From nobody Wed Aug 1 05:17:04 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C010E131057 for ; Wed, 1 Aug 2018 05:17:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.908 X-Spam-Level: X-Spam-Status: No, score=-1.908 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, T_DKIMWL_WL_MED=-0.01, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id C4uJzk5qeqMU for ; Wed, 1 Aug 2018 05:17:00 -0700 (PDT) Received: from mail-lj1-x234.google.com (mail-lj1-x234.google.com [IPv6:2a00:1450:4864:20::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AC015131091 for ; Wed, 1 Aug 2018 05:16:55 -0700 (PDT) Received: by mail-lj1-x234.google.com with SMTP id f1-v6so16674379ljc.9 for ; Wed, 01 Aug 2018 05:16:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=6RvKWjS2UV1BFesVEvYP7hjpueCcAHkXbt2w8s2aO2M=; b=2IV6gNtkFRWJMwrcDe+msseBYn8Wwepv48Vb3riFU3zYya9OHBqk86D7UTnkvIJ5Vr sBMs3xFxGdRGWObzPtcfN3Vnx7nxMQ9NcWWGTadPw9k1k/4ZC0gFrVIJiFtI+Ujs+f9u WjgKr9OMsvhb4gcXndUXiqgWz3rPa/sGaz3dyBmKIoRtx4FQJhWAPODPgYCqyyzhgten 7INCF5CUCqt2SfWh7TJQw58gua4x4idYB9dhNrhhQCML+OiN/yc+1ll/cOneHE8pKlk2 qZ4A6uUX7h8/wE+qjRvPEwlztG/TedvQU6WSherReKLRjHFV70brJtXFjoV3gjgyXr+j TboQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=6RvKWjS2UV1BFesVEvYP7hjpueCcAHkXbt2w8s2aO2M=; b=ko7yWjuJCj0tK520TmUUYjTeyZwfy3XjGF5qRQV8ll8uQa163sqfNHUSE1Cv/we+r2 f2akc95+HhIoKmcCaNd7fZpFEsNxquCGlSTQAfKlJUgAGMidPevqznlkGPvEpVlXw7aE 5658EYifqMc0nMmSEno/S1ixFvjp8WzwFYZxSVPu5aFfH7CSS/S8qO7tFmiJI//IcYBL 2GbUsED44D7dhsKEODGlB8O/Sr88Vz9CVq87kxYQgNvnX31L6BSajadpjr4j6YT8S0g1 ppdE4HHXc4hki/7ce+DOn0ByVG5HEa7PL2urxLDj3d/V6yR5lfjXn/6vSV7hyvKkBNgB m1YQ== X-Gm-Message-State: AOUpUlH828zv0taij9HZ93FEhyg+2kLAs6H1mRqQG1C3QOkbaMeLSsjr CbhnTGIkRtTGU9ptJa5jJz82xtSM78TWT0IKPzNQSg== X-Google-Smtp-Source: AAOMgpf24QzQ/nDP+s1j1rmjmEqTEGzVI7At3w/Zty3F6LJCCd7krY5RNoLZnFEK7pbpX6ro5qJcxv6vAnmCEFm4Zf8= X-Received: by 2002:a2e:1b83:: with SMTP id c3-v6mr18658378ljf.0.1533125813792; Wed, 01 Aug 2018 05:16:53 -0700 (PDT) MIME-Version: 1.0 Received: by 2002:ab3:4091:0:0:0:0:0 with HTTP; Wed, 1 Aug 2018 05:16:13 -0700 (PDT) In-Reply-To: References: <153307887249.3105.12827768403582747815.idtracker@ietfa.amsl.com> From: Eric Rescorla Date: Wed, 1 Aug 2018 05:16:13 -0700 Message-ID: To: Martin Thomson Cc: The IESG , Sean Turner , tls-chairs , draft-ietf-tls-tls13-vectors@ietf.org, "" Content-Type: multipart/alternative; boundary="0000000000008702f605725eab71" Archived-At: Subject: Re: [TLS] Eric Rescorla's No Objection on draft-ietf-tls-tls13-vectors-06: (with COMMENT) X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Aug 2018 12:17:03 -0000 --0000000000008702f605725eab71 Content-Type: text/plain; charset="UTF-8" On Tue, Jul 31, 2018 at 10:03 PM, Martin Thomson wrote: > Thanks for checking on this. I had a couple of bugs with > deduplication that made some of the values unnecessarily repetitious. > There are a few values around Finished calculation that I added (the > values were there already, but you had to extract them from other > values). > > A preview is available (though that uses the draft version numbers and > it doesn't have the Finished values because those changes haven't made > it into NSS yet): > https://tlswg.github.io/draft-ietf-tls-tls13-vectors/draft- > ietf-tls-tls13-vectors.html > > The diff isn't particularly enlightening because the handshakes are > completely different each time, but you should be able to find the > specific changes if you look for them. > > On Wed, Aug 1, 2018 at 9:14 AM Eric Rescorla wrote: > > Has anyone checked these besides MT? > > I wasn't aware that openssl was using them, but Kazu provided a ton of > feedback when building this. > > > COMMENTS > > > salt: (absent) > > > > ARen't we using the convention 0? > > Yes, but "salt: 0" is hard to distinguish from "salt (1 octet): 00", > so I decided to be more explicit. I built special code for this, so > it could say anything; what would you prefer it to say? "(zero)"? I > tend to think that this is OK, but I don't care what it says. > Yes, I think 0 would be better. > > S 3. > > > {server} extract secret "handshake": > > > > > > salt (32 octets): 6f 26 15 a1 08 c7 02 c5 67 8f 54 fc 9d ba > b6 97 > > > 16 c0 76 18 9c 48 25 0c eb ea c3 57 6c 36 11 ba > > > > > > IKM (32 octets): 81 51 d1 46 4c 1b 55 53 36 23 b9 c2 24 6a 6a > 0e > > > > You should specify Z above with the DH. > > The IKM is Z. I didn't see much point in repeating it. Besides, > because this is driven from logging, it would require a whole bunch of > new logging to support recording of the key exchange. > I'm suggesting you manually edit the draft. > > S 3. > > > {server} send a Finished handshake message > > > > Maybe include more of the finished computaitons. > > Yeah, the computed HMAC wasn't logged, so I missed it. If you are > willing to review the change to NSS to log the result > (https://phabricator.services.mozilla.com/D2589), I can include that > in the block explicitly, which is better. > > > S 3. > > > key output (16 octets): 26 79 a4 3e 1d 76 78 40 34 ea 17 97 > d5 ad > > > 26 49 > > > > > > iv info (12 octets): 00 0c 08 74 6c 73 31 33 20 69 76 00 > > > > > > iv output (12 octets): 54 82 40 52 90 dd 0d 2f 81 c0 d9 42 > > > > This is kind of an odd order. > > I don't know how else to order this. > It's odd that we're computing the handshake keys after the application keys. It's just an oddity in NSS. > > S 4. > > > secret (32 octets): 04 8b 40 aa 09 ff d4 c6 76 9c 54 1a 2f 46 > e2 > > > 84 66 06 f7 0d 62 a6 15 97 77 29 c5 b2 81 c7 e7 15 > > > > > > {client} send a ClientHello handshake message > > > > > > {client} calculate finished "tls13 finished": > > > > You should label this as the binder. > > Done. I've added the other inputs to this as well. > > > S 4. > > > output (32 octets): a8 19 28 e3 08 5c 3a 85 63 ed 82 2d a9 af > 7a > > > b7 1a c5 43 2a 5f 9d 1e 6f 71 32 f1 8b 36 e2 c7 05 > > > > > > {client} send handshake record: > > > > > > payload (512 octets): 01 00 01 fc 03 03 88 09 d2 a3 9b f9 ae > b3 > > > > You should explain why this is 512 > > I don't think that it's appropriate to document all the design choices > here; that this is padded is one from many. (It's also very hard to > pick this sort of exceptional condition out for special treatment.) > What's relevant is that the previous one is padded and this is not. I think that's a very appropriate thing to note. As for special treatment, again, you can edit the output. Once this is approved by the IESG, you're not going to be able to regenerate it anyway. -Ekr --0000000000008702f605725eab71 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


On Tue, Jul 31, 2018 at 10:03 PM, Martin Thomson <= martin.thomso= n@gmail.com> wrote:
Thanks = for checking on this.=C2=A0 I had a couple of bugs with
deduplication that made some of the values unnecessarily repetitious.
There are a few values around Finished calculation that I added (the
values were there already, but you had to extract them from other
values).

A preview is available (though that uses the draft version numbers and
it doesn't have the Finished values because those changes haven't m= ade
it into NSS yet):
https://tlswg.= github.io/draft-ietf-tls-tls13-vectors/draft-ietf-tls-tls13-vecto= rs.html

The diff isn't particularly enlightening because the handshakes are
completely different each time, but you should be able to find the
specific changes if you look for them.

On Wed, Aug 1, 2018 at 9:14 AM Eric Rescorla <ekr@rtfm.com> wrote:
> Has anyone checked these besides MT?

I wasn't aware that openssl was using them, but Kazu provided a = ton of
feedback when building this.

> COMMENTS
> >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0salt:=C2=A0 (ab= sent)
>
> ARen't we using the convention 0?

Yes, but "salt: 0" is hard to distinguish from "salt = (1 octet): 00",
so I decided to be more explicit.=C2=A0 I built special code for this, so it could say anything; what would you prefer it to say?=C2=A0 =C2=A0"(= zero)"?=C2=A0 I
tend to think that this is OK, but I don't care what it says.

Yes, I think 0 would be better.

<= /div>

> S 3.
> >=C2=A0 =C2=A0 =C2=A0 {server}=C2=A0 extract secret "handshake= ":
> >
> >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0salt (32 octets):=C2=A0 6f 26 15= a1 08 c7 02 c5 67 8f 54 fc 9d ba b6 97
> >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 16 c0 76 18 9c 48 25 0c = eb ea c3 57 6c 36 11 ba
> >
> >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0IKM (32 octets):=C2=A0 81 51 d1 = 46 4c 1b 55 53 36 23 b9 c2 24 6a 6a 0e
>
> You should specify Z above with the DH.

The IKM is Z.=C2=A0 I didn't see much point in repeating it.=C2= =A0 Besides,
because this is driven from logging, it would require a whole bunch of
new logging to support recording of the key exchange.
=
I'm suggesting you manually edit the draft.
=C2=A0
> S 3.
> >=C2=A0 =C2=A0 =C2=A0 {server}=C2=A0 send a Finish= ed handshake message
>
> Maybe include more of the finished computaitons.

Yeah, the computed HMAC wasn't logged, so I missed it.=C2=A0 If = you are
willing to review the change to NSS to log the result
(https://phabricator.services.mozilla.com/D2589), I can include that
in the block explicitly, which is better.

> S 3.
> >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0key output (16 octets):=C2=A0 26= 79 a4 3e 1d 76 78 40 34 ea 17 97 d5 ad
> >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 26 49
> >
> >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0iv info (12 octets):=C2=A0 00 0c= 08 74 6c 73 31 33 20 69 76 00
> >
> >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0iv output (12 octets):=C2=A0 54 = 82 40 52 90 dd 0d 2f 81 c0 d9 42
>
> This is kind of an odd order.

I don't know how else to order this.

It's odd that we're computing the handshake keys after the= application keys.
It's just an oddity in NSS.
=

> S 4.
> >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0secret (32 octets):=C2=A0 04 8b = 40 aa 09 ff d4 c6 76 9c 54 1a 2f 46 e2
> >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 84 66 06 f7 0d 62 a6 15 = 97 77 29 c5 b2 81 c7 e7 15
> >
> >=C2=A0 =C2=A0 =C2=A0 {client}=C2=A0 send a ClientHello handshake m= essage
> >
> >=C2=A0 =C2=A0 =C2=A0 {client}=C2=A0 calculate finished "tls13= finished":
>
> You should label this as the binder.

Done.=C2=A0 I've added the other inputs to this as well.

> S 4.
> >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0output (32 octets):=C2=A0 a8 19 = 28 e3 08 5c 3a 85 63 ed 82 2d a9 af 7a
> >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 b7 1a c5 43 2a 5f 9d 1e = 6f 71 32 f1 8b 36 e2 c7 05
> >
> >=C2=A0 =C2=A0 =C2=A0 {client}=C2=A0 send handshake record:
> >
> >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0payload (512 octets):=C2=A0 01 0= 0 01 fc 03 03 88 09 d2 a3 9b f9 ae b3
>
> You should explain why this is 512

I don't think that it's appropriate to document all the desi= gn choices
here; that this is padded is one from many.=C2=A0 (It's also very hard = to
pick this sort of exceptional condition out for special treatment.)

What's relevant is that the previous one i= s padded and this is not. I think
that's a very appropriate t= hing to note. As for special treatment, again,
you can edit the o= utput. Once this is approved by the IESG, you're not
going to= be able to regenerate it anyway.


-Ekr

--0000000000008702f605725eab71-- From larry@wolfssl.com Wed Aug 1 12:48:43 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E22BC130E8C for ; Wed, 1 Aug 2018 12:48:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0 X-Spam-Level: X-Spam-Status: No, score=0 tagged_above=-999 required=5 tests=[BAYES_20=-0.001, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iBDmEHz4lQDt for ; Wed, 1 Aug 2018 12:48:42 -0700 (PDT) Received: from p3plsmtpa08-01.prod.phx3.secureserver.net (p3plsmtpa08-01.prod.phx3.secureserver.net [173.201.193.102]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 25DCB130E67 for ; Wed, 1 Aug 2018 12:48:42 -0700 (PDT) Received: from larrys-mbp.fios-router.home ([50.35.97.200]) by :SMTPAUTH: with ESMTPSA id kx6vfwZou9PY4kx6vfWVAp; Wed, 01 Aug 2018 12:48:41 -0700 From: Larry Stefonic Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (Mac OS X Mail 11.4 \(3445.8.2\)) Message-Id: <8D9B1B6B-6918-426E-A359-910ABF0AC152@wolfssl.com> Date: Wed, 1 Aug 2018 12:48:40 -0700 To: tls@ietf.org, Elizabeth Nank X-Mailer: Apple Mail (2.3445.8.2) X-CMAE-Envelope: MS4wfBtUD3jBz81FNE+m8p9PQa9+/n2wUwWvA+1NpXGG6r9cu6F/UpxqELjW2M+jIVqHzc/pO89FaF+W8Y4nni+TMtpaZXJJlHhEgy6VJZeDgkgn94WsV9Jx G/Ln1MAna+8XfdlZgZarjjuaoNkaRPi0P2XnzhK8gK+saUDXOzJ9tO3ncUhABGPA/BXyFd4OGhfPdn8FUDuJyx1gT0XyhLMBze8= Archived-At: Subject: [TLS] TLS 1.3 Stickers X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Aug 2018 19:50:11 -0000 To all of the contributors to the TLS 1.3 process, many thanks! We are = big believers and feel really good about the state of the protocol. A = lot of our consumers are excited to start using it. We=E2=80=99ve taken the TLS 1.3 logo and made a batch of stickers, and = want to share them. If you are going to be at Black Hat next week, stop = by are booth and grab some. We=E2=80=99ll also have them at the other = shows we participate at. If you want us to send you some, then just contact Elizabeth, give her = your address, and we=E2=80=99ll mail them to you! Thanks again to all who have labored to get the protocol to where it is = today! LS Larry Stefonic Founder and CEO www.wolfssl.com http://twitter.com/wolfSSL From nobody Wed Aug 1 18:56:55 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7A3E5124D68 for ; Wed, 1 Aug 2018 18:56:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.75 X-Spam-Level: X-Spam-Status: No, score=-1.75 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_ENVFROM_END_DIGIT=0.25, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mrtds8UXdIcN for ; Wed, 1 Aug 2018 18:56:51 -0700 (PDT) Received: from mail-it0-x243.google.com (mail-it0-x243.google.com [IPv6:2607:f8b0:4001:c0b::243]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CC57D130DCA for ; Wed, 1 Aug 2018 18:56:50 -0700 (PDT) Received: by mail-it0-x243.google.com with SMTP id h23-v6so983950ita.5 for ; Wed, 01 Aug 2018 18:56:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to; bh=g4R0SmQkpIt0qxUAf3R9jIvlM3lvXllz8JOyEVHo8gc=; b=Toc/ygnr1TSNlfinUf3oMRWqpToRFiikBYBTDiKNVotjmrsjJLayxaU/6wwmKzq5vH WgBur4o8kpN/W0+rRi54DX8a4P3E5jkq9O+QCTYlB+pbIDOhuqpeB631/ilqdi38tHkw it6EoIgIb12VID0U9iYvU0IxdMrxFGr0hX1VyLE1D7XBN3xizcAXEXpJET31PcRzKdyD njV1tMFQtfmhCjh9v81WGIG+CqyJTxeF5Dv5FBJmxGxPwUdBH2Gqxp0F2skTCLXl4YKy Akj+q5amBJXzXddZ7bkR8xvUZ6jJQSIyjFaabaWsI0UdvE8S39Hg/qNBdRD3EAgKK5hn Or3g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=g4R0SmQkpIt0qxUAf3R9jIvlM3lvXllz8JOyEVHo8gc=; b=e5tknuCbjFLz8bvin4UhVo6F9TgNsrikzaC3XaiHLHlCppuktJoT4VJiXUqDINpdq/ BKAPT2wBsyoVMjR42VaZfOkYoT78VQkGt4eTdfsp+Lq2I84gSD60g6tjr2l1mSDCEf5J OOd8UHTMlaF2uelQIX5RzPi9Tu6DWien1hX0jqUzTkpfqMO/8u6ehH/9Zp3qw77Zcl+J 1yHwR1aISHu90FxOj+ntNOT0bHQV8wGU1wZq9LnsPQuR/kty9hLsgTI6wHJb5TR8iuQ3 vNBQcTdqwTJL56B4jq8Zq74vX/SeLSrsfLA62qGNJxKfSUIcV6YGoOPv1S8vrsb99RAq I1hg== X-Gm-Message-State: AOUpUlFRLK3/cbJz5rSZHyd9LdLkLrRifoc5OUyXbaH7fopXi8zfkz0I Cb1147GGawXiw97nCZQdTCpw5wg7uYyZDIB3c4p5Zs8SiSY= X-Google-Smtp-Source: AAOMgpcR3j63enG+eCyhYiTClIEuiq409qhwAbSqLuVLE7K9uTzCBv0o439CDG0M4OODl2r88qvivdmMs96HuDGtDE8= X-Received: by 2002:a02:a501:: with SMTP id e1-v6mr680902jam.52.1533175009609; Wed, 01 Aug 2018 18:56:49 -0700 (PDT) MIME-Version: 1.0 From: Christopher Wood Date: Wed, 1 Aug 2018 18:56:38 -0700 Message-ID: To: "" Content-Type: text/plain; charset="UTF-8" Archived-At: Subject: [TLS] Sharing PSKs with TLS 1.2 and 1.3 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Aug 2018 01:56:52 -0000 Hi folks, To address the lingering external PSK issue [1], Ekr proposed some advisory text [2] for applications regarding how they should provision or use PSKs for TLS 1.3 and 1.2. It reads as follows: TLS 1.3 takes a conservative approach to PSKs by binding them to a specific KDF. By contrast, TLS 1.2 allows PSKs to be used with any hash function and the TLS 1.2 PRF. Thus, any PSK which is used with both TLS 1.2 and TLS 1.3 must be used with only one hash in TLS 1.3, which is less than optimal if users want to provision a single PSK. In addition, while constructions in TLS 1.2 and TLS 1.3, although both based on HMAC, are very different and there is no known way in which reuse of the same PSK in TLS 1.3 and TLS 1.2 would produce related output, only limited analysis has been done of the safety of this practice. Implementations can ensure safety from cross-protocol key collisions by not reusing PSKs between TLS 1.3 and TLS 1.2. Future work such as [UNIVERSALPSK] or [SHAREDPSK] may result in a construction with a higher degree of flexibility and cryptographic assurance of key separation. Please have a look and provide feedback on this change by the end of business on Friday. We hope to close on this final issue by then. Thanks, Chris, Joe, and Sean [1] https://www.ietf.org/mail-archive/web/tls/current/msg26693.html [2] https://github.com/tlswg/tls13-rfc/pull/13 From nobody Wed Aug 1 19:01:19 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 288B5130DCA; Wed, 1 Aug 2018 19:01:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nPaYmAuE1Z4a; Wed, 1 Aug 2018 19:01:16 -0700 (PDT) Received: from mail-oi0-x243.google.com (mail-oi0-x243.google.com [IPv6:2607:f8b0:4003:c06::243]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 521F0124D68; Wed, 1 Aug 2018 19:01:16 -0700 (PDT) Received: by mail-oi0-x243.google.com with SMTP id w126-v6so1098244oie.7; Wed, 01 Aug 2018 19:01:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=D4uwgYaDCB7ldbTCFDFPlNCw63Nsaexf+LhadJ5vzYc=; b=t2R0vCwcDX+ZWo1lnaE5JPuJWazJFibpSSz8mfBhbYXwGIIoMMa6tX7qYuRAbRkB8q 5MwZyRwGfe4SVwgPaIo6aIOYXF1fjq6+HLQqu3vCGjWByWZKkEnKwo2Bjr41HSRxJLhW ac3ka2uDnosmfw/gHdnjQhEjlgKRmSNG9isI7q8/sFOPpuhCTZY6uebtZwS6p1WZmkDz 0tG/KXFYZMA3IVTSJTAx9SF/7KUf+HgZs9Ibup/B99Zhz4/8EnGJXF0jTyZfiZ/eLAyk CGsn1P9KZZrCQENLn4M6qjIU3+q6K4ec1+N+6xXreZwJLULUWzzBaPBFSyadIhQyEjd4 s1yA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=D4uwgYaDCB7ldbTCFDFPlNCw63Nsaexf+LhadJ5vzYc=; b=Exza7oyZ+VYLNsyoB+8WTzDaG9IysHv/BRzzWeA5lZxgWzegAFT5qzqRsEfnbQizf0 gHgsrJScGivq9/PqFh98u6tpblTAJ1+c8ZoUAwo0T4IOigl3IEYQ+u6KHG9JoaiQLd9T SpTU3wtWoymsMPpRTKT6vZnNSs+UVd+g4Ytb3pcyr2BNtoTx5py7mkx1bFdyWOA8xIS+ k/o37BkluAMWTgGogH3yHAdC+Zo6iKLOX9XBZVc2+59mb9oiyVRyxD7CAEWHZrQwp25i IO4aJH+xheSV+MWgFChWZm88NOyRrTNCnlgFFp5O/DZd6GWDhzhF09lexfOhipg5ctn3 yckw== X-Gm-Message-State: AOUpUlFkgtcuOo2JNacgvOmUt1z85Zrs8UNxbOyEhjhobn7RY/7eDXsh 5RueH0YKceZHTnAFHdrLPkhW0+2v1My1oBzZhXY= X-Google-Smtp-Source: AAOMgpeFGOVdaEpCUwq1tVHnbGVkrLQz1t0szrp/koysO/NMJZN6X5JldAnL4wb6XTy/f+F1btXg9tdNA+ZXiZ9ccIA= X-Received: by 2002:aca:3d56:: with SMTP id k83-v6mr749228oia.166.1533175275478; Wed, 01 Aug 2018 19:01:15 -0700 (PDT) MIME-Version: 1.0 References: <153307887249.3105.12827768403582747815.idtracker@ietfa.amsl.com> In-Reply-To: From: Martin Thomson Date: Thu, 2 Aug 2018 12:01:06 +1000 Message-ID: To: Eric Rescorla Cc: The IESG , Sean Turner , tls-chairs , draft-ietf-tls-tls13-vectors@ietf.org, "" Content-Type: text/plain; charset="UTF-8" Archived-At: Subject: Re: [TLS] Eric Rescorla's No Objection on draft-ietf-tls-tls13-vectors-06: (with COMMENT) X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Aug 2018 02:01:18 -0000 I'm not excited by editing this, but can do so later. Until all comments have been addressed, I'd like to retain the ability to regenerate the draft as necessary. I've changed the 0 thing, and am OK with the occasional ordering oddity. On Wed, Aug 1, 2018 at 10:16 PM Eric Rescorla wrote: > > > > On Tue, Jul 31, 2018 at 10:03 PM, Martin Thomson wrote: >> >> Thanks for checking on this. I had a couple of bugs with >> deduplication that made some of the values unnecessarily repetitious. >> There are a few values around Finished calculation that I added (the >> values were there already, but you had to extract them from other >> values). >> >> A preview is available (though that uses the draft version numbers and >> it doesn't have the Finished values because those changes haven't made >> it into NSS yet): >> https://tlswg.github.io/draft-ietf-tls-tls13-vectors/draft-ietf-tls-tls13-vectors.html >> >> The diff isn't particularly enlightening because the handshakes are >> completely different each time, but you should be able to find the >> specific changes if you look for them. >> >> On Wed, Aug 1, 2018 at 9:14 AM Eric Rescorla wrote: >> > Has anyone checked these besides MT? >> >> I wasn't aware that openssl was using them, but Kazu provided a ton of >> feedback when building this. >> >> > COMMENTS >> > > salt: (absent) >> > >> > ARen't we using the convention 0? >> >> Yes, but "salt: 0" is hard to distinguish from "salt (1 octet): 00", >> so I decided to be more explicit. I built special code for this, so >> it could say anything; what would you prefer it to say? "(zero)"? I >> tend to think that this is OK, but I don't care what it says. > > > Yes, I think 0 would be better. > >> >> > S 3. >> > > {server} extract secret "handshake": >> > > >> > > salt (32 octets): 6f 26 15 a1 08 c7 02 c5 67 8f 54 fc 9d ba b6 97 >> > > 16 c0 76 18 9c 48 25 0c eb ea c3 57 6c 36 11 ba >> > > >> > > IKM (32 octets): 81 51 d1 46 4c 1b 55 53 36 23 b9 c2 24 6a 6a 0e >> > >> > You should specify Z above with the DH. >> >> The IKM is Z. I didn't see much point in repeating it. Besides, >> because this is driven from logging, it would require a whole bunch of >> new logging to support recording of the key exchange. > > > I'm suggesting you manually edit the draft. > > >> >> > S 3. >> > > {server} send a Finished handshake message >> > >> > Maybe include more of the finished computaitons. >> >> Yeah, the computed HMAC wasn't logged, so I missed it. If you are >> willing to review the change to NSS to log the result >> (https://phabricator.services.mozilla.com/D2589), I can include that >> in the block explicitly, which is better. >> >> > S 3. >> > > key output (16 octets): 26 79 a4 3e 1d 76 78 40 34 ea 17 97 d5 ad >> > > 26 49 >> > > >> > > iv info (12 octets): 00 0c 08 74 6c 73 31 33 20 69 76 00 >> > > >> > > iv output (12 octets): 54 82 40 52 90 dd 0d 2f 81 c0 d9 42 >> > >> > This is kind of an odd order. >> >> I don't know how else to order this. > > > It's odd that we're computing the handshake keys after the application keys. > It's just an oddity in NSS. > >> >> > S 4. >> > > secret (32 octets): 04 8b 40 aa 09 ff d4 c6 76 9c 54 1a 2f 46 e2 >> > > 84 66 06 f7 0d 62 a6 15 97 77 29 c5 b2 81 c7 e7 15 >> > > >> > > {client} send a ClientHello handshake message >> > > >> > > {client} calculate finished "tls13 finished": >> > >> > You should label this as the binder. >> >> Done. I've added the other inputs to this as well. >> >> > S 4. >> > > output (32 octets): a8 19 28 e3 08 5c 3a 85 63 ed 82 2d a9 af 7a >> > > b7 1a c5 43 2a 5f 9d 1e 6f 71 32 f1 8b 36 e2 c7 05 >> > > >> > > {client} send handshake record: >> > > >> > > payload (512 octets): 01 00 01 fc 03 03 88 09 d2 a3 9b f9 ae b3 >> > >> > You should explain why this is 512 >> >> I don't think that it's appropriate to document all the design choices >> here; that this is padded is one from many. (It's also very hard to >> pick this sort of exceptional condition out for special treatment.) > > > What's relevant is that the previous one is padded and this is not. I think > that's a very appropriate thing to note. As for special treatment, again, > you can edit the output. Once this is approved by the IESG, you're not > going to be able to regenerate it anyway. > > > -Ekr > From nobody Wed Aug 1 19:07:43 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3AAA0130DCA for ; Wed, 1 Aug 2018 19:07:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qZaMGTtvVBtZ for ; Wed, 1 Aug 2018 19:07:39 -0700 (PDT) Received: from mail-oi0-x22c.google.com (mail-oi0-x22c.google.com [IPv6:2607:f8b0:4003:c06::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F231C124D68 for ; Wed, 1 Aug 2018 19:07:38 -0700 (PDT) Received: by mail-oi0-x22c.google.com with SMTP id v8-v6so1142825oie.5 for ; Wed, 01 Aug 2018 19:07:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=uV7U5P2ZZngFX/YELKZTXdjavkuVq5y7AhYQBr95sdw=; b=hA0BIGoLlySKurhwu4ysIIpSXF52ATAxTqsDpFkTuHDMpzqPjLGNvrS4nkCL4RMEiM bv42TRSi4kVFoOqHEtW/TJlqsJGEwxVO4z2s47u5Rw2TW5eMvZqxXIs8FJcZHfFJAbCE AmlqBUJbVmhJziFEF2NmohjSD+uh5u48aT9OUF3dl/H/WHvczYgXIoWcukR77N7OS5xH z3ECs0j09JsmSMAUex78nS/QRMosFMVMYLf+5XT0jZWXZFmby+QCA7Q9Wearn+exmawO mwLHZE4UuUGk++FKv1CkFUmW0jrXfyvsuezfiWjNBKm+qQUVApys9O+xVZIRRl5/TXL2 zrPg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=uV7U5P2ZZngFX/YELKZTXdjavkuVq5y7AhYQBr95sdw=; b=I8MD1HIJSS9BeD4jbrydlj6zMXUO2scSGe5Epj3xIM5UtHOTYHhsGjzsQhPGSKPBTO l/RYNRHtJ9LZ0R4j351HUdD0DHhYRseihsyzytmN+yL1RuYKU4zzvu5MrQLGIhkOLu64 FvfgW3UORUPEIqO8fW8p6Am+ixkDJwHSAjFTmZo4Oq7tnC4kMno7NPbZVfBFxK+j/3cr Vqrrmf/G9HFgte7PTqV4vx3rjG+Mbik+3aowGMrGAQlJVMa+4BG91U3GW+Pvv/ZuziNe nqti5uIWfeRTKzjTLgDpLfuOeuGIb2NLKCENYShdneHt1QnMQZ+UYun720Jy/eUy2bqH d/WA== X-Gm-Message-State: AOUpUlGfBNoJDbKJ7sdNyYtT7F3c8lUvRowXIUyYuT4Lpgnu8iED59KE PHzmfYu34CK5V1JM4cCaAfl+PsRnN7rpZQxXPps= X-Google-Smtp-Source: AAOMgpcU/mVupF0i88+QLJRIibYy/swWipPCZ/bJyf1HgQnzA3gbcu5WHFjSD8tFCtVOz3ZxrqQeu1D/4Fk2nRWFVFo= X-Received: by 2002:aca:5155:: with SMTP id f82-v6mr848753oib.272.1533175658174; Wed, 01 Aug 2018 19:07:38 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Martin Thomson Date: Thu, 2 Aug 2018 12:07:29 +1000 Message-ID: To: Christopher Wood Cc: "" Content-Type: text/plain; charset="UTF-8" Archived-At: Subject: Re: [TLS] Sharing PSKs with TLS 1.2 and 1.3 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Aug 2018 02:07:41 -0000 This is the right sentiment. Some editorial comments inline. On Thu, Aug 2, 2018 at 11:57 AM Christopher Wood wrote: > In addition, while constructions in TLS 1.2 and TLS 1.3, although both > based on HMAC, are very different and there is no known way in which > reuse of the same PSK in TLS 1.3 and TLS 1.2 would produce related > output, only limited analysis has been done of the safety of this > practice. I had some difficultly parsing this sentence. I think that it is two: The constructions in TLS 1.2 and TLS 1.3 are different, although they both based on HMAC. Though there is no known way in which the same PSK might produce related output in both versions, only limited analysis has been done. > Future > work such as [UNIVERSALPSK] or [SHAREDPSK] I would avoid citing specific drafts, particularly when we're still unsure about where we want to go (maybe we want both, or neither). I'd strike the "such as" bit here. From nobody Fri Aug 3 14:11:25 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9095B1310E5 for ; Fri, 3 Aug 2018 14:11:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.75 X-Spam-Level: X-Spam-Status: No, score=-1.75 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_ENVFROM_END_DIGIT=0.25, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ma4ef5UKPFrp for ; Fri, 3 Aug 2018 14:11:22 -0700 (PDT) Received: from mail-it0-x22b.google.com (mail-it0-x22b.google.com [IPv6:2607:f8b0:4001:c0b::22b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4C2E8130E64 for ; Fri, 3 Aug 2018 14:11:22 -0700 (PDT) Received: by mail-it0-x22b.google.com with SMTP id d16-v6so6619122itj.0 for ; Fri, 03 Aug 2018 14:11:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=IOSLndqTbKP3wBN5dso+fl1ETUa1QzT4aosmVCgrWY0=; b=XwEZK8Cr0XxTpldG8JQbuERwuoAfWRifmPP9N0kbjM0xj3wcZilsVGVleG9Rm6ggND 8dE0eqtXhT5ihFBwrZBYP89vP7v2hfTZLc5qMVCuvsBWt3JJ3jQ01qBN31ThsGHz97aW 0yiGQ+oHjjpq8N+lq4wppsJJHfaqaFPpC86OsroZcSn3lo130i7ScjzRzy1vswg+yjTx P/u68h0oDtPTWntjmDv5J0LFpfUx7Eo1+WOHu2iiBB7U/nZ3Hg9v3/UBn5FUA4UaYZoA h6KwjIZ4f+hN4OAcu6LSUWoB9gtG2U6ZwVzMaXiokB/0aq38WfEOuRvrSH2SIN5vr2h0 OC8w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=IOSLndqTbKP3wBN5dso+fl1ETUa1QzT4aosmVCgrWY0=; b=cg9tbQr6R+6/njAjW4qQSPG3lfybesWBqs5Miwh4GxmC76kMMnqTJfs7GWMZ+UKxK6 JsO9ZH+20B90S3pfRLgdsY+pdkK+W54AtFnNblngF8by9C11aS31Yujrd6Gjom4ZjnpL 1eoIrqSGsAYfEEfVPsT6rL59MrX9/OaDjAVyIMrKHVMhdL/m7bApOn6z3D/JXC+d2q5Q X139Tk6/YAkISkYLQEpwfPYaz7nKTaib7UfZAlsnPAVMSK4zLfIoEvkeoE8bWVQ2gGBw Clqn+zABXanq+1HYuZ1oI/ukxd/vO9no/wMC1Gie6tO8e6Yuxb5claceKqQfaVdubfQE nb5g== X-Gm-Message-State: AOUpUlGYCYqZE8T6U0iqVxXkBF/QGOXYWSV9BkBO9ls1OUXa4KOaOsK+ zi5q9bKI77070aFMZEL+P9rsCAxk8dRmFHtr/Ig= X-Google-Smtp-Source: AAOMgpexKhJEmAYhaRuYmVx8pNi498PPRScKiXrKkuYXw51E7KNxOGE6yavjIL1Y1NUrPFx0P/xeaiGHhCVr9Pfvnb4= X-Received: by 2002:a24:643:: with SMTP id 64-v6mr8232700itv.109.1533330681400; Fri, 03 Aug 2018 14:11:21 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Christopher Wood Date: Fri, 3 Aug 2018 14:11:09 -0700 Message-ID: To: Martin Thomson Cc: "" Content-Type: text/plain; charset="UTF-8" Archived-At: Subject: Re: [TLS] Sharing PSKs with TLS 1.2 and 1.3 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Aug 2018 21:11:24 -0000 On Wed, Aug 1, 2018 at 7:07 PM Martin Thomson wrote: > > This is the right sentiment. Some editorial comments inline. > > On Thu, Aug 2, 2018 at 11:57 AM Christopher Wood > wrote: > > In addition, while constructions in TLS 1.2 and TLS 1.3, although both > > based on HMAC, are very different and there is no known way in which > > reuse of the same PSK in TLS 1.3 and TLS 1.2 would produce related > > output, only limited analysis has been done of the safety of this > > practice. > > I had some difficultly parsing this sentence. I think that it is two: > > The constructions in TLS 1.2 and TLS 1.3 are different, although they > both based on HMAC. Though there is no known way in which the same > PSK might produce related output in both versions, only limited > analysis has been done. +1 -- this is a nice improvement. > > > Future > > work such as [UNIVERSALPSK] or [SHAREDPSK] > > I would avoid citing specific drafts, particularly when we're still > unsure about where we want to go (maybe we want both, or neither). > I'd strike the "such as" bit here. +1 here too. We might as well remove the entire sentence as it does not add much value without the references. Thanks, Chris (chair hat on) From nobody Mon Aug 6 11:02:29 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 12148130E7D for ; Mon, 6 Aug 2018 11:02:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Eb6jlvVUM2lz for ; Mon, 6 Aug 2018 11:02:25 -0700 (PDT) Received: from mail-oi0-x22a.google.com (mail-oi0-x22a.google.com [IPv6:2607:f8b0:4003:c06::22a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C32D3130EA2 for ; Mon, 6 Aug 2018 11:02:23 -0700 (PDT) Received: by mail-oi0-x22a.google.com with SMTP id q11-v6so23737561oic.12 for ; Mon, 06 Aug 2018 11:02:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to; bh=8Rqrh4G31Dr3/YIMXzUAYpYIKz62YyqiC0OwQwUxPY8=; b=hbr8NxhvVP4xSiu/W3P03MLVYQmMlewXpLI5PFpHsPRhjIHb75WbN9VMB/vzse3UcB fxK7T02j9ehTUjB+med0tu+hWossjBrK3+kLQobq6Dhh2rEgsdD7mdry2zzx/e3xkdXr HgOy3n14Ts3rN/JtJ+Qjblw2vCspAWauhEcF9Sk+4JIdPjG7YUw/ne2aIHlHcgC99gJJ 5cbpZhbcay5YNSMbqiM5UoXlM6GF7+pFghTszIGxtB8XpRyQL+gQCwHydTEiLfNbRW06 DOzN25JYxXMki6zcXiyhJ5Z0rCRifaVWptlzOZRMxEyMe0o9vWgHT6/x2FDuLfnBuH87 V1kQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=8Rqrh4G31Dr3/YIMXzUAYpYIKz62YyqiC0OwQwUxPY8=; b=KqDKCQEj0l426RbOG4unCbF4jovO4LZFHU2bbqJxdaU9VwNwrn7WVUbSVv9F+cXdfS qME6P84RD2EHp9emPNk2c/XpT4TSQ5F16yo0rDat2svjURWkq7jsiq4HyGUzUDPoV7s/ FhsjvVUiTmmUMkCgBj3MC/Y0547DTr8xgAz6Phgl9edlRYHjUcQWVuEbtBSqPOZ4i6H5 epPo5c+KVufbwkuxAk/jrNIH/cUXwDW+GCYQNFHvxa84oLtbKAVg18QfbTvwBAwk0Ms0 WgF27T+8awspaaxYU0G/KQMDkdptIM/omDQ3knWdH4CVS6jhgaaxT0TnA4WGpwKc67UK Er7w== X-Gm-Message-State: AOUpUlGCcs5d2zkUQD+uOuehd12lZaVMvyOsffM7Xbl8vg7CVkh1nPb3 xwuX3bvuC67RzSvfruzhN/w7PpBcZUbxsjXv/8QWp8JP X-Google-Smtp-Source: AAOMgpdBN7chTtaaYg2OtunsNlxVoNc/QIJAzE+oBogW2xf77fdOsE4274SpWPC2i50RgJr6Z5ogcuEzdtbNwVWLXEM= X-Received: by 2002:aca:5f0a:: with SMTP id t10-v6mr14700330oib.337.1533578542837; Mon, 06 Aug 2018 11:02:22 -0700 (PDT) MIME-Version: 1.0 Received: by 2002:a4a:c810:0:0:0:0:0 with HTTP; Mon, 6 Aug 2018 11:01:42 -0700 (PDT) From: Joseph Birr-Pixton Date: Mon, 6 Aug 2018 19:01:42 +0100 Message-ID: To: "" Content-Type: text/plain; charset="UTF-8" Archived-At: Subject: [TLS] 0-RTT profiles X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Aug 2018 18:02:27 -0000 Hello, > Application protocols MUST NOT use 0-RTT data without a profile that defines its use. > That profile needs to identify which messages or interactions are safe to use with 0-RTT > and how to handle the situation when the server rejects 0-RTT and falls back to 1-RTT. 0-RTT has now at least two large deployments on the public internet that I know of. Are there any such "profiles" published or being worked on? Thanks for any pointers. Cheers, Joe From nobody Mon Aug 6 11:16:42 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4176A130EBF for ; Mon, 6 Aug 2018 11:16:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nk2e-rx-xtKD for ; Mon, 6 Aug 2018 11:16:39 -0700 (PDT) Received: from welho-filter1.welho.com (welho-filter1.welho.com [83.102.41.23]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E9F2F130EB3 for ; Mon, 6 Aug 2018 11:16:38 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by welho-filter1.welho.com (Postfix) with ESMTP id 3857A160DD; Mon, 6 Aug 2018 21:16:36 +0300 (EEST) X-Virus-Scanned: Debian amavisd-new at pp.htv.fi Received: from welho-smtp1.welho.com ([IPv6:::ffff:83.102.41.84]) by localhost (welho-filter1.welho.com [::ffff:83.102.41.23]) (amavisd-new, port 10024) with ESMTP id i6-WiuQalb7W; Mon, 6 Aug 2018 21:16:36 +0300 (EEST) Received: from LK-Perkele-VII (87-92-19-27.bb.dnainternet.fi [87.92.19.27]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by welho-smtp1.welho.com (Postfix) with ESMTPSA id ABCC428B; Mon, 6 Aug 2018 21:16:33 +0300 (EEST) Date: Mon, 6 Aug 2018 21:16:33 +0300 From: Ilari Liusvaara To: Joseph Birr-Pixton Cc: "" Message-ID: <20180806181633.GA29670@LK-Perkele-VII> References: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.10.1 (2018-07-13) Sender: ilariliusvaara@welho.com Archived-At: Subject: Re: [TLS] 0-RTT profiles X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Aug 2018 18:16:41 -0000 On Mon, Aug 06, 2018 at 07:01:42PM +0100, Joseph Birr-Pixton wrote: > Hello, > > > Application protocols MUST NOT use 0-RTT data without a profile that defines its use. > > That profile needs to identify which messages or interactions are safe to use with 0-RTT > > and how to handle the situation when the server rejects 0-RTT and falls back to 1-RTT. > > 0-RTT has now at least two large deployments on the public internet > that I know of. Are there any such "profiles" published or being > worked on? The HTTP profile is in RFC-Editor queue (draft-ietf-httpbis-replay). -Ilari From nobody Mon Aug 6 11:20:40 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DE852130EA2 for ; Mon, 6 Aug 2018 11:20:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.711 X-Spam-Level: X-Spam-Status: No, score=-2.711 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=akamai.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id prK-wnN7lSWy for ; Mon, 6 Aug 2018 11:20:37 -0700 (PDT) Received: from mx0a-00190b01.pphosted.com (mx0a-00190b01.pphosted.com [IPv6:2620:100:9001:583::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E61A6130E1C for ; Mon, 6 Aug 2018 11:20:36 -0700 (PDT) Received: from pps.filterd (m0050095.ppops.net [127.0.0.1]) by m0050095.ppops.net-00190b01. (8.16.0.22/8.16.0.22) with SMTP id w76IH7b3032624; Mon, 6 Aug 2018 19:20:36 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=akamai.com; h=date : from : to : cc : subject : message-id : references : mime-version : content-type : in-reply-to; s=jan2016.eng; bh=kK2U9KphwAZlMqI4ztFefd17554Mtd1P+A2m7Tq8E6k=; b=Zj19B9PXfJTnVklk2PkoDVKLTWBvxJCf0Sn7fX4Cuf/wSGdqHwSUiZ84WCovo225fJor I4KWD4hgfRA4Gv+zpdIY5CX92NA5+/KYfVamlUKo8mY2rnVhMRiEVAej2iqn4yE8DEEg rmp/cICIpDz1zVg7iIlrmkYo/CM/EjmsdsvpZb7zHS33a1TsYXgEihNKZ7InNgXE22QG rQIDWhOqZBwnLb9JuBha71addjZhIW3EdLH1/W9q6aKihZe7HPOpLPYSP5evZUUeDPV1 lfn7979BqjfclF7wfCwkq9E78F0+xfb2eVlm68Y3FMglLvFe6P22BUJ4X0ekwq5w8FTl Pw== Received: from prod-mail-ppoint4 (a96-6-114-87.deploy.static.akamaitechnologies.com [96.6.114.87] (may be forged)) by m0050095.ppops.net-00190b01. with ESMTP id 2kn3p372wt-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 06 Aug 2018 19:20:35 +0100 Received: from pps.filterd (prod-mail-ppoint4.akamai.com [127.0.0.1]) by prod-mail-ppoint4.akamai.com (8.16.0.21/8.16.0.21) with SMTP id w76IKJ6K031839; Mon, 6 Aug 2018 14:20:34 -0400 Received: from prod-mail-relay15.akamai.com ([172.27.17.40]) by prod-mail-ppoint4.akamai.com with ESMTP id 2kn7fvqtbe-1; Mon, 06 Aug 2018 14:20:34 -0400 Received: from bos-lpczi.kendall.corp.akamai.com (bos-lpczi.kendall.corp.akamai.com [172.19.17.86]) by prod-mail-relay15.akamai.com (Postfix) with ESMTP id 6663A20070; Mon, 6 Aug 2018 18:20:34 +0000 (GMT) Received: from bkaduk by bos-lpczi.kendall.corp.akamai.com with local (Exim 4.86_2) (envelope-from ) id 1fmk7N-00011g-ID; Mon, 06 Aug 2018 13:20:33 -0500 Date: Mon, 6 Aug 2018 13:20:33 -0500 From: Benjamin Kaduk To: Joseph Birr-Pixton Cc: "" Message-ID: <20180806182033.GO28516@akamai.com> References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.24 (2015-08-30) X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2018-08-06_08:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 mlxscore=0 mlxlogscore=505 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1807170000 definitions=main-1808060191 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2018-08-06_08:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1011 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=548 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1807170000 definitions=main-1808060190 Archived-At: Subject: Re: [TLS] 0-RTT profiles X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Aug 2018 18:20:39 -0000 On Mon, Aug 06, 2018 at 07:01:42PM +0100, Joseph Birr-Pixton wrote: > Hello, > > > Application protocols MUST NOT use 0-RTT data without a profile that defines its use. > > That profile needs to identify which messages or interactions are safe to use with 0-RTT > > and how to handle the situation when the server rejects 0-RTT and falls back to 1-RTT. > > 0-RTT has now at least two large deployments on the public internet > that I know of. Are there any such "profiles" published or being > worked on? draft-ietf-httpbis-replay is in the RFC Editor's queue. -Ben From nobody Mon Aug 6 22:40:21 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7C931130E84; Mon, 6 Aug 2018 22:40:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id woV1zfAL6ApG; Mon, 6 Aug 2018 22:39:57 -0700 (PDT) Received: from rfc-editor.org (rfc-editor.org [4.31.198.49]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E642A130F5F; Mon, 6 Aug 2018 22:39:47 -0700 (PDT) Received: by rfc-editor.org (Postfix, from userid 30) id BBCC1B817EC; Mon, 6 Aug 2018 22:39:44 -0700 (PDT) To: ietf-announce@ietf.org, rfc-dist@rfc-editor.org X-PHP-Originating-Script: 1005:ams_util_lib.php From: rfc-editor@rfc-editor.org Cc: rfc-editor@rfc-editor.org, drafts-update-ref@iana.org, tls@ietf.org Content-type: text/plain; charset=UTF-8 Message-Id: <20180807053944.BBCC1B817EC@rfc-editor.org> Date: Mon, 6 Aug 2018 22:39:44 -0700 (PDT) Archived-At: Subject: [TLS] =?utf-8?q?RFC_8422_on_Elliptic_Curve_Cryptography_=28ECC?= =?utf-8?q?=29_Cipher_Suites_for_Transport_Layer_Security_=28TLS=29_Versio?= =?utf-8?q?ns_1=2E2_and_Earlier?= X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Aug 2018 05:40:10 -0000 A new Request for Comments is now available in online RFC libraries. RFC 8422 Title: Elliptic Curve Cryptography (ECC) Cipher Suites for Transport Layer Security (TLS) Versions 1.2 and Earlier Author: Y. Nir, S. Josefsson, M. Pegourie-Gonnard Status: Standards Track Stream: IETF Date: August 2018 Mailbox: ynir.ietf@gmail.com, simon@josefsson.org, mpg@elzevir.fr Pages: 34 Characters: 69965 Obsoletes: RFC 4492 I-D Tag: draft-ietf-tls-rfc4492bis-17.txt URL: https://www.rfc-editor.org/info/rfc8422 DOI: 10.17487/RFC8422 This document describes key exchange algorithms based on Elliptic Curve Cryptography (ECC) for the Transport Layer Security (TLS) protocol. In particular, it specifies the use of Ephemeral Elliptic Curve Diffie-Hellman (ECDHE) key agreement in a TLS handshake and the use of the Elliptic Curve Digital Signature Algorithm (ECDSA) and Edwards-curve Digital Signature Algorithm (EdDSA) as authentication mechanisms. This document obsoletes RFC 4492. This document is a product of the Transport Layer Security Working Group of the IETF. This is now a Proposed Standard. STANDARDS TRACK: This document specifies an Internet Standards Track protocol for the Internet community, and requests discussion and suggestions for improvements. Please refer to the current edition of the Official Internet Protocol Standards (https://www.rfc-editor.org/standards) for the standardization state and status of this protocol. Distribution of this memo is unlimited. This announcement is sent to the IETF-Announce and rfc-dist lists. To subscribe or unsubscribe, see https://www.ietf.org/mailman/listinfo/ietf-announce https://mailman.rfc-editor.org/mailman/listinfo/rfc-dist For searching the RFC series, see https://www.rfc-editor.org/search For downloading RFCs, see https://www.rfc-editor.org/retrieve/bulk Requests for special distribution should be addressed to either the author of the RFC in question, or to rfc-editor@rfc-editor.org. Unless specifically noted otherwise on the RFC itself, all RFCs are for unlimited distribution. The RFC Editor Team Association Management Solutions, LLC From nobody Tue Aug 7 01:35:47 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8B6FB128B14 for ; Tue, 7 Aug 2018 01:35:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.001 X-Spam-Level: X-Spam-Status: No, score=-5.001 tagged_above=-999 required=5 tests=[BAYES_20=-0.001, RCVD_IN_DNSWL_HI=-5] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jkliq8QcyfOr for ; Tue, 7 Aug 2018 01:35:44 -0700 (PDT) Received: from mta.openssl.org (xmpp.openssl.org [IPv6:2001:608:c00:180::1:e6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7A602126CC7 for ; Tue, 7 Aug 2018 01:35:44 -0700 (PDT) Received: from [10.10.10.6] (ip-36-84-52-196.southampton.uk.amsterdamresidential.com [196.52.84.36]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mta.openssl.org (Postfix) with ESMTPSA id 0CF05E4D2A for ; Tue, 7 Aug 2018 08:35:40 +0000 (UTC) From: Matt Caswell Openpgp: preference=signencrypt Autocrypt: addr=matt@openssl.org; prefer-encrypt=mutual; keydata= xsBNBFGALsIBCADBkh6zfxbewW2KJjaMaishSrpxuiVaUyvWgpe6Moae7JNCW8ayhJbwAtsQ 69SGA4gUkyrR6PBvDMVYEiYqZwXB/3IErStESjcu+gkbmsa0XcwHpkE3iN7I8aU66yMt710n GEmcrR5E4u4NuNoHtnOBKEh+RCLGp5mo6hwbUYUzG3eUI/zi2hLApPpaATXnD3ZkhgtHV3ln 3Z16nUWQAdIVToxYhvVno2EQsqe8Q3ifl2Uf0YpaN19BDBrxM3WPOAKbJk0Ab1bjgEadavrF BCOl9CrbThewRGmkOdxJWaVkERXMShlzUzjJvKOUEUGOxJCmnfQimPQoCdQyVFLgHfRFABEB AAHNH01hdHQgQ2Fzd2VsbCA8bWF0dEBvcGVuc3NsLm9yZz7CwHgEEwECACIFAlPevrwCGwMG CwkIBwMCBhUIAgkKCwQWAgMBAh4BAheAAAoJENnE0m0OYESRoD0H/1lEJXfr66rdvskyOi0z U0ARvUXHjbmmYkZ7ETkdXh7Va/Tjn81T3pwmr3F4IcLGNLDz4Eg67xbq/T8rrsEPOx5nV/mR nUT97UmsQuLnR2wLGbRBu24FKM7oX3KQvgIdJWdxHHJsjpGCViE1mIFARAzlN+6p3tPbnQzA NjRy7i/PYU/niGdqVcMhcnZCX5F7YH6w6t0ZmYH3m1QeREnWqfxu7eyHsIvebMgKTI/bMG8Z 7KlLZha9HwrFXQAPIST6sfc1blKJ9INUDM9iK6DR/ulkw7e0hmHLqjWqYs5PzyXeoNnsPXJt 69wiADYqj4KNDIdNp1RoF9qfb1nE+DM6rgbOwE0EUYAuwgEIAM9nUJAEpsVBYwK92PP9Mlo1 /etXp6JgBI68sOCJxTwzBrbTzIlevVQXqW9zdODD6ObKcgGNuG+G6Nwn54P6McRpd2dxor9Y A+yaI0yT6CVnhxsXjwc/vuQ4tBAL6tfuMAXRVIeEVk22cKk4HJB68ImXCCRdyRi9HIE5iTrZ HsHC4sjAsirhlc0o8hU3gqkKh2Ehwa6+U8lzNx06hoFEZxIVRteoz1jzCHImF7EXztEcDIam O8uckVKAuKbJgFGkU3bkvNgWlc8Pgx4tRUNJGC1LE4nYqaSEwee1SpA/VewiDObj97PozCTF zRCUBCnSvaAlTnpA90TnODH7ar+L5aEAEQEAAcLAXwQYAQIACQUCUYAuwgIbDAAKCRDZxNJt DmBEkQs2B/96XB9hyFpX/bhu41YNr7nSA65dDi9d+PkMqvLppickG3VR4xXWywzEJTw6W2DN MyFO6mOtdXWgNdgDF7HKZYvHBr6pyttLAMP7BfWBvU7YY59uKmUSc5vl0NzsaSbx5PDSQEkS ICLI+/hIwuEXOb6Z7gOrX7F1uy83TmHFOOjD2mLl5isUzFhaLVk0fZSY+mCgg3/inbwb8g31 91Ybk2LfXmndaEsdEzMLrT0g6wIgmybz6UdVuVPfSPGly0VWVAG1sNPOCpAuJpNV6+VxrdVi Ax3vQPbx3XzqDFS1ISlnd0qS/7RXwMuFDpVH/BDvzQcoikWnpRY/loPGkSg4TB7a To: "tls@ietf.org" Message-ID: <60fd3847-ce85-3b59-e9e2-4902582ed058@openssl.org> Date: Tue, 7 Aug 2018 09:35:40 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.9.1 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Language: en-GB Content-Transfer-Encoding: 8bit Archived-At: Subject: [TLS] Alerts after early_data X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Aug 2018 08:35:46 -0000 If a client has sent early_data and later encounters an error before it has sent the end of early data message, should the alert be sent in plaintext, or encrypted using the client_early_traffic secret? The error could occur before or after the client knows whether the server has accepted its early_data. Thanks Matt From nobody Wed Aug 8 04:13:39 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 582E9130DE9 for ; Wed, 8 Aug 2018 04:13:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QMtU06QaLcpL for ; Wed, 8 Aug 2018 04:13:36 -0700 (PDT) Received: from mx1.redhat.com (mx3-rdu2.redhat.com [66.187.233.73]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0F4F7128C65 for ; Wed, 8 Aug 2018 04:13:35 -0700 (PDT) Received: from smtp.corp.redhat.com (int-mx04.intmail.prod.int.rdu2.redhat.com [10.11.54.4]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 6218840241CB; Wed, 8 Aug 2018 11:13:34 +0000 (UTC) Received: from pintsize.usersys.redhat.com (unknown [10.43.21.250]) by smtp.corp.redhat.com (Postfix) with ESMTP id BB07B2027047; Wed, 8 Aug 2018 11:13:33 +0000 (UTC) From: Hubert Kario To: tls@ietf.org Date: Wed, 08 Aug 2018 13:13:32 +0200 Message-ID: <2192054.D06t4ic3VH@pintsize.usersys.redhat.com> In-Reply-To: <60fd3847-ce85-3b59-e9e2-4902582ed058@openssl.org> References: <60fd3847-ce85-3b59-e9e2-4902582ed058@openssl.org> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="nextPart2269617.Gph7zP9vfk"; micalg="pgp-sha512"; protocol="application/pgp-signature" X-Scanned-By: MIMEDefang 2.78 on 10.11.54.4 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.11.55.7]); Wed, 08 Aug 2018 11:13:34 +0000 (UTC) X-Greylist: inspected by milter-greylist-4.5.16 (mx1.redhat.com [10.11.55.7]); Wed, 08 Aug 2018 11:13:34 +0000 (UTC) for IP:'10.11.54.4' DOMAIN:'int-mx04.intmail.prod.int.rdu2.redhat.com' HELO:'smtp.corp.redhat.com' FROM:'hkario@redhat.com' RCPT:'' Archived-At: Subject: Re: [TLS] Alerts after early_data X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 08 Aug 2018 11:13:38 -0000 --nextPart2269617.Gph7zP9vfk Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="UTF-8" On Tuesday, 7 August 2018 10:35:40 CEST Matt Caswell wrote: > If a client has sent early_data and later encounters an error before it > has sent the end of early data message, should the alert be sent in > plaintext, or encrypted using the client_early_traffic secret? The error > could occur before or after the client knows whether the server has > accepted its early_data. I'd say that if the alert is in relation to early_data, it should be encryp= ted=20 with client_early_traffic keys (internal_error, user_canceled), if it is in= =20 relation to ServerHello, it should be in plaintext, and when it is in relat= ion=20 to EncryptedExtensions, Certificate, ..., or Finished message, it may be=20 either in plaintext or encrypted with client_handshake_traffic_secret (of course, plaintext alerts are allowed only until the first record encryp= ted=20 with handshake_traffic_secret keys) logic being, that the purpose of the alert is to tell the other side why th= e=20 connection is being broken, no use of doing that if the other side (or even= an=20 admin using the server's SSLKEYLOGFILE) won't be able to read that message that being said, very strict reading of the draft-28 would indicate that=20 alerts shouldn't be encrypted at all with the client_early_traffic keys: 0-RTT messages sent in the first flight have the same (encrypted) content types as messages of the same type sent in other flights (handshake and application_data) but are protected under different keys. (the "alert" type is not listed) https://tools.ietf.org/html/draft-ietf-tls-tls13-28#page-58 =2D-=20 Regards, Hubert Kario Senior Quality Engineer, QE BaseOS Security team Web: www.cz.redhat.com Red Hat Czech s.r.o., Purky=C5=88ova 115, 612 00 Brno, Czech Republic --nextPart2269617.Gph7zP9vfk Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part. Content-Transfer-Encoding: 7Bit -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEYeeuxEU+3unL/K+dkqjRuAHS9fUFAltq0FwACgkQkqjRuAHS 9fWdig/+MIX2ssgKFqRGnH6R17fFTr3qejD3DcGP1mmf+dGc8Fd/NzvwcGG36pYJ RYOKJSDNRLSvbeyC7rb9ON53wg1TM6IZJMFKYsijsD31SeENtnlexeZOc7qA+eMv /PUPABQYeaCzCAVWguuS801S5oSQC/pdun2vMwSOId53lDt32DQSFSZ9ijXQjqlY aoVGF9kIWDowhjHXmctIUShPMcodyMDXVVOvXirzQRRA3dsEGoIVY8ze1arD1BSi PqSTahQYdleK+4h6tzwZxj01V0L36jQVrWBjnyxhoRVkn5qWZ+g37HbqqyzJZM9U Wh8XRz9Vjw0Zn4OFrkjBRv6RLmSI7Jvv5vUqSgkvQWyZhOkC/uzGhrYCNQt1+yua fmK6BoX8D+ksgj7HnrSOISL5PFs1zTXD4uREw/Vz58D83lfr5lFMESoeBDxa0st0 F5jzR1PeYteAtnr+yewmVkc5LBNzP038aOgokoKIqU7HGga49I7j3h4QwbwB6gF2 4QBQH1ldMm1fhxkSyYG0s7Njd4nw+8N+vNhQ3IBRFQeN5VXLAsIJb7Ws5n8crGp2 jrBtKEjragIoNjDcggMAmehOhxUBm+vZoR3RsdnBxkxFGIj04YHZJtYPib+zTwVw eN5JRQrZLNjqQu66eWefk2mDKEompjgwqTvgO7f5kjpAVGp+1Jw= =AYAp -----END PGP SIGNATURE----- --nextPart2269617.Gph7zP9vfk-- From nobody Wed Aug 8 04:26:38 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 637A1120049 for ; Wed, 8 Aug 2018 04:26:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.9 X-Spam-Level: X-Spam-Status: No, score=-6.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7khBT3BGKosY for ; Wed, 8 Aug 2018 04:26:33 -0700 (PDT) Received: from mta.openssl.org (mta.openssl.org [194.97.150.230]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F09DB128B14 for ; Wed, 8 Aug 2018 04:26:32 -0700 (PDT) Received: from [IPv6:2a00:23c6:2d84:6d00:89f5:897:e397:b05a] (unknown [IPv6:2a00:23c6:2d84:6d00:89f5:897:e397:b05a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mta.openssl.org (Postfix) with ESMTPSA id 1A41FEABA4; Wed, 8 Aug 2018 11:26:30 +0000 (UTC) To: Hubert Kario , tls@ietf.org References: <60fd3847-ce85-3b59-e9e2-4902582ed058@openssl.org> <2192054.D06t4ic3VH@pintsize.usersys.redhat.com> From: Matt Caswell Openpgp: preference=signencrypt Autocrypt: addr=matt@openssl.org; prefer-encrypt=mutual; keydata= xsBNBFGALsIBCADBkh6zfxbewW2KJjaMaishSrpxuiVaUyvWgpe6Moae7JNCW8ayhJbwAtsQ 69SGA4gUkyrR6PBvDMVYEiYqZwXB/3IErStESjcu+gkbmsa0XcwHpkE3iN7I8aU66yMt710n GEmcrR5E4u4NuNoHtnOBKEh+RCLGp5mo6hwbUYUzG3eUI/zi2hLApPpaATXnD3ZkhgtHV3ln 3Z16nUWQAdIVToxYhvVno2EQsqe8Q3ifl2Uf0YpaN19BDBrxM3WPOAKbJk0Ab1bjgEadavrF BCOl9CrbThewRGmkOdxJWaVkERXMShlzUzjJvKOUEUGOxJCmnfQimPQoCdQyVFLgHfRFABEB AAHNH01hdHQgQ2Fzd2VsbCA8bWF0dEBvcGVuc3NsLm9yZz7CwHgEEwECACIFAlPevrwCGwMG CwkIBwMCBhUIAgkKCwQWAgMBAh4BAheAAAoJENnE0m0OYESRoD0H/1lEJXfr66rdvskyOi0z U0ARvUXHjbmmYkZ7ETkdXh7Va/Tjn81T3pwmr3F4IcLGNLDz4Eg67xbq/T8rrsEPOx5nV/mR nUT97UmsQuLnR2wLGbRBu24FKM7oX3KQvgIdJWdxHHJsjpGCViE1mIFARAzlN+6p3tPbnQzA NjRy7i/PYU/niGdqVcMhcnZCX5F7YH6w6t0ZmYH3m1QeREnWqfxu7eyHsIvebMgKTI/bMG8Z 7KlLZha9HwrFXQAPIST6sfc1blKJ9INUDM9iK6DR/ulkw7e0hmHLqjWqYs5PzyXeoNnsPXJt 69wiADYqj4KNDIdNp1RoF9qfb1nE+DM6rgbOwE0EUYAuwgEIAM9nUJAEpsVBYwK92PP9Mlo1 /etXp6JgBI68sOCJxTwzBrbTzIlevVQXqW9zdODD6ObKcgGNuG+G6Nwn54P6McRpd2dxor9Y A+yaI0yT6CVnhxsXjwc/vuQ4tBAL6tfuMAXRVIeEVk22cKk4HJB68ImXCCRdyRi9HIE5iTrZ HsHC4sjAsirhlc0o8hU3gqkKh2Ehwa6+U8lzNx06hoFEZxIVRteoz1jzCHImF7EXztEcDIam O8uckVKAuKbJgFGkU3bkvNgWlc8Pgx4tRUNJGC1LE4nYqaSEwee1SpA/VewiDObj97PozCTF zRCUBCnSvaAlTnpA90TnODH7ar+L5aEAEQEAAcLAXwQYAQIACQUCUYAuwgIbDAAKCRDZxNJt DmBEkQs2B/96XB9hyFpX/bhu41YNr7nSA65dDi9d+PkMqvLppickG3VR4xXWywzEJTw6W2DN MyFO6mOtdXWgNdgDF7HKZYvHBr6pyttLAMP7BfWBvU7YY59uKmUSc5vl0NzsaSbx5PDSQEkS ICLI+/hIwuEXOb6Z7gOrX7F1uy83TmHFOOjD2mLl5isUzFhaLVk0fZSY+mCgg3/inbwb8g31 91Ybk2LfXmndaEsdEzMLrT0g6wIgmybz6UdVuVPfSPGly0VWVAG1sNPOCpAuJpNV6+VxrdVi Ax3vQPbx3XzqDFS1ISlnd0qS/7RXwMuFDpVH/BDvzQcoikWnpRY/loPGkSg4TB7a Message-ID: <51f43090-0c68-d6c0-e0e9-e3f4475e742f@openssl.org> Date: Wed, 8 Aug 2018 12:26:29 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.9.1 MIME-Version: 1.0 In-Reply-To: <2192054.D06t4ic3VH@pintsize.usersys.redhat.com> Content-Type: text/plain; charset=utf-8 Content-Language: en-GB Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [TLS] Alerts after early_data X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 08 Aug 2018 11:26:37 -0000 On 08/08/18 12:13, Hubert Kario wrote: > On Tuesday, 7 August 2018 10:35:40 CEST Matt Caswell wrote: >> If a client has sent early_data and later encounters an error before it >> has sent the end of early data message, should the alert be sent in >> plaintext, or encrypted using the client_early_traffic secret? The error >> could occur before or after the client knows whether the server has >> accepted its early_data. > > I'd say that if the alert is in relation to early_data, it should be encrypted > with client_early_traffic keys (internal_error, user_canceled), if it is in The problem with this is that if the server does not accept the early data then it won't be able to read the alert. From the server's perspective the client will just abort with no alert sent. > that being said, very strict reading of the draft-28 would indicate that > alerts shouldn't be encrypted at all with the client_early_traffic keys: > > 0-RTT messages sent in the first flight have the same (encrypted) > content types as messages of the same type sent in other flights > (handshake and application_data) but are protected under different > keys. > > (the "alert" type is not listed) > https://tools.ietf.org/html/draft-ietf-tls-tls13-28#page-58 > This was my interpretation too (thanks). What I've (now) implemented in OpenSSL is that all alerts from the client are in plaintext until the client_handshake_traffic_secret is in place, and then encrypted from then on. On the server side we tolerate encrypted (with client_early_traffic key or client_handshake_traffic_secret key as appropriate for the context) or unencrypted alerts until we've actually seen a handshake message from the client encrypted with the client_handshake_traffic_secret. From then on, only encrypted alerts are accepted. Matt From nobody Wed Aug 8 04:35:57 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C79F3128C65 for ; Wed, 8 Aug 2018 04:35:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id o_3tvdL3z8Gk for ; Wed, 8 Aug 2018 04:35:54 -0700 (PDT) Received: from mx1.redhat.com (mx3-rdu2.redhat.com [66.187.233.73]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EA407128B14 for ; Wed, 8 Aug 2018 04:35:53 -0700 (PDT) Received: from smtp.corp.redhat.com (int-mx06.intmail.prod.int.rdu2.redhat.com [10.11.54.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 4961E87AAF; Wed, 8 Aug 2018 11:35:53 +0000 (UTC) Received: from pintsize.usersys.redhat.com (unknown [10.43.21.250]) by smtp.corp.redhat.com (Postfix) with ESMTP id B5DCA2166BA0; Wed, 8 Aug 2018 11:35:52 +0000 (UTC) From: Hubert Kario To: Matt Caswell Cc: tls@ietf.org Date: Wed, 08 Aug 2018 13:35:51 +0200 Message-ID: <4264497.RZl5T2Zt9a@pintsize.usersys.redhat.com> In-Reply-To: <51f43090-0c68-d6c0-e0e9-e3f4475e742f@openssl.org> References: <60fd3847-ce85-3b59-e9e2-4902582ed058@openssl.org> <2192054.D06t4ic3VH@pintsize.usersys.redhat.com> <51f43090-0c68-d6c0-e0e9-e3f4475e742f@openssl.org> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="nextPart7950919.Qb32rgY8GR"; micalg="pgp-sha512"; protocol="application/pgp-signature" X-Scanned-By: MIMEDefang 2.78 on 10.11.54.6 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.11.55.1]); Wed, 08 Aug 2018 11:35:53 +0000 (UTC) X-Greylist: inspected by milter-greylist-4.5.16 (mx1.redhat.com [10.11.55.1]); Wed, 08 Aug 2018 11:35:53 +0000 (UTC) for IP:'10.11.54.6' DOMAIN:'int-mx06.intmail.prod.int.rdu2.redhat.com' HELO:'smtp.corp.redhat.com' FROM:'hkario@redhat.com' RCPT:'' Archived-At: Subject: Re: [TLS] Alerts after early_data X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 08 Aug 2018 11:35:56 -0000 --nextPart7950919.Qb32rgY8GR Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="UTF-8" On Wednesday, 8 August 2018 13:26:29 CEST Matt Caswell wrote: > On 08/08/18 12:13, Hubert Kario wrote: > > On Tuesday, 7 August 2018 10:35:40 CEST Matt Caswell wrote: > >> If a client has sent early_data and later encounters an error before it > >> has sent the end of early data message, should the alert be sent in > >> plaintext, or encrypted using the client_early_traffic secret? The err= or > >> could occur before or after the client knows whether the server has > >> accepted its early_data. > >=20 > > I'd say that if the alert is in relation to early_data, it should be > > encrypted with client_early_traffic keys (internal_error, user_canceled= ), > > if it is in > The problem with this is that if the server does not accept the early > data then it won't be able to read the alert. From the server's > perspective the client will just abort with no alert sent. upside is that it makes the ciphertext unusable for replay, as if server is= =20 able to decrypt it, it will automatically abort whether that plays better with EndOfEarlyData handling on server side or no= t=20 depends on implementation =E2=80=93 if implementation wants the application= layer to=20 be able to send data as soon as possible to the client, it may result in co= de=20 returning from handshake before lack of EndOfEarlyData is noted (and still= =20 providing early_data to application) =20 > > that being said, very strict reading of the draft-28 would indicate that > >=20 > > alerts shouldn't be encrypted at all with the client_early_traffic keys: > > 0-RTT messages sent in the first flight have the same (encrypted) > > content types as messages of the same type sent in other flights > > (handshake and application_data) but are protected under different > > keys. > >=20 > > (the "alert" type is not listed) > > https://tools.ietf.org/html/draft-ietf-tls-tls13-28#page-58 >=20 > This was my interpretation too (thanks). What I've (now) implemented in > OpenSSL is that all alerts from the client are in plaintext until the > client_handshake_traffic_secret is in place, and then encrypted from > then on. >=20 > On the server side we tolerate encrypted (with client_early_traffic key > or client_handshake_traffic_secret key as appropriate for the context) > or unencrypted alerts until we've actually seen a handshake message from > the client encrypted with the client_handshake_traffic_secret. From then > on, only encrypted alerts are accepted. sounds like what I had in mind =2D-=20 Regards, Hubert Kario Senior Quality Engineer, QE BaseOS Security team Web: www.cz.redhat.com Red Hat Czech s.r.o., Purky=C5=88ova 115, 612 00 Brno, Czech Republic --nextPart7950919.Qb32rgY8GR Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part. Content-Transfer-Encoding: 7Bit -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEYeeuxEU+3unL/K+dkqjRuAHS9fUFAltq1ZcACgkQkqjRuAHS 9fXygw/9GceK8Bn3v69yxLTeWYGoTBeFG5CgrcJDf22S5hga+IgLclrlbdUCprly hGzP4ganDYaJu6qJ59Jmkl6Rq7f9naaG9eev+250qxmpBLM8GqcZ0trZgXa6O4mo 849IfB0hdQd7WrqdQgOVNohpbNWHQ4QAUqw0ZJg8RpsEoL3CyEt7mpXDYepkiasN zoyzvd8p7Jr5uyMb9tbukPn/MRc2Zpk4X5OWifnYRDbTLtWDSF94hNjLYVrdyX2s cCPw16EsgCm1hx09C5MecGzJE3ziSphKS7/CdPkdas2D+vjaKrYS1QmmmN/bHPxz MqEfB1V0IjOdtojOrmlPBN/dQ91uX7Y7BvtDsMn5joq5ZSpUJAaBWv64syMmgqca YavI69w7lUOeqHlSiW74F580Kvs8mmcRM8ix7bYxnQqpk6HZv0Cp9HmouPmsoRbU yuGYpTtkbuD0Cn3nTZIJLJZpuG5/PJAKtWJPsPiR/aGz6RkqhYL5pwyUA8hns7g8 v+zDQXeXshqVGfw7OXPtZYCDCA/PcGPSBYGea6Deo1tkgy1rqWYxk0T81Fh4N3DV GoJ5e9H7fUNGjY9g4LeoFXrDg2GnQqg7dfIG+uIP1fbhRtkv9wlhv21Nvu6g4MQU bx+cMbpidn3NOUyTOyfYlnKndUrHqnX6F1R9vqMWPMfhE57pEsE= =b9Yu -----END PGP SIGNATURE----- --nextPart7950919.Qb32rgY8GR-- From nobody Wed Aug 8 06:05:08 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6E9E31277CC for ; Wed, 8 Aug 2018 06:05:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.9 X-Spam-Level: X-Spam-Status: No, score=-6.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id g-MR-9skzMIT for ; Wed, 8 Aug 2018 06:05:03 -0700 (PDT) Received: from mta.openssl.org (mta.openssl.org [IPv6:2001:608:c00:180::1:e6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 54A4A1252B7 for ; Wed, 8 Aug 2018 06:05:03 -0700 (PDT) Received: from [IPv6:2a00:23c6:2d84:6d00:89f5:897:e397:b05a] (unknown [IPv6:2a00:23c6:2d84:6d00:89f5:897:e397:b05a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mta.openssl.org (Postfix) with ESMTPSA id 14867EABB6 for ; Wed, 8 Aug 2018 13:05:01 +0000 (UTC) To: "tls@ietf.org" From: Matt Caswell Openpgp: preference=signencrypt Autocrypt: addr=matt@openssl.org; prefer-encrypt=mutual; keydata= xsBNBFGALsIBCADBkh6zfxbewW2KJjaMaishSrpxuiVaUyvWgpe6Moae7JNCW8ayhJbwAtsQ 69SGA4gUkyrR6PBvDMVYEiYqZwXB/3IErStESjcu+gkbmsa0XcwHpkE3iN7I8aU66yMt710n GEmcrR5E4u4NuNoHtnOBKEh+RCLGp5mo6hwbUYUzG3eUI/zi2hLApPpaATXnD3ZkhgtHV3ln 3Z16nUWQAdIVToxYhvVno2EQsqe8Q3ifl2Uf0YpaN19BDBrxM3WPOAKbJk0Ab1bjgEadavrF BCOl9CrbThewRGmkOdxJWaVkERXMShlzUzjJvKOUEUGOxJCmnfQimPQoCdQyVFLgHfRFABEB AAHNH01hdHQgQ2Fzd2VsbCA8bWF0dEBvcGVuc3NsLm9yZz7CwHgEEwECACIFAlPevrwCGwMG CwkIBwMCBhUIAgkKCwQWAgMBAh4BAheAAAoJENnE0m0OYESRoD0H/1lEJXfr66rdvskyOi0z U0ARvUXHjbmmYkZ7ETkdXh7Va/Tjn81T3pwmr3F4IcLGNLDz4Eg67xbq/T8rrsEPOx5nV/mR nUT97UmsQuLnR2wLGbRBu24FKM7oX3KQvgIdJWdxHHJsjpGCViE1mIFARAzlN+6p3tPbnQzA NjRy7i/PYU/niGdqVcMhcnZCX5F7YH6w6t0ZmYH3m1QeREnWqfxu7eyHsIvebMgKTI/bMG8Z 7KlLZha9HwrFXQAPIST6sfc1blKJ9INUDM9iK6DR/ulkw7e0hmHLqjWqYs5PzyXeoNnsPXJt 69wiADYqj4KNDIdNp1RoF9qfb1nE+DM6rgbOwE0EUYAuwgEIAM9nUJAEpsVBYwK92PP9Mlo1 /etXp6JgBI68sOCJxTwzBrbTzIlevVQXqW9zdODD6ObKcgGNuG+G6Nwn54P6McRpd2dxor9Y A+yaI0yT6CVnhxsXjwc/vuQ4tBAL6tfuMAXRVIeEVk22cKk4HJB68ImXCCRdyRi9HIE5iTrZ HsHC4sjAsirhlc0o8hU3gqkKh2Ehwa6+U8lzNx06hoFEZxIVRteoz1jzCHImF7EXztEcDIam O8uckVKAuKbJgFGkU3bkvNgWlc8Pgx4tRUNJGC1LE4nYqaSEwee1SpA/VewiDObj97PozCTF zRCUBCnSvaAlTnpA90TnODH7ar+L5aEAEQEAAcLAXwQYAQIACQUCUYAuwgIbDAAKCRDZxNJt DmBEkQs2B/96XB9hyFpX/bhu41YNr7nSA65dDi9d+PkMqvLppickG3VR4xXWywzEJTw6W2DN MyFO6mOtdXWgNdgDF7HKZYvHBr6pyttLAMP7BfWBvU7YY59uKmUSc5vl0NzsaSbx5PDSQEkS ICLI+/hIwuEXOb6Z7gOrX7F1uy83TmHFOOjD2mLl5isUzFhaLVk0fZSY+mCgg3/inbwb8g31 91Ybk2LfXmndaEsdEzMLrT0g6wIgmybz6UdVuVPfSPGly0VWVAG1sNPOCpAuJpNV6+VxrdVi Ax3vQPbx3XzqDFS1ISlnd0qS/7RXwMuFDpVH/BDvzQcoikWnpRY/loPGkSg4TB7a Message-ID: <2fd24f64-bee5-18ed-cf0d-0fc999add395@openssl.org> Date: Wed, 8 Aug 2018 14:05:00 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.9.1 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Language: en-GB Content-Transfer-Encoding: 7bit Archived-At: Subject: [TLS] inappropriate_fallback X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 08 Aug 2018 13:05:07 -0000 Draft 28 defines the inappropriate_fallback alert as follows: inappropriate_fallback Sent by a server in response to an invalid connection retry attempt from a client With the introduction of the downgrade protection sentinels it now seems that an inappropriate fallback could also be detected by the client. Should this wording be changed? Matt From nobody Wed Aug 8 06:21:56 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DA5EC127598 for ; Wed, 8 Aug 2018 06:21:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.711 X-Spam-Level: X-Spam-Status: No, score=-2.711 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=akamai.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id E2rSxna5HHu0 for ; Wed, 8 Aug 2018 06:21:54 -0700 (PDT) Received: from mx0a-00190b01.pphosted.com (mx0a-00190b01.pphosted.com [IPv6:2620:100:9001:583::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 766CC1252B7 for ; Wed, 8 Aug 2018 06:21:54 -0700 (PDT) Received: from pps.filterd (m0122333.ppops.net [127.0.0.1]) by mx0a-00190b01.pphosted.com (8.16.0.22/8.16.0.22) with SMTP id w78DLsIt005169; Wed, 8 Aug 2018 14:21:54 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=akamai.com; h=date : from : to : cc : subject : message-id : references : mime-version : content-type : in-reply-to; s=jan2016.eng; bh=TanIySC2uwHvvrcbpH0zGKxGday4aolHtmyGe5YYTVE=; b=RmFxv/i1HW3chyrS0fg+yuADi4LyexUEoXxyIO0VSfBF/TOn7Q+wKBoii0m3l5FXENpo JVhzOOLWUH09F9yZSbifCSZOsptFoZsN4sI+b6XG1RGTvC50BSFrEF2tWo0NmqgZe2B+ 8wTtCOqjIGXVRTGBYQ+fdRSyjWNcj+2r3l36LmiEmrhA6biafze9s7e3zn2G5WDocYv1 t/wTGdKPSC9u6H7h6vjPNVMTDNsoobByIhKsEJiiCu0umraRPwg6m3hOlSJIQ/RcJbvN 7hB3gNQAs+59/eTP2JB+YGJAe/Ew+ETOB+Ntg6TrJrF106RoP/yb04bsjTZHCBoUfV8X SA== Received: from prod-mail-ppoint4 (a96-6-114-87.deploy.static.akamaitechnologies.com [96.6.114.87] (may be forged)) by mx0a-00190b01.pphosted.com with ESMTP id 2kqxfwgdcf-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 08 Aug 2018 14:21:53 +0100 Received: from pps.filterd (prod-mail-ppoint4.akamai.com [127.0.0.1]) by prod-mail-ppoint4.akamai.com (8.16.0.21/8.16.0.21) with SMTP id w78DKORe020314; Wed, 8 Aug 2018 09:21:53 -0400 Received: from prod-mail-relay15.akamai.com ([172.27.17.40]) by prod-mail-ppoint4.akamai.com with ESMTP id 2kn7fvy5g7-1; Wed, 08 Aug 2018 09:21:52 -0400 Received: from bos-lpczi.kendall.corp.akamai.com (bos-lpczi.kendall.corp.akamai.com [172.19.17.86]) by prod-mail-relay15.akamai.com (Postfix) with ESMTP id AF31620079; Wed, 8 Aug 2018 13:21:52 +0000 (GMT) Received: from bkaduk by bos-lpczi.kendall.corp.akamai.com with local (Exim 4.86_2) (envelope-from ) id 1fnOPP-0000MQ-R1; Wed, 08 Aug 2018 08:21:51 -0500 Date: Wed, 8 Aug 2018 08:21:51 -0500 From: Benjamin Kaduk To: Matt Caswell Cc: "tls@ietf.org" Message-ID: <20180808132151.GQ28516@akamai.com> References: <2fd24f64-bee5-18ed-cf0d-0fc999add395@openssl.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <2fd24f64-bee5-18ed-cf0d-0fc999add395@openssl.org> User-Agent: Mutt/1.5.24 (2015-08-30) X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2018-08-08_04:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 mlxscore=0 mlxlogscore=534 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1807170000 definitions=main-1808080139 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2018-08-08_04:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=578 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1807170000 definitions=main-1808080139 Archived-At: Subject: Re: [TLS] inappropriate_fallback X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 08 Aug 2018 13:21:56 -0000 On Wed, Aug 08, 2018 at 02:05:00PM +0100, Matt Caswell wrote: > Draft 28 defines the inappropriate_fallback alert as follows: > > inappropriate_fallback Sent by a server in response to an invalid > connection retry attempt from a client > > With the introduction of the downgrade protection sentinels it now seems > that an inappropriate fallback could also be detected by the client. > Should this wording be changed? Well, *fallback* specifically is inherently client-driven; the things the client could detect would be more of an incorrectly negotiated version (presumably due to an active attack). -Ben From nobody Wed Aug 8 06:26:34 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E52AD12785F for ; Wed, 8 Aug 2018 06:26:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.9 X-Spam-Level: X-Spam-Status: No, score=-6.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id H0UvI-P2Va76 for ; Wed, 8 Aug 2018 06:26:30 -0700 (PDT) Received: from mta.openssl.org (mta.openssl.org [194.97.150.230]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8032E1252B7 for ; Wed, 8 Aug 2018 06:26:30 -0700 (PDT) Received: from [IPv6:2a00:23c6:2d84:6d00:89f5:897:e397:b05a] (unknown [IPv6:2a00:23c6:2d84:6d00:89f5:897:e397:b05a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mta.openssl.org (Postfix) with ESMTPSA id 27EB1EABB7; Wed, 8 Aug 2018 13:26:29 +0000 (UTC) To: Benjamin Kaduk Cc: "tls@ietf.org" References: <2fd24f64-bee5-18ed-cf0d-0fc999add395@openssl.org> <20180808132151.GQ28516@akamai.com> From: Matt Caswell Openpgp: preference=signencrypt Autocrypt: addr=matt@openssl.org; prefer-encrypt=mutual; keydata= xsBNBFGALsIBCADBkh6zfxbewW2KJjaMaishSrpxuiVaUyvWgpe6Moae7JNCW8ayhJbwAtsQ 69SGA4gUkyrR6PBvDMVYEiYqZwXB/3IErStESjcu+gkbmsa0XcwHpkE3iN7I8aU66yMt710n GEmcrR5E4u4NuNoHtnOBKEh+RCLGp5mo6hwbUYUzG3eUI/zi2hLApPpaATXnD3ZkhgtHV3ln 3Z16nUWQAdIVToxYhvVno2EQsqe8Q3ifl2Uf0YpaN19BDBrxM3WPOAKbJk0Ab1bjgEadavrF BCOl9CrbThewRGmkOdxJWaVkERXMShlzUzjJvKOUEUGOxJCmnfQimPQoCdQyVFLgHfRFABEB AAHNH01hdHQgQ2Fzd2VsbCA8bWF0dEBvcGVuc3NsLm9yZz7CwHgEEwECACIFAlPevrwCGwMG CwkIBwMCBhUIAgkKCwQWAgMBAh4BAheAAAoJENnE0m0OYESRoD0H/1lEJXfr66rdvskyOi0z U0ARvUXHjbmmYkZ7ETkdXh7Va/Tjn81T3pwmr3F4IcLGNLDz4Eg67xbq/T8rrsEPOx5nV/mR nUT97UmsQuLnR2wLGbRBu24FKM7oX3KQvgIdJWdxHHJsjpGCViE1mIFARAzlN+6p3tPbnQzA NjRy7i/PYU/niGdqVcMhcnZCX5F7YH6w6t0ZmYH3m1QeREnWqfxu7eyHsIvebMgKTI/bMG8Z 7KlLZha9HwrFXQAPIST6sfc1blKJ9INUDM9iK6DR/ulkw7e0hmHLqjWqYs5PzyXeoNnsPXJt 69wiADYqj4KNDIdNp1RoF9qfb1nE+DM6rgbOwE0EUYAuwgEIAM9nUJAEpsVBYwK92PP9Mlo1 /etXp6JgBI68sOCJxTwzBrbTzIlevVQXqW9zdODD6ObKcgGNuG+G6Nwn54P6McRpd2dxor9Y A+yaI0yT6CVnhxsXjwc/vuQ4tBAL6tfuMAXRVIeEVk22cKk4HJB68ImXCCRdyRi9HIE5iTrZ HsHC4sjAsirhlc0o8hU3gqkKh2Ehwa6+U8lzNx06hoFEZxIVRteoz1jzCHImF7EXztEcDIam O8uckVKAuKbJgFGkU3bkvNgWlc8Pgx4tRUNJGC1LE4nYqaSEwee1SpA/VewiDObj97PozCTF zRCUBCnSvaAlTnpA90TnODH7ar+L5aEAEQEAAcLAXwQYAQIACQUCUYAuwgIbDAAKCRDZxNJt DmBEkQs2B/96XB9hyFpX/bhu41YNr7nSA65dDi9d+PkMqvLppickG3VR4xXWywzEJTw6W2DN MyFO6mOtdXWgNdgDF7HKZYvHBr6pyttLAMP7BfWBvU7YY59uKmUSc5vl0NzsaSbx5PDSQEkS ICLI+/hIwuEXOb6Z7gOrX7F1uy83TmHFOOjD2mLl5isUzFhaLVk0fZSY+mCgg3/inbwb8g31 91Ybk2LfXmndaEsdEzMLrT0g6wIgmybz6UdVuVPfSPGly0VWVAG1sNPOCpAuJpNV6+VxrdVi Ax3vQPbx3XzqDFS1ISlnd0qS/7RXwMuFDpVH/BDvzQcoikWnpRY/loPGkSg4TB7a Message-ID: <4fe1cef1-2dd2-3838-9019-a97dd4dbe776@openssl.org> Date: Wed, 8 Aug 2018 14:26:28 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.9.1 MIME-Version: 1.0 In-Reply-To: <20180808132151.GQ28516@akamai.com> Content-Type: text/plain; charset=utf-8 Content-Language: en-GB Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [TLS] inappropriate_fallback X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 08 Aug 2018 13:26:32 -0000 On 08/08/18 14:21, Benjamin Kaduk wrote: > On Wed, Aug 08, 2018 at 02:05:00PM +0100, Matt Caswell wrote: >> Draft 28 defines the inappropriate_fallback alert as follows: >> >> inappropriate_fallback Sent by a server in response to an invalid >> connection retry attempt from a client >> >> With the introduction of the downgrade protection sentinels it now seems >> that an inappropriate fallback could also be detected by the client. >> Should this wording be changed? > > Well, *fallback* specifically is inherently client-driven; the things the > client could detect would be more of an incorrectly negotiated version > (presumably due to an active attack). Consider the scenario where a server supports TLSv1.3/TLSv1.2 but does not support RFC7507 (TLS Fallback Signalling Cipher Suite Value). If the client attempts a TLSv1.3 connection first and fails (e.g. an active attacker prevented it) and then falls back to TLSv1.2 it would be able to detect that its fallback attempt was inappropriate when it sees the downgrade protection sentinels. In that case inappropriate_fallback seems reasonable. Matt From nobody Wed Aug 8 06:46:24 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BFF8C130DBE for ; Wed, 8 Aug 2018 06:46:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.909 X-Spam-Level: X-Spam-Status: No, score=-1.909 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, T_DKIMWL_WL_MED=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id c3QFGcr_ZmfI for ; Wed, 8 Aug 2018 06:46:19 -0700 (PDT) Received: from mail-lf1-x12c.google.com (mail-lf1-x12c.google.com [IPv6:2a00:1450:4864:20::12c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3138112F1A2 for ; Wed, 8 Aug 2018 06:46:19 -0700 (PDT) Received: by mail-lf1-x12c.google.com with SMTP id j8-v6so1628872lfb.4 for ; Wed, 08 Aug 2018 06:46:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=eA5iLOpx7iY1Tbo24OmhIwZiZireChfta4NfL31n+9A=; b=slJ09JZkjlnDcC45d65+hkT5kbzPIuQXx6F7dMoKmGlOBTnDEIMnjAwjyXKI/LBUN5 zMWDaQMpq64dVSkaMy/b7lvyB9u6Ng364BcwXBITeHc6U71O8s0OXfR4to6AFnIBskrc t3oHD7jk5aoEvcTniHH1f42mXJ/W81ShqFvLdQ4qbkYIbhbe8ic9KHHfXZ98XGS6JJvo nnAN8slGgo9FGreGr8+9VhBLkGKyJ5Af9ib0pOgxnqeENZaKcPiYqDq+RKXpTsYxLlLS CDjuSkB+9alx3NbFhTqF0IzID2v6+4SmMC4BRz2TdBKK7TyH02F0LS0bknw8BS/l3qEj lOwg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=eA5iLOpx7iY1Tbo24OmhIwZiZireChfta4NfL31n+9A=; b=KZcN90QFpYc40SHIL5tD67Hh0hnZILTsgYgTsIEMqGkh8tJLd2MyHWKJ7sFWy0LeE2 XCZyJDjvq8oLy/n/rNwtPFvMvQEdaG8p3hzZoa+Wp8MoeNp5qoerSqAnCyVbtuZQlwwz ue/15XYyKDTEoh0dgxllV4zGaCnSfcxhKGehlSnKe1IFikTbGAXfIyrEUHYtAhU8sWcd Ags19WaJyIA8TGvyQWpKyO5EvLRyPYhjuaI8YtAt69acDPSnDV/NX88J4bOjzRlHj3nV bR67mGX0zPkhCsDoJxkHbXCz/sOq60JyNlaaRsVXbgfrSCIvEjtUEAHPGlKk3FdPx8Lv TjjQ== X-Gm-Message-State: AOUpUlF7OteO5oCRV5eFW5be6yylAHHSt17QhvWZn8acRnyQ7RyUIk54 90FjjNTZe2W07H0MPmiv0ynMe0jkTh0WJRivLj/HhQ== X-Google-Smtp-Source: AA+uWPwQ11Vs05VPMJlp3Tj0bM2EXXWNgowygdnpJybgYrQdHgHrASi7jJ5fUHSp5gh9NEaUtg49gmH9FBZGCs163TM= X-Received: by 2002:a19:c403:: with SMTP id u3-v6mr1981462lff.87.1533735977365; Wed, 08 Aug 2018 06:46:17 -0700 (PDT) MIME-Version: 1.0 Received: by 2002:ab3:4091:0:0:0:0:0 with HTTP; Wed, 8 Aug 2018 06:45:36 -0700 (PDT) In-Reply-To: <4fe1cef1-2dd2-3838-9019-a97dd4dbe776@openssl.org> References: <2fd24f64-bee5-18ed-cf0d-0fc999add395@openssl.org> <20180808132151.GQ28516@akamai.com> <4fe1cef1-2dd2-3838-9019-a97dd4dbe776@openssl.org> From: Eric Rescorla Date: Wed, 8 Aug 2018 06:45:36 -0700 Message-ID: To: Matt Caswell Cc: Benjamin Kaduk , "tls@ietf.org" Content-Type: multipart/alternative; boundary="0000000000001c470b0572ecbc1c" Archived-At: Subject: Re: [TLS] inappropriate_fallback X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 08 Aug 2018 13:46:22 -0000 --0000000000001c470b0572ecbc1c Content-Type: text/plain; charset="UTF-8" On Wed, Aug 8, 2018 at 6:26 AM, Matt Caswell wrote: > > > On 08/08/18 14:21, Benjamin Kaduk wrote: > > On Wed, Aug 08, 2018 at 02:05:00PM +0100, Matt Caswell wrote: > >> Draft 28 defines the inappropriate_fallback alert as follows: > >> > >> inappropriate_fallback Sent by a server in response to an invalid > >> connection retry attempt from a client > >> > >> With the introduction of the downgrade protection sentinels it now seems > >> that an inappropriate fallback could also be detected by the client. > >> Should this wording be changed? > > > > Well, *fallback* specifically is inherently client-driven; the things the > > client could detect would be more of an incorrectly negotiated version > > (presumably due to an active attack). > > Consider the scenario where a server supports TLSv1.3/TLSv1.2 but does > not support RFC7507 (TLS Fallback Signalling Cipher Suite Value). > > If the client attempts a TLSv1.3 connection first and fails (e.g. an > active attacker prevented it) and then falls back to TLSv1.2 it would be > able to detect that its fallback attempt was inappropriate when it sees > the downgrade protection sentinels. In that case inappropriate_fallback > seems reasonable. > I don't think that is the alert I would choose in this circumstance. Probably "illegal_parameter" -Ekr > Matt > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > --0000000000001c470b0572ecbc1c Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


On Wed, Aug 8, 2018 at 6:26 AM, Matt Caswell <matt@openssl.org><= /span> wrote:


On 08/08/18 14:21, Benjamin Kaduk wrote:
> On Wed, Aug 08, 2018 at 02:05:00PM +0100, Matt Caswell wrote:
>> Draft 28 defines the inappropriate_fallback alert as follows:
>>
>> inappropriate_fallback=C2=A0 Sent by a server in response to an in= valid
>>=C2=A0 =C2=A0 =C2=A0 =C2=A0connection retry attempt from a client >>
>> With the introduction of the downgrade protection sentinels it now= seems
>> that an inappropriate fallback could also be detected by the clien= t.
>> Should this wording be changed?
>
> Well, *fallback* specifically is inherently client-driven; the things = the
> client could detect would be more of an incorrectly negotiated version=
> (presumably due to an active attack).

Consider the scenario where a server supports TLSv1.3/TLSv1.2 but do= es
not support RFC7507 (TLS Fallback Signalling Cipher Suite Value).

If the client attempts a TLSv1.3 connection first and fails (e.g. an
active attacker prevented it) and then falls back to TLSv1.2 it would be able to detect that its fallback attempt was inappropriate when it sees
the downgrade protection sentinels. In that case inappropriate_fallback
seems reasonable.

I don't think tha= t is the alert I would choose in this circumstance. Probably "illegal_= parameter"

-Ekr


Matt

_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls

--0000000000001c470b0572ecbc1c-- From nobody Wed Aug 8 06:52:34 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D3004130DC2 for ; Wed, 8 Aug 2018 06:52:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.9 X-Spam-Level: X-Spam-Status: No, score=-6.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XKJMfvmdgJyx for ; Wed, 8 Aug 2018 06:52:30 -0700 (PDT) Received: from mta.openssl.org (mta.openssl.org [IPv6:2001:608:c00:180::1:e6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 02921130DBE for ; Wed, 8 Aug 2018 06:52:30 -0700 (PDT) Received: from [IPv6:2a00:23c6:2d84:6d00:89f5:897:e397:b05a] (unknown [IPv6:2a00:23c6:2d84:6d00:89f5:897:e397:b05a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mta.openssl.org (Postfix) with ESMTPSA id 5EF9FEABB7; Wed, 8 Aug 2018 13:52:28 +0000 (UTC) To: Eric Rescorla Cc: Benjamin Kaduk , "tls@ietf.org" References: <2fd24f64-bee5-18ed-cf0d-0fc999add395@openssl.org> <20180808132151.GQ28516@akamai.com> <4fe1cef1-2dd2-3838-9019-a97dd4dbe776@openssl.org> From: Matt Caswell Openpgp: preference=signencrypt Autocrypt: addr=matt@openssl.org; prefer-encrypt=mutual; keydata= xsBNBFGALsIBCADBkh6zfxbewW2KJjaMaishSrpxuiVaUyvWgpe6Moae7JNCW8ayhJbwAtsQ 69SGA4gUkyrR6PBvDMVYEiYqZwXB/3IErStESjcu+gkbmsa0XcwHpkE3iN7I8aU66yMt710n GEmcrR5E4u4NuNoHtnOBKEh+RCLGp5mo6hwbUYUzG3eUI/zi2hLApPpaATXnD3ZkhgtHV3ln 3Z16nUWQAdIVToxYhvVno2EQsqe8Q3ifl2Uf0YpaN19BDBrxM3WPOAKbJk0Ab1bjgEadavrF BCOl9CrbThewRGmkOdxJWaVkERXMShlzUzjJvKOUEUGOxJCmnfQimPQoCdQyVFLgHfRFABEB AAHNH01hdHQgQ2Fzd2VsbCA8bWF0dEBvcGVuc3NsLm9yZz7CwHgEEwECACIFAlPevrwCGwMG CwkIBwMCBhUIAgkKCwQWAgMBAh4BAheAAAoJENnE0m0OYESRoD0H/1lEJXfr66rdvskyOi0z U0ARvUXHjbmmYkZ7ETkdXh7Va/Tjn81T3pwmr3F4IcLGNLDz4Eg67xbq/T8rrsEPOx5nV/mR nUT97UmsQuLnR2wLGbRBu24FKM7oX3KQvgIdJWdxHHJsjpGCViE1mIFARAzlN+6p3tPbnQzA NjRy7i/PYU/niGdqVcMhcnZCX5F7YH6w6t0ZmYH3m1QeREnWqfxu7eyHsIvebMgKTI/bMG8Z 7KlLZha9HwrFXQAPIST6sfc1blKJ9INUDM9iK6DR/ulkw7e0hmHLqjWqYs5PzyXeoNnsPXJt 69wiADYqj4KNDIdNp1RoF9qfb1nE+DM6rgbOwE0EUYAuwgEIAM9nUJAEpsVBYwK92PP9Mlo1 /etXp6JgBI68sOCJxTwzBrbTzIlevVQXqW9zdODD6ObKcgGNuG+G6Nwn54P6McRpd2dxor9Y A+yaI0yT6CVnhxsXjwc/vuQ4tBAL6tfuMAXRVIeEVk22cKk4HJB68ImXCCRdyRi9HIE5iTrZ HsHC4sjAsirhlc0o8hU3gqkKh2Ehwa6+U8lzNx06hoFEZxIVRteoz1jzCHImF7EXztEcDIam O8uckVKAuKbJgFGkU3bkvNgWlc8Pgx4tRUNJGC1LE4nYqaSEwee1SpA/VewiDObj97PozCTF zRCUBCnSvaAlTnpA90TnODH7ar+L5aEAEQEAAcLAXwQYAQIACQUCUYAuwgIbDAAKCRDZxNJt DmBEkQs2B/96XB9hyFpX/bhu41YNr7nSA65dDi9d+PkMqvLppickG3VR4xXWywzEJTw6W2DN MyFO6mOtdXWgNdgDF7HKZYvHBr6pyttLAMP7BfWBvU7YY59uKmUSc5vl0NzsaSbx5PDSQEkS ICLI+/hIwuEXOb6Z7gOrX7F1uy83TmHFOOjD2mLl5isUzFhaLVk0fZSY+mCgg3/inbwb8g31 91Ybk2LfXmndaEsdEzMLrT0g6wIgmybz6UdVuVPfSPGly0VWVAG1sNPOCpAuJpNV6+VxrdVi Ax3vQPbx3XzqDFS1ISlnd0qS/7RXwMuFDpVH/BDvzQcoikWnpRY/loPGkSg4TB7a Message-ID: Date: Wed, 8 Aug 2018 14:52:27 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.9.1 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Language: en-GB Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [TLS] inappropriate_fallback X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 08 Aug 2018 13:52:32 -0000 On 08/08/18 14:45, Eric Rescorla wrote: > > > On Wed, Aug 8, 2018 at 6:26 AM, Matt Caswell > wrote: > > > > On 08/08/18 14:21, Benjamin Kaduk wrote: > > On Wed, Aug 08, 2018 at 02:05:00PM +0100, Matt Caswell wrote: > >> Draft 28 defines the inappropriate_fallback alert as follows: > >> > >> inappropriate_fallback  Sent by a server in response to an invalid > >>       connection retry attempt from a client > >> > >> With the introduction of the downgrade protection sentinels it now seems > >> that an inappropriate fallback could also be detected by the client. > >> Should this wording be changed? > > > > Well, *fallback* specifically is inherently client-driven; the things the > > client could detect would be more of an incorrectly negotiated version > > (presumably due to an active attack). > > Consider the scenario where a server supports TLSv1.3/TLSv1.2 but does > not support RFC7507 (TLS Fallback Signalling Cipher Suite Value). > > If the client attempts a TLSv1.3 connection first and fails (e.g. an > active attacker prevented it) and then falls back to TLSv1.2 it would be > able to detect that its fallback attempt was inappropriate when it sees > the downgrade protection sentinels. In that case inappropriate_fallback > seems reasonable. > > > I don't think that is the alert I would choose in this circumstance. > Probably "illegal_parameter" illegal_parameter suggests to me that the peer is misbehaving in some way - which isn't the case here? Also it seems strange that we would have a more explicit alert than the generic illegal_parameter, that seems to precisely describe the scenario (a fallback occurred, and it turns out it was inappropriate) but not be able to use it. Matt > > -Ekr > > > Matt > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > > > From nobody Wed Aug 8 07:02:07 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 59DA4130DC0 for ; Wed, 8 Aug 2018 07:02:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.711 X-Spam-Level: X-Spam-Status: No, score=-2.711 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=akamai.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uz9sWmqMlE5B for ; Wed, 8 Aug 2018 07:02:03 -0700 (PDT) Received: from mx0a-00190b01.pphosted.com (mx0a-00190b01.pphosted.com [IPv6:2620:100:9001:583::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AE59C127598 for ; Wed, 8 Aug 2018 07:02:03 -0700 (PDT) Received: from pps.filterd (m0050095.ppops.net [127.0.0.1]) by m0050095.ppops.net-00190b01. (8.16.0.22/8.16.0.22) with SMTP id w78E23rP028255; Wed, 8 Aug 2018 15:02:03 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=akamai.com; h=date : from : to : cc : subject : message-id : references : mime-version : content-type : content-transfer-encoding : in-reply-to; s=jan2016.eng; bh=IlFUZtSmz/qt6CTC5Yyf2nDC7Jk/tuA8jmcmcf3C6QM=; b=LFxH1Z3jrXgHzG4BTtbCs7J1U0CE79IRnTT1WO52xJH9+zkZTq/ejtEpwGXLPKV0baBW qDreR2DC0rZ4f4zktd9cP6lVYA2PTiPBvIniMeMC7Unqi0uZo8yc1MxZoW15jJSscdoW oB8d0bxMETdglrBI+ROxG/5It3Wva7a6rqnK2o9IDvAvtsoQTnbwzIijuflDFTtyQriL RZrOFyrZTG9TQCpEvH+armyzuOfAOjEntaV/ngaqNYoxT8iDnCObHTOHtv7ds2jFtJ6U UaaVAf0CdO3tnUfJq+aOY3DQsLV0HUDHR5pLTpPgprnba/8jXdTpz74W5+YIzM+wWMYd RQ== Received: from prod-mail-ppoint3 (a96-6-114-86.deploy.static.akamaitechnologies.com [96.6.114.86] (may be forged)) by m0050095.ppops.net-00190b01. with ESMTP id 2kqy8qgd9m-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 08 Aug 2018 15:02:02 +0100 Received: from pps.filterd (prod-mail-ppoint3.akamai.com [127.0.0.1]) by prod-mail-ppoint3.akamai.com (8.16.0.21/8.16.0.21) with SMTP id w78Do5r6013994; Wed, 8 Aug 2018 10:02:00 -0400 Received: from prod-mail-relay14.akamai.com ([172.27.17.39]) by prod-mail-ppoint3.akamai.com with ESMTP id 2kn7gc77xc-1; Wed, 08 Aug 2018 10:02:00 -0400 Received: from bos-lpczi.kendall.corp.akamai.com (bos-lpczi.kendall.corp.akamai.com [172.19.17.86]) by prod-mail-relay14.akamai.com (Postfix) with ESMTP id 78EDB817EC; Wed, 8 Aug 2018 14:02:00 +0000 (GMT) Received: from bkaduk by bos-lpczi.kendall.corp.akamai.com with local (Exim 4.86_2) (envelope-from ) id 1fnP2F-0000aZ-GH; Wed, 08 Aug 2018 09:01:59 -0500 Date: Wed, 8 Aug 2018 09:01:59 -0500 From: Benjamin Kaduk To: Matt Caswell Cc: Eric Rescorla , "tls@ietf.org" Message-ID: <20180808140159.GR28516@akamai.com> References: <2fd24f64-bee5-18ed-cf0d-0fc999add395@openssl.org> <20180808132151.GQ28516@akamai.com> <4fe1cef1-2dd2-3838-9019-a97dd4dbe776@openssl.org> MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: User-Agent: Mutt/1.5.24 (2015-08-30) X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2018-08-08_04:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 mlxscore=0 mlxlogscore=467 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1807170000 definitions=main-1808080143 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2018-08-08_04:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=482 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1807170000 definitions=main-1808080146 Archived-At: Subject: Re: [TLS] inappropriate_fallback X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 08 Aug 2018 14:02:06 -0000 On Wed, Aug 08, 2018 at 02:52:27PM +0100, Matt Caswell wrote: > > > On 08/08/18 14:45, Eric Rescorla wrote: > > > > > > On Wed, Aug 8, 2018 at 6:26 AM, Matt Caswell > > wrote: > > > > > > > > On 08/08/18 14:21, Benjamin Kaduk wrote: > > > On Wed, Aug 08, 2018 at 02:05:00PM +0100, Matt Caswell wrote: > > >> Draft 28 defines the inappropriate_fallback alert as follows: > > >> > > >> inappropriate_fallback  Sent by a server in response to an invalid > > >>       connection retry attempt from a client > > >> > > >> With the introduction of the downgrade protection sentinels it now seems > > >> that an inappropriate fallback could also be detected by the client. > > >> Should this wording be changed? > > > > > > Well, *fallback* specifically is inherently client-driven; the things the > > > client could detect would be more of an incorrectly negotiated version > > > (presumably due to an active attack). > > > > Consider the scenario where a server supports TLSv1.3/TLSv1.2 but does > > not support RFC7507 (TLS Fallback Signalling Cipher Suite Value). > > > > If the client attempts a TLSv1.3 connection first and fails (e.g. an > > active attacker prevented it) and then falls back to TLSv1.2 it would be > > able to detect that its fallback attempt was inappropriate when it sees > > the downgrade protection sentinels. In that case inappropriate_fallback > > seems reasonable. > > > > > > I don't think that is the alert I would choose in this circumstance. > > Probably "illegal_parameter" > > illegal_parameter suggests to me that the peer is misbehaving in some > way - which isn't the case here? Also it seems strange that we would > have a more explicit alert than the generic illegal_parameter, that > seems to precisely describe the scenario (a fallback occurred, and it > turns out it was inappropriate) but not be able to use it. Aren't the semantics here "whoops, I made a new connection attempt that I shouldn't have; let me go back out of that"? In which case one could argue even for close_notify... -Ben From nobody Wed Aug 8 07:05:40 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C15B6130DCC for ; Wed, 8 Aug 2018 07:05:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.9 X-Spam-Level: X-Spam-Status: No, score=-6.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id u2CfI5l0sk2k for ; Wed, 8 Aug 2018 07:05:37 -0700 (PDT) Received: from mta.openssl.org (xmpp.openssl.org [194.97.150.230]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 84C66130DC2 for ; Wed, 8 Aug 2018 07:05:37 -0700 (PDT) Received: from [10.30.10.6] (ip-55-84-52-196.southampton.uk.amsterdamresidential.com [196.52.84.55]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mta.openssl.org (Postfix) with ESMTPSA id B6D9DEABB7; Wed, 8 Aug 2018 14:05:35 +0000 (UTC) To: Benjamin Kaduk Cc: Eric Rescorla , "tls@ietf.org" References: <2fd24f64-bee5-18ed-cf0d-0fc999add395@openssl.org> <20180808132151.GQ28516@akamai.com> <4fe1cef1-2dd2-3838-9019-a97dd4dbe776@openssl.org> <20180808140159.GR28516@akamai.com> From: Matt Caswell Openpgp: preference=signencrypt Autocrypt: addr=matt@openssl.org; prefer-encrypt=mutual; keydata= xsBNBFGALsIBCADBkh6zfxbewW2KJjaMaishSrpxuiVaUyvWgpe6Moae7JNCW8ayhJbwAtsQ 69SGA4gUkyrR6PBvDMVYEiYqZwXB/3IErStESjcu+gkbmsa0XcwHpkE3iN7I8aU66yMt710n GEmcrR5E4u4NuNoHtnOBKEh+RCLGp5mo6hwbUYUzG3eUI/zi2hLApPpaATXnD3ZkhgtHV3ln 3Z16nUWQAdIVToxYhvVno2EQsqe8Q3ifl2Uf0YpaN19BDBrxM3WPOAKbJk0Ab1bjgEadavrF BCOl9CrbThewRGmkOdxJWaVkERXMShlzUzjJvKOUEUGOxJCmnfQimPQoCdQyVFLgHfRFABEB AAHNH01hdHQgQ2Fzd2VsbCA8bWF0dEBvcGVuc3NsLm9yZz7CwHgEEwECACIFAlPevrwCGwMG CwkIBwMCBhUIAgkKCwQWAgMBAh4BAheAAAoJENnE0m0OYESRoD0H/1lEJXfr66rdvskyOi0z U0ARvUXHjbmmYkZ7ETkdXh7Va/Tjn81T3pwmr3F4IcLGNLDz4Eg67xbq/T8rrsEPOx5nV/mR nUT97UmsQuLnR2wLGbRBu24FKM7oX3KQvgIdJWdxHHJsjpGCViE1mIFARAzlN+6p3tPbnQzA NjRy7i/PYU/niGdqVcMhcnZCX5F7YH6w6t0ZmYH3m1QeREnWqfxu7eyHsIvebMgKTI/bMG8Z 7KlLZha9HwrFXQAPIST6sfc1blKJ9INUDM9iK6DR/ulkw7e0hmHLqjWqYs5PzyXeoNnsPXJt 69wiADYqj4KNDIdNp1RoF9qfb1nE+DM6rgbOwE0EUYAuwgEIAM9nUJAEpsVBYwK92PP9Mlo1 /etXp6JgBI68sOCJxTwzBrbTzIlevVQXqW9zdODD6ObKcgGNuG+G6Nwn54P6McRpd2dxor9Y A+yaI0yT6CVnhxsXjwc/vuQ4tBAL6tfuMAXRVIeEVk22cKk4HJB68ImXCCRdyRi9HIE5iTrZ HsHC4sjAsirhlc0o8hU3gqkKh2Ehwa6+U8lzNx06hoFEZxIVRteoz1jzCHImF7EXztEcDIam O8uckVKAuKbJgFGkU3bkvNgWlc8Pgx4tRUNJGC1LE4nYqaSEwee1SpA/VewiDObj97PozCTF zRCUBCnSvaAlTnpA90TnODH7ar+L5aEAEQEAAcLAXwQYAQIACQUCUYAuwgIbDAAKCRDZxNJt DmBEkQs2B/96XB9hyFpX/bhu41YNr7nSA65dDi9d+PkMqvLppickG3VR4xXWywzEJTw6W2DN MyFO6mOtdXWgNdgDF7HKZYvHBr6pyttLAMP7BfWBvU7YY59uKmUSc5vl0NzsaSbx5PDSQEkS ICLI+/hIwuEXOb6Z7gOrX7F1uy83TmHFOOjD2mLl5isUzFhaLVk0fZSY+mCgg3/inbwb8g31 91Ybk2LfXmndaEsdEzMLrT0g6wIgmybz6UdVuVPfSPGly0VWVAG1sNPOCpAuJpNV6+VxrdVi Ax3vQPbx3XzqDFS1ISlnd0qS/7RXwMuFDpVH/BDvzQcoikWnpRY/loPGkSg4TB7a Message-ID: <58fcf99d-8bbe-dba1-02c0-6472f1be93d1@openssl.org> Date: Wed, 8 Aug 2018 15:05:34 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.9.1 MIME-Version: 1.0 In-Reply-To: <20180808140159.GR28516@akamai.com> Content-Type: text/plain; charset=utf-8 Content-Language: en-GB Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [TLS] inappropriate_fallback X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 08 Aug 2018 14:05:40 -0000 On 08/08/18 15:01, Benjamin Kaduk wrote: > On Wed, Aug 08, 2018 at 02:52:27PM +0100, Matt Caswell wrote: >> >> >> On 08/08/18 14:45, Eric Rescorla wrote: >>> >>> >>> On Wed, Aug 8, 2018 at 6:26 AM, Matt Caswell >> > wrote: >>> >>> >>> >>> On 08/08/18 14:21, Benjamin Kaduk wrote: >>> > On Wed, Aug 08, 2018 at 02:05:00PM +0100, Matt Caswell wrote: >>> >> Draft 28 defines the inappropriate_fallback alert as follows: >>> >> >>> >> inappropriate_fallback  Sent by a server in response to an invalid >>> >>       connection retry attempt from a client >>> >> >>> >> With the introduction of the downgrade protection sentinels it now seems >>> >> that an inappropriate fallback could also be detected by the client. >>> >> Should this wording be changed? >>> > >>> > Well, *fallback* specifically is inherently client-driven; the things the >>> > client could detect would be more of an incorrectly negotiated version >>> > (presumably due to an active attack). >>> >>> Consider the scenario where a server supports TLSv1.3/TLSv1.2 but does >>> not support RFC7507 (TLS Fallback Signalling Cipher Suite Value). >>> >>> If the client attempts a TLSv1.3 connection first and fails (e.g. an >>> active attacker prevented it) and then falls back to TLSv1.2 it would be >>> able to detect that its fallback attempt was inappropriate when it sees >>> the downgrade protection sentinels. In that case inappropriate_fallback >>> seems reasonable. >>> >>> >>> I don't think that is the alert I would choose in this circumstance. >>> Probably "illegal_parameter" >> >> illegal_parameter suggests to me that the peer is misbehaving in some >> way - which isn't the case here? Also it seems strange that we would >> have a more explicit alert than the generic illegal_parameter, that >> seems to precisely describe the scenario (a fallback occurred, and it >> turns out it was inappropriate) but not be able to use it. > > Aren't the semantics here "whoops, I made a new connection attempt that > I shouldn't have; let me go back out of that"? In which case one could > argue even for close_notify... Well, it is an error condition. The client is expecting this to be ok and it isn't and has to abruptly close. close_notify doesn't seem like a good match to me. Matt From nobody Wed Aug 8 07:06:46 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1771C130DC2 for ; Wed, 8 Aug 2018 07:06:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.909 X-Spam-Level: X-Spam-Status: No, score=-1.909 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, T_DKIMWL_WL_MED=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NqHa0ROCerwa for ; Wed, 8 Aug 2018 07:06:43 -0700 (PDT) Received: from mail-lf1-x134.google.com (mail-lf1-x134.google.com [IPv6:2a00:1450:4864:20::134]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A818F127598 for ; Wed, 8 Aug 2018 07:06:42 -0700 (PDT) Received: by mail-lf1-x134.google.com with SMTP id f135-v6so1659321lfg.10 for ; Wed, 08 Aug 2018 07:06:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=fGg8w1x6SQEy+zSjVmk+gDzlKIW+q9ALnCo9vsOeafY=; b=XZwL/xSuO29ur+NFXUh/rl4aO77MLmkAcmpWYuUe2q4fG1mFk4sDeU3EBnxeRrj5T+ VzEZumPnwkbpSQC+ByALkm7M1FeC9fZxqttFGKZjeUgkwHJ3U90kasEbRqiTwLIBqTcp nNTws9ei3E7f/9389WxG1oAEgYECTuQPslIKoE5gPtfUjXIlRkP/7B31vjKP1EXiP6uv OlusVUCH3I2A8rD9yU1o4Hmx2eGNvkN+v0lNWdx59ik9WgtxKvAxH+Kl6mX5BLFI3NpF pjSbgD1vhnn6pMAGJD60I0iR228CwC4v4aAWbkjPMbA+MV4AvVBuV5oJu8dTrt6a1nhu b5ew== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=fGg8w1x6SQEy+zSjVmk+gDzlKIW+q9ALnCo9vsOeafY=; b=brvRngsu5SSr03dM309qQnyPpFSKlbvu0w12vfRKksVvr8B7/LAhJxOlYN/quC8oyd CsE6qc+i6stSsG9MjQr08VrAnM/Z6GuuI61xm7czQIoBk+EcSzYKIj9QyXrkuD8Sbx2i 2evaNedcJMBNQMq4pNv2LDP/0RwoKzGF8Ii3jNjVTUJOb4zP3IQme8Jy+AyTZIdLlMIy PyTBK+Bt2Iw26+vX5JobtbpMx+nI9rpCkg9dC13+FAN6kMCTPu+Q7131perqAC+Jbs3w hh68HVvSOEnkXA/ZdpdiH/oh7Oe5w+MnjHlI57Mjgyj1rZ7cy+cdjC06wCwyrhHluZRS IZfw== X-Gm-Message-State: AOUpUlGskXWTXihutSJq6s3KqsRtt2FjGwzOmu2vNi5pW9VDvKLoh85X RRpjhlykRDIrQ3P1GzRZ53GZz6w+sPcZAikXf6mAyuZX X-Google-Smtp-Source: AA+uWPzellpBed0trX/LYYowzLx5sJUM+qIhdCYwlKsrmzol+L2lfvm3pYKxBph4ATFTWj0j5Dm0Lgcrh4IhWWuPZXY= X-Received: by 2002:a19:7403:: with SMTP id v3-v6mr562766lfe.97.1533737200981; Wed, 08 Aug 2018 07:06:40 -0700 (PDT) MIME-Version: 1.0 Received: by 2002:ab3:4091:0:0:0:0:0 with HTTP; Wed, 8 Aug 2018 07:06:00 -0700 (PDT) In-Reply-To: <20180808140159.GR28516@akamai.com> References: <2fd24f64-bee5-18ed-cf0d-0fc999add395@openssl.org> <20180808132151.GQ28516@akamai.com> <4fe1cef1-2dd2-3838-9019-a97dd4dbe776@openssl.org> <20180808140159.GR28516@akamai.com> From: Eric Rescorla Date: Wed, 8 Aug 2018 07:06:00 -0700 Message-ID: To: Benjamin Kaduk Cc: Matt Caswell , "tls@ietf.org" Content-Type: multipart/alternative; boundary="0000000000000b2e900572ed0524" Archived-At: Subject: Re: [TLS] inappropriate_fallback X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 08 Aug 2018 14:06:45 -0000 --0000000000000b2e900572ed0524 Content-Type: text/plain; charset="UTF-8" The spec is actually extremely clear on this point https://tools.ietf.org/html/draft-ietf-tls-tls13-28#section-4.1.3 TLS 1.3 clients receiving a ServerHello indicating TLS 1.2 or below MUST check that the last 8 bytes are not equal to either of these values. TLS 1.2 clients SHOULD also check that the last 8 bytes are not equal to the second value if the ServerHello indicates TLS 1.1 or below. If a match is found, the client MUST abort the handshake with an "illegal_parameter" alert. I think it's way late to change it. -Ekr On Wed, Aug 8, 2018 at 7:01 AM, Benjamin Kaduk wrote: > On Wed, Aug 08, 2018 at 02:52:27PM +0100, Matt Caswell wrote: > > > > > > On 08/08/18 14:45, Eric Rescorla wrote: > > > > > > > > > On Wed, Aug 8, 2018 at 6:26 AM, Matt Caswell > > > wrote: > > > > > > > > > > > > On 08/08/18 14:21, Benjamin Kaduk wrote: > > > > On Wed, Aug 08, 2018 at 02:05:00PM +0100, Matt Caswell wrote: > > > >> Draft 28 defines the inappropriate_fallback alert as follows: > > > >> > > > >> inappropriate_fallback Sent by a server in response to an > invalid > > > >> connection retry attempt from a client > > > >> > > > >> With the introduction of the downgrade protection sentinels it > now seems > > > >> that an inappropriate fallback could also be detected by the > client. > > > >> Should this wording be changed? > > > > > > > > Well, *fallback* specifically is inherently client-driven; the > things the > > > > client could detect would be more of an incorrectly negotiated > version > > > > (presumably due to an active attack). > > > > > > Consider the scenario where a server supports TLSv1.3/TLSv1.2 but > does > > > not support RFC7507 (TLS Fallback Signalling Cipher Suite Value). > > > > > > If the client attempts a TLSv1.3 connection first and fails (e.g. > an > > > active attacker prevented it) and then falls back to TLSv1.2 it > would be > > > able to detect that its fallback attempt was inappropriate when it > sees > > > the downgrade protection sentinels. In that case > inappropriate_fallback > > > seems reasonable. > > > > > > > > > I don't think that is the alert I would choose in this circumstance. > > > Probably "illegal_parameter" > > > > illegal_parameter suggests to me that the peer is misbehaving in some > > way - which isn't the case here? Also it seems strange that we would > > have a more explicit alert than the generic illegal_parameter, that > > seems to precisely describe the scenario (a fallback occurred, and it > > turns out it was inappropriate) but not be able to use it. > > Aren't the semantics here "whoops, I made a new connection attempt that > I shouldn't have; let me go back out of that"? In which case one could > argue even for close_notify... > > -Ben > --0000000000000b2e900572ed0524 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
The spec is actually extremely clear on this point

=C2=A0= =C2=A0 TLS 1.3 clients receiving a ServerHello indicating TLS 1.2 or below<= br>=C2=A0=C2=A0 MUST check that the last 8 bytes are not equal to either of= these
=C2=A0=C2=A0 values.=C2=A0 TLS 1.2 clients SHOULD also check that= the last 8 bytes are
=C2=A0=C2=A0 not equal to the second value if the = ServerHello indicates TLS 1.1 or
=C2=A0=C2=A0 below.=C2=A0 If a match is= found, the client MUST abort the handshake with
=C2=A0=C2=A0 an "i= llegal_parameter" alert.

I think it'= s way late to change it.

-Ekr

<= /div>




On Wed, Aug 8, 2018 at 7:01 AM, Benjamin K= aduk <bkaduk@akamai.com> wrote:
On Wed, Aug 08, 2018 at 02:52:27PM +0100, Matt Caswell wrote= :
>
>
> On 08/08/18 14:45, Eric Rescorla wrote:
> >
> >
> > On Wed, Aug 8, 2018 at 6:26 AM, Matt Caswell <matt@openssl.org
> > <mailto:= matt@openssl.org>> wrote:
> >
> >
> >
> >=C2=A0 =C2=A0 =C2=A0On 08/08/18 14:21, Benjamin Kaduk wrote:
> >=C2=A0 =C2=A0 =C2=A0> On Wed, Aug 08, 2018 at 02:05:00PM +0100,= Matt Caswell wrote:
> >=C2=A0 =C2=A0 =C2=A0>> Draft 28 defines the inappropriate_fa= llback alert as follows:
> >=C2=A0 =C2=A0 =C2=A0>>
> >=C2=A0 =C2=A0 =C2=A0>> inappropriate_fallback=C2=A0 Sent by = a server in response to an invalid
> >=C2=A0 =C2=A0 =C2=A0>>=C2=A0 =C2=A0 =C2=A0 =C2=A0connection = retry attempt from a client
> >=C2=A0 =C2=A0 =C2=A0>>
> >=C2=A0 =C2=A0 =C2=A0>> With the introduction of the downgrad= e protection sentinels it now seems
> >=C2=A0 =C2=A0 =C2=A0>> that an inappropriate fallback could = also be detected by the client.
> >=C2=A0 =C2=A0 =C2=A0>> Should this wording be changed?
> >=C2=A0 =C2=A0 =C2=A0>
> >=C2=A0 =C2=A0 =C2=A0> Well, *fallback* specifically is inherent= ly client-driven; the things the
> >=C2=A0 =C2=A0 =C2=A0> client could detect would be more of an i= ncorrectly negotiated version
> >=C2=A0 =C2=A0 =C2=A0> (presumably due to an active attack).
> >
> >=C2=A0 =C2=A0 =C2=A0Consider the scenario where a server supports = TLSv1.3/TLSv1.2 but does
> >=C2=A0 =C2=A0 =C2=A0not support RFC7507 (TLS Fallback Signalling C= ipher Suite Value).
> >
> >=C2=A0 =C2=A0 =C2=A0If the client attempts a TLSv1.3 connection fi= rst and fails (e.g. an
> >=C2=A0 =C2=A0 =C2=A0active attacker prevented it) and then falls b= ack to TLSv1.2 it would be
> >=C2=A0 =C2=A0 =C2=A0able to detect that its fallback attempt was i= nappropriate when it sees
> >=C2=A0 =C2=A0 =C2=A0the downgrade protection sentinels. In that ca= se inappropriate_fallback
> >=C2=A0 =C2=A0 =C2=A0seems reasonable.
> >
> >
> > I don't think that is the alert I would choose in this circum= stance.
> > Probably "illegal_parameter"
>
> illegal_parameter suggests to me that the peer is misbehaving in some<= br> > way - which isn't the case here? Also it seems strange that we wou= ld
> have a more explicit alert than the generic illegal_parameter, that > seems to precisely describe the scenario (a fallback occurred, and it<= br> > turns out it was inappropriate) but not be able to use it.

Aren't the semantics here "whoops, I made a new connec= tion attempt that
I shouldn't have; let me go back out of that"?=C2=A0 In which case= one could
argue even for close_notify...

-Ben

--0000000000000b2e900572ed0524-- From nobody Wed Aug 8 07:11:20 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1088A130DD0 for ; Wed, 8 Aug 2018 07:11:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.9 X-Spam-Level: X-Spam-Status: No, score=-6.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mOmg8H0Othh0 for ; Wed, 8 Aug 2018 07:11:17 -0700 (PDT) Received: from mta.openssl.org (mta.openssl.org [IPv6:2001:608:c00:180::1:e6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6550A1294D0 for ; Wed, 8 Aug 2018 07:11:17 -0700 (PDT) Received: from [IPv6:2a00:23c6:2d84:6d00:89f5:897:e397:b05a] (unknown [IPv6:2a00:23c6:2d84:6d00:89f5:897:e397:b05a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mta.openssl.org (Postfix) with ESMTPSA id F1C59EABB7; Wed, 8 Aug 2018 14:11:15 +0000 (UTC) To: Eric Rescorla , Benjamin Kaduk Cc: "tls@ietf.org" References: <2fd24f64-bee5-18ed-cf0d-0fc999add395@openssl.org> <20180808132151.GQ28516@akamai.com> <4fe1cef1-2dd2-3838-9019-a97dd4dbe776@openssl.org> <20180808140159.GR28516@akamai.com> From: Matt Caswell Openpgp: preference=signencrypt Autocrypt: addr=matt@openssl.org; prefer-encrypt=mutual; keydata= xsBNBFGALsIBCADBkh6zfxbewW2KJjaMaishSrpxuiVaUyvWgpe6Moae7JNCW8ayhJbwAtsQ 69SGA4gUkyrR6PBvDMVYEiYqZwXB/3IErStESjcu+gkbmsa0XcwHpkE3iN7I8aU66yMt710n GEmcrR5E4u4NuNoHtnOBKEh+RCLGp5mo6hwbUYUzG3eUI/zi2hLApPpaATXnD3ZkhgtHV3ln 3Z16nUWQAdIVToxYhvVno2EQsqe8Q3ifl2Uf0YpaN19BDBrxM3WPOAKbJk0Ab1bjgEadavrF BCOl9CrbThewRGmkOdxJWaVkERXMShlzUzjJvKOUEUGOxJCmnfQimPQoCdQyVFLgHfRFABEB AAHNH01hdHQgQ2Fzd2VsbCA8bWF0dEBvcGVuc3NsLm9yZz7CwHgEEwECACIFAlPevrwCGwMG CwkIBwMCBhUIAgkKCwQWAgMBAh4BAheAAAoJENnE0m0OYESRoD0H/1lEJXfr66rdvskyOi0z U0ARvUXHjbmmYkZ7ETkdXh7Va/Tjn81T3pwmr3F4IcLGNLDz4Eg67xbq/T8rrsEPOx5nV/mR nUT97UmsQuLnR2wLGbRBu24FKM7oX3KQvgIdJWdxHHJsjpGCViE1mIFARAzlN+6p3tPbnQzA NjRy7i/PYU/niGdqVcMhcnZCX5F7YH6w6t0ZmYH3m1QeREnWqfxu7eyHsIvebMgKTI/bMG8Z 7KlLZha9HwrFXQAPIST6sfc1blKJ9INUDM9iK6DR/ulkw7e0hmHLqjWqYs5PzyXeoNnsPXJt 69wiADYqj4KNDIdNp1RoF9qfb1nE+DM6rgbOwE0EUYAuwgEIAM9nUJAEpsVBYwK92PP9Mlo1 /etXp6JgBI68sOCJxTwzBrbTzIlevVQXqW9zdODD6ObKcgGNuG+G6Nwn54P6McRpd2dxor9Y A+yaI0yT6CVnhxsXjwc/vuQ4tBAL6tfuMAXRVIeEVk22cKk4HJB68ImXCCRdyRi9HIE5iTrZ HsHC4sjAsirhlc0o8hU3gqkKh2Ehwa6+U8lzNx06hoFEZxIVRteoz1jzCHImF7EXztEcDIam O8uckVKAuKbJgFGkU3bkvNgWlc8Pgx4tRUNJGC1LE4nYqaSEwee1SpA/VewiDObj97PozCTF zRCUBCnSvaAlTnpA90TnODH7ar+L5aEAEQEAAcLAXwQYAQIACQUCUYAuwgIbDAAKCRDZxNJt DmBEkQs2B/96XB9hyFpX/bhu41YNr7nSA65dDi9d+PkMqvLppickG3VR4xXWywzEJTw6W2DN MyFO6mOtdXWgNdgDF7HKZYvHBr6pyttLAMP7BfWBvU7YY59uKmUSc5vl0NzsaSbx5PDSQEkS ICLI+/hIwuEXOb6Z7gOrX7F1uy83TmHFOOjD2mLl5isUzFhaLVk0fZSY+mCgg3/inbwb8g31 91Ybk2LfXmndaEsdEzMLrT0g6wIgmybz6UdVuVPfSPGly0VWVAG1sNPOCpAuJpNV6+VxrdVi Ax3vQPbx3XzqDFS1ISlnd0qS/7RXwMuFDpVH/BDvzQcoikWnpRY/loPGkSg4TB7a Message-ID: <5fca0e59-1649-9a49-766b-adacf9e4ea60@openssl.org> Date: Wed, 8 Aug 2018 15:11:15 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.9.1 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Language: en-GB Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [TLS] inappropriate_fallback X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 08 Aug 2018 14:11:19 -0000 On 08/08/18 15:06, Eric Rescorla wrote: > The spec is actually extremely clear on this point > https://tools.ietf.org/html/draft-ietf-tls-tls13-28#section-4.1.3 > > >    TLS 1.3 clients receiving a ServerHello indicating TLS 1.2 or below >    MUST check that the last 8 bytes are not equal to either of these >    values.  TLS 1.2 clients SHOULD also check that the last 8 bytes are >    not equal to the second value if the ServerHello indicates TLS 1.1 or >    below.  If a match is found, the client MUST abort the handshake with >    an "illegal_parameter" alert. In this case the client is acting as a TLS 1.2 client so I don't think that this paragraph applies. Matt From nobody Wed Aug 8 07:22:16 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 16159130E20 for ; Wed, 8 Aug 2018 07:22:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.909 X-Spam-Level: X-Spam-Status: No, score=-1.909 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, T_DKIMWL_WL_MED=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZwKNOnN2KBRZ for ; Wed, 8 Aug 2018 07:22:13 -0700 (PDT) Received: from mail-lf1-x136.google.com (mail-lf1-x136.google.com [IPv6:2a00:1450:4864:20::136]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E29B2130E0D for ; Wed, 8 Aug 2018 07:22:12 -0700 (PDT) Received: by mail-lf1-x136.google.com with SMTP id f18-v6so1721007lfc.2 for ; Wed, 08 Aug 2018 07:22:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=PkNP9AqDEt2Bt3wVolWQmlKAGh3p+JmQVwbrrNz28tA=; b=EGnC/L9DuuuHPibl692CqG40GD+giJzSFNkts6P0vR1bh68YCDwq2wwt/UxbqCkNep qBjfzgRdQgaOL361GqCn7vCXKCQJVbyxfz2cd075ivpnAUaZ1wmUyhP/6WZPLoK8Zq1L Rt9lQNhmslIaHJE2nKQa0d0odbKzsQyFdQyn08kVvbjYfezyWbuTIwHDgXmI3DTzbNqe odw7g4FdStv8QMZ+sbpPxM6fjTnHi50vAuzcTZOwicSzHhWpHyM/Ten5TPDNoMoWCPzl etsGL+h9hnMEag2wERUj+XQhF7o/XMQ7sPzLxwuVr/W9ILOCBq3HvUsELxdPvW8nAC4b AxZg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=PkNP9AqDEt2Bt3wVolWQmlKAGh3p+JmQVwbrrNz28tA=; b=iLC0PlgCtbKuVbbowI2X2t8L9WPtne2bvYfnATtrI2ywh7FUrSrMp0O6QqhM7tPHbZ z/bnOYdenAnm4p211Ob/vUjYvzpLDEhlYrS08DRhUOLMu3lCpVABPPgP3RhX4dIPCyjP twThbRLlJE4fP3Su0XWcJ8F/hwuQAEHiSMsQDIyATZRyNSKdcistG6A9Rsk7J8tzawoR 9GpdHYdoLKr0RZ5opXsJvuO7n3SeP6Y/H4gtp4vSk+9HpfUNf1iKuaT5CXAXyTn+KsYT m1Q1PnxO3wypXIjmN5sJzPBgDo/clVPsfPDCfAx+CTGXcJolnMi2rlK5ICmrAbKKRHi4 liuA== X-Gm-Message-State: AOUpUlGbInXkimExkxby2a7pn3106Eja+Ej1iHOWDBi1ymMYbKO0LMEp oAe50djbEpqHGtvazGyqqRRBFCvE8ifr+HiAr5jHe8PU X-Google-Smtp-Source: AA+uWPzzqINrFju7Y+ayjzY4n1tk6kaigcl20UFplikv+utZcR9spUJwEBMDawN4lTrXjVuxnFLVM9didS7IYdA9i9s= X-Received: by 2002:a19:7403:: with SMTP id v3-v6mr597309lfe.97.1533738131183; Wed, 08 Aug 2018 07:22:11 -0700 (PDT) MIME-Version: 1.0 Received: by 2002:ab3:4091:0:0:0:0:0 with HTTP; Wed, 8 Aug 2018 07:21:30 -0700 (PDT) In-Reply-To: <5fca0e59-1649-9a49-766b-adacf9e4ea60@openssl.org> References: <2fd24f64-bee5-18ed-cf0d-0fc999add395@openssl.org> <20180808132151.GQ28516@akamai.com> <4fe1cef1-2dd2-3838-9019-a97dd4dbe776@openssl.org> <20180808140159.GR28516@akamai.com> <5fca0e59-1649-9a49-766b-adacf9e4ea60@openssl.org> From: Eric Rescorla Date: Wed, 8 Aug 2018 07:21:30 -0700 Message-ID: To: Matt Caswell Cc: Benjamin Kaduk , "tls@ietf.org" Content-Type: multipart/alternative; boundary="0000000000007cea380572ed3c3d" Archived-At: Subject: Re: [TLS] inappropriate_fallback X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 08 Aug 2018 14:22:15 -0000 --0000000000007cea380572ed3c3d Content-Type: text/plain; charset="UTF-8" On Wed, Aug 8, 2018 at 7:11 AM, Matt Caswell wrote: > > > On 08/08/18 15:06, Eric Rescorla wrote: > > The spec is actually extremely clear on this point > > https://tools.ietf.org/html/draft-ietf-tls-tls13-28#section-4.1.3 > > > > > > TLS 1.3 clients receiving a ServerHello indicating TLS 1.2 or below > > MUST check that the last 8 bytes are not equal to either of these > > values. TLS 1.2 clients SHOULD also check that the last 8 bytes are > > not equal to the second value if the ServerHello indicates TLS 1.1 or > > below. If a match is found, the client MUST abort the handshake with > > an "illegal_parameter" alert. > > In this case the client is acting as a TLS 1.2 client so I don't think > that this paragraph applies. > Well, not quite. It's a TLS 1.3 implementation that has sent a TLS 1.2 CH, but that looks the same to the server as an active downgrade. This text was is in fact intended to cover this case -- and that's how NSS interprets it -- though perhaps it's not as explicit as one would like. Regardless, I think illegal_parameter is a reasonable alert to send, especially as sending a separate alert in the case of fallback and of active downgrade is a pain. -Ekr > Matt > > --0000000000007cea380572ed3c3d Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


On Wed, Aug 8, 2018 at 7:11 AM, Matt Caswell <matt@openssl.org><= /span> wrote:


On 08/08/18 15:06, Eric Rescorla wrote:
> The spec is actually extremely clear on this point
> https://tools.ietf.org/html/dr= aft-ietf-tls-tls13-28#section-4.1.3
> <https://tools.ietf.org/htm= l/draft-ietf-tls-tls13-28#section-4.1.3>
>
> =C2=A0=C2=A0 TLS 1.3 clients receiving a ServerHello indicating TLS 1.= 2 or below
> =C2=A0=C2=A0 MUST check that the last 8 bytes are not equal to either = of these
> =C2=A0=C2=A0 values.=C2=A0 TLS 1.2 clients SHOULD also check that the = last 8 bytes are
> =C2=A0=C2=A0 not equal to the second value if the ServerHello indicate= s TLS 1.1 or
> =C2=A0=C2=A0 below.=C2=A0 If a match is found, the client MUST abort t= he handshake with
> =C2=A0=C2=A0 an "illegal_parameter" alert.

In this case the client is acting as a TLS 1.2 client so I don't= think
that this paragraph applies.

Well, not = quite. It's a TLS 1.3 implementation that has sent a TLS 1.2 CH, but th= at looks the same to the server as an active downgrade. This text was is in= fact intended to cover this case -- and that's how NSS interprets it -= -=C2=A0 though perhaps it's not as explicit as one would like.

Regardless, I think illegal_parameter is a reasonable= alert to send, especially as sending a separate alert in the case of fallb= ack and of active downgrade is a pain.

-Ekr


Matt


--0000000000007cea380572ed3c3d-- From nobody Wed Aug 8 07:25:49 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CE99E130E6A for ; Wed, 8 Aug 2018 07:25:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.9 X-Spam-Level: X-Spam-Status: No, score=-6.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Z2dMp-pSsZB5 for ; Wed, 8 Aug 2018 07:25:40 -0700 (PDT) Received: from mta.openssl.org (mta.openssl.org [194.97.150.230]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7C54C130E20 for ; Wed, 8 Aug 2018 07:25:40 -0700 (PDT) Received: from [IPv6:2a00:23c6:2d84:6d00:89f5:897:e397:b05a] (unknown [IPv6:2a00:23c6:2d84:6d00:89f5:897:e397:b05a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mta.openssl.org (Postfix) with ESMTPSA id 1A75CEABB7; Wed, 8 Aug 2018 14:25:38 +0000 (UTC) To: Eric Rescorla Cc: Benjamin Kaduk , "tls@ietf.org" References: <2fd24f64-bee5-18ed-cf0d-0fc999add395@openssl.org> <20180808132151.GQ28516@akamai.com> <4fe1cef1-2dd2-3838-9019-a97dd4dbe776@openssl.org> <20180808140159.GR28516@akamai.com> <5fca0e59-1649-9a49-766b-adacf9e4ea60@openssl.org> From: Matt Caswell Openpgp: preference=signencrypt Autocrypt: addr=matt@openssl.org; prefer-encrypt=mutual; keydata= xsBNBFGALsIBCADBkh6zfxbewW2KJjaMaishSrpxuiVaUyvWgpe6Moae7JNCW8ayhJbwAtsQ 69SGA4gUkyrR6PBvDMVYEiYqZwXB/3IErStESjcu+gkbmsa0XcwHpkE3iN7I8aU66yMt710n GEmcrR5E4u4NuNoHtnOBKEh+RCLGp5mo6hwbUYUzG3eUI/zi2hLApPpaATXnD3ZkhgtHV3ln 3Z16nUWQAdIVToxYhvVno2EQsqe8Q3ifl2Uf0YpaN19BDBrxM3WPOAKbJk0Ab1bjgEadavrF BCOl9CrbThewRGmkOdxJWaVkERXMShlzUzjJvKOUEUGOxJCmnfQimPQoCdQyVFLgHfRFABEB AAHNH01hdHQgQ2Fzd2VsbCA8bWF0dEBvcGVuc3NsLm9yZz7CwHgEEwECACIFAlPevrwCGwMG CwkIBwMCBhUIAgkKCwQWAgMBAh4BAheAAAoJENnE0m0OYESRoD0H/1lEJXfr66rdvskyOi0z U0ARvUXHjbmmYkZ7ETkdXh7Va/Tjn81T3pwmr3F4IcLGNLDz4Eg67xbq/T8rrsEPOx5nV/mR nUT97UmsQuLnR2wLGbRBu24FKM7oX3KQvgIdJWdxHHJsjpGCViE1mIFARAzlN+6p3tPbnQzA NjRy7i/PYU/niGdqVcMhcnZCX5F7YH6w6t0ZmYH3m1QeREnWqfxu7eyHsIvebMgKTI/bMG8Z 7KlLZha9HwrFXQAPIST6sfc1blKJ9INUDM9iK6DR/ulkw7e0hmHLqjWqYs5PzyXeoNnsPXJt 69wiADYqj4KNDIdNp1RoF9qfb1nE+DM6rgbOwE0EUYAuwgEIAM9nUJAEpsVBYwK92PP9Mlo1 /etXp6JgBI68sOCJxTwzBrbTzIlevVQXqW9zdODD6ObKcgGNuG+G6Nwn54P6McRpd2dxor9Y A+yaI0yT6CVnhxsXjwc/vuQ4tBAL6tfuMAXRVIeEVk22cKk4HJB68ImXCCRdyRi9HIE5iTrZ HsHC4sjAsirhlc0o8hU3gqkKh2Ehwa6+U8lzNx06hoFEZxIVRteoz1jzCHImF7EXztEcDIam O8uckVKAuKbJgFGkU3bkvNgWlc8Pgx4tRUNJGC1LE4nYqaSEwee1SpA/VewiDObj97PozCTF zRCUBCnSvaAlTnpA90TnODH7ar+L5aEAEQEAAcLAXwQYAQIACQUCUYAuwgIbDAAKCRDZxNJt DmBEkQs2B/96XB9hyFpX/bhu41YNr7nSA65dDi9d+PkMqvLppickG3VR4xXWywzEJTw6W2DN MyFO6mOtdXWgNdgDF7HKZYvHBr6pyttLAMP7BfWBvU7YY59uKmUSc5vl0NzsaSbx5PDSQEkS ICLI+/hIwuEXOb6Z7gOrX7F1uy83TmHFOOjD2mLl5isUzFhaLVk0fZSY+mCgg3/inbwb8g31 91Ybk2LfXmndaEsdEzMLrT0g6wIgmybz6UdVuVPfSPGly0VWVAG1sNPOCpAuJpNV6+VxrdVi Ax3vQPbx3XzqDFS1ISlnd0qS/7RXwMuFDpVH/BDvzQcoikWnpRY/loPGkSg4TB7a Message-ID: Date: Wed, 8 Aug 2018 15:25:37 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.9.1 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Language: en-GB Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [TLS] inappropriate_fallback X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 08 Aug 2018 14:25:47 -0000 On 08/08/18 15:21, Eric Rescorla wrote: > > > On Wed, Aug 8, 2018 at 7:11 AM, Matt Caswell > wrote: > > > > On 08/08/18 15:06, Eric Rescorla wrote: > > The spec is actually extremely clear on this point > > https://tools.ietf.org/html/draft-ietf-tls-tls13-28#section-4.1.3 > > > > > > > >    TLS 1.3 clients receiving a ServerHello indicating TLS 1.2 or below > >    MUST check that the last 8 bytes are not equal to either of these > >    values.  TLS 1.2 clients SHOULD also check that the last 8 bytes are > >    not equal to the second value if the ServerHello indicates TLS 1.1 or > >    below.  If a match is found, the client MUST abort the handshake with > >    an "illegal_parameter" alert. > > In this case the client is acting as a TLS 1.2 client so I don't think > that this paragraph applies. > > > Well, not quite. It's a TLS 1.3 implementation that has sent a TLS 1.2 > CH, but that looks the same to the server as an active downgrade. This > text was is in fact intended to cover this case -- and that's how NSS > interprets it --  though perhaps it's not as explicit as one would like. Fair enough if that was the intention at the time. It's not clear to me from the text - but ok. I do think inappropriate_fallback would have been a better choice for this scenario - but I realise I'm raising this at the last possible moment! Matt From nobody Wed Aug 8 17:44:48 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D115A130EFC for ; Wed, 8 Aug 2018 17:44:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.719 X-Spam-Level: X-Spam-Status: No, score=-2.719 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01, T_DKIMWL_WL_MED=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=fb.com header.b=mvYm9Hr/; dkim=pass (1024-bit key) header.d=fb.onmicrosoft.com header.b=WGUYMOWD Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1KFga78jLMgo for ; Wed, 8 Aug 2018 17:44:44 -0700 (PDT) Received: from mx0a-00082601.pphosted.com (mx0a-00082601.pphosted.com [67.231.145.42]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 93BF2130EFB for ; Wed, 8 Aug 2018 17:44:44 -0700 (PDT) Received: from pps.filterd (m0044012.ppops.net [127.0.0.1]) by mx0a-00082601.pphosted.com (8.16.0.22/8.16.0.22) with SMTP id w790dleV031621; Wed, 8 Aug 2018 17:44:44 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fb.com; h=from : to : cc : subject : date : message-id : references : in-reply-to : content-type : mime-version; s=facebook; bh=lKlx/bcLcFIgGsPWLJulAoi3LWRpUSbRH73hsTMZ2Fw=; b=mvYm9Hr/JsJHOrViRDAzCur2kzzPgTXK9IjgnEQtUUuB9yjsW4rXufQU62ijoml2jjmO 7rNeCyzmMn8rtthphjOC4lcychRMOAKzNI+dRuIAL3ynJ/6jhZN+lQirl6+nF4LSyVTk zvV/Qa4DlOsbfbA/iTWYm3AnJizvZF4yHnM= Received: from mail.thefacebook.com ([199.201.64.23]) by mx0a-00082601.pphosted.com with ESMTP id 2kr88g0gmm-1 (version=TLSv1 cipher=ECDHE-RSA-AES256-SHA bits=256 verify=NOT); Wed, 08 Aug 2018 17:44:44 -0700 Received: from NAM02-BL2-obe.outbound.protection.outlook.com (192.168.54.28) by o365-in.thefacebook.com (192.168.16.19) with Microsoft SMTP Server (TLS) id 14.3.361.1; Wed, 8 Aug 2018 17:44:42 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fb.onmicrosoft.com; s=selector1-fb-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=lKlx/bcLcFIgGsPWLJulAoi3LWRpUSbRH73hsTMZ2Fw=; b=WGUYMOWDfLyPodxAI46ffNiTLPh+Uob58L4jb28c1siowGy7ijoaCSIIZvfEb3HaBFadff1XPvqmDxwz2Y1pe7DkJsJcZv0tGxfIlwMJy/FhlARPE2oiNmUi+lXd0huaftGj8Z9w3sna9qYfeAYYM+EW6gN5YSlGbViexTgjKyc= Received: from MWHPR15MB1821.namprd15.prod.outlook.com (10.174.255.137) by MWHPR15MB1904.namprd15.prod.outlook.com (10.174.100.141) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1038.21; Thu, 9 Aug 2018 00:44:40 +0000 Received: from MWHPR15MB1821.namprd15.prod.outlook.com ([fe80::18bc:612d:2c36:5c1b]) by MWHPR15MB1821.namprd15.prod.outlook.com ([fe80::18bc:612d:2c36:5c1b%6]) with mapi id 15.20.1017.019; Thu, 9 Aug 2018 00:44:40 +0000 From: Subodh Iyengar To: "Patton,Christopher J" , Ilari Liusvaara CC: "tls@ietf.org" Thread-Topic: [TLS] Proposed changes to draft-ietf-tls-subcerts Thread-Index: AQHUHjQqsE1M6CF49EGVkJJk0Fkh4aSUjG8AgACw7A+AAEu7AIABYHq/gAAKfACAAAOdc4AAB1IAgAABKuKAAUZ7gIAAJjiBgAY63oCAAAqVOIAYBNdY Date: Thu, 9 Aug 2018 00:44:40 +0000 Message-ID: References: <20180718065616.GA18428@LK-Perkele-VII> <18b301d41ee2$bff8e8f0$3feabad0$@gmail.com> <20180719193938.GA24141@LK-Perkele-VII> <20180719201846.GA24678@LK-Perkele-VII> <20180720155127.GA28236@LK-Perkele-VII> , <20180724171629.GA27830@LK-Perkele-VII>, In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [2620:10d:c090:200::4:7f44] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; MWHPR15MB1904; 20:PWl7CLV06RPqi8BmsUk3gEkBqtENS5Qfzn43DTgJk+nhwc8kFXeSi1FxNTlvbeCEEyCnBJfORLpYz+5fVBRwWXB4mrF9sKhqPfNFP2LHusnMInVHu4iIktRWc8YTUOHCbFcr+q9CF9aFnEmyV8FNfa/9d+2cYXa/VcrlcJnkGNE= x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-correlation-id: 399ad55a-7555-4652-e9fb-08d5fd914ab5 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(7020095)(4652040)(8989117)(4534165)(4627221)(201703031133081)(201702281549075)(8990107)(5600074)(711020)(2017052603328)(7153060)(7193020); SRVR:MWHPR15MB1904; x-ms-traffictypediagnostic: MWHPR15MB1904: x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(158342451672863)(184103788907841)(166708455590820)(460596917420); x-ms-exchange-senderadcheck: 1 x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(8211001083)(6040522)(2401047)(8121501046)(5005006)(10201501046)(3231311)(11241501184)(944501410)(52105095)(3002001)(93006095)(93001095)(149027)(150027)(6041310)(20161123558120)(201703131423095)(201703031522075)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123560045)(20161123564045)(20161123562045)(6072148)(201708071742011)(7699016); SRVR:MWHPR15MB1904; BCL:0; PCL:0; RULEID:; SRVR:MWHPR15MB1904; x-forefront-prvs: 0759F7A50A x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(39860400002)(366004)(346002)(376002)(136003)(396003)(199004)(189003)(6246003)(2900100001)(476003)(486006)(102836004)(186003)(256004)(53936002)(9686003)(6306002)(54896002)(2171002)(93886005)(55016002)(236005)(99286004)(6506007)(110136005)(86362001)(4326008)(53546011)(105586002)(6436002)(6116002)(11346002)(76176011)(7696005)(106356001)(229853002)(46003)(446003)(97736004)(6606003)(2906002)(19627405001)(25786009)(296002)(606006)(316002)(478600001)(33656002)(966005)(7736002)(5660300001)(5250100002)(8936002)(74316002)(68736007)(81156014)(81166006)(8676002)(14454004); DIR:OUT; SFP:1102; SCL:1; SRVR:MWHPR15MB1904; H:MWHPR15MB1821.namprd15.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: fb.com does not designate permitted sender hosts) x-microsoft-antispam-message-info: j1MndcoiruHghAux2GVqX3I0TU5jUeEcAfUQs2yW6Aiw3MsNPFRxwps+lp3b1ZNOULkVliWGGnjWwL7SF+0IYcLNgBaKKhFuxMaDdID9UE2wNyTFiJdSx9eRJQrc7Z4Hyrp9by3FRS2Ydi0tkFjp7GNd7ZdB1nGR7SqJqP37HM+19LLKWR2WmN+C5L6YgVVw2Klr6X8eIwp2f5VetfNnqKhSutFTpO2doECMQRXWB+9WzwO7uua/vaE8KTRZpnbjgt4O4HDOwtN1p9sw2feeGnDx8y2sPJEHTii8HzxqdGrCYg1ISnILqECuxz0ynYdApVqKOVyrLwfFjvb78+oPs5NViaSjG1F6ZfMVk3GYgE8= spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_MWHPR15MB18219A6490D2E6002FA81AACB6250MWHPR15MB1821namp_" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: 399ad55a-7555-4652-e9fb-08d5fd914ab5 X-MS-Exchange-CrossTenant-originalarrivaltime: 09 Aug 2018 00:44:40.6783 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 8ae927fe-1255-47a7-a2af-5f3a069daaa2 X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR15MB1904 X-OriginatorOrg: fb.com X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2018-08-08_10:, , signatures=0 X-Proofpoint-Spam-Reason: safe X-FB-Internal: Safe Archived-At: Subject: Re: [TLS] Proposed changes to draft-ietf-tls-subcerts X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 09 Aug 2018 00:44:47 -0000 --_000_MWHPR15MB18219A6490D2E6002FA81AACB6250MWHPR15MB1821namp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable I merged all of these changes into master since it looked like no-one seeme= d to have strong opinions against them and they seemed like quite reasonabl= e changes. I'm about to cut a draft-02 with these changes if no-one has strong opinion= s against. https://github.com/tlswg/tls-subcerts/ Subodh ________________________________ From: TLS on behalf of Patton,Christopher J Sent: Tuesday, July 24, 2018 11:04:27 AM To: Ilari Liusvaara Cc: tls@ietf.org Subject: Re: [TLS] Proposed changes to draft-ietf-tls-subcerts Aww, I see your point. You're right, it should be that crit=3Dtrue if and o= nly if crit=3Dtrue. > Actually, what usecase do strict certificates serve anyway? I can not > figure out any usecase that would make much sense to me. Dealing with > server endpoints that are capable of LURK but not proof-of-possession > nor is the keyserver capable of format-checking? The point was to enforce that, if a delegation certificate is offered in a = handshake, then a DC must be negotiated in that handshake. I wasn't actuall= y there, but I'm told that this feature was brought up at IETF. It doesn't = seem like there's a clean way to do this, and I'm not sure this feature is = worth the added complexity. I'm going to propose we drop the strict flag and let the critical bit be op= tional for the extension. What do you think? -Chris --_000_MWHPR15MB18219A6490D2E6002FA81AACB6250MWHPR15MB1821namp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

I merged all of these changes int= o master since it looked like no-one seemed to have strong opinions against= them and they seemed like quite reasonable changes.


I'm about to cut a draft-02 with = these changes if no-one has strong opinions against. https://github.com/tlswg/tls-subcerts/


Subodh

From: TLS <tls-bounces@i= etf.org> on behalf of Patton,Christopher J <cjpatton@ufl.edu>
Sent: Tuesday, July 24, 2018 11:04:27 AM
To: Ilari Liusvaara
Cc: tls@ietf.org
Subject: Re: [TLS] Proposed changes to draft-ietf-tls-subcerts
 

Aww, I see your point. You're ri= ght, it should be that crit=3Dtrue if and only if crit=3Dtrue.


> Actually, what usecase= do strict certificates serve anyway? I can not

> figure out any usecase that= would make much sense to me. Dealing with
> server endpoints that are capable of LURK but not proof-of-posses= sion
> nor is the keyserver capable of format-checking?

The point was to enforce that, if a d= elegation certificate is offered in a handshake, then a DC must be negotiat= ed in that handshake. I wasn't actually there, but I'm told that this featu= re was brought up at IETF. It doesn't seem like there's a clean way to do this, and I'm not sure this feature is=  worth the added complexity.

I'm going to propose we drop the stri= ct flag and let the critical bit be optional for the extension. What d= o you think?

-Chris
--_000_MWHPR15MB18219A6490D2E6002FA81AACB6250MWHPR15MB1821namp_-- From nobody Wed Aug 8 18:05:54 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 97F48130E87 for ; Wed, 8 Aug 2018 18:05:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.916 X-Spam-Level: X-Spam-Status: No, score=-1.916 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FORGED_FROMDOMAIN=0.001, FREEMAIL_FROM=0.001, HEADER_FROM_DIFFERENT_DOMAINS=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id outreq2ssXhE for ; Wed, 8 Aug 2018 18:05:49 -0700 (PDT) Received: from mail-qt0-f176.google.com (mail-qt0-f176.google.com [209.85.216.176]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 58DE212777C for ; Wed, 8 Aug 2018 18:05:49 -0700 (PDT) Received: by mail-qt0-f176.google.com with SMTP id q12-v6so4764020qtp.6 for ; Wed, 08 Aug 2018 18:05:49 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=UjNY3CB0ZK3k/eFibszTXQIhne4LxcIoVOTEc31n8SA=; b=DJhTn3zUhj4Duy18AdcFUV13SrSHIcyMVA+dXmzco1F4/Ya0Hptp+HHOsBaf3raQe9 F6snwDqdKnZaO5IFbLsZzkS1XQTZqSt50EKD+aKSnb0hC7bVL13hWv7v5N/3rmMj0XKC m58AYMOzXZjJDsPJw41nD648RLUXC1Z5L2nz2OtJ+Ec4DRpK/PfRg6mFu/s52wt2kkdN r/WDLOq2DVapUiGt6TRPWsmNIwPldOmDCTXJSaJ6Kf0RBqIz91G0lPzktGlgn4okfwo2 qFaX5rwzfRnA33cmKl8gYSmLEXdVtmpr+sKzHBiDGWJ1zP7aGKSt/sNzmTPyw3HOD+rO LA8Q== X-Gm-Message-State: AOUpUlGxYTQhiv92btFJ07GTpO/Hnx09kFJWr+UYKnKVwIoWuW1Xtzi8 9yBN9LhBvfjQ+2cQJ4rrfo3oTUVoPyc= X-Google-Smtp-Source: AA+uWPyR2myHFjtMGt8aQFhsBJRTn3NG2ODWJQiqte4YD3EtlWbaAAbcB347B7dRscIG1ooPS3sFjQ== X-Received: by 2002:ac8:3730:: with SMTP id o45-v6mr52034qtb.72.1533776748081; Wed, 08 Aug 2018 18:05:48 -0700 (PDT) Received: from mail-qt0-f176.google.com (mail-qt0-f176.google.com. [209.85.216.176]) by smtp.gmail.com with ESMTPSA id v187-v6sm3585953qka.73.2018.08.08.18.05.47 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 08 Aug 2018 18:05:47 -0700 (PDT) Received: by mail-qt0-f176.google.com with SMTP id r21-v6so4790399qtm.2 for ; Wed, 08 Aug 2018 18:05:47 -0700 (PDT) X-Received: by 2002:aed:2a74:: with SMTP id k49-v6mr38074qtf.268.1533776747121; Wed, 08 Aug 2018 18:05:47 -0700 (PDT) MIME-Version: 1.0 References: <20180718065616.GA18428@LK-Perkele-VII> <18b301d41ee2$bff8e8f0$3feabad0$@gmail.com> <20180719193938.GA24141@LK-Perkele-VII> <20180719201846.GA24678@LK-Perkele-VII> <20180720155127.GA28236@LK-Perkele-VII> <20180724171629.GA27830@LK-Perkele-VII> In-Reply-To: From: Clint Wilson Date: Wed, 8 Aug 2018 19:05:35 -0600 X-Gmail-Original-Message-ID: Message-ID: To: Subodh Iyengar Cc: "Patton, Christopher J" , Ilari Liusvaara , "tls@ietf.org" Content-Type: multipart/alternative; boundary="0000000000002d53fc0572f63a61" Archived-At: Subject: Re: [TLS] Proposed changes to draft-ietf-tls-subcerts X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 09 Aug 2018 01:05:52 -0000 --0000000000002d53fc0572f63a61 Content-Type: text/plain; charset="UTF-8" These changes look good to me. I appreciate the change to change DelegationUsage extension to be NULL and dropping TLS1.2. Thanks! -Clint On Wed, Aug 8, 2018 at 6:45 PM Subodh Iyengar wrote: > I merged all of these changes into master since it looked like no-one > seemed to have strong opinions against them and they seemed like quite > reasonable changes. > > > I'm about to cut a draft-02 with these changes if no-one has strong > opinions against. https://github.com/tlswg/tls-subcerts/ > > > Subodh > ------------------------------ > *From:* TLS on behalf of Patton,Christopher J < > cjpatton@ufl.edu> > *Sent:* Tuesday, July 24, 2018 11:04:27 AM > *To:* Ilari Liusvaara > *Cc:* tls@ietf.org > *Subject:* Re: [TLS] Proposed changes to draft-ietf-tls-subcerts > > > Aww, I see your point. You're right, it should be that crit=true if and > only if crit=true. > > > > Actually, what usecase do strict certificates serve anyway? I can not > > figure out any usecase that would make much sense to me. Dealing with > > server endpoints that are capable of LURK but not proof-of-possession > > nor is the keyserver capable of format-checking? > > The point was to enforce that, if a delegation certificate is offered in a > handshake, then a DC must be negotiated in that handshake. I wasn't > actually there, but I'm told that this feature was brought up at IETF. It > doesn't seem like there's a clean way to do this, and I'm not sure this > feature is worth the added complexity. > > I'm going to propose we drop the strict flag and let the critical bit be > optional for the extension. What do you think? > > -Chris > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > --0000000000002d53fc0572f63a61 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
These changes look good to me. I appreciate the chang= e to change DelegationUsage extension to be NULL and dropping TLS1.2.
=

Thanks!
-Clint

On Wed, Aug 8, 2018 at 6:45 PM Subodh Iye= ngar <subodh@fb.com> wrote:
<= /div>

I merged all of these changes int= o master since it looked like no-one seemed to have strong opinions against= them and they seemed like quite reasonable changes.


I'm about to cut a draft-02 w= ith these changes if no-one has strong opinions against. https://github.com/tlswg/tls-subcerts/


Subodh

From: = TLS <tls-bounc= es@ietf.org> on behalf of Patton,Christopher J <cjpatton@ufl.edu>
Sent: Tuesday, July 24, 2018 11:04:27 AM
To: Ilari Liusvaara
Cc: tls@ietf.org
Subject: Re: [TLS] Proposed changes to draft-ietf-tls-subcerts
=C2=A0

Aww, I see your point. You're= right, it should be that=C2=A0crit=3Dtrue if and only if crit=3Dtrue.


>=C2=A0Actually, what usecase = do strict certificates serve anyway? I can not

>=C2=A0figure out any us= ecase that would make much sense to me. Dealing with
>=C2=A0server endpoints that are capable of LURK but not proof-of-posses= sion
>=C2=A0nor is the keyserver capable of format-checking?

The point was to enforce th= at, if a delegation certificate is offered in a handshake, then a DC must b= e negotiated in that handshake. I wasn't actually there, but I'm to= ld that this feature was brought up at IETF. It doesn't seem like there's a clean way to do this, and I'm not sure this fe= ature is=C2=A0worth the added complexity.

I'm going to propose we= drop the strict flag and=C2=A0let the critical bit be optional for the ext= ension. What do you think?

-Chris
_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls
--0000000000002d53fc0572f63a61-- From nobody Wed Aug 8 22:07:50 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9DF48130EFF for ; Wed, 8 Aug 2018 22:07:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.72 X-Spam-Level: X-Spam-Status: No, score=-2.72 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01, T_DKIMWL_WL_MED=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=fb.com header.b=hKOJDB20; dkim=pass (1024-bit key) header.d=fb.onmicrosoft.com header.b=j2VQdik3 Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tVs5QCfQemQj for ; Wed, 8 Aug 2018 22:07:47 -0700 (PDT) Received: from mx0b-00082601.pphosted.com (mx0b-00082601.pphosted.com [67.231.153.30]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4C1B41294D7 for ; Wed, 8 Aug 2018 22:07:47 -0700 (PDT) Received: from pps.filterd (m0148460.ppops.net [127.0.0.1]) by mx0a-00082601.pphosted.com (8.16.0.22/8.16.0.22) with SMTP id w7954A55005703 for ; Wed, 8 Aug 2018 22:07:46 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fb.com; h=from : to : subject : date : message-id : content-type : mime-version; s=facebook; bh=4vBPBgvpFw1Kz8V2PaOqNf1U1FbQ92CZ2Sjk2qzSiDE=; b=hKOJDB203/E1CpJrO1dhBKBUvDPL0YNZFBa8sAHwm/prQBMAcGqJ++eCDT7ZiZ6trNT2 r+zbwdxdn2no9w7Wuq1xOpel4khJfqhKqfHipWNe787/KTPpSZiW+QPBFw85pVH5xJU3 Qf5jWRGyslvp3hV+/eWyk+J7HLtCp7ZbP8c= Received: from maileast.thefacebook.com ([199.201.65.23]) by mx0a-00082601.pphosted.com with ESMTP id 2kraangj5u-1 (version=TLSv1 cipher=ECDHE-RSA-AES256-SHA bits=256 verify=NOT) for ; Wed, 08 Aug 2018 22:07:46 -0700 Received: from NAM04-BN3-obe.outbound.protection.outlook.com (192.168.183.28) by o365-in.thefacebook.com (192.168.177.33) with Microsoft SMTP Server (TLS) id 14.3.361.1; Thu, 9 Aug 2018 01:07:45 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fb.onmicrosoft.com; s=selector1-fb-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=4vBPBgvpFw1Kz8V2PaOqNf1U1FbQ92CZ2Sjk2qzSiDE=; b=j2VQdik3b2zOHXRZwdSSCyDqHAmhBgUc8YfHb9SnUfAqWwpmaltEO/cQuIBEXUIXDYXyb45yIUPTygb2nZclApUppVw8oewguIk4wNDVwQ6AjatXCeBq6Xfay5qwyTNn1N0srnBonKg0ag+USc3OO37R1tjdEtRNxu4IqChOzbI= Received: from MWHPR15MB1821.namprd15.prod.outlook.com (10.174.255.137) by MWHPR15MB1133.namprd15.prod.outlook.com (10.175.2.11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1038.23; Thu, 9 Aug 2018 05:07:43 +0000 Received: from MWHPR15MB1821.namprd15.prod.outlook.com ([fe80::18bc:612d:2c36:5c1b]) by MWHPR15MB1821.namprd15.prod.outlook.com ([fe80::18bc:612d:2c36:5c1b%6]) with mapi id 15.20.1017.019; Thu, 9 Aug 2018 05:07:43 +0000 From: Subodh Iyengar To: "tls@ietf.org" Thread-Topic: OID for delegated credentials Thread-Index: AQHUL5NRvu97ZJW/yUedGGBhRa7g0g== Date: Thu, 9 Aug 2018 05:07:43 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [199.201.64.2] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; MWHPR15MB1133; 20:HoX/jgkpKgDO+fXJR6koItKVZ50PdV8+PjEa3GxX8PH0Ir6uycJwAIzRPgeOm55rW4XxlJAjtfQtqyyEeoBjaCcE8mmdsCC8Qw7yA4ZbhHzP4IlCzeWi7oFOtAr+k/+keAqBNx4R8pTBdznzg7E9fLw3Oiv7Sw3sW57GAoo2bAI= x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-correlation-id: 01672cc2-2dbc-456b-5bd7-08d5fdb60a16 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(7020095)(4652040)(8989117)(5600074)(711020)(4534165)(4627221)(201703031133081)(201702281549075)(8990107)(2017052603328)(7153060)(7193020); SRVR:MWHPR15MB1133; x-ms-traffictypediagnostic: MWHPR15MB1133: x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:; x-ms-exchange-senderadcheck: 1 x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(8211001083)(6040522)(2401047)(5005006)(8121501046)(10201501046)(3002001)(3231311)(11241501184)(944501410)(52105095)(93006095)(93001095)(149027)(150027)(6041310)(20161123558120)(20161123564045)(20161123560045)(20161123562045)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(6072148)(201708071742011)(7699016); SRVR:MWHPR15MB1133; BCL:0; PCL:0; RULEID:; SRVR:MWHPR15MB1133; x-forefront-prvs: 0759F7A50A x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(346002)(376002)(39860400002)(366004)(136003)(396003)(189003)(199004)(6916009)(97736004)(186003)(256004)(102836004)(6606003)(26005)(316002)(6506007)(14454004)(5250100002)(81166006)(81156014)(99286004)(2906002)(8676002)(1730700003)(486006)(2900100001)(478600001)(2501003)(66066001)(25786009)(476003)(74316002)(33656002)(7696005)(7736002)(105586002)(2351001)(106356001)(6436002)(55016002)(5640700003)(5660300001)(6116002)(3846002)(9686003)(53936002)(8936002)(3480700004)(19627405001)(86362001)(68736007)(54896002); DIR:OUT; SFP:1102; SCL:1; SRVR:MWHPR15MB1133; H:MWHPR15MB1821.namprd15.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: fb.com does not designate permitted sender hosts) x-microsoft-antispam-message-info: C7i5VTnZKkGKitHeoYJqvEVNEoC431Ss5luCroqhP+YdLGTwlmz0/ooWdKfICYGcek2GOf8JoomCRB2S1HthWOd8NhXhDb6JcPW3Sz1Bg2oj+cgJP+/qZYiI4nfqCzYReWZFfZsyt3x+Q/TByk0ir3+zSjZoDt0RL0zcBGwbSrKWUDW9Uu1BzCifnHp6F2vXCJyastVi3jJFgtUHMK2GWnNFC1HpoRnHAW2Imuuke5lgGYFUYvFfbdnbO6h1B/pZzMJKQzi+Ad4xsHw+BR7JocuFaEzSORYejaMbyS43gehfQhqCESU9Dx2B/Lb4M9o0k1ph+KZvxrZM1FGVy/TDlZYAo6SYHogpKrpkGUaZhSQ= spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_MWHPR15MB1821DFD41E3FD8CD687924F5B6250MWHPR15MB1821namp_" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: 01672cc2-2dbc-456b-5bd7-08d5fdb60a16 X-MS-Exchange-CrossTenant-originalarrivaltime: 09 Aug 2018 05:07:43.6965 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 8ae927fe-1255-47a7-a2af-5f3a069daaa2 X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR15MB1133 X-OriginatorOrg: fb.com X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2018-08-09_02:, , signatures=0 X-Proofpoint-Spam-Reason: safe X-FB-Internal: Safe Archived-At: Subject: [TLS] OID for delegated credentials X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 09 Aug 2018 05:07:49 -0000 --_000_MWHPR15MB1821DFD41E3FD8CD687924F5B6250MWHPR15MB1821namp_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable We've been kicking this can down the road for a while, but we probably shou= ld choose an OID for Delegated credentials So far we've been doing interop with Cloudflare's OID of 1.3.6.1.4.1.44363.= 44. I'd be fine with putting that as the final OID the draft. Does anyone = have any thoughts on whether we should / should not do this and use a diffe= rent OID instead. Cheers, Subodh --_000_MWHPR15MB1821DFD41E3FD8CD687924F5B6250MWHPR15MB1821namp_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

We've been kicking this can down= the road for a while, but we probably should choose an OID for Delegated c= redentials


So far we've been doing interop = with Cloudflare's OID of 1.3.6.1.4.1.44363.44.  I'd be fine with putting that as the final OID the draft. Does anyone have any thoughts on whether we sh= ould / should not do this and use a different OID instead.


Cheers,

Subodh

--_000_MWHPR15MB1821DFD41E3FD8CD687924F5B6250MWHPR15MB1821namp_-- From nobody Thu Aug 9 01:07:38 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 627B5130F44 for ; Thu, 9 Aug 2018 01:07:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.199 X-Spam-Level: X-Spam-Status: No, score=-4.199 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_MED=-2.3, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=auckland.ac.nz Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jan9wC68rSdU for ; Thu, 9 Aug 2018 01:07:35 -0700 (PDT) Received: from mx4-int.auckland.ac.nz (mx4-int.auckland.ac.nz [130.216.125.246]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A6B74130DC6 for ; Thu, 9 Aug 2018 01:07:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=auckland.ac.nz; i=@auckland.ac.nz; q=dns/txt; s=mail; t=1533802054; x=1565338054; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-transfer-encoding:mime-version; bh=txYVCZoStYvCcgbSTxjmTJ/9J83zsq8LIQoe3dGqcdk=; b=S67OoVoWH30Z3IcZHwSrJtJhKP4buyvQOZwrJaIuzyTX50yMKUrp1P6q yUmaulRjWjJ7jZwQZuDBmn2FwHDpJeR55LfE0UB+XV/4BkEycNRLV2F/P 1CuiBGIICCUpITvBef7uhvHPAD0RVCzMfDNjSom9zU6YhrsoykABqufoF c6+CIxdp7/Z8DXUI3UYARrvzyz7/yAMR4J9uk/HgR8HbKnZM4+z6vwwU+ Lowwpw+my0QQJBUCeLTszub9cq/eN8q2bSxdUYtN4aAGdTk4pWvoaFGX3 s+jc0P0KaiqZ9Da7RUcW8uvEpP9M+gZzvtF6y42VoLwaGjVCFIXj/L61G g==; X-IronPort-AV: E=Sophos;i="5.53,214,1531742400"; d="scan'208";a="25462926" X-Ironport-HAT: MAIL-SERVERS - $RELAYED X-Ironport-Source: 10.6.3.4 - Outgoing - Outgoing Received: from exchangemx.uoa.auckland.ac.nz (HELO uxcn13-tdc-c.UoA.auckland.ac.nz) ([10.6.3.4]) by mx4-int.auckland.ac.nz with ESMTP/TLS/AES256-SHA; 09 Aug 2018 20:07:27 +1200 Received: from uxcn13-ogg-d.UoA.auckland.ac.nz (10.6.2.5) by uxcn13-tdc-c.UoA.auckland.ac.nz (10.6.3.24) with Microsoft SMTP Server (TLS) id 15.0.1263.5; Thu, 9 Aug 2018 20:07:26 +1200 Received: from uxcn13-ogg-d.UoA.auckland.ac.nz ([10.6.2.25]) by uxcn13-ogg-d.UoA.auckland.ac.nz ([10.6.2.25]) with mapi id 15.00.1263.000; Thu, 9 Aug 2018 20:07:26 +1200 From: Peter Gutmann To: Eric Rescorla , Benjamin Kaduk CC: "tls@ietf.org" Thread-Topic: [TLS] inappropriate_fallback Thread-Index: AQHULxh+rHxlHWndvUmdM8wCvcYKyaS1Di2AgAABSgCAAAVYAIAAAeqAgAACqoCAAAEgAIAB9yYd Date: Thu, 9 Aug 2018 08:07:26 +0000 Message-ID: <1533802033644.1196@cs.auckland.ac.nz> References: <2fd24f64-bee5-18ed-cf0d-0fc999add395@openssl.org> <20180808132151.GQ28516@akamai.com> <4fe1cef1-2dd2-3838-9019-a97dd4dbe776@openssl.org> <20180808140159.GR28516@akamai.com>, In-Reply-To: Accept-Language: en-NZ, en-GB, en-US Content-Language: en-NZ X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [130.216.158.4] Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Subject: Re: [TLS] inappropriate_fallback X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 09 Aug 2018 08:07:37 -0000 4oCLRXJpYyBSZXNjb3JsYSA8ZWtyQHJ0Zm0uY29tPiB3cml0ZXM6Cgo+VGhlIHNwZWMgaXMgYWN0 dWFsbHkgZXh0cmVtZWx5IGNsZWFyIG9uIHRoaXMgcG9pbnQKPmh0dHBzOi8vdG9vbHMuaWV0Zi5v cmcvaHRtbC9kcmFmdC1pZXRmLXRscy10bHMxMy0yOCNzZWN0aW9uLTQuMS4zCgpJIGhhZG4ndCBs b29rZWQgYXQgdGhpcyBiaXQgdG9vIGNsb3NlbHkgYmVmb3JlLCBidXQgc2luY2UgaXQgc2F5czoK CiAgIElmIG5lZ290aWF0aW5nIFRMUyAxLjEgb3IgYmVsb3csIFRMUyAxLjMgc2VydmVycyBNVVNU IGFuZCBUTFMgMS4yCiAgIHNlcnZlcnMgU0hPVUxEIHNldCB0aGUgbGFzdCBlaWdodCBieXRlcyBv ZiB0aGVpciBSYW5kb20gdmFsdWUgLi4uCiAgIAogICBbc2Vjb25kIHZhbHVlXQoKWy4uLl0KCiAg IFRMUyAxLjIgY2xpZW50cyBTSE9VTEQgYWxzbyBjaGVjayB0aGF0IHRoZSBsYXN0IGVpZ2h0IGJ5 dGVzCiAgIGFyZSBub3QgZXF1YWwgdG8gdGhlIHNlY29uZCB2YWx1ZSBpZiB0aGUgU2VydmVySGVs bG8gaW5kaWNhdGVzIFRMUwogICAxLjEgb3IgYmVsb3cuICBJZiBhIG1hdGNoIGlzIGZvdW5kLCB0 aGUgY2xpZW50IE1VU1QgYWJvcnQgdGhlCiAgIGhhbmRzaGFrZQoKRG9lc24ndCB0aGlzIG1lYW4g dGhhdCBuby1vbmUgY2FuIGV2ZXIgdXNlIFRMUyAxLjEgb3IgYmVsb3cgYW55IG1vcmU/IFRoZQpz ZXJ2ZXIgaGFzIHRvIHNldCBpdHMgUmFuZG9tIHNpZ25hbGxpbmcgYnl0ZXMgdG8gWCBpZiBpdCB3 YW50cyBUTFMgMS4xIG9yCmJlbG93LCBhbmQgdGhlbiB0aGUgY2xpZW50IGhhcyB0byBhYm9ydCB0 aGUgaGFuZHNoYWtlIGlmIGl0IGZpbmRzIHRob3NlIGJ5dGVzLgoKUGV0ZXIuCg== From nobody Thu Aug 9 04:53:51 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7B7BB130E1E for ; Thu, 9 Aug 2018 04:53:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.71 X-Spam-Level: X-Spam-Status: No, score=-2.71 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=akamai.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MyaG7HF6yqRk for ; Thu, 9 Aug 2018 04:53:47 -0700 (PDT) Received: from mx0b-00190b01.pphosted.com (mx0b-00190b01.pphosted.com [IPv6:2620:100:9005:57f::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 94376130E10 for ; Thu, 9 Aug 2018 04:53:47 -0700 (PDT) Received: from pps.filterd (m0050096.ppops.net [127.0.0.1]) by m0050096.ppops.net-00190b01. (8.16.0.22/8.16.0.22) with SMTP id w79BqCNC001822; Thu, 9 Aug 2018 12:53:41 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=akamai.com; h=date : from : to : cc : subject : message-id : references : mime-version : content-type : content-transfer-encoding : in-reply-to; s=jan2016.eng; bh=NQ88u0xk5t5HtbAQWP/Pif53tcCiAjELqIYmvEET3kQ=; b=fu+c7hLvsl2d2EVZTqlr/ABirr8kUHtEIoarMq2+idtV59enwGWFybpCuCewlPmBrAYW 9Sxn3g//QIr25IuWASoyKvnRl/uc6Ynw4qYyOeOpI5brpgQkkcVDJkpeYPeuS5mmGV42 FmPwN0apQ6W9tbd4Oig6v9Lr3cty1xvq+V5/l87RnGpVu42pGphctPiWpG3S+Mc+NQpO mAKjTe7x2EZwY/YCH8pQjm/o4aPXzLHI9Dqh/EHqsJUWqhjyThXJEGGafzvhB2LcHo0c oFu2nrEkDI9Z2LFTZPuOcC9/QFB8oXVbjQBZiDs/pPY/dKInOFmuxAJvlHkrs/JWtWFm qA== Received: from prod-mail-ppoint4 (a96-6-114-87.deploy.static.akamaitechnologies.com [96.6.114.87] (may be forged)) by m0050096.ppops.net-00190b01. with ESMTP id 2kqy43kfnc-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 09 Aug 2018 12:53:41 +0100 Received: from pps.filterd (prod-mail-ppoint4.akamai.com [127.0.0.1]) by prod-mail-ppoint4.akamai.com (8.16.0.21/8.16.0.21) with SMTP id w79Bnt0h021995; Thu, 9 Aug 2018 07:53:40 -0400 Received: from prod-mail-relay14.akamai.com ([172.27.17.39]) by prod-mail-ppoint4.akamai.com with ESMTP id 2kn7fw2tga-1; Thu, 09 Aug 2018 07:53:40 -0400 Received: from bos-lpczi.kendall.corp.akamai.com (bos-lpczi.kendall.corp.akamai.com [172.19.17.86]) by prod-mail-relay14.akamai.com (Postfix) with ESMTP id 3E4A6817EC; Thu, 9 Aug 2018 11:53:40 +0000 (GMT) Received: from bkaduk by bos-lpczi.kendall.corp.akamai.com with local (Exim 4.86_2) (envelope-from ) id 1fnjVb-0004kG-Gk; Thu, 09 Aug 2018 06:53:39 -0500 Date: Thu, 9 Aug 2018 06:53:39 -0500 From: Benjamin Kaduk To: Peter Gutmann Cc: "tls@ietf.org" Message-ID: <20180809115339.GW28516@akamai.com> References: <2fd24f64-bee5-18ed-cf0d-0fc999add395@openssl.org> <20180808132151.GQ28516@akamai.com> <4fe1cef1-2dd2-3838-9019-a97dd4dbe776@openssl.org> <20180808140159.GR28516@akamai.com> <1533802033644.1196@cs.auckland.ac.nz> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <1533802033644.1196@cs.auckland.ac.nz> User-Agent: Mutt/1.5.24 (2015-08-30) X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2018-08-09_04:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 mlxscore=0 mlxlogscore=719 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1807170000 definitions=main-1808090124 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2018-08-09_04:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=791 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1807170000 definitions=main-1808090125 Archived-At: Subject: Re: [TLS] version downgrade protection (was: inappropriate_fallback) X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 09 Aug 2018 11:53:49 -0000 [changed subject to reflect forking of thread] On Thu, Aug 09, 2018 at 08:07:26AM +0000, Peter Gutmann wrote: > ​Eric Rescorla writes: > > >The spec is actually extremely clear on this point > >https://tools.ietf.org/html/draft-ietf-tls-tls13-28#section-4.1.3 > > I hadn't looked at this bit too closely before, but since it says: > > If negotiating TLS 1.1 or below, TLS 1.3 servers MUST and TLS 1.2 > servers SHOULD set the last eight bytes of their Random value ... > > [second value] > > [...] > > TLS 1.2 clients SHOULD also check that the last eight bytes > are not equal to the second value if the ServerHello indicates TLS > 1.1 or below. If a match is found, the client MUST abort the > handshake > > Doesn't this mean that no-one can ever use TLS 1.1 or below any more? The > server has to set its Random signalling bytes to X if it wants TLS 1.1 or > below, and then the client has to abort the handshake if it finds those bytes. Well, what do you mean by "no one"? A TLS 1.1-only implementation will happily negotiate 1.1 and take no special action on the signalling random value. A 1.2-capable implementation that is configured to only offer 1.1 should be able to behave similarly. -Ben From nobody Thu Aug 9 04:57:29 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 041E2130E10 for ; Thu, 9 Aug 2018 04:57:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.199 X-Spam-Level: X-Spam-Status: No, score=-4.199 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_MED=-2.3, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=auckland.ac.nz Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lZHkMLbrVt4K for ; Thu, 9 Aug 2018 04:57:25 -0700 (PDT) Received: from mx4-int.auckland.ac.nz (mx4-int.auckland.ac.nz [130.216.125.246]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 95637128CB7 for ; Thu, 9 Aug 2018 04:57:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=auckland.ac.nz; i=@auckland.ac.nz; q=dns/txt; s=mail; t=1533815844; x=1565351844; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-transfer-encoding:mime-version; bh=JvDmqlhh2DotHW2hZzUApBFJullH5c27lVoxtjHzJLc=; b=X1ciybygqK52w6GozlOv455R7/Z1ihNZsCMz3+FnGrIZH5HOZaYDU2t8 iGBs8fJaCzLOOx266lX7XbkEaJqBOkioPiXfZrjhKt4yxuOXk0q14JW9/ QdvwEco4/Dv8/tB/kr5O5DurlShlNSViLhsoWHjARBmzXVDYe40fpOtqd WhYD/cF4mDBuSz3hhSnrIRqmjktMXPN8SZQKfJ9YTU7B6iRg/qCnQVQ0w tUZi0l4qG4trmZAiBh9E0DIPz9BgZQmQ/H5kVPrgpNJWUu6S1yZPN0CYp MCMcLlNrBBKFhrIMKglz8jnPWkEHwa4xw4uFsOFOrASAWrWPK2gxZZ8Ip A==; X-IronPort-AV: E=Sophos;i="5.53,215,1531742400"; d="scan'208";a="25481772" X-Ironport-HAT: MAIL-SERVERS - $RELAYED X-Ironport-Source: 10.6.2.4 - Outgoing - Outgoing Received: from uxcn13-ogg-c.uoa.auckland.ac.nz ([10.6.2.4]) by mx4-int.auckland.ac.nz with ESMTP/TLS/AES256-SHA; 09 Aug 2018 23:57:21 +1200 Received: from uxcn13-ogg-d.UoA.auckland.ac.nz (10.6.2.5) by uxcn13-ogg-c.UoA.auckland.ac.nz (10.6.2.4) with Microsoft SMTP Server (TLS) id 15.0.1263.5; Thu, 9 Aug 2018 23:57:21 +1200 Received: from uxcn13-ogg-d.UoA.auckland.ac.nz ([10.6.2.25]) by uxcn13-ogg-d.UoA.auckland.ac.nz ([10.6.2.25]) with mapi id 15.00.1263.000; Thu, 9 Aug 2018 23:57:21 +1200 From: Peter Gutmann To: Benjamin Kaduk CC: "tls@ietf.org" Thread-Topic: [TLS] version downgrade protection (was: inappropriate_fallback) Thread-Index: AQHUL9ewh8ZI3Sk9XUOeYnwfdrk8f6S3UHA4 Date: Thu, 9 Aug 2018 11:57:20 +0000 Message-ID: <1533815828087.10749@cs.auckland.ac.nz> References: <2fd24f64-bee5-18ed-cf0d-0fc999add395@openssl.org> <20180808132151.GQ28516@akamai.com> <4fe1cef1-2dd2-3838-9019-a97dd4dbe776@openssl.org> <20180808140159.GR28516@akamai.com> <1533802033644.1196@cs.auckland.ac.nz>,<20180809115339.GW28516@akamai.com> In-Reply-To: <20180809115339.GW28516@akamai.com> Accept-Language: en-NZ, en-GB, en-US Content-Language: en-NZ X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [130.216.158.4] Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [TLS] version downgrade protection (was: inappropriate_fallback) X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 09 Aug 2018 11:57:27 -0000 Benjamin Kaduk writes:=0A= =0A= >A 1.2-capable implementation that is configured to only offer 1.1 should b= e=0A= >able to behave similarly.=0A= =0A= Except that it can't, because as soon as the server indicates use of TLS 1.= 1,=0A= the client is required to abort the handshake. Thus no one can use TLS 1.1= or=0A= below, because the client is required to abort the handshake if the server= =0A= indicates it's using this.=0A= =0A= Peter.=0A= From nobody Thu Aug 9 05:26:37 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7CE4B129C6A for ; Thu, 9 Aug 2018 05:26:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.908 X-Spam-Level: X-Spam-Status: No, score=-1.908 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, T_DKIMWL_WL_MED=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HY17OdEVHT2b for ; Thu, 9 Aug 2018 05:26:34 -0700 (PDT) Received: from mail-lf1-x131.google.com (mail-lf1-x131.google.com [IPv6:2a00:1450:4864:20::131]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2AA61127598 for ; Thu, 9 Aug 2018 05:26:34 -0700 (PDT) Received: by mail-lf1-x131.google.com with SMTP id y200-v6so3962269lfd.7 for ; Thu, 09 Aug 2018 05:26:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=5D8PAPCGhEkUk/zx6TCjyz/+FI2ZhZ7xBPvVeRsyLjo=; b=UKYf30vWIWhTbhmCo9T6EBRWPLVTVL/9oIQmlL47NR6P/pSDOe6x/E3ut7oH1Rd+6e CoFAwPjCEDQP78EQGk7hs2S/j7xvVMqnXPYVQAG1LmEUyL7rhFni6FWnskRQXiMBwAJ9 QTDLWhJo8GRd3LFWA/CwAiH2p951V+2cLq9IpySK9nRLUnSLdNsW5LinGwIsO7LY31a3 YiHcnfVRg/ShOvCMeoEOiGE2W3ak34ikanTOcfuqHchWzsFJyWaR2WKgbxrMl9W0/E5H /PR8qKCzK5qxljDKIUQB2GqEaCD/NwiJ0R9FMADYxIaU3WkdrCcoqLvl4bKnSSoYmreF tw4A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=5D8PAPCGhEkUk/zx6TCjyz/+FI2ZhZ7xBPvVeRsyLjo=; b=bysj0jaqGqr68UDRBO9TxTNordyZ32iFT5g+amK5SS0czGsKwYJNIot6Itaeuh6p6y aHN1JwPXSUQMrFyrdF/p0NrNVjOJ/C+LPmFhKTwepBO9eS/+5gA8m7ZdvFUWgHq2UBSa Kq5iGiYsuvXcYWHoxkG57J2qg4NEfT6ViO8Wfizk4Fm+z5aJJJ6lsm26NbDROejFiHAE 4DUSI/UcmT0MXzlP8YMU9dCFB8OYk/wEn4X32iMeVz06dMuY7GUbaEVHsf1fBtbQ2DVW tYSzrk2vMYnCzuSUfIHjHhm9sqfx/zGRbtRCEqphhpIh2r6RCRP+XVOPdJbbScLH2Y7x k/DA== X-Gm-Message-State: AOUpUlE2T8B+q1Ci46q1ElaQjEFQoMSjmZ5l9o2qmdrddjVDGqA+84Oy BdyOUcr8HG8Ql/ZNi7PEapctLmfr9UgDUc5PctBVsx4A X-Google-Smtp-Source: AA+uWPyiybENXdDA9rn3DShhwRSuQm+4yBD8AZaCl4lPMh1X6vYAwuu0UquUxsEDoGYSTE435+vVWpXKVKCYDGrhz7c= X-Received: by 2002:a19:1460:: with SMTP id k93-v6mr1428728lfi.15.1533817592355; Thu, 09 Aug 2018 05:26:32 -0700 (PDT) MIME-Version: 1.0 Received: by 2002:ab3:4091:0:0:0:0:0 with HTTP; Thu, 9 Aug 2018 05:25:51 -0700 (PDT) In-Reply-To: <1533802033644.1196@cs.auckland.ac.nz> References: <2fd24f64-bee5-18ed-cf0d-0fc999add395@openssl.org> <20180808132151.GQ28516@akamai.com> <4fe1cef1-2dd2-3838-9019-a97dd4dbe776@openssl.org> <20180808140159.GR28516@akamai.com> <1533802033644.1196@cs.auckland.ac.nz> From: Eric Rescorla Date: Thu, 9 Aug 2018 05:25:51 -0700 Message-ID: To: Peter Gutmann Cc: Benjamin Kaduk , "tls@ietf.org" Content-Type: multipart/alternative; boundary="000000000000be37f30572ffbc89" Archived-At: Subject: Re: [TLS] inappropriate_fallback X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 09 Aug 2018 12:26:37 -0000 --000000000000be37f30572ffbc89 Content-Type: text/plain; charset="UTF-8" On Thu, Aug 9, 2018 at 1:07 AM, Peter Gutmann wrote: > Eric Rescorla writes: > > >The spec is actually extremely clear on this point > >https://tools.ietf.org/html/draft-ietf-tls-tls13-28#section-4.1.3 > > I hadn't looked at this bit too closely before, but since it says: > > If negotiating TLS 1.1 or below, TLS 1.3 servers MUST and TLS 1.2 > servers SHOULD set the last eight bytes of their Random value ... > > [second value] > > [...] > > TLS 1.2 clients SHOULD also check that the last eight bytes > are not equal to the second value if the ServerHello indicates TLS > 1.1 or below. If a match is found, the client MUST abort the > handshake > > Doesn't this mean that no-one can ever use TLS 1.1 or below any more? The > server has to set its Random signalling bytes to X if it wants TLS 1.1 or > below, and then the client has to abort the handshake if it finds those > bytes. > I don't believe so, no. The server MUST set these bytes if it supports > TLS 1.1 and the client MUST check them if it gets TLS 1.1 and it wants > TLS 1.1. So if the server wants TLS 1.1, then it doesn't set the bytes. If the client wants TLS 1.1, it doesn't check them. In either case, the handshake succeeds. -Ekr > Peter. > --000000000000be37f30572ffbc89 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


On Thu, Aug 9, 2018 at 1:07 AM, Peter Gutmann <pgut001@cs.auck= land.ac.nz> wrote:
Eric Rescorla <ekr@rtfm.com= > writes:

>The spec is actually extremely clear on this point
>https://tools.ietf.org/html/draft-ietf-tls-tls13-28#section-4.1.3

I hadn't looked at this bit too closely before, but since it say= s:

=C2=A0 =C2=A0If negotiating TLS 1.1 or below, TLS 1.3 servers MUST and TLS = 1.2
=C2=A0 =C2=A0servers SHOULD set the last eight bytes of their Random value = ...

=C2=A0 =C2=A0[second value]

[...]

=C2=A0 =C2=A0TLS 1.2 clients SHOULD also check that the last eight bytes =C2=A0 =C2=A0are not equal to the second value if the Serv= erHello indicates TLS
=C2=A0 =C2=A01.1 or below.=C2=A0 If a match is found, the client MUST abort= the
=C2=A0 =C2=A0handshake

Doesn't this mean that no-one can ever use TLS 1.1 or below any = more? The
server has to set its Random signalling bytes to X if it wants TLS 1.1 or below, and then the client has to abort the handshake if it finds those byt= es.

I don't believe so, no.

The server MUST set these bytes if it supports > T= LS 1.1 and the client MUST check them if it gets TLS 1.1 and it wants > = TLS 1.1.

So if the server wants TLS 1.1, then it d= oesn't set the bytes. If the client wants TLS 1.1, it doesn't check= them. In either case, the handshake succeeds.

-Ekr


Peter.

--000000000000be37f30572ffbc89-- From nobody Thu Aug 9 05:27:45 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2D5F1129C6A for ; Thu, 9 Aug 2018 05:27:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.908 X-Spam-Level: X-Spam-Status: No, score=-1.908 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, T_DKIMWL_WL_MED=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id A985pG0h4JNG for ; Thu, 9 Aug 2018 05:27:41 -0700 (PDT) Received: from mail-lf1-x12d.google.com (mail-lf1-x12d.google.com [IPv6:2a00:1450:4864:20::12d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 68E7C130E13 for ; Thu, 9 Aug 2018 05:27:41 -0700 (PDT) Received: by mail-lf1-x12d.google.com with SMTP id a134-v6so3964593lfe.6 for ; Thu, 09 Aug 2018 05:27:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=BRhGP0z1VXNokuz6gPIXBBakgwjjRYKgo+EKDL02/UU=; b=TPKGg/M8AxNS/Gm1sQiH5Nn6hRlXit2rpUO3CYhdmrDdJ2XqquqpOnsv2SGCeXJBuV BIdov2vf3M+CJv81pAlLYJGYvusK/iRinxGJaqz98ZNVNKLvK1sQSwv8gBPe+z7GhZO6 hc3RsLsuX7mnIdbpxWAxDV+eARjiY/rhqg3Qzx9IPG/Vv+V0ShZ8YuWoMx3dMBien3OI TcKcfDRoUDpe7N/7XC4jpu61SItTyMUWnkUEZvTruzmUrAsCfcRCT6fED6970SIC6Vnn Ph7n2frw+gO5d3SGV82xpdcWWo6KNdU9i/rDCss0JFI8mABcgxJD33A3VUGk2tw0Panj SyeQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=BRhGP0z1VXNokuz6gPIXBBakgwjjRYKgo+EKDL02/UU=; b=ROda9iOe+FOvJm8m42CBnlyBMGH1PNp6vGtlxaGlT/sd893OAeWh59UxgCEdyZIG7L XyZYevaiktusWYJjieG3yDsug9bq5ht6aVcwW4wiEm5bRUsgmpehdt6kDoQxH4dLIdOY b/dEr9W8uUBQ9SQv3nfYM/uN1ZXHSpfl1skiZgXL1/AsoIFt+tsEdlJ2ByMrd5v9P1+q X7APkupGfVpz9o5Rrbs/g5vfzHwmiYrcY79Cl3C8hf2YlrJHviLphKATHndmyoB9mbhB tEwrRWLRPL36+wEEuD77cfoaDGe00nBzFC0Vur13qX3w1x/x4/Q9a0jyTztaciYDe+Lq 5Cow== X-Gm-Message-State: AOUpUlGDNo38mTBxAX7dPhEEjw5e39wJTwJpdY0ftwSqQzs4YWobvKXm Xd+mTNcdZr9JmQ81rUVWY50MvXnwmw4a1xhwreX9Yv1X X-Google-Smtp-Source: AA+uWPym6zOjgTkrB7eA+bBa8t0DFT9EFwMmW+Zt3TneGfeyRJWLjlPnPG6qacS/nA/qiSB6CPd4xwAqxFd8dT8Tl2E= X-Received: by 2002:a19:1ad1:: with SMTP id a200-v6mr1436860lfa.49.1533817659736; Thu, 09 Aug 2018 05:27:39 -0700 (PDT) MIME-Version: 1.0 Received: by 2002:ab3:4091:0:0:0:0:0 with HTTP; Thu, 9 Aug 2018 05:26:58 -0700 (PDT) In-Reply-To: <1533815828087.10749@cs.auckland.ac.nz> References: <2fd24f64-bee5-18ed-cf0d-0fc999add395@openssl.org> <20180808132151.GQ28516@akamai.com> <4fe1cef1-2dd2-3838-9019-a97dd4dbe776@openssl.org> <20180808140159.GR28516@akamai.com> <1533802033644.1196@cs.auckland.ac.nz> <20180809115339.GW28516@akamai.com> <1533815828087.10749@cs.auckland.ac.nz> From: Eric Rescorla Date: Thu, 9 Aug 2018 05:26:58 -0700 Message-ID: To: Peter Gutmann Cc: Benjamin Kaduk , "tls@ietf.org" Content-Type: multipart/alternative; boundary="000000000000c258030572ffc09c" Archived-At: Subject: Re: [TLS] version downgrade protection (was: inappropriate_fallback) X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 09 Aug 2018 12:27:43 -0000 --000000000000c258030572ffc09c Content-Type: text/plain; charset="UTF-8" On Thu, Aug 9, 2018 at 4:57 AM, Peter Gutmann wrote: > Benjamin Kaduk writes: > > >A 1.2-capable implementation that is configured to only offer 1.1 should > be > >able to behave similarly. > > Except that it can't, because as soon as the server indicates use of TLS > 1.1, > the client is required to abort the handshake. Thus no one can use TLS > 1.1 or > below, because the client is required to abort the handshake if the server > indicates it's using this. > I believe you are misreading this text. The client is required to abort only if the server supplies the signalling bytes in ServerRandom, which a 1.1 server will not. -Ekr Peter. > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > --000000000000c258030572ffc09c Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


On Thu, Aug 9, 2018 at 4:57 AM, Peter Gutmann <pgut001@cs.auck= land.ac.nz> wrote:
Benjamin Kaduk <bkaduk@aka= mai.com> writes:

>A 1.2-capable implementation that is configured to only offer 1.1 shoul= d be
>able to behave similarly.

Except that it can't, because as soon as the server indicates us= e of TLS 1.1,
the client is required to abort the handshake.=C2=A0 Thus no one can use TL= S 1.1 or
below, because the client is required to abort the handshake if the server<= br> indicates it's using this.

I believe you are misr= eading this text. The client is required to abort only if the server
<= div>supplies the signalling bytes in ServerRandom, which a 1.1 server will = not.

-Ekr


Peter.

_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls

--000000000000c258030572ffc09c-- From nobody Thu Aug 9 05:34:48 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CCC37130E5A for ; Thu, 9 Aug 2018 05:34:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QgPwH2FDVvnZ for ; Thu, 9 Aug 2018 05:34:44 -0700 (PDT) Received: from mx1.redhat.com (mx3-rdu2.redhat.com [66.187.233.73]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 457FA130E13 for ; Thu, 9 Aug 2018 05:34:44 -0700 (PDT) Received: from smtp.corp.redhat.com (int-mx06.intmail.prod.int.rdu2.redhat.com [10.11.54.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 36DE37B2B1; Thu, 9 Aug 2018 12:34:43 +0000 (UTC) Received: from pintsize.usersys.redhat.com (ovpn-200-43.brq.redhat.com [10.40.200.43]) by smtp.corp.redhat.com (Postfix) with ESMTP id 0BA582166BA2; Thu, 9 Aug 2018 12:34:39 +0000 (UTC) From: Hubert Kario To: tls@ietf.org Date: Thu, 09 Aug 2018 14:34:39 +0200 Message-ID: <1721604.ZefVVjBoKc@pintsize.usersys.redhat.com> In-Reply-To: <1533815828087.10749@cs.auckland.ac.nz> References: <2fd24f64-bee5-18ed-cf0d-0fc999add395@openssl.org> <20180809115339.GW28516@akamai.com> <1533815828087.10749@cs.auckland.ac.nz> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="nextPart2385708.rUcCo6ArN2"; micalg="pgp-sha512"; protocol="application/pgp-signature" X-Scanned-By: MIMEDefang 2.78 on 10.11.54.6 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.11.55.1]); Thu, 09 Aug 2018 12:34:43 +0000 (UTC) X-Greylist: inspected by milter-greylist-4.5.16 (mx1.redhat.com [10.11.55.1]); Thu, 09 Aug 2018 12:34:43 +0000 (UTC) for IP:'10.11.54.6' DOMAIN:'int-mx06.intmail.prod.int.rdu2.redhat.com' HELO:'smtp.corp.redhat.com' FROM:'hkario@redhat.com' RCPT:'' Archived-At: Subject: Re: [TLS] version downgrade protection (was: inappropriate_fallback) X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 09 Aug 2018 12:34:47 -0000 --nextPart2385708.rUcCo6ArN2 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="UTF-8" On Thursday, 9 August 2018 13:57:20 CEST Peter Gutmann wrote: > Benjamin Kaduk writes: > >A 1.2-capable implementation that is configured to only offer 1.1 should= be > >able to behave similarly. >=20 > Except that it can't, because as soon as the server indicates use of TLS > 1.1, the client is required to abort the handshake. Thus no one can use > TLS 1.1 or below, because the client is required to abort the handshake if > the server indicates it's using this. the signalling bytes must be included only if server has support for higher= =20 protocol versions enabled; if TLS 1.2 and TLS 1.3 is explicitly disabled on= =20 the server, it must not include those signalling bytes =2D-=20 Regards, Hubert Kario Senior Quality Engineer, QE BaseOS Security team Web: www.cz.redhat.com Red Hat Czech s.r.o., Purky=C5=88ova 115, 612 00 Brno, Czech Republic --nextPart2385708.rUcCo6ArN2 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part. Content-Transfer-Encoding: 7Bit -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEYeeuxEU+3unL/K+dkqjRuAHS9fUFAltsNN8ACgkQkqjRuAHS 9fUUtQ//RHjCWIp32h8KzuPakUqx4se7vexwJLRatUUYcUHDhBXO5AOh8j//FTbS 3IM7KtabWVUMSSvF0/ZtRNmknNoPSZXb+RkK3Flsvvru8d/fbK38xQGvK4xWP472 Cto7L6BSg3jWld9MazS/+7ECMGwuZnbekB503UYr+MvvVswIJBLEv3v6iZ/KR/tQ YPXjkZu9T36COPLYMtJj4cuW1Dk2vZIAGesEgqKiWEiid8U5HmN8Qs5kEMjOQEPo nQ+jBmuxCal5wH3DG+zuXVlZFSiwPSnov2H+xhYbJ/NWCExbOzKCDswkbBsZqHeG yqXbXUBjNcV/3yqdleY+oDsM/oWz60k0AXIOhRm5q0z5S3L3WVoY28TpFGJwrc08 VExrmp3DeU2wDtTjHAtLRx/uN18evbJlkG/70EsVbgLz35qTZP/dVbZQPUFb3ucv 371WTfG2J9AX85ecEB95TNLfH3D7u0Ns/Nq9ZdnookEc9s97T96hE+4ItpGt9pss 93r/RzlMZcc0PdR7KsqDG+FW3U92LcyLc04i+NmuhQcKsYZFWnE23ZSstwd/d+bq XGQzONYmOEvsrIWwRXfYwLFxeVb5wZPWlqJM4iCXlMQodVnv4Wv6m/qs4fVbXHrD zx3zDnfZpyVgqFsnmD/NJNlf+0dOBbQ7gqC7e6BsUZnAYQtPwls= =VrEv -----END PGP SIGNATURE----- --nextPart2385708.rUcCo6ArN2-- From nobody Thu Aug 9 05:37:55 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A89D4130DCC for ; Thu, 9 Aug 2018 05:37:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sn3rd.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pYRZp-y-9GM3 for ; Thu, 9 Aug 2018 05:37:52 -0700 (PDT) Received: from mail-qk0-x229.google.com (mail-qk0-x229.google.com [IPv6:2607:f8b0:400d:c09::229]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C2B2D128CB7 for ; Thu, 9 Aug 2018 05:37:52 -0700 (PDT) Received: by mail-qk0-x229.google.com with SMTP id u21-v6so3886126qku.2 for ; Thu, 09 Aug 2018 05:37:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sn3rd.com; s=google; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=PmyyIf2Z4i2I5Eub6CcpbX1BlQnFuYXwGfOxLNiA/ZM=; b=dGmuz5Y5mKelYWYgulQG/RMThy+1SB4CZ/rLRFKpaOLEargcexbHIU9XnoKlIcXmj0 VJfcDn+o3PpvcLWbhT82FXmF+x3kC/zcl2vzUFWDo+czcAJ4m8XPSO7MOqWK6m6jIYv0 BhoaA8LVziScfZQAOQLn4+PBPvfYVHXbj3RSE= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=PmyyIf2Z4i2I5Eub6CcpbX1BlQnFuYXwGfOxLNiA/ZM=; b=O/CXM81u+2evEFTlUNKchF4qfdzKlaCRut9SPlxhuBmQmhXqmRKCja5eOe9oM/HLNR si1E9wGQkQICxSBwAE+gXPhGewDi2aMIUTOEOhsuXcz3+Bz99t27w0hs1ZcJU+RpPFei fJ+qsdLc52ZX1MQkM16DzH0lFiVp4VJpsVUwgtkh2wip8M/IyVBT3Bjnc90RW9iHjJwo zTvJk+RSi4dw8zWp/HUdMDHBSAxi/9wfqZQZ3/mFkIAHFucUraNlMfqIqg/DI7B1lBpr 0qKvtC8WYrzFZQHadOwtNN3tr2x2DsjEDbytBiZxl3TNXtLVvDINt9uSw+tPYKgUi3dw SaWw== X-Gm-Message-State: AOUpUlHLCxQTFkHTumzOGpyUtmUwUl21PpHkq2xUSDbYvk0mbRQP3mOB 5cDOMzk8KTaXd2IqbF86tAtZwkBmmms= X-Google-Smtp-Source: AA+uWPxBY1gcm3M+v2fqPQcYAWOjru8tKs4pQrjx39+Pb5oYKxToMTwOym3QlAtxcvHBQVXXkdLbiQ== X-Received: by 2002:a37:5a06:: with SMTP id o6-v6mr1645482qkb.44.1533818271895; Thu, 09 Aug 2018 05:37:51 -0700 (PDT) Received: from [172.16.0.18] ([96.231.225.148]) by smtp.gmail.com with ESMTPSA id o26-v6sm4409676qtk.4.2018.08.09.05.37.50 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 09 Aug 2018 05:37:51 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) From: Sean Turner In-Reply-To: Date: Thu, 9 Aug 2018 08:37:50 -0400 Cc: "tls@ietf.org" Content-Transfer-Encoding: quoted-printable Message-Id: <19F8F17B-88FB-463D-BB92-70F8AF8377BC@sn3rd.com> References: To: Subodh Iyengar X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: Re: [TLS] OID for delegated credentials X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 09 Aug 2018 12:37:55 -0000 Ah okay you didn=E2=80=99t put that OID in the draft (excellent)! The other option is to get it from the PKIX id-pe arc = (https://www.iana.org/assignments/smi-numbers/smi-numbers.xhtml#smi-number= s-1.3.6.1.5.5.7.1)*. Whatever you do don=E2=80=99t use 30 or 31 ;). To = get an early assignment, we basically just need to figure out whether = you think this is stable enough to go through the early assignment = process. spt * Russ Housley is the designated expert for the arc. > On Aug 9, 2018, at 01:07, Subodh Iyengar wrote: >=20 > We've been kicking this can down the road for a while, but we probably = should choose an OID for Delegated credentials >=20 > So far we've been doing interop with Cloudflare's OID of = 1.3.6.1.4.1.44363.44. I'd be fine with putting that as the final OID = the draft. Does anyone have any thoughts on whether we should / should = not do this and use a different OID instead. >=20 > Cheers, > Subodh > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls From nobody Thu Aug 9 05:56:51 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A6243130E40 for ; Thu, 9 Aug 2018 05:56:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.199 X-Spam-Level: X-Spam-Status: No, score=-4.199 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_MED=-2.3, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=auckland.ac.nz Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zJtKjeaguQHM for ; Thu, 9 Aug 2018 05:56:48 -0700 (PDT) Received: from mx4-int.auckland.ac.nz (mx4-int.auckland.ac.nz [130.216.125.246]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6C80C128B14 for ; Thu, 9 Aug 2018 05:56:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=auckland.ac.nz; i=@auckland.ac.nz; q=dns/txt; s=mail; t=1533819408; x=1565355408; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-transfer-encoding:mime-version; bh=pmiriic3M930glCunzl+fVXYai7w6I6xBpkMxYkcJ+4=; b=hx6jorhKw5AcmuiZaOruOIwb2guNwlvA8dtExrtSVMoVsqFDEfxwPH6Q Ql6cw0nguG4JsFtakSywKNgriHN90FKWESeM4zXz6L5L/Lbx+J4osvPTU YvMPtGCQdZrMq8yArBHbczpdbPDBhhmW4Kb6C6lf5I8fZJ4MK7/Gf0+wl +cptrAIbiPHEKe/s4Abf7B9tdB7dZQ7/8cvaDQgtFBhZ2dmcfg9e+glSx wofDI1tNlCYU1Xel9gjS+wajAgeRNuilcrazGjH1HaN8YDkxe5r2uw95w C4ij/y9yRgo7GxKxpxLs70SZ6ab6WXqwjLCxhXBSPnPYC6+y+THcm4YKA g==; X-IronPort-AV: E=Sophos;i="5.53,215,1531742400"; d="scan'208";a="25486539" X-Ironport-HAT: MAIL-SERVERS - $RELAYED X-Ironport-Source: 10.6.2.4 - Outgoing - Outgoing Received: from uxcn13-ogg-c.uoa.auckland.ac.nz ([10.6.2.4]) by mx4-int.auckland.ac.nz with ESMTP/TLS/AES256-SHA; 10 Aug 2018 00:56:44 +1200 Received: from uxcn13-ogg-d.UoA.auckland.ac.nz (10.6.2.5) by uxcn13-ogg-c.UoA.auckland.ac.nz (10.6.2.24) with Microsoft SMTP Server (TLS) id 15.0.1263.5; Fri, 10 Aug 2018 00:56:43 +1200 Received: from uxcn13-ogg-d.UoA.auckland.ac.nz ([10.6.2.25]) by uxcn13-ogg-d.UoA.auckland.ac.nz ([10.6.2.25]) with mapi id 15.00.1263.000; Fri, 10 Aug 2018 00:56:43 +1200 From: Peter Gutmann To: Eric Rescorla CC: Benjamin Kaduk , "tls@ietf.org" Thread-Topic: [TLS] inappropriate_fallback Thread-Index: AQHULxh+rHxlHWndvUmdM8wCvcYKyaS1Di2AgAABSgCAAAVYAIAAAeqAgAACqoCAAAEgAIAB9yYd//9/M4CAANGP3A== Date: Thu, 9 Aug 2018 12:56:43 +0000 Message-ID: <1533819390717.16753@cs.auckland.ac.nz> References: <2fd24f64-bee5-18ed-cf0d-0fc999add395@openssl.org> <20180808132151.GQ28516@akamai.com> <4fe1cef1-2dd2-3838-9019-a97dd4dbe776@openssl.org> <20180808140159.GR28516@akamai.com> <1533802033644.1196@cs.auckland.ac.nz>, In-Reply-To: Accept-Language: en-NZ, en-GB, en-US Content-Language: en-NZ X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [130.216.158.4] Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Subject: Re: [TLS] inappropriate_fallback X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 09 Aug 2018 12:56:51 -0000 4oCLRXJpYyBSZXNjb3JsYSA8ZWtyQHJ0Zm0uY29tPiB3cml0ZXM6Cgo+U28gaWYgdGhlIHNlcnZl ciB3YW50cyBUTFMgMS4xLCB0aGVuIGl0IGRvZXNuJ3Qgc2V0IHRoZSBieXRlcy4KCklmIHRoYXQn cyB0aGUgY2FzZSB0aGVuIHRoZSB0ZXh0IHRoYXQgc2F5czoKCiAgIElmIG5lZ290aWF0aW5nIFRM UyAxLjEgb3IgYmVsb3csIFRMUyAxLjMgc2VydmVycyBNVVNUIGFuZCBUTFMgMS4yCiAgIHNlcnZl cnMgU0hPVUxEIHNldCB0aGUgbGFzdCBlaWdodCBieXRlcyBvZiB0aGVpciBSYW5kb20gdmFsdWUg Li4uCgpuZWVkcyB0byBiZSBmaXhlZCwgYmVhdXNlIGFzIGZhciBhcyBJIGNhbiB0ZWxsIHRoYXQn cyBzYXlpbmcgdGhhdCBpZiB0aGUKc2VydmVyIHdhbnRzIFRMUyAxLjEgdGhlbiBpdCBoYXMgdG8g c2V0IHRoZSBieXRlcywgbm90IHRoYXQgaXQgZG9lc24ndCBzZXQgdGhlCmJ5dGVzLgoKSGVyZSdz IGFuIGV4YW1wbGUgb2Ygd2hlcmUgdGhpcyBjYXVzZXMgcHJvYmxlbXMuICBBIFRMUyAxLjIgY2xp ZW50IGNvbm5lY3RzIHRvCnRoZSBzZXJ2ZXIuICBUaGUgc2VydmVyLCBhIFRMUyAxLjIgc2VydmVy LCBpcyBjb25maWd1cmVkIHRvIHVzZSBUTFMgMS4xLCBzbyBpdApyZXNwb25kcyB3aXRoIHRoZSBz aWduYWxsaW5nIGJ5dGVzIGluIGl0cyByYW5kb20gdmFsdWUuICBUaGUgY2xpZW50IGlzIG5vdwpy ZXF1aXJlZCB0byBhYm9ydCB0aGUgaGFuZHNoYWtlIGV2ZW4gdGhvdWdoIGV2ZXJ5dGhpbmcgaXMg cnVubmluZyBhcyBpdApzaG91bGQuCgpQZXRlci4K From nobody Thu Aug 9 06:00:09 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3833F128B14 for ; Thu, 9 Aug 2018 06:00:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_MED=-2.3] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=auckland.ac.nz Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Zt5QZDDPUNRz for ; Thu, 9 Aug 2018 06:00:07 -0700 (PDT) Received: from mx4-int.auckland.ac.nz (mx4-int.auckland.ac.nz [130.216.125.246]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C4D41127598 for ; Thu, 9 Aug 2018 06:00:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=auckland.ac.nz; i=@auckland.ac.nz; q=dns/txt; s=mail; t=1533819607; x=1565355607; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-transfer-encoding:mime-version; bh=ICTQZQ9eH5LPFhXS+jh1GIhIV+2ufsp/w1w7PNc+uaU=; b=XLXQI7Sn6fePZ4xeWypgnHXiSs06In4WvttnPqTMFsT0mXeqVukRHAs0 LvO6w5GVVCt4Zfc16i9ZEoagDdAaqDrrfDF67kxVQfsLULGjqM3zq62gj 0mBHPaxQtC3b328cSQ3uYL3rZOtUpd4rAbFrMfa/Oaa4H/0f3foiXGVXw V0jw3uIvz1H8NzmhlpUdygkNDU1jkUVCZ+jn4aFe7zPtmY8L4TWDXlccU qJYim/xWSeqLSDEYsx79X6qX98W3BGDsKns6v8BmGHgPKramsbx/9/MRj J8MpPeRVEdEQmgTiC09yI5MQwbgvAGjtk8uWatHuunpc+hVHWc4IfWmJK Q==; X-IronPort-AV: E=Sophos;i="5.53,215,1531742400"; d="scan'208";a="25486795" X-Ironport-HAT: MAIL-SERVERS - $RELAYED X-Ironport-Source: 10.6.3.9 - Outgoing - Outgoing Received: from exchangemx.uoa.auckland.ac.nz (HELO uxcn13-tdc-e.UoA.auckland.ac.nz) ([10.6.3.9]) by mx4-int.auckland.ac.nz with ESMTP/TLS/AES256-SHA; 10 Aug 2018 01:00:05 +1200 Received: from uxcn13-ogg-d.UoA.auckland.ac.nz (10.6.2.5) by uxcn13-tdc-e.UoA.auckland.ac.nz (10.6.3.9) with Microsoft SMTP Server (TLS) id 15.0.1263.5; Fri, 10 Aug 2018 01:00:04 +1200 Received: from uxcn13-ogg-d.UoA.auckland.ac.nz ([10.6.2.25]) by uxcn13-ogg-d.UoA.auckland.ac.nz ([10.6.2.25]) with mapi id 15.00.1263.000; Fri, 10 Aug 2018 01:00:04 +1200 From: Peter Gutmann To: Hubert Kario , "tls@ietf.org" Thread-Topic: [TLS] version downgrade protection (was: inappropriate_fallback) Thread-Index: AQHUL9ewh8ZI3Sk9XUOeYnwfdrk8f6S3UHA4//9BY4CAANAi2w== Date: Thu, 9 Aug 2018 13:00:04 +0000 Message-ID: <1533819591122.83293@cs.auckland.ac.nz> References: <2fd24f64-bee5-18ed-cf0d-0fc999add395@openssl.org> <20180809115339.GW28516@akamai.com> <1533815828087.10749@cs.auckland.ac.nz>, <1721604.ZefVVjBoKc@pintsize.usersys.redhat.com> In-Reply-To: <1721604.ZefVVjBoKc@pintsize.usersys.redhat.com> Accept-Language: en-NZ, en-GB, en-US Content-Language: en-NZ X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [130.216.158.4] Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [TLS] version downgrade protection (was: inappropriate_fallback) X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 09 Aug 2018 13:00:08 -0000 Hubert Kario writes:=0A= =0A= >the signalling bytes must be included only if server has support for highe= r=0A= >protocol versions enabled; if TLS 1.2 and TLS 1.3 is explicitly disabled o= n=0A= >the server, it must not include those signalling bytes=0A= =0A= Ah, OK. In that case the text should probably make clear that "TLS 1.2=0A= server" isn't "a server that implements RFC 5246" but "a server that's=0A= currently configured to run TLS 1.2".=0A= =0A= Peter.=0A= From nobody Thu Aug 9 06:02:31 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7E57A128B14 for ; Thu, 9 Aug 2018 06:02:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.899 X-Spam-Level: X-Spam-Status: No, score=-6.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HOvZR0Jc0ml4 for ; Thu, 9 Aug 2018 06:02:28 -0700 (PDT) Received: from mta.openssl.org (mta.openssl.org [194.97.150.230]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D1082127598 for ; Thu, 9 Aug 2018 06:02:27 -0700 (PDT) Received: from [10.63.10.6] (ip-47-84-52-196.southampton.uk.amsterdamresidential.com [196.52.84.47]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mta.openssl.org (Postfix) with ESMTPSA id D71ECEABDE for ; Thu, 9 Aug 2018 13:02:25 +0000 (UTC) To: tls@ietf.org References: <2fd24f64-bee5-18ed-cf0d-0fc999add395@openssl.org> <20180808132151.GQ28516@akamai.com> <4fe1cef1-2dd2-3838-9019-a97dd4dbe776@openssl.org> <20180808140159.GR28516@akamai.com> <1533802033644.1196@cs.auckland.ac.nz> <1533819390717.16753@cs.auckland.ac.nz> From: Matt Caswell Openpgp: preference=signencrypt Autocrypt: addr=matt@openssl.org; prefer-encrypt=mutual; keydata= xsBNBFGALsIBCADBkh6zfxbewW2KJjaMaishSrpxuiVaUyvWgpe6Moae7JNCW8ayhJbwAtsQ 69SGA4gUkyrR6PBvDMVYEiYqZwXB/3IErStESjcu+gkbmsa0XcwHpkE3iN7I8aU66yMt710n GEmcrR5E4u4NuNoHtnOBKEh+RCLGp5mo6hwbUYUzG3eUI/zi2hLApPpaATXnD3ZkhgtHV3ln 3Z16nUWQAdIVToxYhvVno2EQsqe8Q3ifl2Uf0YpaN19BDBrxM3WPOAKbJk0Ab1bjgEadavrF BCOl9CrbThewRGmkOdxJWaVkERXMShlzUzjJvKOUEUGOxJCmnfQimPQoCdQyVFLgHfRFABEB AAHNH01hdHQgQ2Fzd2VsbCA8bWF0dEBvcGVuc3NsLm9yZz7CwHgEEwECACIFAlPevrwCGwMG CwkIBwMCBhUIAgkKCwQWAgMBAh4BAheAAAoJENnE0m0OYESRoD0H/1lEJXfr66rdvskyOi0z U0ARvUXHjbmmYkZ7ETkdXh7Va/Tjn81T3pwmr3F4IcLGNLDz4Eg67xbq/T8rrsEPOx5nV/mR nUT97UmsQuLnR2wLGbRBu24FKM7oX3KQvgIdJWdxHHJsjpGCViE1mIFARAzlN+6p3tPbnQzA NjRy7i/PYU/niGdqVcMhcnZCX5F7YH6w6t0ZmYH3m1QeREnWqfxu7eyHsIvebMgKTI/bMG8Z 7KlLZha9HwrFXQAPIST6sfc1blKJ9INUDM9iK6DR/ulkw7e0hmHLqjWqYs5PzyXeoNnsPXJt 69wiADYqj4KNDIdNp1RoF9qfb1nE+DM6rgbOwE0EUYAuwgEIAM9nUJAEpsVBYwK92PP9Mlo1 /etXp6JgBI68sOCJxTwzBrbTzIlevVQXqW9zdODD6ObKcgGNuG+G6Nwn54P6McRpd2dxor9Y A+yaI0yT6CVnhxsXjwc/vuQ4tBAL6tfuMAXRVIeEVk22cKk4HJB68ImXCCRdyRi9HIE5iTrZ HsHC4sjAsirhlc0o8hU3gqkKh2Ehwa6+U8lzNx06hoFEZxIVRteoz1jzCHImF7EXztEcDIam O8uckVKAuKbJgFGkU3bkvNgWlc8Pgx4tRUNJGC1LE4nYqaSEwee1SpA/VewiDObj97PozCTF zRCUBCnSvaAlTnpA90TnODH7ar+L5aEAEQEAAcLAXwQYAQIACQUCUYAuwgIbDAAKCRDZxNJt DmBEkQs2B/96XB9hyFpX/bhu41YNr7nSA65dDi9d+PkMqvLppickG3VR4xXWywzEJTw6W2DN MyFO6mOtdXWgNdgDF7HKZYvHBr6pyttLAMP7BfWBvU7YY59uKmUSc5vl0NzsaSbx5PDSQEkS ICLI+/hIwuEXOb6Z7gOrX7F1uy83TmHFOOjD2mLl5isUzFhaLVk0fZSY+mCgg3/inbwb8g31 91Ybk2LfXmndaEsdEzMLrT0g6wIgmybz6UdVuVPfSPGly0VWVAG1sNPOCpAuJpNV6+VxrdVi Ax3vQPbx3XzqDFS1ISlnd0qS/7RXwMuFDpVH/BDvzQcoikWnpRY/loPGkSg4TB7a Message-ID: <9fec7f0c-9591-703a-066f-2eab54a57515@openssl.org> Date: Thu, 9 Aug 2018 14:02:24 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.9.1 MIME-Version: 1.0 In-Reply-To: <1533819390717.16753@cs.auckland.ac.nz> Content-Type: text/plain; charset=utf-8 Content-Language: en-GB Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [TLS] inappropriate_fallback X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 09 Aug 2018 13:02:31 -0000 On 09/08/18 13:56, Peter Gutmann wrote: > ​Eric Rescorla writes: > >> So if the server wants TLS 1.1, then it doesn't set the bytes. > > If that's the case then the text that says: > > If negotiating TLS 1.1 or below, TLS 1.3 servers MUST and TLS 1.2 > servers SHOULD set the last eight bytes of their Random value ... > > needs to be fixed, beause as far as I can tell that's saying that if the > server wants TLS 1.1 then it has to set the bytes, not that it doesn't set the > bytes. > > Here's an example of where this causes problems. A TLS 1.2 client connects to > the server. The server, a TLS 1.2 server, is configured to use TLS 1.1, so it > responds with the signalling bytes in its random value. That's not the way I read it. If a server is configured to use TLSv1.1 then its not a TLSv1.3 server and this text doesn't apply (regardless of whether the binary could do TLSv1.3 if it was configured differently). Matt > The client is now > required to abort the handshake even though everything is running as it > should. > > Peter. > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > From nobody Thu Aug 9 07:09:09 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C1AFD12F1A2 for ; Thu, 9 Aug 2018 07:09:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.71 X-Spam-Level: X-Spam-Status: No, score=-2.71 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=akamai.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Clyp1xHqEVgY for ; Thu, 9 Aug 2018 07:09:05 -0700 (PDT) Received: from mx0b-00190b01.pphosted.com (mx0b-00190b01.pphosted.com [IPv6:2620:100:9005:57f::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8BBB61277C8 for ; Thu, 9 Aug 2018 07:09:05 -0700 (PDT) Received: from pps.filterd (m0122330.ppops.net [127.0.0.1]) by mx0b-00190b01.pphosted.com (8.16.0.22/8.16.0.22) with SMTP id w79E8FIF006418 for ; Thu, 9 Aug 2018 15:09:04 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=akamai.com; h=from : to : subject : date : message-id : references : in-reply-to : content-type : content-id : content-transfer-encoding : mime-version; s=jan2016.eng; bh=MGNDDIG4TdxmQRfDYPhdOsXejWDwE2qAh/tS+Tb5y0Y=; b=I6/QOLl0Oi088Hy2XKCUtK7OzGDdI9C1KpZ516aSvrzjvlTtskjZg/FwzPwroA9Lbirw 4F9ikeofaM+I+k8coI+JROh2YRR+CcCE0W59TSpzQi55FLgbyOEZChhyh1T4hTeNFXyG SXcpOwOCbT/ilgjLehj0vTor6lJX+w0luPYdu+7woelr+uUdv6vzJfB/Dnr1P5QDVcGq XKCH6ku00JTiH84PlxFio7mlg9AeNGAVxwLsgJsJj6A8hjNSd1PB841WrQxOKSYVVWjv rf+kBIlvSWQuAAkWX2s4gKaDxqsIvJdKqjEPBjLPY/yAqUKMg2WoiRQlxHAIVq/+DG8O Mw== Received: from prod-mail-ppoint1 (prod-mail-ppoint1.akamai.com [184.51.33.18]) by mx0b-00190b01.pphosted.com with ESMTP id 2kqww5bts1-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Thu, 09 Aug 2018 15:09:04 +0100 Received: from pps.filterd (prod-mail-ppoint1.akamai.com [127.0.0.1]) by prod-mail-ppoint1.akamai.com (8.16.0.21/8.16.0.21) with SMTP id w79E53a0023128 for ; Thu, 9 Aug 2018 10:09:03 -0400 Received: from email.msg.corp.akamai.com ([172.27.123.30]) by prod-mail-ppoint1.akamai.com with ESMTP id 2kn7furmhx-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT) for ; Thu, 09 Aug 2018 10:09:03 -0400 Received: from USMA1EX-DAG1MB1.msg.corp.akamai.com (172.27.123.101) by usma1ex-dag1mb4.msg.corp.akamai.com (172.27.123.104) with Microsoft SMTP Server (TLS) id 15.0.1365.1; Thu, 9 Aug 2018 10:09:02 -0400 Received: from USMA1EX-DAG1MB1.msg.corp.akamai.com ([172.27.123.101]) by usma1ex-dag1mb1.msg.corp.akamai.com ([172.27.123.101]) with mapi id 15.00.1365.000; Thu, 9 Aug 2018 10:09:02 -0400 From: "Short, Todd" To: "" Thread-Topic: [TLS] inappropriate_fallback Thread-Index: AQHULxh75kG8k7OPYk+Jc40sIvbVU6S2GmWAgAABSwCAAAVYAIAAAeqAgAACqoCAAAEfAIABLiYAgABINICAAAifgIAAAZcAgAASnYA= Date: Thu, 9 Aug 2018 14:09:02 +0000 Message-ID: <084E22DD-9B7E-4F68-A0F9-AE17CD1830A6@akamai.com> References: <2fd24f64-bee5-18ed-cf0d-0fc999add395@openssl.org> <20180808132151.GQ28516@akamai.com> <4fe1cef1-2dd2-3838-9019-a97dd4dbe776@openssl.org> <20180808140159.GR28516@akamai.com> <1533802033644.1196@cs.auckland.ac.nz> <1533819390717.16753@cs.auckland.ac.nz> <9fec7f0c-9591-703a-066f-2eab54a57515@openssl.org> In-Reply-To: <9fec7f0c-9591-703a-066f-2eab54a57515@openssl.org> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [172.19.38.126] Content-Type: text/plain; charset="utf-8" Content-ID: <025753A60F9CCC45938AD57BCC87F4B7@akamai.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2018-08-09_05:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 mlxscore=0 mlxlogscore=643 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1807170000 definitions=main-1808090147 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2018-08-09_05:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=628 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1807170000 definitions=main-1808090147 Archived-At: Subject: Re: [TLS] inappropriate_fallback X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 09 Aug 2018 14:09:08 -0000 DQoNCj4gT24gQXVnIDksIDIwMTgsIGF0IDk6MDIgQU0sIE1hdHQgQ2Fzd2VsbCA8bWF0dEBvcGVu c3NsLm9yZz4gd3JvdGU6DQo+IA0KPiANCj4gDQo+IE9uIDA5LzA4LzE4IDEzOjU2LCBQZXRlciBH dXRtYW5uIHdyb3RlOg0KPj4g4oCLRXJpYyBSZXNjb3JsYSA8ZWtyQHJ0Zm0uY29tPiB3cml0ZXM6 DQo+PiANCj4+PiBTbyBpZiB0aGUgc2VydmVyIHdhbnRzIFRMUyAxLjEsIHRoZW4gaXQgZG9lc24n dCBzZXQgdGhlIGJ5dGVzLg0KPj4gDQo+PiBJZiB0aGF0J3MgdGhlIGNhc2UgdGhlbiB0aGUgdGV4 dCB0aGF0IHNheXM6DQo+PiANCj4+ICAgSWYgbmVnb3RpYXRpbmcgVExTIDEuMSBvciBiZWxvdywg VExTIDEuMyBzZXJ2ZXJzIE1VU1QgYW5kIFRMUyAxLjINCj4+ICAgc2VydmVycyBTSE9VTEQgc2V0 IHRoZSBsYXN0IGVpZ2h0IGJ5dGVzIG9mIHRoZWlyIFJhbmRvbSB2YWx1ZSAuLi4NCj4+IA0KPj4g bmVlZHMgdG8gYmUgZml4ZWQsIGJlYXVzZSBhcyBmYXIgYXMgSSBjYW4gdGVsbCB0aGF0J3Mgc2F5 aW5nIHRoYXQgaWYgdGhlDQo+PiBzZXJ2ZXIgd2FudHMgVExTIDEuMSB0aGVuIGl0IGhhcyB0byBz ZXQgdGhlIGJ5dGVzLCBub3QgdGhhdCBpdCBkb2Vzbid0IHNldCB0aGUNCj4+IGJ5dGVzLg0KPj4g DQo+PiBIZXJlJ3MgYW4gZXhhbXBsZSBvZiB3aGVyZSB0aGlzIGNhdXNlcyBwcm9ibGVtcy4gIEEg VExTIDEuMiBjbGllbnQgY29ubmVjdHMgdG8NCj4+IHRoZSBzZXJ2ZXIuICBUaGUgc2VydmVyLCBh IFRMUyAxLjIgc2VydmVyLCBpcyBjb25maWd1cmVkIHRvIHVzZSBUTFMgMS4xLCBzbyBpdA0KPj4g cmVzcG9uZHMgd2l0aCB0aGUgc2lnbmFsbGluZyBieXRlcyBpbiBpdHMgcmFuZG9tIHZhbHVlLg0K PiANCj4gVGhhdCdzIG5vdCB0aGUgd2F5IEkgcmVhZCBpdC4gSWYgYSBzZXJ2ZXIgaXMgY29uZmln dXJlZCB0byB1c2UgVExTdjEuMQ0KPiB0aGVuIGl0cyBub3QgYSBUTFN2MS4zIHNlcnZlciBhbmQg dGhpcyB0ZXh0IGRvZXNuJ3QgYXBwbHkgKHJlZ2FyZGxlc3Mgb2YNCj4gd2hldGhlciB0aGUgYmlu YXJ5IGNvdWxkIGRvIFRMU3YxLjMgaWYgaXQgd2FzIGNvbmZpZ3VyZWQgZGlmZmVyZW50bHkpLg0K PiANCj4gTWF0dA0KPiANCg0KQWdyZWVkLg0KDQpJZiBhIFRMUyAxLjIgKGNhcGFibGUpIHNlcnZl ciBpcyBuZWdvdGlhdGluZyBUTFMgMS4xIHdpdGggYSBUTFMgMS4yIGNsaWVudCwgdGhlbiBpdCBj YW7igJl0IGJlIGNvbnNpZGVyZWQgYSBUTFMgMS4yIHNlcnZlciwgb3RoZXJ3aXNlLCBpdCB3b3Vs ZCBuZWdvdGlhdGUgVExTIDEuMi4NCg0KSXQgbXVzdCBiZSBjb25zaWRlcmVkIGEgVExTIDEuMSBz ZXJ2ZXIsIHNpbmNlIHRoYXQgaXMgdGhlIG1heGltdW0gdmVyc2lvbiBpdCBpcyBjb25maWd1cmVk IHRvIHN1cHBvcnQuDQoNCi0tDQotVG9kZCBTaG9ydA0KLy8gdHNob3J0QGFrYW1haS5jb20NCi8v ICJPbmUgaWYgYnkgbGFuZCwgdHdvIGlmIGJ5IHNlYSwgdGhyZWUgaWYgYnkgdGhlIEludGVybmV0 LiINCg0KDQo+IA0KPj4gVGhlIGNsaWVudCBpcyBub3cNCj4+IHJlcXVpcmVkIHRvIGFib3J0IHRo ZSBoYW5kc2hha2UgZXZlbiB0aG91Z2ggZXZlcnl0aGluZyBpcyBydW5uaW5nIGFzIGl0DQo+PiBz aG91bGQuDQo+PiANCj4+IFBldGVyLg0KPj4gX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX18NCj4+IFRMUyBtYWlsaW5nIGxpc3QNCj4+IFRMU0BpZXRmLm9yZw0K Pj4gaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby90bHMNCj4+IA0KPiANCj4g X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCj4gVExTIG1h aWxpbmcgbGlzdA0KPiBUTFNAaWV0Zi5vcmcNCj4gaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1h bi9saXN0aW5mby90bHMNCg0K From nobody Thu Aug 9 07:42:06 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6C8CE130ED3 for ; Thu, 9 Aug 2018 07:42:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UlT-vVOdHI6s for ; Thu, 9 Aug 2018 07:42:02 -0700 (PDT) Received: from mx1.redhat.com (mx3-rdu2.redhat.com [66.187.233.73]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3B146130DDB for ; Thu, 9 Aug 2018 07:42:02 -0700 (PDT) Received: from smtp.corp.redhat.com (int-mx05.intmail.prod.int.rdu2.redhat.com [10.11.54.5]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 5B02F7A7EB for ; Thu, 9 Aug 2018 14:42:01 +0000 (UTC) Received: from pintsize.usersys.redhat.com (ovpn-200-43.brq.redhat.com [10.40.200.43]) by smtp.corp.redhat.com (Postfix) with ESMTP id F38A92314E for ; Thu, 9 Aug 2018 14:41:59 +0000 (UTC) From: Hubert Kario To: tls@ietf.org Date: Thu, 09 Aug 2018 16:41:58 +0200 Message-ID: <3096393.3yWAhzPKLF@pintsize.usersys.redhat.com> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="nextPart5329786.adk1iWJsxg"; micalg="pgp-sha512"; protocol="application/pgp-signature" X-Scanned-By: MIMEDefang 2.79 on 10.11.54.5 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.11.55.2]); Thu, 09 Aug 2018 14:42:01 +0000 (UTC) X-Greylist: inspected by milter-greylist-4.5.16 (mx1.redhat.com [10.11.55.2]); Thu, 09 Aug 2018 14:42:01 +0000 (UTC) for IP:'10.11.54.5' DOMAIN:'int-mx05.intmail.prod.int.rdu2.redhat.com' HELO:'smtp.corp.redhat.com' FROM:'hkario@redhat.com' RCPT:'' Archived-At: Subject: [TLS] Uniqueness of values in lists? X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 09 Aug 2018 14:42:05 -0000 --nextPart5329786.adk1iWJsxg Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="UTF-8" I've noticed that while there is an explicit requirement for extension type= s=20 to be unique for any given message: https://tools.ietf.org/html/draft-ietf-tls-tls13-28#page-43: There MUST NOT be more than one extension of the same type in a given extension block. and for key_shares: https://tools.ietf.org/html/draft-ietf-tls-tls13-28#page-54 Clients MUST NOT offer multiple KeyShareEntry values for the same group. I don't see a similar requirement for other lists of values:=20 signature_algorithms, supported_groups, cipher_suites, etc. Did I miss something? =2D-=20 Regards, Hubert Kario Senior Quality Engineer, QE BaseOS Security team Web: www.cz.redhat.com Red Hat Czech s.r.o., Purky=C5=88ova 115, 612 00 Brno, Czech Republic --nextPart5329786.adk1iWJsxg Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part. Content-Transfer-Encoding: 7Bit -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEYeeuxEU+3unL/K+dkqjRuAHS9fUFAltsUrYACgkQkqjRuAHS 9fXCFw//fNevJtRJuH5N0zpskfNPIViS2EjQ/8FoJBPoqDzxXky3dt8h9jNcqxxk o1XA89oH1mwCgQCVLDO8ZxCf2Kszkgf9yxfVIaJPLW3vh4eB++OwIKvZ8bdHNfrV C8Ph1Hu/peRtCjjFPwThhCER8ETTboom0o67/jEE7ncItCTNI8CwIrgk3N2F3S12 CzpxAhzJgsZXg6Zu6w+I+6KWRDG5KeT+c0VOcxbMwj0OMKDI4RRX8PASt5XKu1Dm 3dqas0zKjIvZEtmsHQjS9U8HGvqMaMaK5CsL8Co9nQPP+82XCyzUenxnz6v5DAaz tgAqFXGh6phVWSNLbJh+0cFVQxvK9YEq50+F89t8aBWe1dBDYNRGkV4IpGhp2ugx P92/WwZoNhtohEZIvZPfZh2IEasf/pp/0z2xuIDFpiiJowHQff1Q0kkcyYgAmMpK ZclcsXeZwqiNjWdL8zxcJk6GOrXzhjQKtGl8VaVW5EeWaN4pSpJx4ZRS7iW9Okmx qlLSUQEPr5jyL1H0VFiSgRrHZ064vHBOex4JwREXO4tzv8j/jW48xXyoLYLf4PPZ wG/0MZfefxiso9fMpE9pKEXbHy0sdTJOT+a7av69KKmm6jGWQ2R45xZE+RJS/uow s6TDJVGvIlmBNlSbizeFpNLzldgJkSzUI9ZBuIAZs9BfVrsh1Ks= =YyiH -----END PGP SIGNATURE----- --nextPart5329786.adk1iWJsxg-- From nobody Thu Aug 9 07:45:13 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5D235130E1E for ; Thu, 9 Aug 2018 07:45:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.908 X-Spam-Level: X-Spam-Status: No, score=-1.908 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, T_DKIMWL_WL_MED=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dA3V50aOufsc for ; Thu, 9 Aug 2018 07:45:07 -0700 (PDT) Received: from mail-lj1-x232.google.com (mail-lj1-x232.google.com [IPv6:2a00:1450:4864:20::232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4C9F6130DDB for ; Thu, 9 Aug 2018 07:45:07 -0700 (PDT) Received: by mail-lj1-x232.google.com with SMTP id q127-v6so4656933ljq.11 for ; Thu, 09 Aug 2018 07:45:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=mhOvQeKZC9N6Yjy2q9U74Lxx2tw9+ycl7km38UQZYjg=; b=gyeTERJ3K7b+xqRJYhSq+W6wxbCCLvEv6C90Av03uAJwJVwVGhlmDB0xVjoyRgWm4S b5sM9xVl/0hcnWKRKo8xjD20Zsx611A7AvHjacKZ7ox/ULmZ191m86KYk+89S8ng6gjU bRFgNtYRRyGdAvdWJvmC6KVCebLx2KSI6mhFreZ2R7KUscT24QyOMnMq05EOIqHT/2GL kmOAo2YATgVaIuzWwRMKxX54GzFoc5BBI7t8QU023uzep3AW/QLgiNYfwjtvGhoucUYz 2B0yCzvZ8i+Zj71XxIBuUmKrDfWnpROrjIWgXk0dQdb2aTNlcvW+FpuJf/SYfxA1+ude 5gWQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=mhOvQeKZC9N6Yjy2q9U74Lxx2tw9+ycl7km38UQZYjg=; b=C5Oox7xedaZyXvEPXSj7kObVFOK2tQEKOmOvIFoW1o0/GzKdSJeta3Y3/UncW07FHm fk0oRgNN8XfF91h5BGREbUQglGzKYeBWYguAFoHrS+i9zFEU/88rgkbjDZWTyiGKOb1Q mniUQtPXY6+TeFZyPGfpR++j/0LxzaWaw3597rHKWadouW3UdgQy2iokTGvO9pCHhj3P xnaOnMsLwzfKsaHLZa9ruWiSSke2qI3rQgiCl3nP4OBWSKEyCcD5xRZ6hyZ5VEXIuf/7 37YAIzGlhMQ/1XAcHkBBHG7lxycAD6BC4L/z5nttCHeHqWc0Dze9llywE9yT95t7GPRp niOA== X-Gm-Message-State: AOUpUlGcwOTpvDFfLILuATBgvAhPur2EIC2hIU2Dv6rE9+EMk0wOhImq 2nRTxXp68x0LNAH4IlyBEwRcIm98yrPsqBI/3VOlFA== X-Google-Smtp-Source: AA+uWPxsnq+LGT9C0nJbKt61DNF2TZ6lBj612VfwWGh41tij/9/DhB9c7gPa4VvlBxzRyHoC9UPOUWnv3/FlcF9woaY= X-Received: by 2002:a2e:2096:: with SMTP id g22-v6mr1871831lji.37.1533825905540; Thu, 09 Aug 2018 07:45:05 -0700 (PDT) MIME-Version: 1.0 Received: by 2002:ab3:4091:0:0:0:0:0 with HTTP; Thu, 9 Aug 2018 07:44:24 -0700 (PDT) In-Reply-To: <3096393.3yWAhzPKLF@pintsize.usersys.redhat.com> References: <3096393.3yWAhzPKLF@pintsize.usersys.redhat.com> From: Eric Rescorla Date: Thu, 9 Aug 2018 07:44:24 -0700 Message-ID: To: Hubert Kario Cc: "" Content-Type: multipart/alternative; boundary="0000000000003f5655057301ac7c" Archived-At: Subject: Re: [TLS] Uniqueness of values in lists? X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 09 Aug 2018 14:45:11 -0000 --0000000000003f5655057301ac7c Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Thu, Aug 9, 2018 at 7:41 AM, Hubert Kario wrote: > I've noticed that while there is an explicit requirement for extension > types > to be unique for any given message: > > https://tools.ietf.org/html/draft-ietf-tls-tls13-28#page-43: > > There MUST NOT be more than one extension of the > same type in a given extension block. > > and for key_shares: > > https://tools.ietf.org/html/draft-ietf-tls-tls13-28#page-54 > > Clients MUST NOT offer multiple KeyShareEntry values > for the same group. > > I don't see a similar requirement for other lists of values: > signature_algorithms, supported_groups, cipher_suites, etc. > > Did I miss something? > Nope. I don't believe it's a current requirement. -Ekr --=20 > Regards, > Hubert Kario > Senior Quality Engineer, QE BaseOS Security team > Web: www.cz.redhat.com > Red Hat Czech s.r.o., Purky=C5=88ova 115, 612 00 Brno, Czech Republic > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > > --0000000000003f5655057301ac7c Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


On Thu, Aug 9, 2018 at 7:41 AM, Hubert Kario <hkario@redhat.com>= ; wrote:
I've noticed that whi= le there is an explicit requirement for extension types
to be unique for any given message:

https://tools.ietf.org/html/draft-ie= tf-tls-tls13-28#page-43:

=C2=A0 =C2=A0There MUST NOT be more than one extension of the
=C2=A0 =C2=A0same type in a given extension block.

and for key_shares:

https://tools.ietf.org/html/draft-ie= tf-tls-tls13-28#page-54

=C2=A0 =C2=A0Clients MUST NOT offer multiple KeyShareEntry values
=C2=A0 =C2=A0for the same group.

I don't see a similar requirement for other lists of values:
signature_algorithms, supported_groups, cipher_suites, etc.

Did I miss something?

Nope. I don't= believe it's a current requirement.

-Ekr<= /div>

--
Regards,
Hubert Kario
Senior Quality Engineer, QE BaseOS Security team
Web: www.cz.redhat.com
Red Hat Czech s.r.o., Purky=C5=88ova 115, 612 00=C2=A0 Brno, Czech Republic=
_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls


--0000000000003f5655057301ac7c-- From nobody Thu Aug 9 08:35:38 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BC174130E23 for ; Thu, 9 Aug 2018 08:35:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qiH2iguCP-kD for ; Thu, 9 Aug 2018 08:35:35 -0700 (PDT) Received: from straasha.imrryr.org (straasha.imrryr.org [100.2.39.101]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 020FB130E20 for ; Thu, 9 Aug 2018 08:35:35 -0700 (PDT) Received: from [192.168.1.161] (unknown [192.168.1.161]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by straasha.imrryr.org (Postfix) with ESMTPSA id 8F3F62A6907 for ; Thu, 9 Aug 2018 11:35:33 -0400 (EDT) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) From: Viktor Dukhovni In-Reply-To: <3096393.3yWAhzPKLF@pintsize.usersys.redhat.com> Date: Thu, 9 Aug 2018 11:35:32 -0400 Content-Transfer-Encoding: quoted-printable Reply-To: "" Message-Id: References: <3096393.3yWAhzPKLF@pintsize.usersys.redhat.com> To: "" X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: Re: [TLS] Uniqueness of values in lists? X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 09 Aug 2018 15:35:37 -0000 > On Aug 9, 2018, at 10:41 AM, Hubert Kario wrote: >=20 > I've noticed that while there is an explicit requirement for extension = types=20 > to be unique for any given message: >=20 > https://tools.ietf.org/html/draft-ietf-tls-tls13-28#page-43: >=20 > There MUST NOT be more than one extension of the > same type in a given extension block. >=20 > and for key_shares: >=20 > https://tools.ietf.org/html/draft-ietf-tls-tls13-28#page-54 >=20 > Clients MUST NOT offer multiple KeyShareEntry values > for the same group. Those can be in conflict if repeated, because they (often) carry parameters. > I don't see a similar requirement for other lists of values:=20 > signature_algorithms, supported_groups, cipher_suites, etc. >=20 > Did I miss something? These are simple lists of values with no parameters, and mere duplication, though pointless, creates no ambiguity. --=20 Viktor. From nobody Thu Aug 9 09:11:55 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 98D1C130E5C for ; Thu, 9 Aug 2018 09:11:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xtMoYAoM-JLF for ; Thu, 9 Aug 2018 09:11:50 -0700 (PDT) Received: from mx1.redhat.com (mx3-rdu2.redhat.com [66.187.233.73]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7CA17130E5B for ; Thu, 9 Aug 2018 09:11:50 -0700 (PDT) Received: from smtp.corp.redhat.com (int-mx04.intmail.prod.int.rdu2.redhat.com [10.11.54.4]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 848F683221; Thu, 9 Aug 2018 16:11:49 +0000 (UTC) Received: from pintsize.usersys.redhat.com (ovpn-200-43.brq.redhat.com [10.40.200.43]) by smtp.corp.redhat.com (Postfix) with ESMTP id B22632026D66; Thu, 9 Aug 2018 16:11:48 +0000 (UTC) From: Hubert Kario To: tls@ietf.org Cc: "Short, Todd" Date: Thu, 09 Aug 2018 18:11:43 +0200 Message-ID: <2188947.p4FsqiceqA@pintsize.usersys.redhat.com> In-Reply-To: <084E22DD-9B7E-4F68-A0F9-AE17CD1830A6@akamai.com> References: <2fd24f64-bee5-18ed-cf0d-0fc999add395@openssl.org> <9fec7f0c-9591-703a-066f-2eab54a57515@openssl.org> <084E22DD-9B7E-4F68-A0F9-AE17CD1830A6@akamai.com> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="nextPart3102651.CdvAXY5VrF"; micalg="pgp-sha512"; protocol="application/pgp-signature" X-Scanned-By: MIMEDefang 2.78 on 10.11.54.4 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.11.55.1]); Thu, 09 Aug 2018 16:11:49 +0000 (UTC) X-Greylist: inspected by milter-greylist-4.5.16 (mx1.redhat.com [10.11.55.1]); Thu, 09 Aug 2018 16:11:49 +0000 (UTC) for IP:'10.11.54.4' DOMAIN:'int-mx04.intmail.prod.int.rdu2.redhat.com' HELO:'smtp.corp.redhat.com' FROM:'hkario@redhat.com' RCPT:'' Archived-At: Subject: Re: [TLS] inappropriate_fallback X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 09 Aug 2018 16:11:54 -0000 --nextPart3102651.CdvAXY5VrF Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="UTF-8" On Thursday, 9 August 2018 16:09:02 CEST Short, Todd wrote: > > On Aug 9, 2018, at 9:02 AM, Matt Caswell wrote: > >=20 > >=20 > >=20 > > On 09/08/18 13:56, Peter Gutmann wrote: > >=20 > >> =E2=80=8BEric Rescorla writes: > >>=20 > >>=20 > >>> So if the server wants TLS 1.1, then it doesn't set the bytes. > >>=20 > >>=20 > >> If that's the case then the text that says: > >>=20 > >>=20 > >> If negotiating TLS 1.1 or below, TLS 1.3 servers MUST and TLS 1.2 > >> servers SHOULD set the last eight bytes of their Random value ... > >>=20 > >>=20 > >> needs to be fixed, beause as far as I can tell that's saying that if t= he > >> server wants TLS 1.1 then it has to set the bytes, not that it doesn't > >> set the > >> bytes. > >>=20 > >> Here's an example of where this causes problems. A TLS 1.2 client > >> connects to > >> the server. The server, a TLS 1.2 server, is configured to > >> use TLS 1.1, so it responds with the signalling bytes in its random > >> value. > >=20 > >=20 > > That's not the way I read it. If a server is configured to use TLSv1.1 > > then its not a TLSv1.3 server and this text doesn't apply (regardless of > > whether the binary could do TLSv1.3 if it was configured differently). > >=20 > > Matt > >=20 >=20 >=20 > Agreed. >=20 > If a TLS 1.2 (capable) server is negotiating TLS 1.1 with a TLS 1.2 clien= t, > then it can=E2=80=99t be considered a TLS 1.2 server, otherwise, it would= negotiate > TLS 1.2. =20 > It must be considered a TLS 1.1 server, since that is the maximum version= it > is configured to support. actually, no, if it has both TLS 1.2 and TLS 1.1 enabled, then it is a TLS = 1.2=20 server, so receiving a TLS 1.1 ClientHello with FALLBACK_SCSV MUST fail wit= h=20 inappropriate_fallback if it is has TLS 1.1 enabled, and nothing else, *then* it is TLS 1.1 server= ,=20 and receiving a TLS 1.1 ClientHello with FALLBACK_SCSV SHOULD NOT fail (it = may=20 fail because of ciphersuite mismatch, but it MUST NOT fail because of the t= he=20 =46ALLBACK_SCSV being present) situation with TLS 1.3, TLS 1.2 and downgrade protection from Section 4.1.3= =20 (bottom of page 37 onwards: https://tools.ietf.org/html/draft-ietf-tls-tls13-28#page-37) is exactly the= =20 same =E2=80=93 it does not matter what is _implemented_ it matters what is = _enabled_ =2D-=20 Regards, Hubert Kario Senior Quality Engineer, QE BaseOS Security team Web: www.cz.redhat.com Red Hat Czech s.r.o., Purky=C5=88ova 115, 612 00 Brno, Czech Republic --nextPart3102651.CdvAXY5VrF Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part. Content-Transfer-Encoding: 7Bit -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEYeeuxEU+3unL/K+dkqjRuAHS9fUFAltsZ78ACgkQkqjRuAHS 9fWxvw/+OQQB3Ah9bzpbImt7ghP1swMIOB2WhOfFeVmQQunKWdqYl7C7O6UQLIhh i1cMk3ACQvQmW0sgpGPvAWiUmnZ2JS2ftQXq5g7aYdiZNMig+qn6rWUfkBodoV3G x3tVXh/WDZrZUq8Di0nSZ8U1Wzq614rxiCaPDutGPOU/OOUSTKC5Jwxq07/H2IFa lu8QzuC6u206n7E4pGSTwQRc0PiAHvT9/zpGnzIQlr0pXqy935yah14RVlMrkufA 1zU7SWC97wZtbnIbsYFVdlHZ42l3H90+uSXO5/IBvtlr47Y1yxeyrq8LhKkb5SMf q4cb0zCMkPqiX4jBiN75OBB2XOSIq0Xv0ma09CTVVJch1o8OqdW/yNDmevOvH4qa WCRmPo8+iZMFhj9GQqS2WJla/9T98B/WCAu+kkRS1PcnmOfMStUmjBzfijZbjoHp eH/5wtjVKEnaopG+w640Si6bkOgWqVDeltOiVr12IJDuRKVfGocfhPr0Ei3/c4ex fV1wiroZeuyl3INU9H5MYH8VDF4rVygVCfGbP5n8afhX0h9pTShU3Ms6DgMOUQHd JO9fvl4csvPRRYtclrhydshvY7P4Licz29CyJkd7gbXEoZ4p+kM2iHcWq/+kqwfV /C8esxcXWd+FItU07rPMCippsPDwcSHe+EoFGaP4HBUOSxX6TPM= =aOa8 -----END PGP SIGNATURE----- --nextPart3102651.CdvAXY5VrF-- From nobody Thu Aug 9 11:00:38 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4F2F3130E93 for ; Thu, 9 Aug 2018 11:00:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.709 X-Spam-Level: X-Spam-Status: No, score=-2.709 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=akamai.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Vyym7WZhYSwm for ; Thu, 9 Aug 2018 11:00:33 -0700 (PDT) Received: from mx0b-00190b01.pphosted.com (mx0b-00190b01.pphosted.com [IPv6:2620:100:9005:57f::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D99A4130E8E for ; Thu, 9 Aug 2018 11:00:32 -0700 (PDT) Received: from pps.filterd (m0050096.ppops.net [127.0.0.1]) by m0050096.ppops.net-00190b01. (8.16.0.22/8.16.0.22) with SMTP id w79Hqr8o004508 for ; Thu, 9 Aug 2018 19:00:32 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=akamai.com; h=from : to : subject : date : message-id : references : in-reply-to : content-type : mime-version; s=jan2016.eng; bh=sjci4KD4SZKzBLaRNZhhy0Iv38oraeCKonf7zFCNKPw=; b=EwEez4levNWsnASammAsrDTFUe0DxUO/YCc0Pd6/7Ky4d+Y3V/VH0u6RakK9Oby8iIlo w3JBPBUgsNSWMZHpPi+sW4p51khgvtwLr8OiJ1teLk6K+T+tyi3OJ0liNDReoLu7XLqZ vusQwbwSmpIrZg6VCIiurmHl/tAGL6FWj+QvAMH+ei65os0adlkmGnCCQZzXNdBRf5mE T7JqPQegffeIM/4q1Wjq7MbB5VRtj6YtFqv0gz1xraxzwNXtifxcwiUtgJ9nS5csL0OF ZzCi4syYrvffjdLXtU48N4h7vTpCSGNwrt1g4ErWZXRfqGdl/aj/81bZe1zIgi/6omcS pQ== Received: from prod-mail-ppoint2 (prod-mail-ppoint2.akamai.com [184.51.33.19]) by m0050096.ppops.net-00190b01. with ESMTP id 2kqy43mfgg-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Thu, 09 Aug 2018 19:00:31 +0100 Received: from pps.filterd (prod-mail-ppoint2.akamai.com [127.0.0.1]) by prod-mail-ppoint2.akamai.com (8.16.0.21/8.16.0.21) with SMTP id w79Ho13e006384 for ; Thu, 9 Aug 2018 14:00:30 -0400 Received: from email.msg.corp.akamai.com ([172.27.123.33]) by prod-mail-ppoint2.akamai.com with ESMTP id 2kn7fuhk2r-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT) for ; Thu, 09 Aug 2018 14:00:29 -0400 Received: from USMA1EX-DAG1MB1.msg.corp.akamai.com (172.27.123.101) by usma1ex-dag1mb3.msg.corp.akamai.com (172.27.123.103) with Microsoft SMTP Server (TLS) id 15.0.1365.1; Thu, 9 Aug 2018 14:00:28 -0400 Received: from USMA1EX-DAG1MB1.msg.corp.akamai.com ([172.27.123.101]) by usma1ex-dag1mb1.msg.corp.akamai.com ([172.27.123.101]) with mapi id 15.00.1365.000; Thu, 9 Aug 2018 14:00:28 -0400 From: "Short, Todd" To: "" Thread-Topic: [TLS] inappropriate_fallback Thread-Index: AQHULxh75kG8k7OPYk+Jc40sIvbVU6S2GmWAgAABSwCAAAVYAIAAAeqAgAACqoCAAAEfAIABLiYAgABINICAAAifgIAAAZcAgAASnYCAACJIgIAAHmAA Date: Thu, 9 Aug 2018 18:00:27 +0000 Message-ID: References: <2fd24f64-bee5-18ed-cf0d-0fc999add395@openssl.org> <9fec7f0c-9591-703a-066f-2eab54a57515@openssl.org> <084E22DD-9B7E-4F68-A0F9-AE17CD1830A6@akamai.com> <2188947.p4FsqiceqA@pintsize.usersys.redhat.com> In-Reply-To: <2188947.p4FsqiceqA@pintsize.usersys.redhat.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [172.19.38.126] Content-Type: multipart/signed; boundary="Apple-Mail=_0A230889-E5EC-4347-979C-5053D1CA816F"; protocol="application/pgp-signature"; micalg=pgp-sha512 MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2018-08-09_07:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 mlxscore=0 mlxlogscore=892 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1807170000 definitions=main-1808090180 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2018-08-09_07:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=876 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1807170000 definitions=main-1808090181 Archived-At: Subject: Re: [TLS] inappropriate_fallback X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 09 Aug 2018 18:00:36 -0000 --Apple-Mail=_0A230889-E5EC-4347-979C-5053D1CA816F Content-Type: multipart/alternative; boundary="Apple-Mail=_9A3160D9-B554-4C4F-816C-172936A3B50C" --Apple-Mail=_9A3160D9-B554-4C4F-816C-172936A3B50C Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 -- -Todd Short // tshort@akamai.com // "One if by land, two if by sea, three if by the Internet." > On Aug 9, 2018, at 12:11 PM, Hubert Kario wrote: >=20 > On Thursday, 9 August 2018 16:09:02 CEST Short, Todd wrote: >>> On Aug 9, 2018, at 9:02 AM, Matt Caswell wrote: >>>=20 >>>=20 >>> That's not the way I read it. If a server is configured to use = TLSv1.1 >>> then its not a TLSv1.3 server and this text doesn't apply = (regardless of >>> whether the binary could do TLSv1.3 if it was configured = differently). >>>=20 >>> Matt >>>=20 >>=20 >>=20 >> Agreed. >>=20 >> If a TLS 1.2 (capable) server is negotiating TLS 1.1 with a TLS 1.2 = client, >> then it can=E2=80=99t be considered a TLS 1.2 server, otherwise, it = would negotiate >> TLS 1.2. >=20 >> It must be considered a TLS 1.1 server, since that is the maximum = version it >> is configured to support. >=20 > actually, no, if it has both TLS 1.2 and TLS 1.1 enabled, then it is a = TLS 1.2 > server, so receiving a TLS 1.1 ClientHello with FALLBACK_SCSV MUST = fail with > inappropriate_fallback >=20 > if it is has TLS 1.1 enabled, and nothing else, *then* it is TLS 1.1 = server, > and receiving a TLS 1.1 ClientHello with FALLBACK_SCSV SHOULD NOT fail = (it may > fail because of ciphersuite mismatch, but it MUST NOT fail because of = the the > FALLBACK_SCSV being present) ^^^^^^^^^^^^^^^^^^^^^ This is the situation I am referring to TLS 1.1 only (even if it has = disabled TLS 1.2 code). If TLS 1.2 were enabled in the above scenario, = then TLS 1.2 would be negotiated with the TLS 1.2 client. I explicitly stated "since that [TLS 1.1] is the maximum version it is = configured to support". >=20 > situation with TLS 1.3, TLS 1.2 and downgrade protection from Section = 4.1.3 > (bottom of page 37 onwards: > https://tools.ietf.org/html/draft-ietf-tls-tls13-28#page-37) is = exactly the > same =E2=80=93 it does not matter what is _implemented_ it matters = what is _enabled_ >=20 > -- > Regards, > Hubert Kario > Senior Quality Engineer, QE BaseOS Security team > Web: www.cz.redhat.com > Red Hat Czech s.r.o., Purky=C5=88ova 115, 612 00 Brno, Czech Republic --Apple-Mail=_9A3160D9-B554-4C4F-816C-172936A3B50C Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8
--
-Todd Short
// tshort@akamai.com
// "One if by = land, two if by sea, three if by the Internet."

On Aug 9, 2018, at 12:11 PM, Hubert Kario <hkario@redhat.com> = wrote:

On Thursday, 9 August 2018 16:09:02 CEST Short, Todd = wrote:
On Aug 9, 2018, at 9:02 AM, Matt Caswell <matt@openssl.org> = wrote:


That's not the way I = read it. If a server is configured to use TLSv1.1
then its = not a TLSv1.3 server and this text doesn't apply (regardless of
whether the binary could do TLSv1.3 if it was configured = differently).

Matt



Agreed.

If a TLS 1.2 (capable) server is negotiating = TLS 1.1 with a TLS 1.2 client,
then it can=E2=80=99t be = considered a TLS 1.2 server, otherwise, it would negotiate
TLS 1.2.

It must be considered a TLS 1.1 server, since = that is the maximum version it
is configured to = support.

actually, no, if it = has both TLS 1.2 and TLS 1.1 enabled, then it is a TLS 1.2
server, so receiving a TLS 1.1 ClientHello with FALLBACK_SCSV = MUST fail with
inappropriate_fallback

if it is has TLS 1.1 enabled, and nothing else, *then* it is = TLS 1.1 server,
and receiving a TLS 1.1 ClientHello with = FALLBACK_SCSV SHOULD NOT fail (it may
fail because of = ciphersuite mismatch, but it MUST NOT fail because of the the
FALLBACK_SCSV being present)

^^^^^^^^^^^^^^^^^^^^^

This is the situation I am referring to TLS 1.1 = only (even if it has disabled TLS 1.2 code). If TLS 1.2 were enabled in = the above scenario, then TLS 1.2 would be negotiated with the TLS 1.2 = client.
I explicitly stated "since that [TLS 1.1] is the = maximum version it is configured to support".


situation with TLS 1.3, TLS 1.2 and downgrade = protection from Section 4.1.3
(bottom of page 37 = onwards:
https://tools.ietf.org/html/draft-ietf-tls-tls13-28#page-37= ) is exactly the
same =E2=80=93 it does not matter what = is _implemented_ it matters what is _enabled_

--
Regards,
Hubert Kario
Senior Quality Engineer, QE BaseOS Security team
Web: www.cz.redhat.com
Red Hat Czech s.r.o., = Purky=C5=88ova 115, 612 00  Brno, Czech = Republic

= --Apple-Mail=_9A3160D9-B554-4C4F-816C-172936A3B50C-- --Apple-Mail=_0A230889-E5EC-4347-979C-5053D1CA816F Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename="signature.asc" Content-Type: application/pgp-signature; name="signature.asc" Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEisLwOni6taemOfy9z8VToroaDtEFAltsgToACgkQz8VToroa DtG8bQ/+IN1qnie390WDK60mbaU/W7QU1UhpApqPznFvKP9/qNkDr1p2tcHwhAoM UKoRPRb2jYgJPDuyxH5NB8Z6vjhL4e1gl3YXMuhbfjxz5c3oF5Dnm8tY6xPjedAl ie1+EYVwhbaFn6+f2Z1EvsL6RU6RF5H1mFPMv6NOG9nmPgFMn78XYhI+COpVXDPM IfGXEdqDeDVXM3o2D7IFCdHk3zR9JDiX7/OyJQi39YQ0BlCD8i10HedmDNnOgn+4 9HYaYeImxd2AwjjdhhQd74apT3P+RDocgFrTHHweyNIOKUmQxFHvNEC0D0GWhyeU ZCu5jC1RuktHRPlEV4bYS7Cy6PAnGghrmg6jGFo0DR0B39LG6RFAesAiSzaXMA2D d/3iBuzdJy5AF5tdwOcMQpIUY576S2CqMfVjJlURO3MBALogpsgiarstpTwtAsEH zB4APBw82E9CD2YrTfDn+ZneAvHKUtHhyJfpzkXn7vjmQ32D/eukLoebxajKtDOr 1SbEikgV/LTwXYpdlQqz+gmzN1F9MhtIYwKyGP8thY86OKPoKGLfkES52sFcTCNl shrZaFU6u5GuMlFYqpzo+27kfXFEko7SAqRHhQjoMGdGrugkoCr3sxflm8VLV/Ix q1lS0VnwGoRZ+710ET3lTlxq9o2PIw9cyTiF4yu1J2VxleeeMOc= =TY7N -----END PGP SIGNATURE----- --Apple-Mail=_0A230889-E5EC-4347-979C-5053D1CA816F-- From nobody Thu Aug 9 11:34:24 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 09EC1130E9E for ; Thu, 9 Aug 2018 11:34:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sn3rd.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QMMIybkwUYC8 for ; Thu, 9 Aug 2018 11:34:20 -0700 (PDT) Received: from mail-qt0-x234.google.com (mail-qt0-x234.google.com [IPv6:2607:f8b0:400d:c0d::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3E1FD127AC2 for ; Thu, 9 Aug 2018 11:34:20 -0700 (PDT) Received: by mail-qt0-x234.google.com with SMTP id b15-v6so7582140qtp.11 for ; Thu, 09 Aug 2018 11:34:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sn3rd.com; s=google; h=from:content-transfer-encoding:mime-version:subject:message-id:date :to; bh=FJH3SLRsEJF+s3X/Jv4N6CjM5DfpfuALuxHXHo+ZCT0=; b=CtxOoLBeRff0Z4Ad3eY08ZwepNbkPB9qZ3P3hAkyQ02sRiHb7koKUbbU7oQye2oWEZ C+CkaFXB3xfUibfzyCRBHo8VL/t6wUKwxgjHRo7NxDnFJG+jo+aEBUg5R3dWROqnKOMw gRqtv7OkkaqA5KAzVN/atnpxEt5Du46JdyhrM= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:content-transfer-encoding:mime-version :subject:message-id:date:to; bh=FJH3SLRsEJF+s3X/Jv4N6CjM5DfpfuALuxHXHo+ZCT0=; b=pU0P2CPWR9YQiLeXKI1fhoG5iqtiMKjdLDLd4Ao+1kBNyPQGQBCVX9C41LZ5v/6jWf Hkh3eEI5hJGi4N4qBgbZuF1nvt3n9Jl2UwlhVI1/HcQtD/qoU512XlqGiohHJqtFQHkG 5iZtpvb1/4Fd7Jnmo7moMakFB9Vfj34U7BnTM3mbq4vZrGvw0jWf1t+vTLpymoMbouL9 UiUTHqqkTng4DGO4XrKU56SyAE9l0wrSsXYF8M6ee0ggFGE86DD5Ktl6XcW4rISPjstF hljZUywTCgLt0aFGgmvjxK1aCfy5hfmyTDnhL1wLQGY1gpOr9lE/N+QwbCagnFEfOv2Z Gd4g== X-Gm-Message-State: AOUpUlGfijrLBdanOP1xxz7Y/r7aqxOjzvYoTCUuM2wM6JTFFHgWBnbg o4TbChyyAlo94WI/OPAAIyDGvZkuZNw= X-Google-Smtp-Source: AA+uWPzG+1M2iS3UN72jbOxsBI3KhvlBOOlUx+YUmzZrZ5D/Goxah0XI6AW2SmlS3JeCS/nVWDu2NQ== X-Received: by 2002:a0c:f94e:: with SMTP id i14-v6mr2934245qvo.73.1533839659215; Thu, 09 Aug 2018 11:34:19 -0700 (PDT) Received: from [172.16.0.18] ([96.231.225.148]) by smtp.gmail.com with ESMTPSA id z123-v6sm4739869qke.68.2018.08.09.11.34.18 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 09 Aug 2018 11:34:18 -0700 (PDT) From: Sean Turner Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) Message-Id: <0115A75C-0A99-4AD7-A303-26337B99488A@sn3rd.com> Date: Thu, 9 Aug 2018 14:34:17 -0400 To: tls@ietf.org X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: [TLS] draft-ietf-tls-subcerts-01: some nits a question X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 09 Aug 2018 18:34:23 -0000 Hi, I submitted a PR to address some nits I noticed: https://github.com/tlswg/tls-subcerts/pull/17 One question: In s3, public_key is the same thing as RawPublicKey in RFC 7250, i.e., = they are both DER-encoded SPKI from RFC5280? If it is, does it make = sense to reuse: opaque ASN.1_subjectPublicKeyInfo<1..2^24-1> ? If not, shouldn=E2=80=99t public_key<0..2^16-1>; be public_key<1..2^16-1>; or public_key<1..2^24-1> spt From nobody Thu Aug 9 14:42:04 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CB879130EF3 for ; Thu, 9 Aug 2018 14:42:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.719 X-Spam-Level: X-Spam-Status: No, score=-2.719 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01, T_DKIMWL_WL_MED=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=fb.com header.b=Z9CqfjxA; dkim=pass (1024-bit key) header.d=fb.onmicrosoft.com header.b=IuZHSawa Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bHCQbCXCJqq8 for ; Thu, 9 Aug 2018 14:41:59 -0700 (PDT) Received: from mx0a-00082601.pphosted.com (mx0b-00082601.pphosted.com [67.231.153.30]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 93BA9130EF0 for ; Thu, 9 Aug 2018 14:41:59 -0700 (PDT) Received: from pps.filterd (m0089730.ppops.net [127.0.0.1]) by m0089730.ppops.net (8.16.0.22/8.16.0.22) with SMTP id w79Ld5ew010702; Thu, 9 Aug 2018 14:41:58 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fb.com; h=from : to : subject : date : message-id : references : in-reply-to : content-type : mime-version; s=facebook; bh=rVncLdOOFAGMzmtOkwGfsvJffrMZrxKMTrYkUUhBf6g=; b=Z9CqfjxAzt2MYWVBg+NPyEY9fANmuLPwwGkZbDbrAw/RwbuXm+35FDT4Jb2fcQhxygIO dpA7NIKjAxMkktOIGGzlWV6/HfRY0+/OVv43AiJzLeulatxlxIitx7dlOtklkY5j98ay QO8LaWN0+qlBrkGPlTKhPBYB4U+hZG7VJPI= Received: from mail.thefacebook.com ([199.201.64.23]) by m0089730.ppops.net with ESMTP id 2krust0bps-3 (version=TLSv1 cipher=ECDHE-RSA-AES256-SHA bits=256 verify=NOT); Thu, 09 Aug 2018 14:41:58 -0700 Received: from NAM02-CY1-obe.outbound.protection.outlook.com (192.168.54.28) by o365-in.thefacebook.com (192.168.16.24) with Microsoft SMTP Server (TLS) id 14.3.361.1; Thu, 9 Aug 2018 14:41:56 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fb.onmicrosoft.com; s=selector1-fb-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=rVncLdOOFAGMzmtOkwGfsvJffrMZrxKMTrYkUUhBf6g=; b=IuZHSawa9itxTzj20QVYZ5BjbMfG8ZWC94dyatz2ZlwJ//a56xu+ymVSxMI7CvcdSQzTqln+yC9MAXfFViucsQEon93QrO9XOLOLgXIBXT29QF6a3eoRHOQ/JVaE9sjd4ktwPs4HLoofmdnxwLtBEFlZfnSrOSrkayW/0a49l84= Received: from MWHPR15MB1821.namprd15.prod.outlook.com (10.174.255.137) by MWHPR15MB1296.namprd15.prod.outlook.com (10.175.3.22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1038.19; Thu, 9 Aug 2018 21:41:55 +0000 Received: from MWHPR15MB1821.namprd15.prod.outlook.com ([fe80::18bc:612d:2c36:5c1b]) by MWHPR15MB1821.namprd15.prod.outlook.com ([fe80::18bc:612d:2c36:5c1b%6]) with mapi id 15.20.1017.020; Thu, 9 Aug 2018 21:41:55 +0000 From: Subodh Iyengar To: Sean Turner , "tls@ietf.org" Thread-Topic: [TLS] draft-ietf-tls-subcerts-01: some nits a question Thread-Index: AQHUMA/DEsqhHH1wy0+CYj1KWjYB/qS380XG Date: Thu, 9 Aug 2018 21:41:54 +0000 Message-ID: References: <0115A75C-0A99-4AD7-A303-26337B99488A@sn3rd.com> In-Reply-To: <0115A75C-0A99-4AD7-A303-26337B99488A@sn3rd.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [2620:10d:c090:200::4:a60d] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; MWHPR15MB1296; 20:bEiW6DWS+9t5TdKIE3852BPsK1cmQulWFE3IX45fnIjPilGo2nSXDSrvwb0JnDpytUSjgfGTDWDyyjb/qFlvhmD39Vx07hpiYV7eRAaAJVWAyzEBmXU3lrebbLlmWG5dgF3Uk9Ej58CvRJztsD7oYAZcAsfZXtBZvDcKmwztBNI= x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-correlation-id: 073ea7d5-f9cd-4b50-4ef5-08d5fe40ed17 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(7020095)(4652040)(8989117)(4534165)(4627221)(201703031133081)(201702281549075)(8990107)(5600074)(711020)(2017052603328)(7153060)(7193020); SRVR:MWHPR15MB1296; x-ms-traffictypediagnostic: MWHPR15MB1296: x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(10436049006162)(166708455590820); x-ms-exchange-senderadcheck: 1 x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(8211001083)(6040522)(2401047)(5005006)(8121501046)(3002001)(10201501046)(3231311)(11241501184)(944501410)(52105095)(93006095)(93001095)(149027)(150027)(6041310)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123562045)(20161123564045)(20161123558120)(20161123560045)(6072148)(201708071742011)(7699016); SRVR:MWHPR15MB1296; BCL:0; PCL:0; RULEID:; SRVR:MWHPR15MB1296; x-forefront-prvs: 0759F7A50A x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(346002)(376002)(39860400002)(366004)(136003)(396003)(189003)(199004)(6506007)(478600001)(6116002)(9686003)(55016002)(236005)(68736007)(446003)(11346002)(54896002)(6436002)(316002)(476003)(105586002)(486006)(6306002)(14454004)(102836004)(106356001)(110136005)(53936002)(966005)(46003)(33656002)(19627405001)(2900100001)(186003)(8676002)(81166006)(81156014)(5660300001)(7696005)(2501003)(6246003)(2906002)(97736004)(45954006)(76176011)(575784001)(86362001)(256004)(74316002)(8936002)(229853002)(99286004)(7736002)(25786009)(53546011)(5250100002)(6606003)(606006); DIR:OUT; SFP:1102; SCL:1; SRVR:MWHPR15MB1296; H:MWHPR15MB1821.namprd15.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: fb.com does not designate permitted sender hosts) x-microsoft-antispam-message-info: 5FkquWu4BZd9eoajqTUTAeA7zp3H8F6otvYlUMQ1zoMMMG+R6FezoMmXh+zRfB8Xu4nywpyZVJcXqtCmWR+ThRPE9I3Og8EkFObzp8nOWNmUPFjbYVlprlU/sV7xcDX6IiFediEX1bdlZ7ncDsRRC8ZXPezE1IRmiz4qyzGor9XxTgJT4WDfCZLO3LdiHzIO8ofMP5hz6yn8EN4WrjnJk1pEOeBi2iGRzrQSWusxyeeLKJ3U2wpISzJheKootnR+pquPBE1VFvI0OdH1plD2UDQzQY9Sd6lHL7X1LqsgH7Tm4+WlxTf/0WqKm3UFleS9Xm/ekyxXHAWqY3VdhSG6s9MKPDAvyg8xsT5ljr+kFDw= spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_MWHPR15MB1821F570485D3CE5E0ED44B5B6250MWHPR15MB1821namp_" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: 073ea7d5-f9cd-4b50-4ef5-08d5fe40ed17 X-MS-Exchange-CrossTenant-originalarrivaltime: 09 Aug 2018 21:41:54.9230 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 8ae927fe-1255-47a7-a2af-5f3a069daaa2 X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR15MB1296 X-OriginatorOrg: fb.com X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2018-08-09_08:, , signatures=0 X-Proofpoint-Spam-Reason: safe X-FB-Internal: Safe Archived-At: Subject: Re: [TLS] draft-ietf-tls-subcerts-01: some nits a question X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 09 Aug 2018 21:42:03 -0000 --_000_MWHPR15MB1821F570485D3CE5E0ED44B5B6250MWHPR15MB1821namp_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable Ya you're right here it is the DER-encoded SPKI and opaque ASN.1_subjectPub= licKeyInfo is the right way to go. Thanks, Subodh ________________________________ From: TLS on behalf of Sean Turner Sent: Thursday, August 9, 2018 11:34:17 AM To: tls@ietf.org Subject: [TLS] draft-ietf-tls-subcerts-01: some nits a question Hi, I submitted a PR to address some nits I noticed: https://github.com/tlswg/tls-subcerts/pull/17 One question: In s3, public_key is the same thing as RawPublicKey in RFC 7250, i.e., they= are both DER-encoded SPKI from RFC5280? If it is, does it make sense to re= use: opaque ASN.1_subjectPublicKeyInfo<1..2^24-1> ? If not, shouldn=92t public_key<0..2^16-1>; be public_key<1..2^16-1>; or public_key<1..2^24-1> spt _______________________________________________ TLS mailing list TLS@ietf.org https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailman= _listinfo_tls&d=3DDwIGaQ&c=3D5VD0RTtNlTh3ycd41b3MUw&r=3Dh3Ju9EBS7mHtwg-wAyN= 7fQ&m=3DIrOKyHv0mMG3XQlDR58bcZJrllo1irdlbauz8t892yI&s=3DWCIr65m_Feq1ii72j9E= c0ftL44J0j4f-3zWbbZgcAjU&e=3D --_000_MWHPR15MB1821F570485D3CE5E0ED44B5B6250MWHPR15MB1821namp_ Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable

Ya you're right here it is the DE= R-encoded SPKI and op= aque ASN.1_subjectPublicKeyInfo is the right way to go.


Thanks,

Subodh

From: TLS <tls-bounces@i= etf.org> on behalf of Sean Turner <sean@sn3rd.com>
Sent: Thursday, August 9, 2018 11:34:17 AM
To: tls@ietf.org
Subject: [TLS] draft-ietf-tls-subcerts-01: some nits a question
 
Hi,

I submitted a PR to address some nits I noticed:
https://github.co= m/tlswg/tls-subcerts/pull/17

One question:

In s3, public_key is the same thing as RawPublicKey in RFC 7250, i.e., they= are both DER-encoded SPKI from RFC5280? If it is, does it make sense to re= use:
opaque ASN.1_subjectPublicKeyInfo<1..2^24-1> ?
If not, shouldn=92t
public_key<0..2^16-1>;
be
public_key<1..2^16-1>;
or
public_key<1..2^24-1>

spt

_______________________________________________
TLS mailing list
TLS@ietf.org
https://u= rldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailman_listinfo= _tls&d=3DDwIGaQ&c=3D5VD0RTtNlTh3ycd41b3MUw&r=3Dh3Ju9EBS7mHtwg-w= AyN7fQ&m=3DIrOKyHv0mMG3XQlDR58bcZJrllo1irdlbauz8t892yI&s=3DWCIr65m_= Feq1ii72j9Ec0ftL44J0j4f-3zWbbZgcAjU&e=3D
--_000_MWHPR15MB1821F570485D3CE5E0ED44B5B6250MWHPR15MB1821namp_-- From nobody Thu Aug 9 15:07:45 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CE084130E21 for ; Thu, 9 Aug 2018 15:07:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BBdKd2A2-ZRl for ; Thu, 9 Aug 2018 15:07:42 -0700 (PDT) Received: from mail.smeinc.net (mail.smeinc.net [209.135.209.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 38648130DCE for ; Thu, 9 Aug 2018 15:07:42 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mail.smeinc.net (Postfix) with ESMTP id 1665B300A31 for ; Thu, 9 Aug 2018 18:07:40 -0400 (EDT) X-Virus-Scanned: amavisd-new at mail.smeinc.net Received: from mail.smeinc.net ([127.0.0.1]) by localhost (mail.smeinc.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id iHtNasLWCBm1 for ; Thu, 9 Aug 2018 18:07:39 -0400 (EDT) Received: from [192.168.1.147] (047-133-081-124.res.spectrum.com [47.133.81.124]) by mail.smeinc.net (Postfix) with ESMTPSA id 078FC300568; Thu, 9 Aug 2018 18:07:38 -0400 (EDT) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) From: Russ Housley In-Reply-To: Date: Thu, 9 Aug 2018 18:07:38 -0400 Cc: IETF TLS Content-Transfer-Encoding: quoted-printable Message-Id: References: To: Christopher Wood X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: Re: [TLS] Minutes for TLS IETF 102 uploaded X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 09 Aug 2018 22:07:44 -0000 I do not understand the formatting. Are the '*' characters supposed to = be bullets? If so, them appearing in the middle of paragraphs is = confusing. Russ > On Jul 28, 2018, at 1:32 PM, Christopher Wood = wrote: >=20 > Minutes for both TLS sessions at IETF 102 have been uploaded: > https://datatracker.ietf.org/doc/minutes-102-tls/ >=20 > Many thanks to Joe Hall and Gurshabad Grover for taking detailed = notes. >=20 > Please review the minutes and check for inaccuracies. If anything is > incorrect, please let the chairs know ASAP. >=20 > Thanks, > Chris, Joe, and Sean From nobody Thu Aug 9 18:33:52 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 89ACD130EAF for ; Thu, 9 Aug 2018 18:33:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LPK1vPJ7vb7s for ; Thu, 9 Aug 2018 18:33:47 -0700 (PDT) Received: from huawei.com (lhrrgout.huawei.com [185.176.76.210]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AA0A8130E96 for ; Thu, 9 Aug 2018 18:33:47 -0700 (PDT) Received: from lhreml701-cah.china.huawei.com (unknown [172.18.7.108]) by Forcepoint Email with ESMTP id 85FAEF0CBB42C for ; Fri, 10 Aug 2018 02:33:44 +0100 (IST) Received: from DGGEML424-HUB.china.huawei.com (10.1.199.41) by lhreml701-cah.china.huawei.com (10.201.108.42) with Microsoft SMTP Server (TLS) id 14.3.399.0; Fri, 10 Aug 2018 02:33:44 +0100 Received: from DGGEML531-MBX.china.huawei.com ([169.254.6.153]) by dggeml424-hub.china.huawei.com ([10.1.199.41]) with mapi id 14.03.0399.000; Fri, 10 Aug 2018 09:33:40 +0800 From: yinxinxing To: Russ Housley , Christopher Wood CC: IETF TLS Thread-Topic: [TLS] Minutes for TLS IETF 102 uploaded Thread-Index: AQHUJpkWupoaPoXnpUuEtzZuiMIDsaS3h3UAgAC+9/A= Date: Fri, 10 Aug 2018 01:33:40 +0000 Message-ID: References: In-Reply-To: Accept-Language: zh-CN, en-US Content-Language: zh-CN X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.151.55.175] Content-Type: text/plain; charset="gb2312" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-CFilter-Loop: Reflected Archived-At: Subject: [TLS] =?gb2312?b?tPC4tDogIE1pbnV0ZXMgZm9yIFRMUyBJRVRGIDEwMiB1?= =?gb2312?b?cGxvYWRlZA==?= X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 10 Aug 2018 01:33:50 -0000 KzEuDQpJIGFtIGFsc28gY29uZnVzZWQgYnkgdGhlICouIEkgb3BlbiB0aGUgbGluayB2aWEgd2Vi LiANCg0KWWluIFhpbnhpbmcNCi0tLS0t08q8/tStvP4tLS0tLQ0Kt6K8/sjLOiBUTFMgW21haWx0 bzp0bHMtYm91bmNlc0BpZXRmLm9yZ10gtPqx7SBSdXNzIEhvdXNsZXkNCreiy83KsbzkOiAyMDE4 xOo41MIxMMjVIDY6MDgNCsrVvP7IyzogQ2hyaXN0b3BoZXIgV29vZCA8Y2hyaXN0b3BoZXJ3b29k MDdAZ21haWwuY29tPg0Ks63LzTogSUVURiBUTFMgPHRsc0BpZXRmLm9yZz4NCtb3zOI6IFJlOiBb VExTXSBNaW51dGVzIGZvciBUTFMgSUVURiAxMDIgdXBsb2FkZWQNCg0KSSBkbyBub3QgdW5kZXJz dGFuZCB0aGUgZm9ybWF0dGluZy4gIEFyZSB0aGUgJyonIGNoYXJhY3RlcnMgc3VwcG9zZWQgdG8g YmUgYnVsbGV0cz8gIElmIHNvLCB0aGVtIGFwcGVhcmluZyBpbiB0aGUgbWlkZGxlIG9mIHBhcmFn cmFwaHMgaXMgY29uZnVzaW5nLg0KDQpSdXNzDQoNCg0KPiBPbiBKdWwgMjgsIDIwMTgsIGF0IDE6 MzIgUE0sIENocmlzdG9waGVyIFdvb2QgPGNocmlzdG9waGVyd29vZDA3QGdtYWlsLmNvbT4gd3Jv dGU6DQo+IA0KPiBNaW51dGVzIGZvciBib3RoIFRMUyBzZXNzaW9ucyBhdCBJRVRGIDEwMiBoYXZl IGJlZW4gdXBsb2FkZWQ6DQo+IGh0dHBzOi8vZGF0YXRyYWNrZXIuaWV0Zi5vcmcvZG9jL21pbnV0 ZXMtMTAyLXRscy8NCj4gDQo+IE1hbnkgdGhhbmtzIHRvIEpvZSBIYWxsIGFuZCBHdXJzaGFiYWQg R3JvdmVyIGZvciB0YWtpbmcgZGV0YWlsZWQgbm90ZXMuDQo+IA0KPiBQbGVhc2UgcmV2aWV3IHRo ZSBtaW51dGVzIGFuZCBjaGVjayBmb3IgaW5hY2N1cmFjaWVzLiBJZiBhbnl0aGluZyBpcyANCj4g aW5jb3JyZWN0LCBwbGVhc2UgbGV0IHRoZSBjaGFpcnMga25vdyBBU0FQLg0KPiANCj4gVGhhbmtz LA0KPiBDaHJpcywgSm9lLCBhbmQgU2Vhbg0KDQpfX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fXw0KVExTIG1haWxpbmcgbGlzdA0KVExTQGlldGYub3JnDQpodHRw czovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3Rscw0K From nobody Thu Aug 9 21:53:54 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CDA6B130F18 for ; Thu, 9 Aug 2018 21:53:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.276 X-Spam-Level: X-Spam-Status: No, score=-1.276 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, MIME_HTML_ONLY=0.723, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mVLMCX6ndUhD for ; Thu, 9 Aug 2018 21:53:41 -0700 (PDT) Received: from mail-qt0-x22f.google.com (mail-qt0-x22f.google.com [IPv6:2607:f8b0:400d:c0d::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 00897130F35 for ; Thu, 9 Aug 2018 21:53:40 -0700 (PDT) Received: by mail-qt0-x22f.google.com with SMTP id e19-v6so9063064qtp.8 for ; Thu, 09 Aug 2018 21:53:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:cc:references:from:message-id:date:user-agent :mime-version:in-reply-to:content-language:content-transfer-encoding; bh=56qI5zAkiGdU0+htcaglVGKyjJfm8LFZbzCLD7KSU4c=; b=eN+JBslBauN9/TUiPejYczDGAwoHnPD28Zka0dUm+p3OJYC6w0Q4rrER2sAKiJlxS7 eCS/meXshD8QKQk8T66zEcAXJrpHOQsgTPdKeeTtK6JjZpA9iNvWJxQ3oOY6YBxZsJTf 7EKjOxQkZo14bZ/kodTGkUlaDDfsUclX9AuSCyk/YVUuOgVJ7bbDVl08ESEQZVYEbA0S VpPOhFnmHDqLtfK/33KE7/Jab+JIh+otwCkaMnVW9ymIE6Z6jRHjAOGN1bYPuA5IlP9V O3yJMbwZbiX2ErriSRRFmFBGhHcd8II+Nk8Bo7RhsIHXP+9UwiyRi+RTwFLQysnGXvUd Cf7w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:cc:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=56qI5zAkiGdU0+htcaglVGKyjJfm8LFZbzCLD7KSU4c=; b=Kgvjh+Zir2XaYGBt5BCR2lG8ly8IZgfE3hmJI6EbU5/1U3uMFtSBOXy+6wAlJeAafz eBHXGKNlgtozs+cX9ZrfdBYEb8E06I9SpBz0HCmNFAzulQAKG5JKtxMktd8BNP3dDNsv Cf8lCPSF0VEP5E0DzSfl/qT9PE3Xhs6BIx8VF0Is/Vzx6nlBxHZg1d/O/dca35DbH/yb BuWhdJUlWf7fm91otpM5ptsWvEBRWirBIBUesVLXXBNRICkX+E4Ky2Rqx1R1X/aJO8mS fKgMauU3RaKefl0E8f4TQ7EIjK2jyksZTHnicNJoMK2QYOk9AuJacmGjJrhai+YECx3T c+oQ== X-Gm-Message-State: AOUpUlF8oI1zlOq7ABUQ0QacvVZHdmhoP7S9ES0GMcOrQ5FGUV+OZl7e jmZaWpKCFbjwmh1wzlG0/+3ximaS X-Google-Smtp-Source: AA+uWPzyKqZNEpfEQbpdf9RpGyAp+ktW4w+CPVBPuwc+OiSvDOJUXdSKgZcB+SJM4gQIMFb2U88keg== X-Received: by 2002:ac8:2c1a:: with SMTP id d26-v6mr5109046qta.338.1533876819815; Thu, 09 Aug 2018 21:53:39 -0700 (PDT) Received: from ?IPv6:2001:420:c0e0:1002::a8? ([2001:420:c0e0:1002::a8]) by smtp.googlemail.com with ESMTPSA id j86-v6sm7663808qkh.60.2018.08.09.21.53.37 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 09 Aug 2018 21:53:38 -0700 (PDT) To: Russ Housley , Christopher Wood Cc: IETF TLS References: From: Kaarthik Sivakumar Message-ID: <358d7f50-2055-b903-36f9-7518e957b791@gmail.com> Date: Fri, 10 Aug 2018 10:23:34 +0530 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:52.0) Gecko/20100101 Thunderbird/52.5.2 MIME-Version: 1.0 In-Reply-To: Content-Type: text/html; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [TLS] Minutes for TLS IETF 102 uploaded X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 10 Aug 2018 04:53:54 -0000

Could be line ending issues - I see something like these when switching between different OSes.


-kaarthik-

On 10/08/18 03:37, Russ Housley wrote:
I do not understand the formatting.  Are the '*' characters supposed to be bullets?  If so, them appearing in the middle of paragraphs is confusing.

Russ



On Jul 28, 2018, at 1:32 PM, Christopher Wood <christopherwood07@gmail.com> wrote:

Minutes for both TLS sessions at IETF 102 have been uploaded:
https://datatracker.ietf.org/doc/minutes-102-tls/

Many thanks to Joe Hall and Gurshabad Grover for taking detailed notes.

Please review the minutes and check for inaccuracies. If anything is
incorrect, please let the chairs know ASAP.

Thanks,
Chris, Joe, and Sean

_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls

From nobody Fri Aug 10 07:08:24 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8A08F130DF7 for ; Fri, 10 Aug 2018 07:08:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.749 X-Spam-Level: X-Spam-Status: No, score=-1.749 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_ENVFROM_END_DIGIT=0.25, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gtorLLSTLj8M for ; Fri, 10 Aug 2018 07:08:21 -0700 (PDT) Received: from mail-wm0-x22f.google.com (mail-wm0-x22f.google.com [IPv6:2a00:1450:400c:c09::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2CDB2129C6A for ; Fri, 10 Aug 2018 07:08:21 -0700 (PDT) Received: by mail-wm0-x22f.google.com with SMTP id o11-v6so2040913wmh.2 for ; Fri, 10 Aug 2018 07:08:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:reply-to:from:date:message-id:subject:to:cc; bh=DNUaCB8r1WmkI6Vej4KGjf2Efj0Bbdy8Q3fVr3L6BtE=; b=Yh+1mjwAZ7hbCZmFM0q0wTJ/z5zSolAl96tUu2nQvD/z34HYF0d8zfXVSXR9d7YGJJ JbMkdU8kbjeoahZ29WiXKbXm+8cAjRsxyUuZEPgakG5SW0y9Rahey/Vslelc+k31j9nC u40Dlx5eP/taCuvaSD212Si1O+B6hhfJupXOqnqQoIrMViJsig26GgP2d6FhWCtN/H7q nv4yGAhufVnyj6Oag0vuAGlZ7VhYDZp6twS7Z8G4sFFvVjzN5Rq7GBspzZdzi+7/aGUm 28AGIU8XCjtXRdcoKT8h7XpITSQAdGRneD/aF6qIaer91vUgHhsOSsFM/t3I0WnjOOSt KDAw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:reply-to:from:date:message-id :subject:to:cc; bh=DNUaCB8r1WmkI6Vej4KGjf2Efj0Bbdy8Q3fVr3L6BtE=; b=hIVsOa1jLCkirUqJpAWaVGHFomdXeJv7KqkJlPf5uooOIztsw0NyUcd2nnvOakxWPS Q8zR+w7OVzxH9YWcgx5mYjreElvfZtkw8ftk/B/i6ZlGb0+yBUp434skGMv408evmo4O aQaTZ14GKL47k2lgAO2S3oqOFLQijF4HR9Ohi2zXZPHpguDdOPHvg1+xOiqNX3U2FGou kdtfNekMDwHOle2spftI8XVD68bT65XruLb5g2OP7+6gaUgWJVgSl7JCviWkhR0GglJV YqAktofOUQSFZ1JPQNCLH1PxovgB1nsKVWogIIvcUibFDDocwtckusqtfZD8ths4ecZk zaSA== X-Gm-Message-State: AOUpUlE2+b3SElrzgTIWANVvA9xP30vxxxbQBv8YZIbVTiiejIj4Gv9L cg2MMlB7KZ9O2RG+HaC7MJxuMSivj0HWt9x2YHaNkw== X-Google-Smtp-Source: AA+uWPz2bL3yWFTYohhhaSg2AFgHd63Vs4ffh3RgSDFVAOaL0CY5rGAfNB0a+7+1xCunJ1qrXvTq/onol8OSD95dj9A= X-Received: by 2002:a1c:1a02:: with SMTP id a2-v6mr1773859wma.52.1533910099478; Fri, 10 Aug 2018 07:08:19 -0700 (PDT) MIME-Version: 1.0 Received: by 2002:adf:ef8f:0:0:0:0:0 with HTTP; Fri, 10 Aug 2018 07:08:19 -0700 (PDT) Reply-To: sarikaya@ieee.org From: Behcet Sarikaya Date: Fri, 10 Aug 2018 09:08:19 -0500 Message-ID: To: tls@ietf.org Cc: Dirk.von-Hugo@telekom.de Content-Type: multipart/alternative; boundary="00000000000098cc7e05731546e1" Archived-At: Subject: [TLS] New Non-WG Mailing List: PidLoc X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 10 Aug 2018 14:08:22 -0000 --00000000000098cc7e05731546e1 Content-Type: text/plain; charset="UTF-8" TLS chairs, please approve this non-member post. A new IETF non-working group email list has been created. List address: PIdLoc@ietf.org Archive: https://mailarchive.ietf.org/arch/browse/pidloc/ To subscribe: https://www.ietf.org/mailman/listinfo/pidloc Purpose: In IdLoc protocols like LISP, ILA, etc. separation between (fixed) Identifier and (dynamic) Location is proposed to find optimum path for data packets to/from moving devices The threats against privacy in IdLoc protocols include location privacy where if a third party can at any time determine the IP location of some identifier, then the device can at one point be IP geolocated and movement privacy where if a third party can determine that an identifier has changed locator(s) at time T, then even without knowing the particular locators before and after, it can correlate this movement event with other information to create a binding between the identifier and a person. Privacy and security work is needed both in control and data plane There is an existing draft https://www.ietf.org/id/ draft-nordmark-id-loc-privacy-00.txt that is expected to serve as a starting point. The work is expected to clear the way for a wider acceptance/deployment of IdLoc protocol. This may open new application areas such as in future mobile networks. In future mobile networks more efficient differentiation of packet handling according to specific service demands (QoS) are expected. Traditional tunneling and encapsulation between IP addresses (= Id and/or Loc) have disadvantages --00000000000098cc7e05731546e1 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
TLS chairs, please approve this non-member post.


A new IETF non-working group email list has be= en created.

List address: PIdLoc@ietf.org
Archive: https://mailarchive.ietf.org/arch/br= owse/pidloc/
To subscribe: https://www.ietf.org/mailman/listinf= o/pidloc

Purpose:
=C2=A0In IdLoc protocols like LISP, ILA, etc.=C2=A0 separation between (fix= ed)
Identifier and (dynamic) Location is proposed to find optimum path for data=
packets to/from moving devices

The threats against privacy in IdLoc protocols include

location privacy where if a third party can at any time determine the IP location of some identifier, then the device can at one point be IP
geolocated and

movement privacy where if a third party can determine that an identifier has changed locator(s) at time T, then even without knowing the
particular locators
before and after, it can correlate this movement event with other
information to create a binding between the identifier and a person.

Privacy and security work is needed both in control and data plane

There is an existing draft https://www.ietf.org/id/
draft-nordmark-id-loc-privacy-00.txt that is expected to serve as a starting point.

The work is expected to clear the way for a wider acceptance/deployment
of IdLoc protocol. This may open new application areas such as in future mobile networks.

In future mobile networks more efficient differentiation of packet
handling according to specific service demands (QoS) are expected. Traditio= nal
tunneling and encapsulation between IP addresses (=3D Id and/or Loc) have disadvantages

--00000000000098cc7e05731546e1-- From nobody Fri Aug 10 08:41:05 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D1BC7130DDB for ; Fri, 10 Aug 2018 08:41:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.749 X-Spam-Level: X-Spam-Status: No, score=-1.749 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_ENVFROM_END_DIGIT=0.25, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iVkcAcsUVzuz for ; Fri, 10 Aug 2018 08:41:01 -0700 (PDT) Received: from mail-pf1-x430.google.com (mail-pf1-x430.google.com [IPv6:2607:f8b0:4864:20::430]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 65A8412785F for ; Fri, 10 Aug 2018 08:41:01 -0700 (PDT) Received: by mail-pf1-x430.google.com with SMTP id a26-v6so4711786pfo.4 for ; Fri, 10 Aug 2018 08:41:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:embedded-html; bh=HCc7bYhRj4llXv4T5WBDukJ2zleOOzVG9C+yZbGeIB4=; b=KZdmoJH8X2sCbiHsiyPYnagKcLiarfmwkKNh/xUdqRToy350WGdP3Y66V7hnXmfqRo 6P3nsctBtysKHNe/OfQLVjYt6ZNhb6EfC8XJT6bKNYRpIk/+LBm9HE0l94Zig5TCAtNf P+K7HX8I6zpCo/kTi9cB8ViRF7fmRAtVVQzDwF85g6EUnegc36jXrgyqKbZmCvzbQe+A DH3VQVBzHbqFwrEHRjs/j05uDaQ8SeNuJYQKw36mtK3iF3D3jExIMqUVrKJ7RfO6Y0h+ yjtkJgPeUikbbo3LGVKGF8d9qKkB8HUYUexgNhjESsUoLux0rP9hNJhb0pnGk9NFAbie uF8Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:embedded-html; bh=HCc7bYhRj4llXv4T5WBDukJ2zleOOzVG9C+yZbGeIB4=; b=dng00tTKwtGFgsP+ARQEgGmSTBugbZQuyG0gVAGO6KUjCApWtxqiBeo/+hwul8AqC6 wpx6LvADm3LjT5HHcbFHrkjlPa4re5ZNDR9b54zIv6aJtjLLNgIN9dO57bp9KObmpT+G 481HrIEPu0gDgIZw7Y2Lz/g18HpiJOr3z6eK52gJxi+5l1zy09SH296cCyFUzAjdfQSk sW5hTsyowV9+VDjoL5zvk0Vxgz5cc83B4by6ASJSgMVsokY4VUEHXgbMHBowr38mkLHY OheB2QcEcP86VMj9z26s4QnhJVD/8PklUTRO8h8H6tGKM/QERzY6EGino6RCyfvTfp9k hriA== X-Gm-Message-State: AOUpUlHvmLYpDNJQTXujnoVWlKTRp9XcVnOqiWDAF3keOyeaMREF+gDL GbuNouGFWrfupvRvDhYm5y8= X-Google-Smtp-Source: AA+uWPzLxlOT7y/gACOkNO9YvKkNdBmdtOXRQbdOrTBj2rKP+yrtfiI/cUZFBHc0v6eXuyDl9voEVQ== X-Received: by 2002:a63:161a:: with SMTP id w26-v6mr7112320pgl.257.1533915660693; Fri, 10 Aug 2018 08:41:00 -0700 (PDT) Received: from [172.16.183.52] ([144.178.28.4]) by smtp.gmail.com with ESMTPSA id p19-v6sm17797898pgh.60.2018.08.10.08.40.59 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 10 Aug 2018 08:41:00 -0700 (PDT) From: "Christopher Wood" To: "Kaarthik Sivakumar" Cc: "Russ Housley" , "IETF TLS" Date: Fri, 10 Aug 2018 08:40:58 -0700 X-Mailer: MailMate (1.11.3r5509) Message-ID: In-Reply-To: <358d7f50-2055-b903-36f9-7518e957b791@gmail.com> References: <358d7f50-2055-b903-36f9-7518e957b791@gmail.com> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="=_MailMate_C6D5660A-1286-4F04-BF58-F31988425B52_=" Embedded-HTML: [{"HTML":[631, 1668], "plain":[248, 1075], "uuid":"95EFC2B2-CD5A-46AA-B2D4-30E7A1310B49"}] Archived-At: Subject: Re: [TLS] Minutes for TLS IETF 102 uploaded X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 10 Aug 2018 15:41:03 -0000 --=_MailMate_C6D5660A-1286-4F04-BF58-F31988425B52_= Content-Type: text/plain; format=flowed Thanks for pointing out this formatting issue, Russ. I updated the notes in an attempt to improve readability. Please have a look and let me know if you see other (or new) issues. Best, Chris On 9 Aug 2018, at 21:53, Kaarthik Sivakumar wrote: > Could be line ending issues - I see something like these when > switching between different OSes. > > > > -kaarthik- > > > > On 10/08/18 03:37, Russ Housley wrote: > > >> >> I do not understand the formatting. Are the '*' characters >> supposed to be bullets? If so, them appearing in the middle of >> paragraphs is confusing. >> >> Russ >> >> >> >> >>> >>> On Jul 28, 2018, at 1:32 PM, Christopher Wood >>> []() >>> wrote: >>> >>> Minutes for both TLS sessions at IETF 102 have been uploaded: >>> >>> >>> Many thanks to Joe Hall and Gurshabad Grover for taking detailed >>> notes. >>> >>> Please review the minutes and check for inaccuracies. If >>> anything is >>> incorrect, please let the chairs know ASAP. >>> >>> Thanks, >>> Chris, Joe, and Sean >>> >> >> >> _______________________________________________ >> TLS mailing list >> [TLS@ietf.org]() >> >> --=_MailMate_C6D5660A-1286-4F04-BF58-F31988425B52_= Content-Type: text/html Content-Transfer-Encoding: quoted-printable
<= p dir=3D"auto">Thanks for pointing out this formatting issue, Russ. I upd= ated the notes in an attempt to improve readability. Please have a look a= nd let me know if you see other (or new) issues.

Best,
Chris

On 9 Aug 2018, at 21:53, Kaarthik Sivakumar wrote:

Could be line ending issues - I see something like these when switching between different OSes.


-kaarthik-

On 10/08/18 03:37, Russ Housley wrote:= 
I do not understand the formatting.  Are the '*' cha=
racters supposed to be bullets?  If so, them appearing in the middle of p=
aragraphs is confusing.

Russ



On Jul 28, 2018, at 1:32 PM, Christopher Wood <christopherwood07@gmail.com> wrote:

Minutes for both TLS sessions at IETF 102 have been uploaded:
https://datatracker.ietf.org/doc/minutes-102-tls/

Many thanks to Joe Hall and Gurshabad Grover for taking detailed notes.

Please review the minutes and check for inaccuracies. If anything is
incorrect, please let the chairs know ASAP.

Thanks,
Chris, Joe, and Sean

_______________________________________________
TLS mailing list
TLS@ie=
tf.org
https://www.ietf.org/mailman/listinfo/tls

--=_MailMate_C6D5660A-1286-4F04-BF58-F31988425B52_=-- From nobody Fri Aug 10 14:42:20 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 547EA1310A6 for ; Fri, 10 Aug 2018 14:42:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id U-EIb9k-sDPF for ; Fri, 10 Aug 2018 14:42:08 -0700 (PDT) Received: from mail.smeinc.net (mail.smeinc.net [209.135.209.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4186113107D for ; Fri, 10 Aug 2018 14:42:06 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mail.smeinc.net (Postfix) with ESMTP id CE95C300A4B for ; Fri, 10 Aug 2018 17:42:03 -0400 (EDT) X-Virus-Scanned: amavisd-new at mail.smeinc.net Received: from mail.smeinc.net ([127.0.0.1]) by localhost (mail.smeinc.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id d4CyyFEq-_42 for ; Fri, 10 Aug 2018 17:42:01 -0400 (EDT) Received: from [192.168.1.147] (047-133-081-124.res.spectrum.com [47.133.81.124]) by mail.smeinc.net (Postfix) with ESMTPSA id 8F64B300541; Fri, 10 Aug 2018 17:42:01 -0400 (EDT) From: Russ Housley Message-Id: <502D8CE4-B955-4DE6-B908-B80D499B611F@vigilsec.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_39607239-813B-472D-835B-CE786743585B" Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) Date: Fri, 10 Aug 2018 17:42:01 -0400 In-Reply-To: Cc: IETF TLS To: Christopher Wood References: <358d7f50-2055-b903-36f9-7518e957b791@gmail.com> X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: Re: [TLS] Minutes for TLS IETF 102 uploaded X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 10 Aug 2018 21:42:19 -0000 --Apple-Mail=_39607239-813B-472D-835B-CE786743585B Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii I suggest this change to the minutes: OLD: Russ: Current 1.3 key schedule uses a sig across (?). DH is the thing = that drives the key schedule. Subsequent handshake based on resumption PSK or = that and an additional DH result. Proposal: add an additional option to the = initial hs to include an external PSK and combine with the DH. Want to do this = for quantum protection, you've mixed in this external OOB-distro'd PSK so = that any attacker has to get the PSK too. (See ladder diagram of where this would = fit.) Syntax: boolean, present or not. If you negotiate, you'll agree to do = that. Presently language in the spec that precludes PSK when certs are used. = wouldn't be used with a resumption, just external. Group of TLS peers would need = to get the PSKs. If the quantum computer comes, have to compromise one of the = numbers of the group to compromise the PSK. Ask: WG adopt as a work item, then = review and comment. NEW: Russ: In TLS 1.3, initial handshake authentication is based on = certificate and signature, and DH shared secret drives the key schedule. In a subsequent handshake, authentication is based on resumption PSK, and the key = schedule is driven by the resumption PSK or the resumption PSK plus and an = additional DH shared secret. Proposal: add an additional option to the initial = handshake to include an external PSK that is combined with the DH shared secret. Want = to do this for quantum protection; the external PSK must be distributed out of = band. An attacker with a quantum computer needs to learn the external PSK to = crack the key schedule. (See ladder diagram of where this would fit.) Syntax: = a boolean; the TLS extension is present or not. If the extension is = negotiated, the client and server agree to include the external PSK in the key = schedule. Presently language in TLS 1.3 precludes PSK when certs are used. The = external PSK wouldn't be used for resumption, just initial handshake. Group of = TLS peers would need the same PSK and identifier. If the quantum computer = comes along, the attacker would have to compromise one of the members of the = group to obtain the PSK. Ask: WG adopt as a work item, then review and = comment. Russ > On Aug 10, 2018, at 11:40 AM, Christopher Wood = wrote: >=20 > Thanks for pointing out this formatting issue, Russ. I updated the = notes in an attempt to improve readability. Please have a look and let = me know if you see other (or new) issues. >=20 > Best, > Chris >=20 > On 9 Aug 2018, at 21:53, Kaarthik Sivakumar wrote: >=20 > Could be line ending issues - I see something like these when = switching between different OSes. >=20 > -kaarthik- >=20 > On 10/08/18 03:37, Russ Housley wrote: >> I do not understand the formatting. Are the '*' characters supposed = to be bullets? If so, them appearing in the middle of paragraphs is = confusing. >>=20 >> Russ >>=20 >>=20 >>> On Jul 28, 2018, at 1:32 PM, Christopher Wood = = wrote: >>>=20 >>> Minutes for both TLS sessions at IETF 102 have been uploaded: >>> https://datatracker.ietf.org/doc/minutes-102-tls/ = >>>=20 >>> Many thanks to Joe Hall and Gurshabad Grover for taking detailed = notes. >>>=20 >>> Please review the minutes and check for inaccuracies. If anything is >>> incorrect, please let the chairs know ASAP. >>>=20 >>> Thanks, >>> Chris, Joe, and Sean >> _______________________________________________ >> TLS mailing list >> TLS@ietf.org >> https://www.ietf.org/mailman/listinfo/tls = >=20 --Apple-Mail=_39607239-813B-472D-835B-CE786743585B Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii I = suggest this change to the minutes:

OLD:

Russ: Current 1.3 key = schedule uses a sig across (?). DH is the thing that
drives the key schedule. Subsequent handshake based on = resumption PSK or that
and an additional DH result. = Proposal: add an additional option to the initial
hs = to include an external PSK and combine with the DH. Want to do this = for
quantum protection, you've mixed in this = external OOB-distro'd PSK so that any
attacker has = to get the PSK too. (See ladder diagram of where this would = fit.)
Syntax: boolean, present or not. If you = negotiate, you'll agree to do that.
Presently = language in the spec that precludes PSK when certs are used. = wouldn't
be used with a resumption, just external. = Group of TLS peers would need to get
the PSKs. If = the quantum computer comes, have to compromise one of the = numbers
of the group to compromise the PSK. Ask: WG = adopt as a work item, then review
and = comment.

NEW:

Russ: In TLS 1.3, initial handshake authentication is based = on certificate and
signature, and DH shared secret = drives the key schedule. In a subsequent
handshake, = authentication is based on resumption PSK, and the key schedule = is
driven by the resumption PSK or the resumption = PSK plus and an additional DH
shared secret. = Proposal: add an additional option to the initial handshake to
include an external PSK that is combined with the DH shared = secret. Want to do
this for quantum protection; the = external PSK must be distributed out of band.
An = attacker with a quantum computer needs to learn the external PSK to = crack
the key schedule. (See ladder diagram of = where this would fit.) Syntax: a
boolean; the TLS = extension is present or not. If the extension is negotiated,
the client and server agree to include the external PSK in = the key schedule.
Presently language in TLS 1.3 = precludes PSK when certs are used. The external
PSK = wouldn't be used for resumption, just initial handshake. Group of = TLS
peers would need the same PSK and identifier. = If the quantum computer comes
along, the attacker = would have to compromise one of the members of the group
to obtain the PSK. Ask: WG adopt as a work item, then review = and comment.

Russ


On Aug = 10, 2018, at 11:40 AM, Christopher Wood <christopherwood07@gmail.com> wrote:

Thanks = for pointing out this formatting issue, Russ. I updated the notes in an = attempt to improve readability. Please have a look and let me know if = you see other (or new) issues.

Best,
Chris

On 9 Aug 2018, at 21:53, Kaarthik = Sivakumar wrote:

Could= be line ending issues - I see something like these when switching between different OSes.


-kaarthik-

On 10/08/18 03:37, Russ Housley = wrote:
= 
I do not understand the formatting.  Are =
the '*' characters supposed to be bullets?  If so, them appearing in the =
middle of paragraphs is confusing.

Russ



On Jul 28, 2018, at 1:32 PM, =
Christopher Wood <christopherwood07@gmail.co=
m> wrote:

Minutes for both TLS sessions at IETF 102 have been uploaded:
https://datatra=
cker.ietf.org/doc/minutes-102-tls/

Many thanks to Joe Hall and Gurshabad Grover for taking detailed notes.

Please review the minutes and check for inaccuracies. If anything is
incorrect, please let the chairs know ASAP.

Thanks,
Chris, Joe, and Sean

_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/ma=
ilman/listinfo/tls


= --Apple-Mail=_39607239-813B-472D-835B-CE786743585B-- From nobody Fri Aug 10 16:54:49 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3B8E3130E21; Fri, 10 Aug 2018 16:54:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id v5BFTEbS0JMx; Fri, 10 Aug 2018 16:54:40 -0700 (PDT) Received: from rfc-editor.org (rfc-editor.org [4.31.198.49]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 72864129385; Fri, 10 Aug 2018 16:54:40 -0700 (PDT) Received: by rfc-editor.org (Postfix, from userid 30) id 9FFB1B812BA; Fri, 10 Aug 2018 16:54:34 -0700 (PDT) To: ietf-announce@ietf.org, rfc-dist@rfc-editor.org X-PHP-Originating-Script: 1005:ams_util_lib.php From: rfc-editor@rfc-editor.org Cc: rfc-editor@rfc-editor.org, drafts-update-ref@iana.org, tls@ietf.org Content-type: text/plain; charset=UTF-8 Message-Id: <20180810235434.9FFB1B812BA@rfc-editor.org> Date: Fri, 10 Aug 2018 16:54:34 -0700 (PDT) Archived-At: Subject: [TLS] =?utf-8?q?RFC_8446_on_The_Transport_Layer_Security_=28TLS?= =?utf-8?q?=29_Protocol_Version_1=2E3?= X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 10 Aug 2018 23:54:42 -0000 A new Request for Comments is now available in online RFC libraries. RFC 8446 Title: The Transport Layer Security (TLS) Protocol Version 1.3 Author: E. Rescorla Status: Standards Track Stream: IETF Date: August 2018 Mailbox: ekr@rtfm.com Pages: 160 Characters: 337736 Obsoletes: RFC 5077, RFC 5246, RFC 6961 Updates: RFC 5705, RFC 6066 I-D Tag: draft-ietf-tls-tls13-28.txt URL: https://www.rfc-editor.org/info/rfc8446 DOI: 10.17487/RFC8446 This document specifies version 1.3 of the Transport Layer Security (TLS) protocol. TLS allows client/server applications to communicate over the Internet in a way that is designed to prevent eavesdropping, tampering, and message forgery. This document updates RFCs 5705 and 6066, and obsoletes RFCs 5077, 5246, and 6961. This document also specifies new requirements for TLS 1.2 implementations. This document is a product of the Transport Layer Security Working Group of the IETF. This is now a Proposed Standard. STANDARDS TRACK: This document specifies an Internet Standards Track protocol for the Internet community, and requests discussion and suggestions for improvements. Please refer to the current edition of the Official Internet Protocol Standards (https://www.rfc-editor.org/standards) for the standardization state and status of this protocol. Distribution of this memo is unlimited. This announcement is sent to the IETF-Announce and rfc-dist lists. To subscribe or unsubscribe, see https://www.ietf.org/mailman/listinfo/ietf-announce https://mailman.rfc-editor.org/mailman/listinfo/rfc-dist For searching the RFC series, see https://www.rfc-editor.org/search For downloading RFCs, see https://www.rfc-editor.org/retrieve/bulk Requests for special distribution should be addressed to either the author of the RFC in question, or to rfc-editor@rfc-editor.org. Unless specifically noted otherwise on the RFC itself, all RFCs are for unlimited distribution. The RFC Editor Team Association Management Solutions, LLC From nobody Fri Aug 10 16:55:07 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0C372131011; Fri, 10 Aug 2018 16:54:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6sEog1tLJA1l; Fri, 10 Aug 2018 16:54:53 -0700 (PDT) Received: from rfc-editor.org (rfc-editor.org [4.31.198.49]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D53CA130E8A; Fri, 10 Aug 2018 16:54:53 -0700 (PDT) Received: by rfc-editor.org (Postfix, from userid 30) id DDEB6B812E8; Fri, 10 Aug 2018 16:54:47 -0700 (PDT) To: ietf-announce@ietf.org, rfc-dist@rfc-editor.org X-PHP-Originating-Script: 1005:ams_util_lib.php From: rfc-editor@rfc-editor.org Cc: rfc-editor@rfc-editor.org, drafts-update-ref@iana.org, tls@ietf.org Content-type: text/plain; charset=UTF-8 Message-Id: <20180810235447.DDEB6B812E8@rfc-editor.org> Date: Fri, 10 Aug 2018 16:54:47 -0700 (PDT) Archived-At: Subject: [TLS] =?utf-8?q?RFC_8447_on_IANA_Registry_Updates_for_TLS_and_DT?= =?utf-8?q?LS?= X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 10 Aug 2018 23:55:03 -0000 A new Request for Comments is now available in online RFC libraries. RFC 8447 Title: IANA Registry Updates for TLS and DTLS Author: J. Salowey, S. Turner Status: Standards Track Stream: IETF Date: August 2018 Mailbox: joe@salowey.net, sean@sn3rd.com Pages: 20 Characters: 44773 Updates: RFC 3749, RFC 4680, RFC 5077, RFC 5246, RFC 5705, RFC 5878, RFC 6520, RFC 7301 I-D Tag: draft-ietf-tls-iana-registry-updates-05.txt URL: https://www.rfc-editor.org/info/rfc8447 DOI: 10.17487/RFC8447 This document describes a number of changes to TLS and DTLS IANA registries that range from adding notes to the registry all the way to changing the registration policy. These changes were mostly motivated by WG review of the TLS- and DTLS-related registries undertaken as part of the TLS 1.3 development process. This document updates the following RFCs: 3749, 5077, 4680, 5246, 5705, 5878, 6520, and 7301. This document is a product of the Transport Layer Security Working Group of the IETF. This is now a Proposed Standard. STANDARDS TRACK: This document specifies an Internet Standards Track protocol for the Internet community, and requests discussion and suggestions for improvements. Please refer to the current edition of the Official Internet Protocol Standards (https://www.rfc-editor.org/standards) for the standardization state and status of this protocol. Distribution of this memo is unlimited. This announcement is sent to the IETF-Announce and rfc-dist lists. To subscribe or unsubscribe, see https://www.ietf.org/mailman/listinfo/ietf-announce https://mailman.rfc-editor.org/mailman/listinfo/rfc-dist For searching the RFC series, see https://www.rfc-editor.org/search For downloading RFCs, see https://www.rfc-editor.org/retrieve/bulk Requests for special distribution should be addressed to either the author of the RFC in question, or to rfc-editor@rfc-editor.org. Unless specifically noted otherwise on the RFC itself, all RFCs are for unlimited distribution. The RFC Editor Team Association Management Solutions, LLC From nobody Fri Aug 10 16:55:26 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A7C7713108E; Fri, 10 Aug 2018 16:55:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FbtvXuTyq50p; Fri, 10 Aug 2018 16:55:13 -0700 (PDT) Received: from rfc-editor.org (rfc-editor.org [4.31.198.49]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7413B131094; Fri, 10 Aug 2018 16:55:10 -0700 (PDT) Received: by rfc-editor.org (Postfix, from userid 30) id 856F6B812F4; Fri, 10 Aug 2018 16:55:04 -0700 (PDT) To: ietf-announce@ietf.org, rfc-dist@rfc-editor.org X-PHP-Originating-Script: 1005:ams_util_lib.php From: rfc-editor@rfc-editor.org Cc: rfc-editor@rfc-editor.org, drafts-update-ref@iana.org, tls@ietf.org Content-type: text/plain; charset=UTF-8 Message-Id: <20180810235504.856F6B812F4@rfc-editor.org> Date: Fri, 10 Aug 2018 16:55:04 -0700 (PDT) Archived-At: Subject: [TLS] =?utf-8?q?RFC_8449_on_Record_Size_Limit_Extension_for_TLS?= X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 10 Aug 2018 23:55:23 -0000 A new Request for Comments is now available in online RFC libraries. RFC 8449 Title: Record Size Limit Extension for TLS Author: M. Thomson Status: Standards Track Stream: IETF Date: August 2018 Mailbox: martin.thomson@gmail.com Pages: 8 Characters: 18932 Updates: RFC 6066 I-D Tag: draft-ietf-tls-record-limit-03.txt URL: https://www.rfc-editor.org/info/rfc8449 DOI: 10.17487/RFC8449 An extension to Transport Layer Security (TLS) is defined that allows endpoints to negotiate the maximum size of protected records that each will send the other. This replaces the maximum fragment length extension defined in RFC 6066. This document is a product of the Transport Layer Security Working Group of the IETF. This is now a Proposed Standard. STANDARDS TRACK: This document specifies an Internet Standards Track protocol for the Internet community, and requests discussion and suggestions for improvements. Please refer to the current edition of the Official Internet Protocol Standards (https://www.rfc-editor.org/standards) for the standardization state and status of this protocol. Distribution of this memo is unlimited. This announcement is sent to the IETF-Announce and rfc-dist lists. To subscribe or unsubscribe, see https://www.ietf.org/mailman/listinfo/ietf-announce https://mailman.rfc-editor.org/mailman/listinfo/rfc-dist For searching the RFC series, see https://www.rfc-editor.org/search For downloading RFCs, see https://www.rfc-editor.org/retrieve/bulk Requests for special distribution should be addressed to either the author of the RFC in question, or to rfc-editor@rfc-editor.org. Unless specifically noted otherwise on the RFC itself, all RFCs are for unlimited distribution. The RFC Editor Team Association Management Solutions, LLC From nobody Fri Aug 10 16:57:10 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 55933130E97 for ; Fri, 10 Aug 2018 16:57:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.221 X-Spam-Level: X-Spam-Status: No, score=-4.221 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CV4QX_uuruyC for ; Fri, 10 Aug 2018 16:56:59 -0700 (PDT) Received: from dmz-mailsec-scanner-7.mit.edu (dmz-mailsec-scanner-7.mit.edu [18.7.68.36]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EBCFB131050 for ; Fri, 10 Aug 2018 16:56:58 -0700 (PDT) X-AuditID: 12074424-edfff700000058c8-9e-5b6e2647971c Received: from mailhub-auth-4.mit.edu ( [18.7.62.39]) (using TLS with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by dmz-mailsec-scanner-7.mit.edu (Symantec Messaging Gateway) with SMTP id 2C.78.22728.8462E6B5; Fri, 10 Aug 2018 19:56:57 -0400 (EDT) Received: from outgoing.mit.edu (OUTGOING-AUTH-1.MIT.EDU [18.9.28.11]) by mailhub-auth-4.mit.edu (8.13.8/8.9.2) with ESMTP id w7ANup8e002947 for ; Fri, 10 Aug 2018 19:56:53 -0400 Received: from kduck.kaduk.org (24-107-191-124.dhcp.stls.mo.charter.com [24.107.191.124]) (authenticated bits=56) (User authenticated as kaduk@ATHENA.MIT.EDU) by outgoing.mit.edu (8.13.8/8.12.4) with ESMTP id w7ANumfx006512 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT) for ; Fri, 10 Aug 2018 19:56:50 -0400 Date: Fri, 10 Aug 2018 18:56:48 -0500 From: Benjamin Kaduk To: tls@ietf.org Message-ID: <20180810235648.GZ40887@kduck.kaduk.org> References: <20180810235434.9FFB1B812BA@rfc-editor.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20180810235434.9FFB1B812BA@rfc-editor.org> User-Agent: Mutt/1.9.1 (2017-09-22) X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFnrGIsWRmVeSWpSXmKPExsUixG6nruuplhdt8OIFl8Wn812MDoweS5b8 ZApgjOKySUnNySxLLdK3S+DKWL/7A3NBm2hF36zdzA2Mn/i7GDk5JARMJN7seMrexcjFISSw mEmioX8bC4RzhFFi4rL1UM4LJomJqzoZQVpYBFQl/n3/wAZiswmoSDR0X2buYuTgEBEQkGh+ KQYSFhYIkriz/hwTiM0LtOHjzCvMILaQgLnEvOZ+Foi4oMTJmU/AbGYBLYkb/14ygYxhFpCW WP6PAyTMKWAh8XzzCrASUQFlib19h9gnMPLPQtI9C0n3LITuBYzMqxhlU3KrdHMTM3OKU5N1 i5MT8/JSi3TN9XIzS/RSU0o3MYIDz0VlB2N3j/chRgEORiUeXo0tudFCrIllxZW5hxglOZiU RHkt7wCF+JLyUyozEosz4otKc1KLDzFKcDArifBmmgLleFMSK6tSi/JhUtIcLErivHdrwqOF BNITS1KzU1MLUotgsjIcHEoSvK2qedFCgkWp6akVaZk5JQhpJg5OkOE8QMM5QGp4iwsSc4sz 0yHypxiNOXruTZnEzPHn/dRJzEIsefl5qVLivKUgpQIgpRmleXDTQMlDInt/zStGcaDnhHmn g1TxABMP3LxXQKuYgFZla4L8UVySiJCSamAs7n14J4yX0X29Ua1gZu3so3NTywL7rpkkv1y6 48dHxbJ9yyQ2Rq7Q/5e28HPrD9smh5CF/TL/b7/bbG7mcXrm0ey3NtUfT7BqinafM4tdK/8z rPJBfIlCwjdVyepgufY+Rs4dRf/O2s1ZpT3TZv89lkDxV3MO/NSNiOc8JnCK74Dxv+myRaFK LMUZiYZazEXFiQC0X/rC+QIAAA== Archived-At: Subject: Re: [TLS] RFC 8446 on The Transport Layer Security (TLS) Protocol Version 1.3 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 10 Aug 2018 23:57:09 -0000 A big congratulations and thanks to Ekr, the chairs, Kathleen, and all the researchers and contributors who helped make this happen! I'm looking forward to seeing the deployment share grow as we get the final version out in the wild! -Ben On Fri, Aug 10, 2018 at 04:54:34PM -0700, rfc-editor@rfc-editor.org wrote: > A new Request for Comments is now available in online RFC libraries. > > > RFC 8446 > > Title: The Transport Layer Security (TLS) Protocol > Version 1.3 > Author: E. Rescorla > Status: Standards Track > Stream: IETF > Date: August 2018 > Mailbox: ekr@rtfm.com > Pages: 160 > Characters: 337736 > Obsoletes: RFC 5077, RFC 5246, RFC 6961 > Updates: RFC 5705, RFC 6066 > > I-D Tag: draft-ietf-tls-tls13-28.txt > > URL: https://www.rfc-editor.org/info/rfc8446 > > DOI: 10.17487/RFC8446 > > This document specifies version 1.3 of the Transport Layer Security > (TLS) protocol. TLS allows client/server applications to communicate > over the Internet in a way that is designed to prevent eavesdropping, > tampering, and message forgery. > > This document updates RFCs 5705 and 6066, and obsoletes RFCs 5077, > 5246, and 6961. This document also specifies new requirements for > TLS 1.2 implementations. > > This document is a product of the Transport Layer Security Working Group of the IETF. > > This is now a Proposed Standard. > > STANDARDS TRACK: This document specifies an Internet Standards Track > protocol for the Internet community, and requests discussion and suggestions > for improvements. Please refer to the current edition of the Official > Internet Protocol Standards (https://www.rfc-editor.org/standards) for the > standardization state and status of this protocol. Distribution of this > memo is unlimited. > > This announcement is sent to the IETF-Announce and rfc-dist lists. > To subscribe or unsubscribe, see > https://www.ietf.org/mailman/listinfo/ietf-announce > https://mailman.rfc-editor.org/mailman/listinfo/rfc-dist > > For searching the RFC series, see https://www.rfc-editor.org/search > For downloading RFCs, see https://www.rfc-editor.org/retrieve/bulk > > Requests for special distribution should be addressed to either the > author of the RFC in question, or to rfc-editor@rfc-editor.org. Unless > specifically noted otherwise on the RFC itself, all RFCs are for > unlimited distribution. > > > The RFC Editor Team > Association Management Solutions, LLC > From nobody Fri Aug 10 23:18:32 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DB4DF130DC4 for ; Fri, 10 Aug 2018 23:18:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.898 X-Spam-Level: X-Spam-Status: No, score=-6.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_HI=-5, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id G4Vbqa4IWsnR for ; Fri, 10 Aug 2018 23:18:28 -0700 (PDT) Received: from mail2-relais-roc.national.inria.fr (mail2-relais-roc.national.inria.fr [192.134.164.83]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DCDD0127B92 for ; Fri, 10 Aug 2018 23:18:27 -0700 (PDT) X-IronPort-AV: E=Sophos;i="5.53,223,1531778400"; d="scan'208";a="342101968" Received: from unknown (HELO [10.40.34.197]) ([37.173.250.109]) by mail2-relais-roc.national.inria.fr with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 11 Aug 2018 08:18:24 +0200 Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (1.0) From: Benjamin Beurdouche X-Mailer: iPhone Mail (15G77) In-Reply-To: <20180810235648.GZ40887@kduck.kaduk.org> Date: Fri, 10 Aug 2018 23:18:20 -0700 Cc: tls@ietf.org Content-Transfer-Encoding: quoted-printable Message-Id: References: <20180810235434.9FFB1B812BA@rfc-editor.org> <20180810235648.GZ40887@kduck.kaduk.org> To: Benjamin Kaduk Archived-At: Subject: Re: [TLS] RFC 8446 on The Transport Layer Security (TLS) Protocol Version 1.3 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 11 Aug 2018 06:18:31 -0000 Congratulations everyone !! :) B. > On Aug 10, 2018, at 4:56 PM, Benjamin Kaduk wrote: >=20 > A big congratulations and thanks to Ekr, the chairs, Kathleen, and all the= > researchers and contributors who helped make this happen! > I'm looking forward to seeing the deployment share grow as we get the fina= l > version out in the wild! >=20 > -Ben >=20 >> On Fri, Aug 10, 2018 at 04:54:34PM -0700, rfc-editor@rfc-editor.org wrote= : >> A new Request for Comments is now available in online RFC libraries. >>=20 >>=20 >> RFC 8446 >>=20 >> Title: The Transport Layer Security (TLS) Protocol=20 >> Version 1.3=20 >> Author: E. Rescorla >> Status: Standards Track >> Stream: IETF >> Date: August 2018 >> Mailbox: ekr@rtfm.com >> Pages: 160 >> Characters: 337736 >> Obsoletes: RFC 5077, RFC 5246, RFC 6961 >> Updates: RFC 5705, RFC 6066 >>=20 >> I-D Tag: draft-ietf-tls-tls13-28.txt >>=20 >> URL: https://www.rfc-editor.org/info/rfc8446 >>=20 >> DOI: 10.17487/RFC8446 >>=20 >> This document specifies version 1.3 of the Transport Layer Security >> (TLS) protocol. TLS allows client/server applications to communicate >> over the Internet in a way that is designed to prevent eavesdropping, >> tampering, and message forgery. >>=20 >> This document updates RFCs 5705 and 6066, and obsoletes RFCs 5077, >> 5246, and 6961. This document also specifies new requirements for >> TLS 1.2 implementations. >>=20 >> This document is a product of the Transport Layer Security Working Group o= f the IETF. >>=20 >> This is now a Proposed Standard. >>=20 >> STANDARDS TRACK: This document specifies an Internet Standards Track >> protocol for the Internet community, and requests discussion and suggesti= ons >> for improvements. Please refer to the current edition of the Official >> Internet Protocol Standards (https://www.rfc-editor.org/standards) for th= e=20 >> standardization state and status of this protocol. Distribution of this=20= >> memo is unlimited. >>=20 >> This announcement is sent to the IETF-Announce and rfc-dist lists. >> To subscribe or unsubscribe, see >> https://www.ietf.org/mailman/listinfo/ietf-announce >> https://mailman.rfc-editor.org/mailman/listinfo/rfc-dist >>=20 >> For searching the RFC series, see https://www.rfc-editor.org/search >> For downloading RFCs, see https://www.rfc-editor.org/retrieve/bulk >>=20 >> Requests for special distribution should be addressed to either the >> author of the RFC in question, or to rfc-editor@rfc-editor.org. Unless >> specifically noted otherwise on the RFC itself, all RFCs are for >> unlimited distribution. >>=20 >>=20 >> The RFC Editor Team >> Association Management Solutions, LLC >>=20 >=20 > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls From nobody Sat Aug 11 04:43:55 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C90CD130F33 for ; Sat, 11 Aug 2018 04:43:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 72zuImMnAQWK for ; Sat, 11 Aug 2018 04:43:51 -0700 (PDT) Received: from mail-qt0-x229.google.com (mail-qt0-x229.google.com [IPv6:2607:f8b0:400d:c0d::229]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6BD4D12F1AB for ; Sat, 11 Aug 2018 04:43:51 -0700 (PDT) Received: by mail-qt0-x229.google.com with SMTP id y5-v6so12950688qti.12 for ; Sat, 11 Aug 2018 04:43:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=taI7Brce72BzNftval1ICJSTbAHDonf3BA5uJu+1p5c=; b=ZWUVTbhGE5+Ye505cJJky+zyid6A6SEZJgn3vcoi/74aPgT9CaXWeCG77nsJY1kkOa UslJ32Y2ywvoP9AN32bdCkdr2fEqU+OFxvu9I6oYrH8IPSEYJOAbrLF1Hiq1KJ8hbBL8 dVEbA1SQieTa83q9nn4n/9g2RzQLtY7fwXi7anfdqvgRynIjhNkSZsNRVqPUF59dBoZB r4q+cc1luBaVOF5mbZrWOrZQKq5JiOD3OsGiv5mN/W/IK6pbF8FLPIGYxUjpYX7StjRQ 9g2IAXAQBnCgLZJXagxcPrmw/Ln+QvGnr5Q1xe8sqlkgV9mRjFOUz2Ko3YWvo6r/iqBX xh+A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=taI7Brce72BzNftval1ICJSTbAHDonf3BA5uJu+1p5c=; b=T91/OK7tAXrmne/eo4BuoNgpaufjKhs6qcEN8tuanRaSvGrG64oThseTAyWyJsKZl/ Oj+hQwCnSqza00FKR7lffx5sGg0fDeVltahWORUcJ60R8iXSNkvIybM0A4CstZVuMFLn ARQi4Rpld+fm/4ep4jCUICppbVc6FlZeHh5mO6nNm9MTj8L275fZyhqtbodS7klp//rD uLDdJigu8Y0hgxv6UTB61VIyMNuTTLNIUQcLSYBJ+oc2Ib/5FVvcdwdQNIRren+d5iBc Cv9Qcmti3LILIM/tP+W85ooB6vHAz67GQy7kOZc2ovqbkSPQtqBT8wSH/v3ltOvSthA7 9wJw== X-Gm-Message-State: AOUpUlFkqmZsaAwF6qP1omhoE/6sixXlVK9OGDe4F0fRe01ecV75z35p 4bSTB1jG7QM9su3Ahtq2mnDt3QNJ X-Google-Smtp-Source: AA+uWPyRIBcLd1CR6kVPiWZw4A2xLgw2fbVuSmoRUGLQCLWtgQfjYHBpurN92yyhmMei4yxEeLDrfA== X-Received: by 2002:ac8:1a46:: with SMTP id q6-v6mr10249876qtk.5.1533987830483; Sat, 11 Aug 2018 04:43:50 -0700 (PDT) Received: from [10.111.222.210] (209-6-121-113.s2671.c3-0.arl-cbr1.sbo-arl.ma.cable.rcncustomer.com. [209.6.121.113]) by smtp.gmail.com with ESMTPSA id 49-v6sm8791683qtu.0.2018.08.11.04.43.49 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sat, 11 Aug 2018 04:43:50 -0700 (PDT) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (1.0) From: Kathleen Moriarty X-Mailer: iPhone Mail (15E216) In-Reply-To: <20180810235648.GZ40887@kduck.kaduk.org> Date: Sat, 11 Aug 2018 07:43:49 -0400 Cc: tls@ietf.org Content-Transfer-Encoding: quoted-printable Message-Id: References: <20180810235434.9FFB1B812BA@rfc-editor.org> <20180810235648.GZ40887@kduck.kaduk.org> To: Benjamin Kaduk Archived-At: Subject: Re: [TLS] RFC 8446 on The Transport Layer Security (TLS) Protocol Version 1.3 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 11 Aug 2018 11:43:54 -0000 Congratulations to all who contributed! In addition to EKR & the chairs, th= ank you also to Ben who assisted with all of the final checks as the respons= ible AD for this part of the process. Kathleen=20 Sent from my mobile device > On Aug 10, 2018, at 7:56 PM, Benjamin Kaduk wrote: >=20 > A big congratulations and thanks to Ekr, the chairs, Kathleen, and all the= > researchers and contributors who helped make this happen! > I'm looking forward to seeing the deployment share grow as we get the fina= l > version out in the wild! >=20 > -Ben >=20 >> On Fri, Aug 10, 2018 at 04:54:34PM -0700, rfc-editor@rfc-editor.org wrote= : >> A new Request for Comments is now available in online RFC libraries. >>=20 >>=20 >> RFC 8446 >>=20 >> Title: The Transport Layer Security (TLS) Protocol=20 >> Version 1.3=20 >> Author: E. Rescorla >> Status: Standards Track >> Stream: IETF >> Date: August 2018 >> Mailbox: ekr@rtfm.com >> Pages: 160 >> Characters: 337736 >> Obsoletes: RFC 5077, RFC 5246, RFC 6961 >> Updates: RFC 5705, RFC 6066 >>=20 >> I-D Tag: draft-ietf-tls-tls13-28.txt >>=20 >> URL: https://www.rfc-editor.org/info/rfc8446 >>=20 >> DOI: 10.17487/RFC8446 >>=20 >> This document specifies version 1.3 of the Transport Layer Security >> (TLS) protocol. TLS allows client/server applications to communicate >> over the Internet in a way that is designed to prevent eavesdropping, >> tampering, and message forgery. >>=20 >> This document updates RFCs 5705 and 6066, and obsoletes RFCs 5077, >> 5246, and 6961. This document also specifies new requirements for >> TLS 1.2 implementations. >>=20 >> This document is a product of the Transport Layer Security Working Group o= f the IETF. >>=20 >> This is now a Proposed Standard. >>=20 >> STANDARDS TRACK: This document specifies an Internet Standards Track >> protocol for the Internet community, and requests discussion and suggesti= ons >> for improvements. Please refer to the current edition of the Official >> Internet Protocol Standards (https://www.rfc-editor.org/standards) for th= e=20 >> standardization state and status of this protocol. Distribution of this=20= >> memo is unlimited. >>=20 >> This announcement is sent to the IETF-Announce and rfc-dist lists. >> To subscribe or unsubscribe, see >> https://www.ietf.org/mailman/listinfo/ietf-announce >> https://mailman.rfc-editor.org/mailman/listinfo/rfc-dist >>=20 >> For searching the RFC series, see https://www.rfc-editor.org/search >> For downloading RFCs, see https://www.rfc-editor.org/retrieve/bulk >>=20 >> Requests for special distribution should be addressed to either the >> author of the RFC in question, or to rfc-editor@rfc-editor.org. Unless >> specifically noted otherwise on the RFC itself, all RFCs are for >> unlimited distribution. >>=20 >>=20 >> The RFC Editor Team >> Association Management Solutions, LLC >>=20 >=20 > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls From nobody Sat Aug 11 13:56:19 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 84FC5130EAE for ; Sat, 11 Aug 2018 13:56:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.91 X-Spam-Level: X-Spam-Status: No, score=-1.91 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, T_DKIMWL_WL_MED=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=nomountain-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fHj7HYrG_9hM for ; Sat, 11 Aug 2018 13:56:16 -0700 (PDT) Received: from mail-pf1-x42d.google.com (mail-pf1-x42d.google.com [IPv6:2607:f8b0:4864:20::42d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 018A9130EA9 for ; Sat, 11 Aug 2018 13:56:15 -0700 (PDT) Received: by mail-pf1-x42d.google.com with SMTP id j26-v6so5993406pfi.10 for ; Sat, 11 Aug 2018 13:56:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nomountain-net.20150623.gappssmtp.com; s=20150623; h=subject:to:references:from:message-id:date:user-agent:mime-version :in-reply-to:content-language:content-transfer-encoding; bh=nAg7KU0c+etM+9Qdm4dk/WpkH4BfEINUj/p+llHwxAE=; b=RRLVqWG6rSLT0e6yWwzbDaxFW6SU6ULox8kYSN1uPaxvypVdUV2RqvgzdupAZPdu0c VuVDMjjF2sG6WWzD+mx3DDj63jZ0YFhRKjoybGNxAuLuKq7HCGNkDKBx78l6cZAqWOIU eRPMQSqkDJcjdmXMUXqxIHuwWT80KT7yK034gy/QOyzA8r8y5583Bft1hwH8JpYSu8ow fxe/SurCSgi88QsewPXShL9ZyFxiFRfIwXjbUlCojXZ3dC5yTcpBESJnp/NBytg97fGb T7K2qB/CUxi/jWGTY4GxV5JgfR9Q1grY9XZGnyD0NN8G0P451Xmv9WdBeEwIyNmKpmcu oFKg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=nAg7KU0c+etM+9Qdm4dk/WpkH4BfEINUj/p+llHwxAE=; b=NSRy/xQLuvpaNdW+wfAD4ESoTvd9SiuZZVlhyGu/SMWlZCVvpArwfdRgHI0k/j7cLg vsNQu1Ormabd+EeC2dLhK4nUQNNH4RJYzMVqeG/C8rzZPH3Pti3r5IeYhEUpob9RPyTp T9xGCgXizEjGmU05K0oKFhVTQEcqFY7LzW5IDSQFNsQCb2n07dIjXD93aZNsLTMEwIOc vMDbJdvG8XV0dWBgiu0hgGCdtO+DA447hDR1ByI7clU0fdpl0tNZtmakMkWPHCHu84ge /oq7sWN8e2I0DGKCNZJs1jfwVToa2Z9T+oMCaXaz53OMLrzPialgERZQg0hCyaha+qOD JcPA== X-Gm-Message-State: AOUpUlFsJGL93cq8yuF+WZ+QunbUujkrS2/+TzPb1M4ygUe5f7BADDNU PozFZ9/+lCHAgXQegLeqypUoFNSdJA== X-Google-Smtp-Source: AA+uWPw37DzIdjG7+2PVkVMDSL/1vLrHK5lGxqOf3UXNggnyohmKi/ein4LsucgxegNlumWU1spiHA== X-Received: by 2002:a62:1c13:: with SMTP id c19-v6mr12596458pfc.148.1534020975275; Sat, 11 Aug 2018 13:56:15 -0700 (PDT) Received: from aspen.local (216-67-116-106-radius.dynamic.acsalaska.net. [216.67.116.106]) by smtp.gmail.com with ESMTPSA id x2-v6sm24047428pfi.166.2018.08.11.13.56.14 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sat, 11 Aug 2018 13:56:14 -0700 (PDT) To: tls@ietf.org References: From: Melinda Shore Message-ID: Date: Sat, 11 Aug 2018 12:56:13 -0800 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:52.0) Gecko/20100101 Thunderbird/52.9.1 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252 Content-Language: en-US Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [TLS] OID for delegated credentials X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 11 Aug 2018 20:56:17 -0000 On 8/8/18 9:07 PM, Subodh Iyengar wrote: > So far we've been doing interop with Cloudflare's OID of > 1.3.6.1.4.1.44363.44.  I'd be fine with putting that as the final OID > the draft. Does anyone have any thoughts on whether we should / should > not do this and use a different OID instead. One thing we've found is that it's inevitable that when an OID is chosen from a private arc, it's raised as an issue during various last calls, but I've never seen it be a show-stopper. Melinda -- Software longa, hardware brevis PGP fingerprint: 4F68 2D93 2A17 96F8 20F2 34C0 DFB8 9172 9A76 DB8F From nobody Sun Aug 12 05:50:26 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 329CF129C6A for ; Sun, 12 Aug 2018 05:50:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.909 X-Spam-Level: X-Spam-Status: No, score=-1.909 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, T_DKIMWL_WL_MED=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YmwAAUcBoa8K for ; Sun, 12 Aug 2018 05:50:22 -0700 (PDT) Received: from mail-lf1-x12a.google.com (mail-lf1-x12a.google.com [IPv6:2a00:1450:4864:20::12a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 95968126DBF for ; Sun, 12 Aug 2018 05:50:21 -0700 (PDT) Received: by mail-lf1-x12a.google.com with SMTP id j143-v6so9436711lfj.12 for ; Sun, 12 Aug 2018 05:50:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=EDJPLlfu8N1BIu6CvEuryPxcEefVfC+dGBAHTopw9IU=; b=rKeasHIrcseRKpvJf1pD5sItuKIQ0pFqtj26iKPGRvS9aJDExSXhkLcaP0VIcXUj5x lPdb9CpEhQHjINNUK2hzWFIAAGFLd8l+15ZezRxmuS6t/HdVthsmfIuzRhZq2nJoPt3O B2YPWHJim9HE0OD4KJrvArH+/Gw0J2hVjXCA/ddninCRqFr/g5QV6rIx69vXsgtcK4pw j4QGEWKAxHAyD8U/rqIiTUA9e6hEIaWH8xek2Nf9csfqcYWyMN+MKTs/B7AKxjqc8Ubo L0vzTeXfI6ehzelOjs24iMACP7cxyNtxxLrPc33zqu55NXsr4K1HfPk08dFYfaCIGd0O UyhQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=EDJPLlfu8N1BIu6CvEuryPxcEefVfC+dGBAHTopw9IU=; b=K/iqLWYM5sQJFRUzyAGYNBlRK23rsWOsO6blYOPnHKiA+OsGe0Tf10cJJri64C3xSk DqOBGyxCnhfOg5+pSQcsyM3300CJjnfhO7lfQ9kUchiWIvBLYrrLuFvj+Z8EdYaNpZ6e qsDE4Iq9Ot15bnFotCa1yAnJ0+nyRGu+gvMiEMYG5s/0K6UXTxup5JT0fiptGwjFmtja c/MIL+Kl7oO0/iXIRC8iLReCcYzqN9/OfTCcQRY1WMf/fDWMXKXiFhcX3s44u4KlIXwa ++Uwjf7tNM1ZjbvLGrDlvoaRbUZGssk6KvaosOicT3DOI0dX7JCj0ZXISxiEOgM5dE/e pPow== X-Gm-Message-State: AOUpUlFcGthOoeeNFwzb6mpy8c4JFbEQrIQWtpIfA0nf7tWHToiyP/Sx cAgfKvBrwlWORMikM9+VxIrPciZhBIr8AgeR2uS7zA== X-Google-Smtp-Source: AA+uWPzDYBH0D3hmUkjtZhqDMHwlV5hry6D2EohAUEq2nP9JzmuP+CdE6uiamQb8+aujQ2pCufWQFGlMT0SI41WG7k8= X-Received: by 2002:a19:cf95:: with SMTP id f143-v6mr9052830lfg.101.1534078219715; Sun, 12 Aug 2018 05:50:19 -0700 (PDT) MIME-Version: 1.0 Received: by 2002:ab3:4091:0:0:0:0:0 with HTTP; Sun, 12 Aug 2018 05:49:39 -0700 (PDT) In-Reply-To: <20180810235434.9FFB1B812BA@rfc-editor.org> References: <20180810235434.9FFB1B812BA@rfc-editor.org> From: Eric Rescorla Date: Sun, 12 Aug 2018 05:49:39 -0700 Message-ID: To: RFC Editor Cc: IETF Announcement List , rfc-dist@rfc-editor.org, drafts-update-ref@iana.org, "" Content-Type: multipart/alternative; boundary="00000000000058180905733c6b32" Archived-At: Subject: Re: [TLS] RFC 8446 on The Transport Layer Security (TLS) Protocol Version 1.3 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 12 Aug 2018 12:50:24 -0000 --00000000000058180905733c6b32 Content-Type: text/plain; charset="UTF-8" Finally! Huge thanks to everyone who worked on this. We're already seeing a lot of deployment in advance of the RFC, too, so great to see everyone's hard work paying off. -Ekr On Fri, Aug 10, 2018 at 4:54 PM, wrote: > A new Request for Comments is now available in online RFC libraries. > > > RFC 8446 > > Title: The Transport Layer Security (TLS) Protocol > Version 1.3 > Author: E. Rescorla > Status: Standards Track > Stream: IETF > Date: August 2018 > Mailbox: ekr@rtfm.com > Pages: 160 > Characters: 337736 > Obsoletes: RFC 5077, RFC 5246, RFC 6961 > Updates: RFC 5705, RFC 6066 > > I-D Tag: draft-ietf-tls-tls13-28.txt > > URL: https://www.rfc-editor.org/info/rfc8446 > > DOI: 10.17487/RFC8446 > > This document specifies version 1.3 of the Transport Layer Security > (TLS) protocol. TLS allows client/server applications to communicate > over the Internet in a way that is designed to prevent eavesdropping, > tampering, and message forgery. > > This document updates RFCs 5705 and 6066, and obsoletes RFCs 5077, > 5246, and 6961. This document also specifies new requirements for > TLS 1.2 implementations. > > This document is a product of the Transport Layer Security Working Group > of the IETF. > > This is now a Proposed Standard. > > STANDARDS TRACK: This document specifies an Internet Standards Track > protocol for the Internet community, and requests discussion and > suggestions > for improvements. Please refer to the current edition of the Official > Internet Protocol Standards (https://www.rfc-editor.org/standards) for > the > standardization state and status of this protocol. Distribution of this > memo is unlimited. > > This announcement is sent to the IETF-Announce and rfc-dist lists. > To subscribe or unsubscribe, see > https://www.ietf.org/mailman/listinfo/ietf-announce > https://mailman.rfc-editor.org/mailman/listinfo/rfc-dist > > For searching the RFC series, see https://www.rfc-editor.org/search > For downloading RFCs, see https://www.rfc-editor.org/retrieve/bulk > > Requests for special distribution should be addressed to either the > author of the RFC in question, or to rfc-editor@rfc-editor.org. Unless > specifically noted otherwise on the RFC itself, all RFCs are for > unlimited distribution. > > > The RFC Editor Team > Association Management Solutions, LLC > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > --00000000000058180905733c6b32 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Finally! Huge thanks to everyone who worked on this. = We're already seeing a lot of deployment in advance of the RFC, too, so= great to see everyone's hard work paying off.

-Ekr



On Fri, Aug 10, 2018 at 4:54 PM, <rfc-edi= tor@rfc-editor.org> wrote:
= A new Request for Comments is now available in online RFC libraries.


=C2=A0 =C2=A0 =C2=A0 =C2=A0 RFC 8446

=C2=A0 =C2=A0 =C2=A0 =C2=A0 Title:=C2=A0 =C2=A0 =C2=A0 The Transport Layer = Security (TLS) Protocol
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 Versi= on 1.3
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Author:=C2=A0 =C2=A0 =C2=A0E. Rescorla
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Status:=C2=A0 =C2=A0 =C2=A0Standards Track
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Stream:=C2=A0 =C2=A0 =C2=A0IETF
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Date:=C2=A0 =C2=A0 =C2=A0 =C2=A0August 2018
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Mailbox:=C2=A0 =C2=A0 ekr@rtfm.com
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Pages:=C2=A0 =C2=A0 =C2=A0 160
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Characters: 337736
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Obsoletes:=C2=A0 RFC 5077, RFC 5246, RFC 6961 =C2=A0 =C2=A0 =C2=A0 =C2=A0 Updates:=C2=A0 =C2=A0 RFC 5705, RFC 6066

=C2=A0 =C2=A0 =C2=A0 =C2=A0 I-D Tag:=C2=A0 =C2=A0 draft-ietf-tls-tls13-28.t= xt

=C2=A0 =C2=A0 =C2=A0 =C2=A0 URL:=C2=A0 =C2=A0 =C2=A0 =C2=A0 h= ttps://www.rfc-editor.org/info/rfc8446

=C2=A0 =C2=A0 =C2=A0 =C2=A0 DOI:=C2=A0 =C2=A0 =C2=A0 =C2=A0 10.17487/RFC844= 6

This document specifies version 1.3 of the Transport Layer Security
(TLS) protocol.=C2=A0 TLS allows client/server applications to communicate<= br> over the Internet in a way that is designed to prevent eavesdropping,
tampering, and message forgery.

This document updates RFCs 5705 and 6066, and obsoletes RFCs 5077,
5246, and 6961.=C2=A0 This document also specifies new requirements for
TLS 1.2 implementations.

This document is a product of the Transport Layer Security Working Group of= the IETF.

This is now a Proposed Standard.

STANDARDS TRACK: This document specifies an Internet Standards Track
protocol for the Internet community, and requests discussion and suggestion= s
for improvements.=C2=A0 Please refer to the current edition of the Official=
Internet Protocol Standards (https://www.rfc-editor.org/sta= ndards) for the
standardization state and status of this protocol.=C2=A0 Distribution of th= is
memo is unlimited.

This announcement is sent to the IETF-Announce and rfc-dist lists.
To subscribe or unsubscribe, see
=C2=A0 https://www.ietf.org/mailman/listinf= o/ietf-announce
=C2=A0 https://mailman.rfc-editor.org/m= ailman/listinfo/rfc-dist

For searching the RFC series, see https://www.rfc-editor.org/search
For downloading RFCs, see https://www.rfc-editor.org/retrieve/bulk

Requests for special distribution should be addressed to either the
author of the RFC in question, or to rfc-editor@rfc-editor.org.=C2=A0 Unless
specifically noted otherwise on the RFC itself, all RFCs are for
unlimited distribution.


The RFC Editor Team
Association Management Solutions, LLC

_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls

--00000000000058180905733c6b32-- From nobody Sun Aug 12 07:31:32 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F270E130DEE for ; Sun, 12 Aug 2018 07:31:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0pK_7qqn7-mf for ; Sun, 12 Aug 2018 07:31:27 -0700 (PDT) Received: from mail-io0-x22d.google.com (mail-io0-x22d.google.com [IPv6:2607:f8b0:4001:c06::22d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B3CDE130934 for ; Sun, 12 Aug 2018 07:31:27 -0700 (PDT) Received: by mail-io0-x22d.google.com with SMTP id w11-v6so12008888iob.2 for ; Sun, 12 Aug 2018 07:31:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=LwBYdq3dLfVcjuOl0PL+7+xs8bE3t2Qj4wyQ/Qgn6/w=; b=A7AMkNvrYrT7TVz0BnGKccDdNKaB1p8uJ7LvXkGibeSXC8DzdJE2sLVrB6mzRkVBXn +sf+CF5RgThta3kUJSgKWd6QStOaiLRAsLdV5tnPVhbZSAgTmTHv6JfyjpXDoQQ6BiUa 1BUWMWovYF5kvCPJuMi0v7LIc7CGNtd14KE1jgLLBOroIHd4gwApBtJn2vZdSXf8jzzm KzSP04vPMEYZuHK+kYeFxpVXWJLIPqu7d/I+K8EIvY8kJxicknhHPKwpwl6+vk/hp35Q E1TFPAcTtMTMo+x4o5XCjphqXMOAZh0rjn7UbxEMNVwY162kFg/7RCGaMHgpIBLVy2Zs vvbQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=LwBYdq3dLfVcjuOl0PL+7+xs8bE3t2Qj4wyQ/Qgn6/w=; b=Az7YaI9MdaUOnAScwlm+wesEQI4t8qE2ZRvU3suNTPFyB1dN78rh4OEEshO4pn3e9f ofNo1jlLGE/AX4exENYDe3m8QNTFkUBOjEiaeJHBGeRY+NvBlP/y1tyvsSDgoxSu07Pn XoTC+YmCpf+xteqrKfd3xw8C/oeCQZJtrVqGi05XZXqvQWsYHyEVchTG/nkC2b6X20DJ PnRpp3VaVIbrtDA23I3RsQhukjPRhlqt1UbHAMIkZJXSPKYYBT/qWrft12JSIKOh+pgP cL01UgL/DDX9MW4QrRdwY2+GmjCnSxq63jHS4YTDhWJRDHsHrXCYUd3UJtE1i2jmMjkC oTBg== X-Gm-Message-State: AOUpUlEWScsnF0JtqvKbLdmjAGj0FKWSX3uwFAxebCQo/PNJednxAS0Q kqcUL8Fg40x9Vmu3CsG0BO90zI+ILgsjPW7TTZs= X-Google-Smtp-Source: AA+uWPyFm8rnLGePJidjxau8adQQ6GJMTjYzkmYmcoMX1HtZdS86hpRvzOi2Zyv5BpWv5yEH1rEfoElZytjFQng9jUA= X-Received: by 2002:a6b:310d:: with SMTP id j13-v6mr12179277ioa.250.1534084286888; Sun, 12 Aug 2018 07:31:26 -0700 (PDT) MIME-Version: 1.0 Received: by 2002:a4f:5e47:0:0:0:0:0 with HTTP; Sun, 12 Aug 2018 07:31:26 -0700 (PDT) In-Reply-To: References: <20180810235434.9FFB1B812BA@rfc-editor.org> <20180810235648.GZ40887@kduck.kaduk.org> From: Loganaden Velvindron Date: Sun, 12 Aug 2018 18:31:26 +0400 Message-ID: To: Kathleen Moriarty Cc: Benjamin Kaduk , "" Content-Type: text/plain; charset="UTF-8" Archived-At: Subject: Re: [TLS] RFC 8446 on The Transport Layer Security (TLS) Protocol Version 1.3 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 12 Aug 2018 14:31:30 -0000 Indeed. It's been a long road to the final publication of the RFC. Well done to everybody who put in the effort. On Sat, Aug 11, 2018 at 3:43 PM, Kathleen Moriarty wrote: > Congratulations to all who contributed! In addition to EKR & the chairs, thank you also to Ben who assisted with all of the final checks as the responsible AD for this part of the process. > > Kathleen > > Sent from my mobile device > >> On Aug 10, 2018, at 7:56 PM, Benjamin Kaduk wrote: >> >> A big congratulations and thanks to Ekr, the chairs, Kathleen, and all the >> researchers and contributors who helped make this happen! >> I'm looking forward to seeing the deployment share grow as we get the final >> version out in the wild! >> >> -Ben >> >>> On Fri, Aug 10, 2018 at 04:54:34PM -0700, rfc-editor@rfc-editor.org wrote: >>> A new Request for Comments is now available in online RFC libraries. >>> >>> >>> RFC 8446 >>> >>> Title: The Transport Layer Security (TLS) Protocol >>> Version 1.3 >>> Author: E. Rescorla >>> Status: Standards Track >>> Stream: IETF >>> Date: August 2018 >>> Mailbox: ekr@rtfm.com >>> Pages: 160 >>> Characters: 337736 >>> Obsoletes: RFC 5077, RFC 5246, RFC 6961 >>> Updates: RFC 5705, RFC 6066 >>> >>> I-D Tag: draft-ietf-tls-tls13-28.txt >>> >>> URL: https://www.rfc-editor.org/info/rfc8446 >>> >>> DOI: 10.17487/RFC8446 >>> >>> This document specifies version 1.3 of the Transport Layer Security >>> (TLS) protocol. TLS allows client/server applications to communicate >>> over the Internet in a way that is designed to prevent eavesdropping, >>> tampering, and message forgery. >>> >>> This document updates RFCs 5705 and 6066, and obsoletes RFCs 5077, >>> 5246, and 6961. This document also specifies new requirements for >>> TLS 1.2 implementations. >>> >>> This document is a product of the Transport Layer Security Working Group of the IETF. >>> >>> This is now a Proposed Standard. >>> >>> STANDARDS TRACK: This document specifies an Internet Standards Track >>> protocol for the Internet community, and requests discussion and suggestions >>> for improvements. Please refer to the current edition of the Official >>> Internet Protocol Standards (https://www.rfc-editor.org/standards) for the >>> standardization state and status of this protocol. Distribution of this >>> memo is unlimited. >>> >>> This announcement is sent to the IETF-Announce and rfc-dist lists. >>> To subscribe or unsubscribe, see >>> https://www.ietf.org/mailman/listinfo/ietf-announce >>> https://mailman.rfc-editor.org/mailman/listinfo/rfc-dist >>> >>> For searching the RFC series, see https://www.rfc-editor.org/search >>> For downloading RFCs, see https://www.rfc-editor.org/retrieve/bulk >>> >>> Requests for special distribution should be addressed to either the >>> author of the RFC in question, or to rfc-editor@rfc-editor.org. Unless >>> specifically noted otherwise on the RFC itself, all RFCs are for >>> unlimited distribution. >>> >>> >>> The RFC Editor Team >>> Association Management Solutions, LLC >>> >> >> _______________________________________________ >> TLS mailing list >> TLS@ietf.org >> https://www.ietf.org/mailman/listinfo/tls > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls From nobody Mon Aug 13 08:17:52 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C7938130934 for ; Mon, 13 Aug 2018 08:17:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.909 X-Spam-Level: X-Spam-Status: No, score=-1.909 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_DKIMWL_WL_MED=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=salowey-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ye-AvU2lpz0S for ; Mon, 13 Aug 2018 08:17:49 -0700 (PDT) Received: from mail-qt0-x236.google.com (mail-qt0-x236.google.com [IPv6:2607:f8b0:400d:c0d::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DD434130E43 for ; Mon, 13 Aug 2018 08:17:48 -0700 (PDT) Received: by mail-qt0-x236.google.com with SMTP id z8-v6so17732019qto.9 for ; Mon, 13 Aug 2018 08:17:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=salowey-net.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to; bh=SY6ItDTqUE4fjmhrAb0m9nFvI4SgTz4sUe4FEETs4T8=; b=mTo2ATwEAh7/vuhke8+5qsjfA9nMU6o1uMazyGnKRtXPMTvMyK+VBY8Is43g0eQtYD q3Hjl7yyt7B3a8fT4Qh6rkT59pJMLXyWysehX4C7qZIOfdsK6iv6G/WuejtLw/cbbTpt kg6VrX76YDHFWSuLurDLHQpY3iq4eBTpr8AFwjr4OP/OUqrOAOklqLuD5ZyBjbXqY6m8 qYlw3frB0IEhxPoFH20iIMO7+x3UyyIWmG9WBE6OnHaPyWDWQL+rD9XGFeRpVXMr178a elAjI0uHNVRxXiQ0mzFuZhhQVU/GW6sx9qj5Zav8JCSjainVvY3wNePQiahQMnR72U4T 6plA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to; bh=SY6ItDTqUE4fjmhrAb0m9nFvI4SgTz4sUe4FEETs4T8=; b=BwaQetIJ5sMUH/uuikQ1eXrDv09isXsfccbFABCiLFDtCI2I4xDIkPmO9u4FEifPwu 4vWtNiO5ym9voZLMbq4Ts9EwgGspD4CA2KK4fBZQBN73HkS4c44dmil9n45tk1JKF6gp bmoWlb9V//RpztUPlg4k7oK1u4W784h+uFpf/gYxWk9wbqfDPBtUEVB8PPTX+SWmpntT 4tPV+hwdoYmr8qlMKRiqLQjlWSaCELP5YFLeNfPUendMwFjHrFeQu0hA+bVF2CEaYQ9Z iRVOVo56Mb5d0tmvTVD0G9+VahX96tsfITE+KrWF2XjnbqgX3b6NOnNOvf6DRP054w2C ANag== X-Gm-Message-State: AOUpUlEVmypkKMD8lvrI4IvR1cI1+ZtIoxAwlQKYdL0csUu3BQWwU0jd eGOZi4BEeFd6nDh0zHkuJexN552JQ5Z6PO/y7EGy8uWGjyM= X-Google-Smtp-Source: AA+uWPyYwowbUc8aU94nsuY/+6eMhLRAQ+AWoiS00xPUW9bopSz35xEpEs7K8EKcJVQQzanWBKBmPTCcLiQvj+vKmAM= X-Received: by 2002:ac8:3f8b:: with SMTP id d11-v6mr17293450qtk.46.1534173467696; Mon, 13 Aug 2018 08:17:47 -0700 (PDT) MIME-Version: 1.0 Received: by 2002:ac8:378d:0:0:0:0:0 with HTTP; Mon, 13 Aug 2018 08:17:27 -0700 (PDT) In-Reply-To: References: From: Joseph Salowey Date: Mon, 13 Aug 2018 08:17:27 -0700 Message-ID: To: "tls@ietf.org" Content-Type: multipart/alternative; boundary="00000000000090f17605735298ff" Archived-At: Subject: Re: [TLS] WG adoption call: draft-rescorla-tls-esni X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Aug 2018 15:17:51 -0000 --00000000000090f17605735298ff Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable It looks like we have good consensus to to adopt this draft. Authors, please submit the draft as a working group document with the filename draft-ietf-tls-esni-00.txt On Sat, Jul 28, 2018 at 1:08 AM, Tim Wicinski wrote: > I support adoption of this draft, but as a consumer of SSL certificates > which have *17* wildcards on one certificate, I feel that the handling of > wildcard DNS records in this draft needs some more thought. > > Tim > > > On Fri, Jul 27, 2018 at 11:22 PM, Victor Vasiliev < > vasilvv=3D40google.com@dmarc.ietf.org> wrote: > >> I support adoption of this draft and would be happy to review it. >> >> On Tue, Jul 24, 2018, 22:18 Joseph Salowey wrote: >> >>> >>> The sense of the TLS@IETF102 room was the the WG should adopt >>> https://datatracker.ietf.org/doc/draft-rescorla-tls-esni/ as a WG >>> item. But, we need to confirm this on list. If you would like for thi= s >>> draft to become a WG document and you are willing to review it as it mo= ves >>> through the process, then please let the list know by 2359UTC 20180807.= If >>> you are opposed to this being a WG document, please say so (and say why= ). >>> >>> Note that the draft has been marked as a "Candidate for WG Adoption=E2= =80=9D in >>> the datatracker. >>> >>> >>> _______________________________________________ >>> TLS mailing list >>> TLS@ietf.org >>> https://www.ietf.org/mailman/listinfo/tls >>> >> >> _______________________________________________ >> TLS mailing list >> TLS@ietf.org >> https://www.ietf.org/mailman/listinfo/tls >> >> > --00000000000090f17605735298ff Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
It looks like we have good consensus to to adopt this draf= t.=C2=A0=C2=A0

Authors, please submit the draft as a wor= king group document with the filename draft-ietf-tls-esni-00.txt
=

On Sat, Jul= 28, 2018 at 1:08 AM, Tim Wicinski <tjw.ietf@gmail.com> wro= te:
I support adoption o= f this draft, but as a consumer of SSL certificates which have *17* wildcar= ds on one certificate, I feel that the handling of wildcard DNS records in = this draft needs some more thought.

Tim


On Fri, Jul 27, 2018 at 11:22 PM, Victor Vasiliev <vasilvv=3D40google.com@dmarc.ietf.org> w= rote:
I support adoptio= n of this draft and would be happy to review it.

On Tue, Jul 24, 2018, 22:18 Joseph Salo= wey <joe@salowey.net> wrote:

The sense of the TLS@IETF102 room was the the WG should adopt=C2= =A0https://datatracker.ietf.o= rg/doc/draft-rescorla-tls-esni/=C2=A0as a WG item.=C2=A0 But, we need to confirm thi= s on list.=C2=A0 If you would like for this draft to become a WG document a= nd you are willing to review it as it moves through the process, then pleas= e let the list know by 2359UTC 20180807.=C2=A0 If you are opposed to this b= eing a WG document, please say so (and say why).

Note that the draft= has been marked as a "Candidate for WG Adoption=E2=80=9D in the datat= racker.


=
_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/lis= tinfo/tls

_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls



--00000000000090f17605735298ff-- From nobody Mon Aug 13 08:26:09 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9ABD6130F59 for ; Mon, 13 Aug 2018 08:26:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.749 X-Spam-Level: X-Spam-Status: No, score=-1.749 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_ENVFROM_END_DIGIT=0.25, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ajqsH9ChfrhC for ; Mon, 13 Aug 2018 08:26:07 -0700 (PDT) Received: from mail-it0-x233.google.com (mail-it0-x233.google.com [IPv6:2607:f8b0:4001:c0b::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 01248130EEC for ; Mon, 13 Aug 2018 08:26:06 -0700 (PDT) Received: by mail-it0-x233.google.com with SMTP id d10-v6so13609054itj.5 for ; Mon, 13 Aug 2018 08:26:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=gr1laOcYp+IWcOTJi4rxegq0Eh/FwtFj70mETggYneA=; b=eXbkzNbokIbfOG8bdrfVMn+OxAqMzU7mCmY70X2hc+sAg2rghXFvrmSodLArdOggbC /uJCxhmJeDSokSWy8DOV08MKBUYTww3Oz1G1WWmU4AnLP4W+7fR9Czy9xJ0QJEqnzD+4 k7EK5Orcq4AIIC9o8E8hgCxRQt9TtEXSIn8fGvBX/uzhppAwS5bYB1MBTM0GIA+aMZRh wRK3xhaQu8VwWDJZlRxrf3FiM9BK3AF/Q0mGyPOdAGBXX0aZOJDib6koJ4s76Ayxd3cm c/DyQ8F4r5gZ1DGya3AVw0H7CRGQAPUcRMWqIk1/cHFHJhONfebIz8Vtm4W4GVBDkJRX Pk9Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=gr1laOcYp+IWcOTJi4rxegq0Eh/FwtFj70mETggYneA=; b=L48mnaMKpBizbJCK8exiFm6BN31A9QgZ+dZYVUeoFvw0UVKznFsCo1NsJom3K8aV41 ecU+d6vS/+2F9sFIeaSnwkg6+h+c/mtgkDMX+oWC2k/V0MxFvAdbci1o8UJYQ9nz+1Ta TxK7AnfP61BSKuixmMtIDMek2Qex0YvmMWfaW5P81m6wPOZTbBqVHGnME6OVmuvGDygP QhsxBsdOVEfCDkjYsimyjHIY9UUOzbb0fI+A5EPyxrfTOP1AI5atK4bU8xCSemYHEGVw 4JdKyjKQOuwJ5JM4ORdHFQQSnZi9yxXDLjzbFN50YKgpCLdKGZjlTeX6VNIEDMtLPIsN vwLA== X-Gm-Message-State: AOUpUlGUF1tFHiars+POH0ebkexIAgS7fB/dJgL9812lUGYfmJNRGB+3 qO+evWAzAn0ADWZCObEReOo5oCBqd4ybs04l+I8Q+j7o X-Google-Smtp-Source: AA+uWPyUdbfKvhXewxesK82EldBfDzwkeG+esGo6t0CAfDyaJfvT4qbwEKOZ2u5p3dyCGoGXD9LcMCJ6AUS6j8Yi8aI= X-Received: by 2002:a24:5e0b:: with SMTP id h11-v6mr11418325itb.80.1534173965870; Mon, 13 Aug 2018 08:26:05 -0700 (PDT) MIME-Version: 1.0 References: <358d7f50-2055-b903-36f9-7518e957b791@gmail.com> <502D8CE4-B955-4DE6-B908-B80D499B611F@vigilsec.com> In-Reply-To: <502D8CE4-B955-4DE6-B908-B80D499B611F@vigilsec.com> From: Christopher Wood Date: Mon, 13 Aug 2018 08:25:54 -0700 Message-ID: To: Russ Housley Cc: "" Content-Type: text/plain; charset="UTF-8" Archived-At: Subject: Re: [TLS] Minutes for TLS IETF 102 uploaded X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Aug 2018 15:26:09 -0000 I patched the minutes with your change. Best, Chris On Fri, Aug 10, 2018 at 2:42 PM Russ Housley wrote: > > I suggest this change to the minutes: > > OLD: > > Russ: Current 1.3 key schedule uses a sig across (?). DH is the thing that > drives the key schedule. Subsequent handshake based on resumption PSK or that > and an additional DH result. Proposal: add an additional option to the initial > hs to include an external PSK and combine with the DH. Want to do this for > quantum protection, you've mixed in this external OOB-distro'd PSK so that any > attacker has to get the PSK too. (See ladder diagram of where this would fit.) > Syntax: boolean, present or not. If you negotiate, you'll agree to do that. > Presently language in the spec that precludes PSK when certs are used. wouldn't > be used with a resumption, just external. Group of TLS peers would need to get > the PSKs. If the quantum computer comes, have to compromise one of the numbers > of the group to compromise the PSK. Ask: WG adopt as a work item, then review > and comment. > > NEW: > > Russ: In TLS 1.3, initial handshake authentication is based on certificate and > signature, and DH shared secret drives the key schedule. In a subsequent > handshake, authentication is based on resumption PSK, and the key schedule is > driven by the resumption PSK or the resumption PSK plus and an additional DH > shared secret. Proposal: add an additional option to the initial handshake to > include an external PSK that is combined with the DH shared secret. Want to do > this for quantum protection; the external PSK must be distributed out of band. > An attacker with a quantum computer needs to learn the external PSK to crack > the key schedule. (See ladder diagram of where this would fit.) Syntax: a > boolean; the TLS extension is present or not. If the extension is negotiated, > the client and server agree to include the external PSK in the key schedule. > Presently language in TLS 1.3 precludes PSK when certs are used. The external > PSK wouldn't be used for resumption, just initial handshake. Group of TLS > peers would need the same PSK and identifier. If the quantum computer comes > along, the attacker would have to compromise one of the members of the group > to obtain the PSK. Ask: WG adopt as a work item, then review and comment. > > Russ > > > On Aug 10, 2018, at 11:40 AM, Christopher Wood wrote: > > Thanks for pointing out this formatting issue, Russ. I updated the notes in an attempt to improve readability. Please have a look and let me know if you see other (or new) issues. > > Best, > Chris > > On 9 Aug 2018, at 21:53, Kaarthik Sivakumar wrote: > > Could be line ending issues - I see something like these when switching between different OSes. > > > -kaarthik- > > On 10/08/18 03:37, Russ Housley wrote: > > I do not understand the formatting. Are the '*' characters supposed to be bullets? If so, them appearing in the middle of paragraphs is confusing. > > Russ > > > On Jul 28, 2018, at 1:32 PM, Christopher Wood wrote: > > Minutes for both TLS sessions at IETF 102 have been uploaded: > https://datatracker.ietf.org/doc/minutes-102-tls/ > > Many thanks to Joe Hall and Gurshabad Grover for taking detailed notes. > > Please review the minutes and check for inaccuracies. If anything is > incorrect, please let the chairs know ASAP. > > Thanks, > Chris, Joe, and Sean > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > > > From nobody Wed Aug 15 13:23:06 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AD07E130DE6 for ; Wed, 15 Aug 2018 13:23:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.75 X-Spam-Level: X-Spam-Status: No, score=-1.75 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_ENVFROM_END_DIGIT=0.25, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id p4B8JlMRyZUe for ; Wed, 15 Aug 2018 13:23:03 -0700 (PDT) Received: from mail-io0-x22c.google.com (mail-io0-x22c.google.com [IPv6:2607:f8b0:4001:c06::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B7948130DE3 for ; Wed, 15 Aug 2018 13:23:03 -0700 (PDT) Received: by mail-io0-x22c.google.com with SMTP id z20-v6so2067613iol.0 for ; Wed, 15 Aug 2018 13:23:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to; bh=7X9Eb2IsnuQlWeNRJy0PatkI8UxxMH+kR6nsDunIu8A=; b=kT/a0HL+FaUM5sLPU1xgFDoa3sPNSvL5/+zZn2/wsyK0TnnQV+bDneahAM2PBFCBP8 kHTtgVw86/sVyz1Loz6RpnyCUdLdFQLZ7loFrztBSdV4D4YEQSSgvDJFhoDQ+CkV6heO LZYHZgjWirWTuV4x2aJkPDG3XVYs2o3lKkCL5XxMJymjAsun1MpkQ/7gf7tA1uh7jIf0 Kssqrr4BuGKl7csKY/wwK7ABmTQ9tX/DRzzrEALj22tFFSStp8VfcsiCQM4dIZIuz2dg c4HyRHcAJWxUk7UDCMdBBMzEM/0AfKsjhHeL860BOm5BJePwJW+VJrb4uXZzkZJ+4cez G21A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to; bh=7X9Eb2IsnuQlWeNRJy0PatkI8UxxMH+kR6nsDunIu8A=; b=ECGHDNa+UlhgLkUU9NAPVhP47HjLwNhiu1TCDjlRPrsFMf2H7BBmODK6YXDx7XisYf IACnFpUZMis850w+tUkBZeDdKT8N4B49PWmVlf5cUk/a+iEd9XfJUnHK2G8XiriSlIAq zyhkYkqumInIHEeKSNO1n7GIvikKRuPoN4T30A0C5hO15X/NSznSvn0mKJRtNJdyWvhu 1r25ELfp7lhREnogFKu24sH0SKmaDnNuxTkYd1RPjiFPFMsvhKayQlArHYpFuCju8zDQ MBgMWg5+lu2pLZx7W+g8JKQ4OGNkAKdwJ5WPk+nv/SGL19oH4Z6qnFOwVHRVLO95Rpqu wPLQ== X-Gm-Message-State: APzg51Aq2X2cia6+QXQ4JuBJvDeXqFofZkjFji7Nombcl4rmvbfCukYn 0hhyI7j2gzLiC/UNew98cgOVlhPqu2Qtb/Eon+pG0NtB X-Google-Smtp-Source: ANB0VdbmCQ34U7dAZwCYhGtEfTL5vpA/3V7uajX9yyhQQijq58I7Hn1+MKprznjImHKePjpRN1bZxPT/T83s6+A0XKs= X-Received: by 2002:a6b:2055:: with SMTP id g82-v6mr317173iog.204.1534364582430; Wed, 15 Aug 2018 13:23:02 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Christopher Wood Date: Wed, 15 Aug 2018 13:22:50 -0700 Message-ID: To: "" Content-Type: text/plain; charset="UTF-8" Archived-At: Subject: Re: [TLS] WG adoption call: draft-housley-tls-tls13-cert-with-extern-psk X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 15 Aug 2018 20:23:05 -0000 The call for adoption is now over. The conclusion is that there is lack of clarity around the goals of this document. Thus, it will not be adopted as a WG item at this time. We encourage more discussions and reviews of this document and its open issues, and ask the authors to clarify its goals before we revisit adoption. Best, Chris, Joe, Sean On Thu, Jul 26, 2018 at 3:05 PM Christopher Wood wrote: > > The sense of the TLS@IETF102 room was that the WG should adopt > draft-housley-tls-tls13-cert-with-extern-psk as a WG item. This email > is to confirm this sense on list. If you would like for this draft to > become a WG document and you are willing to review it as it moves > through the process, then please let the list know by 2359UTC > 20180809. If you are opposed to this being a WG document, please say > so (and say why). > > Thanks, > Chris, Joe and Sean From nobody Thu Aug 16 10:06:42 2018 Return-Path: X-Original-To: tls@ietf.org Delivered-To: tls@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 81F42130DDA; Thu, 16 Aug 2018 10:06:14 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: tls@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.83.1 Auto-Submitted: auto-generated Precedence: bulk Reply-To: tls@ietf.org Message-ID: <153443917445.12116.710125731895353596@ietfa.amsl.com> Date: Thu, 16 Aug 2018 10:06:14 -0700 Archived-At: Subject: [TLS] I-D Action: draft-housley-tls-tls13-cert-with-extern-psk-01.txt X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 16 Aug 2018 17:06:21 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Transport Layer Security WG of the IETF. Title : TLS 1.3 Extension for Certificate-based Authentication with an External Pre-Shared Key Author : Russ Housley Filename : draft-housley-tls-tls13-cert-with-extern-psk-01.txt Pages : 10 Date : 2018-08-16 Abstract: This document specifies a TLS 1.3 extension that allows a server to authenticate with a certificate while providing an external pre- shared key (PSK) as an input to the key schedule. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-housley-tls-tls13-cert-with-extern-psk/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-housley-tls-tls13-cert-with-extern-psk-01 https://datatracker.ietf.org/doc/html/draft-housley-tls-tls13-cert-with-extern-psk-01 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-housley-tls-tls13-cert-with-extern-psk-01 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Thu Aug 16 11:30:18 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 93467128CFD for ; Thu, 16 Aug 2018 11:30:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cuCEb0p3z2VW for ; Thu, 16 Aug 2018 11:30:14 -0700 (PDT) Received: from mail.smeinc.net (mail.smeinc.net [209.135.209.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1B508128CB7 for ; Thu, 16 Aug 2018 11:30:14 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mail.smeinc.net (Postfix) with ESMTP id EA234300A23 for ; Thu, 16 Aug 2018 14:30:11 -0400 (EDT) X-Virus-Scanned: amavisd-new at mail.smeinc.net Received: from mail.smeinc.net ([127.0.0.1]) by localhost (mail.smeinc.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id QQXUbZmTJH-0 for ; Thu, 16 Aug 2018 14:30:10 -0400 (EDT) Received: from a860b60074bd.home (pool-71-127-50-4.washdc.fios.verizon.net [71.127.50.4]) by mail.smeinc.net (Postfix) with ESMTPSA id 6CEF6300265 for ; Thu, 16 Aug 2018 14:30:10 -0400 (EDT) From: Russ Housley Content-Type: multipart/alternative; boundary="Apple-Mail=_5A5EC1EC-4EA1-4938-A12C-567509561092" Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) Message-Id: References: <153443917470.12116.7074563467184942601.idtracker@ietfa.amsl.com> To: IETF TLS Date: Thu, 16 Aug 2018 14:30:10 -0400 X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: [TLS] New Version Notification for draft-housley-tls-tls13-cert-with-extern-psk-01.txt X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 16 Aug 2018 18:30:17 -0000 --Apple-Mail=_5A5EC1EC-4EA1-4938-A12C-567509561092 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii I just posted an update to this Internet-Draft. It addresses some, but = not all, of the comments that I got in Montreal and on the mail list. I = am now working on the other comments. Russ > From: internet-drafts@ietf.org > Subject: New Version Notification for = draft-housley-tls-tls13-cert-with-extern-psk-01.txt > Date: August 16, 2018 at 1:06:14 PM EDT > To: "Russ Housley" >=20 >=20 > A new version of I-D, = draft-housley-tls-tls13-cert-with-extern-psk-01.txt > has been successfully submitted by Russ Housley and posted to the > IETF repository. >=20 > Name: draft-housley-tls-tls13-cert-with-extern-psk > Revision: 01 > Title: TLS 1.3 Extension for Certificate-based = Authentication with an External Pre-Shared Key > Document date: 2018-08-16 > Group: tls > Pages: 10 > URL: = https://www.ietf.org/internet-drafts/draft-housley-tls-tls13-cert-with-ext= ern-psk-01.txt > Status: = https://datatracker.ietf.org/doc/draft-housley-tls-tls13-cert-with-extern-= psk/ > Htmlized: = https://tools.ietf.org/html/draft-housley-tls-tls13-cert-with-extern-psk-0= 1 > Htmlized: = https://datatracker.ietf.org/doc/html/draft-housley-tls-tls13-cert-with-ex= tern-psk > Diff: = https://www.ietf.org/rfcdiff?url2=3Ddraft-housley-tls-tls13-cert-with-exte= rn-psk-01 >=20 > Abstract: > This document specifies a TLS 1.3 extension that allows a server to > authenticate with a certificate while providing an external pre- > shared key (PSK) as an input to the key schedule. >=20 >=20 >=20 >=20 > Please note that it may take a couple of minutes from the time of = submission > until the htmlized version and diff are available at tools.ietf.org. >=20 > The IETF Secretariat >=20 --Apple-Mail=_5A5EC1EC-4EA1-4938-A12C-567509561092 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii I = just posted an update to this Internet-Draft.  It addresses some, = but not all, of the comments that I got in Montreal and on the mail = list.  I am now working on the other comments.

Russ


From: = internet-drafts@ietf.org
Subject: = New Version = Notification for = draft-housley-tls-tls13-cert-with-extern-psk-01.txt
Date: = August 16, 2018 at 1:06:14 PM = EDT
To: = "Russ Housley" <housley@vigilsec.com>


A new version = of I-D, draft-housley-tls-tls13-cert-with-extern-psk-01.txt
has been successfully submitted by Russ Housley and posted to = the
IETF repository.

Name: = draft-housley-tls-tls13-cert-with-extern-psk
Revision: 01
Title: TLS 1.3 = Extension for Certificate-based Authentication with an External = Pre-Shared Key
Document date: 2018-08-16
Group:= = tls
Pages: 10
URL: =            https://www.ietf.org/internet-drafts/draft-housley-tls-tls13-ce= rt-with-extern-psk-01.txt
Status: =         https://datatracker.ietf.org/doc/draft-housley-tls-tls13-cert-w= ith-extern-psk/
Htmlized: =       https://tools.ietf.org/html/draft-housley-tls-tls13-cert-with-e= xtern-psk-01
Htmlized: =       https://datatracker.ietf.org/doc/html/draft-housley-tls-tls13-c= ert-with-extern-psk
Diff: =           https://www.ietf.org/rfcdiff?url2=3Ddraft-housley-tls-tls13-cer= t-with-extern-psk-01

Abstract:
  This document specifies a TLS 1.3 extension that = allows a server to
  authenticate with a = certificate while providing an external pre-
=   shared key (PSK) as an input to the key schedule.




Please note that it may take a couple of minutes from the = time of submission
until the htmlized version and diff are = available at tools.ietf.org.

The IETF = Secretariat


= --Apple-Mail=_5A5EC1EC-4EA1-4938-A12C-567509561092-- From nobody Thu Aug 16 19:07:45 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E78FB130E0E for ; Thu, 16 Aug 2018 19:07:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id urjboO-dHpNd for ; Thu, 16 Aug 2018 19:07:40 -0700 (PDT) Received: from rfc-editor.org (rfc-editor.org [4.31.198.49]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D5A3C130DEF for ; Thu, 16 Aug 2018 19:07:40 -0700 (PDT) Received: by rfc-editor.org (Postfix, from userid 30) id B5DF1B80117; Thu, 16 Aug 2018 19:07:30 -0700 (PDT) To: ynir.ietf@gmail.com, simon@josefsson.org, mpg@elzevir.fr, kaduk@mit.edu, ekr@rtfm.com, christopherwood07@gmail.com, joe@salowey.net, sean+ietf@sn3rd.com X-PHP-Originating-Script: 30:errata_mail_lib.php From: RFC Errata System Cc: mgosui@yahoo-corp.jp, tls@ietf.org, rfc-editor@rfc-editor.org Content-Type: text/plain; charset=UTF-8 Message-Id: <20180817020730.B5DF1B80117@rfc-editor.org> Date: Thu, 16 Aug 2018 19:07:30 -0700 (PDT) Archived-At: Subject: [TLS] [Editorial Errata Reported] RFC8422 (5466) X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 Aug 2018 02:07:43 -0000 The following errata report has been submitted for RFC8422, "Elliptic Curve Cryptography (ECC) Cipher Suites for Transport Layer Security (TLS) Versions 1.2 and Earlier". -------------------------------------- You may review the report below and at: http://www.rfc-editor.org/errata/eid5466 -------------------------------------- Type: Editorial Reported by: Masato Gosui Section: 5.3 Original Text ------------- Actions of the sender: The server constructs an appropriate certificate chain and conveys it to the client in the Certificate message. If the client has used a Supported Elliptic Curves Extension, the public key in the server's certificate MUST respect the client's choice of elliptic curves. A server that cannot satisfy this requirement MUST NOT choose an ECC cipher suite in its ServerHello message.) Corrected Text -------------- Actions of the sender: The server constructs an appropriate certificate chain and conveys it to the client in the Certificate message. If the client has used a Supported Elliptic Curves Extension, the public key in the server's certificate MUST respect the client's choice of elliptic curves. (A server that cannot satisfy this requirement MUST NOT choose an ECC cipher suite in its ServerHello message.) Notes ----- This adds the missing opening parenthesis of the last sentence of the "Actions of the sender" paragraph. Instructions: ------------- This erratum is currently posted as "Reported". If necessary, please use "Reply All" to discuss whether it should be verified or rejected. When a decision is reached, the verifying party can log in to change the status and edit the report, if necessary. -------------------------------------- RFC8422 (draft-ietf-tls-rfc4492bis-17) -------------------------------------- Title : Elliptic Curve Cryptography (ECC) Cipher Suites for Transport Layer Security (TLS) Versions 1.2 and Earlier Publication Date : August 2018 Author(s) : Y. Nir, S. Josefsson, M. Pegourie-Gonnard Category : PROPOSED STANDARD Source : Transport Layer Security Area : Security Stream : IETF Verifying Party : IESG From nobody Thu Aug 16 19:21:50 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C890A130E1B for ; Thu, 16 Aug 2018 19:21:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SOFSUA2meGyO for ; Thu, 16 Aug 2018 19:21:47 -0700 (PDT) Received: from rfc-editor.org (rfc-editor.org [4.31.198.49]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 896A5130E0E for ; Thu, 16 Aug 2018 19:21:47 -0700 (PDT) Received: by rfc-editor.org (Postfix, from userid 30) id 6C114B80A77; Thu, 16 Aug 2018 19:21:37 -0700 (PDT) To: ynir.ietf@gmail.com, simon@josefsson.org, mpg@elzevir.fr, kaduk@mit.edu, ekr@rtfm.com, christopherwood07@gmail.com, joe@salowey.net, sean+ietf@sn3rd.com X-PHP-Originating-Script: 30:errata_mail_lib.php From: RFC Errata System Cc: mgosui@yahoo-corp.jp, tls@ietf.org, rfc-editor@rfc-editor.org Content-Type: text/plain; charset=UTF-8 Message-Id: <20180817022137.6C114B80A77@rfc-editor.org> Date: Thu, 16 Aug 2018 19:21:37 -0700 (PDT) Archived-At: Subject: [TLS] [Editorial Errata Reported] RFC8422 (5468) X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 Aug 2018 02:21:49 -0000 The following errata report has been submitted for RFC8422, "Elliptic Curve Cryptography (ECC) Cipher Suites for Transport Layer Security (TLS) Versions 1.2 and Earlier". -------------------------------------- You may review the report below and at: http://www.rfc-editor.org/errata/eid5468 -------------------------------------- Type: Editorial Reported by: Masato Gosui Section: 5.4 Original Text ------------- namedCurve: Specifies a recommended set of elliptic curve domain Corrected Text -------------- namedcurve: Specifies a recommended set of elliptic curve domain Notes ----- This fixes mismatched names of the variable "namedcurve" in the "Structure of this message" paragraph. Instructions: ------------- This erratum is currently posted as "Reported". If necessary, please use "Reply All" to discuss whether it should be verified or rejected. When a decision is reached, the verifying party can log in to change the status and edit the report, if necessary. -------------------------------------- RFC8422 (draft-ietf-tls-rfc4492bis-17) -------------------------------------- Title : Elliptic Curve Cryptography (ECC) Cipher Suites for Transport Layer Security (TLS) Versions 1.2 and Earlier Publication Date : August 2018 Author(s) : Y. Nir, S. Josefsson, M. Pegourie-Gonnard Category : PROPOSED STANDARD Source : Transport Layer Security Area : Security Stream : IETF Verifying Party : IESG From nobody Thu Aug 16 21:09:29 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5387F130E29 for ; Thu, 16 Aug 2018 21:09:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XATko2RZvDoS for ; Thu, 16 Aug 2018 21:09:26 -0700 (PDT) Received: from mail-oi0-x229.google.com (mail-oi0-x229.google.com [IPv6:2607:f8b0:4003:c06::229]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 36310128CF2 for ; Thu, 16 Aug 2018 21:09:26 -0700 (PDT) Received: by mail-oi0-x229.google.com with SMTP id d189-v6so11915018oib.6 for ; Thu, 16 Aug 2018 21:09:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=MI+1y75OEhcW5zrkQIR/FHd+Hs5gD3iQQgm28X82DJo=; b=dmPerN9Z+4yQl7EKtrBvmp5dPEx5wqERRWNKKGx64gs4FJPuRus/bDTdLiqMu39FVj U+VsFhKzu09WXdDBOjBadlU7pjfH0uV0fCp8B1cmuNoHWqs8GDnnae08TysO6Mq9CGkM lS/00G4NIiR14alS70GpIcjxZ9EYL01054AhjVon+dCEWidouv0WxzE1lwfHXfd1Xk4K IZmxD+fN61mp/wKxhufs12KmcVGuMTDkRvShKXOLneP0L09RgMdq/UJoduYgz6O+MrzO xgimARUm3JEAeH8IC3TM2gnvv1pXJPQ53ZjDodz/0bsAa2DKuodoFxiFziV9u7uKqlBm 1Zug== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=MI+1y75OEhcW5zrkQIR/FHd+Hs5gD3iQQgm28X82DJo=; b=eOx/NWRySeuQps0kWdKroqLN1ThaBC05IDzjPV+rU2LHLOriZVvWK6pZCzAjx6fjvg Opn8mKZdedjxSxxSQTUz1yG4/HpjElSVyVyVtsp+ztajxtts8FS3Fx3oSl2qdtWAk6zB fmQHR1UvV4DoDv0IQF1s2Kpr1CTbcVyfmYdq9cw1FDhVwwl+9qmz//GBViU7hHwyzusx qtvqo9EAb0kqE686ZF8IcYieYalrYM7PcRdLngmFlhlXAmSKIancqwxdeuJGhnFDbm7A xBjTXNMU3O7IM0rKxz04TEaSVQO37meJoPJcRkfBZTqDMR+wyWiYQ59gu7lHei9j4KCb s0jg== X-Gm-Message-State: AOUpUlGlJONhFofG2qFtAarBvuEsjHjtVeaXfw1l/rYBekIy7tKBsjQl 5z+pciHrfgN16D5ewbVH5AWcGa1bQuMFiCdzKrI= X-Google-Smtp-Source: AA+uWPxGXbS0s1BVAd3qkHgLTV/7Wrgq6k9MR5rC1pok+I4WDBWTqNpXI8HkfzuVOJRk+1TMFpR8Vi9EZ8apxqWFRE8= X-Received: by 2002:a54:448b:: with SMTP id v11-v6mr853394oiv.208.1534478965464; Thu, 16 Aug 2018 21:09:25 -0700 (PDT) MIME-Version: 1.0 References: <20180817020730.B5DF1B80117@rfc-editor.org> In-Reply-To: <20180817020730.B5DF1B80117@rfc-editor.org> From: Martin Thomson Date: Fri, 17 Aug 2018 14:09:13 +1000 Message-ID: To: RFC Errata System Cc: Yoav Nir , Simon Josefsson , mpg@elzevir.fr, Benjamin Kaduk , Eric Rescorla , Christopher Wood , Joseph Salowey , sean+ietf@sn3rd.com, "" Content-Type: text/plain; charset="UTF-8" Archived-At: Subject: Re: [TLS] [Editorial Errata Reported] RFC8422 (5466) X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 Aug 2018 04:09:28 -0000 Looks good. I would remove the trailing paren instead though. On Fri, Aug 17, 2018 at 12:08 PM RFC Errata System wrote: > > The following errata report has been submitted for RFC8422, > "Elliptic Curve Cryptography (ECC) Cipher Suites for Transport Layer Security (TLS) Versions 1.2 and Earlier". > > -------------------------------------- > You may review the report below and at: > http://www.rfc-editor.org/errata/eid5466 > > -------------------------------------- > Type: Editorial > Reported by: Masato Gosui > > Section: 5.3 > > Original Text > ------------- > Actions of the sender: > > The server constructs an appropriate certificate chain and conveys it > to the client in the Certificate message. If the client has used a > Supported Elliptic Curves Extension, the public key in the server's > certificate MUST respect the client's choice of elliptic curves. A > server that cannot satisfy this requirement MUST NOT choose an ECC > cipher suite in its ServerHello message.) > > Corrected Text > -------------- > Actions of the sender: > > The server constructs an appropriate certificate chain and conveys it > to the client in the Certificate message. If the client has used a > Supported Elliptic Curves Extension, the public key in the server's > certificate MUST respect the client's choice of elliptic curves. (A > server that cannot satisfy this requirement MUST NOT choose an ECC > cipher suite in its ServerHello message.) > > Notes > ----- > This adds the missing opening parenthesis of the last sentence of the "Actions of the sender" paragraph. > > Instructions: > ------------- > This erratum is currently posted as "Reported". If necessary, please > use "Reply All" to discuss whether it should be verified or > rejected. When a decision is reached, the verifying party > can log in to change the status and edit the report, if necessary. > > -------------------------------------- > RFC8422 (draft-ietf-tls-rfc4492bis-17) > -------------------------------------- > Title : Elliptic Curve Cryptography (ECC) Cipher Suites for Transport Layer Security (TLS) Versions 1.2 and Earlier > Publication Date : August 2018 > Author(s) : Y. Nir, S. Josefsson, M. Pegourie-Gonnard > Category : PROPOSED STANDARD > Source : Transport Layer Security > Area : Security > Stream : IETF > Verifying Party : IESG > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls From nobody Thu Aug 16 23:30:11 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D5288130E21 for ; Thu, 16 Aug 2018 23:30:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0FsOizk8qHMv for ; Thu, 16 Aug 2018 23:30:06 -0700 (PDT) Received: from duva.sjd.se (duva.sjd.se [IPv6:2001:9b0:1:1702::100]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 11FF0130DC8 for ; Thu, 16 Aug 2018 23:30:05 -0700 (PDT) Received: from latte ([IPv6:2001:9b0:104:42::8cb]) (authenticated bits=0) by duva.sjd.se (8.14.4/8.14.4/Debian-4+deb7u1) with ESMTP id w7H6Ti2a020642 (version=TLSv1/SSLv3 cipher=AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 17 Aug 2018 08:29:47 +0200 Message-ID: <1534487378.28819.2.camel@josefsson.org> From: Simon Josefsson To: Martin Thomson , RFC Errata System Cc: Yoav Nir , mpg@elzevir.fr, Benjamin Kaduk , Eric Rescorla , Christopher Wood , Joseph Salowey , sean+ietf@sn3rd.com, "" Date: Fri, 17 Aug 2018 08:29:38 +0200 In-Reply-To: References: <20180817020730.B5DF1B80117@rfc-editor.org> Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="=-v6aKF3Y73ZgiGHCQqdgK" X-Mailer: Evolution 3.22.6-1+deb9u1 Mime-Version: 1.0 X-Virus-Scanned: clamav-milter 0.99.4 at duva.sjd.se X-Virus-Status: Clean Archived-At: Subject: Re: [TLS] [Editorial Errata Reported] RFC8422 (5466) X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 Aug 2018 06:30:09 -0000 --=-v6aKF3Y73ZgiGHCQqdgK Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable I would also remove the spurious paren instead -- having a MUST NOT inside a paren seems suboptimal to me. /Simon fre 2018-08-17 klockan 14:09 +1000 skrev Martin Thomson: > Looks good.=C2=A0=C2=A0I would remove the trailing paren instead though. > On Fri, Aug 17, 2018 at 12:08 PM RFC Errata System > wrote: > >=20 > > The following errata report has been submitted for RFC8422, > > "Elliptic Curve Cryptography (ECC) Cipher Suites for Transport > > Layer Security (TLS) Versions 1.2 and Earlier". > >=20 > > -------------------------------------- > > You may review the report below and at: > > http://www.rfc-editor.org/errata/eid5466 > >=20 > > -------------------------------------- > > Type: Editorial > > Reported by: Masato Gosui > >=20 > > Section: 5.3 > >=20 > > Original Text > > ------------- > > =C2=A0=C2=A0=C2=A0Actions of the sender: > >=20 > > =C2=A0=C2=A0=C2=A0The server constructs an appropriate certificate chai= n and > > conveys it > > =C2=A0=C2=A0=C2=A0to the client in the Certificate message.=C2=A0=C2=A0= If the client has > > used a > > =C2=A0=C2=A0=C2=A0Supported Elliptic Curves Extension, the public key i= n the > > server's > > =C2=A0=C2=A0=C2=A0certificate MUST respect the client's choice of ellip= tic > > curves.=C2=A0=C2=A0A > > =C2=A0=C2=A0=C2=A0server that cannot satisfy this requirement MUST NOT = choose an > > ECC > > =C2=A0=C2=A0=C2=A0cipher suite in its ServerHello message.) > >=20 > > Corrected Text > > -------------- > > =C2=A0=C2=A0=C2=A0Actions of the sender: > >=20 > > =C2=A0=C2=A0=C2=A0The server constructs an appropriate certificate chai= n and > > conveys it > > =C2=A0=C2=A0=C2=A0to the client in the Certificate message.=C2=A0=C2=A0= If the client has > > used a > > =C2=A0=C2=A0=C2=A0Supported Elliptic Curves Extension, the public key i= n the > > server's > > =C2=A0=C2=A0=C2=A0certificate MUST respect the client's choice of ellip= tic > > curves.=C2=A0=C2=A0(A > > =C2=A0=C2=A0=C2=A0server that cannot satisfy this requirement MUST NOT = choose an > > ECC > > =C2=A0=C2=A0=C2=A0cipher suite in its ServerHello message.) > >=20 > > Notes > > ----- > > This adds the missing opening parenthesis of the last sentence of > > the "Actions of the sender" paragraph. > >=20 > > Instructions: > > ------------- > > This erratum is currently posted as "Reported". If necessary, > > please > > use "Reply All" to discuss whether it should be verified or > > rejected. When a decision is reached, the verifying party > > can log in to change the status and edit the report, if necessary. > >=20 > > -------------------------------------- > > RFC8422 (draft-ietf-tls-rfc4492bis-17) > > -------------------------------------- > > Title=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0: Elliptic Curve Cryptography (ECC) Cipher > > Suites for Transport Layer Security (TLS) Versions 1.2 and Earlier > > Publication Date=C2=A0=C2=A0=C2=A0=C2=A0: August 2018 > > Author(s)=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0: Y. Nir, S. Josefsson, M. Pegourie-Gonnard > > Category=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0: PROPOSED STANDARD > > Source=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0: Transport Layer Security > > Area=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0: Security > > Stream=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0: IETF > > Verifying Party=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0: IESG > >=20 > > _______________________________________________ > > TLS mailing list > > TLS@ietf.org > > https://www.ietf.org/mailman/listinfo/tls --=-v6aKF3Y73ZgiGHCQqdgK Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part Content-Transfer-Encoding: 7bit -----BEGIN PGP SIGNATURE----- iQEzBAABCAAdFiEEmUFc4ZBdDlWp+IAmhgt/uzL4EZ0FAlt2a1IACgkQhgt/uzL4 EZ223Af/cD0MZ7DEYqLegDH2gMewztbf2ZqyItHdlhjdR47ilSHzxgcgTcF8aEBf EVgnjm1qp9Vm/LCIum70i+/p5IwIPKSlqmhdHF3yjMur47/nbY370Rs2FyhYyAYi dUbYN0K7sskaZdRH2XzyC8hChqp6udtBiccoUB2g6Clw/N8J4DvusryZP8/yuGbU ZTNqByKXjd4WSTreLAQ3E/bJ9F7ib3+bGInIa8uPaTCgdi8dGcU4+egBtT7MRc9K UKpQYRvQ5MvRn/LT9caAOheYPvUT5lEl98pwAzL1gNy5oHDIExMgM3GwMoB807h4 5Aw/OECC2MPct0HzPqAvIs/CX5FBTQ== =ZAWd -----END PGP SIGNATURE----- --=-v6aKF3Y73ZgiGHCQqdgK-- From nobody Fri Aug 17 01:26:15 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EAD80130DF3 for ; Fri, 17 Aug 2018 01:26:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id knPG5SyOsKzW for ; Fri, 17 Aug 2018 01:26:11 -0700 (PDT) Received: from duva.sjd.se (duva.sjd.se [IPv6:2001:9b0:1:1702::100]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 04642130DD3 for ; Fri, 17 Aug 2018 01:26:10 -0700 (PDT) Received: from [IPv6:2001:9b0:104:42::cd8] ([IPv6:2001:9b0:104:42::cd8]) (authenticated bits=0) by duva.sjd.se (8.14.4/8.14.4/Debian-4+deb7u1) with ESMTP id w7H8Pqh9001137 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 17 Aug 2018 10:25:54 +0200 Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (1.0) From: Simon Josefsson X-Mailer: iPhone Mail (15G77) In-Reply-To: <20180817022137.6C114B80A77@rfc-editor.org> Date: Fri, 17 Aug 2018 10:25:47 +0200 Cc: ynir.ietf@gmail.com, mpg@elzevir.fr, kaduk@mit.edu, ekr@rtfm.com, christopherwood07@gmail.com, joe@salowey.net, sean+ietf@sn3rd.com, mgosui@yahoo-corp.jp, tls@ietf.org Content-Transfer-Encoding: quoted-printable Message-Id: <1937603C-BD24-48A0-8555-B4D8D7BE6D37@josefsson.org> References: <20180817022137.6C114B80A77@rfc-editor.org> To: RFC Errata System X-Virus-Scanned: clamav-milter 0.99.4 at duva.sjd.se X-Virus-Status: Clean Archived-At: Subject: Re: [TLS] [Editorial Errata Reported] RFC8422 (5468) X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 Aug 2018 08:26:13 -0000 I think =E2=80=9CnamedCurve=E2=80=9D is better, it matches ASN.1 usage. /Simon > 17 aug. 2018 kl. 04:21 skrev RFC Errata System = : >=20 > The following errata report has been submitted for RFC8422, > "Elliptic Curve Cryptography (ECC) Cipher Suites for Transport Layer Secur= ity (TLS) Versions 1.2 and Earlier". >=20 > -------------------------------------- > You may review the report below and at: > http://www.rfc-editor.org/errata/eid5468 >=20 > -------------------------------------- > Type: Editorial > Reported by: Masato Gosui >=20 > Section: 5.4 >=20 > Original Text > ------------- > namedCurve: Specifies a recommended set of elliptic curve domain >=20 > Corrected Text > -------------- > namedcurve: Specifies a recommended set of elliptic curve domain >=20 > Notes > ----- > This fixes mismatched names of the variable "namedcurve" in the "Structure= of this message" paragraph. >=20 > Instructions: > ------------- > This erratum is currently posted as "Reported". If necessary, please > use "Reply All" to discuss whether it should be verified or > rejected. When a decision is reached, the verifying party =20 > can log in to change the status and edit the report, if necessary.=20 >=20 > -------------------------------------- > RFC8422 (draft-ietf-tls-rfc4492bis-17) > -------------------------------------- > Title : Elliptic Curve Cryptography (ECC) Cipher Suites for T= ransport Layer Security (TLS) Versions 1.2 and Earlier > Publication Date : August 2018 > Author(s) : Y. Nir, S. Josefsson, M. Pegourie-Gonnard > Category : PROPOSED STANDARD > Source : Transport Layer Security > Area : Security > Stream : IETF > Verifying Party : IESG From nobody Fri Aug 17 09:21:57 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4998F130E9C for ; Fri, 17 Aug 2018 09:21:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sn3rd.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hBeBbN19qi4S for ; Fri, 17 Aug 2018 09:21:53 -0700 (PDT) Received: from mail-qt0-x22e.google.com (mail-qt0-x22e.google.com [IPv6:2607:f8b0:400d:c0d::22e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 09A74130D7A for ; Fri, 17 Aug 2018 09:21:53 -0700 (PDT) Received: by mail-qt0-x22e.google.com with SMTP id r21-v6so9335012qtm.2 for ; Fri, 17 Aug 2018 09:21:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sn3rd.com; s=google; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=Upe49TSxcdqWzl8qtMTh9KNVryUQzZ4Abt3tb618GBA=; b=lCEZPXoh9y8/8y9qAucbiaAXhDyZkWWOWxusQlaWlrU0O4GgEnrI2uylsSXK5PZy/7 CgxzfVG5ci2QAzcZAPlZImvR9DaTw568Ml6WNO6KTpcoq3pV6X31PCQpHW3iooZ8BAOB nDKbErtyuH/ybU8xOF6sPa/nlLwH90LgMCoFg= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=Upe49TSxcdqWzl8qtMTh9KNVryUQzZ4Abt3tb618GBA=; b=mbR4wNDVV19YukiaSrn8qgfBlh78JWpPPPNj9XlcDgFynsGHr9awpvrepQg2NTK5vx 4FjlxoWhTas0s8E/6rulzEHCdobbd9WOOKkVFLglxPyhqRRtT3TxLho2k7/6ZPUpNSDN wgS+jt7R5vxuORMuYKg2a1Cyilbk36f6x9y82oEfDSTc6hNgQU+8oWQJ7pE5TScK4uf2 tU/1qebMHNcvahahj3vVVgH+RrV2C/ZtgXGDBKdS+HyG1E4Y9/9Z7AnvuPuuNcDovXkQ qRQen9D/7cpaKRH/grlryavq+nCnq/IDBkOO62iZti7O6BuQ/aeDUKCBmIWmmXlv5m+l hb6Q== X-Gm-Message-State: AOUpUlEkZ8BL2s/Rpytg7wTwJyr8WwENTsq2v5Vd6s+xnL5ynGBOje2k oFsmIIRB3sspUkIzk9AujfznJA== X-Google-Smtp-Source: AA+uWPxJxzs9adYHPLQP3FXxHBw5RJjaS8zqH/CpTUdDYJo6alpDomHNJKYOPhp270xGQBaC6T2KJw== X-Received: by 2002:ac8:71d1:: with SMTP id i17-v6mr34588649qtp.65.1534522912230; Fri, 17 Aug 2018 09:21:52 -0700 (PDT) Received: from [172.16.0.18] ([96.231.225.148]) by smtp.gmail.com with ESMTPSA id t28-v6sm1481161qki.82.2018.08.17.09.21.50 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 17 Aug 2018 09:21:51 -0700 (PDT) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) From: Sean Turner In-Reply-To: <1534487378.28819.2.camel@josefsson.org> Date: Fri, 17 Aug 2018 12:21:49 -0400 Cc: Martin Thomson , Yoav Nir , mpg@elzevir.fr, Eric Rescorla , Chris Wood , Joe Salowey , tls@ietf.org, Simon Josefsson Content-Transfer-Encoding: 7bit Message-Id: <738D5D21-5E34-4BA2-9C8D-C418D2D1F73D@sn3rd.com> References: <20180817020730.B5DF1B80117@rfc-editor.org> <1534487378.28819.2.camel@josefsson.org> To: Benjamin Kaduk X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: Re: [TLS] [Editorial Errata Reported] RFC8422 (5466) X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 Aug 2018 16:21:55 -0000 I think we can safely mark this one HFDU (Hold For Document Update). spt > On Aug 17, 2018, at 02:29, Simon Josefsson wrote: > > I would also remove the spurious paren instead -- having a MUST NOT > inside a paren seems suboptimal to me. > > /Simon > > fre 2018-08-17 klockan 14:09 +1000 skrev Martin Thomson: >> Looks good. I would remove the trailing paren instead though. >> On Fri, Aug 17, 2018 at 12:08 PM RFC Errata System >> wrote: >>> >>> The following errata report has been submitted for RFC8422, >>> "Elliptic Curve Cryptography (ECC) Cipher Suites for Transport >>> Layer Security (TLS) Versions 1.2 and Earlier". >>> >>> -------------------------------------- >>> You may review the report below and at: >>> http://www.rfc-editor.org/errata/eid5466 >>> >>> -------------------------------------- >>> Type: Editorial >>> Reported by: Masato Gosui >>> >>> Section: 5.3 >>> >>> Original Text >>> ------------- >>> Actions of the sender: >>> >>> The server constructs an appropriate certificate chain and >>> conveys it >>> to the client in the Certificate message. If the client has >>> used a >>> Supported Elliptic Curves Extension, the public key in the >>> server's >>> certificate MUST respect the client's choice of elliptic >>> curves. A >>> server that cannot satisfy this requirement MUST NOT choose an >>> ECC >>> cipher suite in its ServerHello message.) >>> >>> Corrected Text >>> -------------- >>> Actions of the sender: >>> >>> The server constructs an appropriate certificate chain and >>> conveys it >>> to the client in the Certificate message. If the client has >>> used a >>> Supported Elliptic Curves Extension, the public key in the >>> server's >>> certificate MUST respect the client's choice of elliptic >>> curves. (A >>> server that cannot satisfy this requirement MUST NOT choose an >>> ECC >>> cipher suite in its ServerHello message.) >>> >>> Notes >>> ----- >>> This adds the missing opening parenthesis of the last sentence of >>> the "Actions of the sender" paragraph. >>> >>> Instructions: >>> ------------- >>> This erratum is currently posted as "Reported". If necessary, >>> please >>> use "Reply All" to discuss whether it should be verified or >>> rejected. When a decision is reached, the verifying party >>> can log in to change the status and edit the report, if necessary. >>> >>> -------------------------------------- >>> RFC8422 (draft-ietf-tls-rfc4492bis-17) >>> -------------------------------------- >>> Title : Elliptic Curve Cryptography (ECC) Cipher >>> Suites for Transport Layer Security (TLS) Versions 1.2 and Earlier >>> Publication Date : August 2018 >>> Author(s) : Y. Nir, S. Josefsson, M. Pegourie-Gonnard >>> Category : PROPOSED STANDARD >>> Source : Transport Layer Security >>> Area : Security >>> Stream : IETF >>> Verifying Party : IESG >>> >>> _______________________________________________ >>> TLS mailing list >>> TLS@ietf.org >>> https://www.ietf.org/mailman/listinfo/tls From nobody Fri Aug 17 10:32:53 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 73FB81252B7 for ; Fri, 17 Aug 2018 10:32:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sn3rd.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JG11FIpSaKAn for ; Fri, 17 Aug 2018 10:32:50 -0700 (PDT) Received: from mail-qt0-x231.google.com (mail-qt0-x231.google.com [IPv6:2607:f8b0:400d:c0d::231]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1DC45130ED7 for ; Fri, 17 Aug 2018 10:32:50 -0700 (PDT) Received: by mail-qt0-x231.google.com with SMTP id h4-v6so9569769qtj.7 for ; Fri, 17 Aug 2018 10:32:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sn3rd.com; s=google; h=from:content-transfer-encoding:mime-version:subject:message-id:date :to; bh=wMOU+rIi1Yo9vJiuj+wA8NWnsWtx+g0/d4mbNfHxWt8=; b=HBgnW8/7xHZFgADrP3msMwsua+Ac/cO34bdwmHZScr08FTjGafsdTTDt7uJLRp68pH uUxCksglVJAKmypNsMEREsoEvJZ0fhmf3xlhB1Q8IVxolJUFRUhi4uRaDwo5p1Org9Ju 6gp58KJdt2nL4qtX/Im5jRCrPwyzbhoXGGYrA= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:content-transfer-encoding:mime-version :subject:message-id:date:to; bh=wMOU+rIi1Yo9vJiuj+wA8NWnsWtx+g0/d4mbNfHxWt8=; b=kXVcaRg0vqGzIpUFvY9/FKe4yGgr7d6oU2w2SSTUHzXbOU4n5YiIUlLDJCZGEoR+K3 QI+CmRJFCxcIw6NDeCHzzW+xCF/OxKigEndkTQLfoh8fat3Y6Y9gcpKhQglLnrQKEYVD h+6vbNkKhdSXzM0uUMXtJd2Ae5RAFMr1rRxos9CwuczDLwJTsSelOkxgfqTRHkKUNo/u op+2rng37E4OnV+OnKTcrus4rQGxBfPNxV63+bJdwnN6NVIcpAeRR2bxUozGLEW0ojVT lKa51Avm6yYcp0C5Cpu87YEwTFQQuiqhRgdUjs3EVFaIBtvchJsbbQoSru9OJKhqrZvJ ICcA== X-Gm-Message-State: AOUpUlETRmI8rkOhR1SeXbEQd0uA1KljQnLZaaQpzJtL+hpAceTupcDZ bN4/WrgMzCUgaSPBZrd6psXeNUJfUek= X-Google-Smtp-Source: AA+uWPwm32pusDFIko+io4MSjcZqVD/SqqeERI/7J6lOruLYlDQIQDtUMC+0Gnu9DjFtuk2Ax6U7HA== X-Received: by 2002:a0c:f1d4:: with SMTP id u20-v6mr32021727qvl.124.1534527169055; Fri, 17 Aug 2018 10:32:49 -0700 (PDT) Received: from [172.16.0.18] ([96.231.225.148]) by smtp.gmail.com with ESMTPSA id c8-v6sm1367264qtn.79.2018.08.17.10.32.48 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 17 Aug 2018 10:32:48 -0700 (PDT) From: Sean Turner Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) Message-Id: <5896D3BB-E621-40E1-AC07-CBA7326886F0@sn3rd.com> Date: Fri, 17 Aug 2018 13:32:47 -0400 To: tls@ietf.org X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: [TLS] WG adoption call: draft-moriarty-tls-oldversions-diediedie X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 Aug 2018 17:32:51 -0000 At the TLS@IETF102 session, there seemed to be some interest in adopting = draft-moriarty-tls-oldversions-diediedie as a WG item. This email is to = determine whether there is WG consensus to adopt this draft as a WG = item. If you would like for this draft to become a WG document and you = are willing to review it as it moves through the process, then please = let the list know by 2359UTC 20180831. If you are opposed to this being = a WG document, please say so (and say why). Note that we will suggest replacing =E2=80=9Cdiediedie" with = =E2=80=9Cdeprecate" in the adopted draft=E2=80=99s name to address the = naming comment raised during the meeting. Thanks, Chris, Joe and Sean= From nobody Fri Aug 17 10:33:29 2018 Return-Path: X-Original-To: tls@ietf.org Delivered-To: tls@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 9A556130FBE; Fri, 17 Aug 2018 10:33:19 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: IETF Secretariat To: , , X-Test-IDTracker: no X-IETF-IDTracker: 6.83.1 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <153452719962.17994.18295787287508064922.idtracker@ietfa.amsl.com> Date: Fri, 17 Aug 2018 10:33:19 -0700 Archived-At: Subject: [TLS] The TLS WG has placed draft-moriarty-tls-oldversions-diediedie in state "Call For Adoption By WG Issued" X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 Aug 2018 17:33:28 -0000 The TLS WG has placed draft-moriarty-tls-oldversions-diediedie in state Call For Adoption By WG Issued (entered by Sean Turner) The document is available at https://datatracker.ietf.org/doc/draft-moriarty-tls-oldversions-diediedie/ From nobody Fri Aug 17 10:59:19 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 929511252B7; Fri, 17 Aug 2018 10:59:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 79EcGD_jcdHr; Fri, 17 Aug 2018 10:59:17 -0700 (PDT) Received: from mail-io0-x22b.google.com (mail-io0-x22b.google.com [IPv6:2607:f8b0:4001:c06::22b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0D6A6130EE3; Fri, 17 Aug 2018 10:59:14 -0700 (PDT) Received: by mail-io0-x22b.google.com with SMTP id y10-v6so7566891ioa.10; Fri, 17 Aug 2018 10:59:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=JJk5vj1viRraaz8mjiNSZZDUkVgU+Ye2Y1/IL2vhIJc=; b=vYNir3gkwsZhEzmR5xZB/4CSeGYQ0w/eZ/0g7+R1k/ZNE7FWPINqqPWywxvigfuLV3 tvSNjU8jXR5/zMZeyGCUpCvn3wf6Lm0L8XAKghsHO1w2Kcwg2s9GkWIZXBvPfDkbRFqu rgC+TlMYCOL4rsonoz33+xLtwdmovc6CwzeHACDz3O4yArxtpyRiggVbV84gX4vc9/WK LQWRlA4agWBBUURhvm1JiGbgVL7DTEWGVFbeNIk3Sgu5wN/OCkdANbCCQamuzF+WvODg 90OsTk5SLnRzHd7Sr8M6YvFn5zb0QHyfkkgwwyi8rDSdgDgd6qUf8jsSP1TTE4RCE3W6 Af8Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=JJk5vj1viRraaz8mjiNSZZDUkVgU+Ye2Y1/IL2vhIJc=; b=nQIgkSAdsFEqMma1l7ok43yv628IUa/deXEeMggO6fdNgpr9AFDpgNhtzE20629T02 uRVRW086XSqY2psnOtbECcz25ELekd+YVi2249gsh8xzayLx/tHEtnFia2xb3fPs1jFu HICZWUr913zhSbxTPJzSEMh5KHP+kgks5sIbYgyMN4o/PZEa+gHPjv7j4N4wm46pfzdu S2dpDzuLgPkryQTjTwAlc2kAEAq0Yl8EvIWcFHxFmGurD9rEuqaM3gl6sU3P9fD189lq S5rt9ZRdHvxqk5SYp4VQcq8bOXV+5rmm29WKJg4bl5ChMarjJfSsSMvGejDp+ndqw2qa CuOA== X-Gm-Message-State: AOUpUlHBSeV1fytwIX8uMUhqtX6B8+AoI9V2uFelFEuxe85L3GfGEUTD zfHt1CHCyrnj8fF6hRrQG0UWFqdqGwMOxFyjJA4BFg== X-Google-Smtp-Source: AA+uWPxblSkx47V1OJ3SIN0gc5C64okWrKo8XokSwRWTrDTYrRC4yIAgXBdyN0ttj8pdPR483QnAjOcT8a5GnhxZZA0= X-Received: by 2002:a6b:310d:: with SMTP id j13-v6mr31489676ioa.250.1534528753157; Fri, 17 Aug 2018 10:59:13 -0700 (PDT) MIME-Version: 1.0 Received: by 2002:a4f:f741:0:0:0:0:0 with HTTP; Fri, 17 Aug 2018 10:59:12 -0700 (PDT) In-Reply-To: <153452719962.17994.18295787287508064922.idtracker@ietfa.amsl.com> References: <153452719962.17994.18295787287508064922.idtracker@ietfa.amsl.com> From: Loganaden Velvindron Date: Fri, 17 Aug 2018 21:59:12 +0400 Message-ID: To: IETF Secretariat Cc: "draft-moriarty-tls-oldversions-diediedie@ietf.org" , "tls-chairs@ietf.org" , "tls@ietf.org" Content-Type: multipart/alternative; boundary="0000000000003acca00573a551ec" Archived-At: Subject: Re: [TLS] The TLS WG has placed draft-moriarty-tls-oldversions-diediedie in state "Call For Adoption By WG Issued" X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 Aug 2018 17:59:18 -0000 --0000000000003acca00573a551ec Content-Type: text/plain; charset="UTF-8" I support the adoption On Friday, August 17, 2018, IETF Secretariat < ietf-secretariat-reply@ietf.org> wrote: > > The TLS WG has placed draft-moriarty-tls-oldversions-diediedie in state > Call For Adoption By WG Issued (entered by Sean Turner) > > The document is available at > https://datatracker.ietf.org/doc/draft-moriarty-tls-oldversions-diediedie/ > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > --0000000000003acca00573a551ec Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable I support the adoption

On Friday, August 17, 2018, IETF Secretariat = <ietf-secretariat-rep= ly@ietf.org> wrote:

The TLS WG has placed draft-moriarty-tls-oldversions-diediedie in stat= e
Call For Adoption By WG Issued (entered by Sean Turner)

The document is available at
https://datatracker.ietf.org/doc/draft-m= oriarty-tls-oldversions-diediedie/

_______________________________________________
TLS mailing list
TLS@ietf.org
htt= ps://www.ietf.org/mailman/listinfo/tls
--0000000000003acca00573a551ec-- From nobody Fri Aug 17 11:00:06 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 81D7B130F72 for ; Fri, 17 Aug 2018 11:00:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qyEpAegHJeth for ; Fri, 17 Aug 2018 11:00:01 -0700 (PDT) Received: from mail-it0-x22d.google.com (mail-it0-x22d.google.com [IPv6:2607:f8b0:4001:c0b::22d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4A14E130F9C for ; Fri, 17 Aug 2018 10:59:59 -0700 (PDT) Received: by mail-it0-x22d.google.com with SMTP id d16-v6so2184427itj.0 for ; Fri, 17 Aug 2018 10:59:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=r25eroVngx3Kw0kPdDBZpvd47kjbrsdkjixRclzuTNw=; b=jZMRyDPyinb6g6TH2YKsrP4CPrRfAF1JfttPAzNI2BztKb3SJfk4eW5LYEEgObonWe rxGT98gk0ly4gOf/gECg4D+w5TycxIvp/xdjiJh7R7ZsODmZcGkqO6H4FvgqA3cvovlt l1Bojft2bO1SWjAU+HZrEgVGEO9HB6U80CzyUZ1HUggwwrGnMiztiCn5dfWB3wDaYF1+ BOUUv45ZHs6+P80KqWVbfwZ+aFrk1tAM9qNZlBdDzvmMLEd/4H3aZ0LIfUrXcL9AoRiZ fUVgdM21149GgiciId/Q0xYteYrpcgp6QupWC/BRrwblSwS1ZkiSJsKruo7EFQ+cBDek 2vXw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=r25eroVngx3Kw0kPdDBZpvd47kjbrsdkjixRclzuTNw=; b=SznITAPM3HoHDtGDRl4XOnvTcqnp3OYELnnIxpJ9acAUEQ075ycEx8F/AdkvbHByX5 cGS3KgQU8DI9Haqo+CUkBoKEXxvindgcW1IsBSHrq5J4lmKT+YP5gtmJY4snPj8aENsD uUMXEZFvQsyT/z8O1AnSJRP9CJMO6GydLdm2WHlNa2VWnTVIZfR6vTd360IfFl8z8Vwu Lna7BrkwsntOvrHRdiZJh29+WKGHfu2z6g+hjc2LCVVUYB8gdRu0gl/GEvSlT1LPBAnV w9P91ZmemwGQSFdUSQEvr0zRQ1wyH7PWf0fyaP99o+NOfMYswhRqfN1B/ZZQBVk07rJY t+qA== X-Gm-Message-State: AOUpUlHJ9nUoxq5NehqcYWdHU+YK3w7QByVaSw+G4V+DCQKtAwB127VS sxmOfWHllaTntPPbd9JQ/O1lO6hXP1P3898gAZarkA== X-Google-Smtp-Source: AA+uWPxGgSDAdxZ/CMSyGnSQ6CXxSvozAbIZ9d0koQHlZQIR6ba5kh/zUOIu2uv/QkaRWYd6/LYAY6E8SbGsRYsxkL4= X-Received: by 2002:a24:c2c2:: with SMTP id i185-v6mr5450585itg.76.1534528798643; Fri, 17 Aug 2018 10:59:58 -0700 (PDT) MIME-Version: 1.0 Received: by 2002:a4f:f741:0:0:0:0:0 with HTTP; Fri, 17 Aug 2018 10:59:58 -0700 (PDT) In-Reply-To: <5896D3BB-E621-40E1-AC07-CBA7326886F0@sn3rd.com> References: <5896D3BB-E621-40E1-AC07-CBA7326886F0@sn3rd.com> From: Loganaden Velvindron Date: Fri, 17 Aug 2018 21:59:58 +0400 Message-ID: To: Sean Turner Cc: "tls@ietf.org" Content-Type: multipart/alternative; boundary="000000000000f0dff60573a5532d" Archived-At: Subject: Re: [TLS] WG adoption call: draft-moriarty-tls-oldversions-diediedie X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 Aug 2018 18:00:05 -0000 --000000000000f0dff60573a5532d Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable I support the adoption. On Friday, August 17, 2018, Sean Turner wrote: > At the TLS@IETF102 session, there seemed to be some interest in adopting > draft-moriarty-tls-oldversions-diediedie as a WG item. This email is to > determine whether there is WG consensus to adopt this draft as a WG item. > If you would like for this draft to become a WG document and you are > willing to review it as it moves through the process, then please let the > list know by 2359UTC 20180831. If you are opposed to this being a WG > document, please say so (and say why). > > Note that we will suggest replacing =E2=80=9Cdiediedie" with =E2=80=9Cdep= recate" in the > adopted draft=E2=80=99s name to address the naming comment raised during = the > meeting. > > Thanks, > Chris, Joe and Sean > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > --000000000000f0dff60573a5532d Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable I support the adoption.

On Friday, August 17, 2018, Sean Turner <= sean@sn3rd.com> wrote:
At the TLS@IETF102 session, there seemed to be some = interest in adopting draft-moriarty-tls-oldversions-diediedie as a WG = item. This email is to determine whether there is WG consensus to adopt thi= s draft as a WG item.=C2=A0 If you would like for this draft to become a WG= document and you are willing to review it as it moves through the process,= then please let the list know by 2359UTC 20180831.=C2=A0 If you are oppose= d to this being a WG document, please say so (and say why).

Note that we will suggest replacing =E2=80=9Cdiediedie" with =E2=80=9C= deprecate" in the adopted draft=E2=80=99s name to address the naming c= omment raised during the meeting.

Thanks,
Chris, Joe and Sean
_______________________________________________
TLS mailing list
TLS@ietf.org
htt= ps://www.ietf.org/mailman/listinfo/tls
--000000000000f0dff60573a5532d-- From nobody Fri Aug 17 11:05:21 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1A761130DC7 for ; Fri, 17 Aug 2018 11:05:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.908 X-Spam-Level: X-Spam-Status: No, score=-1.908 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, T_DKIMWL_WL_MED=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XjgSMo95ljQ2 for ; Fri, 17 Aug 2018 11:05:18 -0700 (PDT) Received: from mail-lf1-x12d.google.com (mail-lf1-x12d.google.com [IPv6:2a00:1450:4864:20::12d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0B2821252B7 for ; Fri, 17 Aug 2018 11:05:18 -0700 (PDT) Received: by mail-lf1-x12d.google.com with SMTP id f135-v6so6470369lfg.10 for ; Fri, 17 Aug 2018 11:05:17 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=ZY7AchD3azRzJjMDn3po2yZ3wNfZus1lQLMrzYCIY1o=; b=H49TxvzQ1V5OcgHg6pShlx4vp/3Gq403LHEdqHMzNOATMvh+iyB2uIlpME94d75tKg rG5C/7kOe5mhRbLaYvmVU1W9WfSnbDNOWWv5bEnjZSdzUa+cl9uU1IE3X3xvxr/DbQQv NMx2kpw7kc8dGhGrddO6mvwbCgk4ORRMq1BeMYkkCIuulAxrwPHeCy05r+G3BHwt4Fmg KdI7yHLdhArSgzVRfZnSEIuujkWxODCWwv1K5c3XPjl4XFUXl2d7xIhVTz76A9PwgeYk 3ICdD3x5E2ceIDEzIKtTWl2n/Rhq6GhRpj9KWanAt5NmnGRKdX4vhDkbV406iwlblxbp nxYw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=ZY7AchD3azRzJjMDn3po2yZ3wNfZus1lQLMrzYCIY1o=; b=PB4nExDJlnGr/24tlGBj+mtpoEjsDuyOqwVy0rfd5UTGBZLl2TR3EJgopUsmuYhpSG j9KjVO2KBSqln3Lm2zNRZqh22PRqDzt5YJCSyhu5KZMd5Rn/Nvigici6FmbHKbOSwiap fps7usoy6svQDeS1lV9PCBzI2PX/VkYc7PjI+lsxQJKNRIeGQ+Hpou/H0Yc0kOdHtjvZ S8L+d6BiJRogDhsmECMm7s/15dMPBZ7l4XGQXmJ39SfcAw8ISNO5xk6S0ECNGYTAfC+A huIv2unl/6GCL/PFe4b8LFwxwOHckyjDms/RodlqXQfH2IGRUnCiaimWbJo1StpmnDuF Pl9Q== X-Gm-Message-State: AOUpUlG+gxsMcquahCEd+yLm10oBs5JHPKVepOYK5O0eOfnWNBTLMI9j z6F0yW4ugFJymoa/TtJtMlgJ2uFJ/86aMkk369H/Xg== X-Google-Smtp-Source: AA+uWPwd+hRbpfFZmJsa69jba0J+oCUDGBLKqti1C0Pc/12+klMSYMZ1AHaB7DRc5QJBxf94z3qwqk5zhSUK1TCfBXM= X-Received: by 2002:a19:d095:: with SMTP id h143-v6mr22532371lfg.16.1534529116017; Fri, 17 Aug 2018 11:05:16 -0700 (PDT) MIME-Version: 1.0 Received: by 2002:ab3:4091:0:0:0:0:0 with HTTP; Fri, 17 Aug 2018 11:04:35 -0700 (PDT) In-Reply-To: <5896D3BB-E621-40E1-AC07-CBA7326886F0@sn3rd.com> References: <5896D3BB-E621-40E1-AC07-CBA7326886F0@sn3rd.com> From: Eric Rescorla Date: Fri, 17 Aug 2018 11:04:35 -0700 Message-ID: To: Sean Turner Cc: "" Content-Type: multipart/alternative; boundary="000000000000dbd0be0573a566eb" Archived-At: Subject: Re: [TLS] WG adoption call: draft-moriarty-tls-oldversions-diediedie X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 Aug 2018 18:05:20 -0000 --000000000000dbd0be0573a566eb Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable I support adoption On Fri, Aug 17, 2018 at 10:32 AM, Sean Turner wrote: > At the TLS@IETF102 session, there seemed to be some interest in adopting > draft-moriarty-tls-oldversions-diediedie as a WG item. This email is to > determine whether there is WG consensus to adopt this draft as a WG item. > If you would like for this draft to become a WG document and you are > willing to review it as it moves through the process, then please let the > list know by 2359UTC 20180831. If you are opposed to this being a WG > document, please say so (and say why). > > Note that we will suggest replacing =E2=80=9Cdiediedie" with =E2=80=9Cdep= recate" in the > adopted draft=E2=80=99s name to address the naming comment raised during = the > meeting. > > Thanks, > Chris, Joe and Sean > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > --000000000000dbd0be0573a566eb Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
I support adoption
On Fri, Aug 17, 2018 at 10:32 AM, Sean Turner <= span dir=3D"ltr"><se= an@sn3rd.com> wrote:
At the= TLS@IETF102 session, there seemed to be some interest in adopting draft-mo= riarty-tls-oldversions-diediedie as a WG item. This email is to determ= ine whether there is WG consensus to adopt this draft as a WG item.=C2=A0 I= f you would like for this draft to become a WG document and you are willing= to review it as it moves through the process, then please let the list kno= w by 2359UTC 20180831.=C2=A0 If you are opposed to this being a WG document= , please say so (and say why).

Note that we will suggest replacing =E2=80=9Cdiediedie" with =E2=80=9C= deprecate" in the adopted draft=E2=80=99s name to address the naming c= omment raised during the meeting.

Thanks,
Chris, Joe and Sean
_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls

--000000000000dbd0be0573a566eb-- From nobody Fri Aug 17 11:07:09 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D5546130F66 for ; Fri, 17 Aug 2018 11:07:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.899 X-Spam-Level: X-Spam-Status: No, score=-6.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id h4sT5_90NPZ7 for ; Fri, 17 Aug 2018 11:06:58 -0700 (PDT) Received: from mail3-relais-sop.national.inria.fr (mail3-relais-sop.national.inria.fr [192.134.164.104]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2D05E130FDA for ; Fri, 17 Aug 2018 11:06:57 -0700 (PDT) X-IronPort-AV: E=Sophos;i="5.53,251,1531778400"; d="asc'?scan'208";a="276130122" Received: from corp-nat.fw1.untrust.mtv2.mozilla.net (HELO [10.252.25.87]) ([63.245.221.198]) by mail3-relais-sop.national.inria.fr with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 17 Aug 2018 20:06:54 +0200 From: Benjamin Beurdouche Message-Id: Content-Type: multipart/signed; boundary="Apple-Mail=_1907565A-C1EC-41C4-801F-B4388E5BF819"; protocol="application/pgp-signature"; micalg=pgp-sha512 Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) Date: Fri, 17 Aug 2018 11:06:51 -0700 In-Reply-To: <5896D3BB-E621-40E1-AC07-CBA7326886F0@sn3rd.com> Cc: ML IETF TLS To: Sean Turner References: <5896D3BB-E621-40E1-AC07-CBA7326886F0@sn3rd.com> X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: Re: [TLS] WG adoption call: draft-moriarty-tls-oldversions-diediedie X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 Aug 2018 18:07:05 -0000 --Apple-Mail=_1907565A-C1EC-41C4-801F-B4388E5BF819 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 I support adoption > On Aug 17, 2018, at 10:32 AM, Sean Turner wrote: >=20 > At the TLS@IETF102 session, there seemed to be some interest in = adopting draft-moriarty-tls-oldversions-diediedie as a WG item. This = email is to determine whether there is WG consensus to adopt this draft = as a WG item. If you would like for this draft to become a WG document = and you are willing to review it as it moves through the process, then = please let the list know by 2359UTC 20180831. If you are opposed to = this being a WG document, please say so (and say why). >=20 > Note that we will suggest replacing =E2=80=9Cdiediedie" with = =E2=80=9Cdeprecate" in the adopted draft=E2=80=99s name to address the = naming comment raised during the meeting. >=20 > Thanks, > Chris, Joe and Sean > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls --Apple-Mail=_1907565A-C1EC-41C4-801F-B4388E5BF819 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEuBxqANrVSPVBPOUAfmABPaR1P1QFAlt3DrsACgkQfmABPaR1 P1TulQ//crdjptSZqWsniMAbzQzLJRI0jyJpDIx1QASMqCUy7h/p1IccM6mgQBwh a7DqV3iTuvbAQhhvUVLRiHCSJBwhs7ysq7mcIhjY1G40dWeGFY2c9L9uSez69zR/ Gj5VnLcDwKoq770O9RNcagy1DyvpR5c9YF7e1Ut3qgbrKpet7tEi/fbB+zVlLr+K SSLezoR3hX40SgJwEpuOsMyNYjCRmVfuRCbpCZI8jED3N0d1SryZQrQ0sg0FBM+R nuorwJDIJR4vFZDZMHveUxfqY48124g7Z+scCCHhBQu9gNzPRsU0IQkKue7/ZvTz 96EUoLCnlk5I3thVs1PLCTKhajCvDZa+1c61UkicrWugYXCkvLetU7M39v3OLb8g +sEJAMM73G8GG2VKwtEkDZRkFegqPxp7JpSbMpgBXrjU94ZTbXP2nvmdjhq7QnwY ZkvXgu5Wf+UfMeGYrlfRWXJCGnel05nrfDlPmbjjhq2uSOQ+oUYxg3QkQp8609f6 FX2udlp3TpyyjkTLgqvi1fL/gH3IG/ErUu0fdUOF1W8E+WnUk3y8jieFaPYDPaYY mZP9lE8lRbzo2sX4gChDaAPXsNtuLqYDVzbu90jagfrxAQQmvTEo++2CAo+e2rPr vaKAbND8F1eSieOjqqJAPjWHDPT7Zg5y8Onh5DFsiNysddvrne0= =ZNAK -----END PGP SIGNATURE----- --Apple-Mail=_1907565A-C1EC-41C4-801F-B4388E5BF819-- From nobody Fri Aug 17 11:19:29 2018 Return-Path: X-Original-To: tls@ietf.org Delivered-To: tls@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 192AE130DD4; Fri, 17 Aug 2018 11:19:28 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: tls@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.83.1 Auto-Submitted: auto-generated Precedence: bulk Reply-To: tls@ietf.org Message-ID: <153452996807.17993.9462517497546257447@ietfa.amsl.com> Date: Fri, 17 Aug 2018 11:19:28 -0700 Archived-At: Subject: [TLS] I-D Action: draft-ietf-tls-subcerts-02.txt X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 Aug 2018 18:19:28 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Transport Layer Security WG of the IETF. Title : Delegated Credentials for TLS Authors : Richard Barnes Subodh Iyengar Nick Sullivan Eric Rescorla Filename : draft-ietf-tls-subcerts-02.txt Pages : 12 Date : 2018-08-17 Abstract: The organizational separation between the operator of a TLS server and the certification authority can create limitations. For example, the lifetime of certificates, how they may be used, and the algorithms they support are ultimately determined by the certification authority. This document describes a mechanism by which operators may delegate their own credentials for use in TLS, without breaking compatibility with clients that do not support this specification. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-tls-subcerts/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-tls-subcerts-02 https://datatracker.ietf.org/doc/html/draft-ietf-tls-subcerts-02 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-tls-subcerts-02 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Fri Aug 17 12:02:53 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 58CCD130E6A for ; Fri, 17 Aug 2018 12:02:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.508 X-Spam-Level: X-Spam-Status: No, score=-9.508 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01, URIBL_BLOCKED=0.001, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=chromium.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id t-2loRONhcSo for ; Fri, 17 Aug 2018 12:02:50 -0700 (PDT) Received: from mail-qt0-x229.google.com (mail-qt0-x229.google.com [IPv6:2607:f8b0:400d:c0d::229]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0EE2C130DC3 for ; Fri, 17 Aug 2018 12:02:50 -0700 (PDT) Received: by mail-qt0-x229.google.com with SMTP id d4-v6so9852744qtn.13 for ; Fri, 17 Aug 2018 12:02:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=53rB1TYr+/5mvZzF5wVWLstjk2paunyk4QQu4GNruG4=; b=a/6dPw3LMWeYrNfeD2gYBndE9y5bcRAG8a2q3K96g++CrfRAEXp8dfatjYMPPNCuDy 9l2kcZ60+Uv7xXjSsSS4n7FsKjEDp1IfpMHv1czNqmYsaQxIGxgCH47Vu3p5NhT19CEU c7t9SE9T+e1YtNJKxxaENzKnta1GWZBS2N2kk= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=53rB1TYr+/5mvZzF5wVWLstjk2paunyk4QQu4GNruG4=; b=NwD9mHgvx4FsY1x9kVL13dHZmtP2yZBNNGUrBACs5Q8nmRykFtbKn2I63dDXhtzc2p jf4LuNToUM1mC5MxV5TzR0KlHHjcC8ug3l0kme8rDVCNuTjWUqQqSFyiCuVXarFEwO// ujDKfB+ktIMkp9q78Wni2mDZ3WRy+zBGJ2f8PJtOAKLa1arhcxZkodzV2Byx5pQsE9KB VvMOb7mZrG63XfQptiD6CLcOxzEDsNNAn0LIm6/amPev6ivy0ZK6wftd3Z2zcPZwse0P TiiFa+KI20ACw/TU01FIM37mEGH7KS8yd/zOCTWFA6A847/D6zBqf6zaarlCU5BA8WCV FIXg== X-Gm-Message-State: AOUpUlGTedmOhbfruGh1keXcwDykI6JoE1Aet95viOgnxewXjZy9SD8o mYimao1U1EpZLVJE/RDA+RrShzNgPby5V6aSJ3Dk X-Google-Smtp-Source: AA+uWPzeGZxmZaD3xVFguE0zICl2Kazs13E9GUaV5YEm/T2j/bboZ+l2eY91Nx/n2Kba2Iwxo56IUNXSwXbp1OhBBUU= X-Received: by 2002:ac8:8d3:: with SMTP id y19-v6mr35002967qth.318.1534532569034; Fri, 17 Aug 2018 12:02:49 -0700 (PDT) MIME-Version: 1.0 References: <5896D3BB-E621-40E1-AC07-CBA7326886F0@sn3rd.com> In-Reply-To: From: David Benjamin Date: Fri, 17 Aug 2018 14:02:37 -0500 Message-ID: To: Benjamin Beurdouche Cc: Sean Turner , ML IETF TLS Content-Type: multipart/alternative; boundary="000000000000acfd370573a63499" Archived-At: Subject: Re: [TLS] WG adoption call: draft-moriarty-tls-oldversions-diediedie X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 Aug 2018 19:02:52 -0000 --000000000000acfd370573a63499 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable I support adoption. On Fri, Aug 17, 2018 at 1:07 PM Benjamin Beurdouche < benjamin.beurdouche@inria.fr> wrote: > I support adoption > > > On Aug 17, 2018, at 10:32 AM, Sean Turner wrote: > > > > At the TLS@IETF102 session, there seemed to be some interest in > adopting draft-moriarty-tls-oldversions-diediedie as a WG item. This emai= l > is to determine whether there is WG consensus to adopt this draft as a WG > item. If you would like for this draft to become a WG document and you a= re > willing to review it as it moves through the process, then please let the > list know by 2359UTC 20180831. If you are opposed to this being a WG > document, please say so (and say why). > > > > Note that we will suggest replacing =E2=80=9Cdiediedie" with =E2=80=9Cd= eprecate" in the > adopted draft=E2=80=99s name to address the naming comment raised during = the > meeting. > > > > Thanks, > > Chris, Joe and Sean > > _______________________________________________ > > TLS mailing list > > TLS@ietf.org > > https://www.ietf.org/mailman/listinfo/tls > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > --000000000000acfd370573a63499 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
I support adoption.

On Fri, Aug 17, 2018 at 1:07 PM Benjamin Beurdouche <benjamin.beurdouche@inria.fr&= gt; wrote:
I support adoption

> On Aug 17, 2018, at 10:32 AM, Sean Turner <sean@sn3rd.com> wrote:
>
> At the TLS@IETF102 session, there seemed to be some interest in adopti= ng draft-moriarty-tls-oldversions-diediedie as a WG item. This email is to = determine whether there is WG consensus to adopt this draft as a WG item.= =C2=A0 If you would like for this draft to become a WG document and you are= willing to review it as it moves through the process, then please let the = list know by 2359UTC 20180831.=C2=A0 If you are opposed to this being a WG = document, please say so (and say why).
>
> Note that we will suggest replacing =E2=80=9Cdiediedie" with =E2= =80=9Cdeprecate" in the adopted draft=E2=80=99s name to address the na= ming comment raised during the meeting.
>
> Thanks,
> Chris, Joe and Sean
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls

_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls
--000000000000acfd370573a63499-- From nobody Fri Aug 17 12:03:15 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1FB8313101B for ; Fri, 17 Aug 2018 12:03:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_DKIMWL_WL_MED=-0.01, T_KAM_HTML_FONT_INVALID=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=evequefou.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id glWaftdgO_Pm for ; Fri, 17 Aug 2018 12:03:07 -0700 (PDT) Received: from NAM01-BY2-obe.outbound.protection.outlook.com (mail-by2nam01on0110.outbound.protection.outlook.com [104.47.34.110]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 205EF130FFF for ; Fri, 17 Aug 2018 12:03:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=evequefou.onmicrosoft.com; s=selector1-evequefou-be; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=b38SPggRkVCVaCCzaxjiZVzAodQdt4rsnvTYLDNTTFY=; b=l7jAYWllJcKumJTa5VwmCG8oDD7oAcQszVZO0xVoKOutUj/Bk2LUnONl7Lf0sP0AL2Ga5QU8RkXd761dZH3nje3am0l1oG99ShP7nsW7gMjaleaY50olbyoyxoS8kAU1uNUBu5Gq5LgR+8OgwXV4LMg/W74t7Ma44JUkyd+0pT0= Received: from BYAPR08MB3944.namprd08.prod.outlook.com (52.135.194.30) by BYAPR08MB4664.namprd08.prod.outlook.com (52.135.234.90) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1038.21; Fri, 17 Aug 2018 19:03:05 +0000 Received: from BYAPR08MB3944.namprd08.prod.outlook.com ([fe80::913f:4f09:ae22:b6db]) by BYAPR08MB3944.namprd08.prod.outlook.com ([fe80::913f:4f09:ae22:b6db%6]) with mapi id 15.20.1059.021; Fri, 17 Aug 2018 19:03:05 +0000 From: Mike Bishop To: Sean Turner , "tls@ietf.org" Thread-Topic: [TLS] WG adoption call: draft-moriarty-tls-oldversions-diediedie Thread-Index: AQHUNlBpkMJss1mjoE+NNwsEh3YJjqTETSgw Date: Fri, 17 Aug 2018 19:03:05 +0000 Message-ID: References: <5896D3BB-E621-40E1-AC07-CBA7326886F0@sn3rd.com> In-Reply-To: <5896D3BB-E621-40E1-AC07-CBA7326886F0@sn3rd.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=mbishop@evequefou.be; x-originating-ip: [38.134.241.6] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; BYAPR08MB4664; 6:bMIZmo1ubVolKTdE/XVyY3IuPrMfShQHrX22Z2YGJwyWsxIVezOzKSUpTRlli6ekq3LJKOQgDUU/CUg9lKnoxbkthn2wRfXt8O5NuMLqP1beJBWfWsWbkcB3IcUprXHFhB48GF3S0gavbk0mCMYWX+B5s0eDtTqyfFLB7SWdXtMzt0J9CAr4cLf/Fi/zEJ0AQ4ytXLLmScrdxxUtbOMgRvDmyb7csO1ZSGpqjV0LatQBYrzgCN0/GQ2CytufrFtUu5lz7bo60kuIBe3csyQPIpvl662PYotUNTiZNxUxK813u95arO0KnH1uL1KjVQU5w14c4er8AGq0CXKHXowlSpmxVpQiRa5ynPowDSuY8Oo0XGywxsK0R8sEC1vIoXS2qTtpSzBnC9Ld7g8HIfROAE0zvuvzVpzEOl3knwp45eZDM3BpNzXbg+HowXe5yPCRA/gLjnkbPjw6dE2nYbQhcw==; 5:0nSMRh3BZgcqFrkaYrwl/REU1nNN0aGfkXBDqH+MRF9zYWVy8uIKy6/jeTaBM7u01lQaySl1uLkzUgMihrMd99Z57s06ecj6aSnqzkXo9Q6Lkjtc+b50VzT2l1eyUHxfREjuZhAY7uwcug/x+K0HqPI0kHAhCiJpANLpGjoRXyg=; 7:MlA0DK1EUu76jFxWPTiRe78oID2W2Jyp4fXBW8HyWR+X2qr/1KE5ZAoQKCAzqtDc/OhXGDBIMRAVhsfTeT7ndaRiCW6uIBA2EqtAreQV5jYec9+qKGnIMWDSteyWXmzgFmasmFvFBIgR4lztrpZ5TOAyVhYn/FRPuV4goviO5gmuxYyairD4lH3oGzrJED9uqIoBMpUr1NnqQYUJGbZUaeiMBycmsWjEZ+eRNgeHzOrbafufkV0XOu0PdN0x04qY x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-correlation-id: d1657cb6-ba69-4987-c336-08d60474107f x-microsoft-antispam: BCL:0; PCL:0; RULEID:(7020095)(4652040)(7021125)(8989137)(4534165)(7022125)(4603075)(4627221)(201702281549075)(8990107)(7048125)(7024125)(7027125)(7028125)(7023125)(5600074)(711020)(2017052603328)(7153060)(7193020); SRVR:BYAPR08MB4664; x-ms-traffictypediagnostic: BYAPR08MB4664: x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(28532068793085)(100405760836317)(21748063052155); x-ms-exchange-senderadcheck: 1 x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(6040522)(2401047)(5005006)(8121501046)(3002001)(3231311)(944501410)(52105095)(93006095)(93001095)(10201501046)(149027)(150027)(6041310)(20161123562045)(20161123564045)(20161123560045)(2016111802025)(20161123558120)(6043046)(201708071742011)(7699016); SRVR:BYAPR08MB4664; BCL:0; PCL:0; RULEID:; SRVR:BYAPR08MB4664; x-forefront-prvs: 076777155F x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(396003)(376002)(136003)(366004)(346002)(39830400003)(13464003)(199004)(189003)(6116002)(6506007)(74316002)(8676002)(99286004)(53546011)(316002)(2906002)(2900100001)(33656002)(66066001)(110136005)(2501003)(97736004)(9686003)(55016002)(25786009)(76176011)(7696005)(6246003)(256004)(81156014)(81166006)(5250100002)(476003)(236005)(6306002)(6436002)(26005)(54896002)(229853002)(53936002)(446003)(7736002)(606006)(106356001)(966005)(11346002)(186003)(68736007)(105586002)(8936002)(3846002)(790700001)(486006)(5660300001)(14454004)(74482002)(86362001)(102836004)(478600001); DIR:OUT; SFP:1102; SCL:1; SRVR:BYAPR08MB4664; H:BYAPR08MB3944.namprd08.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:0; MX:1; received-spf: None (protection.outlook.com: evequefou.be does not designate permitted sender hosts) x-microsoft-antispam-message-info: dh8y7MVshkM95/hRyBR8B84c0xaw/fxbG1rifiAsolUeJIjb+FBkQ8o3ItKEm62+WDwGtOctA3NZ48wADR4m3tzUlov/6BFY2CyVTEvwjH24cZRKvp4jGu76NhVi2Sowz0uXkALR4hlMqyhQqOIleGfAkwLQ6BqE7P/gxpZvpj55cozjy5TIkkv51OHHSfEqwocuOdOUITm7p3GSQhorT1jjAkhy1YDxOLlIWAITPBfTm1f7poEUViYhUerEXG4AspgYkJ5YAoHg9Zd7g7+ve+98ZkkNgPqRrWD8ObpujZqa6FDOThFw9rUwm2vOQmHDiCIxv9Dbo2ntLbn2cpEzCvc9FmhJ2E3W5CJWDdfg87Y= spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_BYAPR08MB3944363C21F1ECEF9D8E48A8DA3D0BYAPR08MB3944namp_" MIME-Version: 1.0 X-OriginatorOrg: evequefou.be X-MS-Exchange-CrossTenant-Network-Message-Id: d1657cb6-ba69-4987-c336-08d60474107f X-MS-Exchange-CrossTenant-originalarrivaltime: 17 Aug 2018 19:03:05.7148 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 41eaf50b-882d-47eb-8c4c-0b5b76a9da8f X-MS-Exchange-Transport-CrossTenantHeadersStamped: BYAPR08MB4664 Archived-At: Subject: Re: [TLS] WG adoption call: draft-moriarty-tls-oldversions-diediedie X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 Aug 2018 19:03:14 -0000 --_000_BYAPR08MB3944363C21F1ECEF9D8E48A8DA3D0BYAPR08MB3944namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SSBzdXBwb3J0IGFkb3B0aW9uLCBhbmQgSSdtIGZpbmUgd2l0aCAtZGllZGllZGllLiAg8J+YiQ0K DQoNCg0KLS0tLS1PcmlnaW5hbCBNZXNzYWdlLS0tLS0NCkZyb206IFRMUyA8dGxzLWJvdW5jZXNA aWV0Zi5vcmc+IE9uIEJlaGFsZiBPZiBTZWFuIFR1cm5lcg0KU2VudDogRnJpZGF5LCBBdWd1c3Qg MTcsIDIwMTggMTA6MzMgQU0NClRvOiB0bHNAaWV0Zi5vcmcNClN1YmplY3Q6IFtUTFNdIFdHIGFk b3B0aW9uIGNhbGw6IGRyYWZ0LW1vcmlhcnR5LXRscy1vbGR2ZXJzaW9ucy1kaWVkaWVkaWUNCg0K DQoNCkF0IHRoZSBUTFNASUVURjEwMiBzZXNzaW9uLCB0aGVyZSBzZWVtZWQgdG8gYmUgc29tZSBp bnRlcmVzdCBpbiBhZG9wdGluZyBkcmFmdC1tb3JpYXJ0eS10bHMtb2xkdmVyc2lvbnMtZGllZGll ZGllIGFzIGEgV0cgaXRlbS4gVGhpcyBlbWFpbCBpcyB0byBkZXRlcm1pbmUgd2hldGhlciB0aGVy ZSBpcyBXRyBjb25zZW5zdXMgdG8gYWRvcHQgdGhpcyBkcmFmdCBhcyBhIFdHIGl0ZW0uICBJZiB5 b3Ugd291bGQgbGlrZSBmb3IgdGhpcyBkcmFmdCB0byBiZWNvbWUgYSBXRyBkb2N1bWVudCBhbmQg eW91IGFyZSB3aWxsaW5nIHRvIHJldmlldyBpdCBhcyBpdCBtb3ZlcyB0aHJvdWdoIHRoZSBwcm9j ZXNzLCB0aGVuIHBsZWFzZSBsZXQgdGhlIGxpc3Qga25vdyBieSAyMzU5VVRDIDIwMTgwODMxLiAg SWYgeW91IGFyZSBvcHBvc2VkIHRvIHRoaXMgYmVpbmcgYSBXRyBkb2N1bWVudCwgcGxlYXNlIHNh eSBzbyAoYW5kIHNheSB3aHkpLg0KDQoNCg0KTm90ZSB0aGF0IHdlIHdpbGwgc3VnZ2VzdCByZXBs YWNpbmcg4oCcZGllZGllZGllIiB3aXRoIOKAnGRlcHJlY2F0ZSIgaW4gdGhlIGFkb3B0ZWQgZHJh ZnTigJlzIG5hbWUgdG8gYWRkcmVzcyB0aGUgbmFtaW5nIGNvbW1lbnQgcmFpc2VkIGR1cmluZyB0 aGUgbWVldGluZy4NCg0KDQoNClRoYW5rcywNCg0KQ2hyaXMsIEpvZSBhbmQgU2Vhbg0KDQpfX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KDQpUTFMgbWFpbGlu ZyBsaXN0DQoNClRMU0BpZXRmLm9yZzxtYWlsdG86VExTQGlldGYub3JnPg0KDQpodHRwczovL3d3 dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3Rscw0K --_000_BYAPR08MB3944363C21F1ECEF9D8E48A8DA3D0BYAPR08MB3944namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQph OmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xv cjojMDU2M0MxOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFu Lk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjoj OTU0RjcyOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KcC5Nc29QbGFpblRleHQsIGxp Lk1zb1BsYWluVGV4dCwgZGl2Lk1zb1BsYWluVGV4dA0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7 DQoJbXNvLXN0eWxlLWxpbms6IlBsYWluIFRleHQgQ2hhciI7DQoJbWFyZ2luOjBpbjsNCgltYXJn aW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2Fs aWJyaSIsc2Fucy1zZXJpZjt9DQpzcGFuLlBsYWluVGV4dENoYXINCgl7bXNvLXN0eWxlLW5hbWU6 IlBsYWluIFRleHQgQ2hhciI7DQoJbXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCW1zby1zdHlsZS1s aW5rOiJQbGFpbiBUZXh0IjsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQou TXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LWZhbWls eToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo4LjVp biAxMS4waW47DQoJbWFyZ2luOjEuMGluIDEuMGluIDEuMGluIDEuMGluO30NCmRpdi5Xb3JkU2Vj dGlvbjENCgl7cGFnZTpXb3JkU2VjdGlvbjE7fQ0KLS0+PC9zdHlsZT48IS0tW2lmIGd0ZSBtc28g OV0+PHhtbD4NCjxvOnNoYXBlZGVmYXVsdHMgdjpleHQ9ImVkaXQiIHNwaWRtYXg9IjEwMjYiIC8+ DQo8L3htbD48IVtlbmRpZl0tLT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlbGF5 b3V0IHY6ZXh0PSJlZGl0Ij4NCjxvOmlkbWFwIHY6ZXh0PSJlZGl0IiBkYXRhPSIxIiAvPg0KPC9v OnNoYXBlbGF5b3V0PjwveG1sPjwhW2VuZGlmXS0tPg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0iRU4t VVMiIGxpbms9IiMwNTYzQzEiIHZsaW5rPSIjOTU0RjcyIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0 aW9uMSI+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij5JIHN1cHBvcnQgYWRvcHRpb24sIGFuZCBJ J20gZmluZSB3aXRoIC1kaWVkaWVkaWUuJm5ic3A7IDxzcGFuIHN0eWxlPSJmb250LWZhbWlseTom cXVvdDtTZWdvZSBVSSBFbW9qaSZxdW90OyxzYW5zLXNlcmlmIj4NCiYjMTI4NTIxOzwvc3Bhbj48 bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+LS0tLS1PcmlnaW5hbCBNZXNzYWdlLS0tLS08 YnI+DQpGcm9tOiBUTFMgJmx0O3Rscy1ib3VuY2VzQGlldGYub3JnJmd0OyBPbiBCZWhhbGYgT2Yg U2VhbiBUdXJuZXI8YnI+DQpTZW50OiBGcmlkYXksIEF1Z3VzdCAxNywgMjAxOCAxMDozMyBBTTxi cj4NClRvOiB0bHNAaWV0Zi5vcmc8YnI+DQpTdWJqZWN0OiBbVExTXSBXRyBhZG9wdGlvbiBjYWxs OiBkcmFmdC1tb3JpYXJ0eS10bHMtb2xkdmVyc2lvbnMtZGllZGllZGllPC9wPg0KPHAgY2xhc3M9 Ik1zb1BsYWluVGV4dCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5U ZXh0Ij5BdCB0aGUgVExTQElFVEYxMDIgc2Vzc2lvbiwgdGhlcmUgc2VlbWVkIHRvIGJlIHNvbWUg aW50ZXJlc3QgaW4gYWRvcHRpbmcgZHJhZnQtbW9yaWFydHktdGxzLW9sZHZlcnNpb25zLWRpZWRp ZWRpZSBhcyBhIFdHIGl0ZW0uIFRoaXMgZW1haWwgaXMgdG8gZGV0ZXJtaW5lIHdoZXRoZXIgdGhl cmUgaXMgV0cgY29uc2Vuc3VzIHRvIGFkb3B0IHRoaXMgZHJhZnQgYXMgYSBXRyBpdGVtLiZuYnNw OyBJZiB5b3Ugd291bGQNCiBsaWtlIGZvciB0aGlzIGRyYWZ0IHRvIGJlY29tZSBhIFdHIGRvY3Vt ZW50IGFuZCB5b3UgYXJlIHdpbGxpbmcgdG8gcmV2aWV3IGl0IGFzIGl0IG1vdmVzIHRocm91Z2gg dGhlIHByb2Nlc3MsIHRoZW4gcGxlYXNlIGxldCB0aGUgbGlzdCBrbm93IGJ5IDIzNTlVVEMgMjAx ODA4MzEuJm5ic3A7IElmIHlvdSBhcmUgb3Bwb3NlZCB0byB0aGlzIGJlaW5nIGEgV0cgZG9jdW1l bnQsIHBsZWFzZSBzYXkgc28gKGFuZCBzYXkgd2h5KS48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNz PSJNc29QbGFpblRleHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWlu VGV4dCI+Tm90ZSB0aGF0IHdlIHdpbGwgc3VnZ2VzdCByZXBsYWNpbmcg4oCcZGllZGllZGllJnF1 b3Q7IHdpdGgg4oCcZGVwcmVjYXRlJnF1b3Q7IGluIHRoZSBhZG9wdGVkIGRyYWZ04oCZcyBuYW1l IHRvIGFkZHJlc3MgdGhlIG5hbWluZyBjb21tZW50IHJhaXNlZCBkdXJpbmcgdGhlIG1lZXRpbmcu PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48bzpwPiZuYnNwOzwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPlRoYW5rcyw8bzpwPjwvbzpwPjwvcD4NCjxw IGNsYXNzPSJNc29QbGFpblRleHQiPkNocmlzLCBKb2UgYW5kIFNlYW48bzpwPjwvbzpwPjwvcD4N CjxwIGNsYXNzPSJNc29QbGFpblRleHQiPl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij5U TFMgbWFpbGluZyBsaXN0PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48 YSBocmVmPSJtYWlsdG86VExTQGlldGYub3JnIj48c3BhbiBzdHlsZT0iY29sb3I6d2luZG93dGV4 dDt0ZXh0LWRlY29yYXRpb246bm9uZSI+VExTQGlldGYub3JnPC9zcGFuPjwvYT48bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxhIGhyZWY9Imh0dHBzOi8vd3d3LmlldGYu b3JnL21haWxtYW4vbGlzdGluZm8vdGxzIj48c3BhbiBzdHlsZT0iY29sb3I6d2luZG93dGV4dDt0 ZXh0LWRlY29yYXRpb246bm9uZSI+aHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5m by90bHM8L3NwYW4+PC9hPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+ DQo= --_000_BYAPR08MB3944363C21F1ECEF9D8E48A8DA3D0BYAPR08MB3944namp_-- From nobody Fri Aug 17 12:49:41 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B73A9130E6A for ; Fri, 17 Aug 2018 12:49:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pA1-8Wj-xorE for ; Fri, 17 Aug 2018 12:49:37 -0700 (PDT) Received: from welho-filter3.welho.com (welho-filter3.welho.com [83.102.41.25]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7672A130E06 for ; Fri, 17 Aug 2018 12:49:36 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by welho-filter3.welho.com (Postfix) with ESMTP id 091C5850A for ; Fri, 17 Aug 2018 22:49:34 +0300 (EEST) X-Virus-Scanned: Debian amavisd-new at pp.htv.fi Received: from welho-smtp3.welho.com ([IPv6:::ffff:83.102.41.86]) by localhost (welho-filter3.welho.com [::ffff:83.102.41.25]) (amavisd-new, port 10024) with ESMTP id a8EbDyjTmjWs for ; Fri, 17 Aug 2018 22:49:33 +0300 (EEST) Received: from LK-Perkele-VII (87-92-19-27.bb.dnainternet.fi [87.92.19.27]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by welho-smtp3.welho.com (Postfix) with ESMTPSA id 9EDC72308 for ; Fri, 17 Aug 2018 22:49:32 +0300 (EEST) Date: Fri, 17 Aug 2018 22:49:32 +0300 From: Ilari Liusvaara To: tls@ietf.org Message-ID: <20180817194932.GA6441@LK-Perkele-VII> References: <5896D3BB-E621-40E1-AC07-CBA7326886F0@sn3rd.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <5896D3BB-E621-40E1-AC07-CBA7326886F0@sn3rd.com> User-Agent: Mutt/1.10.1 (2018-07-13) Sender: ilariliusvaara@welho.com Archived-At: Subject: Re: [TLS] WG adoption call: draft-moriarty-tls-oldversions-diediedie X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 Aug 2018 19:49:40 -0000 On Fri, Aug 17, 2018 at 01:32:47PM -0400, Sean Turner wrote: > At the TLS@IETF102 session, there seemed to be some interest in > adopting draft-moriarty-tls-oldversions-diediedie as a WG item. > This email is to determine whether there is WG consensus to adopt > this draft as a WG item. If you would like for this draft to > become a WG document and you are willing to review it as it moves > through the process, then please let the list know by 2359UTC 20180831. > If you are opposed to this being a WG document, please say so (and > say why). Support adoption. -Ilari From nobody Fri Aug 17 15:33:05 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3D5C7130FDC; Fri, 17 Aug 2018 15:33:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 86f4hnTeCx9q; Fri, 17 Aug 2018 15:33:01 -0700 (PDT) Received: from rfc-editor.org (rfc-editor.org [4.31.198.49]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B3C22130E31; Fri, 17 Aug 2018 15:33:01 -0700 (PDT) Received: by rfc-editor.org (Postfix, from userid 30) id 167A5B80C93; Fri, 17 Aug 2018 15:32:51 -0700 (PDT) To: mgosui@yahoo-corp.jp, ynir.ietf@gmail.com, simon@josefsson.org, mpg@elzevir.fr X-PHP-Originating-Script: 30:errata_mail_lib.php From: RFC Errata System Cc: kaduk@mit.edu, iesg@ietf.org, tls@ietf.org, rfc-editor@rfc-editor.org Content-Type: text/plain; charset=UTF-8 Message-Id: <20180817223251.167A5B80C93@rfc-editor.org> Date: Fri, 17 Aug 2018 15:32:51 -0700 (PDT) Archived-At: Subject: [TLS] [Errata Held for Document Update] RFC8422 (5466) X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 Aug 2018 22:33:03 -0000 The following errata report has been held for document update for RFC8422, "Elliptic Curve Cryptography (ECC) Cipher Suites for Transport Layer Security (TLS) Versions 1.2 and Earlier". -------------------------------------- You may review the report below and at: http://www.rfc-editor.org/errata/eid5466 -------------------------------------- Status: Held for Document Update Type: Editorial Reported by: Masato Gosui Date Reported: 2018-08-17 Held by: Benjamin Kaduk (IESG) Section: 5.3 Original Text ------------- Actions of the sender: The server constructs an appropriate certificate chain and conveys it to the client in the Certificate message. If the client has used a Supported Elliptic Curves Extension, the public key in the server's certificate MUST respect the client's choice of elliptic curves. A server that cannot satisfy this requirement MUST NOT choose an ECC cipher suite in its ServerHello message.) Corrected Text -------------- Actions of the sender: The server constructs an appropriate certificate chain and conveys it to the client in the Certificate message. If the client has used a Supported Elliptic Curves Extension, the public key in the server's certificate MUST respect the client's choice of elliptic curves. A server that cannot satisfy this requirement MUST NOT choose an ECC cipher suite in its ServerHello message. Notes ----- This removes the spurious closing parenthesis of the last sentence of the "Actions of the sender" paragraph. -------------------------------------- RFC8422 (draft-ietf-tls-rfc4492bis-17) -------------------------------------- Title : Elliptic Curve Cryptography (ECC) Cipher Suites for Transport Layer Security (TLS) Versions 1.2 and Earlier Publication Date : August 2018 Author(s) : Y. Nir, S. Josefsson, M. Pegourie-Gonnard Category : PROPOSED STANDARD Source : Transport Layer Security Area : Security Stream : IETF Verifying Party : IESG From nobody Fri Aug 17 15:33:47 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 137D313106A for ; Fri, 17 Aug 2018 15:33:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rC2GczMmu1Pe for ; Fri, 17 Aug 2018 15:33:38 -0700 (PDT) Received: from dmz-mailsec-scanner-8.mit.edu (dmz-mailsec-scanner-8.mit.edu [18.7.68.37]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6E9DD131041 for ; Fri, 17 Aug 2018 15:33:38 -0700 (PDT) X-AuditID: 12074425-e1fff700000056dc-9a-5b774d3f0dcd Received: from mailhub-auth-3.mit.edu ( [18.9.21.43]) (using TLS with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by dmz-mailsec-scanner-8.mit.edu (Symantec Messaging Gateway) with SMTP id 4E.D6.22236.04D477B5; Fri, 17 Aug 2018 18:33:36 -0400 (EDT) Received: from outgoing.mit.edu (OUTGOING-AUTH-1.MIT.EDU [18.9.28.11]) by mailhub-auth-3.mit.edu (8.13.8/8.9.2) with ESMTP id w7HMXXZE019659; Fri, 17 Aug 2018 18:33:34 -0400 Received: from kduck.kaduk.org (24-107-191-124.dhcp.stls.mo.charter.com [24.107.191.124]) (authenticated bits=56) (User authenticated as kaduk@ATHENA.MIT.EDU) by outgoing.mit.edu (8.13.8/8.12.4) with ESMTP id w7HMXRr5010319 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT); Fri, 17 Aug 2018 18:33:30 -0400 Date: Fri, 17 Aug 2018 17:33:28 -0500 From: Benjamin Kaduk To: Sean Turner Cc: Martin Thomson , Yoav Nir , mpg@elzevir.fr, Eric Rescorla , Chris Wood , Joe Salowey , tls@ietf.org, Simon Josefsson Message-ID: <20180817223327.GV40887@kduck.kaduk.org> References: <20180817020730.B5DF1B80117@rfc-editor.org> <1534487378.28819.2.camel@josefsson.org> <738D5D21-5E34-4BA2-9C8D-C418D2D1F73D@sn3rd.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <738D5D21-5E34-4BA2-9C8D-C418D2D1F73D@sn3rd.com> User-Agent: Mutt/1.9.1 (2017-09-22) X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFtrBKsWRmVeSWpSXmKPExsUixCmqrevgWx5t8HOPrsX079fYLFa8Psdu sW3TfnaLa2f+MVp8f5FscWVVI7PFvS2X2C0+ne9itFh67AOTA6fHvc03mD12zrrL7rFkyU8m j5lnLrJ7TH7cxuxxfNcGdo+DBxkD2KO4bFJSczLLUov07RK4Mm6t+c1esIOx4uC1PUwNjH2M XYycHBICJhLzP3xm62Lk4hASWMwkMWPrVUYIZyOjxNG5d5ggnKtMEg9bLgE5HBwsAqoSv/44 g3SzCahINHRfZgaxRQQUJJqOPmAFqWcWmMsk8eTBOzaQhLCArcScLc0sIDYv0LrXh3cxQwy9 wyjxaOEnNoiEoMTJmU/AipgFtCRu/HsJtoxZQFpi+T8OkDAn0JxdUxawgtiiAsoSe/sOsU9g FJiFpHsWku5ZCN0LGJlXMcqm5Fbp5iZm5hSnJusWJyfm5aUW6Vro5WaW6KWmlG5iBEUHu4vq DsY5f70OMQpwMCrx8L5QK48WYk0sK67MPcQoycGkJMrb6QEU4kvKT6nMSCzOiC8qzUktPsQo wcGsJMIbubwsWog3JbGyKrUoHyYlzcGiJM57vyY8WkggPbEkNTs1tSC1CCYrw8GhJMH72hto qGBRanpqRVpmTglCmomDE2Q4D9DwryA1vMUFibnFmekQ+VOMxhzfrnVNYub4837qJGYhlrz8 vFQpcd40kFIBkNKM0jy4aaAEJ5G9v+YVozjQc8K8Rj5AVTzA5Ag37xXQKiagVdMESkFWlSQi pKQaGDsUf72OuhUtl7BOXP75l9QnWfvuqx/+Vzyr4M2sT2+jtBaJa1SFvvHS0I6J/dWioL56 bdXkD+csDY4ZHvR/Ida2W2Rtq8qp3scvH6RsC29awzJdzi2iou/J0Rid7i+PL4Q01TZe7Hxx b0P42s33zq4Ms+V9+PioFOPFXSejRG4yzxDPV9q4REeJpTgj0VCLuag4EQCEvDWRSwMAAA== Archived-At: Subject: Re: [TLS] [Editorial Errata Reported] RFC8422 (5466) X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 Aug 2018 22:33:46 -0000 On Fri, Aug 17, 2018 at 12:21:49PM -0400, Sean Turner wrote: > I think we can safely mark this one HFDU (Hold For Document Update). Indeed, and done. Thanks everybody! -Ben From nobody Fri Aug 17 15:37:48 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3666F130FE9 for ; Fri, 17 Aug 2018 15:37:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id khD4dn0einHB for ; Fri, 17 Aug 2018 15:37:45 -0700 (PDT) Received: from dmz-mailsec-scanner-2.mit.edu (dmz-mailsec-scanner-2.mit.edu [18.9.25.13]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 653BC130FDE for ; Fri, 17 Aug 2018 15:37:45 -0700 (PDT) X-AuditID: 1209190d-005ff700000010eb-00-5b774e372c43 Received: from mailhub-auth-1.mit.edu ( [18.9.21.35]) (using TLS with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by dmz-mailsec-scanner-2.mit.edu (Symantec Messaging Gateway) with SMTP id 19.97.04331.83E477B5; Fri, 17 Aug 2018 18:37:44 -0400 (EDT) Received: from outgoing.mit.edu (OUTGOING-AUTH-1.MIT.EDU [18.9.28.11]) by mailhub-auth-1.mit.edu (8.13.8/8.9.2) with ESMTP id w7HMbfgD016817; Fri, 17 Aug 2018 18:37:42 -0400 Received: from kduck.kaduk.org (24-107-191-124.dhcp.stls.mo.charter.com [24.107.191.124]) (authenticated bits=56) (User authenticated as kaduk@ATHENA.MIT.EDU) by outgoing.mit.edu (8.13.8/8.12.4) with ESMTP id w7HMbZQV011374 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT); Fri, 17 Aug 2018 18:37:38 -0400 Date: Fri, 17 Aug 2018 17:37:35 -0500 From: Benjamin Kaduk To: Simon Josefsson Cc: RFC Errata System , ynir.ietf@gmail.com, mpg@elzevir.fr, ekr@rtfm.com, christopherwood07@gmail.com, joe@salowey.net, sean+ietf@sn3rd.com, mgosui@yahoo-corp.jp, tls@ietf.org Message-ID: <20180817223735.GW40887@kduck.kaduk.org> References: <20180817022137.6C114B80A77@rfc-editor.org> <1937603C-BD24-48A0-8555-B4D8D7BE6D37@josefsson.org> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <1937603C-BD24-48A0-8555-B4D8D7BE6D37@josefsson.org> User-Agent: Mutt/1.9.1 (2017-09-22) X-Brightmail-Tracker: H4sIAAAAAAAAA02Se0gUURTGuTP7mF0du24u3rSQ1nIxWrUIHMwk/5uiRIgQM8jJndzF3XGb WZ9JbEZGW5olJa4ZioaSpJaZ2QNTIsu0x5omkgpW4gMqytikRZtRUv875/u+8ztc7iFwzZA8 iDBzdpbnGItOoZZpVNpQA5WQkxLlaQqgyj1DCqph9o2SenCvU0n9bC8FlGcqjSrs/K2g3C2N GDV23y3qb52AuvXiB7ZXTY+1DuN0h2tUSdfVzWN0Rd97Je0oeiGnyz4X4XTPoxYl3dUF6EvD Xnmi6og61shazNksHxmXqjbdaC/FbA6YW1nYhztAta8TqAgEd6HZKo/cCdSEBtZiqM3Vjy83 dwFqqH0MlptBDD37+kvhBAQhg1vRhCtImlbALchxcQCX5AAYjqrOm6Q4DicB8hS9BlJmPYxG vRNzMilDitted/KSrIEcevfxj1yqSeiPXlV8kUk1DvXIe9O9hMRhMKpfIJblEHS2rRKXahWM Rz3VV5ZGtTAUPS3pVpYCf9cakmsNybVKcq0hVQPZbbDJaM03WBmzRWDTDEIaw3Esb9gZYTXb I1hj1j2w9GUbyIdgYXR/N4AE0PmSU2E5KRo5ky3kWbvBBgLTackLtCj5Hc805pkYwXSMz7Kw QjdABK4LIJPrs1M0pJHJy2f5zP9WMCHTBZJjBUkpGpjO2NkMlrWx/H93I0HoEJl0UIT682w6 m3vCbLGv2hihkuC+IlwvZUjBxlgFc/qy3wsMhPf7tau4RsZlcmxQIDlxQAxBKWTK4lY40jmi jM6CGRAoPms9mSqhfMVjXSHNiEswccl1mCUtsTOrVpAD2E761Cwenriz+8OhJ8lFR9kYb2N0 ZPawvacFlY34DIzUTDYVnGZU5XrHSNm3xd7AYK6tpDn8z83TIc098Qn0la2xYR39UTHC82Kt vnR6fHSz6pR7/Pfc5bjWOj+7bc+ZT9r5l3/XEfuCB4urEvk5JmaxsaKmZvt0fFJ/fHvYuVc6 mWBidmzDeYH5B+tRQCJpAwAA Archived-At: Subject: Re: [TLS] [Editorial Errata Reported] RFC8422 (5468) X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 Aug 2018 22:37:47 -0000 On Fri, Aug 17, 2018 at 10:25:47AM +0200, Simon Josefsson wrote: > I think “namedCurve†is better, it matches ASN.1 usage. So you want me to change the PDU to be "namedCurve" instead? -Ben > /Simon > > > 17 aug. 2018 kl. 04:21 skrev RFC Errata System : > > > > The following errata report has been submitted for RFC8422, > > "Elliptic Curve Cryptography (ECC) Cipher Suites for Transport Layer Security (TLS) Versions 1.2 and Earlier". > > > > -------------------------------------- > > You may review the report below and at: > > http://www.rfc-editor.org/errata/eid5468 > > > > -------------------------------------- > > Type: Editorial > > Reported by: Masato Gosui > > > > Section: 5.4 > > > > Original Text > > ------------- > > namedCurve: Specifies a recommended set of elliptic curve domain > > > > Corrected Text > > -------------- > > namedcurve: Specifies a recommended set of elliptic curve domain > > > > Notes > > ----- > > This fixes mismatched names of the variable "namedcurve" in the "Structure of this message" paragraph. > > > > Instructions: > > ------------- > > This erratum is currently posted as "Reported". If necessary, please > > use "Reply All" to discuss whether it should be verified or > > rejected. When a decision is reached, the verifying party > > can log in to change the status and edit the report, if necessary. > > > > -------------------------------------- > > RFC8422 (draft-ietf-tls-rfc4492bis-17) > > -------------------------------------- > > Title : Elliptic Curve Cryptography (ECC) Cipher Suites for Transport Layer Security (TLS) Versions 1.2 and Earlier > > Publication Date : August 2018 > > Author(s) : Y. Nir, S. Josefsson, M. Pegourie-Gonnard > > Category : PROPOSED STANDARD > > Source : Transport Layer Security > > Area : Security > > Stream : IETF > > Verifying Party : IESG > From nobody Sat Aug 18 04:53:55 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8B0E0130DCE for ; Sat, 18 Aug 2018 04:53:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6VvS6wwPeDB8 for ; Sat, 18 Aug 2018 04:53:52 -0700 (PDT) Received: from mail-yb0-x22d.google.com (mail-yb0-x22d.google.com [IPv6:2607:f8b0:4002:c09::22d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7106B120049 for ; Sat, 18 Aug 2018 04:53:52 -0700 (PDT) Received: by mail-yb0-x22d.google.com with SMTP id d34-v6so2951003yba.3 for ; Sat, 18 Aug 2018 04:53:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=lAlq8gCOYHp0DMKvrw3OIGjcextitKJ22svVfEh5fWc=; b=RQXy1CMfYhfz3vSD+XoqolzBJelVDBqMeLNwTnclwAw327Vlme6QKWRjE1As5VnoZb eXGH2hHXgpIwgAOW8NXct8xVT02Uedo/QkXOtDGQFj5vzgUJDEgIR8ZCVYAJiAIXfDKc kQWe1uEbAXUx0U7pBeUUwY/yt9T310sWNUvebdBDIM+i+NAZy24DH3zLWRlWfw2iWc4n uBKdYu1TeWavWAMtpJclW3CTPHs0fVbk7XuFHpqn1obWlzG0nwJJXUm7Es8+/H9rCig3 6+3wXDJSRhtLM/n+mBz4IoGIJY1bivJF8qLtdXHucXIKuXrsMrvfue6Wj5iRv7nctn5c WqsQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=lAlq8gCOYHp0DMKvrw3OIGjcextitKJ22svVfEh5fWc=; b=A5t957PxVDLTDbqR7S8IjsRzWdH7lp8L+z5d0wWeAtZ1HJI1g7cCR4SidfnMkK2PCZ qySCXOl7qmW+8LtriULTQDcAqolHELxH+WRUo4i8xmKWJWQZhfjDE04AA/Cyhw4VlHTl DpvGoSQw8VOvFuR2RU6gOh9CqraRO0wC2AEj9X1T1JIgtaGKDg4oZOiH9DH/maBxuYZI jBy84zNOCYLr0cweikeQ8vKBY2VHHj7lpsybl7vL07knH7iCgkIPUI9v76/aUIYjYhhv +FmE923JUezf/CoNw8X9WsLy7FVEZ13CXbfV8v+XP/VItEKyvnL8NbNREmAyJVbEMOGx lh5Q== X-Gm-Message-State: AOUpUlEgMwCSwtDJM9eEhmtfl5lAlQytGqhOLqcXba3JA9PowQ2ksRm6 pr9dCJvGOCZsnRLht0U4OlsTuI6Qg3Hi8W7UWO4= X-Google-Smtp-Source: AA+uWPzAENc3dDN1aODhpgmTDtX4dsuTiqgguObnUYd6rMiHF5RNFwppsWwbIruAHFv/YHoRFstT34uym/gcXUmiqeY= X-Received: by 2002:a25:a302:: with SMTP id d2-v6mr22178862ybi.193.1534593230760; Sat, 18 Aug 2018 04:53:50 -0700 (PDT) MIME-Version: 1.0 Received: by 2002:a25:8b85:0:0:0:0:0 with HTTP; Sat, 18 Aug 2018 04:53:30 -0700 (PDT) In-Reply-To: <5896D3BB-E621-40E1-AC07-CBA7326886F0@sn3rd.com> References: <5896D3BB-E621-40E1-AC07-CBA7326886F0@sn3rd.com> From: Ira McDonald Date: Sat, 18 Aug 2018 07:53:30 -0400 Message-ID: To: Sean Turner , Ira McDonald Cc: "TLS@ietf.org (tls@ietf.org)" Content-Type: multipart/alternative; boundary="00000000000064ee4b0573b454b4" Archived-At: Subject: Re: [TLS] WG adoption call: draft-moriarty-tls-oldversions-diediedie X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 18 Aug 2018 11:53:55 -0000 --00000000000064ee4b0573b454b4 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable I support adoption. - Ira On Fri, Aug 17, 2018 at 1:32 PM, Sean Turner wrote: > At the TLS@IETF102 session, there seemed to be some interest in adopting > draft-moriarty-tls-oldversions-diediedie as a WG item. This email is to > determine whether there is WG consensus to adopt this draft as a WG item. > If you would like for this draft to become a WG document and you are > willing to review it as it moves through the process, then please let the > list know by 2359UTC 20180831. If you are opposed to this being a WG > document, please say so (and say why). > > Note that we will suggest replacing =E2=80=9Cdiediedie" with =E2=80=9Cdep= recate" in the > adopted draft=E2=80=99s name to address the naming comment raised during = the > meeting. > > Thanks, > Chris, Joe and Sean > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > --00000000000064ee4b0573b454b4 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
I support adoption.

- Ira


On Fri, Aug 17, 2018 at 1:32 PM, Sean Turner= <= sean@sn3rd.com> wrote:
At t= he TLS@IETF102 session, there seemed to be some interest in adopting draft-= moriarty-tls-oldversions-diediedie as a WG item. This email is to dete= rmine whether there is WG consensus to adopt this draft as a WG item.=C2=A0= If you would like for this draft to become a WG document and you are willi= ng to review it as it moves through the process, then please let the list k= now by 2359UTC 20180831.=C2=A0 If you are opposed to this being a WG docume= nt, please say so (and say why).

Note that we will suggest replacing =E2=80=9Cdiediedie" with =E2=80=9C= deprecate" in the adopted draft=E2=80=99s name to address the naming c= omment raised during the meeting.

Thanks,
Chris, Joe and Sean
_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls

--00000000000064ee4b0573b454b4-- From nobody Sat Aug 18 11:01:59 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3AABF130EA7 for ; Sat, 18 Aug 2018 11:01:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, FREEMAIL_FORGED_FROMDOMAIN=0.001, FREEMAIL_FROM=0.001, HEADER_FROM_DIFFERENT_DOMAINS=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Bzghxmic55-3 for ; Sat, 18 Aug 2018 11:01:55 -0700 (PDT) Received: from mail-lj1-x236.google.com (mail-lj1-x236.google.com [IPv6:2a00:1450:4864:20::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 918EF130EC4 for ; Sat, 18 Aug 2018 11:01:54 -0700 (PDT) Received: by mail-lj1-x236.google.com with SMTP id y17-v6so8696977ljy.8 for ; Sat, 18 Aug 2018 11:01:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:sender:in-reply-to:references:from:date:message-id :subject:to:cc; bh=B+CYdwNy0IqulMe4AalmYBIXvAnY64nhvolh5OkP2cE=; b=VSvg1yS1ZZmFGKxy86m2jPv69JDa3bLKNIg3ELNSQ3aUUIkR3zIh9vZJUwV2114pVb bodB5iAv6JklmQipRUanBmFRfOtKxKVLvX1TkvHZRSMnW3sJL7k2luL4jFztEqogCI2T NgH5mOXzGWt1c7mqHL98XYcgLd3nTtXU1jZuJT1Sw4XWvmpskODWkiGIMsE74STc57HC rK8JUtUThOIdo65xxeqOfcVc9YVZWKNGTSZmsO2XOK/gisb5hZ+Q5yshdDwUYxor8bxZ rs6Kdb+j5YbGSF0bmHGzLHAh5m3m/ddgNYKdp3fxUhQZdovPJZliGgL78HR/MwQKCWjb OBAA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:sender:in-reply-to:references:from :date:message-id:subject:to:cc; bh=B+CYdwNy0IqulMe4AalmYBIXvAnY64nhvolh5OkP2cE=; b=Rlwomt2XyMxUcpjLKo1zeFugQCWbPum8AjmLWCPt93+VUMcUkoarRAea8M2HUxapEl hquGNIdRJq8XBaCokf+l4viyGu+7lEHhxcYh+SIthR6bE65PtqMDVF2Q21Djp0c7s43b sO0ubyAV1FsDYju8yVWJFJYpQsEhIVCzqlX3Blere/TXGUrPCgklMXYhwWbhnxSMcemY 5yMuhwNU1GSlzLvMdBv68yNjEG3+IFwOLiSy3RMDy5xHcYbbCg28MVVPsyKUQPk9H4+l 6ovl6dk7h6Vhlg3NZpk+uE2+1D8T6dUR952GLARq9bdN89qsnIVBBouWcJj8yKm7tT94 GWYA== X-Gm-Message-State: AOUpUlHFMp6hCG0iRYJ+FKBGXn//DADBzNuL7LbXgsPDWrvgZTc+3U7Y YddKFdVP2GgzlZJphbDdECeBq9D4G4yLPjSS7Uo= X-Google-Smtp-Source: AA+uWPyZ+v2x1SZYFlwoQZlrn1mnrTYsOfmrlrjwPrZ7Qu3otNOSB0GPPHRigQXZEpVaAkXh4HxV4EFQFalYTdq730M= X-Received: by 2002:a2e:5d1c:: with SMTP id r28-v6mr26656318ljb.89.1534615312914; Sat, 18 Aug 2018 11:01:52 -0700 (PDT) MIME-Version: 1.0 Sender: mglt.ietf@gmail.com Received: by 2002:a2e:912:0:0:0:0:0 with HTTP; Sat, 18 Aug 2018 11:01:52 -0700 (PDT) In-Reply-To: References: <5896D3BB-E621-40E1-AC07-CBA7326886F0@sn3rd.com> From: Daniel Migault Date: Sat, 18 Aug 2018 14:01:52 -0400 X-Google-Sender-Auth: fLxUmPkv9_-HtixaQTlBc5Y_OR4 Message-ID: To: Ira McDonald Cc: Sean Turner , "TLS@ietf.org (tls@ietf.org)" Content-Type: multipart/alternative; boundary="00000000000097dcdd0573b97823" Archived-At: Subject: Re: [TLS] WG adoption call: draft-moriarty-tls-oldversions-diediedie X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 18 Aug 2018 18:01:57 -0000 --00000000000097dcdd0573b97823 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable I support the adoption. Yours, Daniel On Sat, Aug 18, 2018 at 7:53 AM, Ira McDonald wrote: > I support adoption. > > - Ira > > > On Fri, Aug 17, 2018 at 1:32 PM, Sean Turner wrote: > >> At the TLS@IETF102 session, there seemed to be some interest in adopting >> draft-moriarty-tls-oldversions-diediedie as a WG item. This email is to >> determine whether there is WG consensus to adopt this draft as a WG item= . >> If you would like for this draft to become a WG document and you are >> willing to review it as it moves through the process, then please let th= e >> list know by 2359UTC 20180831. If you are opposed to this being a WG >> document, please say so (and say why). >> >> Note that we will suggest replacing =E2=80=9Cdiediedie" with =E2=80=9Cde= precate" in the >> adopted draft=E2=80=99s name to address the naming comment raised during= the >> meeting. >> >> Thanks, >> Chris, Joe and Sean >> _______________________________________________ >> TLS mailing list >> TLS@ietf.org >> https://www.ietf.org/mailman/listinfo/tls >> > > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > > --00000000000097dcdd0573b97823 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
I support the adoption.
Yours,
Daniel

On Sat, Aug 18, 2018 at 7:53 AM, Ira McDonald <blueroof= music@gmail.com> wrote:
I support adoption.

- Ira


On Fri, Aug 17, 2018 at 1:32 PM, Sean Turner= <= sean@sn3rd.com> wrote:
At t= he TLS@IETF102 session, there seemed to be some interest in adopting draft-= moriarty-tls-oldversions-diediedie as a WG item. This email is to dete= rmine whether there is WG consensus to adopt this draft as a WG item.=C2=A0= If you would like for this draft to become a WG document and you are willi= ng to review it as it moves through the process, then please let the list k= now by 2359UTC 20180831.=C2=A0 If you are opposed to this being a WG docume= nt, please say so (and say why).

Note that we will suggest replacing =E2=80=9Cdiediedie" with =E2=80=9C= deprecate" in the adopted draft=E2=80=99s name to address the naming c= omment raised during the meeting.

Thanks,
Chris, Joe and Sean
_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls


_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls


--00000000000097dcdd0573b97823-- From nobody Sat Aug 18 16:41:14 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9DF6A12785F for ; Sat, 18 Aug 2018 16:41:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4SiTdsd7lxD8 for ; Sat, 18 Aug 2018 16:41:10 -0700 (PDT) Received: from mail-yw1-xc2a.google.com (mail-yw1-xc2a.google.com [IPv6:2607:f8b0:4864:20::c2a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 98500130F0F for ; Sat, 18 Aug 2018 16:41:10 -0700 (PDT) Received: by mail-yw1-xc2a.google.com with SMTP id z143-v6so5680931ywa.7 for ; Sat, 18 Aug 2018 16:41:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc:content-transfer-encoding; bh=TTOdoySrmPylZaAWxJEykTLAnqKlxlwPNmxqcaROiXU=; b=hmoNMwsQz3SkeRIi55kPE/WC+/79NVG3DwrSuablnbjZNbcYSLFlv3sXoI1X4zhttk xDyiaVkcDBBtNhccWKrXopEgPvxZnLmF5OifbEKczndR5zhbD7+ZtKZRly3kcAvxqC14 GFEfkqk+Vt7kAD6cSYdaGs+OIahHCG9yc20YsuYL0osVWl8w+pd5A5e0YlC5TAvtNXn7 1Y2FI157EAVW5aJtITL+mULjhwa79VP051jfg6T/O0sPLv1D5zUreZlNNKgRxZtQpkOO xFZ9J3rvsFP0grY0JA/k8jgsenMb7YXZEl69vNUINvVZUVUYrLSOu9bxaEt5OSSBs8vg HErA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc:content-transfer-encoding; bh=TTOdoySrmPylZaAWxJEykTLAnqKlxlwPNmxqcaROiXU=; b=kHv7T0C+V/D95U5ZxGhuD3HY60c+CuuHMyRiwsRegMgziK8op4ToVJxESIEGCwYTBN SjrddI0yixytbXc3xl/+xJvKmGyA4Ml64JS2WWAonkUWaGG2ZpjtkarrIF9ZlzS+2kZA yObeu4yDvL/yWGdxCj1YDhThBqA3+7fo1/DcoEgEsErt3PhUs07XeDJM3wJjG/a6D1kQ QGXZBgdbxsmltxjBE9DZAdj5TYoMMuBlPhr8VePvac/vd/Sl0xdltf3zeCgpbojrMSbK Zvs3YWoZBBvH4rxjfRn9/2XhJZ/Tqnr//WjmqM2xmuYuCbhIUi8dJz8tuSykxidK5kHf 4avg== X-Gm-Message-State: AOUpUlF49poFRhY+YuTrDuegnlbaeCeCkOj8QV67Ei3rRaptmvkE3Q0Z C3490Zze7DP3iF3KVEYagGhPBes/lx38xbj1ym2dOg== X-Google-Smtp-Source: AA+uWPxMh9CKGW5ojfqHReYAtHAsCEoV20OQhjC8vuGMqNBUg1JQdH5cNHTqVVaGZUvSGboASB0L+9UXLRysiutmOX4= X-Received: by 2002:a81:a6d2:: with SMTP id d201-v6mr21527695ywh.323.1534635669584; Sat, 18 Aug 2018 16:41:09 -0700 (PDT) MIME-Version: 1.0 References: <5896D3BB-E621-40E1-AC07-CBA7326886F0@sn3rd.com> In-Reply-To: <5896D3BB-E621-40E1-AC07-CBA7326886F0@sn3rd.com> From: Artyom Gavrichenkov Date: Sun, 19 Aug 2018 02:40:58 +0300 Message-ID: To: Sean Turner Cc: "" Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Archived-At: Subject: Re: [TLS] WG adoption call: draft-moriarty-tls-oldversions-diediedie X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 18 Aug 2018 23:41:13 -0000 I support the adoption. | Artyom Gavrichenkov | gpg: 2deb 97b1 0a3c 151d b67f 1ee5 00e7 94bc 4d08 9191 | mailto: ximaera@gmail.com | fb: ximaera | telegram: xima_era | skype: xima_era | tel. no: +7 916 515 49 58 On Fri, Aug 17, 2018 at 8:33 PM Sean Turner wrote: > > At the TLS@IETF102 session, there seemed to be some interest in adopting = draft-moriarty-tls-oldversions-diediedie as a WG item. This email is to det= ermine whether there is WG consensus to adopt this draft as a WG item. If = you would like for this draft to become a WG document and you are willing t= o review it as it moves through the process, then please let the list know = by 2359UTC 20180831. If you are opposed to this being a WG document, pleas= e say so (and say why). > > Note that we will suggest replacing =E2=80=9Cdiediedie" with =E2=80=9Cdep= recate" in the adopted draft=E2=80=99s name to address the naming comment r= aised during the meeting. > > Thanks, > Chris, Joe and Sean > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls From nobody Sat Aug 18 16:45:49 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BFD50130F4D for ; Sat, 18 Aug 2018 16:45:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FmOmQ4cL0D2o for ; Sat, 18 Aug 2018 16:45:46 -0700 (PDT) Received: from mail-yb0-x22b.google.com (mail-yb0-x22b.google.com [IPv6:2607:f8b0:4002:c09::22b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 086A8130F0E for ; Sat, 18 Aug 2018 16:45:46 -0700 (PDT) Received: by mail-yb0-x22b.google.com with SMTP id g68-v6so3113861yba.0 for ; Sat, 18 Aug 2018 16:45:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc:content-transfer-encoding; bh=eyR1CJIVXzoyNsefMPvAtOOJdMa2I7U+EmoLPdS/rqk=; b=JvvXRcv27H0yl0OZLGAQmt4yVWOOkgLFHp51U3gQBVVJpMicaToB5urRoBDG1Ngj4A lai7xW8tvmTQUrCE3wO3Qbi2cTUj7mpbEzy4paucKhDmZeoXqdO2rN/iNn6JEoNnMw0Q VwNzpHBcZBlVma44p9dvWUtiPefzzLIO1cGmsomJoW5cJuSklthngMWAhHDwn/N4HYrf CLppNo3JDmXi0jLtZM4yTjo806afCZ626y3EB6/Pv46HfRYV94F9KsOXDth0ukuI+8t9 1Vijq6Jiqq9txpLi0P+G328rg8jYJxOmeqfxUhROw54VkFJPJZ8cnnh6K3jdUI3byGni zs0A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc:content-transfer-encoding; bh=eyR1CJIVXzoyNsefMPvAtOOJdMa2I7U+EmoLPdS/rqk=; b=rtNcRaFQ768MNGxs3Ll2V5ILp0Pv3vUftGF2sWGzitYAnCvSsDm9863RCRMgG1J+JG 4lnH9cApCDbHW/kshPi/17UUXWiv0+yl/DyWsAlhAB2qOkXj3oGED6wslRIrY4ficMQg k0LtYziaTGQd079kUNM8NmYkPt/R84jGJ8Xon/SLh1jXCV09uKj7arf+orIFR0vK19vp cAC7lahCqLOt+oBTJFbvL76hm/40OIxxH0fTCFBUEwmYpfJrjOAZ5l1GaDGGLJTLaerv R8Z+Fx4XCiKUoCN8IMHrqgQUmLYLYa2X7+l7kCCW05e6P3uH1kIPlKGUxuvAZpiFMbyp p96Q== X-Gm-Message-State: AOUpUlGjpFUrUHib4f/yBHQbjN2M8GUoGAlpN6/E8ZABRk38D2GIs9bP D3gUW8TAcZ++B5qVtV0JCC3GUNt1PrRQKGOLfxw= X-Google-Smtp-Source: AA+uWPzENGit3EZvg7OYfbYXRubs4LhPQ8rq41wl3xkgauWz7RyGVBcMwMWPmgmu/EBxgkRniGwSZg+959yx0aFmjUY= X-Received: by 2002:a25:4c45:: with SMTP id z66-v6mr17561298yba.383.1534635945107; Sat, 18 Aug 2018 16:45:45 -0700 (PDT) MIME-Version: 1.0 References: <152934875755.3094.4484881874912460528.idtracker@ietfa.amsl.com> In-Reply-To: From: Artyom Gavrichenkov Date: Sun, 19 Aug 2018 02:45:33 +0300 Message-ID: To: Kathleen Moriarty Cc: "" Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Archived-At: Subject: Re: [TLS] Fwd: New Version Notification for draft-moriarty-tls-oldversions-diediedie-00.txt X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 18 Aug 2018 23:45:48 -0000 On Mon, Jul 9, 2018 at 7:42 PM Kathleen Moriarty wrote: > Stephen and I posted the draft below to see if the TLS working group > is ready to take steps to deprecate TLSv1.0 and TLSv1.1. There has > been a recent drop off in usage for web applications due to the PCI > Council recommendation to move off TLSv1.0, with a recommendation to > go to TLSv1.2 by June 30th. Err, sorry, but =E2=80=93 to make it one hundred per cent correct =E2=80=93= it seems like PCI SSC has just deprecated TLS v1.0 _only_. "Migrating from SSL and Early TLS", version 1.1: "The best response is to disable SSL entirely and migrate to a more modern encryption protocol, which at the time of publication is a minimum of TLS v1.1" https://www.pcisecuritystandards.org/documents/Migrating-from-SSL-Early-TLS= -Info-Supp-v1_1.pdf draft-moriarty-diediedie also mentions PCI SSC requirements. Do I get anything wrong here? From nobody Sat Aug 18 17:02:05 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 85C89130F53 for ; Sat, 18 Aug 2018 17:01:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.301 X-Spam-Level: X-Spam-Status: No, score=-4.301 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XpesXTKLghRj for ; Sat, 18 Aug 2018 17:01:48 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B672A130F0F for ; Sat, 18 Aug 2018 17:01:47 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 461FDBE6F; Sun, 19 Aug 2018 01:01:45 +0100 (IST) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SacxnKGEVoCN; Sun, 19 Aug 2018 01:01:41 +0100 (IST) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 5510ABE64; Sun, 19 Aug 2018 01:01:41 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1534636901; bh=E0Koa81QYiZFgvogXtCe4ekTEWCE+Sk3BgBrVQTrRJ4=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=4HvzazPpkOOsjPNhfqaRYlAJjWq76/aJmP5gTSTqvw+uiHuQ3woBn7Qqq+SUGHSLE DIEwdTQUTnTY37SC2yzPDjluXiHCVfmXwnrMD4aalbhdUJYYsImwAX/2KfkV9o2tOu geYtSn6jAdhzD9T0Rlr1NTaTP4iJmDa3l4QxO2fQ= To: Artyom Gavrichenkov , Kathleen Moriarty Cc: "" References: <152934875755.3094.4484881874912460528.idtracker@ietfa.amsl.com> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= xsFNBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABzTJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPsLBgAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxM7BTQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAcLBZQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <84460734-cfd5-e66e-f242-e72b10589d56@cs.tcd.ie> Date: Sun, 19 Aug 2018 01:01:40 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.9.1 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="Zhmi538P8S6BPXEP3IEArzuGmPVFMJUAX" Archived-At: Subject: Re: [TLS] Fwd: New Version Notification for draft-moriarty-tls-oldversions-diediedie-00.txt X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 19 Aug 2018 00:01:54 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --Zhmi538P8S6BPXEP3IEArzuGmPVFMJUAX Content-Type: multipart/mixed; boundary="sttKvimqRBfuTbLBW1QnkVxvGYJ0zMgnW"; protected-headers="v1" From: Stephen Farrell To: Artyom Gavrichenkov , Kathleen Moriarty Cc: "" Message-ID: <84460734-cfd5-e66e-f242-e72b10589d56@cs.tcd.ie> Subject: Re: [TLS] Fwd: New Version Notification for draft-moriarty-tls-oldversions-diediedie-00.txt References: <152934875755.3094.4484881874912460528.idtracker@ietfa.amsl.com> In-Reply-To: --sttKvimqRBfuTbLBW1QnkVxvGYJ0zMgnW Content-Type: multipart/mixed; boundary="------------A5AC881C656ECC7FB19421C5" Content-Language: en-GB This is a multi-part message in MIME format. --------------A5AC881C656ECC7FB19421C5 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hiya, Thanks for reading the draft! On 19/08/18 00:45, Artyom Gavrichenkov wrote: > On Mon, Jul 9, 2018 at 7:42 PM Kathleen Moriarty > wrote: >> Stephen and I posted the draft below to see if the TLS working group >> is ready to take steps to deprecate TLSv1.0 and TLSv1.1. There has >> been a recent drop off in usage for web applications due to the PCI >> Council recommendation to move off TLSv1.0, with a recommendation to >> go to TLSv1.2 by June 30th. >=20 > Err, sorry, but =E2=80=93 to make it one hundred per cent correct =E2=80= =93 it seems > like PCI SSC has just deprecated TLS v1.0 _only_. >=20 > "Migrating from SSL and Early TLS", version 1.1: > "The best response is to disable SSL entirely and migrate to a more > modern encryption protocol, which at the time of publication is a > minimum of TLS v1.1" > https://www.pcisecuritystandards.org/documents/Migrating-from-SSL-Early= -TLS-Info-Supp-v1_1.pdf >=20 > draft-moriarty-diediedie also mentions PCI SSC requirements. Do I get > anything wrong here? Well, two comments: 1. The bit you quote above is incomplete, the full paragraph says "The best response is to disable SSL entirely and migrate to a more modern encryption protocol, which at the time of publication is a minimum of TLS v1.1, although entities are strongly encouraged to consider TLS v1.2. Note that not all implementations of TLS v1.1 are considered secure =E2=80=93 refer to NIST SP 800-52 rev 1 for guidanc= e on secure TLS configurations." So there's already a strong hint in PCI-land to GOTO TLSv1.2+. 2. Use of TLSv1.1 seems to be almost non-existent. See the figures in the -01 draft for some detail, (and more data is always welcome). It seems like there's more already-deprecated SSL than there is TLSv1.1 which I think means that this is really a non-issue. I guess there could be a formal but theoretical problem resulting from this, but OTOH, if (or when) the IETF finished an RFC based on this draft deprecating these legacy versions then PCI folks can catch up, and without that affecting pretty much anyone, so I'd say, in this case, it's likely ok to just ignore this slight discrepancy. But if you've some text change to suggest that'd handle it better, that'd be great to see. Cheers, S. >=20 > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls >=20 --------------A5AC881C656ECC7FB19421C5 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1bQyU3RlcGhlbiBGYXJy ZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxsQGNzLnRjZC5pZT6JAkAEEwEIACoC GwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AFAlo+o3cCGQEACgkQWrL6 8XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeOM3P7SW3C3UQYdCgZ/TlvxGgKow5o DSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP2ZK24tw5k6duTh4+sFwUualTMlcp 0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s/69L/fvHmdSKet5LIUAxoYaZkTCr uFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBjMw1xV+p0uCwNbN6XDzcToK7wsm+t AIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k4S+sN2CnYk4tTW7jHjsWarV3FLIS COObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSlAblGjwZe4EIkCXAJUtzJhoFUuGaF /PlWjxqV3UFRcgTERZTijguVyREre8GNERNgvDxZvuXssEjvz9X5JfcIZDIJpdzh LiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/rwWcpGr/MfVPTOik4H7F8rcVJelce ZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o4uBZCQ0GzvsmFA4XLqn2pA5rVizM XnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKAxo/tuHYtk19XCi83QzFhWls5TT+X QeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd8MxYNAbNYgSPtkbhZ8SJARwEEAEI AAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6NXEGtw/r1miKNGcopzvzILQ9oB8r KI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYcJf+RyiH1nMoqUIZiZJaf3bJXinDZ 5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbYtWgsYtRqHLD4IWi37MZrVyjBuF7u 14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1WQOAfD1kfBpW9PvAva5Iw9FWeXpC XRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7EDuTBb/8um1wK7Y9bgeIQC+CYjhYB 5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlve2Q6UTrmHxP5U22DlokCPQQTAQgA JwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrx excr6tJpD/4rrILH+meP07vrx8wW5eYuqCiPGYnh/CXxIF8eLrfbe5d4QRgtq+w6 UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dTMrEGn8QWKx2iNuz9rZMXyOSWFetu O01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9gQ7edR9mfLTdvBf2FR522hg8BRBM 1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZXripS0uFA07dM46Oi/E8osjx6fQt/ lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGFL64/VCQb1YGjf0Z5MBPnWm9jgUoO Y5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2DFeo9+S9f2V53Llz1WIspXJg6f+n9 lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCbhrC3+yobyy/AUOs5Z3E+njjX1FF/ VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10MSU8GEZu9ayU4M3o3N9yxOjaoP0Nu Q4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXtGKvJtFAEppGEYezB+bLKIm6XlpPk hnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA5rEP4lL16BmijmF+CHoPE/zwgKZb KpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ksZgUUnNyvfQr2p7jrQuU3RlcGhl biBGYXJyZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgA JwUCWj1RWgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrx excr6jscEADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvn crAFClVI6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtg rlstjk7hqVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIg pMw0bA1yBU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5c F8R4OvB1n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaP y1/fEgIqhCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5 b1AEzZKw2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7 b9Ocu+nYm2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkpo rMQCTh3T5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXR dS/oDKrBLUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGl Ru78ba0HArxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgA BgUCWj1SoAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89Sq Bd++uG06TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VO dL8zJWJs0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD 4t0VHpWkmfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lz nNiH41x9M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8I WOMqN2woDjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBuQINBFo9UDIB EAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuBHmpvceBRZgRasdbaMc4H Jee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD8U4xxjvR5Mi7+ToQQUOU NuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5MsK1SKfs51pLa5ToC1rc8 tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE4bGjXdJW5pKphFB2lX3d G4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7PbTuW/eITbMbI1eV3+fyym 9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3vDUew1h5QU1yDaWT3NAp vi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcmoazpiKZt91CrFPOaoXDP ck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r+oA/wxWb5jELElAhOpny qMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22fQ0D38zud+CKH3bMP3ayX XJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7Ffa4UbkwlD+dh8GiIAtv T51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1gwARAQABiQIlBBgBCAAP BQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF6TeR83xD6MasqXyrBjwc LmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfdn3BmvqGyh8+ouHX9jMOx iRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx252HKTFdeOrszoOjWjEzwm h+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjNJIXXM+lHqCDrjDaDhNcz mq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjwrIdfQM86H1z5J31lfhqo p+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGsokRina9947fRWxXHh3O6 6ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqYo3pcN2OE0C1chqgDZQxk r+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQkd0YjcqlB1E0svODHTzcS oRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmUyXBIeq6I5z8xBcd+BQ/n /9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhkvMvem9XXh1yyhqN14gfj mLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3YFMVUUfgyudqAV1wWdZi nUk+H3pkqOKoHAy/8fST =3DTOQn -----END PGP PUBLIC KEY BLOCK----- --------------A5AC881C656ECC7FB19421C5-- --sttKvimqRBfuTbLBW1QnkVxvGYJ0zMgnW-- --Zhmi538P8S6BPXEP3IEArzuGmPVFMJUAX Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAlt4s2QACgkQWrL68XsX K+o1Qg//ffGEvOUSB9INuTIlJvwieKgtH8AAag0/XjeJKLrumtsP6LwTlrMEkArN VqbNxFVBqB2cr+0I9YPZtTNDuUk6YuH87wa4qOU0uWHChUyyX7plAX5fJpDCzC5P OiRkDdWkyFknWyj/TnoxSXkY1QZzDTMJPT00xr40vSZcqQd56wsYbBSw1+Pk+D+9 tJdVhOz/6grUe0AakWYSKz0hCh3gP7FcCOVmAnCKRDS8rWrVxQwG7N5xnlViO34q Aal+m1MPtTeNW49AXP53xjlV7/BnjwK6uhDLcTDnOhfmidHKJCYefKpVzWDDD7u0 cHD+Z31AQ7gUtbcpYsr5rUPFFhFcdqcg3GYlXl4RoI9rHJWDOmhkarTrgve7IQ3y CxXDARCiD26ZlkDCEKTvHhc4ywb4qJ6HukoAj+a71v9v/BhmH9iD1vklNUJWzrMV bkhopIyKkslUa62vuC5DRSMEtx930j7C8Uw3LqbJVc5Eh2tFX6bibPScQRy0UZcY AzO7mQytWb7tSBRrlb6g9W9/bnJWCo9VUTNerPJ1HgkZb2/6iHGuG94NHZOyxNXv cQ6zfFJgnvMkl2d45P6/KTBs+sD+pYSVHOd2Tc8SIYZ9P4ftJ7LzuPfs17NlQQBF fmahq+wWKvbslaI31qiYUAqefy48co1aYpH8Oukyv7xJTCi9HXQ= =98Dw -----END PGP SIGNATURE----- --Zhmi538P8S6BPXEP3IEArzuGmPVFMJUAX-- From nobody Sun Aug 19 14:23:17 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3D559130EB0 for ; Sun, 19 Aug 2018 14:23:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5w7B9wkux3AR for ; Sun, 19 Aug 2018 14:23:12 -0700 (PDT) Received: from mail-yw1-xc31.google.com (mail-yw1-xc31.google.com [IPv6:2607:f8b0:4864:20::c31]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0D792130E32 for ; Sun, 19 Aug 2018 14:23:12 -0700 (PDT) Received: by mail-yw1-xc31.google.com with SMTP id r3-v6so6177765ywc.5 for ; Sun, 19 Aug 2018 14:23:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc:content-transfer-encoding; bh=Xx12cEiGYUYK+7+HRIMBo50t1L+f8B8SI0e0Xj+68ks=; b=ECV4b2E4SRCc1xk7vAlITCSO6oefh75Xf6RwpK48kgTcnYR3i5XEYNui7Z2AJuXqRL e9t+2i0DQaikGFBJq4FQNwLq0IF726wxltHYDIib4ht/kv6gaPAX7u26PA1n6nAH2N3L QoGq0ux3XSu7W65ClStvfU3U7Z0VSPusrDBhBzFFIE+R2poEckHI90//p2pIGZZLiGt+ RpqucsdhribRXBnQbnmGU+GVv6AOkf2cQnNPeGx99iw4ZTbUOQ99bRqFFH9IvSY6xtY+ L+r/459LueOM3mht/NO6573q9eDEkzEXj69s1gQgHPXswSGPCfcvgBj9Y9Ge+rZkSIYj VdTw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc:content-transfer-encoding; bh=Xx12cEiGYUYK+7+HRIMBo50t1L+f8B8SI0e0Xj+68ks=; b=UPz9IPV+T95ddoNFcTav+nVj9F1xSrx8nrQJZSDOsPfQYJ2GyLl8dP9JUlNiuqLiKR Gybpfpohh8UCgVprfnB+rOmxjEz2yOZsTX9WS/lless9lSORvwQotin/5Yy6ZArQPO5i gbilLHM8ARlaHYzRJRQyc1aKc1l9JT3U+D0cBMLDcDDZLCt7F3Oa+eL0pQoFY0vClk44 guVE96rXNIIUZmh37KgJrZOiYIxpBJ1C+LhrUSnS67B88uwlxXUvlCzw/ftmY8Hm+YaT nWU5dx6ViCB80+ay59APZMILYyzqEvTfuSbTKe6yc7L1O8mccYUKdDEm0QnBClrRoUVT OkTw== X-Gm-Message-State: AOUpUlHMMictgXzQv8Qji+9Lb4UwvGaI9usKaUP4qQOzSsz5aZbx/w/E mkRtyXUpv/Celqhgs6CMf77OB04ni1omnjviZOQ= X-Google-Smtp-Source: ANB0VdbqBn2+rELDi78Xu0pDg3CnsNwOrFGoxE2UwzxJnBsWqVnNMysH3CTDRuxymx0WQpTGX6kdpo7mDyIcafv0c6s= X-Received: by 2002:a81:3595:: with SMTP id c143-v6mr1146042ywa.184.1534713790983; Sun, 19 Aug 2018 14:23:10 -0700 (PDT) MIME-Version: 1.0 References: <152934875755.3094.4484881874912460528.idtracker@ietfa.amsl.com> <84460734-cfd5-e66e-f242-e72b10589d56@cs.tcd.ie> In-Reply-To: <84460734-cfd5-e66e-f242-e72b10589d56@cs.tcd.ie> From: Artyom Gavrichenkov Date: Mon, 20 Aug 2018 00:22:59 +0300 Message-ID: To: Stephen Farrell Cc: Kathleen Moriarty , "" Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Archived-At: Subject: Re: [TLS] Fwd: New Version Notification for draft-moriarty-tls-oldversions-diediedie-00.txt X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 19 Aug 2018 21:23:16 -0000 Good day! On Sun, Aug 19, 2018 at 3:01 AM Stephen Farrell wrote: > 1. The bit you quote above is incomplete Yep, but the rest of the paragraph just outlines *recommendations* (or, even better, 'encouragements') while the draft states that "PCI Council [is] deprecating TLSv1.0 and TLSv1.1 by June 30, 2018". In the PCI world, *deprecation* is commonly thought to be a *requirement*, not a recommendation. It is *not recommended* to use TLSv1.1 (and TLSv1.2) already just by virtue of fact that a more up-to-date spec version exists. My point here is that this wording is not, strictly speaking, correct -- so far, as a matter of fact. (In fact, PCI DSS even still allows usage of SSLv3 under certain circumstances -- e.g. POS/POI, -- but said circumstances are strict enough for us to conveniently omit mentioning those). > 2. Use of TLSv1.1 seems to be almost non-existent. See the figures > in the -01 draft for some detail [..] Maybe, but this is irrelevant to the concern I've raised. If you want PCI SSC to deprecate TLSv1.1 just because enterprise networks are not using it, the right way to do it is to share the data with the SSC along with the research methodology and let them decide. By the way, at least one issue with the research data referred to in draft-diediedie-01 which I'm aware of is that the researchers were hunting for open 443/tcp port only, while the enterprises have a practice to move deprecated services those enterprises somehow cannot get rid of to different ports, like, 4443, 4433, 8443 and so on. To make it absolutely clear, I'm not criticizing the methodology now, however, I just want to raise a concern that if PCI SSC somehow decided to deprecate v1.0 (far ahead of IETF) but still keep v1.1 then, *maybe*, they had at some point in time a strong reason to do so. It's entirely fine to ignore their preferences and let PCI SSC 'catch up' without quoting themselves as a reference, or, vice versa, it's okay to quote the SSC while sticking to their actual suggestions. Just in case, I'm not in any way against the draft-diediedie. I support it, which is why I've voted for the WG adoption before posting this to the mailing list. I'm just a nerd who wants the document to be consistent for that matter, and that's it. -- T=C3=B6ma From nobody Mon Aug 20 04:23:40 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7B91A130DEA; Mon, 20 Aug 2018 04:23:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_MED=-2.3] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=auckland.ac.nz Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9sW13-C5duvu; Mon, 20 Aug 2018 04:23:28 -0700 (PDT) Received: from mx4-int.auckland.ac.nz (mx4-int.auckland.ac.nz [130.216.125.246]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E35EE130DDD; Mon, 20 Aug 2018 04:23:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=auckland.ac.nz; i=@auckland.ac.nz; q=dns/txt; s=mail; t=1534764208; x=1566300208; h=from:to:subject:date:message-id: content-transfer-encoding:mime-version; bh=/r0hkTNBFc7USnRIcBJ5jE+VcyxFgl6uFfh+AaIyil0=; b=vqasNSgjC8vn3/Q3le2GDpdFj1oTk9zGtmilrPs7eqlsaM71Bm0xY/hi CEseyD9UUoMmfPjjgpM/V6xAUXnB5Etidoh/IYsr/x+ayGRb3wQYw1LIA rpWdEJrQnSRx7zQQB9kxXSnjnmBgoEsUu+/XUwkiGJ4yQwQbqXrLdVZfd yTYTQRqiRJIAYjYLYnwyKEZlXEoSNsiBr4JqPsm7yLss+pnLrUIn//0JY YzvGWZrxk6FM713XhNSCetLWclxbkN1xWh/miw/JtGT60cURG3+J5NoJ7 mLWsmmSOPXxLuDXF7tWqgD1daT3X3FXI52Qtnbono1UmRFU6LxTWGsC1U Q==; X-IronPort-AV: E=Sophos;i="5.53,265,1531742400"; d="scan'208";a="27194084" X-Ironport-HAT: MAIL-SERVERS - $RELAYED X-Ironport-Source: 10.6.2.3 - Outgoing - Outgoing Received: from smtp.uoa.auckland.ac.nz (HELO uxcn13-ogg-b.UoA.auckland.ac.nz) ([10.6.2.3]) by mx4-int.auckland.ac.nz with ESMTP/TLS/AES256-SHA; 20 Aug 2018 23:23:19 +1200 Received: from uxcn13-ogg-d.UoA.auckland.ac.nz (10.6.2.5) by uxcn13-ogg-b.UoA.auckland.ac.nz (10.6.2.3) with Microsoft SMTP Server (TLS) id 15.0.1263.5; Mon, 20 Aug 2018 23:23:19 +1200 Received: from uxcn13-ogg-d.UoA.auckland.ac.nz ([10.6.2.25]) by uxcn13-ogg-d.UoA.auckland.ac.nz ([10.6.2.5]) with mapi id 15.00.1263.000; Mon, 20 Aug 2018 23:23:19 +1200 From: Peter Gutmann To: "tls-reg-review@ietf.org" , "tls@ietf.org" Thread-Topic: Request to register value in TLS extension registry Thread-Index: AQHUOHgQgYCzmvnTw0+jhiJlS3ncUg== Date: Mon, 20 Aug 2018 11:23:18 +0000 Message-ID: <1534764197914.55986@cs.auckland.ac.nz> Accept-Language: en-NZ, en-GB, en-US Content-Language: en-NZ X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [130.216.158.4] Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: [TLS] Request to register value in TLS extension registry X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Aug 2018 11:23:32 -0000 [CC'd to the main TLS list, since I don't know how many people are on the t= ls-=0A= reg-review one and therefore wouldn't otherwise see this, and the archives= =0A= and discussion for that are all non-public]=0A= =0A= Now that RFC 8447 is published, I'd like to request the addition of extensi= on=0A= ID 26 for TLS-LTS:=0A= =0A= https://datatracker.ietf.org/doc/draft-gutmann-tls-lts/=0A= =0A= This extension has been waiting for quite some time for the publication of= =0A= 8447, so it's already in use by implementations.=0A= =0A= Peter.=0A= From nobody Mon Aug 20 05:03:17 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C372B130F62 for ; Mon, 20 Aug 2018 05:03:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.902 X-Spam-Level: X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cv5i3pduh9hD for ; Mon, 20 Aug 2018 05:03:14 -0700 (PDT) Received: from mail-wr1-f43.google.com (mail-wr1-f43.google.com [209.85.221.43]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id ADAD9128BAC for ; Mon, 20 Aug 2018 05:03:13 -0700 (PDT) Received: by mail-wr1-f43.google.com with SMTP id o37-v6so3900451wrf.6 for ; Mon, 20 Aug 2018 05:03:13 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:message-id:subject:from:to:date:in-reply-to :references:mime-version:content-transfer-encoding; bh=MAvU/Pmwf3i4fZrBz1z3VFE29kjHc3FcVr/6KLqiRC4=; b=W9kPKuBlnBc8vN8q20sfc56re/NcvIp9tPzb00SlVoNV721t1UBX+KQSemxWEqALkj iDvF3xdeKvkHleMpOsYvry4Ymp1FOXdjx21vTnq+3lKcjwbEEesIyvOih+DgRMMDLTYo lO7ObDPixbLJHq5QA9Q2DGeobrVO1iBg34Cadd0qufzkTUsrqj+wxR7+1zd+UhWSd4hB 3okmpJ9wWa1tAwMe6GrfaukMW7l1ctyKnIFLnz5B9NuFDQKTt2MOrMRKBjAwC8SxmO+L L7P90PErj430Kg6D9K4gXMULnCGj6lKKvO5l1WRaJOTkqfw4jJ/P/Uq4ZgeNWduAFoGT 3WlQ== X-Gm-Message-State: APzg51Dgm+bf2SY/qcnoDchLB99akM7C83P0kFxKNAAfhAitk/weAWhN qFDzIrshL+QXPcIKUVOjqM/403i/6MQ= X-Google-Smtp-Source: ANB0VdbQOH8rBRnmHB9rHJWnD1HdysVdem1X+4e1Dg1x+iACe4eBPDEX5XzHo2l1Q/TRtk4Gmi99WA== X-Received: by 2002:a5d:404a:: with SMTP id w10-v6mr5101359wrp.147.1534766591660; Mon, 20 Aug 2018 05:03:11 -0700 (PDT) Received: from dhcp-10-40-1-102.brq.redhat.com (nat-pool-brq-t.redhat.com. [213.175.37.10]) by smtp.gmail.com with ESMTPSA id a11-v6sm9066244wrr.81.2018.08.20.05.03.10 for (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Mon, 20 Aug 2018 05:03:10 -0700 (PDT) Message-ID: From: Nikos Mavrogiannopoulos To: tls@ietf.org Date: Mon, 20 Aug 2018 14:03:09 +0200 In-Reply-To: <153452719962.17994.18295787287508064922.idtracker@ietfa.amsl.com> References: <153452719962.17994.18295787287508064922.idtracker@ietfa.amsl.com> Content-Type: text/plain; charset="UTF-8" X-Mailer: Evolution 3.28.5 (3.28.5-1.fc28) Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [TLS] The TLS WG has placed draft-moriarty-tls-oldversions-diediedie in state "Call For Adoption By WG Issued" X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Aug 2018 12:03:16 -0000 On Fri, 2018-08-17 at 10:33 -0700, IETF Secretariat wrote: > The TLS WG has placed draft-moriarty-tls-oldversions-diediedie in > state > Call For Adoption By WG Issued (entered by Sean Turner) > > The document is available at > https://datatracker.ietf.org/doc/draft-moriarty-tls-oldversions-diediedie/ I support the adoption. From nobody Mon Aug 20 08:28:33 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 23842130F7B for ; Mon, 20 Aug 2018 08:28:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rG4vA4nM_DpU for ; Mon, 20 Aug 2018 08:28:20 -0700 (PDT) Received: from mail-vk0-x231.google.com (mail-vk0-x231.google.com [IPv6:2607:f8b0:400c:c05::231]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E9685130F84 for ; Mon, 20 Aug 2018 08:28:19 -0700 (PDT) Received: by mail-vk0-x231.google.com with SMTP id q184-v6so6694119vke.7 for ; Mon, 20 Aug 2018 08:28:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to; bh=RjtHjIZDeCLLWA63RGib+GyYWWtcYQdcEkZGEM6khSA=; b=l1xcKjt3Rdt7LVhHPQ/T3k5iN2qAMJiJg7ynFPBi14zB/Lm6jRfAaLNrsWj7JudkNw pXpqbe2tP4o8rsW6tcj7RRyVvQ/fGnvZraJolIOJCYQTERKpz4BFf5BQRcOk+Erm1cj8 DcMbWlayqfjAQmrW4XZzC2d+FrN2gsbbtjp67it6FsGqhzcDS8KZjr4zUuBr/LFTlKx5 PpHCk7HPbk5ZVST0YUrBFWT4YsyPofmea5P/1qB3JJ9m2TjP0v49m2mod45fErqt/6wg ZVfO1rIi1NDX17dzooQyLSWAPSLH7xsNgNBGcjPbb8Yjr3Ruh66ZZP1PkXDFEwaaLaMJ wH2g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=RjtHjIZDeCLLWA63RGib+GyYWWtcYQdcEkZGEM6khSA=; b=FMoxAy1D92rYCrsAUF5FZDcj3zHrtLldvA3h278EtwhRDcVvQNmYA4cwGTTEy9iu61 P+cA8Ud21HVWj8zl9k221AFkbnRLKUfTVFWGmB3g/Y7wTlYExXJPEMDKAEk6cocTtStC 15hv35p9BtYvWKN84kAB5X0i7RHjj+egMmspGDjJRyMOJytdwNGeNDvVkFIcLrQPl7Fa Jky2iBq101YqaCx4vwkjv9VutQY4xNoxLDYCv6yCNIh2jpYeQl5GBgd/S01cZsl/J9YR QdG0+FDbjpNJYu/u2DL+HEoSqBQdz0c23LkeYIb5U7dowx2PVjLUUILdPQOFhOPhZvqR Tw2Q== X-Gm-Message-State: APzg51ByAEjJtgo9X0EE4wo2RQ+EnixbAvBr/o3sQhGi1w6C91GGGPSC Dwzfaw5V0blstLqb2tlMWX3aAC5yec/nzWkIWUf49w== X-Google-Smtp-Source: ANB0Vdb6w0PczKlAHlnmWhy8HL2sq3F4bzp7P0OUHD06xzULcRsbm7xVOpufhOGarx26LL2TKmuGtH6NIUUeg1cjT60= X-Received: by 2002:a1f:378e:: with SMTP id e136-v6mr1792468vka.154.1534778898683; Mon, 20 Aug 2018 08:28:18 -0700 (PDT) MIME-Version: 1.0 From: Tony Arcieri Date: Mon, 20 Aug 2018 08:28:07 -0700 Message-ID: To: "" Content-Type: multipart/alternative; boundary="000000000000109d000573df8f02" Archived-At: Subject: [TLS] Drop "1.x" from future TLS version names? X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Aug 2018 15:28:31 -0000 --000000000000109d000573df8f02 Content-Type: text/plain; charset="UTF-8" Apologies if the last thing people want to talk about right now is the next version of TLS. There was much discussion about bumping TLS 1.3's version number to "TLS 4" or thereabouts (so as to be higher than "SSLv3"). The ship has sailed on that and it is "TLS 1.3". I think there was widespread agreement that TLS 1.3 represented something a bit more substantial than a minor version bump, and a desire to have a TLS version number bigger than the SSL version number lest people get confused and deploy SSLv3 instead of TLS 1.3. Modest proposal: TLS 1.4 => TLS 4 I bring this up so soon because I think a lot of the pushback regarding doing this before was due to changing the version so late in the development cycle. -- Tony Arcieri --000000000000109d000573df8f02 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Apologies if the last thing people want to talk about= right now is the next version of TLS.

There was much d= iscussion about bumping TLS 1.3's version number to "TLS 4" o= r thereabouts (so as to be higher than "SSLv3"). The ship has sai= led on that and it is "TLS 1.3".

=
I think there was widespread agreement that TLS 1.3 represented someth= ing a bit more substantial than a minor version bump, and a desire to have = a TLS version number bigger than the SSL version number lest people get con= fused and deploy SSLv3 instead of TLS 1.3.

Modest = proposal: TLS 1.4 =3D> TLS 4

I bring this up so= soon because I think a lot of the pushback regarding doing this before was= due to changing the version so late in the development cycle.
--
Tony Arcieri
--000000000000109d000573df8f02-- From nobody Mon Aug 20 08:38:56 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0C22C130E5A for ; Mon, 20 Aug 2018 08:38:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FbCkeVufR5OO for ; Mon, 20 Aug 2018 08:38:53 -0700 (PDT) Received: from mail-io0-x22b.google.com (mail-io0-x22b.google.com [IPv6:2607:f8b0:4001:c06::22b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 86324130F66 for ; Mon, 20 Aug 2018 08:38:53 -0700 (PDT) Received: by mail-io0-x22b.google.com with SMTP id y12-v6so3176584ioj.13 for ; Mon, 20 Aug 2018 08:38:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=fRE0rriD6ZkGcwNvXBZq6zFRom9iezBJ2Vp9eVqzCHE=; b=Efw+ryHt/AE8cVL9xZWSLuv6jPodnZaK3Y1aLeIGHfu1HfUsDcn0edi+bRy5tuUFAr mFaUQNqdf3RLqRr0H8sFMdFayUSdu4KSTCI9C9EEH5TSLprfsFWqbqA1aFJUTLe9F8uc WYjZC06biEWzLigIQUh1NiKZcvB/jpcHmd0s9sF80YdQVZezlHapE++O3HhapzPgblfN BsUQ1dMRd9MGV2FTY6wn14JE6hDwrL7ZK5GdLpYJucysAckxQJfNleMEPjHucUY9LCqr qFM2s2GG/y3eZMbt6bkztnQ29BjX6zQjiDurdm82u4O9AQo69qdOjgIrGp40SkYSV4WO nrKA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=fRE0rriD6ZkGcwNvXBZq6zFRom9iezBJ2Vp9eVqzCHE=; b=Ym4LULSVnDngkk0mcMKED4+FyAjng/dKR/9wqBu0s0QPG6SJDKvEW+jPSHoj/RB/Kg l1RsOuAaeG7teiRm6xm+BxiMCwTykQc4+me046B0InAUgVy5D/9Apt4dx3ujYgSanOFH NmAaZK6uwXFPkOgtYMKN7eqKgCziP3SwN3jENaO4l9+IpnRHZqRA6vkwGzQjQuy2jPgF VWY1lqaHMUucOyU4u5FCJ+Gbn0Oj0+RvktLywDf0yVVn5fOX9vcHD0njKZyocaIuylGv c3+O6+8V2sM7VTFBOfqnaZNwbSHKZ2xTh50whyJkFCGs4kB2PolwMf/7PX+Bu4yJkTJK 0dhg== X-Gm-Message-State: APzg51BJ1Otfhr8T2ppYnghNhwZTBa0hzOcmgvDPtlx8VS4A3dnBTqdc O6OS2dWgJgB3IXKGP0Sfo43OWQmAa8rh7Epa7LI= X-Google-Smtp-Source: ANB0Vda+g/2RMRC/6WANvkTf5+Q7cBFGlC4rExvBk02Hv7gNjxPvKTUl+gLjUEQhse7eB5TvZ/mRhvAOefgNrpLS1mI= X-Received: by 2002:a6b:24a:: with SMTP id 71-v6mr6779226ioc.191.1534779532856; Mon, 20 Aug 2018 08:38:52 -0700 (PDT) MIME-Version: 1.0 Received: by 2002:a4f:f741:0:0:0:0:0 with HTTP; Mon, 20 Aug 2018 08:38:52 -0700 (PDT) In-Reply-To: References: From: Loganaden Velvindron Date: Mon, 20 Aug 2018 19:38:52 +0400 Message-ID: To: Tony Arcieri Cc: "" Content-Type: text/plain; charset="UTF-8" Archived-At: Subject: Re: [TLS] Drop "1.x" from future TLS version names? X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Aug 2018 15:38:55 -0000 On Mon, Aug 20, 2018 at 7:28 PM, Tony Arcieri wrote: > Apologies if the last thing people want to talk about right now is the next > version of TLS. > > There was much discussion about bumping TLS 1.3's version number to "TLS 4" > or thereabouts (so as to be higher than "SSLv3"). The ship has sailed on > that and it is "TLS 1.3". > > I think there was widespread agreement that TLS 1.3 represented something a > bit more substantial than a minor version bump, and a desire to have a TLS > version number bigger than the SSL version number lest people get confused > and deploy SSLv3 instead of TLS 1.3. > > Modest proposal: TLS 1.4 => TLS 4 > > I bring this up so soon because I think a lot of the pushback regarding > doing this before was due to changing the version so late in the development > cycle. I think that it's too late for that now. > > -- > Tony Arcieri > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > From nobody Mon Aug 20 10:21:06 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6F34B130E78 for ; Mon, 20 Aug 2018 10:20:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.71 X-Spam-Level: X-Spam-Status: No, score=-2.71 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=akamai.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OCdmouqOHpof for ; Mon, 20 Aug 2018 10:20:49 -0700 (PDT) Received: from mx0b-00190b01.pphosted.com (mx0b-00190b01.pphosted.com [IPv6:2620:100:9005:57f::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 282B9130EE3 for ; Mon, 20 Aug 2018 10:20:49 -0700 (PDT) Received: from pps.filterd (m0050096.ppops.net [127.0.0.1]) by m0050096.ppops.net-00190b01. (8.16.0.22/8.16.0.22) with SMTP id w7KHHGOo025605; Mon, 20 Aug 2018 18:20:48 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=akamai.com; h=from : to : cc : subject : date : message-id : references : in-reply-to : content-type : mime-version; s=jan2016.eng; bh=ntdKR3h9ucinjX3OvuecrJCKGu5SP3vsIpcKzATWjsc=; b=GUqTIsCLNsmLBPlljpGbW2bA5orjY5SnoQvy9mwHG85465hFKXK+Dx83z1/0GH1Z/DaV KIB0dfwSSlBQl/l7s3YmGLHY5mEx9Soyzid5r3W/lssJBaih5e8bqadZmE8WMnEnjThj d0/qSuYRfSOdJTsd4jGOKllg6eTR/H26+W0eczKQLuxYG+1yOswwArsb7e/9egS8zM+K npTlaHlSNdaGL90ufJi3AAwm1NaDU24ZMXN+zyxak0BECL8XxaI5nvDr455lqjqFaXeG KuD/pvv/VMFCR9MxwIY2nCOIZFTy9/ZD8J+mMCsLByT7KcpLVVEg7ihgASWOQjAPr/cI RA== Received: from prod-mail-ppoint1 (prod-mail-ppoint1.akamai.com [184.51.33.18]) by m0050096.ppops.net-00190b01. with ESMTP id 2kxbv6ecqc-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 20 Aug 2018 18:20:48 +0100 Received: from pps.filterd (prod-mail-ppoint1.akamai.com [127.0.0.1]) by prod-mail-ppoint1.akamai.com (8.16.0.21/8.16.0.21) with SMTP id w7KHJPaj018521; Mon, 20 Aug 2018 13:20:47 -0400 Received: from email.msg.corp.akamai.com ([172.27.123.57]) by prod-mail-ppoint1.akamai.com with ESMTP id 2kxesut3rq-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Mon, 20 Aug 2018 13:20:46 -0400 Received: from USMA1EX-DAG1MB1.msg.corp.akamai.com (172.27.123.101) by usma1ex-dag1mb4.msg.corp.akamai.com (172.27.123.104) with Microsoft SMTP Server (TLS) id 15.0.1365.1; Mon, 20 Aug 2018 13:20:39 -0400 Received: from USMA1EX-DAG1MB1.msg.corp.akamai.com ([172.27.123.101]) by usma1ex-dag1mb1.msg.corp.akamai.com ([172.27.123.101]) with mapi id 15.00.1365.000; Mon, 20 Aug 2018 13:20:39 -0400 From: "Short, Todd" To: Sean Turner CC: "tls@ietf.org" Thread-Topic: [TLS] WG adoption call: draft-moriarty-tls-oldversions-diediedie Thread-Index: AQHUNlBhnZLcwWr/zEmF8IIhIcyF+6TJKqcA Date: Mon, 20 Aug 2018 17:20:39 +0000 Message-ID: <0BB00AA5-192E-4514-A11F-DF14B6AA611F@akamai.com> References: <5896D3BB-E621-40E1-AC07-CBA7326886F0@sn3rd.com> In-Reply-To: <5896D3BB-E621-40E1-AC07-CBA7326886F0@sn3rd.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [172.19.34.196] Content-Type: multipart/alternative; boundary="_000_0BB00AA5192E4514A11FDF14B6AA611Fakamaicom_" MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2018-08-20_05:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 mlxscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1807170000 definitions=main-1808200181 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2018-08-20_05:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1011 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1807170000 definitions=main-1808200180 Archived-At: Subject: Re: [TLS] WG adoption call: draft-moriarty-tls-oldversions-diediedie X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Aug 2018 17:20:57 -0000 --_000_0BB00AA5192E4514A11FDF14B6AA611Fakamaicom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SSBzdXBwb3J0IGFkb3B0aW9uLg0KLS0NCi1Ub2RkIFNob3J0DQovLyB0c2hvcnRAYWthbWFpLmNv bTxtYWlsdG86dHNob3J0QGFrYW1haS5jb20+DQovLyAiT25lIGlmIGJ5IGxhbmQsIHR3byBpZiBi eSBzZWEsIHRocmVlIGlmIGJ5IHRoZSBJbnRlcm5ldC4iDQoNCk9uIEF1ZyAxNywgMjAxOCwgYXQg MTozMiBQTSwgU2VhbiBUdXJuZXIgPHNlYW5Ac24zcmQuY29tPG1haWx0bzpzZWFuQHNuM3JkLmNv bT4+IHdyb3RlOg0KDQpBdCB0aGUgVExTQElFVEYxMDIgc2Vzc2lvbiwgdGhlcmUgc2VlbWVkIHRv IGJlIHNvbWUgaW50ZXJlc3QgaW4gYWRvcHRpbmcgZHJhZnQtbW9yaWFydHktdGxzLW9sZHZlcnNp b25zLWRpZWRpZWRpZSBhcyBhIFdHIGl0ZW0uIFRoaXMgZW1haWwgaXMgdG8gZGV0ZXJtaW5lIHdo ZXRoZXIgdGhlcmUgaXMgV0cgY29uc2Vuc3VzIHRvIGFkb3B0IHRoaXMgZHJhZnQgYXMgYSBXRyBp dGVtLiAgSWYgeW91IHdvdWxkIGxpa2UgZm9yIHRoaXMgZHJhZnQgdG8gYmVjb21lIGEgV0cgZG9j dW1lbnQgYW5kIHlvdSBhcmUgd2lsbGluZyB0byByZXZpZXcgaXQgYXMgaXQgbW92ZXMgdGhyb3Vn aCB0aGUgcHJvY2VzcywgdGhlbiBwbGVhc2UgbGV0IHRoZSBsaXN0IGtub3cgYnkgMjM1OVVUQyAy MDE4MDgzMS4gIElmIHlvdSBhcmUgb3Bwb3NlZCB0byB0aGlzIGJlaW5nIGEgV0cgZG9jdW1lbnQs IHBsZWFzZSBzYXkgc28gKGFuZCBzYXkgd2h5KS4NCg0KTm90ZSB0aGF0IHdlIHdpbGwgc3VnZ2Vz dCByZXBsYWNpbmcg4oCcZGllZGllZGllIiB3aXRoIOKAnGRlcHJlY2F0ZSIgaW4gdGhlIGFkb3B0 ZWQgZHJhZnTigJlzIG5hbWUgdG8gYWRkcmVzcyB0aGUgbmFtaW5nIGNvbW1lbnQgcmFpc2VkIGR1 cmluZyB0aGUgbWVldGluZy4NCg0KVGhhbmtzLA0KQ2hyaXMsIEpvZSBhbmQgU2Vhbg0KX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NClRMUyBtYWlsaW5nIGxp c3QNClRMU0BpZXRmLm9yZzxtYWlsdG86VExTQGlldGYub3JnPg0KaHR0cHM6Ly93d3cuaWV0Zi5v cmcvbWFpbG1hbi9saXN0aW5mby90bHMNCg0K --_000_0BB00AA5192E4514A11FDF14B6AA611Fakamaicom_ Content-Type: text/html; charset="utf-8" Content-ID: <1DEA61ADB9DFE8438471E81C69359DB3@akamai.com> Content-Transfer-Encoding: base64 PGh0bWw+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIgY29udGVudD0i dGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjwvaGVhZD4NCjxib2R5IHN0eWxlPSJ3b3JkLXdy YXA6IGJyZWFrLXdvcmQ7IC13ZWJraXQtbmJzcC1tb2RlOiBzcGFjZTsgbGluZS1icmVhazogYWZ0 ZXItd2hpdGUtc3BhY2U7IiBjbGFzcz0iIj4NCkkgc3VwcG9ydCBhZG9wdGlvbi48YnIgY2xhc3M9 IiI+DQo8ZGl2IGNsYXNzPSIiPg0KPGRpdiBzdHlsZT0iY29sb3I6IHJnYigwLCAwLCAwKTsgbGV0 dGVyLXNwYWNpbmc6IG5vcm1hbDsgb3JwaGFuczogYXV0bzsgdGV4dC1hbGlnbjogc3RhcnQ7IHRl eHQtaW5kZW50OiAwcHg7IHRleHQtdHJhbnNmb3JtOiBub25lOyB3aGl0ZS1zcGFjZTogbm9ybWFs OyB3aWRvd3M6IGF1dG87IHdvcmQtc3BhY2luZzogMHB4OyAtd2Via2l0LXRleHQtc3Ryb2tlLXdp ZHRoOiAwcHg7IHdvcmQtd3JhcDogYnJlYWstd29yZDsgLXdlYmtpdC1uYnNwLW1vZGU6IHNwYWNl OyAtd2Via2l0LWxpbmUtYnJlYWs6IGFmdGVyLXdoaXRlLXNwYWNlOyIgY2xhc3M9IiI+DQo8ZGl2 IHN0eWxlPSJjb2xvcjogcmdiKDAsIDAsIDApOyBsZXR0ZXItc3BhY2luZzogbm9ybWFsOyBvcnBo YW5zOiBhdXRvOyB0ZXh0LWFsaWduOiBzdGFydDsgdGV4dC1pbmRlbnQ6IDBweDsgdGV4dC10cmFu c2Zvcm06IG5vbmU7IHdoaXRlLXNwYWNlOiBub3JtYWw7IHdpZG93czogYXV0bzsgd29yZC1zcGFj aW5nOiAwcHg7IC13ZWJraXQtdGV4dC1zdHJva2Utd2lkdGg6IDBweDsgd29yZC13cmFwOiBicmVh ay13b3JkOyAtd2Via2l0LW5ic3AtbW9kZTogc3BhY2U7IC13ZWJraXQtbGluZS1icmVhazogYWZ0 ZXItd2hpdGUtc3BhY2U7IiBjbGFzcz0iIj4NCjxkaXYgY2xhc3M9IiI+LS08L2Rpdj4NCjxkaXYg Y2xhc3M9IiI+LVRvZGQgU2hvcnQ8L2Rpdj4NCjxkaXYgY2xhc3M9IiI+Ly8gPGEgaHJlZj0ibWFp bHRvOnRzaG9ydEBha2FtYWkuY29tIiBjbGFzcz0iIj50c2hvcnRAYWthbWFpLmNvbTwvYT48L2Rp dj4NCjxkaXYgY2xhc3M9IiI+Ly8gJnF1b3Q7T25lIGlmIGJ5IGxhbmQsIHR3byBpZiBieSBzZWEs IHRocmVlIGlmIGJ5IHRoZSBJbnRlcm5ldC4mcXVvdDs8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8 L2Rpdj4NCjxkaXYgc3R5bGU9IiI+PGJyIGNsYXNzPSIiPg0KPGJsb2NrcXVvdGUgdHlwZT0iY2l0 ZSIgY2xhc3M9IiI+DQo8ZGl2IGNsYXNzPSIiPk9uIEF1ZyAxNywgMjAxOCwgYXQgMTozMiBQTSwg U2VhbiBUdXJuZXIgJmx0OzxhIGhyZWY9Im1haWx0bzpzZWFuQHNuM3JkLmNvbSIgY2xhc3M9IiI+ c2VhbkBzbjNyZC5jb208L2E+Jmd0OyB3cm90ZTo8L2Rpdj4NCjxiciBjbGFzcz0iQXBwbGUtaW50 ZXJjaGFuZ2UtbmV3bGluZSI+DQo8ZGl2IGNsYXNzPSIiPg0KPGRpdiBjbGFzcz0iIj5BdCB0aGUg VExTQElFVEYxMDIgc2Vzc2lvbiwgdGhlcmUgc2VlbWVkIHRvIGJlIHNvbWUgaW50ZXJlc3QgaW4g YWRvcHRpbmcgZHJhZnQtbW9yaWFydHktdGxzLW9sZHZlcnNpb25zLWRpZWRpZWRpZSBhcyBhIFdH IGl0ZW0uIFRoaXMgZW1haWwgaXMgdG8gZGV0ZXJtaW5lIHdoZXRoZXIgdGhlcmUgaXMgV0cgY29u c2Vuc3VzIHRvIGFkb3B0IHRoaXMgZHJhZnQgYXMgYSBXRyBpdGVtLiAmbmJzcDtJZiB5b3Ugd291 bGQgbGlrZSBmb3IgdGhpcw0KIGRyYWZ0IHRvIGJlY29tZSBhIFdHIGRvY3VtZW50IGFuZCB5b3Ug YXJlIHdpbGxpbmcgdG8gcmV2aWV3IGl0IGFzIGl0IG1vdmVzIHRocm91Z2ggdGhlIHByb2Nlc3Ms IHRoZW4gcGxlYXNlIGxldCB0aGUgbGlzdCBrbm93IGJ5IDIzNTlVVEMgMjAxODA4MzEuICZuYnNw O0lmIHlvdSBhcmUgb3Bwb3NlZCB0byB0aGlzIGJlaW5nIGEgV0cgZG9jdW1lbnQsIHBsZWFzZSBz YXkgc28gKGFuZCBzYXkgd2h5KS48YnIgY2xhc3M9IiI+DQo8YnIgY2xhc3M9IiI+DQpOb3RlIHRo YXQgd2Ugd2lsbCBzdWdnZXN0IHJlcGxhY2luZyDigJxkaWVkaWVkaWUmcXVvdDsgd2l0aCDigJxk ZXByZWNhdGUmcXVvdDsgaW4gdGhlIGFkb3B0ZWQgZHJhZnTigJlzIG5hbWUgdG8gYWRkcmVzcyB0 aGUgbmFtaW5nIGNvbW1lbnQgcmFpc2VkIGR1cmluZyB0aGUgbWVldGluZy48YnIgY2xhc3M9IiI+ DQo8YnIgY2xhc3M9IiI+DQpUaGFua3MsPGJyIGNsYXNzPSIiPg0KQ2hyaXMsIEpvZSBhbmQgU2Vh bjxiciBjbGFzcz0iIj4NCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fPGJyIGNsYXNzPSIiPg0KVExTIG1haWxpbmcgbGlzdDxiciBjbGFzcz0iIj4NCjxhIGhy ZWY9Im1haWx0bzpUTFNAaWV0Zi5vcmciIGNsYXNzPSIiPlRMU0BpZXRmLm9yZzwvYT48YnIgY2xh c3M9IiI+DQpodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3RsczxiciBjbGFz cz0iIj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjxiciBjbGFzcz0i Ij4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_0BB00AA5192E4514A11FDF14B6AA611Fakamaicom_-- From nobody Mon Aug 20 10:52:34 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B2071130E6A; Mon, 20 Aug 2018 10:52:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YIUo-R8_motw; Mon, 20 Aug 2018 10:52:30 -0700 (PDT) Received: from mx1.redhat.com (mx3-rdu2.redhat.com [66.187.233.73]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D09A1130E30; Mon, 20 Aug 2018 10:52:30 -0700 (PDT) Received: from smtp.corp.redhat.com (int-mx06.intmail.prod.int.rdu2.redhat.com [10.11.54.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 060CB448D5; Mon, 20 Aug 2018 17:52:30 +0000 (UTC) Received: from pintsize.usersys.redhat.com (unknown [10.43.21.250]) by smtp.corp.redhat.com (Postfix) with ESMTP id 53A052166BA1; Mon, 20 Aug 2018 17:52:28 +0000 (UTC) From: Hubert Kario To: tls@ietf.org Cc: IETF Secretariat , draft-moriarty-tls-oldversions-diediedie@ietf.org, tls-chairs@ietf.org Date: Mon, 20 Aug 2018 19:52:23 +0200 Message-ID: <10662277.xqPAvb2LZS@pintsize.usersys.redhat.com> In-Reply-To: <153452719962.17994.18295787287508064922.idtracker@ietfa.amsl.com> References: <153452719962.17994.18295787287508064922.idtracker@ietfa.amsl.com> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="nextPart13707491.aEuEFiqZbm"; micalg="pgp-sha512"; protocol="application/pgp-signature" X-Scanned-By: MIMEDefang 2.78 on 10.11.54.6 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.11.55.2]); Mon, 20 Aug 2018 17:52:30 +0000 (UTC) X-Greylist: inspected by milter-greylist-4.5.16 (mx1.redhat.com [10.11.55.2]); Mon, 20 Aug 2018 17:52:30 +0000 (UTC) for IP:'10.11.54.6' DOMAIN:'int-mx06.intmail.prod.int.rdu2.redhat.com' HELO:'smtp.corp.redhat.com' FROM:'hkario@redhat.com' RCPT:'' Archived-At: Subject: Re: [TLS] The TLS WG has placed draft-moriarty-tls-oldversions-diediedie in state "Call For Adoption By WG Issued" X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Aug 2018 17:52:33 -0000 --nextPart13707491.aEuEFiqZbm Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="UTF-8" On Friday, 17 August 2018 19:33:19 CEST IETF Secretariat wrote: > The TLS WG has placed draft-moriarty-tls-oldversions-diediedie in state > Call For Adoption By WG Issued (entered by Sean Turner) >=20 > The document is available at > https://datatracker.ietf.org/doc/draft-moriarty-tls-oldversions-diediedie/ I support the adoption. =2D-=20 Regards, Hubert Kario Senior Quality Engineer, QE BaseOS Security team Web: www.cz.redhat.com Red Hat Czech s.r.o., Purky=C5=88ova 115, 612 00 Brno, Czech Republic --nextPart13707491.aEuEFiqZbm Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part. Content-Transfer-Encoding: 7Bit -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEYeeuxEU+3unL/K+dkqjRuAHS9fUFAlt6/9cACgkQkqjRuAHS 9fXtQQ/9FRhYZEc8sX+6s/tED3snrUAfaFzB/FlH10r/d3iTbJxECs2FmF/jh0WL z7adeoOzLpF2F6b53HJnaWg/M+AlVkS7SOdGzQH+6XNlPkDVnXBk1hqSkfv/lkc1 zbMjFk+51TSm4/3fu+9gVeLhceZH/Y+olm27VzTWZd4logpesr1CylXF48FIhIB7 L4u7nZ/8xdSW1e62vNdftnWzj8GC8V8/9rCbjj8nZRiloxuFIjU0R2o2enP/W/CD W5Ubh9+1bNfMraX2aQxzfA2agGAc7Z2USUdBIBRyGJx2DT5V0hRe5+LFE2vCVPJE P1mZdwCr8UhSv89isTp5HEjC26agRGGWJUFx5/w45IyNRWi96xu5pUgtM3xGFrwL YoXa4IvHiUKE7ueUugXQnHB+KqtxXfT8W/+2Df/pMs19PgXtnF+ThAfuna6jOcm6 NAKmekBZ0wdU4HETz2J0LxOZcq6XwNpoitUT5bjuFeM1pyD0aGvWtbnkLPn21PV2 JcFx/umWLDON2KaSS8S9v0ISdXp1ewkm6CDXUn5usvsqxgfZq6qJ8Dkyg8DE/7HH lUNQr9g7cQysyzI5CZYhVVW7h1GMmdkej5sAvXGHO+hDV0g/kW4jF9cwvxmebFNS shrtcLmlPQeesQv5oct/+2Qnk6yFhlxgp+T9kiHBYuV514Dxh1g= =HyDt -----END PGP SIGNATURE----- --nextPart13707491.aEuEFiqZbm-- From nobody Mon Aug 20 13:48:09 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A2DB6130DCE for ; Mon, 20 Aug 2018 13:48:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.51 X-Spam-Level: X-Spam-Status: No, score=-14.51 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xikErQeTPPNA for ; Mon, 20 Aug 2018 13:48:05 -0700 (PDT) Received: from rcdn-iport-4.cisco.com (rcdn-iport-4.cisco.com [173.37.86.75]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 54F5912F1A5 for ; Mon, 20 Aug 2018 13:48:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=5122; q=dns/txt; s=iport; t=1534798085; x=1536007685; h=from:to:cc:subject:date:message-id:mime-version; bh=IAL33TKmuaQPYzonSNIZ2Yah0P6tTQWOh773OpvM69M=; b=KV4PgmH9sFDAcVeUOHi5isz4d9olsRvE3HQkVkn8d+YaUaIYJrjKjkDU XZ584kCXm80ONLSnbq65YNb4EMBkqZ8ALeXciWsRMsisPwztcDZF/nNzX e96+rv0KIqIS4zQxN6aOfFp3AJBavfppSgy6uNUwxnxoukbYPewuBfx/Q 4=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0D5AABOKHtb/51dJa1cGgEBAQEBAgE?= =?us-ascii?q?BAQEIAQEBAYJXeGN/MoNmiAqMHZJ5hSuBegsjhEkZgzYhNBgBAgEBAgEBAm0?= =?us-ascii?q?cAQuFYVYSAQw+AgQwHwgEDoMnAYEdZA+oDoEuhGiFcwWJGBeCAIESJx+FZwE?= =?us-ascii?q?BA4RfMYImAox3jgUJAoYniTcPBo44iwyHdQIRFIEkHTiBUnAVZQGCP4sUhT6?= =?us-ascii?q?OUIEbAQE?= X-IronPort-AV: E=Sophos;i="5.53,266,1531785600"; d="scan'208,217";a="440588988" Received: from rcdn-core-6.cisco.com ([173.37.93.157]) by rcdn-iport-4.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 20 Aug 2018 20:48:04 +0000 Received: from XCH-RTP-015.cisco.com (xch-rtp-015.cisco.com [64.101.220.155]) by rcdn-core-6.cisco.com (8.15.2/8.15.2) with ESMTPS id w7KKm3O0008705 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL); Mon, 20 Aug 2018 20:48:04 GMT Received: from xch-rtp-015.cisco.com (64.101.220.155) by XCH-RTP-015.cisco.com (64.101.220.155) with Microsoft SMTP Server (TLS) id 15.0.1320.4; Mon, 20 Aug 2018 16:48:03 -0400 Received: from xch-rtp-015.cisco.com ([64.101.220.155]) by XCH-RTP-015.cisco.com ([64.101.220.155]) with mapi id 15.00.1320.000; Mon, 20 Aug 2018 16:48:03 -0400 From: "Nancy Cam-Winget (ncamwing)" To: "tls@ietf.org" Thread-Topic: integrity only ciphersuites Thread-Index: AQHUOMcWIQ0ztQCz9UKccOekmBKudw== Date: Mon, 20 Aug 2018 20:48:03 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.c.0.180410 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.155.208.72] Content-Type: multipart/alternative; boundary="_000_E29465D4E4C5466F9E3F240E258DC7C2ciscocom_" MIME-Version: 1.0 X-Outbound-SMTP-Client: 64.101.220.155, xch-rtp-015.cisco.com X-Outbound-Node: rcdn-core-6.cisco.com Archived-At: Subject: [TLS] integrity only ciphersuites X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Aug 2018 20:48:08 -0000 --_000_E29465D4E4C5466F9E3F240E258DC7C2ciscocom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 QWxsLA0KQSBjb3VwbGUgSW9UIGNvbnNvcnRpdW1zIGFyZSB0cnlpbmcgdG8gZW1icmFjZSB0aGUg aW1wcm92ZW1lbnRzIG1hZGUgdG8gVExTIDEuMyBhbmQgYXMgdGhleSBkZWZpbmUgdGhlaXIgbmV3 IHNlY3VyaXR5IGNvbnN0cnVjdHMgd291bGQgbGlrZSB0byBhZG9wdCB0aGUgbGF0ZXN0IHByb3Rv Y29scywgaW4gdGhpcyBjYXNlIFRMUyAxLjMuICAgVG8gdGhhdCBleHRlbnQsIHRoZXkgaGF2ZSBh IHN0cm9uZyBuZWVkIGZvciBtdXR1YWwgYXV0aGVudGljYXRpb24sIGJ1dCBpbnRlZ3JpdHkgb25s eSAobm8gY29uZmlkZW50aWFsaXR5KSByZXF1aXJlbWVudHMuDQoNCkluIGZvbGxvd2luZyB0aGUg bmV3IElBTkEgcnVsZXMsIHdlIGhhdmUgcG9zdGVkIHRoZSBkcmFmdCBodHRwczovL3Rvb2xzLmll dGYub3JnL2h0bWwvZHJhZnQtY2Ftd2luZ2V0LXRscy10czEzLW1hY2NpcGhlcnN1aXRlcy0wMCB0 byBkb2N1bWVudCByZXF1ZXN0IGZvciByZWdpc3RyYXRpb25zIG9mIEhNQUMgYmFzZWQgY2lwaGVy IHNlbGVjdGlvbnMgd2l0aCBUTFMgMS4z4oCmLi5hbmQgYXJlIHNvbGljaXRpbmcgZmVlZGJhY2sg ZnJvbSB0aGUgV0cgb24gdGhlIGRyYWZ0IGFuZCBpdHMgcGF0aCBmb3J3YXJkLg0KDQpXYXJtIHJl Z2FyZHMsIE5hbmN5IChhbmQgSmFjaykNCg== --_000_E29465D4E4C5466F9E3F240E258DC7C2ciscocom_ Content-Type: text/html; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2 IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToy IDE1IDUgMiAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3Jt YWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1i b3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJp IixzYW5zLXNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXBy aW9yaXR5Ojk5Ow0KCWNvbG9yOiMwNTYzQzE7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9 DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9y aXR5Ojk5Ow0KCWNvbG9yOiM5NTRGNzI7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpw Lm1zb25vcm1hbDAsIGxpLm1zb25vcm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1u YW1lOm1zb25vcm1hbDsNCgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6 MGluOw0KCW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglm b250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnNw YW4uRW1haWxTdHlsZTE4DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsOw0KCWZvbnQtZmFtaWx5 OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0KLk1zb0NocERlZmF1 bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1zaXplOjEwLjBwdDsNCglm b250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7 c2l6ZTo4LjVpbiAxMS4waW47DQoJbWFyZ2luOjEuMGluIDEuMGluIDEuMGluIDEuMGluO30NCmRp di5Xb3JkU2VjdGlvbjENCgl7cGFnZTpXb3JkU2VjdGlvbjE7fQ0KLS0+PC9zdHlsZT4NCjwvaGVh ZD4NCjxib2R5IGxhbmc9IkVOLVVTIiBsaW5rPSIjMDU2M0MxIiB2bGluaz0iIzk1NEY3MiI+DQo8 ZGl2IGNsYXNzPSJXb3JkU2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQiPkFsbCw8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+QSBjb3VwbGUgSW9U IGNvbnNvcnRpdW1zIGFyZSB0cnlpbmcgdG8gZW1icmFjZSB0aGUgaW1wcm92ZW1lbnRzIG1hZGUg dG8gVExTIDEuMyBhbmQgYXMgdGhleSBkZWZpbmUgdGhlaXIgbmV3IHNlY3VyaXR5IGNvbnN0cnVj dHMgd291bGQgbGlrZSB0byBhZG9wdCB0aGUgbGF0ZXN0IHByb3RvY29scywgaW4gdGhpcyBjYXNl IFRMUyAxLjMuJm5ic3A7Jm5ic3A7IFRvIHRoYXQgZXh0ZW50LA0KIHRoZXkgaGF2ZSBhIHN0cm9u ZyBuZWVkIGZvciBtdXR1YWwgYXV0aGVudGljYXRpb24sIGJ1dCBpbnRlZ3JpdHkgb25seSAobm8g Y29uZmlkZW50aWFsaXR5KSByZXF1aXJlbWVudHMuJm5ic3A7DQo8bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+ PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPkluIGZvbGxvd2luZyB0aGUgbmV3IElBTkEgcnVsZXMs IHdlIGhhdmUgcG9zdGVkIHRoZSBkcmFmdA0KPGEgaHJlZj0iaHR0cHM6Ly90b29scy5pZXRmLm9y Zy9odG1sL2RyYWZ0LWNhbXdpbmdldC10bHMtdHMxMy1tYWNjaXBoZXJzdWl0ZXMtMDAiPg0KaHR0 cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LWNhbXdpbmdldC10bHMtdHMxMy1tYWNjaXBo ZXJzdWl0ZXMtMDA8L2E+IHRvIGRvY3VtZW50IHJlcXVlc3QgZm9yIHJlZ2lzdHJhdGlvbnMgb2Yg SE1BQyBiYXNlZCBjaXBoZXIgc2VsZWN0aW9ucyB3aXRoIFRMUyAxLjPigKYuLmFuZCBhcmUgc29s aWNpdGluZyBmZWVkYmFjayBmcm9tIHRoZSBXRyBvbiB0aGUgZHJhZnQgYW5kIGl0cyBwYXRoIGZv cndhcmQuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij5XYXJtIHJl Z2FyZHMsIE5hbmN5IChhbmQgSmFjayk8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwv Ym9keT4NCjwvaHRtbD4NCg== --_000_E29465D4E4C5466F9E3F240E258DC7C2ciscocom_-- From nobody Mon Aug 20 13:58:45 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 055B6128BAC for ; Mon, 20 Aug 2018 13:58:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.909 X-Spam-Level: X-Spam-Status: No, score=-1.909 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, T_DKIMWL_WL_MED=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Y1Mq8_CovUHV for ; Mon, 20 Aug 2018 13:58:41 -0700 (PDT) Received: from mail-lf1-x135.google.com (mail-lf1-x135.google.com [IPv6:2a00:1450:4864:20::135]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 596F8124C04 for ; Mon, 20 Aug 2018 13:58:41 -0700 (PDT) Received: by mail-lf1-x135.google.com with SMTP id i7-v6so2369170lfh.5 for ; Mon, 20 Aug 2018 13:58:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=wDWyNX6oYUL9ukmMJGUnBjE9VYgeEUUwMJhtRUJzLlc=; b=lzmnz8QM4dW2x1qRdCtq3RcrMG7Vg6x7Vlz/sW5LO3IhG+Kp2yW8HgKuJ/xSBWzkqw UzxRGnzSZiz4pyA8WT1njx+FF9aA74+7x6lEdiCQefdz5TtU8+mWwpefk+J6B0t3UPgH RHcTQBtqSyiMAeIz/vrb2dmYbygkmDO4sOxegUwO92OFcjnSHoUKYnhNTKRQD0RlD3OK yM3QQFNKRfRqA1oavq4/BxUNVd6eDGW03CokOStIIkFB6EVbDyutzzRGPtJ95LFf9Z+q fiApy3fM5YtXSIeV0IYpyVR8hTX5L3kye+/UILb+zxm8Y6zIKvCJrfpQ2jhBmgcNU3VD I2jg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=wDWyNX6oYUL9ukmMJGUnBjE9VYgeEUUwMJhtRUJzLlc=; b=qVfXIexIve37cscvtowIhbRTEci3PuWzbIsgwMwZ23OQ6HhfQBx4O+C9pGc0PorII6 ukxLqj0IhGiUBbPtX5p8scZV+asbvXHdbZDmv1rot1yM9A1KgiN7RJblODQaPr+613MX 3V0v9zdrg0trqOxjib91LeeAzeYXQtd+J30erBJkpyBFPvbf1YWbI+8pT4JOc+l/YCeT 2G1RoBWkY98OmM5xSyO+OHeWJcGeH1CgC/Ry1ux79c8wUJRtCXWzNS5Sc6N0OoBgz75w b7W9YO3n/7gkFYSt3S3KCP/jr1OigGuaocn52vRKV2xiNVENxzNzOW6TIEVJeIqn3oVX jfVQ== X-Gm-Message-State: AOUpUlGD6TOlS2jpBdRXvKsZwV1mlQaxAD2znXh6mlOf7oOLfANOC0L4 8H3ej6wDDmyyvWSkOQzjGEC7SzPMARanHmMUfDSqH7ZCSw8= X-Google-Smtp-Source: AA+uWPynHv1IM8B6duH8piAd0hlYhC8o039qykmS7P3zJj4MfLwKS246Cv7udiDcwk1ojXbQwvCgncMIsVnEmfSFUII= X-Received: by 2002:a19:d095:: with SMTP id h143-v6mr29774898lfg.16.1534798719490; Mon, 20 Aug 2018 13:58:39 -0700 (PDT) MIME-Version: 1.0 Received: by 2002:ab3:4091:0:0:0:0:0 with HTTP; Mon, 20 Aug 2018 13:57:58 -0700 (PDT) In-Reply-To: References: From: Eric Rescorla Date: Mon, 20 Aug 2018 13:57:58 -0700 Message-ID: To: "Nancy Cam-Winget (ncamwing)" Cc: "tls@ietf.org" Content-Type: multipart/alternative; boundary="0000000000007a327c0573e42ce9" Archived-At: Subject: Re: [TLS] integrity only ciphersuites X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Aug 2018 20:58:44 -0000 --0000000000007a327c0573e42ce9 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Mon, Aug 20, 2018 at 1:48 PM, Nancy Cam-Winget (ncamwing) < ncamwing=3D40cisco.com@dmarc.ietf.org> wrote: > All, > > A couple IoT consortiums are trying to embrace the improvements made to > TLS 1.3 and as they define their new security constructs would like to > adopt the latest protocols, in this case TLS 1.3. To that extent, they > have a strong need for mutual authentication, but integrity only (no > confidentiality) requirements. > > > > In following the new IANA rules, we have posted the draft > https://tools.ietf.org/html/draft-camwinget-tls-ts13-macciphersuites-00 > to document request for registrations of HMAC based cipher selections wit= h > TLS 1.3=E2=80=A6..and are soliciting feedback from the WG on the draft an= d its path > forward. > Nancy, As you say, you don't need WG approval for code point registration as long as you don't want Recommended status. With that said, I don't think this document makes a very strong case for these cipher suites. Essentially you say: 1. We don't need confidentiality 2. Code footprint is important Generally, I'm not very enthusiastic about argument (1). It's often the case that applications superficially need integrity but actually rely on confidentiality in some way (the obvious case is that HTTP Cookies are an authentication mechanism, but because they are a bearer token, you actually need confidentiatilty). It's much easier to just always supply confidentiality than to try to reason about when it is or is not needed. The second argument is that you are trying to keep code size down. It's true that not having AES is cheaper than having AES, but it's possible to have very lightweight AES stacks (see for instance: https://github.com/01org/tinycrypt). So, overall, this doesn't seem very compelling. -Ekr > > Warm regards, Nancy (and Jack) > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > > --0000000000007a327c0573e42ce9 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


On Mon, Aug 20, 2018 at 1:48 PM, Nancy Cam-Winget (ncamwing) <ncamwing=3D40cisco.com@dmarc.ietf.org> wrote:

All,

A couple IoT consorti= ums are trying to embrace the improvements made to TLS 1.3 and as they defi= ne their new security constructs would like to adopt the latest protocols, = in this case TLS 1.3.=C2=A0=C2=A0 To that extent, they have a strong need for mutual authentication, but integrity only (no = confidentiality) requirements.=C2=A0

=C2=A0<= /p>


In following the new = IANA rules, we have posted the draft https://tools.ietf.org/html/draft-camwinget-tls-ts13-macciphersui= tes-00 to document request for registrations of HMAC based cipher selec= tions with TLS 1.3=E2=80=A6..and are soliciting feedback from the WG on the= draft and its path forward.


Nancy,

As you say, you don't need WG = approval for code point registration as long as you don't want Recommen= ded status.

With that said, I don't think = this document makes a very strong case for these cipher suites. Essentially= you say:

1. We don't need confidentiality
2. Code footprint is important

Generally, I= 'm not very enthusiastic about argument (1). It's often the case th= at applications superficially need integrity but actually rely on confident= iality in some way (the obvious case is that HTTP Cookies are an authentica= tion mechanism, but because they are a bearer token, you actually need conf= identiatilty). It's much easier to just always supply confidentiality t= han to try to reason about when it is or is not needed.

The second argument is that you are trying to keep code size down. It= 's true that not having AES is cheaper than having AES, but it's po= ssible to have very lightweight AES stacks (see for instance: https://github.com/01org/tinycrypt).<= /div>

So, overall, this doesn't seem very compelling= .

-Ekr


=C2=A0<= /span>

Warm regards, Nancy (= and Jack)


_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls


--0000000000007a327c0573e42ce9-- From jmvisoky@ra.rockwell.com Mon Aug 20 14:36:08 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6BD65130DC7 for ; Mon, 20 Aug 2018 14:36:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bjv3hrQLa2rC for ; Mon, 20 Aug 2018 14:36:05 -0700 (PDT) Received: from NAM01-SN1-obe.outbound.protection.outlook.com (mail-sn1nam01on0080.outbound.protection.outlook.com [104.47.32.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0463F129619 for ; Mon, 20 Aug 2018 14:36:05 -0700 (PDT) Received: from DM5PR2201MB1433.namprd22.prod.outlook.com (10.174.186.154) by DM5PR2201MB1417.namprd22.prod.outlook.com (10.174.177.149) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1059.19; Mon, 20 Aug 2018 21:36:03 +0000 Received: from DM5PR2201MB1433.namprd22.prod.outlook.com ([fe80::49f1:7875:b984:9a65]) by DM5PR2201MB1433.namprd22.prod.outlook.com ([fe80::49f1:7875:b984:9a65%2]) with mapi id 15.20.1059.023; Mon, 20 Aug 2018 21:36:03 +0000 From: Jack Visoky To: Eric Rescorla , "Nancy Cam-Winget (ncamwing)" CC: "tls@ietf.org" Thread-Topic: EXTERNAL: Re: [TLS] integrity only ciphersuites Thread-Index: AQHUOMilgC0HRr8W2EOuV8r28re96KTJKAvw Date: Mon, 20 Aug 2018 21:36:03 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=jmvisoky@ra.rockwell.com; x-originating-ip: [205.175.250.241] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; DM5PR2201MB1417; 6:PGTW1GLcGobnBOhWZ+QQXNdVMnyYx+Ebzwit+ArFPJ97K3j3AU1w85IFhkVQ1ZXpI4UxWe2waBhSOlEAB8U+trN+92bPJ7r7V3y/aEf1PzndSvv9UuSC4CFMadSN7h/IcJ27oDF9qzeKzz7a8pxojft7voIwEfKPRCtkOQgn3N6Lr3xQL3nIfUg5a6ZzDF9hcxW4/pzO+GpGsqZvRgYdWSBh7NKTOwgJbGlPjKD3zWf7Ln9/eWkSCj6kaRP54QVyzXll+ayDuYpIcbHCfBJfBgRX0BKZfJ3jG4597rp5FFxz2kHFmv8jE2QnxJZEyjOfRcHU39XqDyCOhTzJl/7NvcK741jLVWvoSlQG8FlRM5LWEOOAnflC5KfrrvHUPllha1PSj0V7Q1QWB6XWNEAQJ/eCRXiobhZnIN3LpxcVXSdfpLOb4a7DzGu6UGJL50cJgJg5Zr9B9/G5mT8nJsEDQQ==; 5:cgRj8T0NAOMsG6nfZ4ZBUVPHS09JV7AgizqqEfRYfc05bkLPptKlIYbVTpBHOpysD5yftienqTncdydKBNMZtAZZzBzLgmLNbf7bsJ4hJ1A8BMVbujdrApfPAZpAv4tRdrhIawh+SgXHfQc2bCl6+GQxRtkYv0ev69Vko77EgO8=; 7:yPn7UF1henCBtupS5NhkkZPyAfY9y+eE9uSJUJ6KnyfaTUam3eiQW9U9Jf9ZmcjfUmZINHgEbpj+ZfRt/1Jdjg1FRJfBOLyzTI6Tl3Avp+kXUov5bgsKXAlttrvchKSjd877REJo2uC6jZ4WzrxsR6LP9lHD0Py/XwUo6YoynkdvYT0pE5ElmLfOpuuy7DJg2Qge3xR/AahWN6wTZtTT81VBdsqEKHupjK6lzlsmc30IjwabIuDe8fMDCMB1DtZk x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-correlation-id: 0451921c-9d02-4c13-0bfa-08d606e4edec x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(7020095)(4652040)(8989137)(4534165)(4627221)(201703031133081)(201702281549075)(8990107)(5600074)(711020)(4618075)(2017052603328)(7153060)(7193020); SRVR:DM5PR2201MB1417; x-ms-traffictypediagnostic: DM5PR2201MB1417: x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(278428928389397)(166708455590820)(192374486261705); x-ms-exchange-senderadcheck: 1 x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(8211001083)(6040522)(2401047)(5005006)(8121501046)(10201501046)(93006095)(93001095)(3231311)(944501410)(52105095)(3002001)(6055026)(149027)(150027)(6041310)(20161123564045)(20161123562045)(20161123560045)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123558120)(201708071742011)(7699016); SRVR:DM5PR2201MB1417; BCL:0; PCL:0; RULEID:; SRVR:DM5PR2201MB1417; x-forefront-prvs: 0770F75EA9 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(376002)(346002)(136003)(396003)(39860400002)(366004)(199004)(189003)(106356001)(4326008)(2906002)(53546011)(316002)(186003)(86362001)(446003)(102836004)(14444005)(5024004)(8676002)(256004)(6506007)(110136005)(476003)(66066001)(14454004)(97736004)(105586002)(966005)(6436002)(81156014)(478600001)(81166006)(53936002)(11346002)(229853002)(76176011)(7696005)(3846002)(33656002)(486006)(2900100001)(99286004)(6116002)(5660300001)(5250100002)(68736007)(9686003)(26005)(25786009)(305945005)(7736002)(6306002)(8936002)(55016002)(74316002)(6246003); DIR:OUT; SFP:1101; SCL:1; SRVR:DM5PR2201MB1417; H:DM5PR2201MB1433.namprd22.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: ra.rockwell.com does not designate permitted sender hosts) x-microsoft-antispam-message-info: /1SwkEuFBfISuMo8CP8TDijb7tWPcTgsh9LsmeOqKhDaa0Z+Br3PbSrw5v3LjTH7gNFKNMrr6es8JrhdQ3Q2rIL3AnaQzfKjICOltBVW87gBcRzzelImgS4pntNR7UVzrJLXfUVdlXLTYufEAgSaUQ/Rswb+38emqnTEToltxRSmvhdCcSBCq3y95tkV2UXwVerLmJARTWxqZz3Df79o98RDRAUM8gtVPqdvN1EzKjHtcLN2Dm6A59sViurt+UtCDxEYnnekfSPBFQWAJ8u+YMhzWBwgUQqN1cLU/WvpRjrfP6g1zLHT+IdtlMFYs9w1CR5R0WdY6sG2g1I5uQardvVs3XfTcxuc0wTaL2DFDXk= spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: ra.rockwell.com X-MS-Exchange-CrossTenant-Network-Message-Id: 0451921c-9d02-4c13-0bfa-08d606e4edec X-MS-Exchange-CrossTenant-originalarrivaltime: 20 Aug 2018 21:36:03.2072 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 855b093e-7340-45c7-9f0c-96150415893e X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM5PR2201MB1417 Archived-At: Subject: Re: [TLS] EXTERNAL: Re: integrity only ciphersuites X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Aug 2018 21:37:38 -0000 SGkgRXJpYywNCg0KVGhhbmtzIGZvciB5b3VyIGZlZWRiYWNrLiAgSnVzdCBhIGZldyBwb2ludHMg dG8gYWRkOg0KDQoxLiBUaGVyZSByZWFsbHkgYXJlIHNvbWUgYXBwbGljYXRpb25zIHdoZXJlIGNv bmZpZGVudGlhbGl0eSBpc27igJl0IGltcG9ydGFudCwgZm9yIGV4YW1wbGUgc29tZSBtb3Rpb24g Y29udHJvbCB0aGF0IG1pZ2h0IGludm9sdmUgdmVyeSBzaW1wbGUgbW92ZSBpbnN0cnVjdGlvbnMg KGUuZy4gZ28gdG8gWCwgZ28gdG8gWSwgZ28gdG8gWiwgcmVwZWF0KS4gIENlcnRhaW5seSB0aGVy ZSBhcmUgYWxzbyBhcHBsaWNhdGlvbnMgdGhhdCB3b3VsZCBiZW5lZml0IGZyb20gY29uZmlkZW50 aWFsaXR5LCBidXQgdGhlcmXigJlzIGEgbm9uLXRyaXZpYWwgYW1vdW50IHRoYXQgcmVhbGx5IGdh aW4gbGl0dGxlIHRvIG5vdGhpbmcuDQoyLiBJbiBzb21lIGNhc2VzIHRoZSBjb2RlIHNpemUgaXMg cXVpdGUgaW1wb3J0YW50LiAgSXTigJlzIG5vdCB1bmNvbW1vbiBmb3IgaGFyZHdhcmUgdG8gYmUg aW4gdGhlIGZpZWxkIGluIEluZHVzdHJpYWwgQXV0b21hdGlvbiBmb3IgMTUgb3IgbW9yZSB5ZWFy cywgc28gaW4gc29tZSBjYXNlcyB0aGUgaGFyZHdhcmUgaXMgYWxyZWFkeSBzdHJldGNoZWQgcHJl dHR5IHRoaW4gYW5kIG1pZ2h0IG5vdCBiZSBhYmxlIHRvIGhhbmRsZSB0aGUgZGVtYW5kcyBvZiBl bmNyeXB0aW9uLiAgQXQgdGhlIHNhbWUgdGltZSBpdCBpcyBodWdlbHkgYmVuZWZpY2lhbCB0byB0 YWtlIGFkdmFudGFnZSBvZiB0aGUgc2VjdXJpdHkgb2YgVExTIGZvciBtYW55IG9mIHRoZXNlIGlu c3RhbGxhdGlvbnMuDQozLiBBbm90aGVyIHVzZSBjYXNlIGZvciB0aGVzZSBOVUxMIGVuY3J5cHRp b24gc3VpdGVzIGlzIGFyb3VuZCBpbnNwZWN0aW9uIG9mIGRhdGEuICBJIHRoaW5rIHRoaXMgaGFz IGJlZW4gZGlzY3Vzc2VkIGluIHRoaXMgZm9ydW0gYWxyZWFkeSwgYnV0IHRoZXNlIGNpcGhlciBz dWl0ZXMgY291bGQgc3VwcG9ydCB0aGF0IGFzIHdlbGwuDQoNClRoYW5rcyBhbmQgQmVzdCBSZWdh cmRzLA0KDQpKYWNrIFZpc29reQ0KU2VjdXJpdHkgQXJjaGl0ZWN0IGFuZCBTci4gUHJvamVjdCBF bmdpbmVlcg0KQ29tbW9uIEFyY2hpdGVjdHVyZSBhbmQgVGVjaG5vbG9neSBHcm91cA0KUm9ja3dl bGwgQXV0b21hdGlvbiB8IDEgQWxsZW4tQnJhZGxleSBEcml2ZSB8IE1heWZpZWxkIEhlaWdodHMs IE9IIDQ0MTI0DQoNCg0KDQpGcm9tOiBUTFMgW21haWx0bzp0bHMtYm91bmNlc0BpZXRmLm9yZ10g T24gQmVoYWxmIE9mIEVyaWMgUmVzY29ybGENClNlbnQ6IE1vbmRheSwgQXVndXN0IDIwLCAyMDE4 IDQ6NTggUE0NClRvOiBOYW5jeSBDYW0tV2luZ2V0IChuY2Ftd2luZykgPG5jYW13aW5nPTQwY2lz Y28uY29tQGRtYXJjLmlldGYub3JnPg0KQ2M6IHRsc0BpZXRmLm9yZw0KU3ViamVjdDogRVhURVJO QUw6IFJlOiBbVExTXSBpbnRlZ3JpdHkgb25seSBjaXBoZXJzdWl0ZXMNCg0KW1VzZSBjYXV0aW9u IHdpdGggbGlua3MgJiBhdHRhY2htZW50c10NCsKgDQoNCg0KT24gTW9uLCBBdWcgMjAsIDIwMTgg YXQgMTo0OCBQTSwgTmFuY3kgQ2FtLVdpbmdldCAobmNhbXdpbmcpIDxuY2Ftd2luZz00MGNpc2Nv LmNvbUBkbWFyYy5pZXRmLm9yZz4gd3JvdGU6DQpBbGwsDQpBIGNvdXBsZSBJb1QgY29uc29ydGl1 bXMgYXJlIHRyeWluZyB0byBlbWJyYWNlIHRoZSBpbXByb3ZlbWVudHMgbWFkZSB0byBUTFMgMS4z IGFuZCBhcyB0aGV5IGRlZmluZSB0aGVpciBuZXcgc2VjdXJpdHkgY29uc3RydWN0cyB3b3VsZCBs aWtlIHRvIGFkb3B0IHRoZSBsYXRlc3QgcHJvdG9jb2xzLCBpbiB0aGlzIGNhc2UgVExTIDEuMy7C oMKgIFRvIHRoYXQgZXh0ZW50LCB0aGV5IGhhdmUgYSBzdHJvbmcgbmVlZCBmb3IgbXV0dWFsIGF1 dGhlbnRpY2F0aW9uLCBidXQgaW50ZWdyaXR5IG9ubHkgKG5vIGNvbmZpZGVudGlhbGl0eSkgcmVx dWlyZW1lbnRzLsKgIA0KwqANCg0KSW4gZm9sbG93aW5nIHRoZSBuZXcgSUFOQSBydWxlcywgd2Ug aGF2ZSBwb3N0ZWQgdGhlIGRyYWZ0IGh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1j YW13aW5nZXQtdGxzLXRzMTMtbWFjY2lwaGVyc3VpdGVzLTAwIHRvIGRvY3VtZW50IHJlcXVlc3Qg Zm9yIHJlZ2lzdHJhdGlvbnMgb2YgSE1BQyBiYXNlZCBjaXBoZXIgc2VsZWN0aW9ucyB3aXRoIFRM UyAxLjPigKYuLmFuZCBhcmUgc29saWNpdGluZyBmZWVkYmFjayBmcm9tIHRoZSBXRyBvbiB0aGUg ZHJhZnQgYW5kIGl0cyBwYXRoIGZvcndhcmQuDQoNCk5hbmN5LA0KDQpBcyB5b3Ugc2F5LCB5b3Ug ZG9uJ3QgbmVlZCBXRyBhcHByb3ZhbCBmb3IgY29kZSBwb2ludCByZWdpc3RyYXRpb24gYXMgbG9u ZyBhcyB5b3UgZG9uJ3Qgd2FudCBSZWNvbW1lbmRlZCBzdGF0dXMuDQoNCldpdGggdGhhdCBzYWlk LCBJIGRvbid0IHRoaW5rIHRoaXMgZG9jdW1lbnQgbWFrZXMgYSB2ZXJ5IHN0cm9uZyBjYXNlIGZv ciB0aGVzZSBjaXBoZXIgc3VpdGVzLiBFc3NlbnRpYWxseSB5b3Ugc2F5Og0KDQoxLiBXZSBkb24n dCBuZWVkIGNvbmZpZGVudGlhbGl0eQ0KMi4gQ29kZSBmb290cHJpbnQgaXMgaW1wb3J0YW50DQoN CkdlbmVyYWxseSwgSSdtIG5vdCB2ZXJ5IGVudGh1c2lhc3RpYyBhYm91dCBhcmd1bWVudCAoMSku IEl0J3Mgb2Z0ZW4gdGhlIGNhc2UgdGhhdCBhcHBsaWNhdGlvbnMgc3VwZXJmaWNpYWxseSBuZWVk IGludGVncml0eSBidXQgYWN0dWFsbHkgcmVseSBvbiBjb25maWRlbnRpYWxpdHkgaW4gc29tZSB3 YXkgKHRoZSBvYnZpb3VzIGNhc2UgaXMgdGhhdCBIVFRQIENvb2tpZXMgYXJlIGFuIGF1dGhlbnRp Y2F0aW9uIG1lY2hhbmlzbSwgYnV0IGJlY2F1c2UgdGhleSBhcmUgYSBiZWFyZXIgdG9rZW4sIHlv dSBhY3R1YWxseSBuZWVkIGNvbmZpZGVudGlhdGlsdHkpLiBJdCdzIG11Y2ggZWFzaWVyIHRvIGp1 c3QgYWx3YXlzIHN1cHBseSBjb25maWRlbnRpYWxpdHkgdGhhbiB0byB0cnkgdG8gcmVhc29uIGFi b3V0IHdoZW4gaXQgaXMgb3IgaXMgbm90IG5lZWRlZC4NCg0KVGhlIHNlY29uZCBhcmd1bWVudCBp cyB0aGF0IHlvdSBhcmUgdHJ5aW5nIHRvIGtlZXAgY29kZSBzaXplIGRvd24uIEl0J3MgdHJ1ZSB0 aGF0IG5vdCBoYXZpbmcgQUVTIGlzIGNoZWFwZXIgdGhhbiBoYXZpbmcgQUVTLCBidXQgaXQncyBw b3NzaWJsZSB0byBoYXZlIHZlcnkgbGlnaHR3ZWlnaHQgQUVTIHN0YWNrcyAoc2VlIGZvciBpbnN0 YW5jZTogaHR0cHM6Ly9naXRodWIuY29tLzAxb3JnL3RpbnljcnlwdCkuDQoNClNvLCBvdmVyYWxs LCB0aGlzIGRvZXNuJ3Qgc2VlbSB2ZXJ5IGNvbXBlbGxpbmcuLg0KDQotRWtyDQoNCg0KDQrCoA0K V2FybSByZWdhcmRzLCBOYW5jeSAoYW5kIEphY2spDQoNCl9fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fDQpUTFMgbWFpbGluZyBsaXN0DQpUTFNAaWV0Zi5vcmcN Cmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vdGxzDQoNCg== From nobody Mon Aug 20 15:30:16 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 43E8C130EB1 for ; Mon, 20 Aug 2018 15:30:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.909 X-Spam-Level: X-Spam-Status: No, score=-1.909 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, T_DKIMWL_WL_MED=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rwSmL_vIRzVV for ; Mon, 20 Aug 2018 15:30:04 -0700 (PDT) Received: from mail-lj1-x244.google.com (mail-lj1-x244.google.com [IPv6:2a00:1450:4864:20::244]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 64BAC130DF0 for ; Mon, 20 Aug 2018 15:30:03 -0700 (PDT) Received: by mail-lj1-x244.google.com with SMTP id v9-v6so12809248ljk.4 for ; Mon, 20 Aug 2018 15:30:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=cKISf3//fg5Hcymqa3JgqcEpuPWxAy9Zm6uNaTHISbg=; b=EnR7yCkeCclj9oylWURHaGgkrQLbYh0Ut8EAhFZqbZp5IOBibE4I2+o7DBa791qlBG avcjCHRJ7s9Dlxn4+f4LCCbBSETDN5P/Uz174u12PIY/fodcincpfoOeAPBDGxGHUyzy pCYVFhvAn4xz8FD3Hc7cwB+BG4YMK7jA2BYxsUg3fHY6B0yB6WNHA4JoErZpk+9OlIzR w74oNO9BS2pKRJMGur9aPgyCNhrxhE/k0c+H+YbUwW6f4s+q2lo5d/45GrlNZxR335uI HpTbsOSg+aa9uy3u44mPw/hyRfHfO1NAkIT3NhloQvvLp7a8Aot+D2cCpNpVY5rJ27T9 F3MA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=cKISf3//fg5Hcymqa3JgqcEpuPWxAy9Zm6uNaTHISbg=; b=Iq7s21N9y1oBOd43aqBHMxppvisKUapexLCSqxr6QsQDxUQw1UMpDM6jmC5rdAgUIo 0TN6UWj1Jpadesqm/nIf1AKQHHOEbvIDIkKH8i3JTMWFRd7uSN661X/M++rvkkmirtdF twkHVqWPIPZPHymLlClDIVMiOTNgaijZXX2m4/x6zmculMdQsnxCdxapBypBxYBfXzC9 cCnCe3+UBDibQ2k0CI48U3/42X0PACQN/CFbu4ogqT3sSSeJ8yOgFp4hWQ6bKHvrK/1W IJlQm83nftq12fliPEDB1zwPB9P7H+YRaRfGk+TSOpjxpxVSzu0L5wqzMWiU0lpRVk33 l44g== X-Gm-Message-State: APzg51AxMn/ZdKA04SbcZ/A5MhUx0S1j+xqRBorzb+9QXxOTk98hDYXk u1M64EkygEWJ+LmTvMPry8vQ3sdibTzwr6eXVv/0Bw== X-Google-Smtp-Source: ANB0VdZv1EcoBGyClnQ0pgxnduqtPGmAw6xOxH+TZ9pweh133g9vBBd3WEPfEbmpayG2ikOArDIOVn1v6iV2nLdE89s= X-Received: by 2002:a2e:1bd7:: with SMTP id c84-v6mr606062ljf.0.1534804201536; Mon, 20 Aug 2018 15:30:01 -0700 (PDT) MIME-Version: 1.0 Received: by 2002:ab3:4091:0:0:0:0:0 with HTTP; Mon, 20 Aug 2018 15:29:20 -0700 (PDT) In-Reply-To: References: From: Eric Rescorla Date: Mon, 20 Aug 2018 15:29:20 -0700 Message-ID: To: Jack Visoky Cc: "Nancy Cam-Winget (ncamwing)" , "tls@ietf.org" Content-Type: multipart/alternative; boundary="0000000000003b937f0573e57327" Archived-At: Subject: Re: [TLS] EXTERNAL: Re: integrity only ciphersuites X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Aug 2018 22:30:12 -0000 --0000000000003b937f0573e57327 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Mon, Aug 20, 2018 at 2:36 PM, Jack Visoky wrote: > Hi Eric, > > Thanks for your feedback. Just a few points to add: > > 1. There really are some applications where confidentiality isn=E2=80=99t > important, for example some motion control that might involve very simple > move instructions (e.g. go to X, go to Y, go to Z, repeat). Certainly > there are also applications that would benefit from confidentiality, but > there=E2=80=99s a non-trivial amount that really gain little to nothing. > Why do you think this isn't sensitive information? I can imagine scenarios where it's not, but it also might be, as, for instance, it leaks the level of activity of the device. 2. In some cases the code size is quite important. It=E2=80=99s not uncomm= on for > hardware to be in the field in Industrial Automation for 15 or more years= , > so in some cases the hardware is already stretched pretty thin and might > not be able to handle the demands of encryption. At the same time it is > hugely beneficial to take advantage of the security of TLS for many of > these installations. > This seems not very specific. Can you provide some actual numbers for the difference in code size to have encryption as a fraction of the total code size? > 3. Another use case for these NULL encryption suites is around inspection > of data. I think this has been discussed in this forum already, but thes= e > cipher suites could support that as well. > Supporting this use case is not really a priority for this WG. In fact, it's part of why we removed these ciphers in TLS 1.3. -Ekr > Thanks and Best Regards, > > Jack Visoky > Security Architect and Sr. Project Engineer > Common Architecture and Technology Group > Rockwell Automation | 1 Allen-Bradley Drive | Mayfield Heights, OH 44124 > > > > From: TLS [mailto:tls-bounces@ietf.org] On Behalf Of Eric Rescorla > Sent: Monday, August 20, 2018 4:58 PM > To: Nancy Cam-Winget (ncamwing) > Cc: tls@ietf.org > Subject: EXTERNAL: Re: [TLS] integrity only ciphersuites > > [Use caution with links & attachments] > > > > On Mon, Aug 20, 2018 at 1:48 PM, Nancy Cam-Winget (ncamwing) 40cisco.com@dmarc.ietf.org> wrote: > All, > A couple IoT consortiums are trying to embrace the improvements made to > TLS 1.3 and as they define their new security constructs would like to > adopt the latest protocols, in this case TLS 1.3. To that extent, they > have a strong need for mutual authentication, but integrity only (no > confidentiality) requirements. > > > In following the new IANA rules, we have posted the draft > https://tools.ietf.org/html/draft-camwinget-tls-ts13-macciphersuites-00 > to document request for registrations of HMAC based cipher selections wit= h > TLS 1.3=E2=80=A6..and are soliciting feedback from the WG on the draft an= d its path > forward. > > Nancy, > > As you say, you don't need WG approval for code point registration as lon= g > as you don't want Recommended status. > > With that said, I don't think this document makes a very strong case for > these cipher suites. Essentially you say: > > 1. We don't need confidentiality > 2. Code footprint is important > > Generally, I'm not very enthusiastic about argument (1). It's often the > case that applications superficially need integrity but actually rely on > confidentiality in some way (the obvious case is that HTTP Cookies are an > authentication mechanism, but because they are a bearer token, you actual= ly > need confidentiatilty). It's much easier to just always supply > confidentiality than to try to reason about when it is or is not needed. > > The second argument is that you are trying to keep code size down. It's > true that not having AES is cheaper than having AES, but it's possible to > have very lightweight AES stacks (see for instance: > https://github.com/01org/tinycrypt). > > So, overall, this doesn't seem very compelling.. > > -Ekr > > > > > Warm regards, Nancy (and Jack) > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > > --0000000000003b937f0573e57327 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


On Mon, Aug 20, 2018 at 2:36 PM, Jack Visoky <jmvisoky@ra.rockw= ell.com> wrote:
Hi Eric,
Thanks for your feedback.=C2=A0 Just a few points to add:

1. There really are some applications where confidentiality isn=E2=80=99t i= mportant, for example some motion control that might involve very simple mo= ve instructions (e.g. go to X, go to Y, go to Z, repeat).=C2=A0 Certainly t= here are also applications that would benefit from confidentiality, but the= re=E2=80=99s a non-trivial amount that really gain little to nothing.

Why do you think this isn't sensitive in= formation? I can imagine scenarios where it's not, but it also might be= , as, for instance, it leaks the level of activity of the device.
=

2. In some cases the code size is quite important.=C2=A0 It=E2=80=99s not u= ncommon for hardware to be in the field in Industrial Automation for 15 or = more years, so in some cases the hardware is already stretched pretty thin = and might not be able to handle the demands of encryption.=C2=A0 At the sam= e time it is hugely beneficial to take advantage of the security of TLS for= many of these installations.

This seem= s not very specific. Can you provide some actual numbers for the difference= in code size to have encryption as a fraction of the total code size?
<= /div>

=C2=A0
3. Another use case for these NULL encryption suites is around inspection o= f data.=C2=A0 I think this has been discussed in this forum already, but th= ese cipher suites could support that as well.

Supporting this use case is not really a priority for this WG. In fa= ct, it's part of why we removed these ciphers in TLS 1.3.

-Ekr


Thanks and Best Regards,

Jack Visoky
Security Architect and Sr. Project Engineer
Common Architecture and Technology Group
Rockwell Automation | 1 Allen-Bradley Drive | Mayfield Heights, OH 44124


From: TLS [mailto:tls-bounces@ietf.= org] On Behalf Of Eric Rescorla
Sent: Monday, August 20, 2018 4:58 PM
To: Nancy Cam-Winget (ncamwing) <ncamwing=3D40cisco.com@dmarc.ietf.org>
Cc: tls@ietf.org
Subject: EXTERNAL: Re: [TLS] integrity only ciphersuites

[Use caution with links & attachments]
=C2=A0


On Mon, Aug 20, 2018 at 1:48 PM, Nancy Cam-Winget (ncamwing) <ncamwing= =3D40cisco.com@dmarc.iet= f.org> wrote:
All,
A couple IoT consortiums are trying to embrace the improvements made to TLS= 1.3 and as they define their new security constructs would like to adopt t= he latest protocols, in this case TLS 1.3.=C2=A0=C2=A0 To that extent, they= have a strong need for mutual authentication, but integrity only (no confi= dentiality) requirements.=C2=A0
=C2=A0

In following the new IANA rules, we have posted the draft https://tools.ietf.org/html/draft-camwing= et-tls-ts13-macciphersuites-00 to document request for registratio= ns of HMAC based cipher selections with TLS 1.3=E2=80=A6..and are solicitin= g feedback from the WG on the draft and its path forward.

Nancy,

As you say, you don't need WG approval for code point registration as l= ong as you don't want Recommended status.

With that said, I don't think this document makes a very strong case fo= r these cipher suites. Essentially you say:

1. We don't need confidentiality
2. Code footprint is important

Generally, I'm not very enthusiastic about argument (1). It's often= the case that applications superficially need integrity but actually rely = on confidentiality in some way (the obvious case is that HTTP Cookies are a= n authentication mechanism, but because they are a bearer token, you actual= ly need confidentiatilty). It's much easier to just always supply confi= dentiality than to try to reason about when it is or is not needed.

The second argument is that you are trying to keep code size down. It's= true that not having AES is cheaper than having AES, but it's possible= to have very lightweight AES stacks (see for instance: https://gi= thub.com/01org/tinycrypt).

So, overall, this doesn't seem very compelling..

-Ekr



=C2=A0
Warm regards, Nancy (and Jack)

_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls


--0000000000003b937f0573e57327-- From nobody Mon Aug 20 15:48:01 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D4246130E32 for ; Mon, 20 Aug 2018 15:47:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.91 X-Spam-Level: X-Spam-Status: No, score=-1.91 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_DKIMWL_WL_MED=-0.01] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id M7FHpfe6GP-f for ; Mon, 20 Aug 2018 15:47:56 -0700 (PDT) Received: from mail-it0-x234.google.com (mail-it0-x234.google.com [IPv6:2607:f8b0:4001:c0b::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 89A49130E22 for ; Mon, 20 Aug 2018 15:47:56 -0700 (PDT) Received: by mail-it0-x234.google.com with SMTP id h20-v6so1665387itf.2 for ; Mon, 20 Aug 2018 15:47:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=tgXuicAZAyGIpvPFbr+8xUAPzohTFhXQkYLf8X107Mo=; b=Kqi2/MRB73w2pzuCasjljNc1yfloyMrUfA/gIvOtqxnRSy/ukJ4w5EAKZjNMh9o7oJ F0eJFH4bs0o2ccPqGkw0qEeXSAnn6vs5zX3cpmTks1ePSnKfSqCrf7TKuJDOV5mkRM7l BqGK7qLvUK9Y1WwchmPL66KQhN6ExeTnX5Qh3GUSi1SuFq3U4V6LvzxSqojE4UOm1K0i C5LFbN+5FWj2ZYT5CYtJx0NoKeOZwA4ND8wq3VEu4VBlcacqXUaLegdRQXH+hqjJljAG iBPARuosapIrW/7zJzbWQQxNqqLqI+qzzQDIRSAu4Qo9nYnI9v/oHMXbrhttCsLkW4Jx TEJQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=tgXuicAZAyGIpvPFbr+8xUAPzohTFhXQkYLf8X107Mo=; b=afKr8V9gPCKCBHpaPbGqW/ZD5C/u662wdNE5zxE6B7KkKUh4tVDA3daYOOKBBDs26G llacJWuXbdFr7hdjMlmzzb+aqOlmYCfjackRNvI9jPoLWJMTiZl2BBvVzFUN7uojO2Ly 4FWJQwOnFh5HvSKBkjsJMYjb8o4qi2z0LKUqPBK3ShaHe0IB+yeDqwxibU/+ywKFgbc9 /5Oqjq0tXC33CLDHeWF2i3OnvmsHCZYT0C+bji7xME5UXYU0uJ8SajbJ/kXLLsVTp7L3 Jp6ZXTLK76VLOp5HvkkvwXUhTdBYZJDn26RSHUjlr1MENup4A8/4uGWX05jqRQKcJRAg W3Mg== X-Gm-Message-State: AOUpUlHLMonDkdCORsnEBVx3IV3kUBEUaTuLfgBMRoxOHKu9t5J1zNCQ CTT/Id0pu0UtEXOabAKtdtcNqb/HmywkT3VUVjp/eQ== X-Google-Smtp-Source: AA+uWPzz4yTl5i1Ny97Hc1As2NmGUTG2vXt4b9a51Zu2+ca1quSB2qRGQU5kKjDuOqRA6bUGJX2r8YxMjZEm+jWipi0= X-Received: by 2002:a24:374d:: with SMTP id r74-v6mr35415578itr.57.1534805275794; Mon, 20 Aug 2018 15:47:55 -0700 (PDT) MIME-Version: 1.0 Received: by 2002:a4f:a009:0:0:0:0:0 with HTTP; Mon, 20 Aug 2018 15:47:15 -0700 (PDT) In-Reply-To: References: From: Ted Lemon Date: Mon, 20 Aug 2018 18:47:15 -0400 Message-ID: To: Jack Visoky Cc: Eric Rescorla , "Nancy Cam-Winget (ncamwing)" , "tls@ietf.org" Content-Type: multipart/alternative; boundary="00000000000043ac680573e5b3a0" Archived-At: Subject: Re: [TLS] EXTERNAL: Re: integrity only ciphersuites X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Aug 2018 22:48:00 -0000 --00000000000043ac680573e5b3a0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Mon, Aug 20, 2018 at 5:36 PM, Jack Visoky wrote: > 2. In some cases the code size is quite important. It=E2=80=99s not unco= mmon for > hardware to be in the field in Industrial Automation for 15 or more years= , > so in some cases the hardware is already stretched pretty thin and might > not be able to handle the demands of encryption. At the same time it is > hugely beneficial to take advantage of the security of TLS for many of > these installations. > Given that you work for Rockwell, I'm assuming that you have specific devices in mind, that these devices are already in the field, and that you intend to upgrade their firmware to support CORE or something like that. Is this the use case you're talking about? > 3. Another use case for these NULL encryption suites is around inspection > of data. I think this has been discussed in this forum already, but thes= e > cipher suites could support that as well. > I would really encourage you to take a look at MUD (Manufacturer Usage Description) as a way to configure these devices. I presume that the use case here is that you have a device that could be pwned, and you want to be able to see what it is sending. But really it shouldn't even be having the conversation, right? MUD lets you configure your firewall automatically, preventing the device, if it's pwned, from talking to the controlling botnet. --00000000000043ac680573e5b3a0 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On M= on, Aug 20, 2018 at 5:36 PM, Jack Visoky <jmvisoky@ra.rockwell.com<= /a>> wrote:
2. In some cases th= e code size is quite important.=C2=A0 It=E2=80=99s not uncommon for hardwar= e to be in the field in Industrial Automation for 15 or more years, so in s= ome cases the hardware is already stretched pretty thin and might not be ab= le to handle the demands of encryption.=C2=A0 At the same time it is hugely= beneficial to take advantage of the security of TLS for many of these inst= allations.

Given that you work for Rockwell, I'm = assuming that you have specific devices in mind, that these devices are alr= eady in the field, and that you intend to upgrade their firmware to support= CORE or something like that.=C2=A0 =C2=A0Is this the use case you're t= alking about?
=C2=A0
3. Anoth= er use case for these NULL encryption suites is around inspection of data.= =C2=A0 I think this has been discussed in this forum already, but these cip= her suites could support that as well.

= I would really encourage you to take a look at MUD (Manufacturer Usage Description= ) as a way to configure these devices.=C2=A0 =C2=A0I presume that the u= se case here is that you have a device that could be pwned, and you want to= be able to see what it is sending.=C2=A0 =C2=A0But really it shouldn't= even be having the conversation, right?=C2=A0 =C2=A0MUD lets you configure= your firewall automatically, preventing the device, if it's pwned, fro= m talking to the controlling botnet.
=C2=A0
--00000000000043ac680573e5b3a0-- From nobody Mon Aug 20 16:01:34 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0ACA0127148 for ; Mon, 20 Aug 2018 16:01:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.91 X-Spam-Level: X-Spam-Status: No, score=-1.91 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_DKIMWL_WL_MED=-0.01] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=evequefou.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dWiwMPaBqeyf for ; Mon, 20 Aug 2018 16:01:29 -0700 (PDT) Received: from NAM01-SN1-obe.outbound.protection.outlook.com (mail-sn1nam01on0101.outbound.protection.outlook.com [104.47.32.101]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 68B15129619 for ; Mon, 20 Aug 2018 16:01:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=evequefou.onmicrosoft.com; s=selector1-evequefou-be; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=ME3VDYsCY7LljdqH0sqIaTagEEyqyUPm8w2kZJ10ZYU=; b=Mfzwl5w1cbo/XirlK3hS1K8saQ9kdV34NquqbY5PG54flDtKlBloK8ZCbQiXauGD5dijehZthYkosU4QW7AeVCRgi0mFfdoOEDjIlAzrKHaaRP95LUlgLq04+CEJD4VfdTy92GsqJS10weenjf6Yu1LC4amiKQYZIpAS3FQshH0= Received: from BYAPR08MB3944.namprd08.prod.outlook.com (52.135.194.30) by BYAPR08MB4888.namprd08.prod.outlook.com (20.176.255.93) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1059.19; Mon, 20 Aug 2018 23:01:25 +0000 Received: from BYAPR08MB3944.namprd08.prod.outlook.com ([fe80::913f:4f09:ae22:b6db]) by BYAPR08MB3944.namprd08.prod.outlook.com ([fe80::913f:4f09:ae22:b6db%6]) with mapi id 15.20.1059.023; Mon, 20 Aug 2018 23:01:25 +0000 From: Mike Bishop To: Eric Rescorla , "Nancy Cam-Winget (ncamwing)" CC: "tls@ietf.org" Thread-Topic: [TLS] integrity only ciphersuites Thread-Index: AQHUOMcWIQ0ztQCz9UKccOekmBKud6TJH2QAgAAPoXA= Date: Mon, 20 Aug 2018 23:01:25 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=mbishop@evequefou.be; x-originating-ip: [2601:600:8080:701:f1d0:3c7f:b853:184] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; BYAPR08MB4888; 6:k6nhaG3vECIjaDeL+rC1ZV9+ebLnBITHZWtaw0pvmJzjxpZIMuygz1E4CYwnS7JvTEvSE7gmQNBz0XKsGk0o1kd1r+tTCO9B78pvB3y0iltUv7uVDooiNQRDu7qnLBU1noTKe2gsOje1nnBOleGntCRGSF3hBex+wqlS0FjQQBy4MHvLkk5SJ2AoV0jTszDnA7K2rLMLDIXJ0/A8kR+iy2UfNrb2PFM4P/IBChx4Muh0Hz5dp9luKuHd0jZwZpqXjMk8c7ohjeooLTN5VopPB12TGCAKpJzH3lrx1od6t2o3R2Qqb3FkR94xkfLglJaw+1NH5MXuE3XumD7wHF6Er4scf2b7DNIt+00iore14z0UY5E7Qzj9NZKwEHYoJtZbFXRbAl8We8LRPXFkDK9pOqvh/dlK5M0JzBR0flwtcPQ8vRM/smrHxlEEA7HAXhw8FGBVapx5Yo8LpJbJySx87Q==; 5:eKXsggKdOK6PA8MUCoSEBDTdot/swmt4l2PGi1EjprluFBEO6pCIbCJIuOkqdCdwD0clWe01unUYl1Uq4m2kIvmyGpb4repgiLzvSBgY7nNKSaqtwr8jILuuiWlqyuuCxbY3uR0jgOMqErqjXHess1MIOxheoXQWkkPz81jmZ58=; 7:GboQnolfQBEg9hFQGRjX3MwL/ZS56oKzKTdoKcJqTBx6sfoRFVV+yYc2A70fblMRyhvJ+ov8cNz2oTFUQ/jQ/H68J1JZuR3clpJFxxSXOMtDaKTt54yfec1nIYErIS7oGq+DyNVQ+BVSl1KZLnHG2HQacHUFbqxHNYXfxRaanE7w+OTSUANURorvLkPY2Kpo1GTuXfDOHoliObIDHWzy/I7LRbYpi1Fxh7UufFVK8ZseWmo0l18FLTTl53Rp1h2H x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-correlation-id: 67e5e244-f850-42ca-6236-08d606f0db05 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(7020095)(4652040)(7021125)(8989137)(4534165)(7022125)(4603075)(4627221)(201702281549075)(8990107)(7048125)(7024125)(7027125)(7028125)(7023125)(5600074)(711020)(2017052603328)(7153060)(7193020); SRVR:BYAPR08MB4888; x-ms-traffictypediagnostic: BYAPR08MB4888: x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(28532068793085)(278428928389397)(166708455590820)(192374486261705)(21748063052155); x-ms-exchange-senderadcheck: 1 x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(6040522)(2401047)(8121501046)(5005006)(3002001)(93006095)(93001095)(10201501046)(3231311)(944501410)(52105095)(149027)(150027)(6041310)(20161123558120)(20161123560045)(20161123562045)(2016111802025)(20161123564045)(6043046)(201708071742011)(7699016); SRVR:BYAPR08MB4888; BCL:0; PCL:0; RULEID:; SRVR:BYAPR08MB4888; x-forefront-prvs: 0770F75EA9 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(39830400003)(346002)(136003)(376002)(396003)(366004)(189003)(199004)(14444005)(11346002)(53936002)(7696005)(7736002)(6306002)(236005)(186003)(25786009)(99286004)(6436002)(4326008)(446003)(102836004)(105586002)(97736004)(76176011)(106356001)(476003)(478600001)(229853002)(46003)(81166006)(54896002)(256004)(74316002)(6246003)(110136005)(81156014)(8676002)(6506007)(9686003)(316002)(53546011)(486006)(55016002)(86362001)(14454004)(5660300001)(966005)(2900100001)(74482002)(33656002)(6116002)(790700001)(19609705001)(2906002)(5250100002)(606006)(8936002)(68736007)(45080400002); DIR:OUT; SFP:1102; SCL:1; SRVR:BYAPR08MB4888; H:BYAPR08MB3944.namprd08.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:0; received-spf: None (protection.outlook.com: evequefou.be does not designate permitted sender hosts) x-microsoft-antispam-message-info: DK+eVPXylPJP8jh8ceT5Jj+kr7DjaU2iPYqj9EwS0EDRnPLK3JfBPBospqwtAR9Bj3ISa9B8H4TiBxyX01LSh2dAD0H6IH/SaSxzIAz1n5/QAhMwZ/8woE/yUB1mF1tiask+azIuhQESuGzH5E/NrJywI5MoyGR3zfhM1RB5ELd754sOleKBCvCm7p4RABmrYIK5OcfTHVLZG2j4bHCt15EGgXePRugtYgT24E1Kc/Z1+Ptzoy6ZDvmPE4V2kNJyXJ5aFfHhcj7T3KtgNcSTUjHGqUcUkr2ljJU3LSDkxIO81NreoZrV4K6Nhpb0RQJO07/k7FIH+FhwO9yfAlbzl0AinXcXKEzh4uTr2GsOvkw= spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_BYAPR08MB39449E1BD3CFAD93B18613F6DA320BYAPR08MB3944namp_" MIME-Version: 1.0 X-OriginatorOrg: evequefou.be X-MS-Exchange-CrossTenant-Network-Message-Id: 67e5e244-f850-42ca-6236-08d606f0db05 X-MS-Exchange-CrossTenant-originalarrivaltime: 20 Aug 2018 23:01:25.4373 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 41eaf50b-882d-47eb-8c4c-0b5b76a9da8f X-MS-Exchange-Transport-CrossTenantHeadersStamped: BYAPR08MB4888 Archived-At: Subject: Re: [TLS] integrity only ciphersuites X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Aug 2018 23:01:33 -0000 --_000_BYAPR08MB39449E1BD3CFAD93B18613F6DA320BYAPR08MB3944namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SSB0ZW5kIHRvIHRoaW5rIHRoZSBzdHJvbmdlc3Qgc2NlbmFyaW8gZm9yIGludGVncml0eS1vbmx5 IGNpcGhlcnN1aXRlcyBpcyBpbiBhbiBhcHBsaWNhdGlvbiB3aGVyZSB0aGUgZGF0YSBiZWluZyB0 cmFuc2ZlcnJlZCBpcyBhbHJlYWR5IGVuY3J5cHRlZCBzdWZmaWNpZW50bHkuICBGb3IgZXhhbXBs ZSwgd2hlbiBydW5uaW5nIElQc2VjIG92ZXIgYW4gSVAtSFRUUFMgdHVubmVsLCBNaWNyb3NvZnQg dXNlZCBhIG51bGwgY2lwaGVyIG9uIHRoZSBvdXRlciBUTFMgbGF5ZXIuICBIb3dldmVyLCBhcyB5 b3Ugc2F5LCB0aGlzIGNhbiBiZSBkZWNlcHRpdmUuICBEUk0tcHJvdGVjdGVkIG1lZGlhIGlzIGFs cmVhZHkgZW5jcnlwdGVkIGFuZCBzZWVtcyBsaWtlIGFub3RoZXIgYXBwbGljYXRpb24gZm9yIHRo aXMsIGJ1dCB1c2luZyBUTFMgbWVhbnMgaXQgaXMgbm90IChhcykgdHJpdmlhbCB0byBpZGVudGlm eSB0aGF0IGRpZmZlcmVudCBmbG93cyBhcmUgcmV0cmlldmluZyB0aGUgc2FtZSByZXNvdXJjZS4N Cg0KRnJvbTogVExTIDx0bHMtYm91bmNlc0BpZXRmLm9yZz4gT24gQmVoYWxmIE9mIEVyaWMgUmVz Y29ybGENClNlbnQ6IE1vbmRheSwgQXVndXN0IDIwLCAyMDE4IDE6NTggUE0NClRvOiBOYW5jeSBD YW0tV2luZ2V0IChuY2Ftd2luZykgPG5jYW13aW5nPTQwY2lzY28uY29tQGRtYXJjLmlldGYub3Jn Pg0KQ2M6IHRsc0BpZXRmLm9yZw0KU3ViamVjdDogUmU6IFtUTFNdIGludGVncml0eSBvbmx5IGNp cGhlcnN1aXRlcw0KDQoNCg0KT24gTW9uLCBBdWcgMjAsIDIwMTggYXQgMTo0OCBQTSwgTmFuY3kg Q2FtLVdpbmdldCAobmNhbXdpbmcpIDxuY2Ftd2luZz00MGNpc2NvLmNvbUBkbWFyYy5pZXRmLm9y ZzxtYWlsdG86bmNhbXdpbmc9NDBjaXNjby5jb21AZG1hcmMuaWV0Zi5vcmc+PiB3cm90ZToNCkFs bCwNCkEgY291cGxlIElvVCBjb25zb3J0aXVtcyBhcmUgdHJ5aW5nIHRvIGVtYnJhY2UgdGhlIGlt cHJvdmVtZW50cyBtYWRlIHRvIFRMUyAxLjMgYW5kIGFzIHRoZXkgZGVmaW5lIHRoZWlyIG5ldyBz ZWN1cml0eSBjb25zdHJ1Y3RzIHdvdWxkIGxpa2UgdG8gYWRvcHQgdGhlIGxhdGVzdCBwcm90b2Nv bHMsIGluIHRoaXMgY2FzZSBUTFMgMS4zLiAgIFRvIHRoYXQgZXh0ZW50LCB0aGV5IGhhdmUgYSBz dHJvbmcgbmVlZCBmb3IgbXV0dWFsIGF1dGhlbnRpY2F0aW9uLCBidXQgaW50ZWdyaXR5IG9ubHkg KG5vIGNvbmZpZGVudGlhbGl0eSkgcmVxdWlyZW1lbnRzLg0KDQoNCkluIGZvbGxvd2luZyB0aGUg bmV3IElBTkEgcnVsZXMsIHdlIGhhdmUgcG9zdGVkIHRoZSBkcmFmdCBodHRwczovL3Rvb2xzLmll dGYub3JnL2h0bWwvZHJhZnQtY2Ftd2luZ2V0LXRscy10czEzLW1hY2NpcGhlcnN1aXRlcy0wMCB0 byBkb2N1bWVudCByZXF1ZXN0IGZvciByZWdpc3RyYXRpb25zIG9mIEhNQUMgYmFzZWQgY2lwaGVy IHNlbGVjdGlvbnMgd2l0aCBUTFMgMS4z4oCmLi5hbmQgYXJlIHNvbGljaXRpbmcgZmVlZGJhY2sg ZnJvbSB0aGUgV0cgb24gdGhlIGRyYWZ0IGFuZCBpdHMgcGF0aCBmb3J3YXJkLg0KDQpOYW5jeSwN Cg0KQXMgeW91IHNheSwgeW91IGRvbid0IG5lZWQgV0cgYXBwcm92YWwgZm9yIGNvZGUgcG9pbnQg cmVnaXN0cmF0aW9uIGFzIGxvbmcgYXMgeW91IGRvbid0IHdhbnQgUmVjb21tZW5kZWQgc3RhdHVz Lg0KDQpXaXRoIHRoYXQgc2FpZCwgSSBkb24ndCB0aGluayB0aGlzIGRvY3VtZW50IG1ha2VzIGEg dmVyeSBzdHJvbmcgY2FzZSBmb3IgdGhlc2UgY2lwaGVyIHN1aXRlcy4gRXNzZW50aWFsbHkgeW91 IHNheToNCg0KMS4gV2UgZG9uJ3QgbmVlZCBjb25maWRlbnRpYWxpdHkNCjIuIENvZGUgZm9vdHBy aW50IGlzIGltcG9ydGFudA0KDQpHZW5lcmFsbHksIEknbSBub3QgdmVyeSBlbnRodXNpYXN0aWMg YWJvdXQgYXJndW1lbnQgKDEpLiBJdCdzIG9mdGVuIHRoZSBjYXNlIHRoYXQgYXBwbGljYXRpb25z IHN1cGVyZmljaWFsbHkgbmVlZCBpbnRlZ3JpdHkgYnV0IGFjdHVhbGx5IHJlbHkgb24gY29uZmlk ZW50aWFsaXR5IGluIHNvbWUgd2F5ICh0aGUgb2J2aW91cyBjYXNlIGlzIHRoYXQgSFRUUCBDb29r aWVzIGFyZSBhbiBhdXRoZW50aWNhdGlvbiBtZWNoYW5pc20sIGJ1dCBiZWNhdXNlIHRoZXkgYXJl IGEgYmVhcmVyIHRva2VuLCB5b3UgYWN0dWFsbHkgbmVlZCBjb25maWRlbnRpYXRpbHR5KS4gSXQn cyBtdWNoIGVhc2llciB0byBqdXN0IGFsd2F5cyBzdXBwbHkgY29uZmlkZW50aWFsaXR5IHRoYW4g dG8gdHJ5IHRvIHJlYXNvbiBhYm91dCB3aGVuIGl0IGlzIG9yIGlzIG5vdCBuZWVkZWQuDQoNClRo ZSBzZWNvbmQgYXJndW1lbnQgaXMgdGhhdCB5b3UgYXJlIHRyeWluZyB0byBrZWVwIGNvZGUgc2l6 ZSBkb3duLiBJdCdzIHRydWUgdGhhdCBub3QgaGF2aW5nIEFFUyBpcyBjaGVhcGVyIHRoYW4gaGF2 aW5nIEFFUywgYnV0IGl0J3MgcG9zc2libGUgdG8gaGF2ZSB2ZXJ5IGxpZ2h0d2VpZ2h0IEFFUyBz dGFja3MgKHNlZSBmb3IgaW5zdGFuY2U6IGh0dHBzOi8vZ2l0aHViLmNvbS8wMW9yZy90aW55Y3J5 cHQpLg0KDQpTbywgb3ZlcmFsbCwgdGhpcyBkb2Vzbid0IHNlZW0gdmVyeSBjb21wZWxsaW5nLi4N Cg0KLUVrcg0KDQoNCg0KDQpXYXJtIHJlZ2FyZHMsIE5hbmN5IChhbmQgSmFjaykNCg0KX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NClRMUyBtYWlsaW5nIGxp c3QNClRMU0BpZXRmLm9yZzxtYWlsdG86VExTQGlldGYub3JnPg0KaHR0cHM6Ly93d3cuaWV0Zi5v cmcvbWFpbG1hbi9saXN0aW5mby90bHMNCg0K --_000_BYAPR08MB39449E1BD3CFAD93B18613F6DA320BYAPR08MB3944namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQph OmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xv cjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1z b0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpwdXJw bGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLm1zb25vcm1hbDAsIGxpLm1zb25v cm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCgltc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4tYm90 dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZv bnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnNwYW4uRW1haWxTdHlsZTE4DQoJe21z by1zdHlsZS10eXBlOnBlcnNvbmFsOw0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlm Ow0KCWNvbG9yOndpbmRvd3RleHQ7fQ0Kc3Bhbi5FbWFpbFN0eWxlMTkNCgl7bXNvLXN0eWxlLXR5 cGU6cGVyc29uYWwtY29tcG9zZTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsN Cgljb2xvcjp3aW5kb3d0ZXh0O30NCi5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBlOmV4 cG9ydC1vbmx5Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNh bnMtc2VyaWY7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6OC41aW4gMTEuMGluOw0KCW1h cmdpbjoxLjBpbiAxLjBpbiAxLjBpbiAxLjBpbjt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6 V29yZFNlY3Rpb24xO30NCi0tPjwvc3R5bGU+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpz aGFwZWRlZmF1bHRzIHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2IiAvPg0KPC94bWw+PCFbZW5k aWZdLS0+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWxheW91dCB2OmV4dD0iZWRp dCI+DQo8bzppZG1hcCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4NCjwvbzpzaGFwZWxheW91dD48 L3htbD48IVtlbmRpZl0tLT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9IkVOLVVTIiBsaW5rPSJibHVl IiB2bGluaz0icHVycGxlIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj5JIHRlbmQgdG8gdGhpbmsgdGhlIHN0cm9uZ2VzdCBzY2VuYXJpbyBmb3IgaW50 ZWdyaXR5LW9ubHkgY2lwaGVyc3VpdGVzIGlzIGluIGFuIGFwcGxpY2F0aW9uIHdoZXJlIHRoZSBk YXRhIGJlaW5nIHRyYW5zZmVycmVkIGlzIGFscmVhZHkgZW5jcnlwdGVkIHN1ZmZpY2llbnRseS4m bmJzcDsgRm9yIGV4YW1wbGUsIHdoZW4gcnVubmluZyBJUHNlYyBvdmVyIGFuIElQLUhUVFBTIHR1 bm5lbCwgTWljcm9zb2Z0IHVzZWQgYSBudWxsDQogY2lwaGVyIG9uIHRoZSBvdXRlciBUTFMgbGF5 ZXIuJm5ic3A7IEhvd2V2ZXIsIGFzIHlvdSBzYXksIHRoaXMgY2FuIGJlIGRlY2VwdGl2ZS4mbmJz cDsgRFJNLXByb3RlY3RlZCBtZWRpYSBpcyBhbHJlYWR5IGVuY3J5cHRlZCBhbmQgc2VlbXMgbGlr ZSBhbm90aGVyIGFwcGxpY2F0aW9uIGZvciB0aGlzLCBidXQgdXNpbmcgVExTIG1lYW5zIGl0IGlz IG5vdCAoYXMpIHRyaXZpYWwgdG8gaWRlbnRpZnkgdGhhdCBkaWZmZXJlbnQgZmxvd3MgYXJlIHJl dHJpZXZpbmcgdGhlDQogc2FtZSByZXNvdXJjZS48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+ RnJvbTo8L2I+IFRMUyAmbHQ7dGxzLWJvdW5jZXNAaWV0Zi5vcmcmZ3Q7IDxiPk9uIEJlaGFsZiBP ZiA8L2I+DQpFcmljIFJlc2NvcmxhPGJyPg0KPGI+U2VudDo8L2I+IE1vbmRheSwgQXVndXN0IDIw LCAyMDE4IDE6NTggUE08YnI+DQo8Yj5Ubzo8L2I+IE5hbmN5IENhbS1XaW5nZXQgKG5jYW13aW5n KSAmbHQ7bmNhbXdpbmc9NDBjaXNjby5jb21AZG1hcmMuaWV0Zi5vcmcmZ3Q7PGJyPg0KPGI+Q2M6 PC9iPiB0bHNAaWV0Zi5vcmc8YnI+DQo8Yj5TdWJqZWN0OjwvYj4gUmU6IFtUTFNdIGludGVncml0 eSBvbmx5IGNpcGhlcnN1aXRlczxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4m bmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8 L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+T24gTW9uLCBBdWcgMjAsIDIw MTggYXQgMTo0OCBQTSwgTmFuY3kgQ2FtLVdpbmdldCAobmNhbXdpbmcpICZsdDs8YSBocmVmPSJt YWlsdG86bmNhbXdpbmc9NDBjaXNjby5jb21AZG1hcmMuaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5r Ij5uY2Ftd2luZz00MGNpc2NvLmNvbUBkbWFyYy5pZXRmLm9yZzwvYT4mZ3Q7IHdyb3RlOjxvOnA+ PC9vOnA+PC9wPg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNv bGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowaW4gMGluIDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0 LjhwdDttYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1yaWdodDowaW47bWFyZ2luLWJvdHRvbTo1LjBw dCI+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2lu LXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+QWxsLDxvOnA+PC9vOnA+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRv O21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj5BIGNvdXBsZSBJb1QgY29uc29ydGl1bXMgYXJl IHRyeWluZyB0byBlbWJyYWNlIHRoZSBpbXByb3ZlbWVudHMgbWFkZSB0byBUTFMgMS4zIGFuZCBh cyB0aGV5IGRlZmluZSB0aGVpciBuZXcgc2VjdXJpdHkgY29uc3RydWN0cyB3b3VsZCBsaWtlIHRv IGFkb3B0IHRoZSBsYXRlc3QgcHJvdG9jb2xzLCBpbiB0aGlzDQogY2FzZSBUTFMgMS4zLiZuYnNw OyZuYnNwOyBUbyB0aGF0IGV4dGVudCwgdGhleSBoYXZlIGEgc3Ryb25nIG5lZWQgZm9yIG11dHVh bCBhdXRoZW50aWNhdGlvbiwgYnV0IGludGVncml0eSBvbmx5IChubyBjb25maWRlbnRpYWxpdHkp IHJlcXVpcmVtZW50cy4mbmJzcDsNCjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDph dXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+ DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0ND QyAxLjBwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdp bi10b3A6NS4wcHQ7bWFyZ2luLXJpZ2h0OjBpbjttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDph dXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFy Z2luLWJvdHRvbS1hbHQ6YXV0byI+SW4gZm9sbG93aW5nIHRoZSBuZXcgSUFOQSBydWxlcywgd2Ug aGF2ZSBwb3N0ZWQgdGhlIGRyYWZ0DQo8YSBocmVmPSJodHRwczovL3Rvb2xzLmlldGYub3JnL2h0 bWwvZHJhZnQtY2Ftd2luZ2V0LXRscy10czEzLW1hY2NpcGhlcnN1aXRlcy0wMCIgdGFyZ2V0PSJf YmxhbmsiPg0KaHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LWNhbXdpbmdldC10bHMt dHMxMy1tYWNjaXBoZXJzdWl0ZXMtMDA8L2E+IHRvIGRvY3VtZW50IHJlcXVlc3QgZm9yIHJlZ2lz dHJhdGlvbnMgb2YgSE1BQyBiYXNlZCBjaXBoZXIgc2VsZWN0aW9ucyB3aXRoIFRMUyAxLjPigKYu LmFuZCBhcmUgc29saWNpdGluZyBmZWVkYmFjayBmcm9tIHRoZSBXRyBvbiB0aGUgZHJhZnQgYW5k IGl0cyBwYXRoIGZvcndhcmQuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9j a3F1b3RlPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+TmFuY3ksPG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkFzIHlvdSBzYXksIHlv dSBkb24ndCBuZWVkIFdHIGFwcHJvdmFsIGZvciBjb2RlIHBvaW50IHJlZ2lzdHJhdGlvbiBhcyBs b25nIGFzIHlvdSBkb24ndCB3YW50IFJlY29tbWVuZGVkIHN0YXR1cy48bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+V2l0aCB0aGF0IHNhaWQsIEkg ZG9uJ3QgdGhpbmsgdGhpcyBkb2N1bWVudCBtYWtlcyBhIHZlcnkgc3Ryb25nIGNhc2UgZm9yIHRo ZXNlIGNpcGhlciBzdWl0ZXMuIEVzc2VudGlhbGx5IHlvdSBzYXk6PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjEuIFdlIGRvbid0IG5lZWQgY29u ZmlkZW50aWFsaXR5PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj4yLiBDb2RlIGZvb3RwcmludCBpcyBpbXBvcnRhbnQ8bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+R2VuZXJhbGx5LCBJJ20gbm90IHZl cnkgZW50aHVzaWFzdGljIGFib3V0IGFyZ3VtZW50ICgxKS4gSXQncyBvZnRlbiB0aGUgY2FzZSB0 aGF0IGFwcGxpY2F0aW9ucyBzdXBlcmZpY2lhbGx5IG5lZWQgaW50ZWdyaXR5IGJ1dCBhY3R1YWxs eSByZWx5IG9uIGNvbmZpZGVudGlhbGl0eSBpbiBzb21lIHdheSAodGhlIG9idmlvdXMgY2FzZSBp cyB0aGF0IEhUVFAgQ29va2llcyBhcmUgYW4gYXV0aGVudGljYXRpb24gbWVjaGFuaXNtLA0KIGJ1 dCBiZWNhdXNlIHRoZXkgYXJlIGEgYmVhcmVyIHRva2VuLCB5b3UgYWN0dWFsbHkgbmVlZCBjb25m aWRlbnRpYXRpbHR5KS4gSXQncyBtdWNoIGVhc2llciB0byBqdXN0IGFsd2F5cyBzdXBwbHkgY29u ZmlkZW50aWFsaXR5IHRoYW4gdG8gdHJ5IHRvIHJlYXNvbiBhYm91dCB3aGVuIGl0IGlzIG9yIGlz IG5vdCBuZWVkZWQuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPlRoZSBzZWNvbmQgYXJndW1lbnQgaXMgdGhhdCB5b3UgYXJlIHRyeWluZyB0byBr ZWVwIGNvZGUgc2l6ZSBkb3duLiBJdCdzIHRydWUgdGhhdCBub3QgaGF2aW5nIEFFUyBpcyBjaGVh cGVyIHRoYW4gaGF2aW5nIEFFUywgYnV0IGl0J3MgcG9zc2libGUgdG8gaGF2ZSB2ZXJ5IGxpZ2h0 d2VpZ2h0IEFFUyBzdGFja3MgKHNlZSBmb3IgaW5zdGFuY2U6DQo8YSBocmVmPSJodHRwczovL2dp dGh1Yi5jb20vMDFvcmcvdGlueWNyeXB0Ij5odHRwczovL2dpdGh1Yi5jb20vMDFvcmcvdGlueWNy eXB0PC9hPikuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPlNvLCBvdmVyYWxsLCB0aGlzIGRvZXNuJ3Qgc2VlbSB2ZXJ5IGNvbXBlbGxpbmcuLjxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4m bmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4tRWty PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpw PiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxv OnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6 bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGluIDBpbiAwaW4g Ni4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tcmlnaHQ6MGlu O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1 dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1z by1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj5XYXJtIHJl Z2FyZHMsIE5hbmN5IChhbmQgSmFjayk8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWJvdHRvbToxMi4wcHQiPjxicj4NCl9f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fPGJyPg0KVExTIG1h aWxpbmcgbGlzdDxicj4NCjxhIGhyZWY9Im1haWx0bzpUTFNAaWV0Zi5vcmciPlRMU0BpZXRmLm9y ZzwvYT48YnI+DQo8YSBocmVmPSJodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZv L3RscyIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGlu Zm8vdGxzPC9hPjxvOnA+PC9vOnA+PC9wPg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rp dj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_BYAPR08MB39449E1BD3CFAD93B18613F6DA320BYAPR08MB3944namp_-- From nobody Mon Aug 20 16:13:37 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 63E7A127148 for ; Mon, 20 Aug 2018 16:13:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.51 X-Spam-Level: X-Spam-Status: No, score=-14.51 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id J8E3yKZeW0Sb for ; Mon, 20 Aug 2018 16:13:33 -0700 (PDT) Received: from rcdn-iport-2.cisco.com (rcdn-iport-2.cisco.com [173.37.86.73]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4159C129619 for ; Mon, 20 Aug 2018 16:13:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=21724; q=dns/txt; s=iport; t=1534806813; x=1536016413; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=JyasRvHTvjO7MEPqwP5ciQzFyYjN3tPEVv1jxC8N6Z4=; b=iG47OwN2moGH/PFtZEntGrrSFEVENfx7FjFspbmzL/y6nxWdzweY5d7C TabM7rhgcaGUt9uJNA3jFsFT+d1DyjGl+Vuu+4WNj1ZSsJCf3+TQJIeDw xyXb8PY7KDtuIhM8BRyH1KLEuwlzxBnmoDgCTHqQcQE5ES7z908PkSr5r Q=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0D5AABSSntb/4gNJK1cGgEBAQEBAgE?= =?us-ascii?q?BAQEIAQEBAYJXeGN/KAqDZogKjB6BaCWQbIUrgXoLGAEKhEkCF4M2ITQYAQI?= =?us-ascii?q?BAQIBAQJtHAyFNwEBAQQBASFLCxACAQgOAwMBAigDAgICJQsUCQgCBA4FgyI?= =?us-ascii?q?BgR1kD6dsgS6EKgE9hXcFh32BGxeCAIESJwwTgkyDGwEBAgGBfhaCSzGCJgK?= =?us-ascii?q?IdYQCjgUJAoYniTcVgT6EL4hLhkGES4d1AhEUgSQdOIFScBU7KgGCPgmCHBe?= =?us-ascii?q?DRYUUhT5vAY1vgRsBAQ?= X-IronPort-AV: E=Sophos;i="5.53,267,1531785600"; d="scan'208,217";a="443972216" Received: from alln-core-3.cisco.com ([173.36.13.136]) by rcdn-iport-2.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 20 Aug 2018 23:13:32 +0000 Received: from XCH-RTP-014.cisco.com (xch-rtp-014.cisco.com [64.101.220.154]) by alln-core-3.cisco.com (8.15.2/8.15.2) with ESMTPS id w7KNDVg2014755 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL); Mon, 20 Aug 2018 23:13:32 GMT Received: from xch-rtp-015.cisco.com (64.101.220.155) by XCH-RTP-014.cisco.com (64.101.220.154) with Microsoft SMTP Server (TLS) id 15.0.1320.4; Mon, 20 Aug 2018 19:13:30 -0400 Received: from xch-rtp-015.cisco.com ([64.101.220.155]) by XCH-RTP-015.cisco.com ([64.101.220.155]) with mapi id 15.00.1320.000; Mon, 20 Aug 2018 19:13:31 -0400 From: "Nancy Cam-Winget (ncamwing)" To: Eric Rescorla CC: "tls@ietf.org" Thread-Topic: [TLS] integrity only ciphersuites Thread-Index: AQHUOMbv4/TwUeWSFUmhTxfQeZX0pqTJYnIA//+wigA= Date: Mon, 20 Aug 2018 23:13:31 +0000 Message-ID: <7E9735B9-79F4-4E0B-8701-676048893CB4@cisco.com> References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.c.0.180410 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.155.208.72] Content-Type: multipart/alternative; boundary="_000_7E9735B979F44E0B8701676048893CB4ciscocom_" MIME-Version: 1.0 X-Outbound-SMTP-Client: 64.101.220.154, xch-rtp-014.cisco.com X-Outbound-Node: alln-core-3.cisco.com Archived-At: Subject: Re: [TLS] integrity only ciphersuites X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Aug 2018 23:13:35 -0000 --_000_7E9735B979F44E0B8701676048893CB4ciscocom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGkgRXJpYywNClRoYW5rcyBmb3IgdGhlIHByb21wdCBmZWVkYmFjayEgIFBsZWFzZSBzZWUgZnVy dGhlciBjb21tZW50cy9xdWVzdGlvbnMgYmVsb3c6DQoNCkZyb206IEVyaWMgUmVzY29ybGEgPGVr ckBydGZtLmNvbT4NCkRhdGU6IE1vbmRheSwgQXVndXN0IDIwLCAyMDE4IGF0IDEzOjU4DQpUbzog Im5jYW13aW5nQGNpc2NvLmNvbSIgPG5jYW13aW5nQGNpc2NvLmNvbT4NCkNjOiAidGxzQGlldGYu b3JnIiA8dGxzQGlldGYub3JnPg0KU3ViamVjdDogUmU6IFtUTFNdIGludGVncml0eSBvbmx5IGNp cGhlcnN1aXRlcw0KDQoNCg0KT24gTW9uLCBBdWcgMjAsIDIwMTggYXQgMTo0OCBQTSwgTmFuY3kg Q2FtLVdpbmdldCAobmNhbXdpbmcpIDxuY2Ftd2luZz00MGNpc2NvLmNvbUBkbWFyYy5pZXRmLm9y ZzxtYWlsdG86bmNhbXdpbmc9NDBjaXNjby5jb21AZG1hcmMuaWV0Zi5vcmc+PiB3cm90ZToNCkFs bCwNCkEgY291cGxlIElvVCBjb25zb3J0aXVtcyBhcmUgdHJ5aW5nIHRvIGVtYnJhY2UgdGhlIGlt cHJvdmVtZW50cyBtYWRlIHRvIFRMUyAxLjMgYW5kIGFzIHRoZXkgZGVmaW5lIHRoZWlyIG5ldyBz ZWN1cml0eSBjb25zdHJ1Y3RzIHdvdWxkIGxpa2UgdG8gYWRvcHQgdGhlIGxhdGVzdCBwcm90b2Nv bHMsIGluIHRoaXMgY2FzZSBUTFMgMS4zLiAgIFRvIHRoYXQgZXh0ZW50LCB0aGV5IGhhdmUgYSBz dHJvbmcgbmVlZCBmb3IgbXV0dWFsIGF1dGhlbnRpY2F0aW9uLCBidXQgaW50ZWdyaXR5IG9ubHkg KG5vIGNvbmZpZGVudGlhbGl0eSkgcmVxdWlyZW1lbnRzLg0KDQoNCkluIGZvbGxvd2luZyB0aGUg bmV3IElBTkEgcnVsZXMsIHdlIGhhdmUgcG9zdGVkIHRoZSBkcmFmdCBodHRwczovL3Rvb2xzLmll dGYub3JnL2h0bWwvZHJhZnQtY2Ftd2luZ2V0LXRscy10czEzLW1hY2NpcGhlcnN1aXRlcy0wMCB0 byBkb2N1bWVudCByZXF1ZXN0IGZvciByZWdpc3RyYXRpb25zIG9mIEhNQUMgYmFzZWQgY2lwaGVy IHNlbGVjdGlvbnMgd2l0aCBUTFMgMS4z4oCmLi5hbmQgYXJlIHNvbGljaXRpbmcgZmVlZGJhY2sg ZnJvbSB0aGUgV0cgb24gdGhlIGRyYWZ0IGFuZCBpdHMgcGF0aCBmb3J3YXJkLg0KDQpOYW5jeSwN Cg0KQXMgeW91IHNheSwgeW91IGRvbid0IG5lZWQgV0cgYXBwcm92YWwgZm9yIGNvZGUgcG9pbnQg cmVnaXN0cmF0aW9uIGFzIGxvbmcgYXMgeW91IGRvbid0IHdhbnQgUmVjb21tZW5kZWQgc3RhdHVz Lg0KDQpXaXRoIHRoYXQgc2FpZCwgSSBkb24ndCB0aGluayB0aGlzIGRvY3VtZW50IG1ha2VzIGEg dmVyeSBzdHJvbmcgY2FzZSBmb3IgdGhlc2UgY2lwaGVyIHN1aXRlcy4gRXNzZW50aWFsbHkgeW91 IHNheToNCg0KDQogIDEuICBXZSBkb24ndCBuZWVkIGNvbmZpZGVudGlhbGl0eQ0KMi4gQ29kZSBm b290cHJpbnQgaXMgaW1wb3J0YW50DQoNCkdlbmVyYWxseSwgSSdtIG5vdCB2ZXJ5IGVudGh1c2lh c3RpYyBhYm91dCBhcmd1bWVudCAoMSkuIEl0J3Mgb2Z0ZW4gdGhlIGNhc2UgdGhhdCBhcHBsaWNh dGlvbnMgc3VwZXJmaWNpYWxseSBuZWVkIGludGVncml0eSBidXQgYWN0dWFsbHkgcmVseSBvbiBj b25maWRlbnRpYWxpdHkgaW4gc29tZSB3YXkgKHRoZSBvYnZpb3VzIGNhc2UgaXMgdGhhdCBIVFRQ IENvb2tpZXMgYXJlIGFuIGF1dGhlbnRpY2F0aW9uIG1lY2hhbmlzbSwgYnV0IGJlY2F1c2UgdGhl eSBhcmUgYSBiZWFyZXIgdG9rZW4sIHlvdSBhY3R1YWxseSBuZWVkIGNvbmZpZGVudGlhdGlsdHkp LiBJdCdzIG11Y2ggZWFzaWVyIHRvIGp1c3QgYWx3YXlzIHN1cHBseSBjb25maWRlbnRpYWxpdHkg dGhhbiB0byB0cnkgdG8gcmVhc29uIGFib3V0IHdoZW4gaXQgaXMgb3IgaXMgbm90IG5lZWRlZC4N CltOQ1ddIFdlIGFyZSB3b3JraW5nIGRpbGlnZW50bHkgaW4gc2V2ZXJhbCBJb1QgYmFzZWQgY29u c29ydGl1bXMgdG8gYmVnaW4gdG8gZGVmaW5lIHNlY3VyaXR5IGFyb3VuZCB0aG9zZSBwcm90b2Nv bHMgYXMgbWFueSB0b2RheSBkbyBub3QgYWZmb3JkIGFueSBwcm90ZWN0aW9uIGF0IGFsbC4gIEF0 IG1pbmltdW0sIHdlIHdhbnQgdG8gZW5zdXJlIHRoZXJlIGlzIG11dHVhbCBhdXRoZW50aWNhdGlv biBhbmQgYXV0aG9yaXphdGlvbiBhcyB3ZWxsIGFzIG1lc3NhZ2UgaW50ZWdyaXR5LiAgQXMgd2Ug Y2l0ZSBpbiB0aGUgZHJhZnQsIG1hbnkg4oCcdGhpbmdz4oCdIHBlcmZvcm0gcmVwZXRpdGl2ZSB0 YXNrcyB0aGF0IHdhbnQgdG8gY29tbXVuaWNhdGUgbW90aW9uLCBzcGVlZCBvciBvdGhlciBtYWNo aW5lIGNvbnRyb2wgZnVuY3Rpb25zIHRoYXQgYXJlIG5vdCBkZWVtZWQgdG8gYmUgcHJpdmF0ZS4N CkkgY2FuIHNlZSB5b3VyIHBvaW50L2JlbGllZiB0aGF0IGl0IGlzIG11Y2ggZWFzaWVyIHRvIGlu Y2x1ZGUgY29uZmlkZW50aWFsaXR5LCBidXQgc29tZSBjaGlwc2V0cyB0b2RheSBlc3BlY2lhbGx5 IGF0IHRob3NlIGxldmVscyAoYW5kIGNvc3QpIGFyZSBub3QgY29uc3RydWN0ZWQgd2l0aCB0aG9z ZSBwcm92aXNpb25zIHRvZGF5LCB0aG91Z2ggdGhleSBkbyBoYXZlIEhNQUMgY2FwYWJpbGl0aWVz Lg0KDQpUaGUgc2Vjb25kIGFyZ3VtZW50IGlzIHRoYXQgeW91IGFyZSB0cnlpbmcgdG8ga2VlcCBj b2RlIHNpemUgZG93bi4gSXQncyB0cnVlIHRoYXQgbm90IGhhdmluZyBBRVMgaXMgY2hlYXBlciB0 aGFuIGhhdmluZyBBRVMsIGJ1dCBpdCdzIHBvc3NpYmxlIHRvIGhhdmUgdmVyeSBsaWdodHdlaWdo dCBBRVMgc3RhY2tzIChzZWUgZm9yIGluc3RhbmNlOiBodHRwczovL2dpdGh1Yi5jb20vMDFvcmcv dGlueWNyeXB0KS4NCltOQ1ddIFNvLCBpdCBpcyBub3QganVzdCBhYm91dCBjb2RlIHNpemUsIGJ1 dCBvdmVyYWxsIGhhcmR3YXJlIGF2YWlsYWJpbGl0eSBhbmQgY29zdOKApi4NCg0KU28sIG92ZXJh bGwsIHRoaXMgZG9lc24ndCBzZWVtIHZlcnkgY29tcGVsbGluZy4uDQoNCi1Fa3INCg0KDQoNCg0K V2FybSByZWdhcmRzLCBOYW5jeSAoYW5kIEphY2spDQoNCl9fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fDQpUTFMgbWFpbGluZyBsaXN0DQpUTFNAaWV0Zi5vcmc8 bWFpbHRvOlRMU0BpZXRmLm9yZz4NCmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGlu Zm8vdGxzDQoNCg== --_000_7E9735B979F44E0B8701676048893CB4ciscocom_ Content-Type: text/html; charset="utf-8" Content-ID: <6CFD0AB496EF2E4797AF081DC0A86EE5@emea.cisco.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2 IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToy IDE1IDUgMiAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3Jt YWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1i b3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJp IixzYW5zLXNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXBy aW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQph OnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5 Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnAuTXNv TGlzdFBhcmFncmFwaCwgbGkuTXNvTGlzdFBhcmFncmFwaCwgZGl2Lk1zb0xpc3RQYXJhZ3JhcGgN Cgl7bXNvLXN0eWxlLXByaW9yaXR5OjM0Ow0KCW1hcmdpbi10b3A6MGluOw0KCW1hcmdpbi1yaWdo dDowaW47DQoJbWFyZ2luLWJvdHRvbTowaW47DQoJbWFyZ2luLWxlZnQ6LjVpbjsNCgltYXJnaW4t Ym90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJy aSIsc2Fucy1zZXJpZjt9DQpwLm1zb25vcm1hbDAsIGxpLm1zb25vcm1hbDAsIGRpdi5tc29ub3Jt YWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0 bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0KCW1h cmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJp IixzYW5zLXNlcmlmO30NCnNwYW4uRW1haWxTdHlsZTE4DQoJe21zby1zdHlsZS10eXBlOnBlcnNv bmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOndp bmRvd3RleHQ7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7 DQoJZm9udC1zaXplOjEwLjBwdDt9DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo4LjVpbiAx MS4waW47DQoJbWFyZ2luOjEuMGluIDEuMGluIDEuMGluIDEuMGluO30NCmRpdi5Xb3JkU2VjdGlv bjENCgl7cGFnZTpXb3JkU2VjdGlvbjE7fQ0KLyogTGlzdCBEZWZpbml0aW9ucyAqLw0KQGxpc3Qg bDANCgl7bXNvLWxpc3QtaWQ6MjA1NDU3MDcwNTsNCgltc28tbGlzdC10eXBlOmh5YnJpZDsNCglt c28tbGlzdC10ZW1wbGF0ZS1pZHM6LTEyNzk3ODUxNDYgNjc2OTg3MDMgNjc2OTg3MTMgNjc2OTg3 MTUgNjc2OTg3MDMgNjc2OTg3MTMgNjc2OTg3MTUgNjc2OTg3MDMgNjc2OTg3MTMgNjc2OTg3MTU7 fQ0KQGxpc3QgbDA6bGV2ZWwxDQoJe21zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZl bC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47fQ0KQGxpc3QgbDA6 bGV2ZWwyDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmFscGhhLWxvd2VyOw0KCW1zby1sZXZl bC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0 LWluZGVudDotLjI1aW47fQ0KQGxpc3QgbDA6bGV2ZWwzDQoJe21zby1sZXZlbC1udW1iZXItZm9y bWF0OnJvbWFuLWxvd2VyOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1u dW1iZXItcG9zaXRpb246cmlnaHQ7DQoJdGV4dC1pbmRlbnQ6LTkuMHB0O30NCkBsaXN0IGwwOmxl dmVsNA0KCXttc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0 aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluO30NCkBsaXN0IGwwOmxldmVsNQ0KCXttc28t bGV2ZWwtbnVtYmVyLWZvcm1hdDphbHBoYS1sb3dlcjsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9u ZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWlu O30NCkBsaXN0IGwwOmxldmVsNg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpyb21hbi1sb3dl cjsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9u OnJpZ2h0Ow0KCXRleHQtaW5kZW50Oi05LjBwdDt9DQpAbGlzdCBsMDpsZXZlbDcNCgl7bXNvLWxl dmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRl eHQtaW5kZW50Oi0uMjVpbjt9DQpAbGlzdCBsMDpsZXZlbDgNCgl7bXNvLWxldmVsLW51bWJlci1m b3JtYXQ6YWxwaGEtbG93ZXI7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVs LW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjt9DQpAbGlzdCBsMDps ZXZlbDkNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6cm9tYW4tbG93ZXI7DQoJbXNvLWxldmVs LXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpyaWdodDsNCgl0ZXh0 LWluZGVudDotOS4wcHQ7fQ0Kb2wNCgl7bWFyZ2luLWJvdHRvbTowaW47fQ0KdWwNCgl7bWFyZ2lu LWJvdHRvbTowaW47fQ0KLS0+PC9zdHlsZT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9IkVOLVVTIiBs aW5rPSJibHVlIiB2bGluaz0icHVycGxlIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj5IaSBFcmljLDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+VGhhbmtzIGZvciB0aGUgcHJvbXB0IGZlZWRiYWNrISAmbmJzcDtQbGVhc2Ugc2Vl IGZ1cnRoZXIgY29tbWVudHMvcXVlc3Rpb25zIGJlbG93OjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2IHN0eWxlPSJib3JkZXI6 bm9uZTtib3JkZXItdG9wOnNvbGlkICNCNUM0REYgMS4wcHQ7cGFkZGluZzozLjBwdCAwaW4gMGlu IDBpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEy LjBwdDtjb2xvcjpibGFjayI+RnJvbTogPC9zcGFuPjwvYj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjEyLjBwdDtjb2xvcjpibGFjayI+RXJpYyBSZXNjb3JsYSAmbHQ7ZWtyQHJ0Zm0uY29tJmd0Ozxi cj4NCjxiPkRhdGU6IDwvYj5Nb25kYXksIEF1Z3VzdCAyMCwgMjAxOCBhdCAxMzo1ODxicj4NCjxi PlRvOiA8L2I+JnF1b3Q7bmNhbXdpbmdAY2lzY28uY29tJnF1b3Q7ICZsdDtuY2Ftd2luZ0BjaXNj by5jb20mZ3Q7PGJyPg0KPGI+Q2M6IDwvYj4mcXVvdDt0bHNAaWV0Zi5vcmcmcXVvdDsgJmx0O3Rs c0BpZXRmLm9yZyZndDs8YnI+DQo8Yj5TdWJqZWN0OiA8L2I+UmU6IFtUTFNdIGludGVncml0eSBv bmx5IGNpcGhlcnN1aXRlczxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PGEgbmFtZT0iX01haWxPcmlnaW5hbEJvZHkiPjxvOnA+Jm5i c3A7PC9vOnA+PC9hPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bh bj48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1zby1ib29r bWFyazpfTWFpbE9yaWdpbmFsQm9keSI+T24gTW9uLCBBdWcgMjAsIDIwMTggYXQgMTo0OCBQTSwg TmFuY3kgQ2FtLVdpbmdldCAobmNhbXdpbmcpICZsdDs8L3NwYW4+PGEgaHJlZj0ibWFpbHRvOm5j YW13aW5nPTQwY2lzY28uY29tQGRtYXJjLmlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4g c3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+bmNhbXdpbmc9NDBjaXNjby5j b21AZG1hcmMuaWV0Zi5vcmc8L3NwYW4+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9y aWdpbmFsQm9keSI+PC9zcGFuPjwvYT48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3Jp Z2luYWxCb2R5Ij4mZ3Q7DQogd3JvdGU6PG86cD48L286cD48L3NwYW4+PC9wPg0KPGJsb2NrcXVv dGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFk ZGluZzowaW4gMGluIDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tcmlnaHQ6MGlu Ij4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4t dG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0ibXNv LWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij5BbGwsPG86cD48L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1t YXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3Jp Z2luYWxCb2R5Ij5BIGNvdXBsZSBJb1QgY29uc29ydGl1bXMgYXJlIHRyeWluZyB0byBlbWJyYWNl IHRoZSBpbXByb3ZlbWVudHMgbWFkZSB0byBUTFMgMS4zIGFuZCBhcyB0aGV5IGRlZmluZSB0aGVp ciBuZXcgc2VjdXJpdHkgY29uc3RydWN0cyB3b3VsZA0KIGxpa2UgdG8gYWRvcHQgdGhlIGxhdGVz dCBwcm90b2NvbHMsIGluIHRoaXMgY2FzZSBUTFMgMS4zLiZuYnNwOyZuYnNwOyBUbyB0aGF0IGV4 dGVudCwgdGhleSBoYXZlIGEgc3Ryb25nIG5lZWQgZm9yIG11dHVhbCBhdXRoZW50aWNhdGlvbiwg YnV0IGludGVncml0eSBvbmx5IChubyBjb25maWRlbnRpYWxpdHkpIHJlcXVpcmVtZW50cy4mbmJz cDsNCjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt c28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4g c3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+Jm5ic3A7PG86cD48L286cD48 L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjxibG9ja3F1b3RlIHN0 eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6 MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXJpZ2h0OjBpbiI+DQo8 ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1h bHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9Im1zby1ib29r bWFyazpfTWFpbE9yaWdpbmFsQm9keSI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJn aW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2lu YWxCb2R5Ij5JbiBmb2xsb3dpbmcgdGhlIG5ldyBJQU5BIHJ1bGVzLCB3ZSBoYXZlIHBvc3RlZCB0 aGUgZHJhZnQNCjwvc3Bhbj48YSBocmVmPSJodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJh ZnQtY2Ftd2luZ2V0LXRscy10czEzLW1hY2NpcGhlcnN1aXRlcy0wMCIgdGFyZ2V0PSJfYmxhbmsi PjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPmh0dHBzOi8vdG9v bHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1jYW13aW5nZXQtdGxzLXRzMTMtbWFjY2lwaGVyc3VpdGVz LTAwPC9zcGFuPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPjwv c3Bhbj48L2E+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+DQog dG8gZG9jdW1lbnQgcmVxdWVzdCBmb3IgcmVnaXN0cmF0aW9ucyBvZiBITUFDIGJhc2VkIGNpcGhl ciBzZWxlY3Rpb25zIHdpdGggVExTIDEuM+KApi4uYW5kIGFyZSBzb2xpY2l0aW5nIGZlZWRiYWNr IGZyb20gdGhlIFdHIG9uIHRoZSBkcmFmdCBhbmQgaXRzIHBhdGggZm9yd2FyZC48bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJv ZHkiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJvZHki Pk5hbmN5LDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPjxv OnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPkFzIHlv dSBzYXksIHlvdSBkb24ndCBuZWVkIFdHIGFwcHJvdmFsIGZvciBjb2RlIHBvaW50IHJlZ2lzdHJh dGlvbiBhcyBsb25nIGFzIHlvdSBkb24ndCB3YW50IFJlY29tbWVuZGVkIHN0YXR1cy48bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij48bzpwPiZuYnNwOzwvbzpw Pjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij5XaXRoIHRoYXQgc2FpZCwgSSBk b24ndCB0aGluayB0aGlzIGRvY3VtZW50IG1ha2VzIGEgdmVyeSBzdHJvbmcgY2FzZSBmb3IgdGhl c2UgY2lwaGVyIHN1aXRlcy4gRXNzZW50aWFsbHkgeW91IHNheTo8bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0ibXNv LWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8b2wgc3R5bGU9Im1hcmdpbi10b3A6MGluIiBzdGFydD0iMSIgdHlw ZT0iMSI+DQo8bGkgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJtYXJnaW4tbGVmdDow aW47bXNvLWxpc3Q6bDAgbGV2ZWwxIGxmbzEiPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01h aWxPcmlnaW5hbEJvZHkiPldlIGRvbid0IG5lZWQgY29uZmlkZW50aWFsaXR5PG86cD48L286cD48 L3NwYW4+PC9saT48L29sPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1hcmdpbi1sZWZ0Oi4yNWluIj48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3Jp Z2luYWxCb2R5Ij4yLiBDb2RlIGZvb3RwcmludCBpcyBpbXBvcnRhbnQ8bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i bXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0ibXNv LWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij5HZW5lcmFsbHksIEknbSBub3QgdmVyeSBlbnRo dXNpYXN0aWMgYWJvdXQgYXJndW1lbnQgKDEpLiBJdCdzIG9mdGVuIHRoZSBjYXNlIHRoYXQgYXBw bGljYXRpb25zIHN1cGVyZmljaWFsbHkgbmVlZCBpbnRlZ3JpdHkgYnV0IGFjdHVhbGx5IHJlbHkg b24gY29uZmlkZW50aWFsaXR5IGluIHNvbWUgd2F5ICh0aGUgb2J2aW91cyBjYXNlDQogaXMgdGhh dCBIVFRQIENvb2tpZXMgYXJlIGFuIGF1dGhlbnRpY2F0aW9uIG1lY2hhbmlzbSwgYnV0IGJlY2F1 c2UgdGhleSBhcmUgYSBiZWFyZXIgdG9rZW4sIHlvdSBhY3R1YWxseSBuZWVkIGNvbmZpZGVudGlh dGlsdHkpLiBJdCdzIG11Y2ggZWFzaWVyIHRvIGp1c3QgYWx3YXlzIHN1cHBseSBjb25maWRlbnRp YWxpdHkgdGhhbiB0byB0cnkgdG8gcmVhc29uIGFib3V0IHdoZW4gaXQgaXMgb3IgaXMgbm90IG5l ZWRlZC48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij5bTkNXXSBXZSBhcmUgd29ya2lu ZyBkaWxpZ2VudGx5IGluIHNldmVyYWwgSW9UIGJhc2VkIGNvbnNvcnRpdW1zIHRvIGJlZ2luIHRv IGRlZmluZSBzZWN1cml0eSBhcm91bmQgdGhvc2UgcHJvdG9jb2xzIGFzIG1hbnkgdG9kYXkgZG8g bm90IGFmZm9yZCBhbnkgcHJvdGVjdGlvbiBhdCBhbGwuJm5ic3A7IEF0IG1pbmltdW0sIHdlIHdh bnQgdG8NCiBlbnN1cmUgdGhlcmUgaXMgbXV0dWFsIGF1dGhlbnRpY2F0aW9uIGFuZCBhdXRob3Jp emF0aW9uIGFzIHdlbGwgYXMgbWVzc2FnZSBpbnRlZ3JpdHkuJm5ic3A7IEFzIHdlIGNpdGUgaW4g dGhlIGRyYWZ0LCBtYW55IOKAnHRoaW5nc+KAnSBwZXJmb3JtIHJlcGV0aXRpdmUgdGFza3MgdGhh dCB3YW50IHRvIGNvbW11bmljYXRlIG1vdGlvbiwgc3BlZWQgb3Igb3RoZXIgbWFjaGluZSBjb250 cm9sIGZ1bmN0aW9ucyB0aGF0IGFyZSBub3QgZGVlbWVkIHRvIGJlIHByaXZhdGUuPG86cD48L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1zby1ib29r bWFyazpfTWFpbE9yaWdpbmFsQm9keSI+SSBjYW4gc2VlIHlvdXIgcG9pbnQvYmVsaWVmIHRoYXQg aXQgaXMgbXVjaCBlYXNpZXIgdG8gaW5jbHVkZSBjb25maWRlbnRpYWxpdHksIGJ1dCBzb21lIGNo aXBzZXRzIHRvZGF5IGVzcGVjaWFsbHkgYXQgdGhvc2UgbGV2ZWxzIChhbmQgY29zdCkgYXJlIG5v dCBjb25zdHJ1Y3RlZCB3aXRoIHRob3NlIHByb3Zpc2lvbnMgdG9kYXksIHRob3VnaA0KIHRoZXkg ZG8gaGF2ZSBITUFDIGNhcGFiaWxpdGllcy4mbmJzcDsgPG86cD48L286cD48L3NwYW4+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1zby1ib29r bWFyazpfTWFpbE9yaWdpbmFsQm9keSI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFy azpfTWFpbE9yaWdpbmFsQm9keSI+VGhlIHNlY29uZCBhcmd1bWVudCBpcyB0aGF0IHlvdSBhcmUg dHJ5aW5nIHRvIGtlZXAgY29kZSBzaXplIGRvd24uIEl0J3MgdHJ1ZSB0aGF0IG5vdCBoYXZpbmcg QUVTIGlzIGNoZWFwZXIgdGhhbiBoYXZpbmcgQUVTLCBidXQgaXQncyBwb3NzaWJsZSB0byBoYXZl IHZlcnkgbGlnaHR3ZWlnaHQgQUVTIHN0YWNrcyAoc2VlIGZvciBpbnN0YW5jZToNCjwvc3Bhbj48 YSBocmVmPSJodHRwczovL2dpdGh1Yi5jb20vMDFvcmcvdGlueWNyeXB0Ij48c3BhbiBzdHlsZT0i bXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij5odHRwczovL2dpdGh1Yi5jb20vMDFvcmcv dGlueWNyeXB0PC9zcGFuPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJv ZHkiPjwvc3Bhbj48L2E+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9k eSI+KS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij5bTkNXXSBTbywgaXQgaXMgbm90 IGp1c3QgYWJvdXQgY29kZSBzaXplLCBidXQgb3ZlcmFsbCBoYXJkd2FyZSBhdmFpbGFiaWxpdHkg YW5kIGNvc3TigKYuPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9k eSI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+ U28sIG92ZXJhbGwsIHRoaXMgZG9lc24ndCBzZWVtIHZlcnkgY29tcGVsbGluZy4uPG86cD48L286 cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+PG86cD4mbmJzcDs8L286cD48 L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+LUVrcjxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJt c28tYm9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJtc28t Ym9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJtc28tYm9v a21hcms6X01haWxPcmlnaW5hbEJvZHkiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwv ZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICND Q0NDQ0MgMS4wcHQ7cGFkZGluZzowaW4gMGluIDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDtt YXJnaW4tcmlnaHQ6MGluIj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48 c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij4mbmJzcDs8bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10 b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJtc28t Ym9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPldhcm0gcmVnYXJkcywgTmFuY3kgKGFuZCBKYWNr KTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibWFyZ2luLWJvdHRvbToxMi4wcHQiPjxzcGFuIHN0eWxlPSJtc28tYm9va21h cms6X01haWxPcmlnaW5hbEJvZHkiPjxicj4NCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fPGJyPg0KVExTIG1haWxpbmcgbGlzdDxicj4NCjwvc3Bhbj48YSBo cmVmPSJtYWlsdG86VExTQGlldGYub3JnIj48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWls T3JpZ2luYWxCb2R5Ij5UTFNAaWV0Zi5vcmc8L3NwYW4+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFy azpfTWFpbE9yaWdpbmFsQm9keSI+PC9zcGFuPjwvYT48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJr Ol9NYWlsT3JpZ2luYWxCb2R5Ij48YnI+DQo8L3NwYW4+PGEgaHJlZj0iaHR0cHM6Ly93d3cuaWV0 Zi5vcmcvbWFpbG1hbi9saXN0aW5mby90bHMiIHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0i bXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij5odHRwczovL3d3dy5pZXRmLm9yZy9tYWls bWFuL2xpc3RpbmZvL3Rsczwvc3Bhbj48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3Jp Z2luYWxCb2R5Ij48L3NwYW4+PC9hPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmln aW5hbEJvZHkiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdp bmFsQm9keSI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwv ZGl2Pg0KPC9ib2R5Pg0KPC9odG1sPg0K --_000_7E9735B979F44E0B8701676048893CB4ciscocom_-- From nobody Mon Aug 20 16:39:31 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B2AFF130E3D for ; Mon, 20 Aug 2018 16:39:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ry7t3Wfcg_Qr for ; Mon, 20 Aug 2018 16:39:26 -0700 (PDT) Received: from mail-ed1-x532.google.com (mail-ed1-x532.google.com [IPv6:2a00:1450:4864:20::532]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 10C1A130E3A for ; Mon, 20 Aug 2018 16:39:26 -0700 (PDT) Received: by mail-ed1-x532.google.com with SMTP id o8-v6so9521251edt.13 for ; Mon, 20 Aug 2018 16:39:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=1GZxptpQ6iO41ZGYm2Ii8gMDx4PcT7YG7YzLq6UF6MM=; b=U4DDGFr8pREqOihb/CN0EFMKzsGwaeLNd5r3H7U6x6tGaMdm9TZkXBVpPUB+I2MrVM yZJEJGue1gsn1WajM8Gw148TUVlaR78ICb5WjjY2a39BRzvYKGZoBZb4iSyUhQQCGP/X w5yw49PKpRjbSh+3eAkEKpUQKTxK7sZo9XkZSMRGt6l5In4RagGgdQ2O2IE9oLpsL7Yr LdsJJrIYxQS9uxigz+K1uhtx/9s+G+aG3vqXG9005uZwx7DounlqN31FNK2mqCuBum+m s7BOaMHPwOdRrNHgLmg+BH9WFlQDIxbY2Ma/eibp9GQdmMTPkxIRMeuHqNbeH0AikC00 b53g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=1GZxptpQ6iO41ZGYm2Ii8gMDx4PcT7YG7YzLq6UF6MM=; b=blxCARgAwn+VLOBDqsLdbLQ00b6L92cCOn6QForxP3WRE1ZCbAcBR+zyjWySCn5g7S 8laIImruXk4GYQmc3NmGIyOE8F9XWjwPF+bx1l2rFosT6MNodG6OFOr0nGgAo/G4RNTB HLziSSzQ+DC8R5kNa/P2AicgM3uC7RjJ4uHT37CgfN5L52xLdaKTB0U4rqAFnBKWOclz 5d6g+28iNeFnVUOus1tWlOfkwhSTrhDw/U75vIjgOC8m90GkUpsHaRXtcWm/V3Q7aktr oIZL17cYGxjl8atx0G/rLCAyXw5dzTN2mrzBUlWehyUH2Er6uRUbZ6k1NFyGg2/jgz9S 9FzA== X-Gm-Message-State: AOUpUlGTVIjVKHWNtLIknEOWDtIr8NeU5DCXIXFle7xHyIaJSmiuDdxm 5fT1JVa0Be+n94z/GBtgkZ9iRwMaSHlZ2h9+5l8= X-Google-Smtp-Source: AA+uWPwlaHHrEFFZeF3gHTWF5QREUE5wJSrYpj5rl2t0Cybhn5/8Y0TuWWtg4bcoTgjPyN5MbjuYbFlrMoug3gUpqIY= X-Received: by 2002:a50:b6e3:: with SMTP id f32-v6mr57614369ede.147.1534808364516; Mon, 20 Aug 2018 16:39:24 -0700 (PDT) MIME-Version: 1.0 References: <7E9735B9-79F4-4E0B-8701-676048893CB4@cisco.com> In-Reply-To: <7E9735B9-79F4-4E0B-8701-676048893CB4@cisco.com> From: Judson Wilson Date: Mon, 20 Aug 2018 16:39:12 -0700 Message-ID: To: Eric Rescorla , "Nancy Cam-Winget (ncamwing)" Cc: "tls@ietf.org" Content-Type: multipart/alternative; boundary="0000000000005d8b710573e66bed" Archived-At: Subject: Re: [TLS] integrity only ciphersuites X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Aug 2018 23:39:29 -0000 --0000000000005d8b710573e66bed Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable How are these devices authenticating? On Mon, Aug 20, 2018 at 4:14 PM Nancy Cam-Winget (ncamwing) wrote: > Hi Eric, > > Thanks for the prompt feedback! Please see further comments/questions > below: > > > > *From: *Eric Rescorla > *Date: *Monday, August 20, 2018 at 13:58 > *To: *"ncamwing@cisco.com" > *Cc: *"tls@ietf.org" > > > *Subject: *Re: [TLS] integrity only ciphersuites > > > > > > > > On Mon, Aug 20, 2018 at 1:48 PM, Nancy Cam-Winget (ncamwing) < > ncamwing=3D40cisco.com@dmarc.ietf.org> wrote: > > All, > > A couple IoT consortiums are trying to embrace the improvements made to > TLS 1.3 and as they define their new security constructs would like to > adopt the latest protocols, in this case TLS 1.3. To that extent, they > have a strong need for mutual authentication, but integrity only (no > confidentiality) requirements. > > > > > > In following the new IANA rules, we have posted the draft > https://tools.ietf.org/html/draft-camwinget-tls-ts13-macciphersuites-00 > to document request for registrations of HMAC based cipher selections wit= h > TLS 1.3=E2=80=A6..and are soliciting feedback from the WG on the draft an= d its path > forward. > > > > Nancy, > > > > As you say, you don't need WG approval for code point registration as lon= g > as you don't want Recommended status. > > > > With that said, I don't think this document makes a very strong case for > these cipher suites. Essentially you say: > > > > 1. We don't need confidentiality > > 2. Code footprint is important > > > > Generally, I'm not very enthusiastic about argument (1). It's often the > case that applications superficially need integrity but actually rely on > confidentiality in some way (the obvious case is that HTTP Cookies are an > authentication mechanism, but because they are a bearer token, you actual= ly > need confidentiatilty). It's much easier to just always supply > confidentiality than to try to reason about when it is or is not needed. > > [NCW] We are working diligently in several IoT based consortiums to begin > to define security around those protocols as many today do not afford any > protection at all. At minimum, we want to ensure there is mutual > authentication and authorization as well as message integrity. As we cit= e > in the draft, many =E2=80=9Cthings=E2=80=9D perform repetitive tasks that= want to > communicate motion, speed or other machine control functions that are not > deemed to be private. > > I can see your point/belief that it is much easier to include > confidentiality, but some chipsets today especially at those levels (and > cost) are not constructed with those provisions today, though they do hav= e > HMAC capabilities. > > > > The second argument is that you are trying to keep code size down. It's > true that not having AES is cheaper than having AES, but it's possible to > have very lightweight AES stacks (see for instance: > https://github.com/01org/tinycrypt). > > [NCW] So, it is not just about code size, but overall hardware > availability and cost=E2=80=A6. > > > > So, overall, this doesn't seem very compelling.. > > > > -Ekr > > > > > > > > > > Warm regards, Nancy (and Jack) > > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > --0000000000005d8b710573e66bed Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
How are these devices authenticating?


On Mon, Aug 20, 2018 at 4:14 PM Nancy Cam-Wing= et (ncamwing) <ncamwing=3D= 40cisco.com@dmarc.ietf.org> wrote:

Hi Eric,

Thanks for the prompt feedback!=C2=A0 Please see fur= ther comments/questions below:

=C2=A0

From= : Eric Rescorla <= ;ekr@rtfm.com>
Date: Monday, August 20, 2018 at 13:58
To: "nc= amwing@cisco.com" <ncamwing@cisco.com>
Cc: "tls@ietf= .org" <tls@ie= tf.org>


Subject: Re: [TLS] integrity only ciphersuites<= /p>

=C2=A0

= =C2=A0

=C2=A0

On Mon, Aug 20, 2018 at 1:48 PM, Nancy Cam-Win= get (ncamwing) <ncamwing=3D40cisco.com@dmarc.ietf.org> wrote:

All,

A couple IoT consortiums are trying to embrace= the improvements made to TLS 1.3 and as they define their new security con= structs would like to adopt the latest protocols, in this case TLS 1.3.=C2=A0=C2=A0 To t= hat extent, they have a strong need for mutual authentication, but integrit= y only (no confidentiality) requirements.=C2=A0

=C2=A0

=C2=A0

In following the new IANA rules, we have poste= d the draft https://tools.ietf.org/html/draft-c= amwinget-tls-ts13-macciphersuites-00 to document request for registrations of HMAC based cipher selections with= TLS 1.3=E2=80=A6..and are soliciting feedback from the WG on the draft and= its path forward.

=C2=A0

Nancy,

=C2=A0

As you say, you don't need WG approval for= code point registration as long as you don't want Recommended status.<= u>

=C2=A0

With that said, I don't think this documen= t makes a very strong case for these cipher suites. Essentially you say:=

=C2=A0

  1. We don't need confidentiality

2. Code footprint = is important

=C2=A0

Generally, I'm not very enthusiastic about= argument (1). It's often the case that applications superficially need= integrity but actually rely on confidentiality in some way (the obvious ca= se is that HTTP Cookies are an authentication mechanism, but because they are= a bearer token, you actually need confidentiatilty). It's much easier = to just always supply confidentiality than to try to reason about when it i= s or is not needed.

[NCW] We are working diligently in sever= al IoT based consortiums to begin to define security around those protocols= as many today do not afford any protection at all.=C2=A0 At minimum, we wa= nt to ensure there is mutual authentication and authorization as well as message= integrity.=C2=A0 As we cite in the draft, many =E2=80=9Cthings=E2=80=9D pe= rform repetitive tasks that want to communicate motion, speed or other mach= ine control functions that are not deemed to be private.

I can see your point/belief that it is much ea= sier to include confidentiality, but some chipsets today especially at thos= e levels (and cost) are not constructed with those provisions today, though they do have HMAC capabilities.=C2=A0

=C2=A0

The second argument is that you are trying to = keep code size down. It's true that not having AES is cheaper than havi= ng AES, but it's possible to have very lightweight AES stacks (see for = instance: https://github.com/01org/tinycrypt).

[NCW] So, it is not just about code size= , but overall hardware availability and cost=E2=80=A6.=

=C2=A0

So, overall, this doesn't seem very compel= ling..

=C2=A0

-Ekr

=C2=A0

=C2=A0

=C2=A0

=C2=A0

Warm regards, Nancy (and Jack)


_______________________________________________
TLS mailing list
TLS@ietf.org=
https://www.ietf.org/mailman/listinfo/tls=

_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls
--0000000000005d8b710573e66bed-- From nobody Mon Aug 20 16:45:48 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 604FC130E42 for ; Mon, 20 Aug 2018 16:45:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id G4KEQYKFsvz1 for ; Mon, 20 Aug 2018 16:45:44 -0700 (PDT) Received: from dragaera.releasedominatrix.com (dragaera.releasedominatrix.com [198.0.208.83]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 07B90130E3D for ; Mon, 20 Aug 2018 16:45:44 -0700 (PDT) Received: by dragaera.releasedominatrix.com (Postfix, from userid 501) id 797DA33D283; Mon, 20 Aug 2018 23:45:43 +0000 (UTC) Sender: geoffk@localhost.localdomain To: "Nancy Cam-Winget \(ncamwing\)" Cc: "tls@ietf.org" References: From: Geoffrey Keating Date: 20 Aug 2018 16:45:43 -0700 In-Reply-To: Message-ID: Lines: 30 User-Agent: Gnus/5.09 (Gnus v5.9.0) Emacs/21.4 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Archived-At: Subject: Re: [TLS] integrity only ciphersuites X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Aug 2018 23:45:47 -0000 "Nancy Cam-Winget \(ncamwing\)" wri= tes: > In following the new IANA rules, we have posted the draft > https://tools.ietf.org/html/draft-camwinget-tls-ts13-macciphersuites-00 > to document request for registrations of HMAC based cipher > selections with TLS 1.3=E2=80=A6..and are soliciting feedback from the WG= on > the draft and its path forward. This draft needs more security analysis than is currently there, and probably it needs to define not just a ciphersuite but an entire profile for using TLS with this ciphersuite. Some topics: * Anything that relies on EncryptedExtensions should probably not be used. * The session ticket properties change in the absence of encryption. In existing TLS 1.3, they are sent only after Finished and so are encrypted; now they are public. I am not sure if this changes the security model but it definitely makes it easier to attack the ticket. * A less-obvious consequence to the lack of confidentality is that a typical implementation, an attacker can selectively block messages knowing their contents (by breaking the connection). In the weather example this might be used to manipulate average daily temperature by blocking only higher or only lower readings. In the robot example this might be used to cause it to exceed its limits by allowing movement commands only in one direction. I wonder whether it's really helpful to call the result 'TLS' and not something else? From nobody Mon Aug 20 16:59:33 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 911F9130E81 for ; Mon, 20 Aug 2018 16:59:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HlqoRLMR7t7s for ; Mon, 20 Aug 2018 16:59:18 -0700 (PDT) Received: from orthanc.ca (orthanc.ca [IPv6:2607:f2f8:abf8::2]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 23205130E58 for ; Mon, 20 Aug 2018 16:59:18 -0700 (PDT) Received: from orthanc.ca (l4 [127.0.0.1]) by orthanc.ca (8.15.2/8.15.2) with ESMTPS id w7KNxHfZ003084 (version=TLSv1.2 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO) for ; Mon, 20 Aug 2018 16:59:17 -0700 (PDT) (envelope-from lyndon@orthanc.ca) Received: (from lyndon@localhost) by orthanc.ca (8.15.2/8.15.2/Submit) id w7KNxH0X003083; Mon, 20 Aug 2018 16:59:17 -0700 (PDT) (envelope-from lyndon) Message-Id: <201808202359.w7KNxH0X003083@orthanc.ca> From: Lyndon Nerenberg To: "tls@ietf.org" In-reply-to: References: Comments: In-reply-to Ted Lemon message dated "Mon, 20 Aug 2018 18:47:15 -0400." MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-ID: <3081.1534809557.1@orthanc.ca> Date: Mon, 20 Aug 2018 16:59:17 -0700 Archived-At: Subject: Re: [TLS] EXTERNAL: Re: integrity only ciphersuites X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Aug 2018 23:59:32 -0000 There is one other -- admittedly esoteric! -- place where a NULL cipher would he useful: Amateur Radio applications. By law, we are forbidden from transmitting encrypted traffic, yet there are use cases where integrity protection in the absence of data content protection would be of benefit. A very common case is controlling a remote repeater site. Using data integrity coupled with a client X.509 certificate means I can restrict access to the "control" service at the site. It's fine if people see the traffic in flight, since they won't be able to authenticate to do a replay or issue their own commands. This is a distinct improvement over existing control schemes, which typically use DTMF touch tone commands that anyone can trivially figure out. As I said, a very niche case. It has been done before, using IPsec AH, but that's extremely heavy weight, and a pain to configure and maintain. It also requires a full-on IP fabric, whereas TLS can be implemented directly on top of AX.25 sessions, which represent the vast majority of amateur radio packet data links (which I acknowledge puts this outside the realm of the Internet, and therefore the IETF). --lyndon (VE7TFX) From nobody Mon Aug 20 17:17:33 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 396B5130DF7 for ; Mon, 20 Aug 2018 17:17:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HqIvWeGTStVv for ; Mon, 20 Aug 2018 17:17:29 -0700 (PDT) Received: from mail-ed1-x535.google.com (mail-ed1-x535.google.com [IPv6:2a00:1450:4864:20::535]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B0E3B124D68 for ; Mon, 20 Aug 2018 17:17:28 -0700 (PDT) Received: by mail-ed1-x535.google.com with SMTP id h1-v6so9575447eds.1 for ; Mon, 20 Aug 2018 17:17:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to; bh=aotuRepht0VpauLNSjXQdyuRinSyZn/Xx3bMKlAmGIQ=; b=SfCYqCxCOtiH5/7osF67Tb+d1HvCfUMvVLLpJwxAuzudVieywud/acjRjor3EhQkH0 r4c1JLbPOSYRwhT45NDTtqt+qrQS46pNFR4b6R6cb9MQ8rJHeVUAmz36aSfcH6matL8q y1e7SjVE5XzzmEZVHMe6mN48rx7VGqs2qKCL1yxqcl8q5y6rhLsOnprzhW3juW7NFwL6 /zTKHPCKKVsosCSVLIA28hmsKOAyokR1BaZ2gm11F46AqSaJOs/+wBy7Nd0PmU+J0f8Z Q9U7t8K2prj/iY2UACyUdEnJYyElQsxki71/S25Imfzd+JN6dDN6ZitwuqwAX7iNJC8i fHEA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to; bh=aotuRepht0VpauLNSjXQdyuRinSyZn/Xx3bMKlAmGIQ=; b=d91byY4X05MvPXtz0Gnp+OnKrRJzlPr5AA7izzk3gzhaxfJkoV15dhSjgkJN7R111M XUh9e5ny8d/oTO2Q2MnV4/416AOmD8BwFII32GzvWOjqW/wmI7toJ/WIekrfTRWcMumE bvSX5VKduLt4STQyySOUI+gqxwdHsxMuKCAmB6c4kp2PckGHMU6wO60w8qsegXj4IIY8 CyeYM5qEbUwy/FJlmhAQFNLcaITUJEx0W77arlG4QE53RWjeUFJMs+lzGAZTwy2BxxWp Me74clIwXlykj7u4HuONrkLYAQT7+zZjnDWTl4vH2+FKcPPHGjtIG8e2sduW67qE8bCT k8Fg== X-Gm-Message-State: AOUpUlGx+2Rz8CFmrVUK8fUABuTgml48znAQYJScKGFaKD+xbJrDO9bD 4nx+spdccnyaSyNUIJ4mw8FWnnaX1yeKUgGmRUd+EA== X-Google-Smtp-Source: AA+uWPz802a9rXP8VXToO5FPFVmbt+KajuESOoUYV14QH0u2YlkDaWHxMneXyh4HNyBtZ7QbZf1KyQdNx7aSgnKUBYQ= X-Received: by 2002:aa7:d307:: with SMTP id p7-v6mr60346391edq.143.1534810647212; Mon, 20 Aug 2018 17:17:27 -0700 (PDT) MIME-Version: 1.0 References: <201808202359.w7KNxH0X003083@orthanc.ca> In-Reply-To: <201808202359.w7KNxH0X003083@orthanc.ca> From: Judson Wilson Date: Mon, 20 Aug 2018 17:17:15 -0700 Message-ID: To: Lyndon Nerenberg , "tls@ietf.org" Content-Type: multipart/alternative; boundary="0000000000006cb8e40573e6f3ac" Archived-At: Subject: Re: [TLS] EXTERNAL: Re: integrity only ciphersuites X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Aug 2018 00:17:31 -0000 --0000000000006cb8e40573e6f3ac Content-Type: text/plain; charset="UTF-8" FWIW HAM might require public key signing rather than MACs, since MACs are meaningless without a key. On Mon, Aug 20, 2018 at 5:02 PM Lyndon Nerenberg wrote: > There is one other -- admittedly esoteric! -- place where a NULL > cipher would he useful: Amateur Radio applications. > > By law, we are forbidden from transmitting encrypted traffic, yet > there are use cases where integrity protection in the absence of > data content protection would be of benefit. > > A very common case is controlling a remote repeater site. Using > data integrity coupled with a client X.509 certificate means I can > restrict access to the "control" service at the site. It's fine > if people see the traffic in flight, since they won't be able to > authenticate to do a replay or issue their own commands. > > This is a distinct improvement over existing control schemes, which > typically use DTMF touch tone commands that anyone can trivially > figure out. > > As I said, a very niche case. It has been done before, using IPsec > AH, but that's extremely heavy weight, and a pain to configure and > maintain. It also requires a full-on IP fabric, whereas TLS can > be implemented directly on top of AX.25 sessions, which represent > the vast majority of amateur radio packet data links (which I > acknowledge puts this outside the realm of the Internet, and therefore > the IETF). > > --lyndon (VE7TFX) > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > --0000000000006cb8e40573e6f3ac Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
FWIW HAM might require public key signing rather than MACs, since MACs= are meaningless without a key.


On Mon, Aug 20, 2018 at 5:02 PM Lyndon Nerenberg <lyndon@orthanc.ca> wrote:
=
There is one other -- admittedly esoteric! -= - place where a NULL
cipher would he useful: Amateur Radio applications.

By law, we are forbidden from transmitting encrypted traffic, yet
there are use cases where integrity protection in the absence of
data content protection would be of benefit.

A very common case is controlling a remote repeater site.=C2=A0 Using
data integrity coupled with a client X.509 certificate means I can
restrict access to the "control" service at the site.=C2=A0 It= 9;s fine
if people see the traffic in flight, since they won't be able to
authenticate to do a replay or issue their own commands.

This is a distinct improvement over existing control schemes, which
typically use DTMF touch tone commands that anyone can trivially
figure out.

As I said, a very niche case.=C2=A0 It has been done before, using IPsec AH, but that's extremely heavy weight, and a pain to configure and
maintain.=C2=A0 It also requires a full-on IP fabric, whereas TLS can
be implemented directly on top of AX.25 sessions, which represent
the vast majority of amateur radio packet data links (which I
acknowledge puts this outside the realm of the Internet, and therefore
the IETF).

--lyndon=C2=A0 (VE7TFX)

_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls
--0000000000006cb8e40573e6f3ac-- From nobody Mon Aug 20 21:20:25 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A580F130E1F for ; Mon, 20 Aug 2018 21:20:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.199 X-Spam-Level: X-Spam-Status: No, score=-4.199 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_MED=-2.3, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=auckland.ac.nz Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9GBExWIhxV2u for ; Mon, 20 Aug 2018 21:20:21 -0700 (PDT) Received: from mx4-int.auckland.ac.nz (mx4-int.auckland.ac.nz [130.216.125.246]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2FCC7130DF6 for ; Mon, 20 Aug 2018 21:20:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=auckland.ac.nz; i=@auckland.ac.nz; q=dns/txt; s=mail; t=1534825221; x=1566361221; h=from:to:subject:date:message-id:references:in-reply-to: content-transfer-encoding:mime-version; bh=NO04yvV1eybf0KrkTER1URD9VlaOEb81dTW1nVEGwPc=; b=Lb11uozqTytNnyYCr0Pr3tccoCZ/JaNRv09FDSlCa9Qo+r9K0cQw44X3 h/5OVy8eY9lpgJLmrw7Vd6P/y0zeBlwECPoUUETDbj7GX/m+I/kFeI2Eo vrHXztgx9smUjU+bzPAsCUCskw1tDzoagLGe14LFb8FRxC9hJ3bVLIFvv O2rk26jGkUy0gfmh7IEfIQMpexCvBweKvVT+BD0BEqM2fRXMjB9MjdJDH MbX8Xl/Tx+QY2Q27xTUGWY4FLcStKZR8qXGICzc0sg0I0qsmFYnIntopo s3MKvtCMb0dgdD/9qNQaDbO/ulzE/z4mBkLZj5lJLvZs5r0v/Gpvi23cN A==; X-IronPort-AV: E=Sophos;i="5.53,268,1531742400"; d="scan'208";a="27331558" X-Ironport-HAT: MAIL-SERVERS - $RELAYED X-Ironport-Source: 10.6.3.2 - Outgoing - Outgoing Received: from exchangemx.uoa.auckland.ac.nz (HELO uxcn13-tdc-a.UoA.auckland.ac.nz) ([10.6.3.2]) by mx4-int.auckland.ac.nz with ESMTP/TLS/AES256-SHA; 21 Aug 2018 16:20:18 +1200 Received: from uxcn13-ogg-d.UoA.auckland.ac.nz (10.6.2.5) by uxcn13-tdc-a.UoA.auckland.ac.nz (10.6.3.2) with Microsoft SMTP Server (TLS) id 15.0.1263.5; Tue, 21 Aug 2018 16:20:18 +1200 Received: from uxcn13-ogg-d.UoA.auckland.ac.nz ([10.6.2.25]) by uxcn13-ogg-d.UoA.auckland.ac.nz ([10.6.2.5]) with mapi id 15.00.1263.000; Tue, 21 Aug 2018 16:20:18 +1200 From: Peter Gutmann To: Lyndon Nerenberg , "tls@ietf.org" Thread-Topic: [TLS] EXTERNAL: Re: integrity only ciphersuites Thread-Index: AQHUONfupVOaCaGCyEKJBjZS2fPC0aTIiMGAgAERjmI= Date: Tue, 21 Aug 2018 04:20:17 +0000 Message-ID: <1534825202885.58630@cs.auckland.ac.nz> References: , <201808202359.w7KNxH0X003083@orthanc.ca> In-Reply-To: <201808202359.w7KNxH0X003083@orthanc.ca> Accept-Language: en-NZ, en-GB, en-US Content-Language: en-NZ X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [130.216.158.4] Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [TLS] EXTERNAL: Re: integrity only ciphersuites X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Aug 2018 04:20:24 -0000 Lyndon Nerenberg writes:=0A= =0A= >By law, we are forbidden from transmitting encrypted traffic, yet there ar= e=0A= >use cases where integrity protection in the absence of data content=0A= >protection would be of benefit.=0A= =0A= I've worked a lot with a set of authentication-only channels that can't be= =0A= encrypted but need strong integrity/authenticity protection. The way to de= al=0A= with this is signed/MAC'd messages, not NULL-cipher TLS.=0A= =0A= Peter.=0A= From nobody Mon Aug 20 21:32:22 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5D559130ED8 for ; Mon, 20 Aug 2018 21:32:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id idKa1ZUzfCZX for ; Mon, 20 Aug 2018 21:32:19 -0700 (PDT) Received: from straasha.imrryr.org (straasha.imrryr.org [100.2.39.101]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9AC91130EB9 for ; Mon, 20 Aug 2018 21:32:19 -0700 (PDT) Received: from [192.168.1.161] (unknown [192.168.1.161]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by straasha.imrryr.org (Postfix) with ESMTPSA id EA7FD4369 for ; Tue, 21 Aug 2018 00:32:17 -0400 (EDT) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) From: Viktor Dukhovni In-Reply-To: Date: Tue, 21 Aug 2018 00:32:16 -0400 Content-Transfer-Encoding: quoted-printable Reply-To: "" Message-Id: References: To: "" X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: Re: [TLS] integrity only ciphersuites X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Aug 2018 04:32:21 -0000 > On Aug 20, 2018, at 4:57 PM, Eric Rescorla wrote: >=20 > With that said, I don't think this document makes a very strong case = for these cipher suites. Essentially you say: >=20 > 1. We don't need confidentiality > 2. Code footprint is important There is also a use-case for communication between processes on the same machine, e.g. over unix-domain sockets and the like. Encryption in this context is pointless. TLS can be used with client certificates as a = means of client authentication. Postfix supports eNULL ciphers for unix-domain socket LMTP = communication. This works with TLS <=3D 1.2, but would require enabling unnecessary = encryption with TLS 1.3. http://www.postfix.org/TLS_README.html#client_tls_levels NOTE: Opportunistic encryption of LMTP traffic over UNIX-domain = sockets or loopback TCP connections is futile. TLS is only useful in this = context when it is mandatory, typically to allow at least one of the server or = the client to authenticate the other. The "null" cipher grade may be = appropriate in this context, when available on both client and server. The "null" = ciphers provide authentication without encryption. --=20 Viktor. From nobody Mon Aug 20 22:06:13 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9DFAD126CC7 for ; Mon, 20 Aug 2018 22:06:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.71 X-Spam-Level: X-Spam-Status: No, score=-2.71 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, T_DKIMWL_WL_MED=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=yahoo-corp.jp header.b=tn35OGLX; dkim=pass (1024-bit key) header.d=yjcorp.onmicrosoft.com header.b=l12bZ+jt Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VtJr5heIphCX for ; Mon, 20 Aug 2018 22:06:09 -0700 (PDT) Received: from obrelay04.is.kks.yahoo.co.jp (obrelay04.is.kks.yahoo.co.jp [114.111.94.245]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1EA1A130DF6 for ; Mon, 20 Aug 2018 22:06:08 -0700 (PDT) Received: from corp-ob04.is.kks.ynwp.yahoo.co.jp (corp-ob04.is.kks.ynwp.yahoo.co.jp [183.79.181.67]) by obrelay04.is.kks.yahoo.co.jp (Mailer-Daemon) with ESMTP id w7L55x3P005927; Tue, 21 Aug 2018 14:05:59 +0900 Received: from yjwex2drcas02.yjoffice.local (yjwex2casdr02.is.kks.yahoo.co.jp [172.22.63.28]) by corp-ob04.is.kks.ynwp.yahoo.co.jp (Postfix) with ESMTP id AD7E1120047; Tue, 21 Aug 2018 14:05:59 +0900 (JST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo-corp.jp; s=default; t=1534827959; bh=2Mkv7P9lKHptHkYlp3A6uCQP1E0Bp61/LrcosskWKAY=; h=From:To:CC:Subject:Date:References:In-Reply-To; b=tn35OGLXA7CELumoezGnL+mtq9YMTJwi1/Se+QzvWNZz0UqYe0lozdNvnaIPLV/Ml +blqhJqmv+bj4IZBWPZ5lNcds62agIXi+xPzyvkJfJoEnX2jjqtB4QtG7ye3GRuxu0 zKB8aeGMiHDYLtKa1FAs+s6jskVuzG5VdmS9YDXE= Received: from yjwex2drcas02.yjoffice.local (172.22.63.28) by yjwex2drcas02.yjoffice.local (172.22.63.28) with Microsoft SMTP Server (TLS) id 15.0.1293.2; Tue, 21 Aug 2018 14:05:59 +0900 Received: from yjwex2edge04.yjoffice.local (203.141.54.61) by yjwex2drcas02.yjoffice.local (172.22.63.26) with Microsoft SMTP Server id 15.0.1293.2 via Frontend Transport; Tue, 21 Aug 2018 14:05:59 +0900 Received: from JPN01-TY1-obe.outbound.protection.outlook.com (23.103.139.180) by yjwex2edge04.yahoo-corp.jp (203.141.54.61) with Microsoft SMTP Server (TLS) id 15.0.1293.2; Tue, 21 Aug 2018 14:05:44 +0900 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yjcorp.onmicrosoft.com; s=selector1-yahoocorp-jp01c; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=2Mkv7P9lKHptHkYlp3A6uCQP1E0Bp61/LrcosskWKAY=; b=l12bZ+jtg9jSs7QPbVEkPxH8g+NDrc383j+4pDqn71FwyUDSalmpfpBLDGXCCIKi5rTyO07ezK4QLY80DvBHllnchAb/QZEoQkW1n0l3dZnrU0QqYUkDMv3fSOTgYSSJ/fFDi7KqMzmKhGtwRhmVw3/fvPFje2716r+Tcd1Wgl0= Received: from TYXPR01MB1472.jpnprd01.prod.outlook.com (52.133.165.141) by TYXPR01MB0848.jpnprd01.prod.outlook.com (10.168.44.151) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1059.21; Tue, 21 Aug 2018 05:05:57 +0000 Received: from TYXPR01MB1472.jpnprd01.prod.outlook.com ([fe80::6dfb:2f13:aec6:8b21]) by TYXPR01MB1472.jpnprd01.prod.outlook.com ([fe80::6dfb:2f13:aec6:8b21%4]) with mapi id 15.20.1059.023; Tue, 21 Aug 2018 05:05:57 +0000 From: Masato Gosui To: Benjamin Kaduk , Simon Josefsson CC: RFC Errata System , "ynir.ietf@gmail.com" , "mpg@elzevir.fr" , "ekr@rtfm.com" , "christopherwood07@gmail.com" , "joe@salowey.net" , "sean+ietf@sn3rd.com" , "tls@ietf.org" Thread-Topic: [Editorial Errata Reported] RFC8422 (5468) Thread-Index: AQHUNdEVEMrNsYgJr0mY9xx85mdczKTDnCmAgADt/oCABbpggA== Date: Tue, 21 Aug 2018 05:05:57 +0000 Message-ID: References: <20180817022137.6C114B80A77@rfc-editor.org> <1937603C-BD24-48A0-8555-B4D8D7BE6D37@josefsson.org> <20180817223735.GW40887@kduck.kaduk.org> In-Reply-To: <20180817223735.GW40887@kduck.kaduk.org> Accept-Language: ja-JP, en-US Content-Language: ja-JP X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=mgosui@yahoo-corp.jp; x-originating-ip: [211.14.8.249] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; TYXPR01MB0848; 6:XsyhN/5IQzPAsZEiPV99dOZUUlE8enMs2ln4DBjuKIdp2WLtp/9ACCINiPLl6Ock3T8/Hcg8rjLrRckB7hUH1ajd5dAEdrTjR2HyK9orYCznwnEP+3je2rxBvmtXlJcHgwQBMK8P/7ySE9YiNNLhdg0X65evkEwdrtHCscOR87FByfiDScpiV7tFnvygdjx439vlKGPQcWDHCakUrCrACx3e2fyNMzWf0ERgRLsU8gXOMH/ScfXyqqnnlUvbNEyGtpTWUS2HeEr6rNkEk2cbBa4yRQ5nx1vGZPKKGEVJIKrgNXVuEMJyPgoxcjc8XjWWIyrONIg0pK5P14yoZ1iLW4Z42Q5Y9uNUiL1UkkdDE9luvMRpRJUkr5qE7MbAjzBNGFKSrbFd5TqX5ikqJSTyVHwbfV/a3+ocYVmPyFLeB27prvwT5Xyjl9FkT7YfBYtzSvs3OhFCoVsm4Ja47C3pCA==; 5:WbV+zDbH5kT9f4q7h5VZmHk4yC0fP4sXpM/DxUmESTEkB3I5shCRIvfrH4+To63fOLxJPRseXW+0Cyb/b77USiDGckHQUogOs5ZPPa49TA2NHMPxhP4c9VraQSvbrrQ/FKaKP6xxCxfrRi+YIaX96sCu8Xh0C06V60JjU+/E/uk=; 7:aVSizWYdKm6tZdKLT/V2mcGqWzgyss2Yyv7Am0f6tqjmqFi8zMA+8WhIU4riP2AnaBYIGEhX07iicPEC5YiviY1e46vPFWOwhAlV6NxSGqComYJ7m7yoKnXk1l2WkT2LdIntxAstcVQiX3HcNU6tepZcRJLHLDpT01S32Dxx0nF30jv4j599tia+Esh+sxUJEH23mdrpiKXGtDqzSe4/BCNlkGn1kStzVV/L8BAxmTfH0oNmPcxlUys1lN/IEEYG x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-correlation-id: 1fb91472-0b53-4ceb-c694-08d60723c7e5 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(7020095)(4652040)(8989137)(4534165)(4627221)(201703031133081)(201702281549075)(8990107)(5600074)(711020)(2017052603328)(7153060)(7193020); SRVR:TYXPR01MB0848; x-ms-traffictypediagnostic: TYXPR01MB0848: x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(192374486261705); x-ms-exchange-senderadcheck: 1 x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(8211001083)(6040522)(2401047)(8121501046)(5005006)(3002001)(10201501046)(3231311)(944501410)(52105095)(93006095)(93001095)(149027)(150027)(6041310)(20161123558120)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123560045)(20161123562045)(20161123564045)(201708071742011)(7699016); SRVR:TYXPR01MB0848; BCL:0; PCL:0; RULEID:; SRVR:TYXPR01MB0848; x-forefront-prvs: 0771670921 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(39860400002)(136003)(396003)(366004)(346002)(376002)(189003)(199004)(6246003)(446003)(76176011)(66066001)(2171002)(97736004)(3846002)(1720100001)(2906002)(7736002)(74482002)(6436002)(6116002)(305945005)(14454004)(229853002)(85182001)(106356001)(6306002)(5660300001)(7416002)(99286004)(25786009)(36756003)(82746002)(81166006)(5250100002)(110136005)(54906003)(81156014)(8676002)(6506007)(102836004)(2900100001)(39060400002)(186003)(83716003)(316002)(2616005)(33656002)(26005)(68736007)(6486002)(8936002)(11346002)(86362001)(14444005)(966005)(478600001)(53936002)(6512007)(486006)(4326008)(476003)(256004)(105586002); DIR:OUT; SFP:1102; SCL:1; SRVR:TYXPR01MB0848; H:TYXPR01MB1472.jpnprd01.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:0; received-spf: None (protection.outlook.com: yahoo-corp.jp does not designate permitted sender hosts) x-microsoft-antispam-message-info: TgoFHKvsXR7y6S0i5+LlsblGVjoGABVrrydLG3iakRZWs0Fu4BQOfDAJmETKJMuHsOQP0VMKEnMRH+PTbTOpsqsbmrrGNdr2vAT7HXpKTcD59gwQ6r33EozQc66XHek/ZOKlI2gWHhmblYfiODc4fxwtpqKMOvE9bZaSGSoU45QSf5GoZJedCCp+Ktkp72Tq4DOBF5udydjXYFFFXfcugwGdRoKO24xly46sx1prdGq4WrTmk7Kl8JmKrbOH0oHUMz3gQmqK5DCc7SBTGZrv8pxW2Qd/Qxl8vG67HJ+nL0Gb7LFfzIEfIDXyFw1gyFdZF4OVDqU5lzPgNlWeVUZ+CKA0+igTLhZvZICqYGgrI3Q= spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="utf-8" Content-ID: <3E082DAF7567734B8588811EF9E1C625@jpnprd01.prod.outlook.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: 1fb91472-0b53-4ceb-c694-08d60723c7e5 X-MS-Exchange-CrossTenant-originalarrivaltime: 21 Aug 2018 05:05:57.8027 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: a208d369-cd4e-4f87-b119-98eaf31df2c3 X-MS-Exchange-Transport-CrossTenantHeadersStamped: TYXPR01MB0848 Archived-At: Subject: Re: [TLS] [Editorial Errata Reported] RFC8422 (5468) X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Aug 2018 05:06:13 -0000 SWYgYSBuZXcgZXJyYXRhIHByb3Bvc2luZyB0aGUgUERVIGNoYW5nZSBpcyBuZWVkZWQsIEkgZ2xh ZGx5IHN1Ym1pdCBpdC4NCg0KLS0NCk1hc2F0byBHb3N1aQ0KDQogICAgT24gRnJpLCBBdWcgMTcs IDIwMTggYXQgMTA6MjU6NDdBTSArMDIwMCwgU2ltb24gSm9zZWZzc29uIHdyb3RlOg0KICAgID4g SSB0aGluayDigJxuYW1lZEN1cnZl4oCdIGlzIGJldHRlciwgaXQgbWF0Y2hlcyBBU04uMSB1c2Fn ZS4NCiAgICANCiAgICBTbyB5b3Ugd2FudCBtZSB0byBjaGFuZ2UgdGhlIFBEVSB0byBiZSAibmFt ZWRDdXJ2ZSIgaW5zdGVhZD8NCiAgICANCiAgICAtQmVuDQogICAgDQogICAgPiAvU2ltb24NCiAg ICA+IA0KICAgID4gPiAxNyBhdWcuIDIwMTgga2wuIDA0OjIxIHNrcmV2IFJGQyBFcnJhdGEgU3lz dGVtIDxyZmMtZWRpdG9yQHJmYy1lZGl0b3Iub3JnPjoNCiAgICA+ID4gDQogICAgPiA+IFRoZSBm b2xsb3dpbmcgZXJyYXRhIHJlcG9ydCBoYXMgYmVlbiBzdWJtaXR0ZWQgZm9yIFJGQzg0MjIsDQog ICAgPiA+ICJFbGxpcHRpYyBDdXJ2ZSBDcnlwdG9ncmFwaHkgKEVDQykgQ2lwaGVyIFN1aXRlcyBm b3IgVHJhbnNwb3J0IExheWVyIFNlY3VyaXR5IChUTFMpIFZlcnNpb25zIDEuMiBhbmQgRWFybGll ciIuDQogICAgPiA+IA0KICAgID4gPiAtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLQ0KICAgID4gPiBZb3UgbWF5IHJldmlldyB0aGUgcmVwb3J0IGJlbG93IGFuZCBhdDoNCiAg ICA+ID4gaHR0cDovL3d3dy5yZmMtZWRpdG9yLm9yZy9lcnJhdGEvZWlkNTQ2OA0KICAgID4gPiAN CiAgICA+ID4gLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCiAgICA+ID4g VHlwZTogRWRpdG9yaWFsDQogICAgPiA+IFJlcG9ydGVkIGJ5OiBNYXNhdG8gR29zdWkgPG1nb3N1 aUB5YWhvby1jb3JwLmpwPg0KICAgID4gPiANCiAgICA+ID4gU2VjdGlvbjogNS40DQogICAgPiA+ IA0KICAgID4gPiBPcmlnaW5hbCBUZXh0DQogICAgPiA+IC0tLS0tLS0tLS0tLS0NCiAgICA+ID4g ICBuYW1lZEN1cnZlOiBTcGVjaWZpZXMgYSByZWNvbW1lbmRlZCBzZXQgb2YgZWxsaXB0aWMgY3Vy dmUgZG9tYWluDQogICAgPiA+IA0KICAgID4gPiBDb3JyZWN0ZWQgVGV4dA0KICAgID4gPiAtLS0t LS0tLS0tLS0tLQ0KICAgID4gPiAgIG5hbWVkY3VydmU6IFNwZWNpZmllcyBhIHJlY29tbWVuZGVk IHNldCBvZiBlbGxpcHRpYyBjdXJ2ZSBkb21haW4NCiAgICA+ID4gDQogICAgPiA+IE5vdGVzDQog ICAgPiA+IC0tLS0tDQogICAgPiA+IFRoaXMgZml4ZXMgbWlzbWF0Y2hlZCBuYW1lcyBvZiB0aGUg dmFyaWFibGUgIm5hbWVkY3VydmUiIGluIHRoZSAiU3RydWN0dXJlIG9mIHRoaXMgbWVzc2FnZSIg cGFyYWdyYXBoLg0KICAgID4gPiANCiAgICA+ID4gSW5zdHJ1Y3Rpb25zOg0KICAgID4gPiAtLS0t LS0tLS0tLS0tDQogICAgPiA+IFRoaXMgZXJyYXR1bSBpcyBjdXJyZW50bHkgcG9zdGVkIGFzICJS ZXBvcnRlZCIuIElmIG5lY2Vzc2FyeSwgcGxlYXNlDQogICAgPiA+IHVzZSAiUmVwbHkgQWxsIiB0 byBkaXNjdXNzIHdoZXRoZXIgaXQgc2hvdWxkIGJlIHZlcmlmaWVkIG9yDQogICAgPiA+IHJlamVj dGVkLiBXaGVuIGEgZGVjaXNpb24gaXMgcmVhY2hlZCwgdGhlIHZlcmlmeWluZyBwYXJ0eSAgDQog ICAgPiA+IGNhbiBsb2cgaW4gdG8gY2hhbmdlIHRoZSBzdGF0dXMgYW5kIGVkaXQgdGhlIHJlcG9y dCwgaWYgbmVjZXNzYXJ5LiANCiAgICA+ID4gDQogICAgPiA+IC0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tDQogICAgPiA+IFJGQzg0MjIgKGRyYWZ0LWlldGYtdGxzLXJmYzQ0 OTJiaXMtMTcpDQogICAgPiA+IC0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t DQogICAgPiA+IFRpdGxlICAgICAgICAgICAgICAgOiBFbGxpcHRpYyBDdXJ2ZSBDcnlwdG9ncmFw aHkgKEVDQykgQ2lwaGVyIFN1aXRlcyBmb3IgVHJhbnNwb3J0IExheWVyIFNlY3VyaXR5IChUTFMp IFZlcnNpb25zIDEuMiBhbmQgRWFybGllcg0KICAgID4gPiBQdWJsaWNhdGlvbiBEYXRlICAgIDog QXVndXN0IDIwMTgNCiAgICA+ID4gQXV0aG9yKHMpICAgICAgICAgICA6IFkuIE5pciwgUy4gSm9z ZWZzc29uLCBNLiBQZWdvdXJpZS1Hb25uYXJkDQogICAgPiA+IENhdGVnb3J5ICAgICAgICAgICAg OiBQUk9QT1NFRCBTVEFOREFSRA0KICAgID4gPiBTb3VyY2UgICAgICAgICAgICAgIDogVHJhbnNw b3J0IExheWVyIFNlY3VyaXR5DQogICAgPiA+IEFyZWEgICAgICAgICAgICAgICAgOiBTZWN1cml0 eQ0KICAgID4gPiBTdHJlYW0gICAgICAgICAgICAgIDogSUVURg0KICAgID4gPiBWZXJpZnlpbmcg UGFydHkgICAgIDogSUVTRw0KICAgID4gDQogICAgDQoNCg== From nobody Mon Aug 20 22:41:46 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BBFA2130E2D for ; Mon, 20 Aug 2018 22:41:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vzF-tlClEaKZ for ; Mon, 20 Aug 2018 22:41:40 -0700 (PDT) Received: from mail-ed1-x532.google.com (mail-ed1-x532.google.com [IPv6:2a00:1450:4864:20::532]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0FE37130EAC for ; Mon, 20 Aug 2018 22:41:34 -0700 (PDT) Received: by mail-ed1-x532.google.com with SMTP id e6-v6so9873293edr.2 for ; Mon, 20 Aug 2018 22:41:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to; bh=exUrf1P93h5DytD3fao4o5YxuCYXQD0MFharklpOMp0=; b=ayAAlmh5EbilGdvU99yKDkP+q9XBQpBq7qx0Tklgi7Ma8YmD5/DiHemGq2JqEB+wNY SkHlDnkQWlaruxbgnbmVVHDuQ7sL+USAusuXLhyJ+6HpJVE2dlsfcpQASvJI30KvTNGt XNYuGvo081JoHB0adKGpX1QoYPm9LT3+9K/lFSPRJ7sx7J10Fqdpp/KHxSSD7QC3ngWB ccLtuIEuTasefn01AlETV4Ef+qc5BVuWT9VYd6vfwXAkgOHu53QfcPgsFIyPisVVclBI SSS+mdhdidhwQVAa4Axe+d266iZrHzmPDp8Zx4uBukIKSwZ47A53ovcD/81fN2c8kpx7 J2Fw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to; bh=exUrf1P93h5DytD3fao4o5YxuCYXQD0MFharklpOMp0=; b=q2aDeZWIPAwjdX1UOsGebohQlznqgjFHtp970SKqZ/bvdkHzaFOaH/7xHZDzBlQnRN yksXcFa33sw502a9IBf/BfAJ5BhbkktCruEZkMjAFcRydNJm/RwMune4RPRpDazCc4Iy ZUil2RasluywFwy1D021nXJJj+YWvZjXZKip2IWkQFWyY+z+8yVzYbOWw9brgRTceAGw WnCUjBjW+OStojmgK1OO2HAKWgPYCS5U3u8y4oIYpQ3PxBdrGPkc1wpRfSXUlzrHwLMa 3oBqtFEIWyjoRbcHTVttLLaGMHemU2+451bTxBHkPhMUNCtpd5txDJq1RFoRgbXGl4eB fiNg== X-Gm-Message-State: APzg51BsNCt0lsFgCxitkZgKivbQ0C08dYKn8xYIzFQII3rA+/Pw5QPP IKHZ0WsyRldMHM5QvmNSArFDLDsxe8NDv6QLYWA= X-Google-Smtp-Source: ANB0VdZ4WcMpr59sX2BKJiHfBeL6vNzbHLRyrvhIBmX6kOz5IIk9ai5PJZOQq8QpPHvstmk4btf0ZiACtbpIFU+9la8= X-Received: by 2002:a50:cd9d:: with SMTP id p29-v6mr556971edi.159.1534830092638; Mon, 20 Aug 2018 22:41:32 -0700 (PDT) MIME-Version: 1.0 References: <201808202359.w7KNxH0X003083@orthanc.ca> <1534825202885.58630@cs.auckland.ac.nz> In-Reply-To: <1534825202885.58630@cs.auckland.ac.nz> From: Judson Wilson Date: Mon, 20 Aug 2018 22:41:20 -0700 Message-ID: To: Lyndon Nerenberg , Peter Gutmann , "tls@ietf.org" Content-Type: multipart/alternative; boundary="000000000000765cba0573eb7a63" Archived-At: Subject: Re: [TLS] EXTERNAL: Re: integrity only ciphersuites X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Aug 2018 05:41:44 -0000 --000000000000765cba0573eb7a63 Content-Type: text/plain; charset="UTF-8" Inventing your own null cipher security opens up the door for replay, withhold and reorder styles of attacks. On Mon, Aug 20, 2018 at 9:20 PM Peter Gutmann wrote: > Lyndon Nerenberg writes: > > >By law, we are forbidden from transmitting encrypted traffic, yet there > are > >use cases where integrity protection in the absence of data content > >protection would be of benefit. > > I've worked a lot with a set of authentication-only channels that can't be > encrypted but need strong integrity/authenticity protection. The way to > deal > with this is signed/MAC'd messages, not NULL-cipher TLS. > > Peter. > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > --000000000000765cba0573eb7a63 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Inventing your own null cipher security opens up the door for replay, = withhold and reorder styles of attacks.


On Mon, Aug 20, 2018 at 9:20 PM Peter Gutmann <= ;pgut001@cs.auckland.ac.nz= > wrote:
Lyndon Nerenberg <lyndon@orthanc.ca&= gt; writes:

>By law, we are forbidden from transmitting encrypted traffic, yet there= are
>use cases where integrity protection in the absence of data content
>protection would be of benefit.

I've worked a lot with a set of authentication-only channels that can&#= 39;t be
encrypted but need strong integrity/authenticity protection.=C2=A0 The way = to deal
with this is signed/MAC'd messages, not NULL-cipher TLS.

Peter.

_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls
--000000000000765cba0573eb7a63-- From nobody Tue Aug 21 04:41:46 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 36025130EE9 for ; Tue, 21 Aug 2018 04:41:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pXQ0gNmdJJ1M for ; Tue, 21 Aug 2018 04:41:41 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D6B1D130DE0 for ; Tue, 21 Aug 2018 04:41:40 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 92EFABE56; Tue, 21 Aug 2018 12:41:37 +0100 (IST) Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZFbR9RCRXult; Tue, 21 Aug 2018 12:41:37 +0100 (IST) Received: from [134.226.36.93] (bilbo.dsg.cs.tcd.ie [134.226.36.93]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 56FC5BE24; Tue, 21 Aug 2018 12:41:37 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1534851697; bh=bXtCZjwSCHSezA1E0o7k45rcQWWZcqJJTqJaQcSHiMY=; h=To:References:From:Subject:Date:In-Reply-To:From; b=iWeXu66V4VV8y+DxuXt1bwoW3HuvFecoOc+aH2l8jjPWohcilFKIGLjiL4tM81Asv KMLCudoRFAndRFmWddkgcPZadBFPu4BZhnFfk7uo8UcicBiYBvWtEMRQrCQP7vRHQz JTHDmLz8FpbfDfWEmk5gH0ClmrJnyBU19lo5iIzs= To: "Nancy Cam-Winget (ncamwing)" , "tls@ietf.org" References: From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= xsFNBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABzTJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPsLBgAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxM7BTQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAcLBZQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <64d23891-2f32-9bb8-1ec8-f4fad13cdfb9@cs.tcd.ie> Date: Tue, 21 Aug 2018 12:41:36 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.9.1 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="UgG9Wcx1ZD0t45UrqeGMXJnxC81gJiTEw" Archived-At: Subject: Re: [TLS] integrity only ciphersuites X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Aug 2018 11:41:44 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --UgG9Wcx1ZD0t45UrqeGMXJnxC81gJiTEw Content-Type: multipart/mixed; boundary="7jy2mdfuaCuVsxaJFDQefgk1hDQd6omyZ"; protected-headers="v1" From: Stephen Farrell To: "Nancy Cam-Winget (ncamwing)" , "tls@ietf.org" Message-ID: <64d23891-2f32-9bb8-1ec8-f4fad13cdfb9@cs.tcd.ie> Subject: Re: [TLS] integrity only ciphersuites References: In-Reply-To: --7jy2mdfuaCuVsxaJFDQefgk1hDQd6omyZ Content-Type: multipart/mixed; boundary="------------41312496A495A46A01086F57" Content-Language: en-GB This is a multi-part message in MIME format. --------------41312496A495A46A01086F57 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 20/08/18 21:48, Nancy Cam-Winget (ncamwing) wrote: > All, A couple IoT consortiums are trying to embrace the improvements > made to TLS 1.3 and as they define their new security constructs > would like to adopt the latest protocols, in this case TLS 1.3. To > that extent, they have a strong need for mutual authentication, but > integrity only (no confidentiality) requirements. >=20 > In following the new IANA rules, we have posted the draft > https://tools.ietf.org/html/draft-camwinget-tls-ts13-macciphersuites-00= > to document request for registrations of HMAC based cipher selections > with TLS 1.3=E2=80=A6..and are soliciting feedback from the WG on the d= raft > and its path forward. As ekr pointed out, with the new registration rules, there's nothing to stop someone defining any old set of crypto stuff and getting non-recommended codepoints. That said, I don't consider that defining such vulnerable-by-design ciphersuites is a good plan. - It imposes costs on the non-niche users of TLS - once these things are defined then developers and those who deploy/configure applications using TLS need to check that they're not using these undesirable ciphersuites, so costs are being displaced from niche uses to the vast majority of implementations and deployments, which seems to me to be a bad idea. And we know that people will sometimes get those checks wrong leading to unexpected transmission of plaintext over the Internet. - Similarly, just defining such ciphersuites seems likely to lead to less well tested and infrequently used code paths, which is undesirable. (Assuming someone pays some developer to add these to some library, which generally does seem to happen.) - RFC7525 [1] is clear on this topic (after debate in the UTA WG) - "Implementations MUST NOT negotiate the cipher suites with NULL encryption" and I see nothing new to convince me that that ought change for TLS1.3. - Code footprint arguments aren't that convincing to me - to get interop for the few devices where AES being present or absent could make a real difference, you'd need an awful lot more profiling of TLS or DTLS. I don't see evidence of that so the interop/footprint arguments seem pretty weak. I'd also bet that any useful "tiny footprint" profile of that kind would end up targeting loads of use-cases where confidentiality is absolutely required. - (In addition to the good points made by Geoffrey Keating [2]) cleartext payloads would also assist in device fingerprinting, making it easier to exploit vulnerabilities at scale. - IIUC there is also a desire to encrypt firmware updates so that patches can be distributed more quickly than attackers can reverse-engineer attacks. [4] I'm not entirely sure if that's really likely to happen, but if it were, then devices would need to be able to use recommended ciphersuites in any case. - TLS/AX.25 doesn't seem that good a plan in any case - according to [3], which seems reasonable to me, using clear-signed GPG is quicker and better meets the oddball regulations. Attempting to deal with those regulations by weakening TLS seems like a very bad plan, as you'd fail in any case to achieve interop with normal TLS applications like the web. (And the advertising is as illegal as the crypto apparently, though I do like that aspect:-) - WRT unix sockets, I'm not clear that there's a sufficiently important performance improvement in real deployments to justify introducing weakened ciphersuites - presumably mail servers are going to use standard TLS libraries that (I hope!) won't be offering NULL encryption, so I'd be surprised if the right engineering decision was to prioritise CPU to that extent, given the risks associated with having weak ciphersuites present in widely used implementations. IOW, it seems more sensible to me for mail servers to just stick to using RECOMMENDED ciphersuites. And given that you could use SASL with Postfix/LMTP [5] I'm not sure why you'd want a weirdo-version of TLS1.3 anyway but maybe there's some reason I don't get. - I think this WG has had to spend waaaay too much time dealing with the "inspection of data" debate in various forms, but we did get an answer (no consensus) in the end for that. Niche use cases seem extremely unlikely to me to justify revisiting that painful topic. So all in all, I just don't see a need for these weak-by-design ciphersuites to even be defined. I'd encourage folks who think they're needed to instead think about how using RECOMMENDED ciphersuites might make their implementations more widely applicable and safer. Seems like a much more productive approach to me anyway. Regards, S. [1] https://tools.ietf.org/html/rfc7525 [2] https://mailarchive.ietf.org/arch/msg/tls/uI8xVgp7gTuJgwUyY-UgZfmUkRo= [3] https://tools.ietf.org/html/draft-ietf-suit-architecture-01#section-3= =2E3 [4] https://www.tapr.org/pdf/DCC2010-AX.25-AuthenticationEffects-KE5LKY.p= df [5] http://www.postfix.org/SASL_README.html#client_sasl --------------41312496A495A46A01086F57 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1bQyU3RlcGhlbiBGYXJy ZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxsQGNzLnRjZC5pZT6JAkAEEwEIACoC GwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AFAlo+o3cCGQEACgkQWrL6 8XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeOM3P7SW3C3UQYdCgZ/TlvxGgKow5o DSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP2ZK24tw5k6duTh4+sFwUualTMlcp 0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s/69L/fvHmdSKet5LIUAxoYaZkTCr uFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBjMw1xV+p0uCwNbN6XDzcToK7wsm+t AIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k4S+sN2CnYk4tTW7jHjsWarV3FLIS COObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSlAblGjwZe4EIkCXAJUtzJhoFUuGaF /PlWjxqV3UFRcgTERZTijguVyREre8GNERNgvDxZvuXssEjvz9X5JfcIZDIJpdzh LiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/rwWcpGr/MfVPTOik4H7F8rcVJelce ZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o4uBZCQ0GzvsmFA4XLqn2pA5rVizM XnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKAxo/tuHYtk19XCi83QzFhWls5TT+X QeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd8MxYNAbNYgSPtkbhZ8SJARwEEAEI AAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6NXEGtw/r1miKNGcopzvzILQ9oB8r KI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYcJf+RyiH1nMoqUIZiZJaf3bJXinDZ 5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbYtWgsYtRqHLD4IWi37MZrVyjBuF7u 14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1WQOAfD1kfBpW9PvAva5Iw9FWeXpC XRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7EDuTBb/8um1wK7Y9bgeIQC+CYjhYB 5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlve2Q6UTrmHxP5U22DlokCPQQTAQgA JwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrx excr6tJpD/4rrILH+meP07vrx8wW5eYuqCiPGYnh/CXxIF8eLrfbe5d4QRgtq+w6 UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dTMrEGn8QWKx2iNuz9rZMXyOSWFetu O01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9gQ7edR9mfLTdvBf2FR522hg8BRBM 1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZXripS0uFA07dM46Oi/E8osjx6fQt/ lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGFL64/VCQb1YGjf0Z5MBPnWm9jgUoO Y5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2DFeo9+S9f2V53Llz1WIspXJg6f+n9 lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCbhrC3+yobyy/AUOs5Z3E+njjX1FF/ VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10MSU8GEZu9ayU4M3o3N9yxOjaoP0Nu Q4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXtGKvJtFAEppGEYezB+bLKIm6XlpPk hnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA5rEP4lL16BmijmF+CHoPE/zwgKZb KpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ksZgUUnNyvfQr2p7jrQuU3RlcGhl biBGYXJyZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgA JwUCWj1RWgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrx excr6jscEADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvn crAFClVI6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtg rlstjk7hqVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIg pMw0bA1yBU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5c F8R4OvB1n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaP y1/fEgIqhCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5 b1AEzZKw2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7 b9Ocu+nYm2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkpo rMQCTh3T5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXR dS/oDKrBLUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGl Ru78ba0HArxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgA BgUCWj1SoAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89Sq Bd++uG06TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VO dL8zJWJs0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD 4t0VHpWkmfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lz nNiH41x9M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8I WOMqN2woDjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBuQINBFo9UDIB EAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuBHmpvceBRZgRasdbaMc4H Jee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD8U4xxjvR5Mi7+ToQQUOU NuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5MsK1SKfs51pLa5ToC1rc8 tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE4bGjXdJW5pKphFB2lX3d G4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7PbTuW/eITbMbI1eV3+fyym 9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3vDUew1h5QU1yDaWT3NAp vi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcmoazpiKZt91CrFPOaoXDP ck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r+oA/wxWb5jELElAhOpny qMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22fQ0D38zud+CKH3bMP3ayX XJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7Ffa4UbkwlD+dh8GiIAtv T51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1gwARAQABiQIlBBgBCAAP BQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF6TeR83xD6MasqXyrBjwc LmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfdn3BmvqGyh8+ouHX9jMOx iRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx252HKTFdeOrszoOjWjEzwm h+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjNJIXXM+lHqCDrjDaDhNcz mq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjwrIdfQM86H1z5J31lfhqo p+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGsokRina9947fRWxXHh3O6 6ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqYo3pcN2OE0C1chqgDZQxk r+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQkd0YjcqlB1E0svODHTzcS oRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmUyXBIeq6I5z8xBcd+BQ/n /9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhkvMvem9XXh1yyhqN14gfj mLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3YFMVUUfgyudqAV1wWdZi nUk+H3pkqOKoHAy/8fST =3DTOQn -----END PGP PUBLIC KEY BLOCK----- --------------41312496A495A46A01086F57-- --7jy2mdfuaCuVsxaJFDQefgk1hDQd6omyZ-- --UgG9Wcx1ZD0t45UrqeGMXJnxC81gJiTEw Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAlt7+nAACgkQWrL68XsX K+qd+Q//R345+DcLfkmyMWAiPnuyI/rkpMyRm8fnUf+FhoSJfQsJG2fTb+F9uxsJ h1gNPw5Y4zzQ2bSjHjQSraZgvw/NdzhPxfcRlxjiwIl7H/SLOtVLOrxlodkUhIgl Eyqi2vEQmY+QMj52WjNz2hZaI8/n9ATLfAQzBaSS1jzloPBF1AQ8ZDbQKGCUYLr2 TfbBnlOWNQeEnz0FDWq2wsXDv7TMCcGcDr07KnIyhDnpfBI7Flkqu6UEl80IAXPV jxbnlWAjwvpuot1hSe/zjtYkfZZz5hNehe0UYA8vNw0XBpEGwBntidI2lfS8BP50 Ef3O8tbhWDmywl9wkjKl5Wq0CwNXwRP9duR27xznDaiH9XF/FGTfSihVgLZ17ehV NeHB8bSTYgQZA0sR6qnex28yLXIx3sm4UJlHXsNj1Fzvxw1fM+Ql95lFfZBWPqhR u06iGrj+g+ELk17tMnsZ5xVsTMDZh3h2AV8RBrnIR3aC/7rjSIEd4nCaTAG6fXT8 ncEkZ6TYXmZL8NJ4w/P48CQFBUZhKJ8DHW5SKPzL4xk1VM7y0eBx8UKPdjJg4N8K iak3Pt7TKv/DJ9HGDlwUUvaI62KlFORINVnb7ZybC6mYpfVCmAMfxj/jjea1KYO4 TbCorsRtOcmtx+nqYNkS/aDpboMANW4hG8UTBlnsIJt4QASOvqo= =ej66 -----END PGP SIGNATURE----- --UgG9Wcx1ZD0t45UrqeGMXJnxC81gJiTEw-- From nobody Tue Aug 21 05:10:30 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 218C512D7EA for ; Tue, 21 Aug 2018 05:10:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.198 X-Spam-Level: X-Spam-Status: No, score=-4.198 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, UNPARSEABLE_RELAY=0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Zv0t6GRxpGTi for ; Tue, 21 Aug 2018 05:10:23 -0700 (PDT) Received: from llmx3.ll.mit.edu (LLMX3.LL.MIT.EDU [129.55.12.49]) by ietfa.amsl.com (Postfix) with ESMTP id D2C72130DE0 for ; Tue, 21 Aug 2018 05:10:21 -0700 (PDT) Received: from LLE2K16-MBX02.mitll.ad.local (LLE2K16-MBX02.mitll.ad.local) by llmx3.ll.mit.edu (unknown) with ESMTP id w7LCAIU8016210; Tue, 21 Aug 2018 08:10:18 -0400 From: "Blumenthal, Uri - 0553 - MITLL" To: Stephen Farrell CC: "Nancy Cam-Winget (ncamwing)" , "tls@ietf.org" Thread-Topic: [TLS] integrity only ciphersuites Thread-Index: AQHUOMcWIQ0ztQCz9UKccOekmBKud6TKWVQAgAAIAoA= Date: Tue, 21 Aug 2018 12:10:17 +0000 Message-ID: <982363FD-A839-4175-BA53-7CA242F9ADA6@ll.mit.edu> References: <64d23891-2f32-9bb8-1ec8-f4fad13cdfb9@cs.tcd.ie> In-Reply-To: <64d23891-2f32-9bb8-1ec8-f4fad13cdfb9@cs.tcd.ie> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 Content-Type: multipart/signed; boundary="Apple-Mail-2316BBF7-9A91-480C-A745-860FA4D8B351"; protocol="application/pkcs7-signature"; micalg=sha1 MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2018-08-21_06:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 mlxscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1807170000 definitions=main-1808210129 Archived-At: Subject: Re: [TLS] integrity only ciphersuites X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Aug 2018 12:10:28 -0000 --Apple-Mail-2316BBF7-9A91-480C-A745-860FA4D8B351 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: base64 IlZ1bG5lcmFibGUtYnktZGVzaWduIGNpcGhlcnN1aXRlcyI/IFZ1bG5lcmFibGUgdG8gd2hhdD8g DQoNClN1Y2sgc2l0ZXMgYXJlIGRlc2lnbmVkIHRvIHByb3ZpZGUgZW5kLXBvaW50IGF1dGhlbnRp Y2F0aW9uIGFuZCB0cmFmZmljIGludGVncml0eS4gQ2FyZSB0byBleHBsYWluL3Nob3cgaG93IHRo ZXNlIHByb3BlcnRpZXMgd291bGQgbm90IGhvbGQ/DQoNCkJlc2lkZXMsIGl0J3MgYmVlbiBleHBs YWluZWQgc2V2ZXJhbCB0aW1lcyB0aGF0IHNvbWUgdXNlIGNhc2VzIGRvIG5vdCByZXF1aXJlIGNv bmZpZGVudGlhbGl0eSwgYW5kIGluIHNvbWUgdXNlIGNhc2VzIGNvbmZpZGVudGlhbGl0eSBpcyBm b3JiaWRkZW4uDQoNClJlZ2FyZHMsDQpVcmkNCg0KU2VudCBmcm9tIG15IGlQaG9uZQ0KDQo+IE9u IEF1ZyAyMSwgMjAxOCwgYXQgMDc6NDIsIFN0ZXBoZW4gRmFycmVsbCA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT4gd3JvdGU6DQo+IA0KPiANCj4gDQo+PiBPbiAyMC8wOC8xOCAyMTo0OCwgTmFu Y3kgQ2FtLVdpbmdldCAobmNhbXdpbmcpIHdyb3RlOg0KPj4gQWxsLCBBIGNvdXBsZSBJb1QgY29u c29ydGl1bXMgYXJlIHRyeWluZyB0byBlbWJyYWNlIHRoZSBpbXByb3ZlbWVudHMNCj4+IG1hZGUg dG8gVExTIDEuMyBhbmQgYXMgdGhleSBkZWZpbmUgdGhlaXIgbmV3IHNlY3VyaXR5IGNvbnN0cnVj dHMNCj4+IHdvdWxkIGxpa2UgdG8gYWRvcHQgdGhlIGxhdGVzdCBwcm90b2NvbHMsIGluIHRoaXMg Y2FzZSBUTFMgMS4zLiAgIFRvDQo+PiB0aGF0IGV4dGVudCwgdGhleSBoYXZlIGEgc3Ryb25nIG5l ZWQgZm9yIG11dHVhbCBhdXRoZW50aWNhdGlvbiwgYnV0DQo+PiBpbnRlZ3JpdHkgb25seSAobm8g Y29uZmlkZW50aWFsaXR5KSByZXF1aXJlbWVudHMuDQo+PiANCj4+IEluIGZvbGxvd2luZyB0aGUg bmV3IElBTkEgcnVsZXMsIHdlIGhhdmUgcG9zdGVkIHRoZSBkcmFmdA0KPj4gaHR0cHM6Ly90b29s cy5pZXRmLm9yZy9odG1sL2RyYWZ0LWNhbXdpbmdldC10bHMtdHMxMy1tYWNjaXBoZXJzdWl0ZXMt MDANCj4+IHRvIGRvY3VtZW50IHJlcXVlc3QgZm9yIHJlZ2lzdHJhdGlvbnMgb2YgSE1BQyBiYXNl ZCBjaXBoZXIgc2VsZWN0aW9ucw0KPj4gd2l0aCBUTFMgMS4z4oCmLi5hbmQgYXJlIHNvbGljaXRp bmcgZmVlZGJhY2sgZnJvbSB0aGUgV0cgb24gdGhlIGRyYWZ0DQo+PiBhbmQgaXRzIHBhdGggZm9y d2FyZC4NCj4gDQo+IEFzIGVrciBwb2ludGVkIG91dCwgd2l0aCB0aGUgbmV3IHJlZ2lzdHJhdGlv biBydWxlcywNCj4gdGhlcmUncyBub3RoaW5nIHRvIHN0b3Agc29tZW9uZSBkZWZpbmluZyBhbnkg b2xkIHNldA0KPiBvZiBjcnlwdG8gc3R1ZmYgYW5kIGdldHRpbmcgbm9uLXJlY29tbWVuZGVkIGNv ZGVwb2ludHMuDQo+IA0KPiBUaGF0IHNhaWQsIEkgZG9uJ3QgY29uc2lkZXIgdGhhdCBkZWZpbmlu ZyBzdWNoDQo+IHZ1bG5lcmFibGUtYnktZGVzaWduIGNpcGhlcnN1aXRlcyBpcyBhIGdvb2QgcGxh bi4NCj4gDQo+IC0gSXQgaW1wb3NlcyBjb3N0cyBvbiB0aGUgbm9uLW5pY2hlIHVzZXJzIG9mIFRM UyAtIG9uY2UNCj4gdGhlc2UgdGhpbmdzIGFyZSBkZWZpbmVkIHRoZW4gZGV2ZWxvcGVycyBhbmQg dGhvc2Ugd2hvDQo+IGRlcGxveS9jb25maWd1cmUgYXBwbGljYXRpb25zIHVzaW5nIFRMUyBuZWVk IHRvIGNoZWNrDQo+IHRoYXQgdGhleSdyZSBub3QgdXNpbmcgdGhlc2UgdW5kZXNpcmFibGUgY2lw aGVyc3VpdGVzLA0KPiBzbyBjb3N0cyBhcmUgYmVpbmcgZGlzcGxhY2VkIGZyb20gbmljaGUgdXNl cyB0byB0aGUNCj4gdmFzdCBtYWpvcml0eSBvZiBpbXBsZW1lbnRhdGlvbnMgYW5kIGRlcGxveW1l bnRzLCB3aGljaA0KPiBzZWVtcyB0byBtZSB0byBiZSBhIGJhZCBpZGVhLiBBbmQgd2Uga25vdyB0 aGF0IHBlb3BsZQ0KPiB3aWxsIHNvbWV0aW1lcyBnZXQgdGhvc2UgY2hlY2tzIHdyb25nIGxlYWRp bmcgdG8gdW5leHBlY3RlZA0KPiB0cmFuc21pc3Npb24gb2YgcGxhaW50ZXh0IG92ZXIgdGhlIElu dGVybmV0Lg0KPiANCj4gLSBTaW1pbGFybHksIGp1c3QgZGVmaW5pbmcgc3VjaCBjaXBoZXJzdWl0 ZXMgc2VlbXMgbGlrZWx5DQo+IHRvIGxlYWQgdG8gbGVzcyB3ZWxsIHRlc3RlZCBhbmQgaW5mcmVx dWVudGx5IHVzZWQgY29kZQ0KPiBwYXRocywgd2hpY2ggaXMgdW5kZXNpcmFibGUuIChBc3N1bWlu ZyBzb21lb25lIHBheXMgc29tZQ0KPiBkZXZlbG9wZXIgdG8gYWRkIHRoZXNlIHRvIHNvbWUgbGli cmFyeSwgd2hpY2ggZ2VuZXJhbGx5DQo+IGRvZXMgc2VlbSB0byBoYXBwZW4uKQ0KPiANCj4gLSBS RkM3NTI1IFsxXSBpcyBjbGVhciBvbiB0aGlzIHRvcGljIChhZnRlciBkZWJhdGUgaW4gdGhlDQo+ IFVUQSBXRykgLSAiSW1wbGVtZW50YXRpb25zIE1VU1QgTk9UIG5lZ290aWF0ZSB0aGUgY2lwaGVy DQo+IHN1aXRlcyB3aXRoIE5VTEwgZW5jcnlwdGlvbiIgYW5kIEkgc2VlIG5vdGhpbmcgbmV3IHRv DQo+IGNvbnZpbmNlIG1lIHRoYXQgdGhhdCBvdWdodCBjaGFuZ2UgZm9yIFRMUzEuMy4NCj4gDQo+ IC0gQ29kZSBmb290cHJpbnQgYXJndW1lbnRzIGFyZW4ndCB0aGF0IGNvbnZpbmNpbmcgdG8NCj4g bWUgLSB0byBnZXQgaW50ZXJvcCBmb3IgdGhlIGZldyBkZXZpY2VzIHdoZXJlIEFFUyBiZWluZw0K PiBwcmVzZW50IG9yIGFic2VudCBjb3VsZCBtYWtlIGEgcmVhbCBkaWZmZXJlbmNlLCB5b3UnZA0K PiBuZWVkIGFuIGF3ZnVsIGxvdCBtb3JlIHByb2ZpbGluZyBvZiBUTFMgb3IgRFRMUy4gSSBkb24n dA0KPiBzZWUgZXZpZGVuY2Ugb2YgdGhhdCBzbyB0aGUgaW50ZXJvcC9mb290cHJpbnQgYXJndW1l bnRzDQo+IHNlZW0gcHJldHR5IHdlYWsuIEknZCBhbHNvIGJldCB0aGF0IGFueSB1c2VmdWwgInRp bnkNCj4gZm9vdHByaW50IiBwcm9maWxlIG9mIHRoYXQga2luZCB3b3VsZCBlbmQgdXAgdGFyZ2V0 aW5nDQo+IGxvYWRzIG9mIHVzZS1jYXNlcyB3aGVyZSBjb25maWRlbnRpYWxpdHkgaXMgYWJzb2x1 dGVseQ0KPiByZXF1aXJlZC4NCj4gDQo+IC0gKEluIGFkZGl0aW9uIHRvIHRoZSBnb29kIHBvaW50 cyBtYWRlIGJ5IEdlb2ZmcmV5DQo+IEtlYXRpbmcgWzJdKSBjbGVhcnRleHQgcGF5bG9hZHMgd291 bGQgYWxzbyBhc3Npc3QgaW4NCj4gZGV2aWNlIGZpbmdlcnByaW50aW5nLCBtYWtpbmcgaXQgZWFz aWVyIHRvIGV4cGxvaXQNCj4gdnVsbmVyYWJpbGl0aWVzIGF0IHNjYWxlLg0KPiANCj4gLSBJSVVD IHRoZXJlIGlzIGFsc28gYSBkZXNpcmUgdG8gZW5jcnlwdCBmaXJtd2FyZQ0KPiB1cGRhdGVzIHNv IHRoYXQgcGF0Y2hlcyBjYW4gYmUgZGlzdHJpYnV0ZWQgbW9yZSBxdWlja2x5DQo+IHRoYW4gYXR0 YWNrZXJzIGNhbiByZXZlcnNlLWVuZ2luZWVyIGF0dGFja3MuIFs0XSBJJ20NCj4gbm90IGVudGly ZWx5IHN1cmUgaWYgdGhhdCdzIHJlYWxseSBsaWtlbHkgdG8gaGFwcGVuLA0KPiBidXQgaWYgaXQg d2VyZSwgdGhlbiBkZXZpY2VzIHdvdWxkIG5lZWQgdG8gYmUgYWJsZSB0bw0KPiB1c2UgcmVjb21t ZW5kZWQgY2lwaGVyc3VpdGVzIGluIGFueSBjYXNlLg0KPiANCj4gLSBUTFMvQVguMjUgZG9lc24n dCBzZWVtIHRoYXQgZ29vZCBhIHBsYW4gaW4gYW55DQo+IGNhc2UgLSBhY2NvcmRpbmcgdG8gWzNd LCB3aGljaCBzZWVtcyByZWFzb25hYmxlIHRvDQo+IG1lLCB1c2luZyBjbGVhci1zaWduZWQgR1BH IGlzIHF1aWNrZXIgYW5kIGJldHRlcg0KPiBtZWV0cyB0aGUgb2RkYmFsbCByZWd1bGF0aW9ucy4g QXR0ZW1wdGluZyB0byBkZWFsDQo+IHdpdGggdGhvc2UgcmVndWxhdGlvbnMgYnkgd2Vha2VuaW5n IFRMUyBzZWVtcyBsaWtlDQo+IGEgdmVyeSBiYWQgcGxhbiwgYXMgeW91J2QgZmFpbCBpbiBhbnkg Y2FzZSB0byBhY2hpZXZlDQo+IGludGVyb3Agd2l0aCBub3JtYWwgVExTIGFwcGxpY2F0aW9ucyBs aWtlIHRoZSB3ZWIuDQo+IChBbmQgdGhlIGFkdmVydGlzaW5nIGlzIGFzIGlsbGVnYWwgYXMgdGhl IGNyeXB0bw0KPiBhcHBhcmVudGx5LCB0aG91Z2ggSSBkbyBsaWtlIHRoYXQgYXNwZWN0Oi0pDQo+ IA0KPiAtIFdSVCB1bml4IHNvY2tldHMsIEknbSBub3QgY2xlYXIgdGhhdCB0aGVyZSdzIGENCj4g c3VmZmljaWVudGx5IGltcG9ydGFudCBwZXJmb3JtYW5jZSBpbXByb3ZlbWVudCBpbg0KPiByZWFs IGRlcGxveW1lbnRzIHRvIGp1c3RpZnkgaW50cm9kdWNpbmcgd2Vha2VuZWQNCj4gY2lwaGVyc3Vp dGVzIC0gcHJlc3VtYWJseSBtYWlsIHNlcnZlcnMgYXJlIGdvaW5nIHRvDQo+IHVzZSBzdGFuZGFy ZCBUTFMgbGlicmFyaWVzIHRoYXQgKEkgaG9wZSEpIHdvbid0IGJlDQo+IG9mZmVyaW5nIE5VTEwg ZW5jcnlwdGlvbiwgc28gSSdkIGJlIHN1cnByaXNlZCBpZg0KPiB0aGUgcmlnaHQgZW5naW5lZXJp bmcgZGVjaXNpb24gd2FzIHRvIHByaW9yaXRpc2UNCj4gQ1BVIHRvIHRoYXQgZXh0ZW50LCBnaXZl biB0aGUgcmlza3MgYXNzb2NpYXRlZCB3aXRoDQo+IGhhdmluZyB3ZWFrIGNpcGhlcnN1aXRlcyBw cmVzZW50IGluIHdpZGVseSB1c2VkDQo+IGltcGxlbWVudGF0aW9ucy4gSU9XLCBpdCBzZWVtcyBt b3JlIHNlbnNpYmxlIHRvIG1lDQo+IGZvciBtYWlsIHNlcnZlcnMgdG8ganVzdCBzdGljayB0byB1 c2luZyBSRUNPTU1FTkRFRA0KPiBjaXBoZXJzdWl0ZXMuIEFuZCBnaXZlbiB0aGF0IHlvdSBjb3Vs ZCB1c2UgU0FTTA0KPiB3aXRoIFBvc3RmaXgvTE1UUCBbNV0gSSdtIG5vdCBzdXJlIHdoeSB5b3Un ZCB3YW50DQo+IGEgd2VpcmRvLXZlcnNpb24gb2YgVExTMS4zIGFueXdheSBidXQgbWF5YmUgdGhl cmUncw0KPiBzb21lIHJlYXNvbiBJIGRvbid0IGdldC4NCj4gDQo+IC0gSSB0aGluayB0aGlzIFdH IGhhcyBoYWQgdG8gc3BlbmQgd2FhYWF5IHRvbyBtdWNoDQo+IHRpbWUgZGVhbGluZyB3aXRoIHRo ZSAiaW5zcGVjdGlvbiBvZiBkYXRhIiBkZWJhdGUgaW4NCj4gdmFyaW91cyBmb3JtcywgYnV0IHdl IGRpZCBnZXQgYW4gYW5zd2VyIChubyBjb25zZW5zdXMpDQo+IGluIHRoZSBlbmQgZm9yIHRoYXQu IE5pY2hlIHVzZSBjYXNlcyBzZWVtIGV4dHJlbWVseQ0KPiB1bmxpa2VseSB0byBtZSB0byBqdXN0 aWZ5IHJldmlzaXRpbmcgdGhhdCBwYWluZnVsDQo+IHRvcGljLg0KPiANCj4gU28gYWxsIGluIGFs bCwgSSBqdXN0IGRvbid0IHNlZSBhIG5lZWQgZm9yIHRoZXNlDQo+IHdlYWstYnktZGVzaWduIGNp cGhlcnN1aXRlcyB0byBldmVuIGJlIGRlZmluZWQuIEknZA0KPiBlbmNvdXJhZ2UgZm9sa3Mgd2hv IHRoaW5rIHRoZXkncmUgbmVlZGVkIHRvIGluc3RlYWQNCj4gdGhpbmsgYWJvdXQgaG93IHVzaW5n IFJFQ09NTUVOREVEIGNpcGhlcnN1aXRlcyBtaWdodA0KPiBtYWtlIHRoZWlyIGltcGxlbWVudGF0 aW9ucyBtb3JlIHdpZGVseSBhcHBsaWNhYmxlIGFuZA0KPiBzYWZlci4gU2VlbXMgbGlrZSBhIG11 Y2ggbW9yZSBwcm9kdWN0aXZlIGFwcHJvYWNoIHRvDQo+IG1lIGFueXdheS4NCj4gDQo+IFJlZ2Fy ZHMsDQo+IFMuDQo+IA0KPiBbMV0gaHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL3JmYzc1MjUN Cj4gWzJdIGh0dHBzOi8vbWFpbGFyY2hpdmUuaWV0Zi5vcmcvYXJjaC9tc2cvdGxzL3VJOHhWZ3A3 Z1R1Smd3VXlZLVVnWmZtVWtSbw0KPiBbM10gaHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL2Ry YWZ0LWlldGYtc3VpdC1hcmNoaXRlY3R1cmUtMDEjc2VjdGlvbi0zLjMNCj4gWzRdIGh0dHBzOi8v d3d3LnRhcHIub3JnL3BkZi9EQ0MyMDEwLUFYLjI1LUF1dGhlbnRpY2F0aW9uRWZmZWN0cy1LRTVM S1kucGRmDQo+IFs1XSBodHRwOi8vd3d3LnBvc3RmaXgub3JnL1NBU0xfUkVBRE1FLmh0bWwjY2xp ZW50X3Nhc2wNCj4gDQo+IA0KPiA8MHg1QUIyRkFGMTdCMTcyQkVBLmFzYz4NCj4gX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCj4gVExTIG1haWxpbmcgbGlz dA0KPiBUTFNAaWV0Zi5vcmcNCj4gaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5m by90bHMNCg== --Apple-Mail-2316BBF7-9A91-480C-A745-860FA4D8B351 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Disposition: attachment; filename="smime.p7s" Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIITojCCBLww ggOkoAMCAQICASkwDQYJKoZIhvcNAQEFBQAwVDELMAkGA1UEBhMCVVMxHzAdBgNVBAoTFk1JVCBM aW5jb2xuIExhYm9yYXRvcnkxDDAKBgNVBAsTA1BLSTEWMBQGA1UEAxMNTUlUTEwgUm9vdCBDQTAe Fw0xMzEyMTcwMDAwMDBaFw0yMDEyMzEyMzU5NTlaMFExCzAJBgNVBAYTAlVTMR8wHQYDVQQKExZN SVQgTGluY29sbiBMYWJvcmF0b3J5MQwwCgYDVQQLEwNQS0kxEzARBgNVBAMTCk1JVExMIENBLTMw ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaMFJ1bXy25bW03EbqHwHSSpyQVlAAC2gc KS9SlQRfqMW8F3yZAjncbIthG4CjgdYml7v+LMVc59IkOzpQzmi+8I59eDZsmANiUEL0kNwsEUif Semk671G+mNZKLG0LnpyvAnlSzlA923G0p16TksleXagrDfDyWKFSLF49vFZp3WbtkwopqC+b3NP Js/oW6YpHF5gmNKkHb5wBiOgYYRtJUfLHy7MebrECgEwfFrxvL7IPPwnOTqw/2KKWA/eJdIagICa HIHO+VBDlA01Y/4Saj2PP+6QqFhUH9XB3G2iq48CqfiJ8MAhoz121vTlzLWBcAVI/dn+JSTHIFll Q5F/AgMBAAGjggGaMIIBljASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBTXYGYOe0mNdUwN /c9G3sjHEofKvzAfBgNVHSMEGDAWgBRnqnrP9AqmuXK1iqDSnfIQw0PtKTAOBgNVHQ8BAf8EBAMC AYYwZgYIKwYBBQUHAQEEWjBYMC0GCCsGAQUFBzAChiFodHRwOi8vY3JsLmxsLm1pdC5lZHUvZ2V0 dG8/TExSQ0EwJwYIKwYBBQUHMAGGG2h0dHA6Ly9vY3NwLmxsLm1pdC5lZHUvb2NzcDAzBgNVHR8E LDAqMCigJqAkhiJodHRwOi8vY3JsLmxsLm1pdC5lZHUvZ2V0Y3JsP0xMUkNBMIGSBgNVHSAEgYow gYcwDQYLKoZIhvcSAgEDAQYwDQYLKoZIhvcSAgEDAQgwDQYLKoZIhvcSAgEDAQcwDQYLKoZIhvcS AgEDAQkwDQYLKoZIhvcSAgEDAQowDQYLKoZIhvcSAgEDAQswDQYLKoZIhvcSAgEDAQ4wDQYLKoZI hvcSAgEDAQ8wDQYLKoZIhvcSAgEDARAwDQYJKoZIhvcNAQEFBQADggEBACx/0cGfvapTtROCTFqu MBzuLKeFwMSBbB7Ngq139IsZJDQOG3MhX8tMLGpQuM534f4dOowlcHz6cefOHKpDjdGycZk4VPlF /M+H3h1v9kneqXbjgPCUkjvJcEDYORlwQSA5YL1sdysSXNTo2eKBqFJbmh1UmuGYf9eFABwxLvsT kfrbLLErVY8+BwGKkZWe7XFIdtOId7sOp9ZDa1UwtR/bddiEi5r3iQmxB3iNKHvU1UPR7sXiycCi pAwj3wzMNh4s6SOXMpGzvuv9oyw8ArHqcxo69EvsLLQ+OnnWLaoWRsaZfyh+eHaR6uNNO9En+Dba vUxXxFHU+S2Myw06w98wggS8MIIDpKADAgECAgEpMA0GCSqGSIb3DQEBBQUAMFQxCzAJBgNVBAYT AlVTMR8wHQYDVQQKExZNSVQgTGluY29sbiBMYWJvcmF0b3J5MQwwCgYDVQQLEwNQS0kxFjAUBgNV BAMTDU1JVExMIFJvb3QgQ0EwHhcNMTMxMjE3MDAwMDAwWhcNMjAxMjMxMjM1OTU5WjBRMQswCQYD VQQGEwJVUzEfMB0GA1UEChMWTUlUIExpbmNvbG4gTGFib3JhdG9yeTEMMAoGA1UECxMDUEtJMRMw EQYDVQQDEwpNSVRMTCBDQS0zMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2jBSdW18 tuW1tNxG6h8B0kqckFZQAAtoHCkvUpUEX6jFvBd8mQI53GyLYRuAo4HWJpe7/izFXOfSJDs6UM5o vvCOfXg2bJgDYlBC9JDcLBFIn0nppOu9RvpjWSixtC56crwJ5Us5QPdtxtKdek5LJXl2oKw3w8li hUixePbxWad1m7ZMKKagvm9zTybP6FumKRxeYJjSpB2+cAYjoGGEbSVHyx8uzHm6xAoBMHxa8by+ yDz8Jzk6sP9iilgP3iXSGoCAmhyBzvlQQ5QNNWP+Emo9jz/ukKhYVB/VwdxtoquPAqn4ifDAIaM9 dtb05cy1gXAFSP3Z/iUkxyBZZUORfwIDAQABo4IBmjCCAZYwEgYDVR0TAQH/BAgwBgEB/wIBADAd BgNVHQ4EFgQU12BmDntJjXVMDf3PRt7IxxKHyr8wHwYDVR0jBBgwFoAUZ6p6z/QKprlytYqg0p3y EMND7SkwDgYDVR0PAQH/BAQDAgGGMGYGCCsGAQUFBwEBBFowWDAtBggrBgEFBQcwAoYhaHR0cDov L2NybC5sbC5taXQuZWR1L2dldHRvP0xMUkNBMCcGCCsGAQUFBzABhhtodHRwOi8vb2NzcC5sbC5t aXQuZWR1L29jc3AwMwYDVR0fBCwwKjAooCagJIYiaHR0cDovL2NybC5sbC5taXQuZWR1L2dldGNy bD9MTFJDQTCBkgYDVR0gBIGKMIGHMA0GCyqGSIb3EgIBAwEGMA0GCyqGSIb3EgIBAwEIMA0GCyqG SIb3EgIBAwEHMA0GCyqGSIb3EgIBAwEJMA0GCyqGSIb3EgIBAwEKMA0GCyqGSIb3EgIBAwELMA0G CyqGSIb3EgIBAwEOMA0GCyqGSIb3EgIBAwEPMA0GCyqGSIb3EgIBAwEQMA0GCSqGSIb3DQEBBQUA A4IBAQAsf9HBn72qU7UTgkxarjAc7iynhcDEgWwezYKtd/SLGSQ0DhtzIV/LTCxqULjOd+H+HTqM JXB8+nHnzhyqQ43RsnGZOFT5RfzPh94db/ZJ3ql244DwlJI7yXBA2DkZcEEgOWC9bHcrElzU6Nni gahSW5odVJrhmH/XhQAcMS77E5H62yyxK1WPPgcBipGVnu1xSHbTiHe7DqfWQ2tVMLUf23XYhIua 94kJsQd4jSh71NVD0e7F4snAoqQMI98MzDYeLOkjlzKRs77r/aMsPAKx6nMaOvRL7Cy0Pjp51i2q FkbGmX8ofnh2kerjTTvRJ/g22r1MV8RR1PktjMsNOsPfMIIE7TCCA9WgAwIBAgIKMziUjwAAAABu ljANBgkqhkiG9w0BAQsFADBRMQswCQYDVQQGEwJVUzEfMB0GA1UEChMWTUlUIExpbmNvbG4gTGFi b3JhdG9yeTEMMAoGA1UECxMDUEtJMRMwEQYDVQQDEwpNSVRMTCBDQS0zMB4XDTE2MDExNDE3MzAz OVoXDTE5MDExMzE3MzAzOVowYTELMAkGA1UEBhMCVVMxHzAdBgNVBAoTFk1JVCBMaW5jb2xuIExh Ym9yYXRvcnkxDzANBgNVBAsTBlBlb3BsZTEgMB4GA1UEAxMXQmx1bWVudGhhbC5VcmkuNTAwMTA1 ODQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDjFDaGib07mHBdNaVMNpj9+4iJa+K9 AcTN3y+iU1ygtvHG4coteDBf77ZN1uwdt+lodW0C8XyG43suSfpNp/owLOUElFagAnPqHAvAUIws l5AjzncpJP+78Ui4u34aMNsddP+QZu9HI2Qg+P6eMD25jkjybT9dQMxXZpO2oTBznlWjYIItdZhK 1DWZqIR0at7n2YjCSQsZNX0lJ4JwrtjHYFrYPnnZC0f1B2M7V54IS863CEyfu5XotoZx8YuHwYpK SFq80SEh6cMDLdTe1ZAjWxsnbyKC64rreStyI2PVN9uBWd+OleGoIAjVogpMKKi0pSRHcCuwDwGe kpQVubK9AgMBAAGjggG1MIIBsTAdBgNVHQ4EFgQU8U/FiJmibLZl2+KcNbVWE2PZipswDgYDVR0P AQH/BAQDAgUgMB8GA1UdIwQYMBaAFNdgZg57SY11TA39z0beyMcSh8q/MDMGA1UdHwQsMCowKKAm oCSGImh0dHA6Ly9jcmwubGwubWl0LmVkdS9nZXRjcmwvTExDQTMwZgYIKwYBBQUHAQEEWjBYMC0G CCsGAQUFBzAChiFodHRwOi8vY3JsLmxsLm1pdC5lZHUvZ2V0dG8vTExDQTMwJwYIKwYBBQUHMAGG G2h0dHA6Ly9vY3NwLmxsLm1pdC5lZHUvb2NzcDA9BgkrBgEEAYI3FQcEMDAuBiYrBgEEAYI3FQiD g+Udh+ynZoathxWD6vBFhbahHx2F69Bwg+vtIAIBZAIBBTAlBgNVHSUEHjAcBgRVHSUABggrBgEF BQcDBAYKKwYBBAGCNwoDBDAYBgNVHSAEETAPMA0GCyqGSIb3EgIBAwEIMBkGA1UdEQQSMBCBDnVy aUBsbC5taXQuZWR1MCcGCSsGAQQBgjcUAgQaHhgATABMAFUAcwBlAHIARQBuAGMALQBTAFcwDQYJ KoZIhvcNAQELBQADggEBABbuvs9m0gS5U8JJuVc+qttV2BWQ0jDepXpYfP/xN8rVScRPHe2SMUaF H5OMRhheGJkdogWVNnMrjHxQfpfc0z8yotlD3xwXENWUY5MoQmpEGB2ksFqgMd121bqzR3WY84Lc osfow0MoplXs8mvO7TnozwM+PtGZs0mpp2PzBkvWdNbs2r/7wXJP6/pLd5zPvywRNhTgoVe1aN4i vIkU8svkKMggv5ZaOsonaW8JS6dUYmvvk0QvDJRIQNRR0zpQpOKp+4V/XhMZRhxQJ3DjVTjh9Q/p HKm7ARFhFr3QAJ6ocCjyzLF5issa1Vshx7ElBIk0cXhep6mLMLqGNX3azAkwggUtMIIEFaADAgEC AgoadMQgAAAAAK0DMA0GCSqGSIb3DQEBCwUAMFExCzAJBgNVBAYTAlVTMR8wHQYDVQQKExZNSVQg TGluY29sbiBMYWJvcmF0b3J5MQwwCgYDVQQLEwNQS0kxEzARBgNVBAMTCk1JVExMIENBLTMwHhcN MTcwMzAxMTgyNTA2WhcNMjAxMjMxMjM1OTU5WjBsMQswCQYDVQQGEwJVUzEfMB0GA1UEChMWTUlU IExpbmNvbG4gTGFib3JhdG9yeTEPMA0GA1UECxMGUGVvcGxlMSswKQYDVQQDEyJCbHVtZW50aGFs LlVyaS41MDAxMDU4NCAoTW9iaWxpdHkpMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA g+8bBB+jySfGyqx/fL9a596qTeq9fGfYXI2yJEZqLzJazzV1u6oLToMnJQ6phCIkQGplPsM+9Ppz Icw5nN8GahHPU6FXXT3BSr6/bny4hftGu05y/n/DWWlPkos6PhSNAB8WG3L+6a3mHcp9yYumPkdt M20+08oiU9S6OhFr6BoFFoeFjKEcFhvvovm9GcRzQ3g1cXHore5p6umBCLGxZi0cGhBI/7ZyJmJU Uo50bAPKdpURqYSsgU7p6GxCgpIcZBUlTxCSliPO/0TqiBMZ857MF4OcehpG7LuxufD0p+g02uX7 Z0aIfYnGHlkm3Y7NgvF6lW2WxCPklqKakb2fuwIDAQABo4IB6jCCAeYwHQYDVR0OBBYEFPbiFDP7 1vJBmRLhxtKU/CWESr+tMA4GA1UdDwEB/wQEAwIGwDAfBgNVHSMEGDAWgBTXYGYOe0mNdUwN/c9G 3sjHEofKvzAzBgNVHR8ELDAqMCigJqAkhiJodHRwOi8vY3JsLmxsLm1pdC5lZHUvZ2V0Y3JsL0xM Q0EzMGYGCCsGAQUFBwEBBFowWDAtBggrBgEFBQcwAoYhaHR0cDovL2NybC5sbC5taXQuZWR1L2dl dHRvL0xMQ0EzMCcGCCsGAQUFBzABhhtodHRwOi8vb2NzcC5sbC5taXQuZWR1L29jc3AwPQYJKwYB BAGCNxUHBDAwLgYmKwYBBAGCNxUIg4PlHYfsp2aGrYcVg+rwRYW2oR8dhYHgQIbXxk0CAWQCAQkw LAYDVR0lAQH/BCIwIAYIKwYBBQUHAwQGCisGAQQBgjcKAwwGCCsGAQUFBwMCMBgGA1UdIAQRMA8w DQYLKoZIhvcSAgEDAQgwQQYDVR0RBDowOIEOdXJpQGxsLm1pdC5lZHWgJgYKKwYBBAGCNxQCA6AY DBZVUjIwOTgwQG1pdGxsLmFkLmxvY2FsMC0GCSsGAQQBgjcUAgQgHh4ATABMAE0AbwBiAGkAbABl AFMAaQBnAEEAdQB0AGgwDQYJKoZIhvcNAQELBQADggEBADbiZo1DkfqhBA4LYklB+i49k6dh7L+n DEg3WdeZ/CRZAon9G3hPsUWd5YIsufRpoYUVJABcVos87kXZmkF1RjH8vLNFOEV8ZVcNxbWC5DiA 6dTswIEhXMSHFuyp3tERvu2z6+f9FC4jvZttYyLyirBJC4KwP/AOLm42Gn4lLeNrY4Ex8nq2Ah3x jB+QqvpxD2k1aaoR0fWaDxv2ZrdaFR43x2MTkiee+wR1diZ7GA7G/HyJg9MUukKq23qm6Ys0VJQc JsKU1Q2/TLL99FRRa18ourBvFwJzcllLhTcqnvbawWt6cYEvGIJ9Dszxz7LQECXI0KrPpM7x32Su lMJjt1YxggLJMIICxQIBATBfMFExCzAJBgNVBAYTAlVTMR8wHQYDVQQKExZNSVQgTGluY29sbiBM YWJvcmF0b3J5MQwwCgYDVQQLEwNQS0kxEzARBgNVBAMTCk1JVExMIENBLTMCChp0xCAAAAAArQMw CQYFKw4DAhoFAKCCAT8wGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcN MTgwODIxMTIxMDE1WjAjBgkqhkiG9w0BCQQxFgQUKl2hud754tMqqtFg3UbvyY1ycQEwbgYJKwYB BAGCNxAEMWEwXzBRMQswCQYDVQQGEwJVUzEfMB0GA1UEChMWTUlUIExpbmNvbG4gTGFib3JhdG9y eTEMMAoGA1UECxMDUEtJMRMwEQYDVQQDEwpNSVRMTCBDQS0zAgozOJSPAAAAAG6WMHAGCyqGSIb3 DQEJEAILMWGgXzBRMQswCQYDVQQGEwJVUzEfMB0GA1UEChMWTUlUIExpbmNvbG4gTGFib3JhdG9y eTEMMAoGA1UECxMDUEtJMRMwEQYDVQQDEwpNSVRMTCBDQS0zAgozOJSPAAAAAG6WMA0GCSqGSIb3 DQEBAQUABIIBAEYdg5k4INH6sHBuZSI8GUi/ILSaNpDZR1hApi4AY2Xe5fp/+5ioAATzyDahmSh1 RvLWHXHpBP3f1G5d1qiV343+eTF+5fTLC0eSEF1CvYfijt5t174g4Y4K86PSFt4+fWcoyNMbY8UR oPuQSQgfQovVspy+sxOthUbNLaEkh0LnrrdUlw3wdOjcauVdN8rzdJXI+jFbAgIcRYt7cfxE1qdp VbnP36NWttTDSrJwffSv1+O/24TsQs/iFO/M9rWLt0xK3c3G7QZeK4XNmlzMzmxAGcG5U4S6InNV ocXvHoEokWaqotgxNBNQduIn91HqDE+/ux2gF+x4JSbXORLlTLIAAAAAAAA= --Apple-Mail-2316BBF7-9A91-480C-A745-860FA4D8B351-- From nobody Tue Aug 21 06:12:15 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5D0F6130DD3 for ; Tue, 21 Aug 2018 06:12:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YWRk3ksqR9F5 for ; Tue, 21 Aug 2018 06:12:12 -0700 (PDT) Received: from straasha.imrryr.org (straasha.imrryr.org [100.2.39.101]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3606B12D7EA for ; Tue, 21 Aug 2018 06:12:12 -0700 (PDT) Received: from [192.168.1.161] (unknown [192.168.1.161]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by straasha.imrryr.org (Postfix) with ESMTPSA id 15F384746 for ; Tue, 21 Aug 2018 09:12:10 -0400 (EDT) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) From: Viktor Dukhovni In-Reply-To: Date: Tue, 21 Aug 2018 09:12:09 -0400 Content-Transfer-Encoding: quoted-printable Reply-To: "" Message-Id: <03F080BE-E263-43C8-9845-BA4E0C9A62AF@dukhovni.org> References: To: "" X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: Re: [TLS] integrity only ciphersuites X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Aug 2018 13:12:13 -0000 > On Aug 21, 2018, at 12:32 AM, Viktor Dukhovni = wrote: >=20 > There is also a use-case for communication between processes on the = same > machine, e.g. over unix-domain sockets and the like. Encryption in = this > context is pointless. TLS can be used with client certificates as a = means > of client authentication. I should note that disabling encryption is not always a performance win. Depending on the machine's hardware and assembly support in libraries AEAD with AESGCM may be faster than SHA256 without encryption. --=20 Viktor. From nobody Tue Aug 21 06:15:29 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 14EC1130DEA for ; Tue, 21 Aug 2018 06:15:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3wJQ6l9xvzms for ; Tue, 21 Aug 2018 06:15:26 -0700 (PDT) Received: from mail-qt0-x244.google.com (mail-qt0-x244.google.com [IPv6:2607:f8b0:400d:c0d::244]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2EE24130DF4 for ; Tue, 21 Aug 2018 06:15:24 -0700 (PDT) Received: by mail-qt0-x244.google.com with SMTP id y5-v6so19986495qti.12 for ; Tue, 21 Aug 2018 06:15:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=8Pt89DDNPmBOvxUinLPPG7TFhMF7lhVzuRumXVDPGzI=; b=qG3fHZkIktLTRAXt/HUGCH+MD2e8iGiu/teHlhUqRRIUWKk1QKrxW0MukX5QmVPviB qeyTnJMFAGmHWJ5kZJ0xZhMiloANMPI3jSB+yEiA3RUXcJfpQnyayPGZLXpnXYJ12fRl jSV7uUB6XpaVwmAQ7e2fDprjJb8I9rLf5KLBXaKFfSedZZq8ZQBuUnTamlO6cmprHuuD zD+6aVe6cjAC5s8W4GqCKvS6JI7jx8UFRuvECzgsZ6WF13SkgQaVa/TnT2m+bOMIWNW0 t9eR/r3aBrE0Z41IKJHkoZFTWjr5kuXkOPioxxQBUNGBFMPneoWgEDkLPrvR9SXQgZVV pMbQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=8Pt89DDNPmBOvxUinLPPG7TFhMF7lhVzuRumXVDPGzI=; b=Ot1ob4HashKAKG5jkfAwyKUXv91k6rzFwVqW7Ex/xeCCqsCh+WLuqlQxqTC2CGVfn6 P25QNXHM2QnfAqexdG+ViLdXPo3mPUZgiXfMrbbE1GP8/YPIwZmsPIc+JEYjCRsMpKcV FZ8avgBV492vrjMWioyez9ZkuasZmyzbzdGIUFPbXJ59uzvH4A6EZEi/YM9Fn9XtnIpf D5ihmhzda7n5qNuc6H0kmTJAStL2e+4qJ6leWQdXefZx6lhmM0BA2OZwPqn7gKuh2Q/j kIUuM6gUo/kWSyLsyzpBkQFzKByQQn/3OYedOJsMBPtgSwnUJecDmxdL+yI5asE1QE8V pvWg== X-Gm-Message-State: APzg51CASSdBho0M7fUaIgNSiAy8euHqD3Bhd1nSx26EDd2rt3wuN54H TD2LAlZd0RslheJ1Ku/rUl67QnFl X-Google-Smtp-Source: ANB0Vda4vBXV68wDYw3cszLwcVjzCvR7wXayheqMznOONLxFQ9cG5zl7JAi3O6ZgT8I5+1lxOFqXMA== X-Received: by 2002:ac8:357c:: with SMTP id z57-v6mr1627203qtb.272.1534857323238; Tue, 21 Aug 2018 06:15:23 -0700 (PDT) Received: from ?IPv6:2600:380:8d2c:564a:4c79:b498:ecfe:4d2d? ([2600:380:8d2c:564a:4c79:b498:ecfe:4d2d]) by smtp.gmail.com with ESMTPSA id 42-v6sm4975666qtq.39.2018.08.21.06.15.22 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 21 Aug 2018 06:15:22 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (1.0) From: Kathleen Moriarty X-Mailer: iPhone Mail (15E216) In-Reply-To: <982363FD-A839-4175-BA53-7CA242F9ADA6@ll.mit.edu> Date: Tue, 21 Aug 2018 09:15:21 -0400 Cc: Stephen Farrell , "Nancy Cam-Winget (ncamwing)" , "tls@ietf.org" Content-Transfer-Encoding: quoted-printable Message-Id: <2D7F2926-6376-4B2C-BDE9-7A6F1C0FA748@gmail.com> References: <64d23891-2f32-9bb8-1ec8-f4fad13cdfb9@cs.tcd.ie> <982363FD-A839-4175-BA53-7CA242F9ADA6@ll.mit.edu> To: "Blumenthal, Uri - 0553 - MITLL" Archived-At: Subject: Re: [TLS] integrity only ciphersuites X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Aug 2018 13:15:28 -0000 Sent from my mobile device > On Aug 21, 2018, at 8:10 AM, Blumenthal, Uri - 0553 - MITLL wrote: >=20 > "Vulnerable-by-design ciphersuites"? Vulnerable to what?=20 >=20 > Suck sites are designed to provide end-point authentication and traffic in= tegrity. Care to explain/show how these properties would not hold? >=20 > Besides, it's been explained several times that some use cases do not requ= ire confidentiality, and in some use cases confidentiality is forbidden. I agree with Uri here, flexibility to cover these use cases to accommodate t= he actual security requirements may result in them using something instead o= f nothing. It could be defined and not listed as Recommended as well. This= comes down to risk management and options, where the risk can be clearly ex= plained and the lack of recommendation can also be explained. Best regards, Kathleen=20 >=20 > Regards, > Uri >=20 > Sent from my iPhone >=20 >> On Aug 21, 2018, at 07:42, Stephen Farrell wr= ote: >>=20 >>=20 >>=20 >>> On 20/08/18 21:48, Nancy Cam-Winget (ncamwing) wrote: >>> All, A couple IoT consortiums are trying to embrace the improvements >>> made to TLS 1.3 and as they define their new security constructs >>> would like to adopt the latest protocols, in this case TLS 1.3. To >>> that extent, they have a strong need for mutual authentication, but >>> integrity only (no confidentiality) requirements. >>>=20 >>> In following the new IANA rules, we have posted the draft >>> https://tools.ietf.org/html/draft-camwinget-tls-ts13-macciphersuites-00 >>> to document request for registrations of HMAC based cipher selections >>> with TLS 1.3=E2=80=A6..and are soliciting feedback from the WG on the dr= aft >>> and its path forward. >>=20 >> As ekr pointed out, with the new registration rules, >> there's nothing to stop someone defining any old set >> of crypto stuff and getting non-recommended codepoints. >>=20 >> That said, I don't consider that defining such >> vulnerable-by-design ciphersuites is a good plan. >>=20 >> - It imposes costs on the non-niche users of TLS - once >> these things are defined then developers and those who >> deploy/configure applications using TLS need to check >> that they're not using these undesirable ciphersuites, >> so costs are being displaced from niche uses to the >> vast majority of implementations and deployments, which >> seems to me to be a bad idea. And we know that people >> will sometimes get those checks wrong leading to unexpected >> transmission of plaintext over the Internet. >>=20 >> - Similarly, just defining such ciphersuites seems likely >> to lead to less well tested and infrequently used code >> paths, which is undesirable. (Assuming someone pays some >> developer to add these to some library, which generally >> does seem to happen.) >>=20 >> - RFC7525 [1] is clear on this topic (after debate in the >> UTA WG) - "Implementations MUST NOT negotiate the cipher >> suites with NULL encryption" and I see nothing new to >> convince me that that ought change for TLS1.3. >>=20 >> - Code footprint arguments aren't that convincing to >> me - to get interop for the few devices where AES being >> present or absent could make a real difference, you'd >> need an awful lot more profiling of TLS or DTLS. I don't >> see evidence of that so the interop/footprint arguments >> seem pretty weak. I'd also bet that any useful "tiny >> footprint" profile of that kind would end up targeting >> loads of use-cases where confidentiality is absolutely >> required. >>=20 >> - (In addition to the good points made by Geoffrey >> Keating [2]) cleartext payloads would also assist in >> device fingerprinting, making it easier to exploit >> vulnerabilities at scale. >>=20 >> - IIUC there is also a desire to encrypt firmware >> updates so that patches can be distributed more quickly >> than attackers can reverse-engineer attacks. [4] I'm >> not entirely sure if that's really likely to happen, >> but if it were, then devices would need to be able to >> use recommended ciphersuites in any case. >>=20 >> - TLS/AX.25 doesn't seem that good a plan in any >> case - according to [3], which seems reasonable to >> me, using clear-signed GPG is quicker and better >> meets the oddball regulations. Attempting to deal >> with those regulations by weakening TLS seems like >> a very bad plan, as you'd fail in any case to achieve >> interop with normal TLS applications like the web. >> (And the advertising is as illegal as the crypto >> apparently, though I do like that aspect:-) >>=20 >> - WRT unix sockets, I'm not clear that there's a >> sufficiently important performance improvement in >> real deployments to justify introducing weakened >> ciphersuites - presumably mail servers are going to >> use standard TLS libraries that (I hope!) won't be >> offering NULL encryption, so I'd be surprised if >> the right engineering decision was to prioritise >> CPU to that extent, given the risks associated with >> having weak ciphersuites present in widely used >> implementations. IOW, it seems more sensible to me >> for mail servers to just stick to using RECOMMENDED >> ciphersuites. And given that you could use SASL >> with Postfix/LMTP [5] I'm not sure why you'd want >> a weirdo-version of TLS1.3 anyway but maybe there's >> some reason I don't get. >>=20 >> - I think this WG has had to spend waaaay too much >> time dealing with the "inspection of data" debate in >> various forms, but we did get an answer (no consensus) >> in the end for that. Niche use cases seem extremely >> unlikely to me to justify revisiting that painful >> topic. >>=20 >> So all in all, I just don't see a need for these >> weak-by-design ciphersuites to even be defined. I'd >> encourage folks who think they're needed to instead >> think about how using RECOMMENDED ciphersuites might >> make their implementations more widely applicable and >> safer. Seems like a much more productive approach to >> me anyway. >>=20 >> Regards, >> S. >>=20 >> [1] https://tools.ietf.org/html/rfc7525 >> [2] https://mailarchive.ietf.org/arch/msg/tls/uI8xVgp7gTuJgwUyY-UgZfmUkRo= >> [3] https://tools.ietf.org/html/draft-ietf-suit-architecture-01#section-3= .3 >> [4] https://www.tapr.org/pdf/DCC2010-AX.25-AuthenticationEffects-KE5LKY.p= df >> [5] http://www.postfix.org/SASL_README.html#client_sasl >>=20 >>=20 >> <0x5AB2FAF17B172BEA.asc> >> _______________________________________________ >> TLS mailing list >> TLS@ietf.org >> https://www.ietf.org/mailman/listinfo/tls > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls From nobody Tue Aug 21 06:31:24 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2FFBB129385 for ; Tue, 21 Aug 2018 06:31:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.619 X-Spam-Level: X-Spam-Status: No, score=-2.619 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ul1FxbixtgUQ for ; Tue, 21 Aug 2018 06:31:21 -0700 (PDT) Received: from elasmtp-mealy.atl.sa.earthlink.net (elasmtp-mealy.atl.sa.earthlink.net [209.86.89.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4C030130E23 for ; Tue, 21 Aug 2018 06:31:20 -0700 (PDT) Received: from [174.192.23.50] (helo=Williams-MacBook-Pro.local) by elasmtp-mealy.atl.sa.earthlink.net with esmtpa (Exim 4) (envelope-from ) id 1fs6kh-000AXz-Ik for tls@ietf.org; Tue, 21 Aug 2018 09:31:19 -0400 Date: Tue, 21 Aug 2018 06:31:19 -0700 From: Bill Frantz To: tls@ietf.org X-Priority: 3 In-Reply-To: Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: quoted-printable X-Mailer: Mailsmith 2.4.3 (480) X-ELNK-Trace: 3a5e54fa03f1b3e21aa676d7e74259b7b3291a7d08dfec7961fd2ac72f5ded4d6c723f7997fcbf37350badd9bab72f9c350badd9bab72f9c350badd9bab72f9c X-Originating-IP: 174.192.23.50 Archived-At: Subject: Re: [TLS] integrity only ciphersuites X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Aug 2018 13:31:23 -0000 One area where there is a need for an integrity and=20 authentication only suite is in amateur radio systems. In=20 amateur radio, any encoding scheme which hides the meaning of a=20 message is against the FCC regulations. However, remote control=20 by radio could benefit from both integrity and authentication.=20 The FCC regulations recognize this need and permit encryption of=20 messages controlling amateur radio satellites. Amateur radio digital protocols include some state of the art=20 error detection and correction techniques, providing a kind of=20 integrity, but they do not provide authentication. Amateurs have=20 gotten by with a combination of very primitive authentication=20 techniques and legal action after tracking attackers with radio=20 direction finding. While I'm not sure that this application area is important=20 enough to be addressed by the TLS working group, if there are=20 other application areas with similar needs, then perhaps these=20 needs should be addressed. Cheers - Bill -------------------------------------------------------------- Bill Frantz | There are now so many exceptions to the 408-356-8506 | Fourth Amendment that it operates only by www.pwpconsult.com | accident. - William Hugh Murray From nobody Tue Aug 21 06:37:32 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CA707130EF6 for ; Tue, 21 Aug 2018 06:37:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=hs-offenburg.de Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id js66eK_Fe06w for ; Tue, 21 Aug 2018 06:37:09 -0700 (PDT) Received: from mx.hs-offenburg.de (mail.hs-offenburg.de [141.79.11.25]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1E956130F12 for ; Tue, 21 Aug 2018 06:37:09 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mx.hs-offenburg.de (Postfix) with ESMTP id 8E9293EBC06F for ; Tue, 21 Aug 2018 15:37:05 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=hs-offenburg.de; h=content-type:content-type:mime-version:in-reply-to:references :subject:subject:from:from:date:date:x-mailer:message-id :received:received:received; s=default; t=1534858624; x= 1535722625; bh=Yi3B0+E+qWnkeGY+ImdbYRkjua58IH70kWcjnFeIdxU=; b=f IzGiV5u7h4e4gkRveHa1AHZbY0bBhmU7cIorLBjJYD9U11P5dxBFBt9G1WJAH13M hcp1/F/IYFlZ9DZ3h4mqzaaJAZevINgIUcaD0sWkE+zwkGD0Xaxzkbj0P2iikWHJ +Aw2zCahKHWrrjs5a4ybMq3dZjSK49y9BcQ9aABUyo= X-Virus-Scanned: amavisd-new at hs-offenburg.de Received: from mx.hs-offenburg.de ([127.0.0.1]) by localhost (mx.hs-offenburg.de [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tcrhtG0dEODx for ; Tue, 21 Aug 2018 15:37:04 +0200 (CEST) Received: from gwia2.rz.hs-offenburg.de (gwia2.rz.hs-offenburg.de [141.79.10.30]) by mx.hs-offenburg.de (Postfix) with ESMTPS id 2DAA43EBC057 for ; Tue, 21 Aug 2018 15:36:52 +0200 (CEST) Received: from gw_dom-gwia2-MTA by gwia2.rz.hs-offenburg.de with Novell_GroupWise; Tue, 21 Aug 2018 15:36:52 +0200 Message-Id: <5B7C1571020000AC0015C330@gwia2.rz.hs-offenburg.de> X-Mailer: Novell GroupWise Internet Agent 14.2.3 Date: Tue, 21 Aug 2018 15:36:49 +0200 From: "Andreas Walz" To: Cc: , , References: <64d23891-2f32-9bb8-1ec8-f4fad13cdfb9@cs.tcd.ie> <982363FD-A839-4175-BA53-7CA242F9ADA6@ll.mit.edu> <2D7F2926-6376-4B2C-BDE9-7A6F1C0FA748@gmail.com> In-Reply-To: <2D7F2926-6376-4B2C-BDE9-7A6F1C0FA748@gmail.com> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="=__Part3B011161.4__=" Archived-At: Subject: Re: [TLS] integrity only ciphersuites X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Aug 2018 13:37:31 -0000 This is a MIME message. If you are reading this text, you may want to consider changing to a mail reader or gateway that understands how to properly handle MIME multipart messages. --=__Part3B011161.4__= Content-Type: multipart/alternative; boundary="=__Part3B011161.5__=" --=__Part3B011161.5__= Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit +1 I fully understand the pursuit of minimizing complexity in TLS. However, banning from TLS all provisions to serve non-internet cases seems suboptimal to me. I think there is a whole universe of systems and applications that are just at the very beginning of being armed with security features: think of communication systems driving, e.g., industrial automation and critical infrastructures. These are quite different from the internet and the web (different threats, security requirements, architectures, networks, resources, etc.). Still, IMHO it's not a niche at all; it's just not as visible to most of us. I strongly believe it is *not* a good idea to hold back all the valuable experience condensed in TLS and entail the design of customized security protocols for such systems. TLS is state-of-the-art and its benefits should be accessible to as many systems as possible. Cheers, Andi Walz >>> Kathleen Moriarty 08/21/18 3:20 PM >>> Sent from my mobile device > On Aug 21, 2018, at 8:10 AM, Blumenthal, Uri - 0553 - MITLL wrote: > > "Vulnerable-by-design ciphersuites"? Vulnerable to what? > > Suck sites are designed to provide end-point authentication and traffic integrity. Care to explain/show how these properties would not hold? > > Besides, it's been explained several times that some use cases do not require confidentiality, and in some use cases confidentiality is forbidden. I agree with Uri here, flexibility to cover these use cases to accommodate the actual security requirements may result in them using something instead of nothing. It could be defined and not listed as Recommended as well. This comes down to risk management and options, where the risk can be clearly explained and the lack of recommendation can also be explained. Best regards, Kathleen > > Regards, > Uri > > Sent from my iPhone > >> On Aug 21, 2018, at 07:42, Stephen Farrell wrote: >> >> >> >>> On 20/08/18 21:48, Nancy Cam-Winget (ncamwing) wrote: >>> All, A couple IoT consortiums are trying to embrace the improvements >>> made to TLS 1.3 and as they define their new security constructs >>> would like to adopt the latest protocols, in this case TLS 1.3. To >>> that extent, they have a strong need for mutual authentication, but >>> integrity only (no confidentiality) requirements. >>> >>> In following the new IANA rules, we have posted the draft >>> https://tools.ietf.org/html/draft-camwinget-tls-ts13-macciphersuites-00 >>> to document request for registrations of HMAC based cipher selections >>> with TLS 1.3…..and are soliciting feedback from the WG on the draft >>> and its path forward. >> >> As ekr pointed out, with the new registration rules, >> there's nothing to stop someone defining any old set >> of crypto stuff and getting non-recommended codepoints. >> >> That said, I don't consider that defining such >> vulnerable-by-design ciphersuites is a good plan. >> >> - It imposes costs on the non-niche users of TLS - once >> these things are defined then developers and those who >> deploy/configure applications using TLS need to check >> that they're not using these undesirable ciphersuites, >> so costs are being displaced from niche uses to the >> vast majority of implementations and deployments, which >> seems to me to be a bad idea. And we know that people >> will sometimes get those checks wrong leading to unexpected >> transmission of plaintext over the Internet. >> >> - Similarly, just defining such ciphersuites seems likely >> to lead to less well tested and infrequently used code >> paths, which is undesirable. (Assuming someone pays some >> developer to add these to some library, which generally >> does seem to happen.) >> >> - RFC7525 [1] is clear on this topic (after debate in the >> UTA WG) - "Implementations MUST NOT negotiate the cipher >> suites with NULL encryption" and I see nothing new to >> convince me that that>> me - to get interop for the few devices where AES being >> present or absent could make a real difference, you'd >> need an awful lot more profiling of TLS or DTLS. I don't >> see evidence of that so the interop/footprint arguments >> seem pretty weak. I'd also bet that any useful "tiny >> footprint" profile of that kind would end up targeting >> loads of use-cases where confidentiality is absolutely >> required. >> >> - (In addition to the good points made by Geoffrey >> Keating [2]) cleartext payloads would also assist in >> device fingerprinting, making it easier to exploit >> vulnerabilities at scale. >> >> - IIUC there is also a desire to encrypt firmware >> updates so that patches can be distributed more quickly >> than attackers can reverse-engineer attacks. [4] I'm >> not entirely sure if that's really likely to happen, >> but if it were, then devices would need to be able to >> use recommended ciphersuites in any case. >> >> - TLS/AX.25 doesn't seem that good a plan in any >> case - according to [3], which seems reasonable to >> me, using clear-signed GPG is quicker and better >> meets the oddball regulations. Attempting to deal >> with those regulations by weakening TLS seems like >> a very bad plan, as you'd fail in any case to achieve >> interop with normal TLS applications like the web. >> (And the advertising is as illegal as the crypto >> apparently, though I do like that aspect:-) >> >> - WRT unix sockets, I'm not clear that there's a >> sufficiently important performance improvement in >> real deployments to justify introducing weakened >> ciphersuites - presumably mail servers are going to >> use standard TLS libraries that (I hope!) won't be >> offering NULL encryption, so I'd be surprised if >> the right engineering decision was to prioritise >> CPU to that extent, given the risks associated with >> having weak ciphersuites present in widely used >> implementations. IOW, it seems more sensible to me >> for mail servers to just stick to using RECOMMENDED >> ciphersuites. And given that you could use SASL >> with Postfix/LMTP [5] I'm not sure why you'd want >> a weirdo-version of TLS1.3 anyway but maybe there's >> some reason I don't get. >> >> - I think this WG has had to spend waaaay too much >> time dealing with the "inspection of data" debate in >> various forms, but we did get an answer (no consensus) >> in the end for that. Niche use cases seem extremely >> unlikely to me to justify revisiting that painful >> topic. >> >> So all in all, I just don't see a need for these >> weak-by-design ciphersuites to even be defined. I'd >> encourage folks who think they're needed to instead >> think about how using RECOMMENDED ciphersuites might >> make their implementations more widely applicable and >> safer. Seems like a much more productive approach to >> me anyway. >> >> Regards, >> S. >> >> [1] https://tools.ietf.org/html/rfc7525 >> [2] https://mailarchive.ietf.org/arch/msg/tls/uI8xVgp7gTuJgwUyY-UgZfmUkRo >> [3] https://tools.ietf.org/html/draft-ietf-suit-architecture-01#section-3.3 >> [4] https://www.tapr.org/pdf/DCC2010-AX.25-AuthenticationEffects-KE5LKY.pdf >> [5] http://www.postfix.org/SASL_README.html#client_sasl >> >> >> <0x5AB2FAF17B172BEA.asc> >> _______________________________________________ >> TLS mailing list >> TLS@ietf.org >> https://www.ietf.org/mailman/listinfo/tls > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls _______________________________________________ TLS mailing list TLS@ietf.org https://www.ietf.org/mailman/listinfo/tls --=__Part3B011161.5__= Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Content-Description: HTML =0Abody p =0A{ =0A margin: 0px; =0A}=0A
+1

I fully understand the pursuit of minimizing = complexity in TLS. However, banning from TLS all provisions to serve = non-internet cases seems suboptimal to me.

I think there is a whole = universe of systems and applications that are just at the very beginning = of being armed with security features: think of communication systems = driving, e.g., industrial automation and critical infrastructures. These = are quite different from the internet and the web (different threats, = security requirements, architectures, networks, resources, etc.). Still, = IMHO it's not a niche at all; it's just not as visible to most of = us.

I strongly believe it is *not* a good idea to hold back all the = valuable experience condensed in TLS and entail the design of customized = security protocols for such systems. TLS is state-of-the-art and its = benefits should be accessible to as many systems as possible.

Cheers,
Andi Walz


>>> Kathleen&nb= sp;Moriarty <kathleen.moriarty.ietf@gmail.com> 08/21/18 3:20 PM = >>>


Sent from my mobile device

> On = Aug 21, 2018, at 8:10 AM, Blumenthal, Uri - 0553 - MITLL <uri@ll.mit.edu= > wrote:
>
> "Vulnerable-by-design ciphersuites"? = Vulnerable to what?
>
> Suck sites are designed to provide = end-point authentication and traffic integrity. Care to explain/show how = these properties would not hold?
>
> Besides, it's been = explained several times that some use cases do not require confidentiality,= and in some use cases confidentiality is forbidden.

I agree with = Uri here, flexibility to cover these use cases to accommodate the actual = security requirements may result in them using something instead of = nothing. It could be defined and not listed as Recommended as well. This = comes down to risk management and options, where the risk can be clearly = explained and the lack of recommendation can also be explained.

Best= regards,
Kathleen

>
> Regards,
> Uri
> =
> Sent from my iPhone
>
>> On Aug 21, 2018, at = 07:42, Stephen Farrell <stephen.farrell@cs.tcd.ie> wrote:
>>=
>>
>>
>>> On 20/08/18 21:48, Nancy = Cam-Winget (ncamwing) wrote:
>>> All, A couple IoT consortiums = are trying to embrace the improvements
>>> made to TLS 1.3 and = as they define their new security constructs
>>> would like to = adopt the latest protocols, in this case TLS 1.3. To
>>> = that extent, they have a strong need for mutual authentication, but
>= >> integrity only (no confidentiality) requirements.
>>> =
>>> In following the new IANA rules, we have posted the = draft
>>> https://tools.ietf.org/html/draft-camwinget-tls-ts13-= macciphersuites-00
>>> to document request for registrations = of HMAC based cipher selections
>>> with TLS 1.3=E2=80=A6..and = are soliciting feedback from the WG on the draft
>>> and its = path forward.
>>
>> As ekr pointed out, with the new = registration rules,
>> there's nothing to stop someone defining = any old set
>> of crypto stuff and getting non-recommended = codepoints.
>>
>> That said, I don't consider that = defining such
>> vulnerable-by-design ciphersuites is a good = plan.
>>
>> - It imposes costs on the non-niche users = of TLS - once
>> these things are defined then developers and = those who
>> deploy/configure applications using TLS need to = check
>> that they're not using these undesirable ciphersuites,>> so costs are being displaced from niche uses to the
>> = vast majority of implementations and deployments, which
>> seems = to me to be a bad idea. And we know that people
>> will sometimes = get those checks wrong leading to unexpected
>> transmission of = plaintext over the Internet.
>>
>> - Similarly, just = defining such ciphersuites seems likely
>> to lead to less well = tested and infrequently used code
>> paths, which is undesirable. = (Assuming someone pays some
>> developer to add these to some = library, which generally
>> does seem to happen.)
>> =
>> - RFC7525 [1] is clear on this topic (after debate in = the
>> UTA WG) - "Implementations MUST NOT negotiate the = cipher
>> suites with NULL encryption" and I see nothing new = to
>> convince me that that ought change for TLS1.3.
>> =
>> - Code footprint arguments aren't that convincing to
>&g= t; me - to get interop for the few devices where AES being
>> = present or absent could make a real difference, you'd
>> need an = awful lot more profiling of TLS or DTLS. I don't
>> see evidence = of that so the interop/footprint arguments
>> seem pretty weak. = I'd also bet that any useful "tiny
>> footprint" profile of that = kind would end up targeting
>> loads of use-cases where confidenti= ality is absolutely
>> required.
>>
>> - (In = addition to the good points made by Geoffrey
>> Keating [2]) = cleartext payloads would also assist in
>> device fingerprinting, = making it easier to exploit
>> vulnerabilities at scale.
>&g= t;
>> - IIUC there is also a desire to encrypt firmware
>&g= t; updates so that patches can be distributed more quickly
>> = than attackers can reverse-engineer attacks. [4] I'm
>> not = entirely sure if that's really likely to happen,
>> but if it = were, then devices would need to be able to
>> use recommended = ciphersuites in any case.
>>
>> - TLS/AX.25 doesn't = seem that good a plan in any
>> case - according to [3], which = seems reasonable to
>> me, using clear-signed GPG is quicker and = better
>> meets the oddball regulations. Attempting to deal
>= ;> with those regulations by weakening TLS seems like
>> a = very bad plan, as you'd fail in any case to achieve
>> interop = with normal TLS applications like the web.
>> (And the advertising= is as illegal as the crypto
>> apparently, though I do like that = aspect:-)
>>
>> - WRT unix sockets, I'm not clear that = there's a
>> sufficiently important performance improvement = in
>> real deployments to justify introducing weakened
>>= ciphersuites - presumably mail servers are going to
>> use = standard TLS libraries that (I hope!) won't be
>> offering NULL = encryption, so I'd be surprised if
>> the right engineering = decision was to prioritise
>> CPU to that extent, given the risks = associated with
>> having weak ciphersuites present in widely = used
>> implementations. IOW, it seems more sensible to me
>= > for mail servers to just stick to using RECOMMENDED
>> = ciphersuites. And given that you could use SASL
>> with Postfix/LM= TP [5] I'm not sure why you'd want
>> a weirdo-version of TLS1.3 = anyway but maybe there's
>> some reason I don't get.
>> =
>> - I think this WG has had to spend waaaay too much
>>= time dealing with the "inspection of data" debate in
>> various = forms, but we did get an answer (no consensus)
>> in the end for = that. Niche use cases seem extremely
>> unlikely to me to justify = revisiting that painful
>> topic.
>>
>> So all = in all, I just don't see a need for these
>> weak-by-design = ciphersuites to even be defined. I'd
>> encourage folks who think = they're needed to instead
>> think about how using RECOMMENDED = ciphersuites might
>> make their implementations more widely = applicable and
>> safer. Seems like a much more productive = approach to
>> me anyway.
>>
>> Regards,
>= ;> S.
>>
>> [1] https://tools.ietf.org/html/rfc7525>> [2] https://mailarchive.ietf.org/arch/msg/tls/uI8xVgp7gTuJgwUyY-= UgZfmUkRo
>> [3] https://tools.ietf.org/html/draft-ietf-suit-archi= tecture-01#section-3.3
>> [4] https://www.tapr.org/pdf/DCC2010-AX.= 25-AuthenticationEffects-KE5LKY.pdf
>> [5] http://www.postfix.org/= SASL_README.html#client_sasl
>>
>>
>> = <0x5AB2FAF17B172BEA.asc>
>> ________________________________= _______________
>> TLS mailing list
>> TLS@ietf.org
&g= t;> https://www.ietf.org/mailman/listinfo/tls
> __________________= _____________________________
> TLS mailing list
> TLS@ietf.org=
> https://www.ietf.org/mailman/listinfo/tls

_________________= ______________________________
TLS mailing list
TLS@ietf.org
https= ://www.ietf.org/mailman/listinfo/tls
--=__Part3B011161.5__=-- --=__Part3B011161.4__=-- From nobody Tue Aug 21 07:06:37 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 04AAC130DFB for ; Tue, 21 Aug 2018 07:06:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.908 X-Spam-Level: X-Spam-Status: No, score=-1.908 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, T_DKIMWL_WL_MED=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=ipv-sx.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QQYxqGo_W2uU for ; Tue, 21 Aug 2018 07:06:32 -0700 (PDT) Received: from mail-oi0-x232.google.com (mail-oi0-x232.google.com [IPv6:2607:f8b0:4003:c06::232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 56152130DD0 for ; Tue, 21 Aug 2018 07:06:32 -0700 (PDT) Received: by mail-oi0-x232.google.com with SMTP id q11-v6so32165950oic.12 for ; Tue, 21 Aug 2018 07:06:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipv-sx.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=j6vg02at6EXkE/KCMokBSpYVDL3DxeV18W9FXNzTSh8=; b=MErYnaI1wiMN56fwz+kEa9KwXGo+QjD3OvsBq8BFiy0uF/J1iO70wC55/DvSEUL3Oy 3CdRonDfDmLbE9lDuBp3k0h9UGajF7bKXd3DBEkB7rc2KYoYLkf907R5vesUxfMt0Wcj 0URnmRzDPlZD0KfmNdDT+69FiMzWARdmJtMM/hP//hO7c185aKRhsFwOAep8d+zb1nGA s9RixBi56lBzzZh4ykSgBG9Am8CIXUNZwX6Nu2oc0BuP7WHH02AlU3RsHMSldkGDxaWr 4srTq/7EeLjdUGo0MOg1RN5JTGllURg3IMm1zG1w5bET4uZVVlax+04/QnjQQfkIWdsN nvgw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=j6vg02at6EXkE/KCMokBSpYVDL3DxeV18W9FXNzTSh8=; b=Vajb44kMIfXgHz7SDv/iM1Papxson0RYicvZxnqljbWgjrkjJ93asZDByXHi58/ZZ1 039boTx/EMxWmJv8hBvYzikkPA7zekUdw0Ucz3orumzCM1/ISSGu4FNC/ASHLDYTh7aZ UfSBgZ3++sIZnzsr6F4QZJUz59Gc50c3zaLM6CgpReg5bevKQjSfNS8BTB5BG0AjbE3B sSeb7p/iae/1ytItGj9FQOMj/dcwRsfFG551Wzrw6doYD/9xLnTbJOHZfzIKhEOsYLMb i9/b/3F9jvIzjSIo2ELHWp/KP6dVskFICFmr3E/molabb90pSSxYikgeNnB4UjYyy8Kp mSpQ== X-Gm-Message-State: AOUpUlG8aFz8FzBHUy2a6W8HiRDgbQhdg96t1q3LAEyl32chxJnp/QdK 4P78pzk0SSePdf0KYr/mqPbj3IQ3+6N1nseEKPU6wg== X-Google-Smtp-Source: AA+uWPyCXF0fWaA1kMEZaUQ11g0fEtIS4+JLYKjeHFLIrqa6RPJ4N3RPcU5GPGPRhD93A3TSrspypXa2pOTYC/3dZbI= X-Received: by 2002:aca:6b87:: with SMTP id g129-v6mr17265701oic.88.1534860391468; Tue, 21 Aug 2018 07:06:31 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Richard Barnes Date: Tue, 21 Aug 2018 10:06:20 -0400 Message-ID: To: geoffk@geoffk.org Cc: ncamwing=40cisco.com@dmarc.ietf.org, "" Content-Type: multipart/alternative; boundary="00000000000069e6ce0573f288d3" Archived-At: Subject: Re: [TLS] integrity only ciphersuites X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Aug 2018 14:06:35 -0000 --00000000000069e6ce0573f288d3 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Mon, Aug 20, 2018 at 7:46 PM Geoffrey Keating wrote: > "Nancy Cam-Winget \(ncamwing\)" > writes: > > > In following the new IANA rules, we have posted the draft > > https://tools.ietf.org/html/draft-camwinget-tls-ts13-macciphersuites-00 > > to document request for registrations of HMAC based cipher > > selections with TLS 1.3=E2=80=A6..and are soliciting feedback from the = WG on > > the draft and its path forward. > > This draft needs more security analysis than is currently there, and > probably it needs to define not just a ciphersuite but an entire > profile for using TLS with this ciphersuite. Some topics: > > * Anything that relies on EncryptedExtensions should probably not be > used. > > * The session ticket properties change in the absence of encryption. In > existing TLS 1.3, they are sent only after Finished and so are > encrypted; now they are public. I am not sure if this changes the > security model but it definitely makes it easier to attack the ticket. > > * A less-obvious consequence to the lack of confidentality is that a > typical implementation, an attacker can selectively block messages > knowing their contents (by breaking the connection). In the weather > example this might be used to manipulate average daily temperature by > blocking only higher or only lower readings. In the robot example > this might be used to cause it to exceed its limits by allowing > movement commands only in one direction. > > I wonder whether it's really helpful to call the result 'TLS' and > not something else? > I'm agnostic w.r.t. confidentiality of application data -- we've historically been bad at making decision about what does / does not need to be confidential, but hey, it's your data. However, the EE / NST arguments Geoff make here seem pretty compelling to me. They indicate to me that if a mechanism is defined where application data is not encrypted, records that contain non-application data still need to be encrypted. That of course blows away the "code footprint" argument, and it's not trivial to implement given how the application_data content type has been overloaded in 1.3. ISTM that in order to do this at all elegantly, you'd have to abandon using application_data records for application data, since those have to be encrypted for the above reasons), and instead either: - Use a different record type (say plaintext_data) - Use a different protocol that can be muxed with TLS (as with DTLS-SRTP) Unfortunately the former approach would require a Standards Action. So maybe the latter is the way to go. --Richard > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > --00000000000069e6ce0573f288d3 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


On Mon= , Aug 20, 2018 at 7:46 PM Geoffrey Keating <geoffk@geoffk.org> wrote:
"Nancy Cam-Winget \(ncamwing\)" <ncamwing=3D40cisco.com@dmarc.ietf= .org> writes:

> In following the new IANA rules, we have posted the draft
> https://tools.ietf.org/h= tml/draft-camwinget-tls-ts13-macciphersuites-00
> to document request for registrations of HMAC based cipher
> selections with TLS 1.3=E2=80=A6..and are soliciting feedback from the= WG on
> the draft and its path forward.

This draft needs more security analysis than is currently there, and
probably it needs to define not just a ciphersuite but an entire
profile for using TLS with this ciphersuite.=C2=A0 Some topics:

* Anything that relies on EncryptedExtensions should probably not be
used.

* The session ticket properties change in the absence of encryption.=C2=A0 = In
existing TLS 1.3, they are sent only after Finished and so are
encrypted; now they are public.=C2=A0 I am not sure if this changes the
security model but it definitely makes it easier to attack the ticket.

* A less-obvious consequence to the lack of confidentality is that a
typical implementation, an attacker can selectively block messages
knowing their contents (by breaking the connection).=C2=A0 In the weather example this might be used to manipulate average daily temperature by
blocking only higher or only lower readings.=C2=A0 In the robot example
this might be used to cause it to exceed its limits by allowing
movement commands only in one direction.

I wonder whether it's really helpful to call the result 'TLS' a= nd
not something else?

I'm agnostic w.= r.t. confidentiality of application data -- we've historically been bad= at making decision about what does / does not need to be confidential, but= hey, it's your data.

However, the EE / NST ar= guments Geoff make here seem pretty compelling to me.=C2=A0 They indicate t= o me that if a mechanism is defined where application data is not encrypted= , records that contain non-application data still need to be encrypted.=C2= =A0 That of course blows away the "code footprint" argument, and = it's not trivial to implement given how the application_data content ty= pe has been overloaded in 1.3.

ISTM that in order = to do this at all elegantly, you'd have to abandon using application_da= ta records for application data, since those have to be encrypted for the a= bove reasons), and instead either:

- Use a differe= nt record type (say plaintext_data)
- Use a different protoco= l that can be muxed with TLS (as with DTLS-SRTP)

Unfortunately the former approach would require a Standards Action.=C2= =A0 So maybe the latter is the way to go.

--Ri= chard
=C2=A0

_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls
--00000000000069e6ce0573f288d3-- From nobody Tue Aug 21 07:17:21 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 452EB130E44 for ; Tue, 21 Aug 2018 07:17:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0VFOSmGPN9TE for ; Tue, 21 Aug 2018 07:17:06 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7F366130F02 for ; Tue, 21 Aug 2018 07:17:01 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id B08C7BE56; Tue, 21 Aug 2018 15:16:59 +0100 (IST) Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3fg2Mk9phJKI; Tue, 21 Aug 2018 15:16:59 +0100 (IST) Received: from [134.226.36.93] (bilbo.dsg.cs.tcd.ie [134.226.36.93]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 7199ABE47; Tue, 21 Aug 2018 15:16:59 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1534861019; bh=kpMXE66sTdo+V6F3z8RdKtw4BypzR1eh9G1brZbGWOM=; h=From:Subject:To:Cc:References:Date:In-Reply-To:From; b=L5Gva4yoETmKIfM5s2+AQslnZkLJaxPLR7ulNFVztDu+A7BB281Uw3ZvVFGSAA4J3 TjC6SyMMQ5aeeOliMkOyC0Rq8AYQkC0vyxpg0aiIV/UHMN9wSkNoUGTb17qUE30bzj Z1oQ99r5mqM7zTCJZYBQijsqgI9SLwH5FrrfGXGY= From: Stephen Farrell To: "Blumenthal, Uri - 0553 - MITLL" Cc: "Nancy Cam-Winget (ncamwing)" , "tls@ietf.org" References: <64d23891-2f32-9bb8-1ec8-f4fad13cdfb9@cs.tcd.ie> <982363FD-A839-4175-BA53-7CA242F9ADA6@ll.mit.edu> Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= xsFNBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABzTJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPsLBgAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxM7BTQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAcLBZQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <01ec52c3-6c7c-4f0f-164d-f441d350b846@cs.tcd.ie> Date: Tue, 21 Aug 2018 15:16:57 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.9.1 MIME-Version: 1.0 In-Reply-To: <982363FD-A839-4175-BA53-7CA242F9ADA6@ll.mit.edu> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="NfB7dwXNu5VMht8c1eW43RB3Pgj5oE3Yx" Archived-At: Subject: Re: [TLS] integrity only ciphersuites X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Aug 2018 14:17:20 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --NfB7dwXNu5VMht8c1eW43RB3Pgj5oE3Yx Content-Type: multipart/mixed; boundary="wqSz0W2cCOoJebZ4jpxmx1c8UiXsUm0Mb"; protected-headers="v1" From: Stephen Farrell To: "Blumenthal, Uri - 0553 - MITLL" Cc: "Nancy Cam-Winget (ncamwing)" , "tls@ietf.org" Message-ID: <01ec52c3-6c7c-4f0f-164d-f441d350b846@cs.tcd.ie> Subject: Re: [TLS] integrity only ciphersuites References: <64d23891-2f32-9bb8-1ec8-f4fad13cdfb9@cs.tcd.ie> <982363FD-A839-4175-BA53-7CA242F9ADA6@ll.mit.edu> In-Reply-To: <982363FD-A839-4175-BA53-7CA242F9ADA6@ll.mit.edu> --wqSz0W2cCOoJebZ4jpxmx1c8UiXsUm0Mb Content-Type: multipart/mixed; boundary="------------1B1CBC7E46B5B950DAA018FC" Content-Language: en-GB This is a multi-part message in MIME format. --------------1B1CBC7E46B5B950DAA018FC Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hiya, On 21/08/18 13:10, Blumenthal, Uri - 0553 - MITLL wrote: > "Vulnerable-by-design ciphersuites"? Vulnerable to what? Accidental use, at least. If libraries implemented this it could create a need for "!NULL" additions to random configurations for example. (I do accept that vulnerable-by-design might be considered overstated, but I'm looking at his from a "part of TLS" POV and not just at the lower level cryptographic mechanism.) > Suck sites are designed to provide end-point authentication and > traffic integrity. Care to explain/show how these properties would > not hold? > > Besides, it's been explained several times that some use cases do not > require confidentiality, and in some use cases confidentiality is > forbidden. I think I and others addressed those issues. Or tried to, anyway;-) Assuming the only "forbidden" case means ham radio. And it's I think fair to say that a number of times when people have started out thinking they don't need confidentiality, it turned out later that they did. Cheers, S. >=20 > Regards, Uri >=20 > Sent from my iPhone >=20 >> On Aug 21, 2018, at 07:42, Stephen Farrell >> wrote: >>=20 >>=20 >>=20 >>> On 20/08/18 21:48, Nancy Cam-Winget (ncamwing) wrote: All, A >>> couple IoT consortiums are trying to embrace the improvements=20 >>> made to TLS 1.3 and as they define their new security constructs=20 >>> would like to adopt the latest protocols, in this case TLS 1.3. >>> To that extent, they have a strong need for mutual >>> authentication, but integrity only (no confidentiality) >>> requirements. >>>=20 >>> In following the new IANA rules, we have posted the draft=20 >>> https://tools.ietf.org/html/draft-camwinget-tls-ts13-macciphersuites-= 00 >>> >>>=20 to document request for registrations of HMAC based cipher selections >>> with TLS 1.3=E2=80=A6..and are soliciting feedback from the WG on the= >>> draft and its path forward. >>=20 >> As ekr pointed out, with the new registration rules, there's >> nothing to stop someone defining any old set of crypto stuff and >> getting non-recommended codepoints. >>=20 >> That said, I don't consider that defining such vulnerable-by-design >> ciphersuites is a good plan. >>=20 >> - It imposes costs on the non-niche users of TLS - once these >> things are defined then developers and those who deploy/configure >> applications using TLS need to check that they're not using these >> undesirable ciphersuites, so costs are being displaced from niche >> uses to the vast majority of implementations and deployments, >> which seems to me to be a bad idea. And we know that people will >> sometimes get those checks wrong leading to unexpected transmission >> of plaintext over the Internet. >>=20 >> - Similarly, just defining such ciphersuites seems likely to lead >> to less well tested and infrequently used code paths, which is >> undesirable. (Assuming someone pays some developer to add these to >> some library, which generally does seem to happen.) >>=20 >> - RFC7525 [1] is clear on this topic (after debate in the UTA WG) - >> "Implementations MUST NOT negotiate the cipher suites with NULL >> encryption" and I see nothing new to convince me that that ought >> change for TLS1.3. >>=20 >> - Code footprint arguments aren't that convincing to me - to get >> interop for the few devices where AES being present or absent could >> make a real difference, you'd need an awful lot more profiling of >> TLS or DTLS. I don't see evidence of that so the interop/footprint >> arguments seem pretty weak. I'd also bet that any useful "tiny=20 >> footprint" profile of that kind would end up targeting loads of >> use-cases where confidentiality is absolutely required. >>=20 >> - (In addition to the good points made by Geoffrey Keating [2]) >> cleartext payloads would also assist in device fingerprinting, >> making it easier to exploit vulnerabilities at scale. >>=20 >> - IIUC there is also a desire to encrypt firmware updates so that >> patches can be distributed more quickly than attackers can >> reverse-engineer attacks. [4] I'm not entirely sure if that's >> really likely to happen, but if it were, then devices would need to >> be able to use recommended ciphersuites in any case. >>=20 >> - TLS/AX.25 doesn't seem that good a plan in any case - according >> to [3], which seems reasonable to me, using clear-signed GPG is >> quicker and better meets the oddball regulations. Attempting to >> deal with those regulations by weakening TLS seems like a very bad >> plan, as you'd fail in any case to achieve interop with normal TLS >> applications like the web. (And the advertising is as illegal as >> the crypto apparently, though I do like that aspect:-) >>=20 >> - WRT unix sockets, I'm not clear that there's a sufficiently >> important performance improvement in real deployments to justify >> introducing weakened ciphersuites - presumably mail servers are >> going to use standard TLS libraries that (I hope!) won't be=20 >> offering NULL encryption, so I'd be surprised if the right >> engineering decision was to prioritise CPU to that extent, given >> the risks associated with having weak ciphersuites present in >> widely used implementations. IOW, it seems more sensible to me for >> mail servers to just stick to using RECOMMENDED ciphersuites. And >> given that you could use SASL with Postfix/LMTP [5] I'm not sure >> why you'd want a weirdo-version of TLS1.3 anyway but maybe there's=20 >> some reason I don't get. >>=20 >> - I think this WG has had to spend waaaay too much time dealing >> with the "inspection of data" debate in various forms, but we did >> get an answer (no consensus) in the end for that. Niche use cases >> seem extremely unlikely to me to justify revisiting that painful=20 >> topic. >>=20 >> So all in all, I just don't see a need for these weak-by-design >> ciphersuites to even be defined. I'd encourage folks who think >> they're needed to instead think about how using RECOMMENDED >> ciphersuites might make their implementations more widely >> applicable and safer. Seems like a much more productive approach >> to me anyway. >>=20 >> Regards, S. >>=20 >> [1] https://tools.ietf.org/html/rfc7525 [2] >> https://mailarchive.ietf.org/arch/msg/tls/uI8xVgp7gTuJgwUyY-UgZfmUkRo >> >>=20 [3] https://tools.ietf.org/html/draft-ietf-suit-architecture-01#section-3= =2E3 >> [4] >> https://www.tapr.org/pdf/DCC2010-AX.25-AuthenticationEffects-KE5LKY.pd= f >> >>=20 [5] http://www.postfix.org/SASL_README.html#client_sasl >>=20 >>=20 >> <0x5AB2FAF17B172BEA.asc>=20 >> _______________________________________________ TLS mailing list=20 >> TLS@ietf.org https://www.ietf.org/mailman/listinfo/tls --------------1B1CBC7E46B5B950DAA018FC Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1bQyU3RlcGhlbiBGYXJy ZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxsQGNzLnRjZC5pZT6JAkAEEwEIACoC GwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AFAlo+o3cCGQEACgkQWrL6 8XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeOM3P7SW3C3UQYdCgZ/TlvxGgKow5o DSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP2ZK24tw5k6duTh4+sFwUualTMlcp 0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s/69L/fvHmdSKet5LIUAxoYaZkTCr uFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBjMw1xV+p0uCwNbN6XDzcToK7wsm+t AIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k4S+sN2CnYk4tTW7jHjsWarV3FLIS COObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSlAblGjwZe4EIkCXAJUtzJhoFUuGaF /PlWjxqV3UFRcgTERZTijguVyREre8GNERNgvDxZvuXssEjvz9X5JfcIZDIJpdzh LiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/rwWcpGr/MfVPTOik4H7F8rcVJelce ZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o4uBZCQ0GzvsmFA4XLqn2pA5rVizM XnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKAxo/tuHYtk19XCi83QzFhWls5TT+X QeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd8MxYNAbNYgSPtkbhZ8SJARwEEAEI AAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6NXEGtw/r1miKNGcopzvzILQ9oB8r KI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYcJf+RyiH1nMoqUIZiZJaf3bJXinDZ 5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbYtWgsYtRqHLD4IWi37MZrVyjBuF7u 14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1WQOAfD1kfBpW9PvAva5Iw9FWeXpC XRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7EDuTBb/8um1wK7Y9bgeIQC+CYjhYB 5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlve2Q6UTrmHxP5U22DlokCPQQTAQgA JwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrx excr6tJpD/4rrILH+meP07vrx8wW5eYuqCiPGYnh/CXxIF8eLrfbe5d4QRgtq+w6 UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dTMrEGn8QWKx2iNuz9rZMXyOSWFetu O01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9gQ7edR9mfLTdvBf2FR522hg8BRBM 1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZXripS0uFA07dM46Oi/E8osjx6fQt/ lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGFL64/VCQb1YGjf0Z5MBPnWm9jgUoO Y5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2DFeo9+S9f2V53Llz1WIspXJg6f+n9 lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCbhrC3+yobyy/AUOs5Z3E+njjX1FF/ VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10MSU8GEZu9ayU4M3o3N9yxOjaoP0Nu Q4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXtGKvJtFAEppGEYezB+bLKIm6XlpPk hnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA5rEP4lL16BmijmF+CHoPE/zwgKZb KpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ksZgUUnNyvfQr2p7jrQuU3RlcGhl biBGYXJyZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgA JwUCWj1RWgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrx excr6jscEADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvn crAFClVI6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtg rlstjk7hqVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIg pMw0bA1yBU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5c F8R4OvB1n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaP y1/fEgIqhCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5 b1AEzZKw2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7 b9Ocu+nYm2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkpo rMQCTh3T5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXR dS/oDKrBLUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGl Ru78ba0HArxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgA BgUCWj1SoAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89Sq Bd++uG06TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VO dL8zJWJs0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD 4t0VHpWkmfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lz nNiH41x9M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8I WOMqN2woDjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBuQINBFo9UDIB EAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuBHmpvceBRZgRasdbaMc4H Jee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD8U4xxjvR5Mi7+ToQQUOU NuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5MsK1SKfs51pLa5ToC1rc8 tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE4bGjXdJW5pKphFB2lX3d G4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7PbTuW/eITbMbI1eV3+fyym 9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3vDUew1h5QU1yDaWT3NAp vi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcmoazpiKZt91CrFPOaoXDP ck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r+oA/wxWb5jELElAhOpny qMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22fQ0D38zud+CKH3bMP3ayX XJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7Ffa4UbkwlD+dh8GiIAtv T51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1gwARAQABiQIlBBgBCAAP BQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF6TeR83xD6MasqXyrBjwc LmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfdn3BmvqGyh8+ouHX9jMOx iRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx252HKTFdeOrszoOjWjEzwm h+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjNJIXXM+lHqCDrjDaDhNcz mq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjwrIdfQM86H1z5J31lfhqo p+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGsokRina9947fRWxXHh3O6 6ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqYo3pcN2OE0C1chqgDZQxk r+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQkd0YjcqlB1E0svODHTzcS oRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmUyXBIeq6I5z8xBcd+BQ/n /9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhkvMvem9XXh1yyhqN14gfj mLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3YFMVUUfgyudqAV1wWdZi nUk+H3pkqOKoHAy/8fST =3DTOQn -----END PGP PUBLIC KEY BLOCK----- --------------1B1CBC7E46B5B950DAA018FC-- --wqSz0W2cCOoJebZ4jpxmx1c8UiXsUm0Mb-- --NfB7dwXNu5VMht8c1eW43RB3Pgj5oE3Yx Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAlt8HtkACgkQWrL68XsX K+pNng//bfmJur6ybOLYsNiTvXwg+/zxRXFH4ZR8yRMmnWInnfI4FG93+9y9ufnI h1+/22YHwx88fITgcMGeGM2AC0ocCf97F72K8dLQGs6psyL8JWCJNt7QHbvwdSkl cO/YAPUxGnRBTY06e/Ee70KNmQTzw8wA++FFEFygTLNOiGPDY3QxoQJefEJOb7mh M0CwCm4wWk2DO2Gkv9qCl3pXMHUq8dQ397YMQbOpD0c1fXMvMt5hmgmEJdAzx1YB 6RKDkRsHogkHobIKXB6/YA9XzHz1prwdRwjgqNC0uCLhpgErik6av+8rkfAmD3au T0dZKFxEBMeNJlmzkIuOfHsowoBh28fsGkzTt6/F1rbWrys2F2hDqlMEt8OemUiS 7qyRhF8AGTvkwpIqPECxgmnMops98Z/QbiQB34tFmAjdAtCzwNINe2GGko7+N2HO H1xImTEGAQ3cBkeZnvlkBE1fw6FM/nHLo/2oq+o7hjNof0gOIicz+9bTwauI5mFI nb0XG0Rc0X8Osn0rGsp/SXsyF7WMNgkPk//9Dzw/UXcrwRenSE3QPvUsrAyI+iT8 xoTXZl3MGyD/NQKNbbuWK4yKqkTaGD8uyzynVf0qWvQdgl0ekUcVDZbl5lbfUK+h grfLtEvTFc4h0qV2rYoFE75gIApcDRmD7TGbnNA9J44lnYkCtLQ= =2KPz -----END PGP SIGNATURE----- --NfB7dwXNu5VMht8c1eW43RB3Pgj5oE3Yx-- From nobody Tue Aug 21 07:24:35 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 18844130EF5 for ; Tue, 21 Aug 2018 07:24:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.197 X-Spam-Level: X-Spam-Status: No, score=-4.197 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, UNPARSEABLE_RELAY=0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sAZcCJLJuvk0 for ; Tue, 21 Aug 2018 07:24:30 -0700 (PDT) Received: from llmx3.ll.mit.edu (LLMX3.LL.MIT.EDU [129.55.12.49]) by ietfa.amsl.com (Postfix) with ESMTP id 5782E130E44 for ; Tue, 21 Aug 2018 07:24:30 -0700 (PDT) Received: from LLE2K16-MBX02.mitll.ad.local (LLE2K16-MBX02.mitll.ad.local) by llmx3.ll.mit.edu (unknown) with ESMTP id w7LEOLDv000804; Tue, 21 Aug 2018 10:24:22 -0400 From: "Blumenthal, Uri - 0553 - MITLL" Message-ID: <380B647B-6ACC-4C7A-A667-999FD69092FE@ll.mit.edu> Content-Type: multipart/signed; boundary="Apple-Mail=_76643C66-D031-45E5-A4A7-721C5DD35B7D"; protocol="application/pgp-signature"; micalg=pgp-sha256 MIME-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) Date: Tue, 21 Aug 2018 10:24:12 -0400 In-Reply-To: <01ec52c3-6c7c-4f0f-164d-f441d350b846@cs.tcd.ie> CC: "Nancy Cam-Winget (ncamwing)" , "tls@ietf.org" To: Stephen Farrell References: <64d23891-2f32-9bb8-1ec8-f4fad13cdfb9@cs.tcd.ie> <982363FD-A839-4175-BA53-7CA242F9ADA6@ll.mit.edu> <01ec52c3-6c7c-4f0f-164d-f441d350b846@cs.tcd.ie> X-Mailer: Apple Mail (2.3445.9.1) X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2018-08-21_08:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 mlxscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1807170000 definitions=main-1808210151 Archived-At: Subject: Re: [TLS] integrity only ciphersuites X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Aug 2018 14:24:33 -0000 --Apple-Mail=_76643C66-D031-45E5-A4A7-721C5DD35B7D Content-Type: multipart/alternative; boundary="Apple-Mail=_1FA492AD-EDFE-4A64-A717-D9FC5AD2E4D8" --Apple-Mail=_1FA492AD-EDFE-4A64-A717-D9FC5AD2E4D8 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 On Aug 21, 2018, at 10:16, Stephen Farrell = wrote: =E2=80=94 Regards, Uri Blumenthal Voice: (781) 981-1638 Secure Resilient Systems and Technologies Fax: (781) 981-7537 MIT Lincoln Laboratory 244 Wood Street, Lexington, MA 02421-9185 Web: = http://www.ll.mit.edu/mission/cybersec/cybersec-bios/blumenthal-bio.html > On 21/08/18 13:10, Blumenthal, Uri - 0553 - MITLL wrote: >> "Vulnerable-by-design ciphersuites"? Vulnerable to what? >=20 > Accidental use, at least. If libraries implemented this > it could create a need for "!NULL" additions to random > configurations for example. >=20 > (I do accept that vulnerable-by-design might be considered > overstated, but I'm looking at his from a "part of TLS" POV > and not just at the lower level cryptographic mechanism.) I disagree, but I see your point. >> Suck sites are designed to provide end-point authentication and >> traffic integrity. Care to explain/show how these properties would >> not hold? >>=20 >> Besides, it's been explained several times that some use cases do not >> require confidentiality, and in some use cases confidentiality is >> forbidden. >=20 > I think I and others addressed those issues. Or tried to, > anyway;-) =E2=80=9CTried=E2=80=9D is the right term in this context. ;-) > Assuming the only "forbidden" case means ham > radio. Incorrect. But probably the most respectable case. ;-) > And it's I think fair to say that a number of times > when people have started out thinking they don't need > confidentiality, it turned out later that they did. I strongly disagree here. It=E2=80=99s been shown that confidentiality without integrity tends to = get broken. It has never been shown that integrity without = confidentiality has any issues. >>> On Aug 21, 2018, at 07:42, Stephen Farrell >>> wrote: >>>=20 >>>=20 >>>=20 >>>> On 20/08/18 21:48, Nancy Cam-Winget (ncamwing) wrote: All, A >>>> couple IoT consortiums are trying to embrace the improvements >>>> made to TLS 1.3 and as they define their new security constructs >>>> would like to adopt the latest protocols, in this case TLS 1.3. >>>> To that extent, they have a strong need for mutual >>>> authentication, but integrity only (no confidentiality) >>>> requirements. >>>>=20 >>>> In following the new IANA rules, we have posted the draft >>>> = https://tools.ietf.org/html/draft-camwinget-tls-ts13-macciphersuites-00 >>>>=20 >>>>=20 > to document request for registrations of HMAC based cipher selections >>>> with TLS 1.3=E2=80=A6..and are soliciting feedback from the WG on = the >>>> draft and its path forward. >>>=20 >>> As ekr pointed out, with the new registration rules, there's >>> nothing to stop someone defining any old set of crypto stuff and >>> getting non-recommended codepoints. >>>=20 >>> That said, I don't consider that defining such vulnerable-by-design >>> ciphersuites is a good plan. >>>=20 >>> - It imposes costs on the non-niche users of TLS - once these >>> things are defined then developers and those who deploy/configure >>> applications using TLS need to check that they're not using these >>> undesirable ciphersuites, so costs are being displaced from niche >>> uses to the vast majority of implementations and deployments, >>> which seems to me to be a bad idea. And we know that people will >>> sometimes get those checks wrong leading to unexpected transmission >>> of plaintext over the Internet. >>>=20 >>> - Similarly, just defining such ciphersuites seems likely to lead >>> to less well tested and infrequently used code paths, which is >>> undesirable. (Assuming someone pays some developer to add these to >>> some library, which generally does seem to happen.) >>>=20 >>> - RFC7525 [1] is clear on this topic (after debate in the UTA WG) - >>> "Implementations MUST NOT negotiate the cipher suites with NULL >>> encryption" and I see nothing new to convince me that that ought >>> change for TLS1.3. >>>=20 >>> - Code footprint arguments aren't that convincing to me - to get >>> interop for the few devices where AES being present or absent could >>> make a real difference, you'd need an awful lot more profiling of >>> TLS or DTLS. I don't see evidence of that so the interop/footprint >>> arguments seem pretty weak. I'd also bet that any useful "tiny >>> footprint" profile of that kind would end up targeting loads of >>> use-cases where confidentiality is absolutely required. >>>=20 >>> - (In addition to the good points made by Geoffrey Keating [2]) >>> cleartext payloads would also assist in device fingerprinting, >>> making it easier to exploit vulnerabilities at scale. >>>=20 >>> - IIUC there is also a desire to encrypt firmware updates so that >>> patches can be distributed more quickly than attackers can >>> reverse-engineer attacks. [4] I'm not entirely sure if that's >>> really likely to happen, but if it were, then devices would need to >>> be able to use recommended ciphersuites in any case. >>>=20 >>> - TLS/AX.25 doesn't seem that good a plan in any case - according >>> to [3], which seems reasonable to me, using clear-signed GPG is >>> quicker and better meets the oddball regulations. Attempting to >>> deal with those regulations by weakening TLS seems like a very bad >>> plan, as you'd fail in any case to achieve interop with normal TLS >>> applications like the web. (And the advertising is as illegal as >>> the crypto apparently, though I do like that aspect:-) >>>=20 >>> - WRT unix sockets, I'm not clear that there's a sufficiently >>> important performance improvement in real deployments to justify >>> introducing weakened ciphersuites - presumably mail servers are >>> going to use standard TLS libraries that (I hope!) won't be >>> offering NULL encryption, so I'd be surprised if the right >>> engineering decision was to prioritise CPU to that extent, given >>> the risks associated with having weak ciphersuites present in >>> widely used implementations. IOW, it seems more sensible to me for >>> mail servers to just stick to using RECOMMENDED ciphersuites. And >>> given that you could use SASL with Postfix/LMTP [5] I'm not sure >>> why you'd want a weirdo-version of TLS1.3 anyway but maybe there's >>> some reason I don't get. >>>=20 >>> - I think this WG has had to spend waaaay too much time dealing >>> with the "inspection of data" debate in various forms, but we did >>> get an answer (no consensus) in the end for that. Niche use cases >>> seem extremely unlikely to me to justify revisiting that painful >>> topic. >>>=20 >>> So all in all, I just don't see a need for these weak-by-design >>> ciphersuites to even be defined. I'd encourage folks who think >>> they're needed to instead think about how using RECOMMENDED >>> ciphersuites might make their implementations more widely >>> applicable and safer. Seems like a much more productive approach >>> to me anyway. >>>=20 >>> Regards, S. >>>=20 >>> [1] https://tools.ietf.org/html/rfc7525 [2] >>> = https://mailarchive.ietf.org/arch/msg/tls/uI8xVgp7gTuJgwUyY-UgZfmUkRo >>>=20 >>>=20 > [3] = https://tools.ietf.org/html/draft-ietf-suit-architecture-01#section-3.3 >>> [4] >>> = https://www.tapr.org/pdf/DCC2010-AX.25-AuthenticationEffects-KE5LKY.pdf >>>=20 >>>=20 > [5] http://www.postfix.org/SASL_README.html#client_sasl >>>=20 >>>=20 >>> <0x5AB2FAF17B172BEA.asc> >>> _______________________________________________ TLS mailing list >>> TLS@ietf.org https://www.ietf.org/mailman/listinfo/tls >=20 >=20 > <0x5AB2FAF17B172BEA.asc> --Apple-Mail=_1FA492AD-EDFE-4A64-A717-D9FC5AD2E4D8 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 On = Aug 21, 2018, at 10:16, Stephen Farrell <stephen.farrell@cs.tcd.ie> wrote:
=E2=80=94
Regards,
Uri = Blumenthal                  =             Voice: (781) = 981-1638 
Secure Resilient Systems =  and Technologies  Fax:   (781) 981-7537
MIT Lincoln Laboratory
244 Wood Street, = Lexington, MA  02421-9185      
 
Web:  http://www.ll.mit.edu/mission/cybersec/cybersec-bios/blumenthal= -bio.html

On 21/08/18 = 13:10, Blumenthal, Uri - 0553 - MITLL wrote:
"Vulnerable-by-design ciphersuites"? Vulnerable to what?

Accidental use, at least. If libraries implemented = this
it could = create a need for "!NULL" additions to random
configurations for = example.

(I do accept = that vulnerable-by-design might be considered
overstated, but I'm looking at = his from a "part of TLS" POV
and not just at the lower level cryptographic = mechanism.)

I = disagree, but I see your point.

Suck sites are designed to provide = end-point authentication and
traffic integrity. Care to = explain/show how these properties would
not hold?

Besides, it's been explained several times = that some use cases do not
require confidentiality, and in = some use cases confidentiality is
forbidden.

I think I and others addressed those issues. Or tried = to,
anyway;-) =

=E2=80=9CTried=E2= =80=9D is the right term in this context. ;-)

Assuming the only "forbidden" = case means ham
radio.

Incorrect. But probably the most respectable case. = ;-)

And it's I = think fair to say that a number of times
when people have started out thinking they don't = need
confidentiality, it turned out later that they did.

I strongly = disagree here.

It=E2=80=99s been = shown that confidentiality without integrity tends to get broken. It has = never been shown that integrity without confidentiality has any = issues.




On Aug 21, 2018, at = 07:42, Stephen Farrell
<stephen.farrell@cs.tcd.ie> wrote:



On 20/08/18 21:48, Nancy Cam-Winget (ncamwing) wrote: All, = A
couple IoT consortiums are trying to embrace the = improvements 
made to TLS 1.3 and as they define their new security = constructs 
would like to adopt the latest protocols, in this case TLS = 1.3.
To that extent, they have a strong need for mutual
authentication, but integrity only (no confidentiality)
requirements.

In following the = new IANA rules, we have posted the draft 
https://tools.ietf.org/html/draft-camwinget-tls-ts13-macciphers= uites-00


to document request for = registrations of HMAC based cipher selections
with TLS 1.3=E2=80=A6..and are soliciting feedback from the = WG on the
draft and its path forward.

As ekr pointed out, with the new = registration rules, there's
nothing to stop someone = defining any old set of crypto stuff and
getting = non-recommended codepoints.

That said, I = don't consider that defining such vulnerable-by-design
ciphersuites is a good plan.

- = It imposes costs on the non-niche users of TLS - once these
things are defined then developers and those who = deploy/configure
applications using TLS need to check that = they're not using these
undesirable ciphersuites, so costs = are being displaced from niche
uses to the vast majority = of implementations and deployments,
which seems to me to = be a bad idea. And we know that people will
sometimes get = those checks wrong leading to unexpected transmission
of = plaintext over the Internet.

- Similarly, = just defining such ciphersuites seems likely to lead
to = less well tested and infrequently used code paths, which is
undesirable. (Assuming someone pays some developer to add = these to
some library, which generally does seem to = happen.)

- RFC7525 [1] is clear on this = topic (after debate in the UTA WG) -
"Implementations MUST = NOT negotiate the cipher suites with NULL
encryption" and = I see nothing new to convince me that that ought
change = for TLS1.3.

- Code footprint arguments = aren't that convincing to me - to get
interop for the few = devices where AES being present or absent could
make a = real difference, you'd need an awful lot more profiling of
TLS or DTLS. I don't see evidence of that so the = interop/footprint
arguments seem pretty weak. I'd also bet = that any useful "tiny 
footprint" = profile of that kind would end up targeting loads of
use-cases where confidentiality is absolutely required.

- (In addition to the good points made by = Geoffrey Keating [2])
cleartext payloads would also assist = in device fingerprinting,
making it easier to exploit = vulnerabilities at scale.

- IIUC there is = also a desire to encrypt firmware updates so that
patches = can be distributed more quickly than attackers can
reverse-engineer attacks. [4] I'm not entirely sure if = that's
really likely to happen, but if it were, then = devices would need to
be able to use recommended = ciphersuites in any case.

- TLS/AX.25 = doesn't seem that good a plan in any case - according
to = [3], which seems reasonable to me, using clear-signed GPG is
quicker and better meets the oddball regulations. Attempting = to
deal with those regulations by weakening TLS seems like = a very bad
plan, as you'd fail in any case to achieve = interop with normal TLS
applications like the web. (And = the advertising is as illegal as
the crypto apparently, = though I do like that aspect:-)

- WRT unix = sockets, I'm not clear that there's a sufficiently
important= performance improvement in real deployments to justify
introducing weakened ciphersuites - presumably mail servers = are
going to use standard TLS libraries that (I hope!) = won't be 
offering NULL encryption, so I'd be surprised if the right
engineering decision was to prioritise CPU to that extent, = given
the risks associated with having weak ciphersuites = present in
widely used implementations. IOW, it seems more = sensible to me for
mail servers to just stick to using = RECOMMENDED ciphersuites. And
given that you could use = SASL with Postfix/LMTP [5] I'm not sure
why you'd want a = weirdo-version of TLS1.3 anyway but maybe there's 
some reason = I don't get.

- I think this WG has had to = spend waaaay too much time dealing
with the "inspection of = data" debate in various forms, but we did
get an answer = (no consensus) in the end for that. Niche use cases
seem = extremely unlikely to me to justify revisiting that painful 
topic.

So all in all, I just don't see a need for = these weak-by-design
ciphersuites to even be defined. I'd = encourage folks who think
they're needed to instead think = about how using RECOMMENDED
ciphersuites might make their = implementations more widely
applicable and safer. Seems = like a much more productive approach
to me anyway.

Regards, S.

[1] = https://tools.ietf.org/html/rfc7525 [2]
https://mailarchive.ietf.org/arch/msg/tls/uI8xVgp7gTuJgwUyY-UgZ= fmUkRo


[3] https://tools.ietf.org/html/draft-ietf-suit-architecture-01#sec= tion-3.3
[4]
https://www.tapr.org/pdf/DCC2010-AX.25-AuthenticationEffects-KE= 5LKY.pdf


[5] http://www.postfix.org/SASL_README.html#client_sasl<= br style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; = font-size: 12px; font-style: normal; font-variant-caps: normal; = font-weight: normal; letter-spacing: normal; text-align: start; = text-indent: 0px; text-transform: none; white-space: normal; = word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: = none;" class=3D"">


<0x5AB2FAF17B172BEA.asc> 
_______________________________________________ TLS mailing = list 
TLS@ietf.org https://www.ietf.org/mailman/listinfo/tls


<0x5AB2FAF17B172BEA.asc= >

= --Apple-Mail=_1FA492AD-EDFE-4A64-A717-D9FC5AD2E4D8-- --Apple-Mail=_76643C66-D031-45E5-A4A7-721C5DD35B7D Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename="signature.asc" Content-Type: application/pgp-signature; name="signature.asc" Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEECz2OQrQb3CCpZwLbAAlTfKUme0MFAlt8IIwACgkQAAlTfKUm e0OBSggAlvZt/U4v91fWS+HLSzUZgTN6LRMh8k9iVFWfUhsXI922QHukdqfDhFQt VzgJZ3udVRIQ5dwxP1A0Aku2Q1/92d1f4XvVBOfI+zbBtOorY8L3pPEVuAVIie5A yyy8GLb4j3N0jucG4qNFCC8fGsckAihaeyATAVsYsjSa+EGCVIa80bsO3Jk9EkOp Ebd2QljUvK/HXnXxtS3twVnZtPZNsQNIfNPxisb2EPn0v98yK3izhmAsNiYtc+w8 uNNrtcPfVcM+6dSREXqO11nmO5IWlmanfwq5yeYd9U5ZMhK3hrTKehR8PvMORw9o 7tiVdXIFiJgPP/BMHQzRDXMO9fs6hQ== =koj3 -----END PGP SIGNATURE----- --Apple-Mail=_76643C66-D031-45E5-A4A7-721C5DD35B7D-- From nobody Tue Aug 21 07:25:05 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B8C49130F27 for ; Tue, 21 Aug 2018 07:24:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.301 X-Spam-Level: X-Spam-Status: No, score=-4.301 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id prlTDS0PQ1uv for ; Tue, 21 Aug 2018 07:24:48 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1DCA9130F21 for ; Tue, 21 Aug 2018 07:24:47 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 4E304BE5D; Tue, 21 Aug 2018 15:24:46 +0100 (IST) Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2owwJCNhNoJw; Tue, 21 Aug 2018 15:24:46 +0100 (IST) Received: from [134.226.36.93] (bilbo.dsg.cs.tcd.ie [134.226.36.93]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 1270BBE5C; Tue, 21 Aug 2018 15:24:46 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1534861486; bh=VLQS3mbdBHDIRZRMlpRX6DNxX4Ef+4PzmAK1U/3imuA=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=b9wiSuTiQ5cvrEFe+9nby/TinBEyF2oeiLFJXvls3f7kU2aUhjxZXwMAuzQ0emvXY m161ndD3e07ZNlcWaPLREJR/dgk0nS5iI4d7R+pGqtVDrSXD/FfxUooLbyhoQpdkfB n0HbT11dG3jKHtjcjhQP9bGc/ootJ7/deRSoeoK0= To: Andreas Walz , tls@ietf.org Cc: ncamwing=40cisco.com@dmarc.ietf.org References: <64d23891-2f32-9bb8-1ec8-f4fad13cdfb9@cs.tcd.ie> <982363FD-A839-4175-BA53-7CA242F9ADA6@ll.mit.edu> <2D7F2926-6376-4B2C-BDE9-7A6F1C0FA748@gmail.com> <5B7C1571020000AC0015C330@gwia2.rz.hs-offenburg.de> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= xsFNBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABzTJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPsLBgAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxM7BTQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAcLBZQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <098c762f-d672-08b3-222e-8aa7a093909d@cs.tcd.ie> Date: Tue, 21 Aug 2018 15:24:44 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.9.1 MIME-Version: 1.0 In-Reply-To: <5B7C1571020000AC0015C330@gwia2.rz.hs-offenburg.de> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="vMVtH9gaQXt21DXxk4JRfXsan1Bfpvw0D" Archived-At: Subject: Re: [TLS] integrity only ciphersuites X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Aug 2018 14:25:04 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --vMVtH9gaQXt21DXxk4JRfXsan1Bfpvw0D Content-Type: multipart/mixed; boundary="fdlBicBWJaqyLyvO2aKM1cNoGQRy1J5uP"; protected-headers="v1" From: Stephen Farrell To: Andreas Walz , tls@ietf.org Cc: ncamwing=40cisco.com@dmarc.ietf.org Message-ID: <098c762f-d672-08b3-222e-8aa7a093909d@cs.tcd.ie> Subject: Re: [TLS] integrity only ciphersuites References: <64d23891-2f32-9bb8-1ec8-f4fad13cdfb9@cs.tcd.ie> <982363FD-A839-4175-BA53-7CA242F9ADA6@ll.mit.edu> <2D7F2926-6376-4B2C-BDE9-7A6F1C0FA748@gmail.com> <5B7C1571020000AC0015C330@gwia2.rz.hs-offenburg.de> In-Reply-To: <5B7C1571020000AC0015C330@gwia2.rz.hs-offenburg.de> --fdlBicBWJaqyLyvO2aKM1cNoGQRy1J5uP Content-Type: multipart/mixed; boundary="------------A17E6B243F275C0DF917C9BB" Content-Language: en-GB This is a multi-part message in MIME format. --------------A17E6B243F275C0DF917C9BB Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 21/08/18 14:36, Andreas Walz wrote: >=20 > I strongly believe it is *not* a good idea to hold back all the valuabl= e > experience condensed in TLS and entail the design of customized securit= y > protocols for such systems. TLS is state-of-the-art and its benefits > should be accessible to as many systems as possible.=20 I agree. Quoting the meat of the abstract of RFC8446: TLS allows client/server applications to communicate over the Internet in a way that is designed to prevent eavesdropping, tampering, and message forgery. Using TLS in non-Internet contexts is just fine. Possibly weakening the "prevent eavesdropping" part is the issue here. Confidentiality is required for lots of reasons, e.g. bearer token security, or maybe even firmware updates, as pointed out earlier in this thread. Cheers, S. --------------A17E6B243F275C0DF917C9BB Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1bQyU3RlcGhlbiBGYXJy ZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxsQGNzLnRjZC5pZT6JAkAEEwEIACoC GwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AFAlo+o3cCGQEACgkQWrL6 8XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeOM3P7SW3C3UQYdCgZ/TlvxGgKow5o DSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP2ZK24tw5k6duTh4+sFwUualTMlcp 0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s/69L/fvHmdSKet5LIUAxoYaZkTCr uFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBjMw1xV+p0uCwNbN6XDzcToK7wsm+t AIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k4S+sN2CnYk4tTW7jHjsWarV3FLIS COObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSlAblGjwZe4EIkCXAJUtzJhoFUuGaF /PlWjxqV3UFRcgTERZTijguVyREre8GNERNgvDxZvuXssEjvz9X5JfcIZDIJpdzh LiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/rwWcpGr/MfVPTOik4H7F8rcVJelce ZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o4uBZCQ0GzvsmFA4XLqn2pA5rVizM XnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKAxo/tuHYtk19XCi83QzFhWls5TT+X QeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd8MxYNAbNYgSPtkbhZ8SJARwEEAEI AAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6NXEGtw/r1miKNGcopzvzILQ9oB8r KI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYcJf+RyiH1nMoqUIZiZJaf3bJXinDZ 5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbYtWgsYtRqHLD4IWi37MZrVyjBuF7u 14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1WQOAfD1kfBpW9PvAva5Iw9FWeXpC XRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7EDuTBb/8um1wK7Y9bgeIQC+CYjhYB 5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlve2Q6UTrmHxP5U22DlokCPQQTAQgA JwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrx excr6tJpD/4rrILH+meP07vrx8wW5eYuqCiPGYnh/CXxIF8eLrfbe5d4QRgtq+w6 UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dTMrEGn8QWKx2iNuz9rZMXyOSWFetu O01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9gQ7edR9mfLTdvBf2FR522hg8BRBM 1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZXripS0uFA07dM46Oi/E8osjx6fQt/ lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGFL64/VCQb1YGjf0Z5MBPnWm9jgUoO Y5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2DFeo9+S9f2V53Llz1WIspXJg6f+n9 lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCbhrC3+yobyy/AUOs5Z3E+njjX1FF/ VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10MSU8GEZu9ayU4M3o3N9yxOjaoP0Nu Q4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXtGKvJtFAEppGEYezB+bLKIm6XlpPk hnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA5rEP4lL16BmijmF+CHoPE/zwgKZb KpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ksZgUUnNyvfQr2p7jrQuU3RlcGhl biBGYXJyZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgA JwUCWj1RWgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrx excr6jscEADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvn crAFClVI6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtg rlstjk7hqVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIg pMw0bA1yBU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5c F8R4OvB1n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaP y1/fEgIqhCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5 b1AEzZKw2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7 b9Ocu+nYm2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkpo rMQCTh3T5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXR dS/oDKrBLUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGl Ru78ba0HArxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgA BgUCWj1SoAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89Sq Bd++uG06TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VO dL8zJWJs0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD 4t0VHpWkmfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lz nNiH41x9M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8I WOMqN2woDjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBuQINBFo9UDIB EAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuBHmpvceBRZgRasdbaMc4H Jee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD8U4xxjvR5Mi7+ToQQUOU NuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5MsK1SKfs51pLa5ToC1rc8 tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE4bGjXdJW5pKphFB2lX3d G4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7PbTuW/eITbMbI1eV3+fyym 9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3vDUew1h5QU1yDaWT3NAp vi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcmoazpiKZt91CrFPOaoXDP ck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r+oA/wxWb5jELElAhOpny qMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22fQ0D38zud+CKH3bMP3ayX XJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7Ffa4UbkwlD+dh8GiIAtv T51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1gwARAQABiQIlBBgBCAAP BQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF6TeR83xD6MasqXyrBjwc LmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfdn3BmvqGyh8+ouHX9jMOx iRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx252HKTFdeOrszoOjWjEzwm h+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjNJIXXM+lHqCDrjDaDhNcz mq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjwrIdfQM86H1z5J31lfhqo p+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGsokRina9947fRWxXHh3O6 6ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqYo3pcN2OE0C1chqgDZQxk r+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQkd0YjcqlB1E0svODHTzcS oRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmUyXBIeq6I5z8xBcd+BQ/n /9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhkvMvem9XXh1yyhqN14gfj mLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3YFMVUUfgyudqAV1wWdZi nUk+H3pkqOKoHAy/8fST =3DTOQn -----END PGP PUBLIC KEY BLOCK----- --------------A17E6B243F275C0DF917C9BB-- --fdlBicBWJaqyLyvO2aKM1cNoGQRy1J5uP-- --vMVtH9gaQXt21DXxk4JRfXsan1Bfpvw0D Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAlt8IKwACgkQWrL68XsX K+r76A/8CBD0qYWXY9Rvlh2o3iMzwPobtajU9wTSRiHfD28zyzq2CRA4Rd1PbYoK eikxgnd8HUWbVE0MuOAqYeo35Ik+ePoRQI4leKw9TaWpBJkKJ/nEnCgcJrHIjHQM qHPAmlS4xXuX2oFMZ6JXkhsLMoLct7eCMe7bjp2oQ8PE4u5bT6SwZ3J0ebog2aUB 5H0PriD/hOZNbi0d+g15RG3H5YIc81xmeyMNVEo5z8WrBMMD5jdJYvfPKaHbQRWQ p2K+mcwQcKEpFcQZt9GzAmi2e2Tb9qWcuoLmx1L+tg19dVIUL9eA0Y9kO+fc1nKM 2vit7qCrodjIPzZoKBOrzcErX1W7/SwM7zNju+xqABO5Zf5IJiDaCetjjqd/gpaq r6KWfU3MwIQ18ExMOrs5jyvsngRTfKc7iIGoy7f25owiiyMBudMmjE99lLIAHXKM tuOB80cinJrD5t0jhGpRaTDOKCaCBhkiDJ+y7SOPmhaGlWvUjuJUyfuOMyq4zOSo rianbZVUcKWl8z0V3BCzFuGL5L3ahoP6J/0rzzuzw79vdUEiFSrW7GMgGK60eOQ9 QWvKQeMddYeMcG1STg1B1qpetv4RxKKcFc7lk+rWwL8jZbRBf/au21mcNtKHX0vl 7L2dAMzNiHjKWzJ57B78h6u4Bfrxe5wMQP4kujA7Fpp3FwS3gVs= =NDRQ -----END PGP SIGNATURE----- --vMVtH9gaQXt21DXxk4JRfXsan1Bfpvw0D-- From nobody Tue Aug 21 07:27:33 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2874C130EF6 for ; Tue, 21 Aug 2018 07:27:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FJVunm1XyowU for ; Tue, 21 Aug 2018 07:27:27 -0700 (PDT) Received: from NAM03-CO1-obe.outbound.protection.outlook.com (mail-co1nam03on0052.outbound.protection.outlook.com [104.47.40.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A7D7F130EF5 for ; Tue, 21 Aug 2018 07:27:27 -0700 (PDT) Received: from DM5PR2201MB1433.namprd22.prod.outlook.com (10.174.186.154) by DM5PR2201MB1051.namprd22.prod.outlook.com (10.174.186.18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1059.23; Tue, 21 Aug 2018 14:27:26 +0000 Received: from DM5PR2201MB1433.namprd22.prod.outlook.com ([fe80::49f1:7875:b984:9a65]) by DM5PR2201MB1433.namprd22.prod.outlook.com ([fe80::49f1:7875:b984:9a65%2]) with mapi id 15.20.1059.023; Tue, 21 Aug 2018 14:27:26 +0000 From: Jack Visoky To: Andreas Walz , "tls@ietf.org" CC: "ncamwing=40cisco.com@dmarc.ietf.org" Thread-Topic: EXTERNAL: Re: [TLS] integrity only ciphersuites Thread-Index: AQHUOUQUkJpihrEzjkez1izxv4krA6TKHVCAgAASLoCAAAX/gIAACkPw Date: Tue, 21 Aug 2018 14:27:25 +0000 Message-ID: References: <64d23891-2f32-9bb8-1ec8-f4fad13cdfb9@cs.tcd.ie> <982363FD-A839-4175-BA53-7CA242F9ADA6@ll.mit.edu> <2D7F2926-6376-4B2C-BDE9-7A6F1C0FA748@gmail.com> <5B7C1571020000AC0015C330@gwia2.rz.hs-offenburg.de> In-Reply-To: <5B7C1571020000AC0015C330@gwia2.rz.hs-offenburg.de> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=jmvisoky@ra.rockwell.com; x-originating-ip: [205.175.250.246] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; DM5PR2201MB1051; 6:if5XigBw2tsLgROrParxI/rbShMin+CrFGmZ2AHMlOs3RPXat9kltaf0IO/9NGgE6ALjQtFgOT0wUizoPlh0lLYpWijVkgC++3MTJ3ESMv27av35hESlAf1ITZPORLZZ+stTlVqpsHSBnDfZ2+Czdmymwin2KRwh6M7vpaWHkYSOgolJqN1NxfGHwakVYW7HTutbEMUbMBp9dLpp3WUOTXiqiq6EaR0TJBm696G50d3/RwHb2MRHeVlgc+mgXWjMgW7mDomGj9zUDzc4wBLtAUcEB5grK04AJHFlM2TFIsODgewCVbMS1IOcoKpHQwzIvUpIVyEBSePt3d2RV48QH/qBPh11QB1rZfYhV1Qht7T0WVxtib6MMg+mghFD3EGY9heMlcXB2l0g8jaDL7aIa8SqVBeSlvbo0yier/FSE3UrCMnp4pPhPYb+PKHF4ZfM4I79GeaLQxvdmgMcjUHgRA==; 5:zYqsNzOfBEkS2/qIn2zQi3Ebd0RENFFJw+zodNoXXatLsXzaURPC+dX+F1ElDE8GY1CaqmYPv0EIMG2BXCfLyNlHTLNuA2xhzpg5fiB6axg5UGiCaEpf7XOiLuxcSsoGDLKnfHE2LkslyX5leiLyL8pZdjeuWKC67WAZMOwE1OA=; 7:Fp+6JPg7eMEgoWl5EIgPuW3L8yrh1XpNDHMDsC8wcIsiklFNH4x1yGUwsrVSv+Zzx5jY9u7Pl+RiFDGFAYUHzEPsGYvi8P0HDwdndkLZcxX13Sn+f/qhRLqK9HIOfAMJ3ZCAAaNu8RH1rF1KmbCLIMXiuF4DkLrSfFTRkg2SI1+uyBjxfQQPT8MFyWRRm2F3TIbUTxUOuYZ4UsYaab6mx32FHpOPcCQM5LQZyxNGgcDnH86Y+eyozuIiEirEkgpr x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-correlation-id: c6626455-1803-484a-bca6-08d6077237b5 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(7020095)(4652040)(8989137)(4534165)(4627221)(201703031133081)(201702281549075)(8990107)(5600074)(711020)(4618075)(2017052603328)(7153060)(7193020); SRVR:DM5PR2201MB1051; x-ms-traffictypediagnostic: DM5PR2201MB1051: x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(28532068793085)(32856632585715)(278428928389397)(192374486261705)(85827821059158)(100405760836317)(21748063052155)(240460790083961); x-ms-exchange-senderadcheck: 1 x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(8211001083)(6040522)(2401047)(8121501046)(5005006)(10201501046)(3002001)(93006095)(93001095)(3231311)(944501410)(52105095)(6055026)(149027)(150027)(6041310)(20161123562045)(20161123558120)(20161123564045)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123560045)(201708071742011)(7699016); SRVR:DM5PR2201MB1051; BCL:0; PCL:0; RULEID:; SRVR:DM5PR2201MB1051; x-forefront-prvs: 0771670921 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(396003)(136003)(346002)(376002)(366004)(39860400002)(199004)(189003)(8936002)(7696005)(33656002)(14444005)(256004)(76176011)(5024004)(5003630100001)(68736007)(8676002)(316002)(3846002)(6116002)(790700001)(5660300001)(2501003)(93886005)(5250100002)(236005)(6436002)(6506007)(81166006)(9686003)(606006)(6306002)(81156014)(53546011)(86362001)(55016002)(54896002)(11346002)(446003)(102836004)(476003)(53936002)(99286004)(2906002)(186003)(74316002)(110136005)(26005)(7736002)(4326008)(6246003)(97736004)(478600001)(966005)(14454004)(2900100001)(66066001)(229853002)(105586002)(106356001)(25786009)(486006); DIR:OUT; SFP:1101; SCL:1; SRVR:DM5PR2201MB1051; H:DM5PR2201MB1433.namprd22.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: ra.rockwell.com does not designate permitted sender hosts) x-microsoft-antispam-message-info: yK8SDj0dS5bLXocOTxxeIQ3A1p8U6nIou3aR/NXZVKidRADGJiDJfYBENbh/7hvJ0YDx2aMEuO+10pYhhleYl8Z1RwEbPB8n15dif5vp4uwFEP61OH2BZlgp6PAt7T9uS3w1d0777F3o6bKgmxQyixyxAqnGWZBOdEFkcZT0Uvvhb496SmoClCZH0gTg0kFwMvXVFSSRDdkOE9YL9jbXeS15EkXv03X2RtnZNj/Ita7V5RGerTbBECet3jei3j5vIBHLLXGlVuA2rvMfZnXvkNRkmj9ppv9XC+dJfv+cEWZ36CsuoFksgMdUUvRZMypIdF5m3zOmTZDTA/ZGhq8IZqA7N0IX2LfSDf9lobqhBDI= spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_DM5PR2201MB14335F5B8FBF5DC0B64B2AEF99310DM5PR2201MB1433_" MIME-Version: 1.0 X-OriginatorOrg: ra.rockwell.com X-MS-Exchange-CrossTenant-Network-Message-Id: c6626455-1803-484a-bca6-08d6077237b5 X-MS-Exchange-CrossTenant-originalarrivaltime: 21 Aug 2018 14:27:26.0276 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 855b093e-7340-45c7-9f0c-96150415893e X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM5PR2201MB1051 Archived-At: Subject: Re: [TLS] EXTERNAL: Re: integrity only ciphersuites X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Aug 2018 14:27:32 -0000 --_000_DM5PR2201MB14335F5B8FBF5DC0B64B2AEF99310DM5PR2201MB1433_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 KEnigJltIHJlc3BvbmRpbmcgIGEgZmV3IGRpZmZlcmVudCBwb2ludHMgbWFkZSBoZXJlKQ0KDQpJ biBnZW5lcmFsLCBhbHRob3VnaCB0aGlzIHNlZW1zIGxpa2UgYSBuaWNoZSBhcHBsaWNhdGlvbiwg dGhlcmUgYXJlIGFjdHVhbGx5IG1pbGxpb25zIG9mIEluZHVzdHJpYWwgRXRoZXJuZXQgbm9kZXMs IHdpdGggdGhlIG51bWJlcnMgdHJlbmRpbmcgdXB3YXJkLiAgQXMgbWVudGlvbmVkLCBtYW55IG9m IHRoZXNlIGFyZSByZWx5aW5nIG9uIG9sZGVyIHByb3RvY29scyBkZXNpZ25lZCB3aXRob3V0IHNl Y3VyaXR5IGluIG1pbmQuICBPdXIgaW5kdXN0cnkgaGFzIGhhZCBhIGRlYmF0ZSBhcm91bmQgdXNp bmcgVExTIHZzLiBjcmVhdGluZyBzb21ldGhpbmcgc3BlY2lmaWMuICBNYW55IG9mIHVzIHByZWZl ciB0byByZWx5IG9uIHRoZSBzZWN1cml0eSBiZW5lZml0cyBvZiBUTFMuICBUbyBhbm90aGVyIHBv aW50LCBhbHRob3VnaCBJIHdvcmsgZm9yIFJvY2t3ZWxsIEF1dG9tYXRpb24sIGhlcmUgSSBhbSB3 b3JraW5nIGluIG15IGNhcGFjaXR5IHdpdGhpbiBPRFZBLCBhIHN0YW5kYXJkcyBncm91cCBmb3Ig SW5kdXN0cmlhbCBDb21tdW5pY2F0aW9ucyB0aGF0IGhhcyBzZXZlcmFsIGxhcmdlIHZlbmRvcnMg YXMgbWVtYmVycy4gIFdlIGhhdmUgYWRvcHRlZCBUTFMgdG8gcHJvdGVjdCBvdXIgaW5kdXN0cmlh bCBFdGhlcm5ldCB0cmFmZmljLCBhbmQgb25lIG9mIHRoZSBzZWxsaW5nIHBvaW50cyBvZiBUTFMg MS4yIHdhcyB0aGUgYWJpbGl0eSB0byB1c2UgTlVMTCBlbmNyeXB0aW9uLg0KDQpOVUxMIGVuY3J5 cHRpb24gaXMgbm90IHJlYWxseSBhcyBtdWNoIGFib3V0IGNvZGUgc2l6ZSBidXQgY2FwYWJpbGl0 eSBvZiB0aGUgZGV2aWNlcy4gIFRoZSBUTFMgaGFuZHNoYWtlIG9mIGNvdXJzZSBjb250YWlucyBz b21lIOKAnGhlYXZ5d2VpZ2h04oCdIG9wZXJhdGlvbnMsIGFsdGhvdWdoIGhhbmRzaGFrZXMgYXJl IHByZXR0eSBpbmZyZXF1ZW50IGFzIHRoZXNlIGNvbm5lY3Rpb25zIGFyZSBvZnRlbiBxdWl0ZSBs b25nLWxpdmVkLiAgT25jZSB0aGUgaGFuZHNoYWtlIGlzIG92ZXIsIHRoZSBJL08gZGF0YSB0aGF0 IGlzIHRyYW5zZmVycmVkIGlzIG9mdGVuIHF1aXRlIHNlbnNpdGl2ZSB0byBsYXRlbmN5LCBhbmQg YWx0aG91Z2ggdGhlIGVuY3J5cHRpb24gb3ZlcmhlYWQgbWlnaHQgbm90IHNlZW0gbGlrZSBtdWNo IHdoZW4gdGhlIEhNQUMgaXMgY29uc2lkZXJlZCwgaXQgaXMgc3RpbGwgYSBjYXNlIHdoZXJlIGlu IG1hbnkgYXBwbGljYXRpb25zIGV2ZXJ5IGJpdCBjb3VudHMuICBSZWdhcmRpbmcgb2xkZXIgaGFy ZHdhcmUgdGhhdCBleGlzdHMgZm9yIG1hbnkgeWVhcnMsIHNvbWUgaGFyZHdhcmUgZG9lcyBoYXZl IGNyeXB0b2dyYXBoaWMgYWNjZWxlcmF0aW9uIGFsdGhvdWdoIG1heSBub3QgaGF2ZSBBRVMtR0NN LCByYXRoZXIgU0hBLTI1NiBITUFDLiAgQWx0ZXJuYXRpdmVseSwgdGhlIGhhcmR3YXJlIG1pZ2h0 IG5vdCBoYXZlIGFueSBjcnlwdG8gYWNjZWxlcmF0aW9uIGFzIGl0IHdhcyBkZXNpZ25lZCB3aXRo b3V0IFRMUyBpbiBtaW5kLiAgQXQgdGhlIHNhbWUgdGltZSB3ZeKAmWQgbGlrZSB0byBzZWN1cmUg dGhpcyB0cmFmZmljIHZpYSBhIGZpcm13YXJlIHVwZ3JhZGUuICBEZXNwaXRlIHRoaXMsIGlmIHVz aW5nIGVuY3J5cHRpb24gZHJvcHMgcGVyZm9ybWFuY2UgZW5vdWdoIHVzZXJzIHdpbGwgc2ltcGx5 IG5vdCB1c2UgaXQsIHdoaWNoIGlzIGEgbmV0IHdvcnNlIG91dGNvbWUuICBVc2VycyB3aWxsIGxp a2VseSBub3QgdXBncmFkZSBoYXJkd2FyZSBmb3IgbWFueSB5ZWFycyBkdWUgdG8gYSB2YXJpZXR5 IG9mIGluZHVzdHJ5IGZhY3RvcnMuDQoNCkthdGhsZWVu4oCZcyBjb21tZW50IGFib3V0IGRlZmlu aW5nIE5VTEwgZW5jcnlwdGlvbiBidXQgYmVpbmcgY2xlYXIgYWJvdXQgdGhlIHJpc2tzIHJlc29u YXRlcyB3aXRoIG1lLiAgSeKAmW0gY2VydGFpbmx5IG5vdCBzdWdnZXN0aW5nIHRoYXQgTlVMTCBl bmNyeXB0aW9uIGlzIG5lZWRlZCBpbiBhbGwgY2FzZXMsIGJ1dCB0aGVyZSBhcmUgdGltZXMgKGFz IGRpc2N1c3NlZCBoZXJlIGFuZCBpbiB0aGUgUkZDIGRyYWZ0KSB3aGVyZSBpdCBjb3VsZCBiZSBx dWl0ZSBiZW5lZmljaWFsLg0KDQpUaGFua3MgYW5kIEJlc3QgUmVnYXJkcywNCg0KLS1KYWNrDQoN CkZyb206IFRMUyBbbWFpbHRvOnRscy1ib3VuY2VzQGlldGYub3JnXSBPbiBCZWhhbGYgT2YgQW5k cmVhcyBXYWx6DQpTZW50OiBUdWVzZGF5LCBBdWd1c3QgMjEsIDIwMTggOTozNyBBTQ0KVG86IHRs c0BpZXRmLm9yZw0KQ2M6IG5jYW13aW5nPTQwY2lzY28uY29tQGRtYXJjLmlldGYub3JnDQpTdWJq ZWN0OiBFWFRFUk5BTDogUmU6IFtUTFNdIGludGVncml0eSBvbmx5IGNpcGhlcnN1aXRlcw0KDQoN CltVc2UgY2F1dGlvbiB3aXRoIGxpbmtzICYgYXR0YWNobWVudHNdDQoNCisxDQoNCkkgZnVsbHkg dW5kZXJzdGFuZCB0aGUgcHVyc3VpdCBvZiBtaW5pbWl6aW5nIGNvbXBsZXhpdHkgaW4gVExTLiBI b3dldmVyLCBiYW5uaW5nIGZyb20gVExTIGFsbCBwcm92aXNpb25zIHRvIHNlcnZlIG5vbi1pbnRl cm5ldCBjYXNlcyBzZWVtcyBzdWJvcHRpbWFsIHRvIG1lLg0KDQpJIHRoaW5rIHRoZXJlIGlzIGEg d2hvbGUgdW5pdmVyc2Ugb2Ygc3lzdGVtcyBhbmQgYXBwbGljYXRpb25zIHRoYXQgYXJlIGp1c3Qg YXQgdGhlIHZlcnkgYmVnaW5uaW5nIG9mIGJlaW5nIGFybWVkIHdpdGggc2VjdXJpdHkgZmVhdHVy ZXM6IHRoaW5rIG9mIGNvbW11bmljYXRpb24gc3lzdGVtcyBkcml2aW5nLCBlLmcuLCBpbmR1c3Ry aWFsIGF1dG9tYXRpb24gYW5kIGNyaXRpY2FsIGluZnJhc3RydWN0dXJlcy4gVGhlc2UgYXJlIHF1 aXRlIGRpZmZlcmVudCBmcm9tIHRoZSBpbnRlcm5ldCBhbmQgdGhlIHdlYiAoZGlmZmVyZW50IHRo cmVhdHMsIHNlY3VyaXR5IHJlcXVpcmVtZW50cywgYXJjaGl0ZWN0dXJlcywgbmV0d29ya3MsIHJl c291cmNlcywgZXRjLikuIFN0aWxsLCBJTUhPIGl0J3Mgbm90IGEgbmljaGUgYXQgYWxsOyBpdCdz IGp1c3Qgbm90IGFzIHZpc2libGUgdG8gbW9zdCBvZiB1cy4NCg0KSSBzdHJvbmdseSBiZWxpZXZl IGl0IGlzICpub3QqIGEgZ29vZCBpZGVhIHRvIGhvbGQgYmFjayBhbGwgdGhlIHZhbHVhYmxlIGV4 cGVyaWVuY2UgY29uZGVuc2VkIGluIFRMUyBhbmQgZW50YWlsIHRoZSBkZXNpZ24gb2YgY3VzdG9t aXplZCBzZWN1cml0eSBwcm90b2NvbHMgZm9yIHN1Y2ggc3lzdGVtcy4gVExTIGlzIHN0YXRlLW9m LXRoZS1hcnQgYW5kIGl0cyBiZW5lZml0cyBzaG91bGQgYmUgYWNjZXNzaWJsZSB0byBhcyBtYW55 IHN5c3RlbXMgYXMgcG9zc2libGUuDQoNCkNoZWVycywNCkFuZGkgV2Fseg0KDQoNCj4+PiBLYXRo bGVlbiBNb3JpYXJ0eSA8a2F0aGxlZW4ubW9yaWFydHkuaWV0ZkBnbWFpbC5jb208bWFpbHRvOmth dGhsZWVuLm1vcmlhcnR5LmlldGZAZ21haWwuY29tPj4gMDgvMjEvMTggMzoyMCBQTSA+Pj4NCg0K DQpTZW50IGZyb20gbXkgbW9iaWxlIGRldmljZQ0KDQo+IE9uIEF1ZyAyMSwgMjAxOCwgYXQgODox MCBBTSwgQmx1bWVudGhhbCwgVXJpIC0gMDU1MyAtIE1JVExMIDx1cmlAbGwubWl0LmVkdTxtYWls dG86dXJpQGxsLm1pdC5lZHU+PiB3cm90ZToNCj4NCj4gIlZ1bG5lcmFibGUtYnktZGVzaWduIGNp cGhlcnN1aXRlcyI/IFZ1bG5lcmFibGUgdG8gd2hhdD8NCj4NCj4gU3VjayBzaXRlcyBhcmUgZGVz aWduZWQgdG8gcHJvdmlkZSBlbmQtcG9pbnQgYXV0aGVudGljYXRpb24gYW5kIHRyYWZmaWMgaW50 ZWdyaXR5LiBDYXJlIHRvIGV4cGxhaW4vc2hvdyBob3cgdGhlc2UgcHJvcGVydGllcyB3b3VsZCBu b3QgaG9sZD8NCj4NCj4gQmVzaWRlcywgaXQncyBiZWVuIGV4cGxhaW5lZCBzZXZlcmFsIHRpbWVz IHRoYXQgc29tZSB1c2UgY2FzZXMgZG8gbm90IHJlcXVpcmUgY29uZmlkZW50aWFsaXR5LCBhbmQg aW4gc29tZSB1c2UgY2FzZXMgY29uZmlkZW50aWFsaXR5IGlzIGZvcmJpZGRlbi4NCg0KSSBhZ3Jl ZSB3aXRoIFVyaSBoZXJlLCBmbGV4aWJpbGl0eSB0byBjb3ZlciB0aGVzZSB1c2UgY2FzZXMgdG8g YWNjb21tb2RhdGUgdGhlIGFjdHVhbCBzZWN1cml0eSByZXF1aXJlbWVudHMgbWF5IHJlc3VsdCBp biB0aGVtIHVzaW5nIHNvbWV0aGluZyBpbnN0ZWFkIG9mIG5vdGhpbmcuIEl0IGNvdWxkIGJlIGRl ZmluZWQgYW5kIG5vdCBsaXN0ZWQgYXMgUmVjb21tZW5kZWQgYXMgd2VsbC4gVGhpcyBjb21lcyBk b3duIHRvIHJpc2sgbWFuYWdlbWVudCBhbmQgb3B0aW9ucywgd2hlcmUgdGhlIHJpc2sgY2FuIGJl IGNsZWFybHkgZXhwbGFpbmVkIGFuZCB0aGUgbGFjayBvZiByZWNvbW1lbmRhdGlvbiBjYW4gYWxz byBiZSBleHBsYWluZWQuDQoNCkJlc3QgcmVnYXJkcywNCkthdGhsZWVuDQoNCj4NCj4gUmVnYXJk cywNCj4gVXJpDQo+DQo+IFNlbnQgZnJvbSBteSBpUGhvbmUNCj4NCj4+IE9uIEF1ZyAyMSwgMjAx OCwgYXQgMDc6NDIsIFN0ZXBoZW4gRmFycmVsbCA8c3RlcGhlbi5mYXJyZWxsQGNzLnRjZC5pZTxt YWlsdG86c3RlcGhlbi5mYXJyZWxsQGNzLnRjZC5pZT4+IHdyb3RlOg0KPj4NCj4+DQo+Pg0KPj4+ IE9uIDIwLzA4LzE4IDIxOjQ4LCBOYW5jeSBDYW0tV2luZ2V0IChuY2Ftd2luZykgd3JvdGU6DQo+ Pj4gQWxsLCBBIGNvdXBsZSBJb1QgY29uc29ydGl1bXMgYXJlIHRyeWluZyB0byBlbWJyYWNlIHRo ZSBpbXByb3ZlbWVudHMNCj4+PiBtYWRlIHRvIFRMUyAxLjMgYW5kIGFzIHRoZXkgZGVmaW5lIHRo ZWlyIG5ldyBzZWN1cml0eSBjb25zdHJ1Y3RzDQo+Pj4gd291bGQgbGlrZSB0byBhZG9wdCB0aGUg bGF0ZXN0IHByb3RvY29scywgaW4gdGhpcyBjYXNlIFRMUyAxLjMuIFRvDQo+Pj4gdGhhdCBleHRl bnQsIHRoZXkgaGF2ZSBhIHN0cm9uZyBuZWVkIGZvciBtdXR1YWwgYXV0aGVudGljYXRpb24sIGJ1 dA0KPj4+IGludGVncml0eSBvbmx5IChubyBjb25maWRlbnRpYWxpdHkpIHJlcXVpcmVtZW50cy4N Cj4+Pg0KPj4+IEluIGZvbGxvd2luZyB0aGUgbmV3IElBTkEgcnVsZXMsIHdlIGhhdmUgcG9zdGVk IHRoZSBkcmFmdA0KPj4+IGh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1jYW13aW5n ZXQtdGxzLXRzMTMtbWFjY2lwaGVyc3VpdGVzLTAwDQo+Pj4gdG8gZG9jdW1lbnQgcmVxdWVzdCBm b3IgcmVnaXN0cmF0aW9ucyBvZiBITUFDIGJhc2VkIGNpcGhlciBzZWxlY3Rpb25zDQo+Pj4gd2l0 aCBUTFMgMS4z4oCmLi5hbmQgYXJlIHNvbGljaXRpbmcgZmVlZGJhY2sgZnJvbSB0aGUgV0cgb24g dGhlIGRyYWZ0DQo+Pj4gYW5kIGl0cyBwYXRoIGZvcndhcmQuDQo+Pg0KPj4gQXMgZWtyIHBvaW50 ZWQgb3V0LCB3aXRoIHRoZSBuZXcgcmVnaXN0cmF0aW9uIHJ1bGVzLA0KPj4gdGhlcmUncyBub3Ro aW5nIHRvIHN0b3Agc29tZW9uZSBkZWZpbmluZyBhbnkgb2xkIHNldA0KPj4gb2YgY3J5cHRvIHN0 dWZmIGFuZCBnZXR0aW5nIG5vbi1yZWNvbW1lbmRlZCBjb2RlcG9pbnRzLg0KPj4NCj4+IFRoYXQg c2FpZCwgSSBkb24ndCBjb25zaWRlciB0aGF0IGRlZmluaW5nIHN1Y2gNCj4+IHZ1bG5lcmFibGUt YnktZGVzaWduIGNpcGhlcnN1aXRlcyBpcyBhIGdvb2QgcGxhbi4NCj4+DQo+PiAtIEl0IGltcG9z ZXMgY29zdHMgb24gdGhlIG5vbi1uaWNoZSB1c2VycyBvZiBUTFMgLSBvbmNlDQo+PiB0aGVzZSB0 aGluZ3MgYXJlIGRlZmluZWQgdGhlbiBkZXZlbG9wZXJzIGFuZCB0aG9zZSB3aG8NCj4+IGRlcGxv eS9jb25maWd1cmUgYXBwbGljYXRpb25zIHVzaW5nIFRMUyBuZWVkIHRvIGNoZWNrDQo+PiB0aGF0 IHRoZXkncmUgbm90IHVzaW5nIHRoZXNlIHVuZGVzaXJhYmxlIGNpcGhlcnN1aXRlcywNCj4+IHNv IGNvc3RzIGFyZSBiZWluZyBkaXNwbGFjZWQgZnJvbSBuaWNoZSB1c2VzIHRvIHRoZQ0KPj4gdmFz dCBtYWpvcml0eSBvZiBpbXBsZW1lbnRhdGlvbnMgYW5kIGRlcGxveW1lbnRzLCB3aGljaA0KPj4g c2VlbXMgdG8gbWUgdG8gYmUgYSBiYWQgaWRlYS4gQW5kIHdlIGtub3cgdGhhdCBwZW9wbGUNCj4+ IHdpbGwgc29tZXRpbWVzIGdldCB0aG9zZSBjaGVja3Mgd3JvbmcgbGVhZGluZyB0byB1bmV4cGVj dGVkDQo+PiB0cmFuc21pc3Npb24gb2YgcGxhaW50ZXh0IG92ZXIgdGhlIEludGVybmV0Lg0KPj4N Cj4+IC0gU2ltaWxhcmx5LCBqdXN0IGRlZmluaW5nIHN1Y2ggY2lwaGVyc3VpdGVzIHNlZW1zIGxp a2VseQ0KPj4gdG8gbGVhZCB0byBsZXNzIHdlbGwgdGVzdGVkIGFuZCBpbmZyZXF1ZW50bHkgdXNl ZCBjb2RlDQo+PiBwYXRocywgd2hpY2ggaXMgdW5kZXNpcmFibGUuIChBc3N1bWluZyBzb21lb25l IHBheXMgc29tZQ0KPj4gZGV2ZWxvcGVyIHRvIGFkZCB0aGVzZSB0byBzb21lIGxpYnJhcnksIHdo aWNoIGdlbmVyYWxseQ0KPj4gZG9lcyBzZWVtIHRvIGhhcHBlbi4pDQo+Pg0KPj4gLSBSRkM3NTI1 IFsxXSBpcyBjbGVhciBvbiB0aGlzIHRvcGljIChhZnRlciBkZWJhdGUgaW4gdGhlDQo+PiBVVEEg V0cpIC0gIkltcGxlbWVudGF0aW9ucyBNVVNUIE5PVCBuZWdvdGlhdGUgdGhlIGNpcGhlcg0KPj4g c3VpdGVzIHdpdGggTlVMTCBlbmNyeXB0aW9uIiBhbmQgSSBzZWUgbm90aGluZyBuZXcgdG8NCj4+ IGNvbnZpbmNlIG1lIHRoYXQgdGhhdCBvdWdodCBjaGFuZ2UgZm9yIFRMUzEuMy4NCj4+DQo+PiAt IENvZGUgZm9vdHByaW50IGFyZ3VtZW50cyBhcmVuJ3QgdGhhdCBjb252aW5jaW5nIHRvDQo+PiBt ZSAtIHRvIGdldCBpbnRlcm9wIGZvciB0aGUgZmV3IGRldmljZXMgd2hlcmUgQUVTIGJlaW5nDQo+ PiBwcmVzZW50IG9yIGFic2VudCBjb3VsZCBtYWtlIGEgcmVhbCBkaWZmZXJlbmNlLCB5b3UnZA0K Pj4gbmVlZCBhbiBhd2Z1bCBsb3QgbW9yZSBwcm9maWxpbmcgb2YgVExTIG9yIERUTFMuIEkgZG9u J3QNCj4+IHNlZSBldmlkZW5jZSBvZiB0aGF0IHNvIHRoZSBpbnRlcm9wL2Zvb3RwcmludCBhcmd1 bWVudHMNCj4+IHNlZW0gcHJldHR5IHdlYWsuIEknZCBhbHNvIGJldCB0aGF0IGFueSB1c2VmdWwg InRpbnkNCj4+IGZvb3RwcmludCIgcHJvZmlsZSBvZiB0aGF0IGtpbmQgd291bGQgZW5kIHVwIHRh cmdldGluZw0KPj4gbG9hZHMgb2YgdXNlLWNhc2VzIHdoZXJlIGNvbmZpZGVudGlhbGl0eSBpcyBh YnNvbHV0ZWx5DQo+PiByZXF1aXJlZC4NCj4+DQo+PiAtIChJbiBhZGRpdGlvbiB0byB0aGUgZ29v ZCBwb2ludHMgbWFkZSBieSBHZW9mZnJleQ0KPj4gS2VhdGluZyBbMl0pIGNsZWFydGV4dCBwYXls b2FkcyB3b3VsZCBhbHNvIGFzc2lzdCBpbg0KPj4gZGV2aWNlIGZpbmdlcnByaW50aW5nLCBtYWtp bmcgaXQgZWFzaWVyIHRvIGV4cGxvaXQNCj4+IHZ1bG5lcmFiaWxpdGllcyBhdCBzY2FsZS4NCj4+ DQo+PiAtIElJVUMgdGhlcmUgaXMgYWxzbyBhIGRlc2lyZSB0byBlbmNyeXB0IGZpcm13YXJlDQo+ PiB1cGRhdGVzIHNvIHRoYXQgcGF0Y2hlcyBjYW4gYmUgZGlzdHJpYnV0ZWQgbW9yZSBxdWlja2x5 DQo+PiB0aGFuIGF0dGFja2VycyBjYW4gcmV2ZXJzZS1lbmdpbmVlciBhdHRhY2tzLiBbNF0gSSdt DQo+PiBub3QgZW50aXJlbHkgc3VyZSBpZiB0aGF0J3MgcmVhbGx5IGxpa2VseSB0byBoYXBwZW4s DQo+PiBidXQgaWYgaXQgd2VyZSwgdGhlbiBkZXZpY2VzIHdvdWxkIG5lZWQgdG8gYmUgYWJsZSB0 bw0KPj4gdXNlIHJlY29tbWVuZGVkIGNpcGhlcnN1aXRlcyBpbiBhbnkgY2FzZS4NCj4+DQo+PiAt IFRMUy9BWC4yNSBkb2Vzbid0IHNlZW0gdGhhdCBnb29kIGEgcGxhbiBpbiBhbnkNCj4+IGNhc2Ug LSBhY2NvcmRpbmcgdG8gWzNdLCB3aGljaCBzZWVtcyByZWFzb25hYmxlIHRvDQo+PiBtZSwgdXNp bmcgY2xlYXItc2lnbmVkIEdQRyBpcyBxdWlja2VyIGFuZCBiZXR0ZXINCj4+IG1lZXRzIHRoZSBv ZGRiYWxsIHJlZ3VsYXRpb25zLiBBdHRlbXB0aW5nIHRvIGRlYWwNCj4+IHdpdGggdGhvc2UgcmVn dWxhdGlvbnMgYnkgd2Vha2VuaW5nIFRMUyBzZWVtcyBsaWtlDQo+PiBhIHZlcnkgYmFkIHBsYW4s IGFzIHlvdSdkIGZhaWwgaW4gYW55IGNhc2UgdG8gYWNoaWV2ZQ0KPj4gaW50ZXJvcCB3aXRoIG5v cm1hbCBUTFMgYXBwbGljYXRpb25zIGxpa2UgdGhlIHdlYi4NCj4+IChBbmQgdGhlIGFkdmVydGlz aW5nIGlzIGFzIGlsbGVnYWwgYXMgdGhlIGNyeXB0bw0KPj4gYXBwYXJlbnRseSwgdGhvdWdoIEkg ZG8gbGlrZSB0aGF0IGFzcGVjdDotKQ0KPj4NCj4+IC0gV1JUIHVuaXggc29ja2V0cywgSSdtIG5v dCBjbGVhciB0aGF0IHRoZXJlJ3MgYQ0KPj4gc3VmZmljaWVudGx5IGltcG9ydGFudCBwZXJmb3Jt YW5jZSBpbXByb3ZlbWVudCBpbg0KPj4gcmVhbCBkZXBsb3ltZW50cyB0byBqdXN0aWZ5IGludHJv ZHVjaW5nIHdlYWtlbmVkDQo+PiBjaXBoZXJzdWl0ZXMgLSBwcmVzdW1hYmx5IG1haWwgc2VydmVy cyBhcmUgZ29pbmcgdG8NCj4+IHVzZSBzdGFuZGFyZCBUTFMgbGlicmFyaWVzIHRoYXQgKEkgaG9w ZSEpIHdvbid0IGJlDQo+PiBvZmZlcmluZyBOVUxMIGVuY3J5cHRpb24sIHNvIEknZCBiZSBzdXJw cmlzZWQgaWYNCj4+IHRoZSByaWdodCBlbmdpbmVlcmluZyBkZWNpc2lvbiB3YXMgdG8gcHJpb3Jp dGlzZQ0KPj4gQ1BVIHRvIHRoYXQgZXh0ZW50LCBnaXZlbiB0aGUgcmlza3MgYXNzb2NpYXRlZCB3 aXRoDQo+PiBoYXZpbmcgd2VhayBjaXBoZXJzdWl0ZXMgcHJlc2VudCBpbiB3aWRlbHkgdXNlZA0K Pj4gaW1wbGVtZW50YXRpb25zLiBJT1csIGl0IHNlZW1zIG1vcmUgc2Vuc2libGUgdG8gbWUNCj4+ IGZvciBtYWlsIHNlcnZlcnMgdG8ganVzdCBzdGljayB0byB1c2luZyBSRUNPTU1FTkRFRA0KPj4g Y2lwaGVyc3VpdGVzLiBBbmQgZ2l2ZW4gdGhhdCB5b3UgY291bGQgdXNlIFNBU0wNCj4+IHdpdGgg UG9zdGZpeC9MTVRQIFs1XSBJJ20gbm90IHN1cmUgd2h5IHlvdSdkIHdhbnQNCj4+IGEgd2VpcmRv LXZlcnNpb24gb2YgVExTMS4zIGFueXdheSBidXQgbWF5YmUgdGhlcmUncw0KPj4gc29tZSByZWFz b24gSSBkb24ndCBnZXQuDQo+Pg0KPj4gLSBJIHRoaW5rIHRoaXMgV0cgaGFzIGhhZCB0byBzcGVu ZCB3YWFhYXkgdG9vIG11Y2gNCj4+IHRpbWUgZGVhbGluZyB3aXRoIHRoZSAiaW5zcGVjdGlvbiBv ZiBkYXRhIiBkZWJhdGUgaW4NCj4+IHZhcmlvdXMgZm9ybXMsIGJ1dCB3ZSBkaWQgZ2V0IGFuIGFu c3dlciAobm8gY29uc2Vuc3VzKQ0KPj4gaW4gdGhlIGVuZCBmb3IgdGhhdC4gTmljaGUgdXNlIGNh c2VzIHNlZW0gZXh0cmVtZWx5DQo+PiB1bmxpa2VseSB0byBtZSB0byBqdXN0aWZ5IHJldmlzaXRp bmcgdGhhdCBwYWluZnVsDQo+PiB0b3BpYy4NCj4+DQo+PiBTbyBhbGwgaW4gYWxsLCBJIGp1c3Qg ZG9uJ3Qgc2VlIGEgbmVlZCBmb3IgdGhlc2UNCj4+IHdlYWstYnktZGVzaWduIGNpcGhlcnN1aXRl cyB0byBldmVuIGJlIGRlZmluZWQuIEknZA0KPj4gZW5jb3VyYWdlIGZvbGtzIHdobyB0aGluayB0 aGV5J3JlIG5lZWRlZCB0byBpbnN0ZWFkDQo+PiB0aGluayBhYm91dCBob3cgdXNpbmcgUkVDT01N RU5ERUQgY2lwaGVyc3VpdGVzIG1pZ2h0DQo+PiBtYWtlIHRoZWlyIGltcGxlbWVudGF0aW9ucyBt b3JlIHdpZGVseSBhcHBsaWNhYmxlIGFuZA0KPj4gc2FmZXIuIFNlZW1zIGxpa2UgYSBtdWNoIG1v cmUgcHJvZHVjdGl2ZSBhcHByb2FjaCB0bw0KPj4gbWUgYW55d2F5Lg0KPj4NCj4+IFJlZ2FyZHMs DQo+PiBTLg0KPj4NCj4+IFsxXSBodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvcmZjNzUyNQ0K Pj4gWzJdIGh0dHBzOi8vbWFpbGFyY2hpdmUuaWV0Zi5vcmcvYXJjaC9tc2cvdGxzL3VJOHhWZ3A3 Z1R1Smd3VXlZLVVnWmZtVWtSbw0KPj4gWzNdIGh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9k cmFmdC1pZXRmLXN1aXQtYXJjaGl0ZWN0dXJlLTAxI3NlY3Rpb24tMy4zDQo+PiBbNF0gaHR0cHM6 Ly93d3cudGFwci5vcmcvcGRmL0RDQzIwMTAtQVguMjUtQXV0aGVudGljYXRpb25FZmZlY3RzLUtF NUxLWS5wZGYNCj4+IFs1XSBodHRwOi8vd3d3LnBvc3RmaXgub3JnL1NBU0xfUkVBRE1FLmh0bWwj Y2xpZW50X3Nhc2wNCj4+DQo+Pg0KPj4gPDB4NUFCMkZBRjE3QjE3MkJFQS5hc2M+DQo+PiBfX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KPj4gVExTIG1haWxp bmcgbGlzdA0KPj4gVExTQGlldGYub3JnPG1haWx0bzpUTFNAaWV0Zi5vcmc+DQo+PiBodHRwczov L3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3Rscw0KPiBfX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KPiBUTFMgbWFpbGluZyBsaXN0DQo+IFRMU0Bp ZXRmLm9yZzxtYWlsdG86VExTQGlldGYub3JnPg0KPiBodHRwczovL3d3dy5pZXRmLm9yZy9tYWls bWFuL2xpc3RpbmZvL3Rscw0KDQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fXw0KVExTIG1haWxpbmcgbGlzdA0KVExTQGlldGYub3JnPG1haWx0bzpUTFNAaWV0 Zi5vcmc+DQpodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3Rscw0K --_000_DM5PR2201MB14335F5B8FBF5DC0B64B2AEF99310DM5PR2201MB1433_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 SGVsdmV0aWNhOw0KCXBhbm9zZS0xOjIgMTEgNiA0IDIgMiAyIDIgMiA0O30NCkBmb250LWZhY2UN Cgl7Zm9udC1mYW1pbHk6U2ltU3VuOw0KCXBhbm9zZS0xOjIgMSA2IDAgMyAxIDEgMSAxIDE7fQ0K QGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQg NSAzIDUgNCA2IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglw YW5vc2UtMToyIDE1IDUgMiAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5 OiJcQFNpbVN1biI7DQoJcGFub3NlLTE6MiAxIDYgMCAzIDEgMSAxIDEgMTt9DQovKiBTdHlsZSBE ZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0K CXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0 Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iLHNlcmlmO30NCmE6bGluaywgc3Bhbi5N c29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOiMwNTYzQzE7DQoJ dGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5r Rm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOiM5NTRGNzI7DQoJdGV4 dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCglt c28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTIuMHB0Ow0K CWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iLHNlcmlmO30NCnAubXNnYm9yZGVyLCBsaS5t c2dib3JkZXIsIGRpdi5tc2dib3JkZXINCgl7bXNvLXN0eWxlLW5hbWU6bXNnYm9yZGVyOw0KCW1z by1tYXJnaW4tdG9wLWFsdDphdXRvOw0KCW1hcmdpbi1yaWdodDowaW47DQoJbXNvLW1hcmdpbi1i b3R0b20tYWx0OmF1dG87DQoJbWFyZ2luLWxlZnQ6MGluOw0KCWJvcmRlcjpub25lOw0KCXBhZGRp bmc6MGluOw0KCWZvbnQtc2l6ZToxMi4wcHQ7DQoJZm9udC1mYW1pbHk6IlRpbWVzIE5ldyBSb21h biIsc2VyaWY7fQ0KcC5tc2dib3JkZXIxLCBsaS5tc2dib3JkZXIxLCBkaXYubXNnYm9yZGVyMQ0K CXttc28tc3R5bGUtbmFtZTptc2dib3JkZXIxOw0KCW1hcmdpbjowaW47DQoJbWFyZ2luLWJvdHRv bTouMDAwMXB0Ow0KCWJvcmRlcjpub25lOw0KCXBhZGRpbmc6MGluOw0KCWZvbnQtc2l6ZToxMi4w cHQ7DQoJZm9udC1mYW1pbHk6IlRpbWVzIE5ldyBSb21hbiIsc2VyaWY7fQ0Kc3Bhbi5ncm91cHdp c2VyZXBseWhlYWRlcg0KCXttc28tc3R5bGUtbmFtZTpncm91cHdpc2VyZXBseWhlYWRlcjt9DQpz cGFuLkVtYWlsU3R5bGUyMQ0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1yZXBseTsNCglmb250 LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjojMUY0OTdEO30NCi5Nc29DaHBE ZWZhdWx0DQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7 fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBp biAxLjBpbiAxLjBpbiAxLjBpbjt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rp b24xO30NCi0tPjwvc3R5bGU+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWRlZmF1 bHRzIHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2IiAvPg0KPC94bWw+PCFbZW5kaWZdLS0+PCEt LVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWxheW91dCB2OmV4dD0iZWRpdCI+DQo8bzpp ZG1hcCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4NCjwvbzpzaGFwZWxheW91dD48L3htbD48IVtl bmRpZl0tLT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9IkVOLVVTIiBsaW5rPSIjMDU2M0MxIiB2bGlu az0iIzk1NEY3MiI+DQo8ZGl2IGNsYXNzPSJXb3JkU2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2Fs aWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPihJ4oCZbSByZXNwb25kaW5nJm5i c3A7IGEgZmV3IGRpZmZlcmVudCBwb2ludHMgbWFkZSBoZXJlKTxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48 bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNh bnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+SW4gZ2VuZXJhbCwgYWx0aG91Z2ggdGhpcyBzZWVtcyBs aWtlIGEgbmljaGUgYXBwbGljYXRpb24sIHRoZXJlIGFyZSBhY3R1YWxseSBtaWxsaW9ucyBvZiBJ bmR1c3RyaWFsIEV0aGVybmV0IG5vZGVzLCB3aXRoIHRoZSBudW1iZXJzIHRyZW5kaW5nIHVwd2Fy ZC4mbmJzcDsgQXMgbWVudGlvbmVkLA0KIG1hbnkgb2YgdGhlc2UgYXJlIHJlbHlpbmcgb24gb2xk ZXIgcHJvdG9jb2xzIGRlc2lnbmVkIHdpdGhvdXQgc2VjdXJpdHkgaW4gbWluZC4mbmJzcDsgT3Vy IGluZHVzdHJ5IGhhcyBoYWQgYSBkZWJhdGUgYXJvdW5kIHVzaW5nIFRMUyB2cy4gY3JlYXRpbmcg c29tZXRoaW5nIHNwZWNpZmljLiZuYnNwOyBNYW55IG9mIHVzIHByZWZlciB0byByZWx5IG9uIHRo ZSBzZWN1cml0eSBiZW5lZml0cyBvZiBUTFMuJm5ic3A7IFRvIGFub3RoZXIgcG9pbnQsIGFsdGhv dWdoIEkgd29yaw0KIGZvciBSb2Nrd2VsbCBBdXRvbWF0aW9uLCBoZXJlIEkgYW0gd29ya2luZyBp biBteSBjYXBhY2l0eSB3aXRoaW4gT0RWQSwgYSBzdGFuZGFyZHMgZ3JvdXAgZm9yIEluZHVzdHJp YWwgQ29tbXVuaWNhdGlvbnMgdGhhdCBoYXMgc2V2ZXJhbCBsYXJnZSB2ZW5kb3JzIGFzIG1lbWJl cnMuJm5ic3A7IFdlIGhhdmUgYWRvcHRlZCBUTFMgdG8gcHJvdGVjdCBvdXIgaW5kdXN0cmlhbCBF dGhlcm5ldCB0cmFmZmljLCBhbmQgb25lIG9mIHRoZSBzZWxsaW5nIHBvaW50cw0KIG9mIFRMUyAx LjIgd2FzIHRoZSBhYmlsaXR5IHRvIHVzZSBOVUxMIGVuY3J5cHRpb24uPG86cD48L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5 N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5OVUxMIGVuY3J5cHRpb24gaXMgbm90IHJlYWxs eSBhcyBtdWNoIGFib3V0IGNvZGUgc2l6ZSBidXQgY2FwYWJpbGl0eSBvZiB0aGUgZGV2aWNlcy4g Jm5ic3A7VGhlIFRMUyBoYW5kc2hha2Ugb2YgY291cnNlIGNvbnRhaW5zIHNvbWUg4oCcaGVhdnl3 ZWlnaHTigJ0gb3BlcmF0aW9ucywgYWx0aG91Z2gNCiBoYW5kc2hha2VzIGFyZSBwcmV0dHkgaW5m cmVxdWVudCBhcyB0aGVzZSBjb25uZWN0aW9ucyBhcmUgb2Z0ZW4gcXVpdGUgbG9uZy1saXZlZC4m bmJzcDsgT25jZSB0aGUgaGFuZHNoYWtlIGlzIG92ZXIsIHRoZSBJL08gZGF0YSB0aGF0IGlzIHRy YW5zZmVycmVkIGlzIG9mdGVuIHF1aXRlIHNlbnNpdGl2ZSB0byBsYXRlbmN5LCBhbmQgYWx0aG91 Z2ggdGhlIGVuY3J5cHRpb24gb3ZlcmhlYWQgbWlnaHQgbm90IHNlZW0gbGlrZSBtdWNoIHdoZW4g dGhlIEhNQUMNCiBpcyBjb25zaWRlcmVkLCBpdCBpcyBzdGlsbCBhIGNhc2Ugd2hlcmUgaW4gbWFu eSBhcHBsaWNhdGlvbnMgZXZlcnkgYml0IGNvdW50cy4mbmJzcDsgUmVnYXJkaW5nIG9sZGVyIGhh cmR3YXJlIHRoYXQgZXhpc3RzIGZvciBtYW55IHllYXJzLCBzb21lIGhhcmR3YXJlIGRvZXMgaGF2 ZSBjcnlwdG9ncmFwaGljIGFjY2VsZXJhdGlvbiBhbHRob3VnaCBtYXkgbm90IGhhdmUgQUVTLUdD TSwgcmF0aGVyIFNIQS0yNTYgSE1BQy4mbmJzcDsgQWx0ZXJuYXRpdmVseSwgdGhlDQogaGFyZHdh cmUgbWlnaHQgbm90IGhhdmUgYW55IGNyeXB0byBhY2NlbGVyYXRpb24gYXMgaXQgd2FzIGRlc2ln bmVkIHdpdGhvdXQgVExTIGluIG1pbmQuJm5ic3A7IEF0IHRoZSBzYW1lIHRpbWUgd2XigJlkIGxp a2UgdG8gc2VjdXJlIHRoaXMgdHJhZmZpYyB2aWEgYSBmaXJtd2FyZSB1cGdyYWRlLiZuYnNwOyBE ZXNwaXRlIHRoaXMsIGlmIHVzaW5nIGVuY3J5cHRpb24gZHJvcHMgcGVyZm9ybWFuY2UgZW5vdWdo IHVzZXJzIHdpbGwgc2ltcGx5IG5vdCB1c2UgaXQsIHdoaWNoDQogaXMgYSBuZXQgd29yc2Ugb3V0 Y29tZS4mbmJzcDsgVXNlcnMgd2lsbCBsaWtlbHkgbm90IHVwZ3JhZGUgaGFyZHdhcmUgZm9yIG1h bnkgeWVhcnMgZHVlIHRvIGEgdmFyaWV0eSBvZiBpbmR1c3RyeSBmYWN0b3JzLjxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjoj MUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+S2F0aGxlZW7igJlzIGNvbW1lbnQgYWJv dXQgZGVmaW5pbmcgTlVMTCBlbmNyeXB0aW9uIGJ1dCBiZWluZyBjbGVhciBhYm91dCB0aGUgcmlz a3MgcmVzb25hdGVzIHdpdGggbWUuJm5ic3A7IEnigJltIGNlcnRhaW5seSBub3Qgc3VnZ2VzdGlu ZyB0aGF0IE5VTEwgZW5jcnlwdGlvbiBpcyBuZWVkZWQNCiBpbiBhbGwgY2FzZXMsIGJ1dCB0aGVy ZSBhcmUgdGltZXMgKGFzIGRpc2N1c3NlZCBoZXJlIGFuZCBpbiB0aGUgUkZDIGRyYWZ0KSB3aGVy ZSBpdCBjb3VsZCBiZSBxdWl0ZSBiZW5lZmljaWFsLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZu YnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2Vy aWY7Y29sb3I6IzFGNDk3RCI+VGhhbmtzIGFuZCBCZXN0IFJlZ2FyZHMsPG86cD48L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5 N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj4tLUphY2s8bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86 cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPGRpdj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25l O2JvcmRlci10b3A6c29saWQgI0UxRTFFMSAxLjBwdDtwYWRkaW5nOjMuMHB0IDBpbiAwaW4gMGlu Ij4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+RnJvbTo8L3NwYW4+ PC9iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGli cmkmcXVvdDssc2Fucy1zZXJpZiI+IFRMUyBbbWFpbHRvOnRscy1ib3VuY2VzQGlldGYub3JnXQ0K PGI+T24gQmVoYWxmIE9mIDwvYj5BbmRyZWFzIFdhbHo8YnI+DQo8Yj5TZW50OjwvYj4gVHVlc2Rh eSwgQXVndXN0IDIxLCAyMDE4IDk6MzcgQU08YnI+DQo8Yj5Ubzo8L2I+IHRsc0BpZXRmLm9yZzxi cj4NCjxiPkNjOjwvYj4gbmNhbXdpbmc9NDBjaXNjby5jb21AZG1hcmMuaWV0Zi5vcmc8YnI+DQo8 Yj5TdWJqZWN0OjwvYj4gRVhURVJOQUw6IFJlOiBbVExTXSBpbnRlZ3JpdHkgb25seSBjaXBoZXJz dWl0ZXM8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibXNvLWVs ZW1lbnQ6cGFyYS1ib3JkZXItZGl2O2JvcmRlcjpzb2xpZCAjQkIyMzIyIDIuMjVwdDtwYWRkaW5n OjIuMHB0IDIuMHB0IDIuMHB0IDIuMHB0O2JhY2tncm91bmQ6I0U4RThFOCI+DQo8cCBjbGFzcz0i bXNnYm9yZGVyMSIgc3R5bGU9ImxpbmUtaGVpZ2h0OjEyLjBwdDtiYWNrZ3JvdW5kOiNFOEU4RTgi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkm cXVvdDssc2Fucy1zZXJpZjtjb2xvcjpibGFjayI+W1VzZSBjYXV0aW9uIHdpdGggbGlua3MgJmFt cDsgYXR0YWNobWVudHNdPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj48bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMt c2VyaWYiPiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxkaXY+DQo8ZGl2IGlkPSJHcm91 cFdpc2VTZWN0aW9uXzE1MzQ4NTgxMzcwMDBfYW5kcmVhcy53YWx6QGhzLW9mZmVuYnVyZy5kZV9G RTdDOTE0MDBEMTkwMDAwQjdBOTJCN0EzQzg5Rjc2QV8iPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hl bHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj4mIzQzOzE8YnI+DQo8YnI+DQpJIGZ1bGx5IHVuZGVy c3RhbmQgdGhlIHB1cnN1aXQgb2YgbWluaW1pemluZyBjb21wbGV4aXR5IGluIFRMUy4gSG93ZXZl ciwgYmFubmluZyBmcm9tIFRMUyBhbGwgcHJvdmlzaW9ucyB0byBzZXJ2ZSBub24taW50ZXJuZXQg Y2FzZXMgc2VlbXMgc3Vib3B0aW1hbCB0byBtZS48YnI+DQo8YnI+DQpJIHRoaW5rIHRoZXJlIGlz IGEgd2hvbGUgdW5pdmVyc2Ugb2Ygc3lzdGVtcyBhbmQgYXBwbGljYXRpb25zIHRoYXQgYXJlIGp1 c3QgYXQgdGhlIHZlcnkgYmVnaW5uaW5nIG9mIGJlaW5nIGFybWVkIHdpdGggc2VjdXJpdHkgZmVh dHVyZXM6IHRoaW5rIG9mIGNvbW11bmljYXRpb24gc3lzdGVtcyBkcml2aW5nLCBlLmcuLCBpbmR1 c3RyaWFsIGF1dG9tYXRpb24gYW5kIGNyaXRpY2FsIGluZnJhc3RydWN0dXJlcy4gVGhlc2UgYXJl IHF1aXRlIGRpZmZlcmVudA0KIGZyb20gdGhlIGludGVybmV0IGFuZCB0aGUgd2ViIChkaWZmZXJl bnQgdGhyZWF0cywgc2VjdXJpdHkgcmVxdWlyZW1lbnRzLCBhcmNoaXRlY3R1cmVzLCBuZXR3b3Jr cywgcmVzb3VyY2VzLCBldGMuKS4gU3RpbGwsIElNSE8gaXQncyBub3QgYSBuaWNoZSBhdCBhbGw7 IGl0J3MganVzdCBub3QgYXMgdmlzaWJsZSB0byBtb3N0IG9mIHVzLjxicj4NCjxicj4NCkkgc3Ry b25nbHkgYmVsaWV2ZSBpdCBpcyAqbm90KiBhIGdvb2QgaWRlYSB0byBob2xkIGJhY2sgYWxsIHRo ZSB2YWx1YWJsZSBleHBlcmllbmNlIGNvbmRlbnNlZCBpbiBUTFMgYW5kIGVudGFpbCB0aGUgZGVz aWduIG9mIGN1c3RvbWl6ZWQgc2VjdXJpdHkgcHJvdG9jb2xzIGZvciBzdWNoIHN5c3RlbXMuIFRM UyBpcyBzdGF0ZS1vZi10aGUtYXJ0IGFuZCBpdHMgYmVuZWZpdHMgc2hvdWxkIGJlIGFjY2Vzc2li bGUgdG8gYXMgbWFueSBzeXN0ZW1zIGFzDQogcG9zc2libGUuIDxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlm Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVv dDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+Q2hlZXJzLDxicj4NCkFuZGkgV2FseiA8bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2Em cXVvdDssc2Fucy1zZXJpZiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZh bWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+PGJyPg0KPHNwYW4gY2xhc3M9 Imdyb3Vwd2lzZXJlcGx5aGVhZGVyIj4mZ3Q7Jmd0OyZndDsgS2F0aGxlZW4mbmJzcDtNb3JpYXJ0 eSZuYnNwOyZsdDs8YSBocmVmPSJtYWlsdG86a2F0aGxlZW4ubW9yaWFydHkuaWV0ZkBnbWFpbC5j b20iPmthdGhsZWVuLm1vcmlhcnR5LmlldGZAZ21haWwuY29tPC9hPiZndDsgMDgvMjEvMTggMzoy MCBQTSAmZ3Q7Jmd0OyZndDs8L3NwYW4+PGJyPg0KPGJyPg0KPGJyPg0KU2VudCBmcm9tIG15IG1v YmlsZSBkZXZpY2U8YnI+DQo8YnI+DQomZ3Q7IE9uIEF1ZyAyMSwgMjAxOCwgYXQgODoxMCBBTSwg Qmx1bWVudGhhbCwgVXJpIC0gMDU1MyAtIE1JVExMICZsdDs8YSBocmVmPSJtYWlsdG86dXJpQGxs Lm1pdC5lZHUiPnVyaUBsbC5taXQuZWR1PC9hPiZndDsgd3JvdGU6PGJyPg0KJmd0OyA8YnI+DQom Z3Q7ICZxdW90O1Z1bG5lcmFibGUtYnktZGVzaWduIGNpcGhlcnN1aXRlcyZxdW90Oz8gVnVsbmVy YWJsZSB0byB3aGF0PyA8YnI+DQomZ3Q7IDxicj4NCiZndDsgU3VjayBzaXRlcyBhcmUgZGVzaWdu ZWQgdG8gcHJvdmlkZSBlbmQtcG9pbnQgYXV0aGVudGljYXRpb24gYW5kIHRyYWZmaWMgaW50ZWdy aXR5LiBDYXJlIHRvIGV4cGxhaW4vc2hvdyBob3cgdGhlc2UgcHJvcGVydGllcyB3b3VsZCBub3Qg aG9sZD88YnI+DQomZ3Q7IDxicj4NCiZndDsgQmVzaWRlcywgaXQncyBiZWVuIGV4cGxhaW5lZCBz ZXZlcmFsIHRpbWVzIHRoYXQgc29tZSB1c2UgY2FzZXMgZG8gbm90IHJlcXVpcmUgY29uZmlkZW50 aWFsaXR5LCBhbmQgaW4gc29tZSB1c2UgY2FzZXMgY29uZmlkZW50aWFsaXR5IGlzIGZvcmJpZGRl bi48YnI+DQo8YnI+DQpJIGFncmVlIHdpdGggVXJpIGhlcmUsIGZsZXhpYmlsaXR5IHRvIGNvdmVy IHRoZXNlIHVzZSBjYXNlcyB0byBhY2NvbW1vZGF0ZSB0aGUgYWN0dWFsIHNlY3VyaXR5IHJlcXVp cmVtZW50cyBtYXkgcmVzdWx0IGluIHRoZW0gdXNpbmcgc29tZXRoaW5nIGluc3RlYWQgb2Ygbm90 aGluZy4gSXQgY291bGQgYmUgZGVmaW5lZCBhbmQgbm90IGxpc3RlZCBhcyBSZWNvbW1lbmRlZCBh cyB3ZWxsLiBUaGlzIGNvbWVzIGRvd24gdG8gcmlzayBtYW5hZ2VtZW50DQogYW5kIG9wdGlvbnMs IHdoZXJlIHRoZSByaXNrIGNhbiBiZSBjbGVhcmx5IGV4cGxhaW5lZCBhbmQgdGhlIGxhY2sgb2Yg cmVjb21tZW5kYXRpb24gY2FuIGFsc28gYmUgZXhwbGFpbmVkLjxicj4NCjxicj4NCkJlc3QgcmVn YXJkcyw8YnI+DQpLYXRobGVlbiA8YnI+DQo8YnI+DQomZ3Q7IDxicj4NCiZndDsgUmVnYXJkcyw8 YnI+DQomZ3Q7IFVyaTxicj4NCiZndDsgPGJyPg0KJmd0OyBTZW50IGZyb20gbXkgaVBob25lPGJy Pg0KJmd0OyA8YnI+DQomZ3Q7Jmd0OyBPbiBBdWcgMjEsIDIwMTgsIGF0IDA3OjQyLCBTdGVwaGVu IEZhcnJlbGwgJmx0OzxhIGhyZWY9Im1haWx0bzpzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllIj5z dGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPC9hPiZndDsgd3JvdGU6PGJyPg0KJmd0OyZndDsgPGJy Pg0KJmd0OyZndDsgPGJyPg0KJmd0OyZndDsgPGJyPg0KJmd0OyZndDsmZ3Q7IE9uIDIwLzA4LzE4 IDIxOjQ4LCBOYW5jeSBDYW0tV2luZ2V0IChuY2Ftd2luZykgd3JvdGU6PGJyPg0KJmd0OyZndDsm Z3Q7IEFsbCwgQSBjb3VwbGUgSW9UIGNvbnNvcnRpdW1zIGFyZSB0cnlpbmcgdG8gZW1icmFjZSB0 aGUgaW1wcm92ZW1lbnRzPGJyPg0KJmd0OyZndDsmZ3Q7IG1hZGUgdG8gVExTIDEuMyBhbmQgYXMg dGhleSBkZWZpbmUgdGhlaXIgbmV3IHNlY3VyaXR5IGNvbnN0cnVjdHM8YnI+DQomZ3Q7Jmd0OyZn dDsgd291bGQgbGlrZSB0byBhZG9wdCB0aGUgbGF0ZXN0IHByb3RvY29scywgaW4gdGhpcyBjYXNl IFRMUyAxLjMuIFRvPGJyPg0KJmd0OyZndDsmZ3Q7IHRoYXQgZXh0ZW50LCB0aGV5IGhhdmUgYSBz dHJvbmcgbmVlZCBmb3IgbXV0dWFsIGF1dGhlbnRpY2F0aW9uLCBidXQ8YnI+DQomZ3Q7Jmd0OyZn dDsgaW50ZWdyaXR5IG9ubHkgKG5vIGNvbmZpZGVudGlhbGl0eSkgcmVxdWlyZW1lbnRzLjxicj4N CiZndDsmZ3Q7Jmd0OyA8YnI+DQomZ3Q7Jmd0OyZndDsgSW4gZm9sbG93aW5nIHRoZSBuZXcgSUFO QSBydWxlcywgd2UgaGF2ZSBwb3N0ZWQgdGhlIGRyYWZ0PGJyPg0KJmd0OyZndDsmZ3Q7IDxhIGhy ZWY9Imh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1jYW13aW5nZXQtdGxzLXRzMTMt bWFjY2lwaGVyc3VpdGVzLTAwIj4NCmh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1j YW13aW5nZXQtdGxzLXRzMTMtbWFjY2lwaGVyc3VpdGVzLTAwPC9hPjxicj4NCiZndDsmZ3Q7Jmd0 OyB0byBkb2N1bWVudCByZXF1ZXN0IGZvciByZWdpc3RyYXRpb25zIG9mIEhNQUMgYmFzZWQgY2lw aGVyIHNlbGVjdGlvbnM8YnI+DQomZ3Q7Jmd0OyZndDsgd2l0aCBUTFMgMS4z4oCmLi5hbmQgYXJl IHNvbGljaXRpbmcgZmVlZGJhY2sgZnJvbSB0aGUgV0cgb24gdGhlIGRyYWZ0PGJyPg0KJmd0OyZn dDsmZ3Q7IGFuZCBpdHMgcGF0aCBmb3J3YXJkLjxicj4NCiZndDsmZ3Q7IDxicj4NCiZndDsmZ3Q7 IEFzIGVrciBwb2ludGVkIG91dCwgd2l0aCB0aGUgbmV3IHJlZ2lzdHJhdGlvbiBydWxlcyw8YnI+ DQomZ3Q7Jmd0OyB0aGVyZSdzIG5vdGhpbmcgdG8gc3RvcCBzb21lb25lIGRlZmluaW5nIGFueSBv bGQgc2V0PGJyPg0KJmd0OyZndDsgb2YgY3J5cHRvIHN0dWZmIGFuZCBnZXR0aW5nIG5vbi1yZWNv bW1lbmRlZCBjb2RlcG9pbnRzLjxicj4NCiZndDsmZ3Q7IDxicj4NCiZndDsmZ3Q7IFRoYXQgc2Fp ZCwgSSBkb24ndCBjb25zaWRlciB0aGF0IGRlZmluaW5nIHN1Y2g8YnI+DQomZ3Q7Jmd0OyB2dWxu ZXJhYmxlLWJ5LWRlc2lnbiBjaXBoZXJzdWl0ZXMgaXMgYSBnb29kIHBsYW4uPGJyPg0KJmd0OyZn dDsgPGJyPg0KJmd0OyZndDsgLSBJdCBpbXBvc2VzIGNvc3RzIG9uIHRoZSBub24tbmljaGUgdXNl cnMgb2YgVExTIC0gb25jZTxicj4NCiZndDsmZ3Q7IHRoZXNlIHRoaW5ncyBhcmUgZGVmaW5lZCB0 aGVuIGRldmVsb3BlcnMgYW5kIHRob3NlIHdobzxicj4NCiZndDsmZ3Q7IGRlcGxveS9jb25maWd1 cmUgYXBwbGljYXRpb25zIHVzaW5nIFRMUyBuZWVkIHRvIGNoZWNrPGJyPg0KJmd0OyZndDsgdGhh dCB0aGV5J3JlIG5vdCB1c2luZyB0aGVzZSB1bmRlc2lyYWJsZSBjaXBoZXJzdWl0ZXMsPGJyPg0K Jmd0OyZndDsgc28gY29zdHMgYXJlIGJlaW5nIGRpc3BsYWNlZCBmcm9tIG5pY2hlIHVzZXMgdG8g dGhlPGJyPg0KJmd0OyZndDsgdmFzdCBtYWpvcml0eSBvZiBpbXBsZW1lbnRhdGlvbnMgYW5kIGRl cGxveW1lbnRzLCB3aGljaDxicj4NCiZndDsmZ3Q7IHNlZW1zIHRvIG1lIHRvIGJlIGEgYmFkIGlk ZWEuIEFuZCB3ZSBrbm93IHRoYXQgcGVvcGxlPGJyPg0KJmd0OyZndDsgd2lsbCBzb21ldGltZXMg Z2V0IHRob3NlIGNoZWNrcyB3cm9uZyBsZWFkaW5nIHRvIHVuZXhwZWN0ZWQ8YnI+DQomZ3Q7Jmd0 OyB0cmFuc21pc3Npb24gb2YgcGxhaW50ZXh0IG92ZXIgdGhlIEludGVybmV0Ljxicj4NCiZndDsm Z3Q7IDxicj4NCiZndDsmZ3Q7IC0gU2ltaWxhcmx5LCBqdXN0IGRlZmluaW5nIHN1Y2ggY2lwaGVy c3VpdGVzIHNlZW1zIGxpa2VseTxicj4NCiZndDsmZ3Q7IHRvIGxlYWQgdG8gbGVzcyB3ZWxsIHRl c3RlZCBhbmQgaW5mcmVxdWVudGx5IHVzZWQgY29kZTxicj4NCiZndDsmZ3Q7IHBhdGhzLCB3aGlj aCBpcyB1bmRlc2lyYWJsZS4gKEFzc3VtaW5nIHNvbWVvbmUgcGF5cyBzb21lPGJyPg0KJmd0OyZn dDsgZGV2ZWxvcGVyIHRvIGFkZCB0aGVzZSB0byBzb21lIGxpYnJhcnksIHdoaWNoIGdlbmVyYWxs eTxicj4NCiZndDsmZ3Q7IGRvZXMgc2VlbSB0byBoYXBwZW4uKTxicj4NCiZndDsmZ3Q7IDxicj4N CiZndDsmZ3Q7IC0gUkZDNzUyNSBbMV0gaXMgY2xlYXIgb24gdGhpcyB0b3BpYyAoYWZ0ZXIgZGVi YXRlIGluIHRoZTxicj4NCiZndDsmZ3Q7IFVUQSBXRykgLSAmcXVvdDtJbXBsZW1lbnRhdGlvbnMg TVVTVCBOT1QgbmVnb3RpYXRlIHRoZSBjaXBoZXI8YnI+DQomZ3Q7Jmd0OyBzdWl0ZXMgd2l0aCBO VUxMIGVuY3J5cHRpb24mcXVvdDsgYW5kIEkgc2VlIG5vdGhpbmcgbmV3IHRvPGJyPg0KJmd0OyZn dDsgY29udmluY2UgbWUgdGhhdCB0aGF0IG91Z2h0IGNoYW5nZSBmb3IgVExTMS4zLjxicj4NCiZn dDsmZ3Q7IDxicj4NCiZndDsmZ3Q7IC0gQ29kZSBmb290cHJpbnQgYXJndW1lbnRzIGFyZW4ndCB0 aGF0IGNvbnZpbmNpbmcgdG88YnI+DQomZ3Q7Jmd0OyBtZSAtIHRvIGdldCBpbnRlcm9wIGZvciB0 aGUgZmV3IGRldmljZXMgd2hlcmUgQUVTIGJlaW5nPGJyPg0KJmd0OyZndDsgcHJlc2VudCBvciBh YnNlbnQgY291bGQgbWFrZSBhIHJlYWwgZGlmZmVyZW5jZSwgeW91J2Q8YnI+DQomZ3Q7Jmd0OyBu ZWVkIGFuIGF3ZnVsIGxvdCBtb3JlIHByb2ZpbGluZyBvZiBUTFMgb3IgRFRMUy4gSSBkb24ndDxi cj4NCiZndDsmZ3Q7IHNlZSBldmlkZW5jZSBvZiB0aGF0IHNvIHRoZSBpbnRlcm9wL2Zvb3Rwcmlu dCBhcmd1bWVudHM8YnI+DQomZ3Q7Jmd0OyBzZWVtIHByZXR0eSB3ZWFrLiBJJ2QgYWxzbyBiZXQg dGhhdCBhbnkgdXNlZnVsICZxdW90O3Rpbnk8YnI+DQomZ3Q7Jmd0OyBmb290cHJpbnQmcXVvdDsg cHJvZmlsZSBvZiB0aGF0IGtpbmQgd291bGQgZW5kIHVwIHRhcmdldGluZzxicj4NCiZndDsmZ3Q7 IGxvYWRzIG9mIHVzZS1jYXNlcyB3aGVyZSBjb25maWRlbnRpYWxpdHkgaXMgYWJzb2x1dGVseTxi cj4NCiZndDsmZ3Q7IHJlcXVpcmVkLjxicj4NCiZndDsmZ3Q7IDxicj4NCiZndDsmZ3Q7IC0gKElu IGFkZGl0aW9uIHRvIHRoZSBnb29kIHBvaW50cyBtYWRlIGJ5IEdlb2ZmcmV5PGJyPg0KJmd0OyZn dDsgS2VhdGluZyBbMl0pIGNsZWFydGV4dCBwYXlsb2FkcyB3b3VsZCBhbHNvIGFzc2lzdCBpbjxi cj4NCiZndDsmZ3Q7IGRldmljZSBmaW5nZXJwcmludGluZywgbWFraW5nIGl0IGVhc2llciB0byBl eHBsb2l0PGJyPg0KJmd0OyZndDsgdnVsbmVyYWJpbGl0aWVzIGF0IHNjYWxlLjxicj4NCiZndDsm Z3Q7IDxicj4NCiZndDsmZ3Q7IC0gSUlVQyB0aGVyZSBpcyBhbHNvIGEgZGVzaXJlIHRvIGVuY3J5 cHQgZmlybXdhcmU8YnI+DQomZ3Q7Jmd0OyB1cGRhdGVzIHNvIHRoYXQgcGF0Y2hlcyBjYW4gYmUg ZGlzdHJpYnV0ZWQgbW9yZSBxdWlja2x5PGJyPg0KJmd0OyZndDsgdGhhbiBhdHRhY2tlcnMgY2Fu IHJldmVyc2UtZW5naW5lZXIgYXR0YWNrcy4gWzRdIEknbTxicj4NCiZndDsmZ3Q7IG5vdCBlbnRp cmVseSBzdXJlIGlmIHRoYXQncyByZWFsbHkgbGlrZWx5IHRvIGhhcHBlbiw8YnI+DQomZ3Q7Jmd0 OyBidXQgaWYgaXQgd2VyZSwgdGhlbiBkZXZpY2VzIHdvdWxkIG5lZWQgdG8gYmUgYWJsZSB0bzxi cj4NCiZndDsmZ3Q7IHVzZSByZWNvbW1lbmRlZCBjaXBoZXJzdWl0ZXMgaW4gYW55IGNhc2UuPGJy Pg0KJmd0OyZndDsgPGJyPg0KJmd0OyZndDsgLSBUTFMvQVguMjUgZG9lc24ndCBzZWVtIHRoYXQg Z29vZCBhIHBsYW4gaW4gYW55PGJyPg0KJmd0OyZndDsgY2FzZSAtIGFjY29yZGluZyB0byBbM10s IHdoaWNoIHNlZW1zIHJlYXNvbmFibGUgdG88YnI+DQomZ3Q7Jmd0OyBtZSwgdXNpbmcgY2xlYXIt c2lnbmVkIEdQRyBpcyBxdWlja2VyIGFuZCBiZXR0ZXI8YnI+DQomZ3Q7Jmd0OyBtZWV0cyB0aGUg b2RkYmFsbCByZWd1bGF0aW9ucy4gQXR0ZW1wdGluZyB0byBkZWFsPGJyPg0KJmd0OyZndDsgd2l0 aCB0aG9zZSByZWd1bGF0aW9ucyBieSB3ZWFrZW5pbmcgVExTIHNlZW1zIGxpa2U8YnI+DQomZ3Q7 Jmd0OyBhIHZlcnkgYmFkIHBsYW4sIGFzIHlvdSdkIGZhaWwgaW4gYW55IGNhc2UgdG8gYWNoaWV2 ZTxicj4NCiZndDsmZ3Q7IGludGVyb3Agd2l0aCBub3JtYWwgVExTIGFwcGxpY2F0aW9ucyBsaWtl IHRoZSB3ZWIuPGJyPg0KJmd0OyZndDsgKEFuZCB0aGUgYWR2ZXJ0aXNpbmcgaXMgYXMgaWxsZWdh bCBhcyB0aGUgY3J5cHRvPGJyPg0KJmd0OyZndDsgYXBwYXJlbnRseSwgdGhvdWdoIEkgZG8gbGlr ZSB0aGF0IGFzcGVjdDotKTxicj4NCiZndDsmZ3Q7IDxicj4NCiZndDsmZ3Q7IC0gV1JUIHVuaXgg c29ja2V0cywgSSdtIG5vdCBjbGVhciB0aGF0IHRoZXJlJ3MgYTxicj4NCiZndDsmZ3Q7IHN1ZmZp Y2llbnRseSBpbXBvcnRhbnQgcGVyZm9ybWFuY2UgaW1wcm92ZW1lbnQgaW48YnI+DQomZ3Q7Jmd0 OyByZWFsIGRlcGxveW1lbnRzIHRvIGp1c3RpZnkgaW50cm9kdWNpbmcgd2Vha2VuZWQ8YnI+DQom Z3Q7Jmd0OyBjaXBoZXJzdWl0ZXMgLSBwcmVzdW1hYmx5IG1haWwgc2VydmVycyBhcmUgZ29pbmcg dG88YnI+DQomZ3Q7Jmd0OyB1c2Ugc3RhbmRhcmQgVExTIGxpYnJhcmllcyB0aGF0IChJIGhvcGUh KSB3b24ndCBiZTxicj4NCiZndDsmZ3Q7IG9mZmVyaW5nIE5VTEwgZW5jcnlwdGlvbiwgc28gSSdk IGJlIHN1cnByaXNlZCBpZjxicj4NCiZndDsmZ3Q7IHRoZSByaWdodCBlbmdpbmVlcmluZyBkZWNp c2lvbiB3YXMgdG8gcHJpb3JpdGlzZTxicj4NCiZndDsmZ3Q7IENQVSB0byB0aGF0IGV4dGVudCwg Z2l2ZW4gdGhlIHJpc2tzIGFzc29jaWF0ZWQgd2l0aDxicj4NCiZndDsmZ3Q7IGhhdmluZyB3ZWFr IGNpcGhlcnN1aXRlcyBwcmVzZW50IGluIHdpZGVseSB1c2VkPGJyPg0KJmd0OyZndDsgaW1wbGVt ZW50YXRpb25zLiBJT1csIGl0IHNlZW1zIG1vcmUgc2Vuc2libGUgdG8gbWU8YnI+DQomZ3Q7Jmd0 OyBmb3IgbWFpbCBzZXJ2ZXJzIHRvIGp1c3Qgc3RpY2sgdG8gdXNpbmcgUkVDT01NRU5ERUQ8YnI+ DQomZ3Q7Jmd0OyBjaXBoZXJzdWl0ZXMuIEFuZCBnaXZlbiB0aGF0IHlvdSBjb3VsZCB1c2UgU0FT TDxicj4NCiZndDsmZ3Q7IHdpdGggUG9zdGZpeC9MTVRQIFs1XSBJJ20gbm90IHN1cmUgd2h5IHlv dSdkIHdhbnQ8YnI+DQomZ3Q7Jmd0OyBhIHdlaXJkby12ZXJzaW9uIG9mIFRMUzEuMyBhbnl3YXkg YnV0IG1heWJlIHRoZXJlJ3M8YnI+DQomZ3Q7Jmd0OyBzb21lIHJlYXNvbiBJIGRvbid0IGdldC48 YnI+DQomZ3Q7Jmd0OyA8YnI+DQomZ3Q7Jmd0OyAtIEkgdGhpbmsgdGhpcyBXRyBoYXMgaGFkIHRv IHNwZW5kIHdhYWFheSB0b28gbXVjaDxicj4NCiZndDsmZ3Q7IHRpbWUgZGVhbGluZyB3aXRoIHRo ZSAmcXVvdDtpbnNwZWN0aW9uIG9mIGRhdGEmcXVvdDsgZGViYXRlIGluPGJyPg0KJmd0OyZndDsg dmFyaW91cyBmb3JtcywgYnV0IHdlIGRpZCBnZXQgYW4gYW5zd2VyIChubyBjb25zZW5zdXMpPGJy Pg0KJmd0OyZndDsgaW4gdGhlIGVuZCBmb3IgdGhhdC4gTmljaGUgdXNlIGNhc2VzIHNlZW0gZXh0 cmVtZWx5PGJyPg0KJmd0OyZndDsgdW5saWtlbHkgdG8gbWUgdG8ganVzdGlmeSByZXZpc2l0aW5n IHRoYXQgcGFpbmZ1bDxicj4NCiZndDsmZ3Q7IHRvcGljLjxicj4NCiZndDsmZ3Q7IDxicj4NCiZn dDsmZ3Q7IFNvIGFsbCBpbiBhbGwsIEkganVzdCBkb24ndCBzZWUgYSBuZWVkIGZvciB0aGVzZTxi cj4NCiZndDsmZ3Q7IHdlYWstYnktZGVzaWduIGNpcGhlcnN1aXRlcyB0byBldmVuIGJlIGRlZmlu ZWQuIEknZDxicj4NCiZndDsmZ3Q7IGVuY291cmFnZSBmb2xrcyB3aG8gdGhpbmsgdGhleSdyZSBu ZWVkZWQgdG8gaW5zdGVhZDxicj4NCiZndDsmZ3Q7IHRoaW5rIGFib3V0IGhvdyB1c2luZyBSRUNP TU1FTkRFRCBjaXBoZXJzdWl0ZXMgbWlnaHQ8YnI+DQomZ3Q7Jmd0OyBtYWtlIHRoZWlyIGltcGxl bWVudGF0aW9ucyBtb3JlIHdpZGVseSBhcHBsaWNhYmxlIGFuZDxicj4NCiZndDsmZ3Q7IHNhZmVy LiBTZWVtcyBsaWtlIGEgbXVjaCBtb3JlIHByb2R1Y3RpdmUgYXBwcm9hY2ggdG88YnI+DQomZ3Q7 Jmd0OyBtZSBhbnl3YXkuPGJyPg0KJmd0OyZndDsgPGJyPg0KJmd0OyZndDsgUmVnYXJkcyw8YnI+ DQomZ3Q7Jmd0OyBTLjxicj4NCiZndDsmZ3Q7IDxicj4NCiZndDsmZ3Q7IFsxXSA8YSBocmVmPSJo dHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvcmZjNzUyNSI+aHR0cHM6Ly90b29scy5pZXRmLm9y Zy9odG1sL3JmYzc1MjU8L2E+PGJyPg0KJmd0OyZndDsgWzJdIDxhIGhyZWY9Imh0dHBzOi8vbWFp bGFyY2hpdmUuaWV0Zi5vcmcvYXJjaC9tc2cvdGxzL3VJOHhWZ3A3Z1R1Smd3VXlZLVVnWmZtVWtS byI+DQpodHRwczovL21haWxhcmNoaXZlLmlldGYub3JnL2FyY2gvbXNnL3Rscy91STh4VmdwN2dU dUpnd1V5WS1VZ1pmbVVrUm88L2E+PGJyPg0KJmd0OyZndDsgWzNdIDxhIGhyZWY9Imh0dHBzOi8v dG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1pZXRmLXN1aXQtYXJjaGl0ZWN0dXJlLTAxI3NlY3Rp b24tMy4zIj4NCmh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1pZXRmLXN1aXQtYXJj aGl0ZWN0dXJlLTAxI3NlY3Rpb24tMy4zPC9hPjxicj4NCiZndDsmZ3Q7IFs0XSA8YSBocmVmPSJo dHRwczovL3d3dy50YXByLm9yZy9wZGYvRENDMjAxMC1BWC4yNS1BdXRoZW50aWNhdGlvbkVmZmVj dHMtS0U1TEtZLnBkZiI+DQpodHRwczovL3d3dy50YXByLm9yZy9wZGYvRENDMjAxMC1BWC4yNS1B dXRoZW50aWNhdGlvbkVmZmVjdHMtS0U1TEtZLnBkZjwvYT48YnI+DQomZ3Q7Jmd0OyBbNV0gPGEg aHJlZj0iaHR0cDovL3d3dy5wb3N0Zml4Lm9yZy9TQVNMX1JFQURNRS5odG1sI2NsaWVudF9zYXNs Ij5odHRwOi8vd3d3LnBvc3RmaXgub3JnL1NBU0xfUkVBRE1FLmh0bWwjY2xpZW50X3Nhc2w8L2E+ PGJyPg0KJmd0OyZndDsgPGJyPg0KJmd0OyZndDsgPGJyPg0KJmd0OyZndDsgJmx0OzB4NUFCMkZB RjE3QjE3MkJFQS5hc2MmZ3Q7PGJyPg0KJmd0OyZndDsgX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX188YnI+DQomZ3Q7Jmd0OyBUTFMgbWFpbGluZyBsaXN0PGJy Pg0KJmd0OyZndDsgPGEgaHJlZj0ibWFpbHRvOlRMU0BpZXRmLm9yZyI+VExTQGlldGYub3JnPC9h Pjxicj4NCiZndDsmZ3Q7IDxhIGhyZWY9Imh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlz dGluZm8vdGxzIj5odHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3RsczwvYT48 YnI+DQomZ3Q7IF9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f PGJyPg0KJmd0OyBUTFMgbWFpbGluZyBsaXN0PGJyPg0KJmd0OyA8YSBocmVmPSJtYWlsdG86VExT QGlldGYub3JnIj5UTFNAaWV0Zi5vcmc8L2E+PGJyPg0KJmd0OyA8YSBocmVmPSJodHRwczovL3d3 dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3RscyI+aHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFp bG1hbi9saXN0aW5mby90bHM8L2E+PGJyPg0KPGJyPg0KX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX188YnI+DQpUTFMgbWFpbGluZyBsaXN0PGJyPg0KPGEgaHJl Zj0ibWFpbHRvOlRMU0BpZXRmLm9yZyI+VExTQGlldGYub3JnPC9hPjxicj4NCjxhIGhyZWY9Imh0 dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vdGxzIj5odHRwczovL3d3dy5pZXRm Lm9yZy9tYWlsbWFuL2xpc3RpbmZvL3RsczwvYT48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rp dj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_DM5PR2201MB14335F5B8FBF5DC0B64B2AEF99310DM5PR2201MB1433_-- From nobody Tue Aug 21 07:58:58 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5D5AE128B14 for ; Tue, 21 Aug 2018 07:58:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.909 X-Spam-Level: X-Spam-Status: No, score=-1.909 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_DKIMWL_WL_MED=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6zb63ewd9mb4 for ; Tue, 21 Aug 2018 07:58:52 -0700 (PDT) Received: from mail-it0-x231.google.com (mail-it0-x231.google.com [IPv6:2607:f8b0:4001:c0b::231]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 27DC5130DDA for ; Tue, 21 Aug 2018 07:58:52 -0700 (PDT) Received: by mail-it0-x231.google.com with SMTP id h23-v6so4430313ita.5 for ; Tue, 21 Aug 2018 07:58:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=6vI377SZ6GJ4hOxQgpoY4sWPGF6DryljQIue0DD1T2o=; b=IPiZzKXYDlXMYgjLwMne90rebWh5hsky4BMKPeWuZUninQpgN/rKFq9QPtFjYHdo1X Wdzq5pt9vqoq9XawvtM7fcJO3wLgRZylrkJAElQIW6wXq29zmNEY/Cvt/x93z0LPPNo0 uBu1tAJC8vB2DPXPUuZ4UFXyl9ZRKoQKZf7B5EJKeJ7RU20hL1rc9ewFietu4g7wj9Vp nI02jn3epvye82Wm18GVmK+8BG7GX0viO8v/xHBmoBa4ZWmRAMPpMnuHlTdG5tB9eFvW Z52DOPFAeFdLQsorQy9MhY5Uq4dwuIAsAZZNvCuz7lgyyKrh7Rj2wx+M5HuNJQBRy6by fMJA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=6vI377SZ6GJ4hOxQgpoY4sWPGF6DryljQIue0DD1T2o=; b=NxDidoY6bfhIJrgXOgKB9vGLDcTHnoQcOYjwDUEGgVsM4WJm1X/ZKvv7GqUVgIlRPu Du2u7MevOr79TaFmdYOAD9UgVOtrM3HUzAeTQYMzU7LQvYFri14WiNXVZ4Hl0/DvcRU+ p625DNLiU59WqhtZqcOhwRZ3T644NI+j5OhiZObDe4t+IInId8abOPiaXFLZ1yti/i6T Gimd4GRxSlEFLmxoVlIQEYbQXoYCRALBa1h4+wtqBUHhP1nzCj6PGIU1PK9g73fTEoPC X84qY/Wwx1UiaKucvVFGk3Y2NItT73rWequ53rBx/fEYzjDmQbR0k76C+wt9aMTCMU/8 lhNQ== X-Gm-Message-State: AOUpUlHbo+Ej3LtKMJ4KSZDQQnvG+L6ah+7g4WawcBhtddcpbi2lW/c+ bnI/SPQv6OA7Il3RuNIUvy9ul0PdWlHiH4kp58Y4Jg== X-Google-Smtp-Source: AA+uWPx7m1wWNnSQcISL3Q8T6GC9tKpVaVcsRTlfUq4QXBabNVwcpNm/7i5VYbj0zrpnW6YuD5QTGuIB7gGVYnEO5pk= X-Received: by 2002:a24:374d:: with SMTP id r74-v6mr37821962itr.57.1534863531302; Tue, 21 Aug 2018 07:58:51 -0700 (PDT) MIME-Version: 1.0 Received: by 2002:a4f:a009:0:0:0:0:0 with HTTP; Tue, 21 Aug 2018 07:58:10 -0700 (PDT) In-Reply-To: References: <64d23891-2f32-9bb8-1ec8-f4fad13cdfb9@cs.tcd.ie> <982363FD-A839-4175-BA53-7CA242F9ADA6@ll.mit.edu> <2D7F2926-6376-4B2C-BDE9-7A6F1C0FA748@gmail.com> <5B7C1571020000AC0015C330@gwia2.rz.hs-offenburg.de> From: Ted Lemon Date: Tue, 21 Aug 2018 10:58:10 -0400 Message-ID: To: Jack Visoky Cc: Andreas Walz , "tls@ietf.org" , "ncamwing=40cisco.com@dmarc.ietf.org" Content-Type: multipart/alternative; boundary="0000000000009004dc0573f343f0" Archived-At: Subject: Re: [TLS] EXTERNAL: Re: integrity only ciphersuites X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Aug 2018 14:58:57 -0000 --0000000000009004dc0573f343f0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Thanks, Jack, but could you respond to the specific questions that we asked you? Earlier you were saying that your motivation for using NULL ciphers was that you had specific hardware that couldn't implement encryption due to lack of horsepower or memory. Now you seem to be saying something completely different. It's going to be difficult for us to understand your requirements if you talk about different things in each message. On Tue, Aug 21, 2018 at 10:27 AM, Jack Visoky wrote: > (I=E2=80=99m responding a few different points made here) > > > > In general, although this seems like a niche application, there are > actually millions of Industrial Ethernet nodes, with the numbers trending > upward. As mentioned, many of these are relying on older protocols > designed without security in mind. Our industry has had a debate around > using TLS vs. creating something specific. Many of us prefer to rely on > the security benefits of TLS. To another point, although I work for > Rockwell Automation, here I am working in my capacity within ODVA, a > standards group for Industrial Communications that has several large > vendors as members. We have adopted TLS to protect our industrial Ethern= et > traffic, and one of the selling points of TLS 1.2 was the ability to use > NULL encryption. > > > > NULL encryption is not really as much about code size but capability of > the devices. The TLS handshake of course contains some =E2=80=9Cheavywei= ght=E2=80=9D > operations, although handshakes are pretty infrequent as these connection= s > are often quite long-lived. Once the handshake is over, the I/O data tha= t > is transferred is often quite sensitive to latency, and although the > encryption overhead might not seem like much when the HMAC is considered, > it is still a case where in many applications every bit counts. Regardin= g > older hardware that exists for many years, some hardware does have > cryptographic acceleration although may not have AES-GCM, rather SHA-256 > HMAC. Alternatively, the hardware might not have any crypto acceleration > as it was designed without TLS in mind. At the same time we=E2=80=99d li= ke to > secure this traffic via a firmware upgrade. Despite this, if using > encryption drops performance enough users will simply not use it, which i= s > a net worse outcome. Users will likely not upgrade hardware for many yea= rs > due to a variety of industry factors. > > > > Kathleen=E2=80=99s comment about defining NULL encryption but being clear= about > the risks resonates with me. I=E2=80=99m certainly not suggesting that N= ULL > encryption is needed in all cases, but there are times (as discussed here > and in the RFC draft) where it could be quite beneficial. > > > > Thanks and Best Regards, > > > > --Jack > > > > *From:* TLS [mailto:tls-bounces@ietf.org] *On Behalf Of *Andreas Walz > *Sent:* Tuesday, August 21, 2018 9:37 AM > *To:* tls@ietf.org > *Cc:* ncamwing=3D40cisco.com@dmarc.ietf.org > *Subject:* EXTERNAL: Re: [TLS] integrity only ciphersuites > > > > [Use caution with links & attachments] > > > > +1 > > I fully understand the pursuit of minimizing complexity in TLS. However, > banning from TLS all provisions to serve non-internet cases seems > suboptimal to me. > > I think there is a whole universe of systems and applications that are > just at the very beginning of being armed with security features: think o= f > communication systems driving, e.g., industrial automation and critical > infrastructures. These are quite different from the internet and the web > (different threats, security requirements, architectures, networks, > resources, etc.). Still, IMHO it's not a niche at all; it's just not as > visible to most of us. > > I strongly believe it is *not* a good idea to hold back all the valuable > experience condensed in TLS and entail the design of customized security > protocols for such systems. TLS is state-of-the-art and its benefits shou= ld > be accessible to as many systems as possible. > > > > Cheers, > Andi Walz > > > > > >>> Kathleen Moriarty 08/21/18 3:20 PM > >>> > > > Sent from my mobile device > > > On Aug 21, 2018, at 8:10 AM, Blumenthal, Uri - 0553 - MITLL < > uri@ll.mit.edu> wrote: > > > > "Vulnerable-by-design ciphersuites"? Vulnerable to what? > > > > Suck sites are designed to provide end-point authentication and traffic > integrity. Care to explain/show how these properties would not hold? > > > > Besides, it's been explained several times that some use cases do not > require confidentiality, and in some use cases confidentiality is forbidd= en. > > I agree with Uri here, flexibility to cover these use cases to accommodat= e > the actual security requirements may result in them using something inste= ad > of nothing. It could be defined and not listed as Recommended as well. Th= is > comes down to risk management and options, where the risk can be clearly > explained and the lack of recommendation can also be explained. > > Best regards, > Kathleen > > > > > Regards, > > Uri > > > > Sent from my iPhone > > > >> On Aug 21, 2018, at 07:42, Stephen Farrell > wrote: > >> > >> > >> > >>> On 20/08/18 21:48, Nancy Cam-Winget (ncamwing) wrote: > >>> All, A couple IoT consortiums are trying to embrace the improvements > >>> made to TLS 1.3 and as they define their new security constructs > >>> would like to adopt the latest protocols, in this case TLS 1.3. To > >>> that extent, they have a strong need for mutual authentication, but > >>> integrity only (no confidentiality) requirements. > >>> > >>> In following the new IANA rules, we have posted the draft > >>> https://tools.ietf.org/html/draft-camwinget-tls-ts13- > macciphersuites-00 > >>> to document request for registrations of HMAC based cipher selections > >>> with TLS 1.3=E2=80=A6..and are soliciting feedback from the WG on the= draft > >>> and its path forward. > >> > >> As ekr pointed out, with the new registration rules, > >> there's nothing to stop someone defining any old set > >> of crypto stuff and getting non-recommended codepoints. > >> > >> That said, I don't consider that defining such > >> vulnerable-by-design ciphersuites is a good plan. > >> > >> - It imposes costs on the non-niche users of TLS - once > >> these things are defined then developers and those who > >> deploy/configure applications using TLS need to check > >> that they're not using these undesirable ciphersuites, > >> so costs are being displaced from niche uses to the > >> vast majority of implementations and deployments, which > >> seems to me to be a bad idea. And we know that people > >> will sometimes get those checks wrong leading to unexpected > >> transmission of plaintext over the Internet. > >> > >> - Similarly, just defining such ciphersuites seems likely > >> to lead to less well tested and infrequently used code > >> paths, which is undesirable. (Assuming someone pays some > >> developer to add these to some library, which generally > >> does seem to happen.) > >> > >> - RFC7525 [1] is clear on this topic (after debate in the > >> UTA WG) - "Implementations MUST NOT negotiate the cipher > >> suites with NULL encryption" and I see nothing new to > >> convince me that that ought change for TLS1.3. > >> > >> - Code footprint arguments aren't that convincing to > >> me - to get interop for the few devices where AES being > >> present or absent could make a real difference, you'd > >> need an awful lot more profiling of TLS or DTLS. I don't > >> see evidence of that so the interop/footprint arguments > >> seem pretty weak. I'd also bet that any useful "tiny > >> footprint" profile of that kind would end up targeting > >> loads of use-cases where confidentiality is absolutely > >> required. > >> > >> - (In addition to the good points made by Geoffrey > >> Keating [2]) cleartext payloads would also assist in > >> device fingerprinting, making it easier to exploit > >> vulnerabilities at scale. > >> > >> - IIUC there is also a desire to encrypt firmware > >> updates so that patches can be distributed more quickly > >> than attackers can reverse-engineer attacks. [4] I'm > >> not entirely sure if that's really likely to happen, > >> but if it were, then devices would need to be able to > >> use recommended ciphersuites in any case. > >> > >> - TLS/AX.25 doesn't seem that good a plan in any > >> case - according to [3], which seems reasonable to > >> me, using clear-signed GPG is quicker and better > >> meets the oddball regulations. Attempting to deal > >> with those regulations by weakening TLS seems like > >> a very bad plan, as you'd fail in any case to achieve > >> interop with normal TLS applications like the web. > >> (And the advertising is as illegal as the crypto > >> apparently, though I do like that aspect:-) > >> > >> - WRT unix sockets, I'm not clear that there's a > >> sufficiently important performance improvement in > >> real deployments to justify introducing weakened > >> ciphersuites - presumably mail servers are going to > >> use standard TLS libraries that (I hope!) won't be > >> offering NULL encryption, so I'd be surprised if > >> the right engineering decision was to prioritise > >> CPU to that extent, given the risks associated with > >> having weak ciphersuites present in widely used > >> implementations. IOW, it seems more sensible to me > >> for mail servers to just stick to using RECOMMENDED > >> ciphersuites. And given that you could use SASL > >> with Postfix/LMTP [5] I'm not sure why you'd want > >> a weirdo-version of TLS1.3 anyway but maybe there's > >> some reason I don't get. > >> > >> - I think this WG has had to spend waaaay too much > >> time dealing with the "inspection of data" debate in > >> various forms, but we did get an answer (no consensus) > >> in the end for that. Niche use cases seem extremely > >> unlikely to me to justify revisiting that painful > >> topic. > >> > >> So all in all, I just don't see a need for these > >> weak-by-design ciphersuites to even be defined. I'd > >> encourage folks who think they're needed to instead > >> think about how using RECOMMENDED ciphersuites might > >> make their implementations more widely applicable and > >> safer. Seems like a much more productive approach to > >> me anyway. > >> > >> Regards, > >> S. > >> > >> [1] https://tools.ietf.org/html/rfc7525 > >> [2] https://mailarchive.ietf.org/arch/msg/tls/ > uI8xVgp7gTuJgwUyY-UgZfmUkRo > >> [3] https://tools.ietf.org/html/draft-ietf-suit-architecture- > 01#section-3.3 > >> [4] https://www.tapr.org/pdf/DCC2010-AX.25- > AuthenticationEffects-KE5LKY.pdf > >> [5] http://www.postfix.org/SASL_README.html#client_sasl > >> > >> > >> <0x5AB2FAF17B172BEA.asc> > >> _______________________________________________ > >> TLS mailing list > >> TLS@ietf.org > >> https://www.ietf.org/mailman/listinfo/tls > > _______________________________________________ > > TLS mailing list > > TLS@ietf.org > > https://www.ietf.org/mailman/listinfo/tls > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > > --0000000000009004dc0573f343f0 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Thanks, Jack, but could you respond to the specific questi= ons that we asked you?=C2=A0 =C2=A0Earlier you were saying that your motiva= tion for using NULL ciphers was that you had specific hardware that couldn&= #39;t implement encryption due to lack of horsepower or memory.=C2=A0 =C2= =A0Now you seem to be saying something completely different.=C2=A0 =C2=A0It= 's going to be difficult for us to understand your requirements if you = talk about different things in each message.

On Tue, Aug 21, 2018 at 10:27 AM, Jack Vis= oky <jmvisoky@ra.rockwell.com> wrote:

(I=E2=80=99m responding=C2=A0 a few d= ifferent points made here)

=C2=A0

In general, although this seems like = a niche application, there are actually millions of Industrial Ethernet nod= es, with the numbers trending upward.=C2=A0 As mentioned, many of these are relying on older protocols designed without security in = mind.=C2=A0 Our industry has had a debate around using TLS vs. creating som= ething specific.=C2=A0 Many of us prefer to rely on the security benefits o= f TLS.=C2=A0 To another point, although I work for Rockwell Automation, here I am working in my capacity within ODVA, a s= tandards group for Industrial Communications that has several large vendors= as members.=C2=A0 We have adopted TLS to protect our industrial Ethernet t= raffic, and one of the selling points of TLS 1.2 was the ability to use NULL encryption.

=C2=A0

NULL encryption is not really as much= about code size but capability of the devices.=C2=A0 The TLS handshake of = course contains some =E2=80=9Cheavyweight=E2=80=9D operations, although handshakes are pretty infrequent as these connections are often quite long= -lived.=C2=A0 Once the handshake is over, the I/O data that is transferred = is often quite sensitive to latency, and although the encryption overhead m= ight not seem like much when the HMAC is considered, it is still a case where in many applications every bit cou= nts.=C2=A0 Regarding older hardware that exists for many years, some hardwa= re does have cryptographic acceleration although may not have AES-GCM, rath= er SHA-256 HMAC.=C2=A0 Alternatively, the hardware might not have any crypto acceleration as it was designed without= TLS in mind.=C2=A0 At the same time we=E2=80=99d like to secure this traff= ic via a firmware upgrade.=C2=A0 Despite this, if using encryption drops pe= rformance enough users will simply not use it, which is a net worse outcome.=C2=A0 Users will likely not upgrade hardware for m= any years due to a variety of industry factors.

=C2=A0

Kathleen=E2=80=99s comment about defi= ning NULL encryption but being clear about the risks resonates with me.=C2= =A0 I=E2=80=99m certainly not suggesting that NULL encryption is needed in all cases, but there are times (as discussed here and in the RFC draft)= where it could be quite beneficial.

=C2=A0

Thanks and Best Regards,

=C2=A0

--Jack

=C2=A0

From: TLS [mailto:tls-bounces@ietf.org] On Behalf Of Andreas Walz
Sent: Tuesday, August 21, 2018 9:37 AM
To: tls@ietf.org
Cc: ncamwing=3D40cisco.com@dmarc.ietf.org
Subject: EXTERNAL: Re: [TLS] integrity only ciphersuites

=C2=A0

[Use caution with links & attachments]

=C2=A0

+1

I fully understand the pursuit of minimizing complexity in TLS. However, ba= nning from TLS all provisions to serve non-internet cases seems suboptimal = to me.

I think there is a whole universe of systems and applications that are just= at the very beginning of being armed with security features: think of comm= unication systems driving, e.g., industrial automation and critical infrast= ructures. These are quite different from the internet and the web (different threats, security requirements, a= rchitectures, networks, resources, etc.). Still, IMHO it's not a niche = at all; it's just not as visible to most of us.

I strongly believe it is *not* a good idea to hold back all the valuable ex= perience condensed in TLS and entail the design of customized security prot= ocols for such systems. TLS is state-of-the-art and its benefits should be = accessible to as many systems as possible.

=C2=A0

Cheers,
Andi Walz

=C2=A0


>>> Kath= leen=C2=A0Moriarty=C2=A0<kathleen.moriarty.ietf@gmail.com> 08/21/= 18 3:20 PM >>>


Sent from my mobile device

> On Aug 21, 2018, at 8:10 AM, Blumenthal, Uri - 0553 - MITLL <uri@ll.mit.edu> wrote:=
>
> "Vulnerable-by-design ciphersuites"? Vulnerable to what? >
> Suck sites are designed to provide end-point authentication and traffi= c integrity. Care to explain/show how these properties would not hold?
>
> Besides, it's been explained several times that some use cases do = not require confidentiality, and in some use cases confidentiality is forbi= dden.

I agree with Uri here, flexibility to cover these use cases to accommodate = the actual security requirements may result in them using something instead= of nothing. It could be defined and not listed as Recommended as well. Thi= s comes down to risk management and options, where the risk can be clearly explained and the lack of recom= mendation can also be explained.

Best regards,
Kathleen

>
> Regards,
> Uri
>
> Sent from my iPhone
>
>> On Aug 21, 2018, at 07:42, Stephen Farrell <stephen.farrell@cs.tcd.ie&g= t; wrote:
>>
>>
>>
>>> On 20/08/18 21:48, Nancy Cam-Winget (ncamwing) wrote:
>>> All, A couple IoT consortiums are trying to embrace the improv= ements
>>> made to TLS 1.3 and as they define their new security construc= ts
>>> would like to adopt the latest protocols, in this case TLS 1.3= . To
>>> that extent, they have a strong need for mutual authentication= , but
>>> integrity only (no confidentiality) requirements.
>>>
>>> In following the new IANA rules, we have posted the draft
>>> https://tools.ietf.org/html/draft-camwinget-tls-ts13-macciphersui= tes-00
>>> to document request for registrations of HMAC based cipher sel= ections
>>> with TLS 1.3=E2=80=A6..and are soliciting feedback from the WG= on the draft
>>> and its path forward.
>>
>> As ekr pointed out, with the new registration rules,
>> there's nothing to stop someone defining any old set
>> of crypto stuff and getting non-recommended codepoints.
>>
>> That said, I don't consider that defining such
>> vulnerable-by-design ciphersuites is a good plan.
>>
>> - It imposes costs on the non-niche users of TLS - once
>> these things are defined then developers and those who
>> deploy/configure applications using TLS need to check
>> that they're not using these undesirable ciphersuites,
>> so costs are being displaced from niche uses to the
>> vast majority of implementations and deployments, which
>> seems to me to be a bad idea. And we know that people
>> will sometimes get those checks wrong leading to unexpected
>> transmission of plaintext over the Internet.
>>
>> - Similarly, just defining such ciphersuites seems likely
>> to lead to less well tested and infrequently used code
>> paths, which is undesirable. (Assuming someone pays some
>> developer to add these to some library, which generally
>> does seem to happen.)
>>
>> - RFC7525 [1] is clear on this topic (after debate in the
>> UTA WG) - "Implementations MUST NOT negotiate the cipher
>> suites with NULL encryption" and I see nothing new to
>> convince me that that ought change for TLS1.3.
>>
>> - Code footprint arguments aren't that convincing to
>> me - to get interop for the few devices where AES being
>> present or absent could make a real difference, you'd
>> need an awful lot more profiling of TLS or DTLS. I don't
>> see evidence of that so the interop/footprint arguments
>> seem pretty weak. I'd also bet that any useful "tiny
>> footprint" profile of that kind would end up targeting
>> loads of use-cases where confidentiality is absolutely
>> required.
>>
>> - (In addition to the good points made by Geoffrey
>> Keating [2]) cleartext payloads would also assist in
>> device fingerprinting, making it easier to exploit
>> vulnerabilities at scale.
>>
>> - IIUC there is also a desire to encrypt firmware
>> updates so that patches can be distributed more quickly
>> than attackers can reverse-engineer attacks. [4] I'm
>> not entirely sure if that's really likely to happen,
>> but if it were, then devices would need to be able to
>> use recommended ciphersuites in any case.
>>
>> - TLS/AX.25 doesn't seem that good a plan in any
>> case - according to [3], which seems reasonable to
>> me, using clear-signed GPG is quicker and better
>> meets the oddball regulations. Attempting to deal
>> with those regulations by weakening TLS seems like
>> a very bad plan, as you'd fail in any case to achieve
>> interop with normal TLS applications like the web.
>> (And the advertising is as illegal as the crypto
>> apparently, though I do like that aspect:-)
>>
>> - WRT unix sockets, I'm not clear that there's a
>> sufficiently important performance improvement in
>> real deployments to justify introducing weakened
>> ciphersuites - presumably mail servers are going to
>> use standard TLS libraries that (I hope!) won't be
>> offering NULL encryption, so I'd be surprised if
>> the right engineering decision was to prioritise
>> CPU to that extent, given the risks associated with
>> having weak ciphersuites present in widely used
>> implementations. IOW, it seems more sensible to me
>> for mail servers to just stick to using RECOMMENDED
>> ciphersuites. And given that you could use SASL
>> with Postfix/LMTP [5] I'm not sure why you'd want
>> a weirdo-version of TLS1.3 anyway but maybe there's
>> some reason I don't get.
>>
>> - I think this WG has had to spend waaaay too much
>> time dealing with the "inspection of data" debate in
>> various forms, but we did get an answer (no consensus)
>> in the end for that. Niche use cases seem extremely
>> unlikely to me to justify revisiting that painful
>> topic.
>>
>> So all in all, I just don't see a need for these
>> weak-by-design ciphersuites to even be defined. I'd
>> encourage folks who think they're needed to instead
>> think about how using RECOMMENDED ciphersuites might
>> make their implementations more widely applicable and
>> safer. Seems like a much more productive approach to
>> me anyway.
>>
>> Regards,
>> S.
>>
>> [1] https://tools.ietf.org/html/rfc7525
>> [2] https://mailarchive.ietf.org/arch/msg/tls/uI8xVgp7gTuJgwUyY-UgZfm= UkRo
>> [3] https://tools.ietf.org/html/draft-ietf-suit-architecture-01#secti= on-3.3
>> [4] https://www.tapr.org/pdf/DCC2010-AX.25-AuthenticationEffects-KE5L= KY.pdf
>> [5] http://www.postfix.org/SASL_README.html#client_sas= l
>>
>>
>> <0x5AB2FAF17B172BEA.asc>
>> _______________________________________________
>> TLS mailing list
>> TLS@ietf.org=
>> https://www.ietf.org/mailman/listinfo/tls
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls

_______________________________________________
TLS mailing list
TLS@ietf.org
htt= ps://www.ietf.org/mailman/listinfo/tls=


_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls


--0000000000009004dc0573f343f0-- From nobody Tue Aug 21 08:20:25 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2288B128B14 for ; Tue, 21 Aug 2018 08:20:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VNxDXixV1PLm for ; Tue, 21 Aug 2018 08:20:19 -0700 (PDT) Received: from NAM01-BN3-obe.outbound.protection.outlook.com (mail-bn3nam01on0051.outbound.protection.outlook.com [104.47.33.51]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 29EE21274D0 for ; Tue, 21 Aug 2018 08:20:19 -0700 (PDT) Received: from DM5PR2201MB1433.namprd22.prod.outlook.com (10.174.186.154) by DM5PR2201MB1465.namprd22.prod.outlook.com (10.174.186.162) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1059.21; Tue, 21 Aug 2018 15:20:17 +0000 Received: from DM5PR2201MB1433.namprd22.prod.outlook.com ([fe80::49f1:7875:b984:9a65]) by DM5PR2201MB1433.namprd22.prod.outlook.com ([fe80::49f1:7875:b984:9a65%2]) with mapi id 15.20.1059.023; Tue, 21 Aug 2018 15:20:17 +0000 From: Jack Visoky To: Ted Lemon CC: Andreas Walz , "tls@ietf.org" , "ncamwing=40cisco.com@dmarc.ietf.org" Thread-Topic: [TLS] EXTERNAL: Re: integrity only ciphersuites Thread-Index: AQHUOV98dXTtnuVz+kOQWLoA1No/8qTKTN5g Date: Tue, 21 Aug 2018 15:20:17 +0000 Message-ID: References: <64d23891-2f32-9bb8-1ec8-f4fad13cdfb9@cs.tcd.ie> <982363FD-A839-4175-BA53-7CA242F9ADA6@ll.mit.edu> <2D7F2926-6376-4B2C-BDE9-7A6F1C0FA748@gmail.com> <5B7C1571020000AC0015C330@gwia2.rz.hs-offenburg.de> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=jmvisoky@ra.rockwell.com; x-originating-ip: [205.175.250.246] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; DM5PR2201MB1465; 6:bgQJLt1lV06JFvhrGUmIMsX0ySFQSZ65U1MOWcDwNhjWXNECNH1c4sbD7VJHVN4XdFTJLq9TgXImCFE8gV/n9rJcZhcUXTN8fLKcyI8f170d3YHdlNJsmAoTZG8G6c0+6xrJuVGqI3GBdr/S+kewLN4HuNCuchg1pjMIo5gFFCEjcSOSTHlNA8xGJYCWZScpYvFnrYCeE3ORKa3MD2qaREknPV1rKrl20PgWze1J9ucilZ6UsM4gMa1kMI4sg7pX5pggfAcJmdtZ3Hrm6xR53EiEMG5ja5Ihxxlxpzg5Ppk5rJf3dRdPO9IPzin+VkmLHiZfNTiYNR0T9AQjQHYD0SbVWdune4GZxBHcjksroVXKLenuR9hrZlQKeLJh3PPnxK9S9t9jWPa2RisX5R0/dY6CqdZIdB40ZeqJ9GORDXE60Kq6jviJeqfEAH5o2gCEXijChDyyhSglY8zlUwbwwg==; 5:IcBzUMubVqkvF4PiW06Spzn/cTB3ZkBqoxGaRuITaeagE25olneQYDa/tUEYPZlHjlHEhhqs9Vq/VdVo6U+swk3D0Oh/IIxwDiuwHF0Z5wE7i+qyPTSg/2JraA5BHFDFFdAMafk3ncvwNRoxd6u1INDzY8fOgKLdN7QryW2eVZ4=; 7:PFeRVJHZzc3sYzwWAuBQiNWAw30XRfTbs6Iqk6olA734LULsXL+hcsVH6NNGMs869wNySTjUo+eoaICgAn68xTwwZt2kwT1YViabORsrfLNpxt75WshlCcT6Q1VvdiVAxb604nSjuBGk1fPASvq3BSMZtmBTpvBeD8RKTgIoAlHCHpKjWu0Qod6WJHSRqN8X+4v7KzqOoFc30vJ3v1OHbXzN5Ed+POylNezGUHLqr63OdVmkVM1//6iuwOpSP8VS x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-correlation-id: 2c831219-32d2-4ecc-0e70-08d6077999cb x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(7020095)(4652040)(8989137)(4534165)(4627221)(201703031133081)(201702281549075)(8990107)(5600074)(711020)(4618075)(2017052603328)(7153060)(7193020); SRVR:DM5PR2201MB1465; x-ms-traffictypediagnostic: DM5PR2201MB1465: x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(28532068793085)(32856632585715)(278428928389397)(192374486261705)(85827821059158)(269231077054813)(100405760836317)(21748063052155)(240460790083961); x-ms-exchange-senderadcheck: 1 x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(8211001083)(6040522)(2401047)(5005006)(8121501046)(3002001)(93006095)(93001095)(10201501046)(3231311)(944501410)(52105095)(6055026)(149027)(150027)(6041310)(20161123564045)(20161123560045)(20161123558120)(20161123562045)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(201708071742011)(7699016); SRVR:DM5PR2201MB1465; BCL:0; PCL:0; RULEID:; SRVR:DM5PR2201MB1465; x-forefront-prvs: 0771670921 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(376002)(136003)(396003)(39860400002)(366004)(346002)(189003)(199004)(966005)(4326008)(55016002)(8936002)(6306002)(54896002)(236005)(9326002)(9686003)(5660300001)(86362001)(99286004)(229853002)(53936002)(2906002)(14454004)(6916009)(66066001)(7696005)(6246003)(68736007)(478600001)(97736004)(6436002)(5003630100001)(76176011)(53546011)(186003)(26005)(102836004)(5024004)(33656002)(6506007)(316002)(256004)(606006)(476003)(81166006)(14444005)(8676002)(790700001)(7736002)(81156014)(3846002)(6116002)(486006)(93886005)(74316002)(105586002)(25786009)(5250100002)(19609705001)(2900100001)(54906003)(446003)(106356001)(11346002); DIR:OUT; SFP:1101; SCL:1; SRVR:DM5PR2201MB1465; H:DM5PR2201MB1433.namprd22.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: ra.rockwell.com does not designate permitted sender hosts) x-microsoft-antispam-message-info: C9V+OMloG5SeYVImLEuMan8Koc7RBUQs39NVI/uUvNKm7PfgNQ8FbPmorD0DU9+oL20YRB4V0Rx+8iSpbXeuMiSrtzRm8kKm8bq9q6jc+SHp9zAzUvcIi73NoKD4VV1y5+yr+3CaEs9B2XSIx906RBorxtpGONk6/Wu1RqoDQnzVwDm+e+vuVUn8FaogFNAArxPq9so3Yu1XrTE/VEWa6KAX1MFGX3sZR6nnG22Vz2QyXMS0R/NW5Rqt0yJon9DWx8mQk2UMZDh8fu2ZkhfceGDyx2J/TCVk4fYiXW259QD+2lL6RMCYA4JfMF2HXiEVKVCABMXIbK0s097AWt3yUD3fFkoPGsv0XqIYbvF/eMg= spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_DM5PR2201MB14332BE29A418B74DF8E2AD299310DM5PR2201MB1433_" MIME-Version: 1.0 X-OriginatorOrg: ra.rockwell.com X-MS-Exchange-CrossTenant-Network-Message-Id: 2c831219-32d2-4ecc-0e70-08d6077999cb X-MS-Exchange-CrossTenant-originalarrivaltime: 21 Aug 2018 15:20:17.0391 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 855b093e-7340-45c7-9f0c-96150415893e X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM5PR2201MB1465 Archived-At: Subject: Re: [TLS] EXTERNAL: Re: integrity only ciphersuites X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Aug 2018 15:20:24 -0000 --_000_DM5PR2201MB14332BE29A418B74DF8E2AD299310DM5PR2201MB1433_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGkgVGVkLA0KDQpNeSBhcG9sb2dpZXMgZm9yIGJlaW5nIG9wYXF1ZS4gIFRoZXJlIGFyZSBtYW55 IGRpZmZlcmVudCBkZXZpY2UvYXBwbGljYXRpb25zL2luc3RhbGxhdGlvbnMgc28gSSBhbSBzb3Jy eSBpZiBJIGFtIG1peGluZyBpZGVhcyBoZXJlLiAgR2VuZXJhbGx5IHRoZSBOVUxMIGNpcGhlcnMg aGF2ZSB0aGUgYmVuZWZpdCBhcm91bmQgYWxsb3dpbmcgaGlnaGVyIHBlcmZvcm1hbmNlIGZvciBk ZXZpY2VzIHRoYXQgYXJlIGxvd2VyIGhvcnNlcG93ZXIuICBDb2RlIHNwYWNlIGNhbiBjZXJ0YWlu bHkgYmUgYSBjb25jZXJuLCBidXQgSSB0aGluayBmb3IgaW5kdXN0cmlhbCBhcHBsaWNhdGlvbnMg aXTigJlzIG1vcmUgYXJvdW5kIHRocm91Z2hwdXQgb2YgaGlnaCBzcGVlZCBJL08sIGNvbWJpbmVk IHdpdGggdGhlIHVzZSBjYXNlcyB0aGF0IGRlcml2ZSBsaXR0bGUgYmVuZWZpdCBmcm9tIHRoZSBj b25maWRlbnRpYWxpdHkgb2YgdGhpcyBkYXRhLiAg4oCcSG9yc2Vwb3dlcuKAnSBpcyBvZiBjb3Vy c2UgYSB2YWd1ZSB0ZXJtIGluIG9mIGl0c2VsZiwgc28gaGVyZSBJ4oCZbSB0YWxraW5nIGFib3V0 IHRoaW5ncyB0aGF0IHdvdWxkIGltcGFjdCBwYWNrZXQgcHJvY2Vzc2luZzsgdGhpcyBpbmNsdWRl cyBwcm9jZXNzb3Igc3BlZWQsIGF2YWlsYWJsZSBoaWdoIHNwZWVkIFJBTSwgcHJlc2VuY2Ugb2Yv bGFjayBvZiBjcnlwdG8gYWNjZWxlcmF0aW9uIChub3QgaW4gbWFueSBJbmR1c3RyaWFsIEV0aGVy bmV0IGRldmljZXMgYnV0IGdyb3dpbmcpLiAgSSB3b3VsZG7igJl0IHB1dCB0aGUgZXhlY3V0YWJs ZSBjb2RlIHNpemUgYXMgaGlnaCBvbiB0aGUgbGlzdCBvZiBjb25jZXJucyBhcyB0aGVzZSBpdGVt cywgYWx0aG91Z2ggdGhlcmUgYXJlIGNlcnRhaW5seSBkZXZpY2VzIHRoYXQgYXJlIGxpbWl0ZWQg aW4gdGhpcy4gIFRoaXMgaG9yc2Vwb3dlciBsaW1pdGF0aW9uIGlzIGRpcmVjdGx5IHJlbGF0ZWQg dG8gdGhlIGZhY3QgdGhhdCB0aGVzZSBkZXZpY2VzIGFyZSBleHBlY3RlZCB0byBmdW5jdGlvbiBm b3IgbWFueSB5ZWFycy4NCg0KSeKAmW0gaGFwcHkgdG8gY2xhcmlmeSBhbnkgb2YgdGhlc2UgcG9p bnRzIGZ1cnRoZXIgaWYgbmVlZGVkLg0KDQpUaGFua3MgYW5kIEJlc3QgUmVnYXJkcywNCg0KLS1K YWNrDQoNCkZyb206IFRlZCBMZW1vbiBbbWFpbHRvOm1lbGxvbkBmdWd1ZS5jb21dDQpTZW50OiBU dWVzZGF5LCBBdWd1c3QgMjEsIDIwMTggMTA6NTggQU0NClRvOiBKYWNrIFZpc29reSA8am12aXNv a3lAcmEucm9ja3dlbGwuY29tPg0KQ2M6IEFuZHJlYXMgV2FseiA8YW5kcmVhcy53YWx6QGhzLW9m ZmVuYnVyZy5kZT47IHRsc0BpZXRmLm9yZzsgbmNhbXdpbmc9NDBjaXNjby5jb21AZG1hcmMuaWV0 Zi5vcmcNClN1YmplY3Q6IFJlOiBbVExTXSBFWFRFUk5BTDogUmU6IGludGVncml0eSBvbmx5IGNp cGhlcnN1aXRlcw0KDQpUaGFua3MsIEphY2ssIGJ1dCBjb3VsZCB5b3UgcmVzcG9uZCB0byB0aGUg c3BlY2lmaWMgcXVlc3Rpb25zIHRoYXQgd2UgYXNrZWQgeW91PyAgIEVhcmxpZXIgeW91IHdlcmUg c2F5aW5nIHRoYXQgeW91ciBtb3RpdmF0aW9uIGZvciB1c2luZyBOVUxMIGNpcGhlcnMgd2FzIHRo YXQgeW91IGhhZCBzcGVjaWZpYyBoYXJkd2FyZSB0aGF0IGNvdWxkbid0IGltcGxlbWVudCBlbmNy eXB0aW9uIGR1ZSB0byBsYWNrIG9mIGhvcnNlcG93ZXIgb3IgbWVtb3J5LiAgIE5vdyB5b3Ugc2Vl bSB0byBiZSBzYXlpbmcgc29tZXRoaW5nIGNvbXBsZXRlbHkgZGlmZmVyZW50LiAgIEl0J3MgZ29p bmcgdG8gYmUgZGlmZmljdWx0IGZvciB1cyB0byB1bmRlcnN0YW5kIHlvdXIgcmVxdWlyZW1lbnRz IGlmIHlvdSB0YWxrIGFib3V0IGRpZmZlcmVudCB0aGluZ3MgaW4gZWFjaCBtZXNzYWdlLg0KDQpP biBUdWUsIEF1ZyAyMSwgMjAxOCBhdCAxMDoyNyBBTSwgSmFjayBWaXNva3kgPGptdmlzb2t5QHJh LnJvY2t3ZWxsLmNvbTxtYWlsdG86am12aXNva3lAcmEucm9ja3dlbGwuY29tPj4gd3JvdGU6DQoo SeKAmW0gcmVzcG9uZGluZyAgYSBmZXcgZGlmZmVyZW50IHBvaW50cyBtYWRlIGhlcmUpDQoNCklu IGdlbmVyYWwsIGFsdGhvdWdoIHRoaXMgc2VlbXMgbGlrZSBhIG5pY2hlIGFwcGxpY2F0aW9uLCB0 aGVyZSBhcmUgYWN0dWFsbHkgbWlsbGlvbnMgb2YgSW5kdXN0cmlhbCBFdGhlcm5ldCBub2Rlcywg d2l0aCB0aGUgbnVtYmVycyB0cmVuZGluZyB1cHdhcmQuICBBcyBtZW50aW9uZWQsIG1hbnkgb2Yg dGhlc2UgYXJlIHJlbHlpbmcgb24gb2xkZXIgcHJvdG9jb2xzIGRlc2lnbmVkIHdpdGhvdXQgc2Vj dXJpdHkgaW4gbWluZC4gIE91ciBpbmR1c3RyeSBoYXMgaGFkIGEgZGViYXRlIGFyb3VuZCB1c2lu ZyBUTFMgdnMuIGNyZWF0aW5nIHNvbWV0aGluZyBzcGVjaWZpYy4gIE1hbnkgb2YgdXMgcHJlZmVy IHRvIHJlbHkgb24gdGhlIHNlY3VyaXR5IGJlbmVmaXRzIG9mIFRMUy4gIFRvIGFub3RoZXIgcG9p bnQsIGFsdGhvdWdoIEkgd29yayBmb3IgUm9ja3dlbGwgQXV0b21hdGlvbiwgaGVyZSBJIGFtIHdv cmtpbmcgaW4gbXkgY2FwYWNpdHkgd2l0aGluIE9EVkEsIGEgc3RhbmRhcmRzIGdyb3VwIGZvciBJ bmR1c3RyaWFsIENvbW11bmljYXRpb25zIHRoYXQgaGFzIHNldmVyYWwgbGFyZ2UgdmVuZG9ycyBh cyBtZW1iZXJzLiAgV2UgaGF2ZSBhZG9wdGVkIFRMUyB0byBwcm90ZWN0IG91ciBpbmR1c3RyaWFs IEV0aGVybmV0IHRyYWZmaWMsIGFuZCBvbmUgb2YgdGhlIHNlbGxpbmcgcG9pbnRzIG9mIFRMUyAx LjIgd2FzIHRoZSBhYmlsaXR5IHRvIHVzZSBOVUxMIGVuY3J5cHRpb24uDQoNCk5VTEwgZW5jcnlw dGlvbiBpcyBub3QgcmVhbGx5IGFzIG11Y2ggYWJvdXQgY29kZSBzaXplIGJ1dCBjYXBhYmlsaXR5 IG9mIHRoZSBkZXZpY2VzLiAgVGhlIFRMUyBoYW5kc2hha2Ugb2YgY291cnNlIGNvbnRhaW5zIHNv bWUg4oCcaGVhdnl3ZWlnaHTigJ0gb3BlcmF0aW9ucywgYWx0aG91Z2ggaGFuZHNoYWtlcyBhcmUg cHJldHR5IGluZnJlcXVlbnQgYXMgdGhlc2UgY29ubmVjdGlvbnMgYXJlIG9mdGVuIHF1aXRlIGxv bmctbGl2ZWQuICBPbmNlIHRoZSBoYW5kc2hha2UgaXMgb3ZlciwgdGhlIEkvTyBkYXRhIHRoYXQg aXMgdHJhbnNmZXJyZWQgaXMgb2Z0ZW4gcXVpdGUgc2Vuc2l0aXZlIHRvIGxhdGVuY3ksIGFuZCBh bHRob3VnaCB0aGUgZW5jcnlwdGlvbiBvdmVyaGVhZCBtaWdodCBub3Qgc2VlbSBsaWtlIG11Y2gg d2hlbiB0aGUgSE1BQyBpcyBjb25zaWRlcmVkLCBpdCBpcyBzdGlsbCBhIGNhc2Ugd2hlcmUgaW4g bWFueSBhcHBsaWNhdGlvbnMgZXZlcnkgYml0IGNvdW50cy4gIFJlZ2FyZGluZyBvbGRlciBoYXJk d2FyZSB0aGF0IGV4aXN0cyBmb3IgbWFueSB5ZWFycywgc29tZSBoYXJkd2FyZSBkb2VzIGhhdmUg Y3J5cHRvZ3JhcGhpYyBhY2NlbGVyYXRpb24gYWx0aG91Z2ggbWF5IG5vdCBoYXZlIEFFUy1HQ00s IHJhdGhlciBTSEEtMjU2IEhNQUMuICBBbHRlcm5hdGl2ZWx5LCB0aGUgaGFyZHdhcmUgbWlnaHQg bm90IGhhdmUgYW55IGNyeXB0byBhY2NlbGVyYXRpb24gYXMgaXQgd2FzIGRlc2lnbmVkIHdpdGhv dXQgVExTIGluIG1pbmQuICBBdCB0aGUgc2FtZSB0aW1lIHdl4oCZZCBsaWtlIHRvIHNlY3VyZSB0 aGlzIHRyYWZmaWMgdmlhIGEgZmlybXdhcmUgdXBncmFkZS4gIERlc3BpdGUgdGhpcywgaWYgdXNp bmcgZW5jcnlwdGlvbiBkcm9wcyBwZXJmb3JtYW5jZSBlbm91Z2ggdXNlcnMgd2lsbCBzaW1wbHkg bm90IHVzZSBpdCwgd2hpY2ggaXMgYSBuZXQgd29yc2Ugb3V0Y29tZS4gIFVzZXJzIHdpbGwgbGlr ZWx5IG5vdCB1cGdyYWRlIGhhcmR3YXJlIGZvciBtYW55IHllYXJzIGR1ZSB0byBhIHZhcmlldHkg b2YgaW5kdXN0cnkgZmFjdG9ycy4NCg0KS2F0aGxlZW7igJlzIGNvbW1lbnQgYWJvdXQgZGVmaW5p bmcgTlVMTCBlbmNyeXB0aW9uIGJ1dCBiZWluZyBjbGVhciBhYm91dCB0aGUgcmlza3MgcmVzb25h dGVzIHdpdGggbWUuICBJ4oCZbSBjZXJ0YWlubHkgbm90IHN1Z2dlc3RpbmcgdGhhdCBOVUxMIGVu Y3J5cHRpb24gaXMgbmVlZGVkIGluIGFsbCBjYXNlcywgYnV0IHRoZXJlIGFyZSB0aW1lcyAoYXMg ZGlzY3Vzc2VkIGhlcmUgYW5kIGluIHRoZSBSRkMgZHJhZnQpIHdoZXJlIGl0IGNvdWxkIGJlIHF1 aXRlIGJlbmVmaWNpYWwuDQoNClRoYW5rcyBhbmQgQmVzdCBSZWdhcmRzLA0KDQotLUphY2sNCg0K RnJvbTogVExTIFttYWlsdG86dGxzLWJvdW5jZXNAaWV0Zi5vcmc8bWFpbHRvOnRscy1ib3VuY2Vz QGlldGYub3JnPl0gT24gQmVoYWxmIE9mIEFuZHJlYXMgV2Fseg0KU2VudDogVHVlc2RheSwgQXVn dXN0IDIxLCAyMDE4IDk6MzcgQU0NClRvOiB0bHNAaWV0Zi5vcmc8bWFpbHRvOnRsc0BpZXRmLm9y Zz4NCkNjOiBuY2Ftd2luZz00MGNpc2NvLmNvbUBkbWFyYy5pZXRmLm9yZzxtYWlsdG86NDBjaXNj by5jb21AZG1hcmMuaWV0Zi5vcmc+DQpTdWJqZWN0OiBFWFRFUk5BTDogUmU6IFtUTFNdIGludGVn cml0eSBvbmx5IGNpcGhlcnN1aXRlcw0KDQoNCltVc2UgY2F1dGlvbiB3aXRoIGxpbmtzICYgYXR0 YWNobWVudHNdDQoNCisxDQoNCkkgZnVsbHkgdW5kZXJzdGFuZCB0aGUgcHVyc3VpdCBvZiBtaW5p bWl6aW5nIGNvbXBsZXhpdHkgaW4gVExTLiBIb3dldmVyLCBiYW5uaW5nIGZyb20gVExTIGFsbCBw cm92aXNpb25zIHRvIHNlcnZlIG5vbi1pbnRlcm5ldCBjYXNlcyBzZWVtcyBzdWJvcHRpbWFsIHRv IG1lLg0KDQpJIHRoaW5rIHRoZXJlIGlzIGEgd2hvbGUgdW5pdmVyc2Ugb2Ygc3lzdGVtcyBhbmQg YXBwbGljYXRpb25zIHRoYXQgYXJlIGp1c3QgYXQgdGhlIHZlcnkgYmVnaW5uaW5nIG9mIGJlaW5n IGFybWVkIHdpdGggc2VjdXJpdHkgZmVhdHVyZXM6IHRoaW5rIG9mIGNvbW11bmljYXRpb24gc3lz dGVtcyBkcml2aW5nLCBlLmcuLCBpbmR1c3RyaWFsIGF1dG9tYXRpb24gYW5kIGNyaXRpY2FsIGlu ZnJhc3RydWN0dXJlcy4gVGhlc2UgYXJlIHF1aXRlIGRpZmZlcmVudCBmcm9tIHRoZSBpbnRlcm5l dCBhbmQgdGhlIHdlYiAoZGlmZmVyZW50IHRocmVhdHMsIHNlY3VyaXR5IHJlcXVpcmVtZW50cywg YXJjaGl0ZWN0dXJlcywgbmV0d29ya3MsIHJlc291cmNlcywgZXRjLikuIFN0aWxsLCBJTUhPIGl0 J3Mgbm90IGEgbmljaGUgYXQgYWxsOyBpdCdzIGp1c3Qgbm90IGFzIHZpc2libGUgdG8gbW9zdCBv ZiB1cy4NCg0KSSBzdHJvbmdseSBiZWxpZXZlIGl0IGlzICpub3QqIGEgZ29vZCBpZGVhIHRvIGhv bGQgYmFjayBhbGwgdGhlIHZhbHVhYmxlIGV4cGVyaWVuY2UgY29uZGVuc2VkIGluIFRMUyBhbmQg ZW50YWlsIHRoZSBkZXNpZ24gb2YgY3VzdG9taXplZCBzZWN1cml0eSBwcm90b2NvbHMgZm9yIHN1 Y2ggc3lzdGVtcy4gVExTIGlzIHN0YXRlLW9mLXRoZS1hcnQgYW5kIGl0cyBiZW5lZml0cyBzaG91 bGQgYmUgYWNjZXNzaWJsZSB0byBhcyBtYW55IHN5c3RlbXMgYXMgcG9zc2libGUuDQoNCkNoZWVy cywNCkFuZGkgV2Fseg0KDQoNCj4+PiBLYXRobGVlbiBNb3JpYXJ0eSA8a2F0aGxlZW4ubW9yaWFy dHkuaWV0ZkBnbWFpbC5jb208bWFpbHRvOmthdGhsZWVuLm1vcmlhcnR5LmlldGZAZ21haWwuY29t Pj4gMDgvMjEvMTggMzoyMCBQTSA+Pj4NCg0KDQpTZW50IGZyb20gbXkgbW9iaWxlIGRldmljZQ0K DQo+IE9uIEF1ZyAyMSwgMjAxOCwgYXQgODoxMCBBTSwgQmx1bWVudGhhbCwgVXJpIC0gMDU1MyAt IE1JVExMIDx1cmlAbGwubWl0LmVkdTxtYWlsdG86dXJpQGxsLm1pdC5lZHU+PiB3cm90ZToNCj4N Cj4gIlZ1bG5lcmFibGUtYnktZGVzaWduIGNpcGhlcnN1aXRlcyI/IFZ1bG5lcmFibGUgdG8gd2hh dD8NCj4NCj4gU3VjayBzaXRlcyBhcmUgZGVzaWduZWQgdG8gcHJvdmlkZSBlbmQtcG9pbnQgYXV0 aGVudGljYXRpb24gYW5kIHRyYWZmaWMgaW50ZWdyaXR5LiBDYXJlIHRvIGV4cGxhaW4vc2hvdyBo b3cgdGhlc2UgcHJvcGVydGllcyB3b3VsZCBub3QgaG9sZD8NCj4NCj4gQmVzaWRlcywgaXQncyBi ZWVuIGV4cGxhaW5lZCBzZXZlcmFsIHRpbWVzIHRoYXQgc29tZSB1c2UgY2FzZXMgZG8gbm90IHJl cXVpcmUgY29uZmlkZW50aWFsaXR5LCBhbmQgaW4gc29tZSB1c2UgY2FzZXMgY29uZmlkZW50aWFs aXR5IGlzIGZvcmJpZGRlbi4NCg0KSSBhZ3JlZSB3aXRoIFVyaSBoZXJlLCBmbGV4aWJpbGl0eSB0 byBjb3ZlciB0aGVzZSB1c2UgY2FzZXMgdG8gYWNjb21tb2RhdGUgdGhlIGFjdHVhbCBzZWN1cml0 eSByZXF1aXJlbWVudHMgbWF5IHJlc3VsdCBpbiB0aGVtIHVzaW5nIHNvbWV0aGluZyBpbnN0ZWFk IG9mIG5vdGhpbmcuIEl0IGNvdWxkIGJlIGRlZmluZWQgYW5kIG5vdCBsaXN0ZWQgYXMgUmVjb21t ZW5kZWQgYXMgd2VsbC4gVGhpcyBjb21lcyBkb3duIHRvIHJpc2sgbWFuYWdlbWVudCBhbmQgb3B0 aW9ucywgd2hlcmUgdGhlIHJpc2sgY2FuIGJlIGNsZWFybHkgZXhwbGFpbmVkIGFuZCB0aGUgbGFj ayBvZiByZWNvbW1lbmRhdGlvbiBjYW4gYWxzbyBiZSBleHBsYWluZWQuDQoNCkJlc3QgcmVnYXJk cywNCkthdGhsZWVuDQoNCj4NCj4gUmVnYXJkcywNCj4gVXJpDQo+DQo+IFNlbnQgZnJvbSBteSBp UGhvbmUNCj4NCj4+IE9uIEF1ZyAyMSwgMjAxOCwgYXQgMDc6NDIsIFN0ZXBoZW4gRmFycmVsbCA8 c3RlcGhlbi5mYXJyZWxsQGNzLnRjZC5pZTxtYWlsdG86c3RlcGhlbi5mYXJyZWxsQGNzLnRjZC5p ZT4+IHdyb3RlOg0KPj4NCj4+DQo+Pg0KPj4+IE9uIDIwLzA4LzE4IDIxOjQ4LCBOYW5jeSBDYW0t V2luZ2V0IChuY2Ftd2luZykgd3JvdGU6DQo+Pj4gQWxsLCBBIGNvdXBsZSBJb1QgY29uc29ydGl1 bXMgYXJlIHRyeWluZyB0byBlbWJyYWNlIHRoZSBpbXByb3ZlbWVudHMNCj4+PiBtYWRlIHRvIFRM UyAxLjMgYW5kIGFzIHRoZXkgZGVmaW5lIHRoZWlyIG5ldyBzZWN1cml0eSBjb25zdHJ1Y3RzDQo+ Pj4gd291bGQgbGlrZSB0byBhZG9wdCB0aGUgbGF0ZXN0IHByb3RvY29scywgaW4gdGhpcyBjYXNl IFRMUyAxLjMuIFRvDQo+Pj4gdGhhdCBleHRlbnQsIHRoZXkgaGF2ZSBhIHN0cm9uZyBuZWVkIGZv ciBtdXR1YWwgYXV0aGVudGljYXRpb24sIGJ1dA0KPj4+IGludGVncml0eSBvbmx5IChubyBjb25m aWRlbnRpYWxpdHkpIHJlcXVpcmVtZW50cy4NCj4+Pg0KPj4+IEluIGZvbGxvd2luZyB0aGUgbmV3 IElBTkEgcnVsZXMsIHdlIGhhdmUgcG9zdGVkIHRoZSBkcmFmdA0KPj4+IGh0dHBzOi8vdG9vbHMu aWV0Zi5vcmcvaHRtbC9kcmFmdC1jYW13aW5nZXQtdGxzLXRzMTMtbWFjY2lwaGVyc3VpdGVzLTAw DQo+Pj4gdG8gZG9jdW1lbnQgcmVxdWVzdCBmb3IgcmVnaXN0cmF0aW9ucyBvZiBITUFDIGJhc2Vk IGNpcGhlciBzZWxlY3Rpb25zDQo+Pj4gd2l0aCBUTFMgMS4z4oCmLi5hbmQgYXJlIHNvbGljaXRp bmcgZmVlZGJhY2sgZnJvbSB0aGUgV0cgb24gdGhlIGRyYWZ0DQo+Pj4gYW5kIGl0cyBwYXRoIGZv cndhcmQuDQo+Pg0KPj4gQXMgZWtyIHBvaW50ZWQgb3V0LCB3aXRoIHRoZSBuZXcgcmVnaXN0cmF0 aW9uIHJ1bGVzLA0KPj4gdGhlcmUncyBub3RoaW5nIHRvIHN0b3Agc29tZW9uZSBkZWZpbmluZyBh bnkgb2xkIHNldA0KPj4gb2YgY3J5cHRvIHN0dWZmIGFuZCBnZXR0aW5nIG5vbi1yZWNvbW1lbmRl ZCBjb2RlcG9pbnRzLg0KPj4NCj4+IFRoYXQgc2FpZCwgSSBkb24ndCBjb25zaWRlciB0aGF0IGRl ZmluaW5nIHN1Y2gNCj4+IHZ1bG5lcmFibGUtYnktZGVzaWduIGNpcGhlcnN1aXRlcyBpcyBhIGdv b2QgcGxhbi4NCj4+DQo+PiAtIEl0IGltcG9zZXMgY29zdHMgb24gdGhlIG5vbi1uaWNoZSB1c2Vy cyBvZiBUTFMgLSBvbmNlDQo+PiB0aGVzZSB0aGluZ3MgYXJlIGRlZmluZWQgdGhlbiBkZXZlbG9w ZXJzIGFuZCB0aG9zZSB3aG8NCj4+IGRlcGxveS9jb25maWd1cmUgYXBwbGljYXRpb25zIHVzaW5n IFRMUyBuZWVkIHRvIGNoZWNrDQo+PiB0aGF0IHRoZXkncmUgbm90IHVzaW5nIHRoZXNlIHVuZGVz aXJhYmxlIGNpcGhlcnN1aXRlcywNCj4+IHNvIGNvc3RzIGFyZSBiZWluZyBkaXNwbGFjZWQgZnJv bSBuaWNoZSB1c2VzIHRvIHRoZQ0KPj4gdmFzdCBtYWpvcml0eSBvZiBpbXBsZW1lbnRhdGlvbnMg YW5kIGRlcGxveW1lbnRzLCB3aGljaA0KPj4gc2VlbXMgdG8gbWUgdG8gYmUgYSBiYWQgaWRlYS4g QW5kIHdlIGtub3cgdGhhdCBwZW9wbGUNCj4+IHdpbGwgc29tZXRpbWVzIGdldCB0aG9zZSBjaGVj a3Mgd3JvbmcgbGVhZGluZyB0byB1bmV4cGVjdGVkDQo+PiB0cmFuc21pc3Npb24gb2YgcGxhaW50 ZXh0IG92ZXIgdGhlIEludGVybmV0Lg0KPj4NCj4+IC0gU2ltaWxhcmx5LCBqdXN0IGRlZmluaW5n IHN1Y2ggY2lwaGVyc3VpdGVzIHNlZW1zIGxpa2VseQ0KPj4gdG8gbGVhZCB0byBsZXNzIHdlbGwg dGVzdGVkIGFuZCBpbmZyZXF1ZW50bHkgdXNlZCBjb2RlDQo+PiBwYXRocywgd2hpY2ggaXMgdW5k ZXNpcmFibGUuIChBc3N1bWluZyBzb21lb25lIHBheXMgc29tZQ0KPj4gZGV2ZWxvcGVyIHRvIGFk ZCB0aGVzZSB0byBzb21lIGxpYnJhcnksIHdoaWNoIGdlbmVyYWxseQ0KPj4gZG9lcyBzZWVtIHRv IGhhcHBlbi4pDQo+Pg0KPj4gLSBSRkM3NTI1IFsxXSBpcyBjbGVhciBvbiB0aGlzIHRvcGljIChh ZnRlciBkZWJhdGUgaW4gdGhlDQo+PiBVVEEgV0cpIC0gIkltcGxlbWVudGF0aW9ucyBNVVNUIE5P VCBuZWdvdGlhdGUgdGhlIGNpcGhlcg0KPj4gc3VpdGVzIHdpdGggTlVMTCBlbmNyeXB0aW9uIiBh bmQgSSBzZWUgbm90aGluZyBuZXcgdG8NCj4+IGNvbnZpbmNlIG1lIHRoYXQgdGhhdCBvdWdodCBj aGFuZ2UgZm9yIFRMUzEuMy4NCj4+DQo+PiAtIENvZGUgZm9vdHByaW50IGFyZ3VtZW50cyBhcmVu J3QgdGhhdCBjb252aW5jaW5nIHRvDQo+PiBtZSAtIHRvIGdldCBpbnRlcm9wIGZvciB0aGUgZmV3 IGRldmljZXMgd2hlcmUgQUVTIGJlaW5nDQo+PiBwcmVzZW50IG9yIGFic2VudCBjb3VsZCBtYWtl IGEgcmVhbCBkaWZmZXJlbmNlLCB5b3UnZA0KPj4gbmVlZCBhbiBhd2Z1bCBsb3QgbW9yZSBwcm9m aWxpbmcgb2YgVExTIG9yIERUTFMuIEkgZG9uJ3QNCj4+IHNlZSBldmlkZW5jZSBvZiB0aGF0IHNv IHRoZSBpbnRlcm9wL2Zvb3RwcmludCBhcmd1bWVudHMNCj4+IHNlZW0gcHJldHR5IHdlYWsuIEkn ZCBhbHNvIGJldCB0aGF0IGFueSB1c2VmdWwgInRpbnkNCj4+IGZvb3RwcmludCIgcHJvZmlsZSBv ZiB0aGF0IGtpbmQgd291bGQgZW5kIHVwIHRhcmdldGluZw0KPj4gbG9hZHMgb2YgdXNlLWNhc2Vz IHdoZXJlIGNvbmZpZGVudGlhbGl0eSBpcyBhYnNvbHV0ZWx5DQo+PiByZXF1aXJlZC4NCj4+DQo+ PiAtIChJbiBhZGRpdGlvbiB0byB0aGUgZ29vZCBwb2ludHMgbWFkZSBieSBHZW9mZnJleQ0KPj4g S2VhdGluZyBbMl0pIGNsZWFydGV4dCBwYXlsb2FkcyB3b3VsZCBhbHNvIGFzc2lzdCBpbg0KPj4g ZGV2aWNlIGZpbmdlcnByaW50aW5nLCBtYWtpbmcgaXQgZWFzaWVyIHRvIGV4cGxvaXQNCj4+IHZ1 bG5lcmFiaWxpdGllcyBhdCBzY2FsZS4NCj4+DQo+PiAtIElJVUMgdGhlcmUgaXMgYWxzbyBhIGRl c2lyZSB0byBlbmNyeXB0IGZpcm13YXJlDQo+PiB1cGRhdGVzIHNvIHRoYXQgcGF0Y2hlcyBjYW4g YmUgZGlzdHJpYnV0ZWQgbW9yZSBxdWlja2x5DQo+PiB0aGFuIGF0dGFja2VycyBjYW4gcmV2ZXJz ZS1lbmdpbmVlciBhdHRhY2tzLiBbNF0gSSdtDQo+PiBub3QgZW50aXJlbHkgc3VyZSBpZiB0aGF0 J3MgcmVhbGx5IGxpa2VseSB0byBoYXBwZW4sDQo+PiBidXQgaWYgaXQgd2VyZSwgdGhlbiBkZXZp Y2VzIHdvdWxkIG5lZWQgdG8gYmUgYWJsZSB0bw0KPj4gdXNlIHJlY29tbWVuZGVkIGNpcGhlcnN1 aXRlcyBpbiBhbnkgY2FzZS4NCj4+DQo+PiAtIFRMUy9BWC4yNSBkb2Vzbid0IHNlZW0gdGhhdCBn b29kIGEgcGxhbiBpbiBhbnkNCj4+IGNhc2UgLSBhY2NvcmRpbmcgdG8gWzNdLCB3aGljaCBzZWVt cyByZWFzb25hYmxlIHRvDQo+PiBtZSwgdXNpbmcgY2xlYXItc2lnbmVkIEdQRyBpcyBxdWlja2Vy IGFuZCBiZXR0ZXINCj4+IG1lZXRzIHRoZSBvZGRiYWxsIHJlZ3VsYXRpb25zLiBBdHRlbXB0aW5n IHRvIGRlYWwNCj4+IHdpdGggdGhvc2UgcmVndWxhdGlvbnMgYnkgd2Vha2VuaW5nIFRMUyBzZWVt cyBsaWtlDQo+PiBhIHZlcnkgYmFkIHBsYW4sIGFzIHlvdSdkIGZhaWwgaW4gYW55IGNhc2UgdG8g YWNoaWV2ZQ0KPj4gaW50ZXJvcCB3aXRoIG5vcm1hbCBUTFMgYXBwbGljYXRpb25zIGxpa2UgdGhl IHdlYi4NCj4+IChBbmQgdGhlIGFkdmVydGlzaW5nIGlzIGFzIGlsbGVnYWwgYXMgdGhlIGNyeXB0 bw0KPj4gYXBwYXJlbnRseSwgdGhvdWdoIEkgZG8gbGlrZSB0aGF0IGFzcGVjdDotKQ0KPj4NCj4+ IC0gV1JUIHVuaXggc29ja2V0cywgSSdtIG5vdCBjbGVhciB0aGF0IHRoZXJlJ3MgYQ0KPj4gc3Vm ZmljaWVudGx5IGltcG9ydGFudCBwZXJmb3JtYW5jZSBpbXByb3ZlbWVudCBpbg0KPj4gcmVhbCBk ZXBsb3ltZW50cyB0byBqdXN0aWZ5IGludHJvZHVjaW5nIHdlYWtlbmVkDQo+PiBjaXBoZXJzdWl0 ZXMgLSBwcmVzdW1hYmx5IG1haWwgc2VydmVycyBhcmUgZ29pbmcgdG8NCj4+IHVzZSBzdGFuZGFy ZCBUTFMgbGlicmFyaWVzIHRoYXQgKEkgaG9wZSEpIHdvbid0IGJlDQo+PiBvZmZlcmluZyBOVUxM IGVuY3J5cHRpb24sIHNvIEknZCBiZSBzdXJwcmlzZWQgaWYNCj4+IHRoZSByaWdodCBlbmdpbmVl cmluZyBkZWNpc2lvbiB3YXMgdG8gcHJpb3JpdGlzZQ0KPj4gQ1BVIHRvIHRoYXQgZXh0ZW50LCBn aXZlbiB0aGUgcmlza3MgYXNzb2NpYXRlZCB3aXRoDQo+PiBoYXZpbmcgd2VhayBjaXBoZXJzdWl0 ZXMgcHJlc2VudCBpbiB3aWRlbHkgdXNlZA0KPj4gaW1wbGVtZW50YXRpb25zLiBJT1csIGl0IHNl ZW1zIG1vcmUgc2Vuc2libGUgdG8gbWUNCj4+IGZvciBtYWlsIHNlcnZlcnMgdG8ganVzdCBzdGlj ayB0byB1c2luZyBSRUNPTU1FTkRFRA0KPj4gY2lwaGVyc3VpdGVzLiBBbmQgZ2l2ZW4gdGhhdCB5 b3UgY291bGQgdXNlIFNBU0wNCj4+IHdpdGggUG9zdGZpeC9MTVRQIFs1XSBJJ20gbm90IHN1cmUg d2h5IHlvdSdkIHdhbnQNCj4+IGEgd2VpcmRvLXZlcnNpb24gb2YgVExTMS4zIGFueXdheSBidXQg bWF5YmUgdGhlcmUncw0KPj4gc29tZSByZWFzb24gSSBkb24ndCBnZXQuDQo+Pg0KPj4gLSBJIHRo aW5rIHRoaXMgV0cgaGFzIGhhZCB0byBzcGVuZCB3YWFhYXkgdG9vIG11Y2gNCj4+IHRpbWUgZGVh bGluZyB3aXRoIHRoZSAiaW5zcGVjdGlvbiBvZiBkYXRhIiBkZWJhdGUgaW4NCj4+IHZhcmlvdXMg Zm9ybXMsIGJ1dCB3ZSBkaWQgZ2V0IGFuIGFuc3dlciAobm8gY29uc2Vuc3VzKQ0KPj4gaW4gdGhl IGVuZCBmb3IgdGhhdC4gTmljaGUgdXNlIGNhc2VzIHNlZW0gZXh0cmVtZWx5DQo+PiB1bmxpa2Vs eSB0byBtZSB0byBqdXN0aWZ5IHJldmlzaXRpbmcgdGhhdCBwYWluZnVsDQo+PiB0b3BpYy4NCj4+ DQo+PiBTbyBhbGwgaW4gYWxsLCBJIGp1c3QgZG9uJ3Qgc2VlIGEgbmVlZCBmb3IgdGhlc2UNCj4+ IHdlYWstYnktZGVzaWduIGNpcGhlcnN1aXRlcyB0byBldmVuIGJlIGRlZmluZWQuIEknZA0KPj4g ZW5jb3VyYWdlIGZvbGtzIHdobyB0aGluayB0aGV5J3JlIG5lZWRlZCB0byBpbnN0ZWFkDQo+PiB0 aGluayBhYm91dCBob3cgdXNpbmcgUkVDT01NRU5ERUQgY2lwaGVyc3VpdGVzIG1pZ2h0DQo+PiBt YWtlIHRoZWlyIGltcGxlbWVudGF0aW9ucyBtb3JlIHdpZGVseSBhcHBsaWNhYmxlIGFuZA0KPj4g c2FmZXIuIFNlZW1zIGxpa2UgYSBtdWNoIG1vcmUgcHJvZHVjdGl2ZSBhcHByb2FjaCB0bw0KPj4g bWUgYW55d2F5Lg0KPj4NCj4+IFJlZ2FyZHMsDQo+PiBTLg0KPj4NCj4+IFsxXSBodHRwczovL3Rv b2xzLmlldGYub3JnL2h0bWwvcmZjNzUyNQ0KPj4gWzJdIGh0dHBzOi8vbWFpbGFyY2hpdmUuaWV0 Zi5vcmcvYXJjaC9tc2cvdGxzL3VJOHhWZ3A3Z1R1Smd3VXlZLVVnWmZtVWtSbw0KPj4gWzNdIGh0 dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1pZXRmLXN1aXQtYXJjaGl0ZWN0dXJlLTAx I3NlY3Rpb24tMy4zDQo+PiBbNF0gaHR0cHM6Ly93d3cudGFwci5vcmcvcGRmL0RDQzIwMTAtQVgu MjUtQXV0aGVudGljYXRpb25FZmZlY3RzLUtFNUxLWS5wZGYNCj4+IFs1XSBodHRwOi8vd3d3LnBv c3RmaXgub3JnL1NBU0xfUkVBRE1FLmh0bWwjY2xpZW50X3Nhc2wNCj4+DQo+Pg0KPj4gPDB4NUFC MkZBRjE3QjE3MkJFQS5hc2M+DQo+PiBfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fXw0KPj4gVExTIG1haWxpbmcgbGlzdA0KPj4gVExTQGlldGYub3JnPG1haWx0 bzpUTFNAaWV0Zi5vcmc+DQo+PiBodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZv L3Rscw0KPiBfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0K PiBUTFMgbWFpbGluZyBsaXN0DQo+IFRMU0BpZXRmLm9yZzxtYWlsdG86VExTQGlldGYub3JnPg0K PiBodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3Rscw0KDQpfX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KVExTIG1haWxpbmcgbGlzdA0K VExTQGlldGYub3JnPG1haWx0bzpUTFNAaWV0Zi5vcmc+DQpodHRwczovL3d3dy5pZXRmLm9yZy9t YWlsbWFuL2xpc3RpbmZvL3Rscw0KDQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fXw0KVExTIG1haWxpbmcgbGlzdA0KVExTQGlldGYub3JnPG1haWx0bzpUTFNA aWV0Zi5vcmc+DQpodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3Rscw0KDQo= --_000_DM5PR2201MB14332BE29A418B74DF8E2AD299310DM5PR2201MB1433_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 SGVsdmV0aWNhOw0KCXBhbm9zZS0xOjIgMTEgNiA0IDIgMiAyIDIgMiA0O30NCkBmb250LWZhY2UN Cgl7Zm9udC1mYW1pbHk6U2ltU3VuOw0KCXBhbm9zZS0xOjIgMSA2IDAgMyAxIDEgMSAxIDE7fQ0K QGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpTaW1TdW47DQoJcGFub3NlLTE6MiAxIDYgMCAzIDEg MSAxIDEgMTt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6 MiAxNSA1IDIgMiAyIDQgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseToiXEBTaW1T dW4iOw0KCXBhbm9zZS0xOjIgMSA2IDAgMyAxIDEgMSAxIDE7fQ0KLyogU3R5bGUgRGVmaW5pdGlv bnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWwsIGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2lu OjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEyLjBwdDsNCglmb250 LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIixzZXJpZjt9DQphOmxpbmssIHNwYW4uTXNvSHlwZXJs aW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpibHVlOw0KCXRleHQtZGVjb3Jh dGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJ e21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpwdXJwbGU7DQoJdGV4dC1kZWNvcmF0aW9u OnVuZGVybGluZTt9DQpwLm0tNTU2OTEzNjI2NDAzMzMzMjMzbXNnYm9yZGVyMSwgbGkubS01NTY5 MTM2MjY0MDMzMzMyMzNtc2dib3JkZXIxLCBkaXYubS01NTY5MTM2MjY0MDMzMzMyMzNtc2dib3Jk ZXIxDQoJe21zby1zdHlsZS1uYW1lOm1fLTU1NjkxMzYyNjQwMzMzMzIzM21zZ2JvcmRlcjE7DQoJ bXNvLW1hcmdpbi10b3AtYWx0OmF1dG87DQoJbWFyZ2luLXJpZ2h0OjBpbjsNCgltc28tbWFyZ2lu LWJvdHRvbS1hbHQ6YXV0bzsNCgltYXJnaW4tbGVmdDowaW47DQoJZm9udC1zaXplOjEyLjBwdDsN Cglmb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIixzZXJpZjt9DQpzcGFuLm0tNTU2OTEzNjI2 NDAzMzMzMjMzZ3JvdXB3aXNlcmVwbHloZWFkZXINCgl7bXNvLXN0eWxlLW5hbWU6bV8tNTU2OTEz NjI2NDAzMzMzMjMzZ3JvdXB3aXNlcmVwbHloZWFkZXI7fQ0Kc3Bhbi5FbWFpbFN0eWxlMTkNCgl7 bXNvLXN0eWxlLXR5cGU6cGVyc29uYWw7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2Vy aWY7DQoJY29sb3I6IzFGNDk3RDt9DQpzcGFuLkVtYWlsU3R5bGUyMA0KCXttc28tc3R5bGUtdHlw ZTpwZXJzb25hbC1jb21wb3NlOw0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0K CWNvbG9yOndpbmRvd3RleHQ7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhw b3J0LW9ubHk7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0KQHBhZ2UgV29y ZFNlY3Rpb24xDQoJe3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBpbiAxLjBp biAxLjBpbjt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi0tPjwv c3R5bGU+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWRlZmF1bHRzIHY6ZXh0PSJl ZGl0IiBzcGlkbWF4PSIxMDI2IiAvPg0KPC94bWw+PCFbZW5kaWZdLS0+PCEtLVtpZiBndGUgbXNv IDldPjx4bWw+DQo8bzpzaGFwZWxheW91dCB2OmV4dD0iZWRpdCI+DQo8bzppZG1hcCB2OmV4dD0i ZWRpdCIgZGF0YT0iMSIgLz4NCjwvbzpzaGFwZWxheW91dD48L3htbD48IVtlbmRpZl0tLT4NCjwv aGVhZD4NCjxib2R5IGxhbmc9IkVOLVVTIiBsaW5rPSJibHVlIiB2bGluaz0icHVycGxlIj4NCjxk aXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMt c2VyaWY7Y29sb3I6IzFGNDk3RCI+SGkgVGVkLDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNw OzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7 Y29sb3I6IzFGNDk3RCI+TXkgYXBvbG9naWVzIGZvciBiZWluZyBvcGFxdWUuJm5ic3A7IFRoZXJl IGFyZSBtYW55IGRpZmZlcmVudCBkZXZpY2UvYXBwbGljYXRpb25zL2luc3RhbGxhdGlvbnMgc28g SSBhbSBzb3JyeSBpZiBJIGFtIG1peGluZyBpZGVhcyBoZXJlLiZuYnNwOyBHZW5lcmFsbHkgdGhl IE5VTEwgY2lwaGVycw0KIGhhdmUgdGhlIGJlbmVmaXQgYXJvdW5kIGFsbG93aW5nIGhpZ2hlciBw ZXJmb3JtYW5jZSBmb3IgZGV2aWNlcyB0aGF0IGFyZSBsb3dlciBob3JzZXBvd2VyLiZuYnNwOyBD b2RlIHNwYWNlIGNhbiBjZXJ0YWlubHkgYmUgYSBjb25jZXJuLCBidXQgSSB0aGluayBmb3IgaW5k dXN0cmlhbCBhcHBsaWNhdGlvbnMgaXTigJlzIG1vcmUgYXJvdW5kIHRocm91Z2hwdXQgb2YgaGln aCBzcGVlZCBJL08sIGNvbWJpbmVkIHdpdGggdGhlIHVzZSBjYXNlcyB0aGF0IGRlcml2ZQ0KIGxp dHRsZSBiZW5lZml0IGZyb20gdGhlIGNvbmZpZGVudGlhbGl0eSBvZiB0aGlzIGRhdGEuJm5ic3A7 IOKAnEhvcnNlcG93ZXLigJ0gaXMgb2YgY291cnNlIGEgdmFndWUgdGVybSBpbiBvZiBpdHNlbGYs IHNvIGhlcmUgSeKAmW0gdGFsa2luZyBhYm91dCB0aGluZ3MgdGhhdCB3b3VsZCBpbXBhY3QgcGFj a2V0IHByb2Nlc3Npbmc7IHRoaXMgaW5jbHVkZXMgcHJvY2Vzc29yIHNwZWVkLCBhdmFpbGFibGUg aGlnaCBzcGVlZCBSQU0sIHByZXNlbmNlIG9mL2xhY2sgb2YgY3J5cHRvDQogYWNjZWxlcmF0aW9u IChub3QgaW4gbWFueSBJbmR1c3RyaWFsIEV0aGVybmV0IGRldmljZXMgYnV0IGdyb3dpbmcpLiZu YnNwOyBJIHdvdWxkbuKAmXQgcHV0IHRoZSBleGVjdXRhYmxlIGNvZGUgc2l6ZSBhcyBoaWdoIG9u IHRoZSBsaXN0IG9mIGNvbmNlcm5zIGFzIHRoZXNlIGl0ZW1zLCBhbHRob3VnaCB0aGVyZSBhcmUg Y2VydGFpbmx5IGRldmljZXMgdGhhdCBhcmUgbGltaXRlZCBpbiB0aGlzLiZuYnNwOyBUaGlzIGhv cnNlcG93ZXIgbGltaXRhdGlvbiBpcyBkaXJlY3RseQ0KIHJlbGF0ZWQgdG8gdGhlIGZhY3QgdGhh dCB0aGVzZSBkZXZpY2VzIGFyZSBleHBlY3RlZCB0byBmdW5jdGlvbiBmb3IgbWFueSB5ZWFycy48 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2Vy aWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPknigJltIGhhcHB5IHRv IGNsYXJpZnkgYW55IG9mIHRoZXNlIHBvaW50cyBmdXJ0aGVyIGlmIG5lZWRlZC48bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6 IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJy aSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPlRoYW5rcyBhbmQgQmVzdCBSZWdhcmRz LDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1z ZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+LS1KYWNrPG86cD48 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2Nv bG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+RnJvbTo8L3NwYW4+PC9iPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJp ZiI+IFRlZCBMZW1vbiBbbWFpbHRvOm1lbGxvbkBmdWd1ZS5jb21dDQo8YnI+DQo8Yj5TZW50Ojwv Yj4gVHVlc2RheSwgQXVndXN0IDIxLCAyMDE4IDEwOjU4IEFNPGJyPg0KPGI+VG86PC9iPiBKYWNr IFZpc29reSAmbHQ7am12aXNva3lAcmEucm9ja3dlbGwuY29tJmd0Ozxicj4NCjxiPkNjOjwvYj4g QW5kcmVhcyBXYWx6ICZsdDthbmRyZWFzLndhbHpAaHMtb2ZmZW5idXJnLmRlJmd0OzsgdGxzQGll dGYub3JnOyBuY2Ftd2luZz00MGNpc2NvLmNvbUBkbWFyYy5pZXRmLm9yZzxicj4NCjxiPlN1Ympl Y3Q6PC9iPiBSZTogW1RMU10gRVhURVJOQUw6IFJlOiBpbnRlZ3JpdHkgb25seSBjaXBoZXJzdWl0 ZXM8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNw OzwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5UaGFua3MsIEphY2ssIGJ1 dCBjb3VsZCB5b3UgcmVzcG9uZCB0byB0aGUgc3BlY2lmaWMgcXVlc3Rpb25zIHRoYXQgd2UgYXNr ZWQgeW91PyZuYnNwOyAmbmJzcDtFYXJsaWVyIHlvdSB3ZXJlIHNheWluZyB0aGF0IHlvdXIgbW90 aXZhdGlvbiBmb3IgdXNpbmcgTlVMTCBjaXBoZXJzIHdhcyB0aGF0IHlvdSBoYWQgc3BlY2lmaWMg aGFyZHdhcmUgdGhhdCBjb3VsZG4ndCBpbXBsZW1lbnQgZW5jcnlwdGlvbiBkdWUgdG8gbGFjayBv Zg0KIGhvcnNlcG93ZXIgb3IgbWVtb3J5LiZuYnNwOyAmbmJzcDtOb3cgeW91IHNlZW0gdG8gYmUg c2F5aW5nIHNvbWV0aGluZyBjb21wbGV0ZWx5IGRpZmZlcmVudC4mbmJzcDsgJm5ic3A7SXQncyBn b2luZyB0byBiZSBkaWZmaWN1bHQgZm9yIHVzIHRvIHVuZGVyc3RhbmQgeW91ciByZXF1aXJlbWVu dHMgaWYgeW91IHRhbGsgYWJvdXQgZGlmZmVyZW50IHRoaW5ncyBpbiBlYWNoIG1lc3NhZ2UuPG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZu YnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5PbiBUdWUsIEF1ZyAy MSwgMjAxOCBhdCAxMDoyNyBBTSwgSmFjayBWaXNva3kgJmx0OzxhIGhyZWY9Im1haWx0bzpqbXZp c29reUByYS5yb2Nrd2VsbC5jb20iIHRhcmdldD0iX2JsYW5rIj5qbXZpc29reUByYS5yb2Nrd2Vs bC5jb208L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjxibG9ja3F1b3RlIHN0eWxlPSJi b3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGluIDBp biAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXJpZ2h0OjBpbiI+DQo8ZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0 bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5 N0QiPihJ4oCZbSByZXNwb25kaW5nJm5ic3A7IGEgZmV3IGRpZmZlcmVudCBwb2ludHMgbWFkZSBo ZXJlKTwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt c28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90Oyxz YW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFy Z2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPkluIGdl bmVyYWwsIGFsdGhvdWdoIHRoaXMgc2VlbXMgbGlrZSBhIG5pY2hlIGFwcGxpY2F0aW9uLCB0aGVy ZSBhcmUgYWN0dWFsbHkgbWlsbGlvbnMgb2YgSW5kdXN0cmlhbA0KIEV0aGVybmV0IG5vZGVzLCB3 aXRoIHRoZSBudW1iZXJzIHRyZW5kaW5nIHVwd2FyZC4mbmJzcDsgQXMgbWVudGlvbmVkLCBtYW55 IG9mIHRoZXNlIGFyZSByZWx5aW5nIG9uIG9sZGVyIHByb3RvY29scyBkZXNpZ25lZCB3aXRob3V0 IHNlY3VyaXR5IGluIG1pbmQuJm5ic3A7IE91ciBpbmR1c3RyeSBoYXMgaGFkIGEgZGViYXRlIGFy b3VuZCB1c2luZyBUTFMgdnMuIGNyZWF0aW5nIHNvbWV0aGluZyBzcGVjaWZpYy4mbmJzcDsgTWFu eSBvZiB1cyBwcmVmZXIgdG8gcmVseSBvbg0KIHRoZSBzZWN1cml0eSBiZW5lZml0cyBvZiBUTFMu Jm5ic3A7IFRvIGFub3RoZXIgcG9pbnQsIGFsdGhvdWdoIEkgd29yayBmb3IgUm9ja3dlbGwgQXV0 b21hdGlvbiwgaGVyZSBJIGFtIHdvcmtpbmcgaW4gbXkgY2FwYWNpdHkgd2l0aGluIE9EVkEsIGEg c3RhbmRhcmRzIGdyb3VwIGZvciBJbmR1c3RyaWFsIENvbW11bmljYXRpb25zIHRoYXQgaGFzIHNl dmVyYWwgbGFyZ2UgdmVuZG9ycyBhcyBtZW1iZXJzLiZuYnNwOyBXZSBoYXZlIGFkb3B0ZWQgVExT IHRvIHByb3RlY3QNCiBvdXIgaW5kdXN0cmlhbCBFdGhlcm5ldCB0cmFmZmljLCBhbmQgb25lIG9m IHRoZSBzZWxsaW5nIHBvaW50cyBvZiBUTFMgMS4yIHdhcyB0aGUgYWJpbGl0eSB0byB1c2UgTlVM TCBlbmNyeXB0aW9uLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0 byI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJy aSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0 bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5 N0QiPk5VTEwgZW5jcnlwdGlvbiBpcyBub3QgcmVhbGx5IGFzIG11Y2ggYWJvdXQgY29kZSBzaXpl IGJ1dCBjYXBhYmlsaXR5IG9mIHRoZSBkZXZpY2VzLiZuYnNwOyBUaGUgVExTIGhhbmRzaGFrZQ0K IG9mIGNvdXJzZSBjb250YWlucyBzb21lIOKAnGhlYXZ5d2VpZ2h04oCdIG9wZXJhdGlvbnMsIGFs dGhvdWdoIGhhbmRzaGFrZXMgYXJlIHByZXR0eSBpbmZyZXF1ZW50IGFzIHRoZXNlIGNvbm5lY3Rp b25zIGFyZSBvZnRlbiBxdWl0ZSBsb25nLWxpdmVkLiZuYnNwOyBPbmNlIHRoZSBoYW5kc2hha2Ug aXMgb3ZlciwgdGhlIEkvTyBkYXRhIHRoYXQgaXMgdHJhbnNmZXJyZWQgaXMgb2Z0ZW4gcXVpdGUg c2Vuc2l0aXZlIHRvIGxhdGVuY3ksIGFuZCBhbHRob3VnaCB0aGUNCiBlbmNyeXB0aW9uIG92ZXJo ZWFkIG1pZ2h0IG5vdCBzZWVtIGxpa2UgbXVjaCB3aGVuIHRoZSBITUFDIGlzIGNvbnNpZGVyZWQs IGl0IGlzIHN0aWxsIGEgY2FzZSB3aGVyZSBpbiBtYW55IGFwcGxpY2F0aW9ucyBldmVyeSBiaXQg Y291bnRzLiZuYnNwOyBSZWdhcmRpbmcgb2xkZXIgaGFyZHdhcmUgdGhhdCBleGlzdHMgZm9yIG1h bnkgeWVhcnMsIHNvbWUgaGFyZHdhcmUgZG9lcyBoYXZlIGNyeXB0b2dyYXBoaWMgYWNjZWxlcmF0 aW9uIGFsdGhvdWdoIG1heQ0KIG5vdCBoYXZlIEFFUy1HQ00sIHJhdGhlciBTSEEtMjU2IEhNQUMu Jm5ic3A7IEFsdGVybmF0aXZlbHksIHRoZSBoYXJkd2FyZSBtaWdodCBub3QgaGF2ZSBhbnkgY3J5 cHRvIGFjY2VsZXJhdGlvbiBhcyBpdCB3YXMgZGVzaWduZWQgd2l0aG91dCBUTFMgaW4gbWluZC4m bmJzcDsgQXQgdGhlIHNhbWUgdGltZSB3ZeKAmWQgbGlrZSB0byBzZWN1cmUgdGhpcyB0cmFmZmlj IHZpYSBhIGZpcm13YXJlIHVwZ3JhZGUuJm5ic3A7IERlc3BpdGUgdGhpcywgaWYgdXNpbmcgZW5j cnlwdGlvbg0KIGRyb3BzIHBlcmZvcm1hbmNlIGVub3VnaCB1c2VycyB3aWxsIHNpbXBseSBub3Qg dXNlIGl0LCB3aGljaCBpcyBhIG5ldCB3b3JzZSBvdXRjb21lLiZuYnNwOyBVc2VycyB3aWxsIGxp a2VseSBub3QgdXBncmFkZSBoYXJkd2FyZSBmb3IgbWFueSB5ZWFycyBkdWUgdG8gYSB2YXJpZXR5 IG9mIGluZHVzdHJ5IGZhY3RvcnMuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9t LWFsdDphdXRvIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+Jm5ic3A7PC9zcGFuPjxv OnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9w LWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29s b3I6IzFGNDk3RCI+S2F0aGxlZW7igJlzIGNvbW1lbnQgYWJvdXQgZGVmaW5pbmcgTlVMTCBlbmNy eXB0aW9uIGJ1dCBiZWluZyBjbGVhciBhYm91dCB0aGUgcmlza3MgcmVzb25hdGVzIHdpdGggbWUu Jm5ic3A7DQogSeKAmW0gY2VydGFpbmx5IG5vdCBzdWdnZXN0aW5nIHRoYXQgTlVMTCBlbmNyeXB0 aW9uIGlzIG5lZWRlZCBpbiBhbGwgY2FzZXMsIGJ1dCB0aGVyZSBhcmUgdGltZXMgKGFzIGRpc2N1 c3NlZCBoZXJlIGFuZCBpbiB0aGUgUkZDIGRyYWZ0KSB3aGVyZSBpdCBjb3VsZCBiZSBxdWl0ZSBi ZW5lZmljaWFsLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZx dW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bztt c28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0Qi PlRoYW5rcyBhbmQgQmVzdCBSZWdhcmRzLDwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJv dHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPiZuYnNwOzwvc3Bh bj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2lu LXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlm O2NvbG9yOiMxRjQ5N0QiPi0tSmFjazwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRv bS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPiZuYnNwOzwvc3Bhbj48 bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9w OnNvbGlkICNFMUUxRTEgMS4wcHQ7cGFkZGluZzozLjBwdCAwaW4gMGluIDBpbiI+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1i b3R0b20tYWx0OmF1dG8iPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+RnJvbTo8L3NwYW4+PC9iPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZiI+IFRMUyBbbWFpbHRvOjxhIGhyZWY9Im1haWx0bzp0bHMtYm91bmNlc0BpZXRm Lm9yZyIgdGFyZ2V0PSJfYmxhbmsiPnRscy1ib3VuY2VzQGlldGYub3JnPC9hPl0NCjxiPk9uIEJl aGFsZiBPZiA8L2I+QW5kcmVhcyBXYWx6PGJyPg0KPGI+U2VudDo8L2I+IFR1ZXNkYXksIEF1Z3Vz dCAyMSwgMjAxOCA5OjM3IEFNPGJyPg0KPGI+VG86PC9iPiA8YSBocmVmPSJtYWlsdG86dGxzQGll dGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+dGxzQGlldGYub3JnPC9hPjxicj4NCjxiPkNjOjwvYj4g bmNhbXdpbmc9PGEgaHJlZj0ibWFpbHRvOjQwY2lzY28uY29tQGRtYXJjLmlldGYub3JnIiB0YXJn ZXQ9Il9ibGFuayI+NDBjaXNjby5jb21AZG1hcmMuaWV0Zi5vcmc8L2E+PGJyPg0KPGI+U3ViamVj dDo8L2I+IEVYVEVSTkFMOiBSZTogW1RMU10gaW50ZWdyaXR5IG9ubHkgY2lwaGVyc3VpdGVzPC9z cGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0 byI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOnNvbGlk ICNCQjIzMjIgMi4yNXB0O3BhZGRpbmc6Mi4wcHQgMi4wcHQgMi4wcHQgMi4wcHQiPg0KPHAgY2xh c3M9Im0tNTU2OTEzNjI2NDAzMzMzMjMzbXNnYm9yZGVyMSIgc3R5bGU9ImxpbmUtaGVpZ2h0OjEy LjBwdDtiYWNrZ3JvdW5kOiNFOEU4RTgiPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOmJsYWNrIj5b VXNlIGNhdXRpb24gd2l0aCBsaW5rcyAmYW1wOyBhdHRhY2htZW50c108L3NwYW4+PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1t YXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fu cy1zZXJpZiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXYgaWQ9Im1f LTU1NjkxMzYyNjQwMzMzMzIzM0dyb3VwV2lzZVNlY3Rpb25fMTUzNDg1ODEzNzAwMF9hbmRyZWFz LndhbHpAaHMtb2ZmZW5idXJnLmRlX0ZFN0M5MTQwMEQxOTAwMDBCN0E5MkI3QTNDODlGNzZBXyI+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDph dXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEw LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+JiM0Mzsx PGJyPg0KPGJyPg0KSSBmdWxseSB1bmRlcnN0YW5kIHRoZSBwdXJzdWl0IG9mIG1pbmltaXppbmcg Y29tcGxleGl0eSBpbiBUTFMuIEhvd2V2ZXIsIGJhbm5pbmcgZnJvbSBUTFMgYWxsIHByb3Zpc2lv bnMgdG8gc2VydmUgbm9uLWludGVybmV0IGNhc2VzIHNlZW1zIHN1Ym9wdGltYWwgdG8gbWUuPGJy Pg0KPGJyPg0KSSB0aGluayB0aGVyZSBpcyBhIHdob2xlIHVuaXZlcnNlIG9mIHN5c3RlbXMgYW5k IGFwcGxpY2F0aW9ucyB0aGF0IGFyZSBqdXN0IGF0IHRoZSB2ZXJ5IGJlZ2lubmluZyBvZiBiZWlu ZyBhcm1lZCB3aXRoIHNlY3VyaXR5IGZlYXR1cmVzOiB0aGluayBvZiBjb21tdW5pY2F0aW9uIHN5 c3RlbXMgZHJpdmluZywgZS5nLiwgaW5kdXN0cmlhbCBhdXRvbWF0aW9uIGFuZCBjcml0aWNhbCBp bmZyYXN0cnVjdHVyZXMuIFRoZXNlIGFyZSBxdWl0ZSBkaWZmZXJlbnQNCiBmcm9tIHRoZSBpbnRl cm5ldCBhbmQgdGhlIHdlYiAoZGlmZmVyZW50IHRocmVhdHMsIHNlY3VyaXR5IHJlcXVpcmVtZW50 cywgYXJjaGl0ZWN0dXJlcywgbmV0d29ya3MsIHJlc291cmNlcywgZXRjLikuIFN0aWxsLCBJTUhP IGl0J3Mgbm90IGEgbmljaGUgYXQgYWxsOyBpdCdzIGp1c3Qgbm90IGFzIHZpc2libGUgdG8gbW9z dCBvZiB1cy48YnI+DQo8YnI+DQpJIHN0cm9uZ2x5IGJlbGlldmUgaXQgaXMgKm5vdCogYSBnb29k IGlkZWEgdG8gaG9sZCBiYWNrIGFsbCB0aGUgdmFsdWFibGUgZXhwZXJpZW5jZSBjb25kZW5zZWQg aW4gVExTIGFuZCBlbnRhaWwgdGhlIGRlc2lnbiBvZiBjdXN0b21pemVkIHNlY3VyaXR5IHByb3Rv Y29scyBmb3Igc3VjaCBzeXN0ZW1zLiBUTFMgaXMgc3RhdGUtb2YtdGhlLWFydCBhbmQgaXRzIGJl bmVmaXRzIHNob3VsZCBiZSBhY2Nlc3NpYmxlIHRvIGFzIG1hbnkgc3lzdGVtcyBhcw0KIHBvc3Np YmxlLiA8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20t YWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10 b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlm Ij5DaGVlcnMsPGJyPg0KQW5kaSBXYWx6IDwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0 bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzwv c3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVv dDssc2Fucy1zZXJpZiI+PGJyPg0KPHNwYW4gY2xhc3M9Im0tNTU2OTEzNjI2NDAzMzMzMjMzZ3Jv dXB3aXNlcmVwbHloZWFkZXIiPiZndDsmZ3Q7Jmd0OyBLYXRobGVlbiZuYnNwO01vcmlhcnR5Jm5i c3A7Jmx0OzxhIGhyZWY9Im1haWx0bzprYXRobGVlbi5tb3JpYXJ0eS5pZXRmQGdtYWlsLmNvbSIg dGFyZ2V0PSJfYmxhbmsiPmthdGhsZWVuLm1vcmlhcnR5LmlldGZAZ21haWwuY29tPC9hPiZndDsg MDgvMjEvMTggMzoyMCBQTSAmZ3Q7Jmd0OyZndDs8L3NwYW4+PGJyPg0KPGJyPg0KPGJyPg0KU2Vu dCBmcm9tIG15IG1vYmlsZSBkZXZpY2U8YnI+DQo8YnI+DQomZ3Q7IE9uIEF1ZyAyMSwgMjAxOCwg YXQgODoxMCBBTSwgQmx1bWVudGhhbCwgVXJpIC0gMDU1MyAtIE1JVExMICZsdDs8YSBocmVmPSJt YWlsdG86dXJpQGxsLm1pdC5lZHUiIHRhcmdldD0iX2JsYW5rIj51cmlAbGwubWl0LmVkdTwvYT4m Z3Q7IHdyb3RlOjxicj4NCiZndDsgPGJyPg0KJmd0OyAmcXVvdDtWdWxuZXJhYmxlLWJ5LWRlc2ln biBjaXBoZXJzdWl0ZXMmcXVvdDs/IFZ1bG5lcmFibGUgdG8gd2hhdD8gPGJyPg0KJmd0OyA8YnI+ DQomZ3Q7IFN1Y2sgc2l0ZXMgYXJlIGRlc2lnbmVkIHRvIHByb3ZpZGUgZW5kLXBvaW50IGF1dGhl bnRpY2F0aW9uIGFuZCB0cmFmZmljIGludGVncml0eS4gQ2FyZSB0byBleHBsYWluL3Nob3cgaG93 IHRoZXNlIHByb3BlcnRpZXMgd291bGQgbm90IGhvbGQ/PGJyPg0KJmd0OyA8YnI+DQomZ3Q7IEJl c2lkZXMsIGl0J3MgYmVlbiBleHBsYWluZWQgc2V2ZXJhbCB0aW1lcyB0aGF0IHNvbWUgdXNlIGNh c2VzIGRvIG5vdCByZXF1aXJlIGNvbmZpZGVudGlhbGl0eSwgYW5kIGluIHNvbWUgdXNlIGNhc2Vz IGNvbmZpZGVudGlhbGl0eSBpcyBmb3JiaWRkZW4uPGJyPg0KPGJyPg0KSSBhZ3JlZSB3aXRoIFVy aSBoZXJlLCBmbGV4aWJpbGl0eSB0byBjb3ZlciB0aGVzZSB1c2UgY2FzZXMgdG8gYWNjb21tb2Rh dGUgdGhlIGFjdHVhbCBzZWN1cml0eSByZXF1aXJlbWVudHMgbWF5IHJlc3VsdCBpbiB0aGVtIHVz aW5nIHNvbWV0aGluZyBpbnN0ZWFkIG9mIG5vdGhpbmcuIEl0IGNvdWxkIGJlIGRlZmluZWQgYW5k IG5vdCBsaXN0ZWQgYXMgUmVjb21tZW5kZWQgYXMgd2VsbC4gVGhpcyBjb21lcyBkb3duIHRvIHJp c2sgbWFuYWdlbWVudA0KIGFuZCBvcHRpb25zLCB3aGVyZSB0aGUgcmlzayBjYW4gYmUgY2xlYXJs eSBleHBsYWluZWQgYW5kIHRoZSBsYWNrIG9mIHJlY29tbWVuZGF0aW9uIGNhbiBhbHNvIGJlIGV4 cGxhaW5lZC48YnI+DQo8YnI+DQpCZXN0IHJlZ2FyZHMsPGJyPg0KS2F0aGxlZW4gPGJyPg0KPGJy Pg0KJmd0OyA8YnI+DQomZ3Q7IFJlZ2FyZHMsPGJyPg0KJmd0OyBVcmk8YnI+DQomZ3Q7IDxicj4N CiZndDsgU2VudCBmcm9tIG15IGlQaG9uZTxicj4NCiZndDsgPGJyPg0KJmd0OyZndDsgT24gQXVn IDIxLCAyMDE4LCBhdCAwNzo0MiwgU3RlcGhlbiBGYXJyZWxsICZsdDs8YSBocmVmPSJtYWlsdG86 c3RlcGhlbi5mYXJyZWxsQGNzLnRjZC5pZSIgdGFyZ2V0PSJfYmxhbmsiPnN0ZXBoZW4uZmFycmVs bEBjcy50Y2QuaWU8L2E+Jmd0OyB3cm90ZTo8YnI+DQomZ3Q7Jmd0OyA8YnI+DQomZ3Q7Jmd0OyA8 YnI+DQomZ3Q7Jmd0OyA8YnI+DQomZ3Q7Jmd0OyZndDsgT24gMjAvMDgvMTggMjE6NDgsIE5hbmN5 IENhbS1XaW5nZXQgKG5jYW13aW5nKSB3cm90ZTo8YnI+DQomZ3Q7Jmd0OyZndDsgQWxsLCBBIGNv dXBsZSBJb1QgY29uc29ydGl1bXMgYXJlIHRyeWluZyB0byBlbWJyYWNlIHRoZSBpbXByb3ZlbWVu dHM8YnI+DQomZ3Q7Jmd0OyZndDsgbWFkZSB0byBUTFMgMS4zIGFuZCBhcyB0aGV5IGRlZmluZSB0 aGVpciBuZXcgc2VjdXJpdHkgY29uc3RydWN0czxicj4NCiZndDsmZ3Q7Jmd0OyB3b3VsZCBsaWtl IHRvIGFkb3B0IHRoZSBsYXRlc3QgcHJvdG9jb2xzLCBpbiB0aGlzIGNhc2UgVExTIDEuMy4gVG88 YnI+DQomZ3Q7Jmd0OyZndDsgdGhhdCBleHRlbnQsIHRoZXkgaGF2ZSBhIHN0cm9uZyBuZWVkIGZv ciBtdXR1YWwgYXV0aGVudGljYXRpb24sIGJ1dDxicj4NCiZndDsmZ3Q7Jmd0OyBpbnRlZ3JpdHkg b25seSAobm8gY29uZmlkZW50aWFsaXR5KSByZXF1aXJlbWVudHMuPGJyPg0KJmd0OyZndDsmZ3Q7 IDxicj4NCiZndDsmZ3Q7Jmd0OyBJbiBmb2xsb3dpbmcgdGhlIG5ldyBJQU5BIHJ1bGVzLCB3ZSBo YXZlIHBvc3RlZCB0aGUgZHJhZnQ8YnI+DQomZ3Q7Jmd0OyZndDsgPGEgaHJlZj0iaHR0cHM6Ly90 b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LWNhbXdpbmdldC10bHMtdHMxMy1tYWNjaXBoZXJzdWl0 ZXMtMDAiIHRhcmdldD0iX2JsYW5rIj4NCmh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFm dC1jYW13aW5nZXQtdGxzLXRzMTMtbWFjY2lwaGVyc3VpdGVzLTAwPC9hPjxicj4NCiZndDsmZ3Q7 Jmd0OyB0byBkb2N1bWVudCByZXF1ZXN0IGZvciByZWdpc3RyYXRpb25zIG9mIEhNQUMgYmFzZWQg Y2lwaGVyIHNlbGVjdGlvbnM8YnI+DQomZ3Q7Jmd0OyZndDsgd2l0aCBUTFMgMS4z4oCmLi5hbmQg YXJlIHNvbGljaXRpbmcgZmVlZGJhY2sgZnJvbSB0aGUgV0cgb24gdGhlIGRyYWZ0PGJyPg0KJmd0 OyZndDsmZ3Q7IGFuZCBpdHMgcGF0aCBmb3J3YXJkLjxicj4NCiZndDsmZ3Q7IDxicj4NCiZndDsm Z3Q7IEFzIGVrciBwb2ludGVkIG91dCwgd2l0aCB0aGUgbmV3IHJlZ2lzdHJhdGlvbiBydWxlcyw8 YnI+DQomZ3Q7Jmd0OyB0aGVyZSdzIG5vdGhpbmcgdG8gc3RvcCBzb21lb25lIGRlZmluaW5nIGFu eSBvbGQgc2V0PGJyPg0KJmd0OyZndDsgb2YgY3J5cHRvIHN0dWZmIGFuZCBnZXR0aW5nIG5vbi1y ZWNvbW1lbmRlZCBjb2RlcG9pbnRzLjxicj4NCiZndDsmZ3Q7IDxicj4NCiZndDsmZ3Q7IFRoYXQg c2FpZCwgSSBkb24ndCBjb25zaWRlciB0aGF0IGRlZmluaW5nIHN1Y2g8YnI+DQomZ3Q7Jmd0OyB2 dWxuZXJhYmxlLWJ5LWRlc2lnbiBjaXBoZXJzdWl0ZXMgaXMgYSBnb29kIHBsYW4uPGJyPg0KJmd0 OyZndDsgPGJyPg0KJmd0OyZndDsgLSBJdCBpbXBvc2VzIGNvc3RzIG9uIHRoZSBub24tbmljaGUg dXNlcnMgb2YgVExTIC0gb25jZTxicj4NCiZndDsmZ3Q7IHRoZXNlIHRoaW5ncyBhcmUgZGVmaW5l ZCB0aGVuIGRldmVsb3BlcnMgYW5kIHRob3NlIHdobzxicj4NCiZndDsmZ3Q7IGRlcGxveS9jb25m aWd1cmUgYXBwbGljYXRpb25zIHVzaW5nIFRMUyBuZWVkIHRvIGNoZWNrPGJyPg0KJmd0OyZndDsg dGhhdCB0aGV5J3JlIG5vdCB1c2luZyB0aGVzZSB1bmRlc2lyYWJsZSBjaXBoZXJzdWl0ZXMsPGJy Pg0KJmd0OyZndDsgc28gY29zdHMgYXJlIGJlaW5nIGRpc3BsYWNlZCBmcm9tIG5pY2hlIHVzZXMg dG8gdGhlPGJyPg0KJmd0OyZndDsgdmFzdCBtYWpvcml0eSBvZiBpbXBsZW1lbnRhdGlvbnMgYW5k IGRlcGxveW1lbnRzLCB3aGljaDxicj4NCiZndDsmZ3Q7IHNlZW1zIHRvIG1lIHRvIGJlIGEgYmFk IGlkZWEuIEFuZCB3ZSBrbm93IHRoYXQgcGVvcGxlPGJyPg0KJmd0OyZndDsgd2lsbCBzb21ldGlt ZXMgZ2V0IHRob3NlIGNoZWNrcyB3cm9uZyBsZWFkaW5nIHRvIHVuZXhwZWN0ZWQ8YnI+DQomZ3Q7 Jmd0OyB0cmFuc21pc3Npb24gb2YgcGxhaW50ZXh0IG92ZXIgdGhlIEludGVybmV0Ljxicj4NCiZn dDsmZ3Q7IDxicj4NCiZndDsmZ3Q7IC0gU2ltaWxhcmx5LCBqdXN0IGRlZmluaW5nIHN1Y2ggY2lw aGVyc3VpdGVzIHNlZW1zIGxpa2VseTxicj4NCiZndDsmZ3Q7IHRvIGxlYWQgdG8gbGVzcyB3ZWxs IHRlc3RlZCBhbmQgaW5mcmVxdWVudGx5IHVzZWQgY29kZTxicj4NCiZndDsmZ3Q7IHBhdGhzLCB3 aGljaCBpcyB1bmRlc2lyYWJsZS4gKEFzc3VtaW5nIHNvbWVvbmUgcGF5cyBzb21lPGJyPg0KJmd0 OyZndDsgZGV2ZWxvcGVyIHRvIGFkZCB0aGVzZSB0byBzb21lIGxpYnJhcnksIHdoaWNoIGdlbmVy YWxseTxicj4NCiZndDsmZ3Q7IGRvZXMgc2VlbSB0byBoYXBwZW4uKTxicj4NCiZndDsmZ3Q7IDxi cj4NCiZndDsmZ3Q7IC0gUkZDNzUyNSBbMV0gaXMgY2xlYXIgb24gdGhpcyB0b3BpYyAoYWZ0ZXIg ZGViYXRlIGluIHRoZTxicj4NCiZndDsmZ3Q7IFVUQSBXRykgLSAmcXVvdDtJbXBsZW1lbnRhdGlv bnMgTVVTVCBOT1QgbmVnb3RpYXRlIHRoZSBjaXBoZXI8YnI+DQomZ3Q7Jmd0OyBzdWl0ZXMgd2l0 aCBOVUxMIGVuY3J5cHRpb24mcXVvdDsgYW5kIEkgc2VlIG5vdGhpbmcgbmV3IHRvPGJyPg0KJmd0 OyZndDsgY29udmluY2UgbWUgdGhhdCB0aGF0IG91Z2h0IGNoYW5nZSBmb3IgVExTMS4zLjxicj4N CiZndDsmZ3Q7IDxicj4NCiZndDsmZ3Q7IC0gQ29kZSBmb290cHJpbnQgYXJndW1lbnRzIGFyZW4n dCB0aGF0IGNvbnZpbmNpbmcgdG88YnI+DQomZ3Q7Jmd0OyBtZSAtIHRvIGdldCBpbnRlcm9wIGZv ciB0aGUgZmV3IGRldmljZXMgd2hlcmUgQUVTIGJlaW5nPGJyPg0KJmd0OyZndDsgcHJlc2VudCBv ciBhYnNlbnQgY291bGQgbWFrZSBhIHJlYWwgZGlmZmVyZW5jZSwgeW91J2Q8YnI+DQomZ3Q7Jmd0 OyBuZWVkIGFuIGF3ZnVsIGxvdCBtb3JlIHByb2ZpbGluZyBvZiBUTFMgb3IgRFRMUy4gSSBkb24n dDxicj4NCiZndDsmZ3Q7IHNlZSBldmlkZW5jZSBvZiB0aGF0IHNvIHRoZSBpbnRlcm9wL2Zvb3Rw cmludCBhcmd1bWVudHM8YnI+DQomZ3Q7Jmd0OyBzZWVtIHByZXR0eSB3ZWFrLiBJJ2QgYWxzbyBi ZXQgdGhhdCBhbnkgdXNlZnVsICZxdW90O3Rpbnk8YnI+DQomZ3Q7Jmd0OyBmb290cHJpbnQmcXVv dDsgcHJvZmlsZSBvZiB0aGF0IGtpbmQgd291bGQgZW5kIHVwIHRhcmdldGluZzxicj4NCiZndDsm Z3Q7IGxvYWRzIG9mIHVzZS1jYXNlcyB3aGVyZSBjb25maWRlbnRpYWxpdHkgaXMgYWJzb2x1dGVs eTxicj4NCiZndDsmZ3Q7IHJlcXVpcmVkLjxicj4NCiZndDsmZ3Q7IDxicj4NCiZndDsmZ3Q7IC0g KEluIGFkZGl0aW9uIHRvIHRoZSBnb29kIHBvaW50cyBtYWRlIGJ5IEdlb2ZmcmV5PGJyPg0KJmd0 OyZndDsgS2VhdGluZyBbMl0pIGNsZWFydGV4dCBwYXlsb2FkcyB3b3VsZCBhbHNvIGFzc2lzdCBp bjxicj4NCiZndDsmZ3Q7IGRldmljZSBmaW5nZXJwcmludGluZywgbWFraW5nIGl0IGVhc2llciB0 byBleHBsb2l0PGJyPg0KJmd0OyZndDsgdnVsbmVyYWJpbGl0aWVzIGF0IHNjYWxlLjxicj4NCiZn dDsmZ3Q7IDxicj4NCiZndDsmZ3Q7IC0gSUlVQyB0aGVyZSBpcyBhbHNvIGEgZGVzaXJlIHRvIGVu Y3J5cHQgZmlybXdhcmU8YnI+DQomZ3Q7Jmd0OyB1cGRhdGVzIHNvIHRoYXQgcGF0Y2hlcyBjYW4g YmUgZGlzdHJpYnV0ZWQgbW9yZSBxdWlja2x5PGJyPg0KJmd0OyZndDsgdGhhbiBhdHRhY2tlcnMg Y2FuIHJldmVyc2UtZW5naW5lZXIgYXR0YWNrcy4gWzRdIEknbTxicj4NCiZndDsmZ3Q7IG5vdCBl bnRpcmVseSBzdXJlIGlmIHRoYXQncyByZWFsbHkgbGlrZWx5IHRvIGhhcHBlbiw8YnI+DQomZ3Q7 Jmd0OyBidXQgaWYgaXQgd2VyZSwgdGhlbiBkZXZpY2VzIHdvdWxkIG5lZWQgdG8gYmUgYWJsZSB0 bzxicj4NCiZndDsmZ3Q7IHVzZSByZWNvbW1lbmRlZCBjaXBoZXJzdWl0ZXMgaW4gYW55IGNhc2Uu PGJyPg0KJmd0OyZndDsgPGJyPg0KJmd0OyZndDsgLSBUTFMvQVguMjUgZG9lc24ndCBzZWVtIHRo YXQgZ29vZCBhIHBsYW4gaW4gYW55PGJyPg0KJmd0OyZndDsgY2FzZSAtIGFjY29yZGluZyB0byBb M10sIHdoaWNoIHNlZW1zIHJlYXNvbmFibGUgdG88YnI+DQomZ3Q7Jmd0OyBtZSwgdXNpbmcgY2xl YXItc2lnbmVkIEdQRyBpcyBxdWlja2VyIGFuZCBiZXR0ZXI8YnI+DQomZ3Q7Jmd0OyBtZWV0cyB0 aGUgb2RkYmFsbCByZWd1bGF0aW9ucy4gQXR0ZW1wdGluZyB0byBkZWFsPGJyPg0KJmd0OyZndDsg d2l0aCB0aG9zZSByZWd1bGF0aW9ucyBieSB3ZWFrZW5pbmcgVExTIHNlZW1zIGxpa2U8YnI+DQom Z3Q7Jmd0OyBhIHZlcnkgYmFkIHBsYW4sIGFzIHlvdSdkIGZhaWwgaW4gYW55IGNhc2UgdG8gYWNo aWV2ZTxicj4NCiZndDsmZ3Q7IGludGVyb3Agd2l0aCBub3JtYWwgVExTIGFwcGxpY2F0aW9ucyBs aWtlIHRoZSB3ZWIuPGJyPg0KJmd0OyZndDsgKEFuZCB0aGUgYWR2ZXJ0aXNpbmcgaXMgYXMgaWxs ZWdhbCBhcyB0aGUgY3J5cHRvPGJyPg0KJmd0OyZndDsgYXBwYXJlbnRseSwgdGhvdWdoIEkgZG8g bGlrZSB0aGF0IGFzcGVjdDotKTxicj4NCiZndDsmZ3Q7IDxicj4NCiZndDsmZ3Q7IC0gV1JUIHVu aXggc29ja2V0cywgSSdtIG5vdCBjbGVhciB0aGF0IHRoZXJlJ3MgYTxicj4NCiZndDsmZ3Q7IHN1 ZmZpY2llbnRseSBpbXBvcnRhbnQgcGVyZm9ybWFuY2UgaW1wcm92ZW1lbnQgaW48YnI+DQomZ3Q7 Jmd0OyByZWFsIGRlcGxveW1lbnRzIHRvIGp1c3RpZnkgaW50cm9kdWNpbmcgd2Vha2VuZWQ8YnI+ DQomZ3Q7Jmd0OyBjaXBoZXJzdWl0ZXMgLSBwcmVzdW1hYmx5IG1haWwgc2VydmVycyBhcmUgZ29p bmcgdG88YnI+DQomZ3Q7Jmd0OyB1c2Ugc3RhbmRhcmQgVExTIGxpYnJhcmllcyB0aGF0IChJIGhv cGUhKSB3b24ndCBiZTxicj4NCiZndDsmZ3Q7IG9mZmVyaW5nIE5VTEwgZW5jcnlwdGlvbiwgc28g SSdkIGJlIHN1cnByaXNlZCBpZjxicj4NCiZndDsmZ3Q7IHRoZSByaWdodCBlbmdpbmVlcmluZyBk ZWNpc2lvbiB3YXMgdG8gcHJpb3JpdGlzZTxicj4NCiZndDsmZ3Q7IENQVSB0byB0aGF0IGV4dGVu dCwgZ2l2ZW4gdGhlIHJpc2tzIGFzc29jaWF0ZWQgd2l0aDxicj4NCiZndDsmZ3Q7IGhhdmluZyB3 ZWFrIGNpcGhlcnN1aXRlcyBwcmVzZW50IGluIHdpZGVseSB1c2VkPGJyPg0KJmd0OyZndDsgaW1w bGVtZW50YXRpb25zLiBJT1csIGl0IHNlZW1zIG1vcmUgc2Vuc2libGUgdG8gbWU8YnI+DQomZ3Q7 Jmd0OyBmb3IgbWFpbCBzZXJ2ZXJzIHRvIGp1c3Qgc3RpY2sgdG8gdXNpbmcgUkVDT01NRU5ERUQ8 YnI+DQomZ3Q7Jmd0OyBjaXBoZXJzdWl0ZXMuIEFuZCBnaXZlbiB0aGF0IHlvdSBjb3VsZCB1c2Ug U0FTTDxicj4NCiZndDsmZ3Q7IHdpdGggUG9zdGZpeC9MTVRQIFs1XSBJJ20gbm90IHN1cmUgd2h5 IHlvdSdkIHdhbnQ8YnI+DQomZ3Q7Jmd0OyBhIHdlaXJkby12ZXJzaW9uIG9mIFRMUzEuMyBhbnl3 YXkgYnV0IG1heWJlIHRoZXJlJ3M8YnI+DQomZ3Q7Jmd0OyBzb21lIHJlYXNvbiBJIGRvbid0IGdl dC48YnI+DQomZ3Q7Jmd0OyA8YnI+DQomZ3Q7Jmd0OyAtIEkgdGhpbmsgdGhpcyBXRyBoYXMgaGFk IHRvIHNwZW5kIHdhYWFheSB0b28gbXVjaDxicj4NCiZndDsmZ3Q7IHRpbWUgZGVhbGluZyB3aXRo IHRoZSAmcXVvdDtpbnNwZWN0aW9uIG9mIGRhdGEmcXVvdDsgZGViYXRlIGluPGJyPg0KJmd0OyZn dDsgdmFyaW91cyBmb3JtcywgYnV0IHdlIGRpZCBnZXQgYW4gYW5zd2VyIChubyBjb25zZW5zdXMp PGJyPg0KJmd0OyZndDsgaW4gdGhlIGVuZCBmb3IgdGhhdC4gTmljaGUgdXNlIGNhc2VzIHNlZW0g ZXh0cmVtZWx5PGJyPg0KJmd0OyZndDsgdW5saWtlbHkgdG8gbWUgdG8ganVzdGlmeSByZXZpc2l0 aW5nIHRoYXQgcGFpbmZ1bDxicj4NCiZndDsmZ3Q7IHRvcGljLjxicj4NCiZndDsmZ3Q7IDxicj4N CiZndDsmZ3Q7IFNvIGFsbCBpbiBhbGwsIEkganVzdCBkb24ndCBzZWUgYSBuZWVkIGZvciB0aGVz ZTxicj4NCiZndDsmZ3Q7IHdlYWstYnktZGVzaWduIGNpcGhlcnN1aXRlcyB0byBldmVuIGJlIGRl ZmluZWQuIEknZDxicj4NCiZndDsmZ3Q7IGVuY291cmFnZSBmb2xrcyB3aG8gdGhpbmsgdGhleSdy ZSBuZWVkZWQgdG8gaW5zdGVhZDxicj4NCiZndDsmZ3Q7IHRoaW5rIGFib3V0IGhvdyB1c2luZyBS RUNPTU1FTkRFRCBjaXBoZXJzdWl0ZXMgbWlnaHQ8YnI+DQomZ3Q7Jmd0OyBtYWtlIHRoZWlyIGlt cGxlbWVudGF0aW9ucyBtb3JlIHdpZGVseSBhcHBsaWNhYmxlIGFuZDxicj4NCiZndDsmZ3Q7IHNh ZmVyLiBTZWVtcyBsaWtlIGEgbXVjaCBtb3JlIHByb2R1Y3RpdmUgYXBwcm9hY2ggdG88YnI+DQom Z3Q7Jmd0OyBtZSBhbnl3YXkuPGJyPg0KJmd0OyZndDsgPGJyPg0KJmd0OyZndDsgUmVnYXJkcyw8 YnI+DQomZ3Q7Jmd0OyBTLjxicj4NCiZndDsmZ3Q7IDxicj4NCiZndDsmZ3Q7IFsxXSA8YSBocmVm PSJodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvcmZjNzUyNSIgdGFyZ2V0PSJfYmxhbmsiPmh0 dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9yZmM3NTI1PC9hPjxicj4NCiZndDsmZ3Q7IFsyXSA8 YSBocmVmPSJodHRwczovL21haWxhcmNoaXZlLmlldGYub3JnL2FyY2gvbXNnL3Rscy91STh4Vmdw N2dUdUpnd1V5WS1VZ1pmbVVrUm8iIHRhcmdldD0iX2JsYW5rIj4NCmh0dHBzOi8vbWFpbGFyY2hp dmUuaWV0Zi5vcmcvYXJjaC9tc2cvdGxzL3VJOHhWZ3A3Z1R1Smd3VXlZLVVnWmZtVWtSbzwvYT48 YnI+DQomZ3Q7Jmd0OyBbM10gPGEgaHJlZj0iaHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL2Ry YWZ0LWlldGYtc3VpdC1hcmNoaXRlY3R1cmUtMDEjc2VjdGlvbi0zLjMiIHRhcmdldD0iX2JsYW5r Ij4NCmh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1pZXRmLXN1aXQtYXJjaGl0ZWN0 dXJlLTAxI3NlY3Rpb24tMy4zPC9hPjxicj4NCiZndDsmZ3Q7IFs0XSA8YSBocmVmPSJodHRwczov L3d3dy50YXByLm9yZy9wZGYvRENDMjAxMC1BWC4yNS1BdXRoZW50aWNhdGlvbkVmZmVjdHMtS0U1 TEtZLnBkZiIgdGFyZ2V0PSJfYmxhbmsiPg0KaHR0cHM6Ly93d3cudGFwci5vcmcvcGRmL0RDQzIw MTAtQVguMjUtQXV0aGVudGljYXRpb25FZmZlY3RzLUtFNUxLWS5wZGY8L2E+PGJyPg0KJmd0OyZn dDsgWzVdIDxhIGhyZWY9Imh0dHA6Ly93d3cucG9zdGZpeC5vcmcvU0FTTF9SRUFETUUuaHRtbCNj bGllbnRfc2FzbCIgdGFyZ2V0PSJfYmxhbmsiPg0KaHR0cDovL3d3dy5wb3N0Zml4Lm9yZy9TQVNM X1JFQURNRS5odG1sI2NsaWVudF9zYXNsPC9hPjxicj4NCiZndDsmZ3Q7IDxicj4NCiZndDsmZ3Q7 IDxicj4NCiZndDsmZ3Q7ICZsdDsweDVBQjJGQUYxN0IxNzJCRUEuYXNjJmd0Ozxicj4NCiZndDsm Z3Q7IF9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fPGJyPg0K Jmd0OyZndDsgVExTIG1haWxpbmcgbGlzdDxicj4NCiZndDsmZ3Q7IDxhIGhyZWY9Im1haWx0bzpU TFNAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj5UTFNAaWV0Zi5vcmc8L2E+PGJyPg0KJmd0OyZn dDsgPGEgaHJlZj0iaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby90bHMiIHRh cmdldD0iX2JsYW5rIj5odHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3Rsczwv YT48YnI+DQomZ3Q7IF9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fPGJyPg0KJmd0OyBUTFMgbWFpbGluZyBsaXN0PGJyPg0KJmd0OyA8YSBocmVmPSJtYWlsdG86 VExTQGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+VExTQGlldGYub3JnPC9hPjxicj4NCiZndDsg PGEgaHJlZj0iaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby90bHMiIHRhcmdl dD0iX2JsYW5rIj5odHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3RsczwvYT48 YnI+DQo8YnI+DQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f Xzxicj4NClRMUyBtYWlsaW5nIGxpc3Q8YnI+DQo8YSBocmVmPSJtYWlsdG86VExTQGlldGYub3Jn IiB0YXJnZXQ9Il9ibGFuayI+VExTQGlldGYub3JnPC9hPjxicj4NCjxhIGhyZWY9Imh0dHBzOi8v d3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vdGxzIiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6 Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby90bHM8L2E+PC9zcGFuPjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibWFyZ2luLWJvdHRvbToxMi4wcHQiPjxicj4NCl9fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fPGJyPg0KVExTIG1haWxpbmcgbGlzdDxicj4NCjxh IGhyZWY9Im1haWx0bzpUTFNAaWV0Zi5vcmciPlRMU0BpZXRmLm9yZzwvYT48YnI+DQo8YSBocmVm PSJodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3RscyIgdGFyZ2V0PSJfYmxh bmsiPmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vdGxzPC9hPjxvOnA+PC9v OnA+PC9wPg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpw PiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_DM5PR2201MB14332BE29A418B74DF8E2AD299310DM5PR2201MB1433_-- From nobody Tue Aug 21 08:45:23 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 95E1F130E53 for ; Tue, 21 Aug 2018 08:45:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.899 X-Spam-Level: X-Spam-Status: No, score=-6.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kcUMt7cBJK8M for ; Tue, 21 Aug 2018 08:45:18 -0700 (PDT) Received: from lizzard.sbs.de (lizzard.sbs.de [194.138.37.39]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B4C0C12F295 for ; Tue, 21 Aug 2018 08:45:17 -0700 (PDT) Received: from mail1.sbs.de (mail1.sbs.de [192.129.41.35]) by lizzard.sbs.de (8.15.2/8.15.2) with ESMTPS id w7LFj2EY007923 (version=TLSv1.2 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 21 Aug 2018 17:45:02 +0200 Received: from DEFTHW99ERNMSX.ww902.siemens.net (defthw99ernmsx.ww902.siemens.net [139.22.70.141]) by mail1.sbs.de (8.15.2/8.15.2) with ESMTPS id w7LFiBTH016905 (version=TLSv1.2 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 21 Aug 2018 17:45:01 +0200 Received: from DENBGAT9ERFMSX.ww902.siemens.net (139.22.70.83) by DEFTHW99ERNMSX.ww902.siemens.net (139.22.70.141) with Microsoft SMTP Server (TLS) id 14.3.408.0; Tue, 21 Aug 2018 17:44:39 +0200 Received: from DENBGAT9EH2MSX.ww902.siemens.net ([169.254.6.212]) by DENBGAT9ERFMSX.ww902.siemens.net ([139.22.70.83]) with mapi id 14.03.0408.000; Tue, 21 Aug 2018 17:44:39 +0200 From: "Fries, Steffen" To: Andreas Walz , "tls@ietf.org" CC: "ncamwing=40cisco.com@dmarc.ietf.org" Thread-Topic: [TLS] integrity only ciphersuites Thread-Index: AQHUOVRDfNtxeeJAEUKLQicbsYfTf6TKVKsw Date: Tue, 21 Aug 2018 15:44:38 +0000 Message-ID: References: <64d23891-2f32-9bb8-1ec8-f4fad13cdfb9@cs.tcd.ie> <982363FD-A839-4175-BA53-7CA242F9ADA6@ll.mit.edu> <2D7F2926-6376-4B2C-BDE9-7A6F1C0FA748@gmail.com> <5B7C1571020000AC0015C330@gwia2.rz.hs-offenburg.de> In-Reply-To: <5B7C1571020000AC0015C330@gwia2.rz.hs-offenburg.de> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [139.22.70.40] Content-Type: multipart/alternative; boundary="_000_E6C9F0E527F94F4692731382340B337804AEFA24DENBGAT9EH2MSXw_" MIME-Version: 1.0 Archived-At: Subject: Re: [TLS] integrity only ciphersuites X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Aug 2018 15:45:21 -0000 --_000_E6C9F0E527F94F4692731382340B337804AEFA24DENBGAT9EH2MSXw_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGksDQoNCkp1c3QgdG8gYWRkIG9uIHRoaXMsIHRoZXJlIGFyZSBkaWZmZXJlbnQgc3RhbmRhcmRz IGluIHBvd2VyIHN5c3RlbSBhdXRvbWF0aW9uLCB3aGljaCB1dGlsaXplIGFuZCBwcm9maWxlIFRM UyB0byBhdm9pZCBkZWZpbmluZyBhbiBvd24gc2VjdXJpdHkgcHJvdG9jb2wgYW5kIHJlbHkgb24g ZXhpc3Rpbmcgc2VjdXJpdHkgcHJvdG9jb2xzLiBUaGlzIGlzIGRvbmUgZm9yIGluc3RhbmNlIGlu IElFQyA2MjM1MSwgd2hpY2ggcmVxdWlyZXMgbXV0dWFsIGF1dGhlbnRpY2F0aW9uIGJhc2VkIG9u IGNlcnRpZmljYXRlcyBhbmQgYWxsb3dzIGludGVncml0eSBvbmx5IGNpcGhlciBzdWl0ZXMuIFdp dGhpbiBhIHV0aWxpdHkgbmV0d29yayBpdCBtYXkgYmUgbmVjZXNzYXJ5IHRvIG1vbml0b3IgdGhl IGluZm9ybWF0aW9uIHRoYXQgaXMgdXNlZCBmb3IgY29udHJvbCBhbmQvb3IgbWVhc3VyZW1lbnQg b2Ygc3dpdGNoZ2VhciBvciBzaW1pbGFyIGVudGl0aWVzLiBDb25maWRlbnRpYWxpdHkgaXQgbm90 IHRoZSBmaXJzdCBwcmlvcml0eSBoZXJlIGFuZCBpZiB0aGUgY29tbXVuaWNhdGlvbiBjcm9zc2Vz IHRoZSBpbnRlcm5ldCAoZnJvbSBhIHN1YnN0YXRpb24gdG8gYSBjb250cm9sIGNlbnRlciksIGFk ZGl0aW9uYWwgbWVhc3VyZXMgYXJlIHVzZWQuIFRoZSBzYW1lIHJlcXVpcmVtZW50IGZvciBwYXNz aXZlIG1vbml0b3JpbmcgZXhpc3RzIGluIHJhaWx3YXkgc3lzdGVtcyBmb3IgaW50ZXJsb2NraW5n IGNvbW11bmljYXRpb24uIFRoZSBpbnRlbnRpb24gaGVyZSBpcyBhbHNvIHRvIGJlIGFibGUgdG8g bW9uaXRvciB0aGUgc2lnbmFsaW5nIHdpdGhvdXQgdGhlIG5lZWQgdG8gdGVybWluYXRlIGEgc2Vj dXJpdHkgcHJvdG9jb2wuDQoNCklmIHRoZXJlIHdvdWxkIGJlIHN1cHBvcnQgZm9yIGludGVncml0 eSBjaXBoZXJzIGluIFRMUyAxLjMgaXQgd291bGQgZW5hYmxlIHRoZSBzdHJhaWdodCBmb3J3YXJk IHN3aXRjaCBmcm9tIFRMUyAxLjIgYWxzbyBpbiB0aGVzZSBlbnZpcm9ubWVudHMgYnkga2VlcGlu ZyBleGlzdGluZyBtb25pdG9yaW5nIG9wdGlvbnMuDQoNCkJlc3QgcmVnYXJkcw0KU3RlZmZlbiBG cmllcw0KDQoNCkZyb206IFRMUyA8dGxzLWJvdW5jZXNAaWV0Zi5vcmc+IE9uIEJlaGFsZiBPZiBB bmRyZWFzIFdhbHoNClNlbnQ6IERpZW5zdGFnLCAyMS4gQXVndXN0IDIwMTggMTU6MzcNClRvOiB0 bHNAaWV0Zi5vcmcNCkNjOiBuY2Ftd2luZz00MGNpc2NvLmNvbUBkbWFyYy5pZXRmLm9yZw0KU3Vi amVjdDogUmU6IFtUTFNdIGludGVncml0eSBvbmx5IGNpcGhlcnN1aXRlcw0KDQorMQ0KDQpJIGZ1 bGx5IHVuZGVyc3RhbmQgdGhlIHB1cnN1aXQgb2YgbWluaW1pemluZyBjb21wbGV4aXR5IGluIFRM Uy4gSG93ZXZlciwgYmFubmluZyBmcm9tIFRMUyBhbGwgcHJvdmlzaW9ucyB0byBzZXJ2ZSBub24t aW50ZXJuZXQgY2FzZXMgc2VlbXMgc3Vib3B0aW1hbCB0byBtZS4NCg0KSSB0aGluayB0aGVyZSBp cyBhIHdob2xlIHVuaXZlcnNlIG9mIHN5c3RlbXMgYW5kIGFwcGxpY2F0aW9ucyB0aGF0IGFyZSBq dXN0IGF0IHRoZSB2ZXJ5IGJlZ2lubmluZyBvZiBiZWluZyBhcm1lZCB3aXRoIHNlY3VyaXR5IGZl YXR1cmVzOiB0aGluayBvZiBjb21tdW5pY2F0aW9uIHN5c3RlbXMgZHJpdmluZywgZS5nLiwgaW5k dXN0cmlhbCBhdXRvbWF0aW9uIGFuZCBjcml0aWNhbCBpbmZyYXN0cnVjdHVyZXMuIFRoZXNlIGFy ZSBxdWl0ZSBkaWZmZXJlbnQgZnJvbSB0aGUgaW50ZXJuZXQgYW5kIHRoZSB3ZWIgKGRpZmZlcmVu dCB0aHJlYXRzLCBzZWN1cml0eSByZXF1aXJlbWVudHMsIGFyY2hpdGVjdHVyZXMsIG5ldHdvcmtz LCByZXNvdXJjZXMsIGV0Yy4pLiBTdGlsbCwgSU1ITyBpdCdzIG5vdCBhIG5pY2hlIGF0IGFsbDsg aXQncyBqdXN0IG5vdCBhcyB2aXNpYmxlIHRvIG1vc3Qgb2YgdXMuDQoNCkkgc3Ryb25nbHkgYmVs aWV2ZSBpdCBpcyAqbm90KiBhIGdvb2QgaWRlYSB0byBob2xkIGJhY2sgYWxsIHRoZSB2YWx1YWJs ZSBleHBlcmllbmNlIGNvbmRlbnNlZCBpbiBUTFMgYW5kIGVudGFpbCB0aGUgZGVzaWduIG9mIGN1 c3RvbWl6ZWQgc2VjdXJpdHkgcHJvdG9jb2xzIGZvciBzdWNoIHN5c3RlbXMuIFRMUyBpcyBzdGF0 ZS1vZi10aGUtYXJ0IGFuZCBpdHMgYmVuZWZpdHMgc2hvdWxkIGJlIGFjY2Vzc2libGUgdG8gYXMg bWFueSBzeXN0ZW1zIGFzIHBvc3NpYmxlLg0KDQpDaGVlcnMsDQpBbmRpIFdhbHoNCg0KDQo+Pj4g S2F0aGxlZW4gTW9yaWFydHkgPGthdGhsZWVuLm1vcmlhcnR5LmlldGZAZ21haWwuY29tPG1haWx0 bzprYXRobGVlbi5tb3JpYXJ0eS5pZXRmQGdtYWlsLmNvbT4+IDA4LzIxLzE4IDM6MjAgUE0gPj4+ DQoNCg0KU2VudCBmcm9tIG15IG1vYmlsZSBkZXZpY2UNCg0KPiBPbiBBdWcgMjEsIDIwMTgsIGF0 IDg6MTAgQU0sIEJsdW1lbnRoYWwsIFVyaSAtIDA1NTMgLSBNSVRMTCA8dXJpQGxsLm1pdC5lZHU8 bWFpbHRvOnVyaUBsbC5taXQuZWR1Pj4gd3JvdGU6DQo+DQo+ICJWdWxuZXJhYmxlLWJ5LWRlc2ln biBjaXBoZXJzdWl0ZXMiPyBWdWxuZXJhYmxlIHRvIHdoYXQ/DQo+DQo+IFN1Y2sgc2l0ZXMgYXJl IGRlc2lnbmVkIHRvIHByb3ZpZGUgZW5kLXBvaW50IGF1dGhlbnRpY2F0aW9uIGFuZCB0cmFmZmlj IGludGVncml0eS4gQ2FyZSB0byBleHBsYWluL3Nob3cgaG93IHRoZXNlIHByb3BlcnRpZXMgd291 bGQgbm90IGhvbGQ/DQo+DQo+IEJlc2lkZXMsIGl0J3MgYmVlbiBleHBsYWluZWQgc2V2ZXJhbCB0 aW1lcyB0aGF0IHNvbWUgdXNlIGNhc2VzIGRvIG5vdCByZXF1aXJlIGNvbmZpZGVudGlhbGl0eSwg YW5kIGluIHNvbWUgdXNlIGNhc2VzIGNvbmZpZGVudGlhbGl0eSBpcyBmb3JiaWRkZW4uDQoNCkkg YWdyZWUgd2l0aCBVcmkgaGVyZSwgZmxleGliaWxpdHkgdG8gY292ZXIgdGhlc2UgdXNlIGNhc2Vz IHRvIGFjY29tbW9kYXRlIHRoZSBhY3R1YWwgc2VjdXJpdHkgcmVxdWlyZW1lbnRzIG1heSByZXN1 bHQgaW4gdGhlbSB1c2luZyBzb21ldGhpbmcgaW5zdGVhZCBvZiBub3RoaW5nLiBJdCBjb3VsZCBi ZSBkZWZpbmVkIGFuZCBub3QgbGlzdGVkIGFzIFJlY29tbWVuZGVkIGFzIHdlbGwuIFRoaXMgY29t ZXMgZG93biB0byByaXNrIG1hbmFnZW1lbnQgYW5kIG9wdGlvbnMsIHdoZXJlIHRoZSByaXNrIGNh biBiZSBjbGVhcmx5IGV4cGxhaW5lZCBhbmQgdGhlIGxhY2sgb2YgcmVjb21tZW5kYXRpb24gY2Fu IGFsc28gYmUgZXhwbGFpbmVkLg0KDQpCZXN0IHJlZ2FyZHMsDQpLYXRobGVlbg0KDQo+DQo+IFJl Z2FyZHMsDQo+IFVyaQ0KPg0KPiBTZW50IGZyb20gbXkgaVBob25lDQo+DQo+PiBPbiBBdWcgMjEs IDIwMTgsIGF0IDA3OjQyLCBTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW4uZmFycmVsbEBjcy50Y2Qu aWU8bWFpbHRvOnN0ZXBoZW4uZmFycmVsbEBjcy50Y2QuaWU+PiB3cm90ZToNCj4+DQo+Pg0KPj4N Cj4+PiBPbiAyMC8wOC8xOCAyMTo0OCwgTmFuY3kgQ2FtLVdpbmdldCAobmNhbXdpbmcpIHdyb3Rl Og0KPj4+IEFsbCwgQSBjb3VwbGUgSW9UIGNvbnNvcnRpdW1zIGFyZSB0cnlpbmcgdG8gZW1icmFj ZSB0aGUgaW1wcm92ZW1lbnRzDQo+Pj4gbWFkZSB0byBUTFMgMS4zIGFuZCBhcyB0aGV5IGRlZmlu ZSB0aGVpciBuZXcgc2VjdXJpdHkgY29uc3RydWN0cw0KPj4+IHdvdWxkIGxpa2UgdG8gYWRvcHQg dGhlIGxhdGVzdCBwcm90b2NvbHMsIGluIHRoaXMgY2FzZSBUTFMgMS4zLiBUbw0KPj4+IHRoYXQg ZXh0ZW50LCB0aGV5IGhhdmUgYSBzdHJvbmcgbmVlZCBmb3IgbXV0dWFsIGF1dGhlbnRpY2F0aW9u LCBidXQNCj4+PiBpbnRlZ3JpdHkgb25seSAobm8gY29uZmlkZW50aWFsaXR5KSByZXF1aXJlbWVu dHMuDQo+Pj4NCj4+PiBJbiBmb2xsb3dpbmcgdGhlIG5ldyBJQU5BIHJ1bGVzLCB3ZSBoYXZlIHBv c3RlZCB0aGUgZHJhZnQNCj4+PiBodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQtY2Ft d2luZ2V0LXRscy10czEzLW1hY2NpcGhlcnN1aXRlcy0wMA0KPj4+IHRvIGRvY3VtZW50IHJlcXVl c3QgZm9yIHJlZ2lzdHJhdGlvbnMgb2YgSE1BQyBiYXNlZCBjaXBoZXIgc2VsZWN0aW9ucw0KPj4+ IHdpdGggVExTIDEuM+KApi4uYW5kIGFyZSBzb2xpY2l0aW5nIGZlZWRiYWNrIGZyb20gdGhlIFdH IG9uIHRoZSBkcmFmdA0KPj4+IGFuZCBpdHMgcGF0aCBmb3J3YXJkLg0KPj4NCj4+IEFzIGVrciBw b2ludGVkIG91dCwgd2l0aCB0aGUgbmV3IHJlZ2lzdHJhdGlvbiBydWxlcywNCj4+IHRoZXJlJ3Mg bm90aGluZyB0byBzdG9wIHNvbWVvbmUgZGVmaW5pbmcgYW55IG9sZCBzZXQNCj4+IG9mIGNyeXB0 byBzdHVmZiBhbmQgZ2V0dGluZyBub24tcmVjb21tZW5kZWQgY29kZXBvaW50cy4NCj4+DQo+PiBU aGF0IHNhaWQsIEkgZG9uJ3QgY29uc2lkZXIgdGhhdCBkZWZpbmluZyBzdWNoDQo+PiB2dWxuZXJh YmxlLWJ5LWRlc2lnbiBjaXBoZXJzdWl0ZXMgaXMgYSBnb29kIHBsYW4uDQo+Pg0KPj4gLSBJdCBp bXBvc2VzIGNvc3RzIG9uIHRoZSBub24tbmljaGUgdXNlcnMgb2YgVExTIC0gb25jZQ0KPj4gdGhl c2UgdGhpbmdzIGFyZSBkZWZpbmVkIHRoZW4gZGV2ZWxvcGVycyBhbmQgdGhvc2Ugd2hvDQo+PiBk ZXBsb3kvY29uZmlndXJlIGFwcGxpY2F0aW9ucyB1c2luZyBUTFMgbmVlZCB0byBjaGVjaw0KPj4g dGhhdCB0aGV5J3JlIG5vdCB1c2luZyB0aGVzZSB1bmRlc2lyYWJsZSBjaXBoZXJzdWl0ZXMsDQo+ PiBzbyBjb3N0cyBhcmUgYmVpbmcgZGlzcGxhY2VkIGZyb20gbmljaGUgdXNlcyB0byB0aGUNCj4+ IHZhc3QgbWFqb3JpdHkgb2YgaW1wbGVtZW50YXRpb25zIGFuZCBkZXBsb3ltZW50cywgd2hpY2gN Cj4+IHNlZW1zIHRvIG1lIHRvIGJlIGEgYmFkIGlkZWEuIEFuZCB3ZSBrbm93IHRoYXQgcGVvcGxl DQo+PiB3aWxsIHNvbWV0aW1lcyBnZXQgdGhvc2UgY2hlY2tzIHdyb25nIGxlYWRpbmcgdG8gdW5l eHBlY3RlZA0KPj4gdHJhbnNtaXNzaW9uIG9mIHBsYWludGV4dCBvdmVyIHRoZSBJbnRlcm5ldC4N Cj4+DQo+PiAtIFNpbWlsYXJseSwganVzdCBkZWZpbmluZyBzdWNoIGNpcGhlcnN1aXRlcyBzZWVt cyBsaWtlbHkNCj4+IHRvIGxlYWQgdG8gbGVzcyB3ZWxsIHRlc3RlZCBhbmQgaW5mcmVxdWVudGx5 IHVzZWQgY29kZQ0KPj4gcGF0aHMsIHdoaWNoIGlzIHVuZGVzaXJhYmxlLiAoQXNzdW1pbmcgc29t ZW9uZSBwYXlzIHNvbWUNCj4+IGRldmVsb3BlciB0byBhZGQgdGhlc2UgdG8gc29tZSBsaWJyYXJ5 LCB3aGljaCBnZW5lcmFsbHkNCj4+IGRvZXMgc2VlbSB0byBoYXBwZW4uKQ0KPj4NCj4+IC0gUkZD NzUyNSBbMV0gaXMgY2xlYXIgb24gdGhpcyB0b3BpYyAoYWZ0ZXIgZGViYXRlIGluIHRoZQ0KPj4g VVRBIFdHKSAtICJJbXBsZW1lbnRhdGlvbnMgTVVTVCBOT1QgbmVnb3RpYXRlIHRoZSBjaXBoZXIN Cj4+IHN1aXRlcyB3aXRoIE5VTEwgZW5jcnlwdGlvbiIgYW5kIEkgc2VlIG5vdGhpbmcgbmV3IHRv DQo+PiBjb252aW5jZSBtZSB0aGF0IHRoYXQgb3VnaHQgY2hhbmdlIGZvciBUTFMxLjMuDQo+Pg0K Pj4gLSBDb2RlIGZvb3RwcmludCBhcmd1bWVudHMgYXJlbid0IHRoYXQgY29udmluY2luZyB0bw0K Pj4gbWUgLSB0byBnZXQgaW50ZXJvcCBmb3IgdGhlIGZldyBkZXZpY2VzIHdoZXJlIEFFUyBiZWlu Zw0KPj4gcHJlc2VudCBvciBhYnNlbnQgY291bGQgbWFrZSBhIHJlYWwgZGlmZmVyZW5jZSwgeW91 J2QNCj4+IG5lZWQgYW4gYXdmdWwgbG90IG1vcmUgcHJvZmlsaW5nIG9mIFRMUyBvciBEVExTLiBJ IGRvbid0DQo+PiBzZWUgZXZpZGVuY2Ugb2YgdGhhdCBzbyB0aGUgaW50ZXJvcC9mb290cHJpbnQg YXJndW1lbnRzDQo+PiBzZWVtIHByZXR0eSB3ZWFrLiBJJ2QgYWxzbyBiZXQgdGhhdCBhbnkgdXNl ZnVsICJ0aW55DQo+PiBmb290cHJpbnQiIHByb2ZpbGUgb2YgdGhhdCBraW5kIHdvdWxkIGVuZCB1 cCB0YXJnZXRpbmcNCj4+IGxvYWRzIG9mIHVzZS1jYXNlcyB3aGVyZSBjb25maWRlbnRpYWxpdHkg aXMgYWJzb2x1dGVseQ0KPj4gcmVxdWlyZWQuDQo+Pg0KPj4gLSAoSW4gYWRkaXRpb24gdG8gdGhl IGdvb2QgcG9pbnRzIG1hZGUgYnkgR2VvZmZyZXkNCj4+IEtlYXRpbmcgWzJdKSBjbGVhcnRleHQg cGF5bG9hZHMgd291bGQgYWxzbyBhc3Npc3QgaW4NCj4+IGRldmljZSBmaW5nZXJwcmludGluZywg bWFraW5nIGl0IGVhc2llciB0byBleHBsb2l0DQo+PiB2dWxuZXJhYmlsaXRpZXMgYXQgc2NhbGUu DQo+Pg0KPj4gLSBJSVVDIHRoZXJlIGlzIGFsc28gYSBkZXNpcmUgdG8gZW5jcnlwdCBmaXJtd2Fy ZQ0KPj4gdXBkYXRlcyBzbyB0aGF0IHBhdGNoZXMgY2FuIGJlIGRpc3RyaWJ1dGVkIG1vcmUgcXVp Y2tseQ0KPj4gdGhhbiBhdHRhY2tlcnMgY2FuIHJldmVyc2UtZW5naW5lZXIgYXR0YWNrcy4gWzRd IEknbQ0KPj4gbm90IGVudGlyZWx5IHN1cmUgaWYgdGhhdCdzIHJlYWxseSBsaWtlbHkgdG8gaGFw cGVuLA0KPj4gYnV0IGlmIGl0IHdlcmUsIHRoZW4gZGV2aWNlcyB3b3VsZCBuZWVkIHRvIGJlIGFi bGUgdG8NCj4+IHVzZSByZWNvbW1lbmRlZCBjaXBoZXJzdWl0ZXMgaW4gYW55IGNhc2UuDQo+Pg0K Pj4gLSBUTFMvQVguMjUgZG9lc24ndCBzZWVtIHRoYXQgZ29vZCBhIHBsYW4gaW4gYW55DQo+PiBj YXNlIC0gYWNjb3JkaW5nIHRvIFszXSwgd2hpY2ggc2VlbXMgcmVhc29uYWJsZSB0bw0KPj4gbWUs IHVzaW5nIGNsZWFyLXNpZ25lZCBHUEcgaXMgcXVpY2tlciBhbmQgYmV0dGVyDQo+PiBtZWV0cyB0 aGUgb2RkYmFsbCByZWd1bGF0aW9ucy4gQXR0ZW1wdGluZyB0byBkZWFsDQo+PiB3aXRoIHRob3Nl IHJlZ3VsYXRpb25zIGJ5IHdlYWtlbmluZyBUTFMgc2VlbXMgbGlrZQ0KPj4gYSB2ZXJ5IGJhZCBw bGFuLCBhcyB5b3UnZCBmYWlsIGluIGFueSBjYXNlIHRvIGFjaGlldmUNCj4+IGludGVyb3Agd2l0 aCBub3JtYWwgVExTIGFwcGxpY2F0aW9ucyBsaWtlIHRoZSB3ZWIuDQo+PiAoQW5kIHRoZSBhZHZl cnRpc2luZyBpcyBhcyBpbGxlZ2FsIGFzIHRoZSBjcnlwdG8NCj4+IGFwcGFyZW50bHksIHRob3Vn aCBJIGRvIGxpa2UgdGhhdCBhc3BlY3Q6LSkNCj4+DQo+PiAtIFdSVCB1bml4IHNvY2tldHMsIEkn bSBub3QgY2xlYXIgdGhhdCB0aGVyZSdzIGENCj4+IHN1ZmZpY2llbnRseSBpbXBvcnRhbnQgcGVy Zm9ybWFuY2UgaW1wcm92ZW1lbnQgaW4NCj4+IHJlYWwgZGVwbG95bWVudHMgdG8ganVzdGlmeSBp bnRyb2R1Y2luZyB3ZWFrZW5lZA0KPj4gY2lwaGVyc3VpdGVzIC0gcHJlc3VtYWJseSBtYWlsIHNl cnZlcnMgYXJlIGdvaW5nIHRvDQo+PiB1c2Ugc3RhbmRhcmQgVExTIGxpYnJhcmllcyB0aGF0IChJ IGhvcGUhKSB3b24ndCBiZQ0KPj4gb2ZmZXJpbmcgTlVMTCBlbmNyeXB0aW9uLCBzbyBJJ2QgYmUg c3VycHJpc2VkIGlmDQo+PiB0aGUgcmlnaHQgZW5naW5lZXJpbmcgZGVjaXNpb24gd2FzIHRvIHBy aW9yaXRpc2UNCj4+IENQVSB0byB0aGF0IGV4dGVudCwgZ2l2ZW4gdGhlIHJpc2tzIGFzc29jaWF0 ZWQgd2l0aA0KPj4gaGF2aW5nIHdlYWsgY2lwaGVyc3VpdGVzIHByZXNlbnQgaW4gd2lkZWx5IHVz ZWQNCj4+IGltcGxlbWVudGF0aW9ucy4gSU9XLCBpdCBzZWVtcyBtb3JlIHNlbnNpYmxlIHRvIG1l DQo+PiBmb3IgbWFpbCBzZXJ2ZXJzIHRvIGp1c3Qgc3RpY2sgdG8gdXNpbmcgUkVDT01NRU5ERUQN Cj4+IGNpcGhlcnN1aXRlcy4gQW5kIGdpdmVuIHRoYXQgeW91IGNvdWxkIHVzZSBTQVNMDQo+PiB3 aXRoIFBvc3RmaXgvTE1UUCBbNV0gSSdtIG5vdCBzdXJlIHdoeSB5b3UnZCB3YW50DQo+PiBhIHdl aXJkby12ZXJzaW9uIG9mIFRMUzEuMyBhbnl3YXkgYnV0IG1heWJlIHRoZXJlJ3MNCj4+IHNvbWUg cmVhc29uIEkgZG9uJ3QgZ2V0Lg0KPj4NCj4+IC0gSSB0aGluayB0aGlzIFdHIGhhcyBoYWQgdG8g c3BlbmQgd2FhYWF5IHRvbyBtdWNoDQo+PiB0aW1lIGRlYWxpbmcgd2l0aCB0aGUgImluc3BlY3Rp b24gb2YgZGF0YSIgZGViYXRlIGluDQo+PiB2YXJpb3VzIGZvcm1zLCBidXQgd2UgZGlkIGdldCBh biBhbnN3ZXIgKG5vIGNvbnNlbnN1cykNCj4+IGluIHRoZSBlbmQgZm9yIHRoYXQuIE5pY2hlIHVz ZSBjYXNlcyBzZWVtIGV4dHJlbWVseQ0KPj4gdW5saWtlbHkgdG8gbWUgdG8ganVzdGlmeSByZXZp c2l0aW5nIHRoYXQgcGFpbmZ1bA0KPj4gdG9waWMuDQo+Pg0KPj4gU28gYWxsIGluIGFsbCwgSSBq dXN0IGRvbid0IHNlZSBhIG5lZWQgZm9yIHRoZXNlDQo+PiB3ZWFrLWJ5LWRlc2lnbiBjaXBoZXJz dWl0ZXMgdG8gZXZlbiBiZSBkZWZpbmVkLiBJJ2QNCj4+IGVuY291cmFnZSBmb2xrcyB3aG8gdGhp bmsgdGhleSdyZSBuZWVkZWQgdG8gaW5zdGVhZA0KPj4gdGhpbmsgYWJvdXQgaG93IHVzaW5nIFJF Q09NTUVOREVEIGNpcGhlcnN1aXRlcyBtaWdodA0KPj4gbWFrZSB0aGVpciBpbXBsZW1lbnRhdGlv bnMgbW9yZSB3aWRlbHkgYXBwbGljYWJsZSBhbmQNCj4+IHNhZmVyLiBTZWVtcyBsaWtlIGEgbXVj aCBtb3JlIHByb2R1Y3RpdmUgYXBwcm9hY2ggdG8NCj4+IG1lIGFueXdheS4NCj4+DQo+PiBSZWdh cmRzLA0KPj4gUy4NCj4+DQo+PiBbMV0gaHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL3JmYzc1 MjUNCj4+IFsyXSBodHRwczovL21haWxhcmNoaXZlLmlldGYub3JnL2FyY2gvbXNnL3Rscy91STh4 VmdwN2dUdUpnd1V5WS1VZ1pmbVVrUm8NCj4+IFszXSBodHRwczovL3Rvb2xzLmlldGYub3JnL2h0 bWwvZHJhZnQtaWV0Zi1zdWl0LWFyY2hpdGVjdHVyZS0wMSNzZWN0aW9uLTMuMw0KPj4gWzRdIGh0 dHBzOi8vd3d3LnRhcHIub3JnL3BkZi9EQ0MyMDEwLUFYLjI1LUF1dGhlbnRpY2F0aW9uRWZmZWN0 cy1LRTVMS1kucGRmDQo+PiBbNV0gaHR0cDovL3d3dy5wb3N0Zml4Lm9yZy9TQVNMX1JFQURNRS5o dG1sI2NsaWVudF9zYXNsDQo+Pg0KPj4NCj4+IDwweDVBQjJGQUYxN0IxNzJCRUEuYXNjPg0KPj4g X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCj4+IFRMUyBt YWlsaW5nIGxpc3QNCj4+IFRMU0BpZXRmLm9yZzxtYWlsdG86VExTQGlldGYub3JnPg0KPj4gaHR0 cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby90bHMNCj4gX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCj4gVExTIG1haWxpbmcgbGlzdA0KPiBU TFNAaWV0Zi5vcmc8bWFpbHRvOlRMU0BpZXRmLm9yZz4NCj4gaHR0cHM6Ly93d3cuaWV0Zi5vcmcv bWFpbG1hbi9saXN0aW5mby90bHMNCg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX18NClRMUyBtYWlsaW5nIGxpc3QNClRMU0BpZXRmLm9yZzxtYWlsdG86VExT QGlldGYub3JnPg0KaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby90bHMNCg== --_000_E6C9F0E527F94F4692731382340B337804AEFA24DENBGAT9EH2MSXw_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 SGVsdmV0aWNhOw0KCXBhbm9zZS0xOjIgMTEgNiA0IDIgMiAyIDIgMiA0O30NCkBmb250LWZhY2UN Cgl7Zm9udC1mYW1pbHk6IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAz IDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAx NSA1IDIgMiAyIDQgMyAyIDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFs LCBsaS5Nc29Ob3JtYWwsIGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBjbTsNCgltYXJnaW4tYm90 dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIs c2Fucy1zZXJpZjt9DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlv cml0eTo5OTsNCgljb2xvcjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2 aXNpdGVkLCBzcGFuLk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5 OTsNCgljb2xvcjpwdXJwbGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLm1zb25v cm1hbDAsIGxpLm1zb25vcm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1z b25vcm1hbDsNCgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGNtOw0K CW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBjbTsNCglmb250LXNp emU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnNwYW4uZ3Jv dXB3aXNlcmVwbHloZWFkZXINCgl7bXNvLXN0eWxlLW5hbWU6Z3JvdXB3aXNlcmVwbHloZWFkZXI7 fQ0Kc3Bhbi5FbWFpbFN0eWxlMjENCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwtcmVwbHk7DQoJ Zm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6IzFGNDk3RDsNCglmb250 LXdlaWdodDpub3JtYWw7DQoJZm9udC1zdHlsZTpub3JtYWw7DQoJdGV4dC1kZWNvcmF0aW9uOm5v bmUgbm9uZTt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsN Cglmb250LXNpemU6MTAuMHB0O30NCkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjYxMi4wcHQg NzkyLjBwdDsNCgltYXJnaW46NzIuMHB0IDcyLjBwdCA3Mi4wcHQgNzIuMHB0O30NCmRpdi5Xb3Jk U2VjdGlvbjENCgl7cGFnZTpXb3JkU2VjdGlvbjE7fQ0KLS0+PC9zdHlsZT48IS0tW2lmIGd0ZSBt c28gOV0+PHhtbD4NCjxvOnNoYXBlZGVmYXVsdHMgdjpleHQ9ImVkaXQiIHNwaWRtYXg9IjEwMjYi IC8+DQo8L3htbD48IVtlbmRpZl0tLT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBl bGF5b3V0IHY6ZXh0PSJlZGl0Ij4NCjxvOmlkbWFwIHY6ZXh0PSJlZGl0IiBkYXRhPSIxIiAvPg0K PC9vOnNoYXBlbGF5b3V0PjwveG1sPjwhW2VuZGlmXS0tPg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0i REUiIGxpbms9ImJsdWUiIHZsaW5rPSJwdXJwbGUiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24x Ij4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iY29sb3I6 IzFGNDk3RDttc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1VUyI+SGksPG86cD48L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJjb2xv cjojMUY0OTdEO21zby1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTIj48bzpwPiZuYnNwOzwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9 ImNvbG9yOiMxRjQ5N0Q7bXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMiPkp1c3QgdG8gYWRkIG9u IHRoaXMsIHRoZXJlIGFyZSBkaWZmZXJlbnQgc3RhbmRhcmRzIGluIHBvd2VyIHN5c3RlbSBhdXRv bWF0aW9uLCB3aGljaCB1dGlsaXplIGFuZCBwcm9maWxlIFRMUyB0byBhdm9pZCBkZWZpbmluZyBh biBvd24gc2VjdXJpdHkgcHJvdG9jb2wgYW5kIHJlbHkgb24gZXhpc3RpbmcNCiBzZWN1cml0eSBw cm90b2NvbHMuIFRoaXMgaXMgZG9uZSBmb3IgaW5zdGFuY2UgaW4gSUVDIDYyMzUxLCB3aGljaCBy ZXF1aXJlcyBtdXR1YWwgYXV0aGVudGljYXRpb24gYmFzZWQgb24gY2VydGlmaWNhdGVzIGFuZCBh bGxvd3MgaW50ZWdyaXR5IG9ubHkgY2lwaGVyIHN1aXRlcy4gV2l0aGluIGEgdXRpbGl0eSBuZXR3 b3JrIGl0IG1heSBiZSBuZWNlc3NhcnkgdG8gbW9uaXRvciB0aGUgaW5mb3JtYXRpb24gdGhhdCBp cyB1c2VkIGZvciBjb250cm9sDQogYW5kL29yIG1lYXN1cmVtZW50IG9mIHN3aXRjaGdlYXIgb3Ig c2ltaWxhciBlbnRpdGllcy4gQ29uZmlkZW50aWFsaXR5IGl0IG5vdCB0aGUgZmlyc3QgcHJpb3Jp dHkgaGVyZSBhbmQgaWYgdGhlIGNvbW11bmljYXRpb24gY3Jvc3NlcyB0aGUgaW50ZXJuZXQgKGZy b20gYSBzdWJzdGF0aW9uIHRvIGEgY29udHJvbCBjZW50ZXIpLCBhZGRpdGlvbmFsIG1lYXN1cmVz IGFyZSB1c2VkLiBUaGUgc2FtZSByZXF1aXJlbWVudCBmb3IgcGFzc2l2ZSBtb25pdG9yaW5nDQog ZXhpc3RzIGluIHJhaWx3YXkgc3lzdGVtcyBmb3IgaW50ZXJsb2NraW5nIGNvbW11bmljYXRpb24u IFRoZSBpbnRlbnRpb24gaGVyZSBpcyBhbHNvIHRvIGJlIGFibGUgdG8gbW9uaXRvciB0aGUgc2ln bmFsaW5nIHdpdGhvdXQgdGhlIG5lZWQgdG8gdGVybWluYXRlIGEgc2VjdXJpdHkgcHJvdG9jb2wu DQo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5n PSJFTi1VUyIgc3R5bGU9ImNvbG9yOiMxRjQ5N0Q7bXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMi PjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IGxhbmc9IkVOLVVTIiBzdHlsZT0iY29sb3I6IzFGNDk3RDttc28tZmFyZWFzdC1sYW5ndWFnZTpF Ti1VUyI+SWYgdGhlcmUgd291bGQgYmUgc3VwcG9ydCBmb3IgaW50ZWdyaXR5IGNpcGhlcnMgaW4g VExTIDEuMyBpdCB3b3VsZCBlbmFibGUgdGhlIHN0cmFpZ2h0IGZvcndhcmQgc3dpdGNoIGZyb20g VExTIDEuMiBhbHNvIGluIHRoZXNlIGVudmlyb25tZW50cyBieSBrZWVwaW5nIGV4aXN0aW5nIG1v bml0b3JpbmcNCiBvcHRpb25zLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iY29sb3I6IzFGNDk3RDttc28tZmFyZWFz dC1sYW5ndWFnZTpFTi1VUyI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJjb2xvcjojMUY0OTdEO21zby1m YXJlYXN0LWxhbmd1YWdlOkVOLVVTIj5CZXN0IHJlZ2FyZHM8bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9ImNvbG9yOiMx RjQ5N0Q7bXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMiPlN0ZWZmZW4gRnJpZXM8bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1VUyIgc3R5 bGU9ImNvbG9yOiMxRjQ5N0Q7bXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMiPjxvOnA+Jm5ic3A7 PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVT IiBzdHlsZT0ibXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMiPjxvOnA+Jm5ic3A7PC9vOnA+PC9z cGFuPjwvcD4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlk ICNFMUUxRTEgMS4wcHQ7cGFkZGluZzozLjBwdCAwY20gMGNtIDBjbSI+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzUuNHB0Ij48Yj48c3BhbiBsYW5nPSJFTi1VUyI+ RnJvbTo8L3NwYW4+PC9iPjxzcGFuIGxhbmc9IkVOLVVTIj4gVExTICZsdDt0bHMtYm91bmNlc0Bp ZXRmLm9yZyZndDsNCjxiPk9uIEJlaGFsZiBPZiA8L2I+QW5kcmVhcyBXYWx6PGJyPg0KPGI+U2Vu dDo8L2I+IERpZW5zdGFnLCAyMS4gQXVndXN0IDIwMTggMTU6Mzc8YnI+DQo8Yj5Ubzo8L2I+IHRs c0BpZXRmLm9yZzxicj4NCjxiPkNjOjwvYj4gbmNhbXdpbmc9NDBjaXNjby5jb21AZG1hcmMuaWV0 Zi5vcmc8YnI+DQo8Yj5TdWJqZWN0OjwvYj4gUmU6IFtUTFNdIGludGVncml0eSBvbmx5IGNpcGhl cnN1aXRlczxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzUuNHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwv cD4NCjxkaXYgaWQ9Ikdyb3VwV2lzZVNlY3Rpb25fMTUzNDg1ODEzNzAwMF9hbmRyZWFzLndhbHpA aHMtb2ZmZW5idXJnLmRlX0ZFN0M5MTQwMEQxOTAwMDBCN0E5MkI3QTNDODlGNzZBXyI+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM1LjRwdCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7 LHNhbnMtc2VyaWYiPiYjNDM7MTxicj4NCjxicj4NCkkgZnVsbHkgdW5kZXJzdGFuZCB0aGUgcHVy c3VpdCBvZiBtaW5pbWl6aW5nIGNvbXBsZXhpdHkgaW4gVExTLiBIb3dldmVyLCBiYW5uaW5nIGZy b20gVExTIGFsbCBwcm92aXNpb25zIHRvIHNlcnZlIG5vbi1pbnRlcm5ldCBjYXNlcyBzZWVtcyBz dWJvcHRpbWFsIHRvIG1lLjxicj4NCjxicj4NCkkgdGhpbmsgdGhlcmUgaXMgYSB3aG9sZSB1bml2 ZXJzZSBvZiBzeXN0ZW1zIGFuZCBhcHBsaWNhdGlvbnMgdGhhdCBhcmUganVzdCBhdCB0aGUgdmVy eSBiZWdpbm5pbmcgb2YgYmVpbmcgYXJtZWQgd2l0aCBzZWN1cml0eSBmZWF0dXJlczogdGhpbmsg b2YgY29tbXVuaWNhdGlvbiBzeXN0ZW1zIGRyaXZpbmcsIGUuZy4sIGluZHVzdHJpYWwgYXV0b21h dGlvbiBhbmQgY3JpdGljYWwgaW5mcmFzdHJ1Y3R1cmVzLiBUaGVzZSBhcmUgcXVpdGUgZGlmZmVy ZW50DQogZnJvbSB0aGUgaW50ZXJuZXQgYW5kIHRoZSB3ZWIgKGRpZmZlcmVudCB0aHJlYXRzLCBz ZWN1cml0eSByZXF1aXJlbWVudHMsIGFyY2hpdGVjdHVyZXMsIG5ldHdvcmtzLCByZXNvdXJjZXMs IGV0Yy4pLiBTdGlsbCwgSU1ITyBpdCdzIG5vdCBhIG5pY2hlIGF0IGFsbDsgaXQncyBqdXN0IG5v dCBhcyB2aXNpYmxlIHRvIG1vc3Qgb2YgdXMuPGJyPg0KPGJyPg0KSSBzdHJvbmdseSBiZWxpZXZl IGl0IGlzICpub3QqIGEgZ29vZCBpZGVhIHRvIGhvbGQgYmFjayBhbGwgdGhlIHZhbHVhYmxlIGV4 cGVyaWVuY2UgY29uZGVuc2VkIGluIFRMUyBhbmQgZW50YWlsIHRoZSBkZXNpZ24gb2YgY3VzdG9t aXplZCBzZWN1cml0eSBwcm90b2NvbHMgZm9yIHN1Y2ggc3lzdGVtcy4gVExTIGlzIHN0YXRlLW9m LXRoZS1hcnQgYW5kIGl0cyBiZW5lZml0cyBzaG91bGQgYmUgYWNjZXNzaWJsZSB0byBhcyBtYW55 IHN5c3RlbXMgYXMNCiBwb3NzaWJsZS4gPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM1LjRwdCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1 b3Q7LHNhbnMtc2VyaWYiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNS40cHQiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90 OyxzYW5zLXNlcmlmIj5DaGVlcnMsPGJyPg0KQW5kaSBXYWx6IDxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVm dDozNS40cHQiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+ DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNS40cHQi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGlj YSZxdW90OyxzYW5zLXNlcmlmIj48YnI+DQo8c3BhbiBjbGFzcz0iZ3JvdXB3aXNlcmVwbHloZWFk ZXIiPiZndDsmZ3Q7Jmd0OyBLYXRobGVlbiZuYnNwO01vcmlhcnR5Jm5ic3A7Jmx0OzxhIGhyZWY9 Im1haWx0bzprYXRobGVlbi5tb3JpYXJ0eS5pZXRmQGdtYWlsLmNvbSI+a2F0aGxlZW4ubW9yaWFy dHkuaWV0ZkBnbWFpbC5jb208L2E+Jmd0OyAwOC8yMS8xOCAzOjIwIFBNICZndDsmZ3Q7Jmd0Ozwv c3Bhbj48YnI+DQo8YnI+DQo8YnI+DQpTZW50IGZyb20gbXkgbW9iaWxlIGRldmljZTxicj4NCjxi cj4NCiZndDsgT24gQXVnIDIxLCAyMDE4LCBhdCA4OjEwIEFNLCBCbHVtZW50aGFsLCBVcmkgLSAw NTUzIC0gTUlUTEwgJmx0OzxhIGhyZWY9Im1haWx0bzp1cmlAbGwubWl0LmVkdSI+dXJpQGxsLm1p dC5lZHU8L2E+Jmd0OyB3cm90ZTo8YnI+DQomZ3Q7IDxicj4NCiZndDsgJnF1b3Q7VnVsbmVyYWJs ZS1ieS1kZXNpZ24gY2lwaGVyc3VpdGVzJnF1b3Q7PyBWdWxuZXJhYmxlIHRvIHdoYXQ/IDxicj4N CiZndDsgPGJyPg0KJmd0OyBTdWNrIHNpdGVzIGFyZSBkZXNpZ25lZCB0byBwcm92aWRlIGVuZC1w b2ludCBhdXRoZW50aWNhdGlvbiBhbmQgdHJhZmZpYyBpbnRlZ3JpdHkuIENhcmUgdG8gZXhwbGFp bi9zaG93IGhvdyB0aGVzZSBwcm9wZXJ0aWVzIHdvdWxkIG5vdCBob2xkPzxicj4NCiZndDsgPGJy Pg0KJmd0OyBCZXNpZGVzLCBpdCdzIGJlZW4gZXhwbGFpbmVkIHNldmVyYWwgdGltZXMgdGhhdCBz b21lIHVzZSBjYXNlcyBkbyBub3QgcmVxdWlyZSBjb25maWRlbnRpYWxpdHksIGFuZCBpbiBzb21l IHVzZSBjYXNlcyBjb25maWRlbnRpYWxpdHkgaXMgZm9yYmlkZGVuLjxicj4NCjxicj4NCkkgYWdy ZWUgd2l0aCBVcmkgaGVyZSwgZmxleGliaWxpdHkgdG8gY292ZXIgdGhlc2UgdXNlIGNhc2VzIHRv IGFjY29tbW9kYXRlIHRoZSBhY3R1YWwgc2VjdXJpdHkgcmVxdWlyZW1lbnRzIG1heSByZXN1bHQg aW4gdGhlbSB1c2luZyBzb21ldGhpbmcgaW5zdGVhZCBvZiBub3RoaW5nLiBJdCBjb3VsZCBiZSBk ZWZpbmVkIGFuZCBub3QgbGlzdGVkIGFzIFJlY29tbWVuZGVkIGFzIHdlbGwuIFRoaXMgY29tZXMg ZG93biB0byByaXNrIG1hbmFnZW1lbnQNCiBhbmQgb3B0aW9ucywgd2hlcmUgdGhlIHJpc2sgY2Fu IGJlIGNsZWFybHkgZXhwbGFpbmVkIGFuZCB0aGUgbGFjayBvZiByZWNvbW1lbmRhdGlvbiBjYW4g YWxzbyBiZSBleHBsYWluZWQuPGJyPg0KPGJyPg0KQmVzdCByZWdhcmRzLDxicj4NCkthdGhsZWVu IDxicj4NCjxicj4NCiZndDsgPGJyPg0KJmd0OyBSZWdhcmRzLDxicj4NCiZndDsgVXJpPGJyPg0K Jmd0OyA8YnI+DQomZ3Q7IFNlbnQgZnJvbSBteSBpUGhvbmU8YnI+DQomZ3Q7IDxicj4NCiZndDsm Z3Q7IE9uIEF1ZyAyMSwgMjAxOCwgYXQgMDc6NDIsIFN0ZXBoZW4gRmFycmVsbCAmbHQ7PGEgaHJl Zj0ibWFpbHRvOnN0ZXBoZW4uZmFycmVsbEBjcy50Y2QuaWUiPnN0ZXBoZW4uZmFycmVsbEBjcy50 Y2QuaWU8L2E+Jmd0OyB3cm90ZTo8YnI+DQomZ3Q7Jmd0OyA8YnI+DQomZ3Q7Jmd0OyA8YnI+DQom Z3Q7Jmd0OyA8YnI+DQomZ3Q7Jmd0OyZndDsgT24gMjAvMDgvMTggMjE6NDgsIE5hbmN5IENhbS1X aW5nZXQgKG5jYW13aW5nKSB3cm90ZTo8YnI+DQomZ3Q7Jmd0OyZndDsgQWxsLCBBIGNvdXBsZSBJ b1QgY29uc29ydGl1bXMgYXJlIHRyeWluZyB0byBlbWJyYWNlIHRoZSBpbXByb3ZlbWVudHM8YnI+ DQomZ3Q7Jmd0OyZndDsgbWFkZSB0byBUTFMgMS4zIGFuZCBhcyB0aGV5IGRlZmluZSB0aGVpciBu ZXcgc2VjdXJpdHkgY29uc3RydWN0czxicj4NCiZndDsmZ3Q7Jmd0OyB3b3VsZCBsaWtlIHRvIGFk b3B0IHRoZSBsYXRlc3QgcHJvdG9jb2xzLCBpbiB0aGlzIGNhc2UgVExTIDEuMy4gVG88YnI+DQom Z3Q7Jmd0OyZndDsgdGhhdCBleHRlbnQsIHRoZXkgaGF2ZSBhIHN0cm9uZyBuZWVkIGZvciBtdXR1 YWwgYXV0aGVudGljYXRpb24sIGJ1dDxicj4NCiZndDsmZ3Q7Jmd0OyBpbnRlZ3JpdHkgb25seSAo bm8gY29uZmlkZW50aWFsaXR5KSByZXF1aXJlbWVudHMuPGJyPg0KJmd0OyZndDsmZ3Q7IDxicj4N CiZndDsmZ3Q7Jmd0OyBJbiBmb2xsb3dpbmcgdGhlIG5ldyBJQU5BIHJ1bGVzLCB3ZSBoYXZlIHBv c3RlZCB0aGUgZHJhZnQ8YnI+DQomZ3Q7Jmd0OyZndDsgPGEgaHJlZj0iaHR0cHM6Ly90b29scy5p ZXRmLm9yZy9odG1sL2RyYWZ0LWNhbXdpbmdldC10bHMtdHMxMy1tYWNjaXBoZXJzdWl0ZXMtMDAi Pg0KaHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LWNhbXdpbmdldC10bHMtdHMxMy1t YWNjaXBoZXJzdWl0ZXMtMDA8L2E+PGJyPg0KJmd0OyZndDsmZ3Q7IHRvIGRvY3VtZW50IHJlcXVl c3QgZm9yIHJlZ2lzdHJhdGlvbnMgb2YgSE1BQyBiYXNlZCBjaXBoZXIgc2VsZWN0aW9uczxicj4N CiZndDsmZ3Q7Jmd0OyB3aXRoIFRMUyAxLjPigKYuLmFuZCBhcmUgc29saWNpdGluZyBmZWVkYmFj ayBmcm9tIHRoZSBXRyBvbiB0aGUgZHJhZnQ8YnI+DQomZ3Q7Jmd0OyZndDsgYW5kIGl0cyBwYXRo IGZvcndhcmQuPGJyPg0KJmd0OyZndDsgPGJyPg0KJmd0OyZndDsgQXMgZWtyIHBvaW50ZWQgb3V0 LCB3aXRoIHRoZSBuZXcgcmVnaXN0cmF0aW9uIHJ1bGVzLDxicj4NCiZndDsmZ3Q7IHRoZXJlJ3Mg bm90aGluZyB0byBzdG9wIHNvbWVvbmUgZGVmaW5pbmcgYW55IG9sZCBzZXQ8YnI+DQomZ3Q7Jmd0 OyBvZiBjcnlwdG8gc3R1ZmYgYW5kIGdldHRpbmcgbm9uLXJlY29tbWVuZGVkIGNvZGVwb2ludHMu PGJyPg0KJmd0OyZndDsgPGJyPg0KJmd0OyZndDsgVGhhdCBzYWlkLCBJIGRvbid0IGNvbnNpZGVy IHRoYXQgZGVmaW5pbmcgc3VjaDxicj4NCiZndDsmZ3Q7IHZ1bG5lcmFibGUtYnktZGVzaWduIGNp cGhlcnN1aXRlcyBpcyBhIGdvb2QgcGxhbi48YnI+DQomZ3Q7Jmd0OyA8YnI+DQomZ3Q7Jmd0OyAt IEl0IGltcG9zZXMgY29zdHMgb24gdGhlIG5vbi1uaWNoZSB1c2VycyBvZiBUTFMgLSBvbmNlPGJy Pg0KJmd0OyZndDsgdGhlc2UgdGhpbmdzIGFyZSBkZWZpbmVkIHRoZW4gZGV2ZWxvcGVycyBhbmQg dGhvc2Ugd2hvPGJyPg0KJmd0OyZndDsgZGVwbG95L2NvbmZpZ3VyZSBhcHBsaWNhdGlvbnMgdXNp bmcgVExTIG5lZWQgdG8gY2hlY2s8YnI+DQomZ3Q7Jmd0OyB0aGF0IHRoZXkncmUgbm90IHVzaW5n IHRoZXNlIHVuZGVzaXJhYmxlIGNpcGhlcnN1aXRlcyw8YnI+DQomZ3Q7Jmd0OyBzbyBjb3N0cyBh cmUgYmVpbmcgZGlzcGxhY2VkIGZyb20gbmljaGUgdXNlcyB0byB0aGU8YnI+DQomZ3Q7Jmd0OyB2 YXN0IG1ham9yaXR5IG9mIGltcGxlbWVudGF0aW9ucyBhbmQgZGVwbG95bWVudHMsIHdoaWNoPGJy Pg0KJmd0OyZndDsgc2VlbXMgdG8gbWUgdG8gYmUgYSBiYWQgaWRlYS4gQW5kIHdlIGtub3cgdGhh dCBwZW9wbGU8YnI+DQomZ3Q7Jmd0OyB3aWxsIHNvbWV0aW1lcyBnZXQgdGhvc2UgY2hlY2tzIHdy b25nIGxlYWRpbmcgdG8gdW5leHBlY3RlZDxicj4NCiZndDsmZ3Q7IHRyYW5zbWlzc2lvbiBvZiBw bGFpbnRleHQgb3ZlciB0aGUgSW50ZXJuZXQuPGJyPg0KJmd0OyZndDsgPGJyPg0KJmd0OyZndDsg LSBTaW1pbGFybHksIGp1c3QgZGVmaW5pbmcgc3VjaCBjaXBoZXJzdWl0ZXMgc2VlbXMgbGlrZWx5 PGJyPg0KJmd0OyZndDsgdG8gbGVhZCB0byBsZXNzIHdlbGwgdGVzdGVkIGFuZCBpbmZyZXF1ZW50 bHkgdXNlZCBjb2RlPGJyPg0KJmd0OyZndDsgcGF0aHMsIHdoaWNoIGlzIHVuZGVzaXJhYmxlLiAo QXNzdW1pbmcgc29tZW9uZSBwYXlzIHNvbWU8YnI+DQomZ3Q7Jmd0OyBkZXZlbG9wZXIgdG8gYWRk IHRoZXNlIHRvIHNvbWUgbGlicmFyeSwgd2hpY2ggZ2VuZXJhbGx5PGJyPg0KJmd0OyZndDsgZG9l cyBzZWVtIHRvIGhhcHBlbi4pPGJyPg0KJmd0OyZndDsgPGJyPg0KJmd0OyZndDsgLSBSRkM3NTI1 IFsxXSBpcyBjbGVhciBvbiB0aGlzIHRvcGljIChhZnRlciBkZWJhdGUgaW4gdGhlPGJyPg0KJmd0 OyZndDsgVVRBIFdHKSAtICZxdW90O0ltcGxlbWVudGF0aW9ucyBNVVNUIE5PVCBuZWdvdGlhdGUg dGhlIGNpcGhlcjxicj4NCiZndDsmZ3Q7IHN1aXRlcyB3aXRoIE5VTEwgZW5jcnlwdGlvbiZxdW90 OyBhbmQgSSBzZWUgbm90aGluZyBuZXcgdG88YnI+DQomZ3Q7Jmd0OyBjb252aW5jZSBtZSB0aGF0 IHRoYXQgb3VnaHQgY2hhbmdlIGZvciBUTFMxLjMuPGJyPg0KJmd0OyZndDsgPGJyPg0KJmd0OyZn dDsgLSBDb2RlIGZvb3RwcmludCBhcmd1bWVudHMgYXJlbid0IHRoYXQgY29udmluY2luZyB0bzxi cj4NCiZndDsmZ3Q7IG1lIC0gdG8gZ2V0IGludGVyb3AgZm9yIHRoZSBmZXcgZGV2aWNlcyB3aGVy ZSBBRVMgYmVpbmc8YnI+DQomZ3Q7Jmd0OyBwcmVzZW50IG9yIGFic2VudCBjb3VsZCBtYWtlIGEg cmVhbCBkaWZmZXJlbmNlLCB5b3UnZDxicj4NCiZndDsmZ3Q7IG5lZWQgYW4gYXdmdWwgbG90IG1v cmUgcHJvZmlsaW5nIG9mIFRMUyBvciBEVExTLiBJIGRvbid0PGJyPg0KJmd0OyZndDsgc2VlIGV2 aWRlbmNlIG9mIHRoYXQgc28gdGhlIGludGVyb3AvZm9vdHByaW50IGFyZ3VtZW50czxicj4NCiZn dDsmZ3Q7IHNlZW0gcHJldHR5IHdlYWsuIEknZCBhbHNvIGJldCB0aGF0IGFueSB1c2VmdWwgJnF1 b3Q7dGlueTxicj4NCiZndDsmZ3Q7IGZvb3RwcmludCZxdW90OyBwcm9maWxlIG9mIHRoYXQga2lu ZCB3b3VsZCBlbmQgdXAgdGFyZ2V0aW5nPGJyPg0KJmd0OyZndDsgbG9hZHMgb2YgdXNlLWNhc2Vz IHdoZXJlIGNvbmZpZGVudGlhbGl0eSBpcyBhYnNvbHV0ZWx5PGJyPg0KJmd0OyZndDsgcmVxdWly ZWQuPGJyPg0KJmd0OyZndDsgPGJyPg0KJmd0OyZndDsgLSAoSW4gYWRkaXRpb24gdG8gdGhlIGdv b2QgcG9pbnRzIG1hZGUgYnkgR2VvZmZyZXk8YnI+DQomZ3Q7Jmd0OyBLZWF0aW5nIFsyXSkgY2xl YXJ0ZXh0IHBheWxvYWRzIHdvdWxkIGFsc28gYXNzaXN0IGluPGJyPg0KJmd0OyZndDsgZGV2aWNl IGZpbmdlcnByaW50aW5nLCBtYWtpbmcgaXQgZWFzaWVyIHRvIGV4cGxvaXQ8YnI+DQomZ3Q7Jmd0 OyB2dWxuZXJhYmlsaXRpZXMgYXQgc2NhbGUuPGJyPg0KJmd0OyZndDsgPGJyPg0KJmd0OyZndDsg LSBJSVVDIHRoZXJlIGlzIGFsc28gYSBkZXNpcmUgdG8gZW5jcnlwdCBmaXJtd2FyZTxicj4NCiZn dDsmZ3Q7IHVwZGF0ZXMgc28gdGhhdCBwYXRjaGVzIGNhbiBiZSBkaXN0cmlidXRlZCBtb3JlIHF1 aWNrbHk8YnI+DQomZ3Q7Jmd0OyB0aGFuIGF0dGFja2VycyBjYW4gcmV2ZXJzZS1lbmdpbmVlciBh dHRhY2tzLiBbNF0gSSdtPGJyPg0KJmd0OyZndDsgbm90IGVudGlyZWx5IHN1cmUgaWYgdGhhdCdz IHJlYWxseSBsaWtlbHkgdG8gaGFwcGVuLDxicj4NCiZndDsmZ3Q7IGJ1dCBpZiBpdCB3ZXJlLCB0 aGVuIGRldmljZXMgd291bGQgbmVlZCB0byBiZSBhYmxlIHRvPGJyPg0KJmd0OyZndDsgdXNlIHJl Y29tbWVuZGVkIGNpcGhlcnN1aXRlcyBpbiBhbnkgY2FzZS48YnI+DQomZ3Q7Jmd0OyA8YnI+DQom Z3Q7Jmd0OyAtIFRMUy9BWC4yNSBkb2Vzbid0IHNlZW0gdGhhdCBnb29kIGEgcGxhbiBpbiBhbnk8 YnI+DQomZ3Q7Jmd0OyBjYXNlIC0gYWNjb3JkaW5nIHRvIFszXSwgd2hpY2ggc2VlbXMgcmVhc29u YWJsZSB0bzxicj4NCiZndDsmZ3Q7IG1lLCB1c2luZyBjbGVhci1zaWduZWQgR1BHIGlzIHF1aWNr ZXIgYW5kIGJldHRlcjxicj4NCiZndDsmZ3Q7IG1lZXRzIHRoZSBvZGRiYWxsIHJlZ3VsYXRpb25z LiBBdHRlbXB0aW5nIHRvIGRlYWw8YnI+DQomZ3Q7Jmd0OyB3aXRoIHRob3NlIHJlZ3VsYXRpb25z IGJ5IHdlYWtlbmluZyBUTFMgc2VlbXMgbGlrZTxicj4NCiZndDsmZ3Q7IGEgdmVyeSBiYWQgcGxh biwgYXMgeW91J2QgZmFpbCBpbiBhbnkgY2FzZSB0byBhY2hpZXZlPGJyPg0KJmd0OyZndDsgaW50 ZXJvcCB3aXRoIG5vcm1hbCBUTFMgYXBwbGljYXRpb25zIGxpa2UgdGhlIHdlYi48YnI+DQomZ3Q7 Jmd0OyAoQW5kIHRoZSBhZHZlcnRpc2luZyBpcyBhcyBpbGxlZ2FsIGFzIHRoZSBjcnlwdG88YnI+ DQomZ3Q7Jmd0OyBhcHBhcmVudGx5LCB0aG91Z2ggSSBkbyBsaWtlIHRoYXQgYXNwZWN0Oi0pPGJy Pg0KJmd0OyZndDsgPGJyPg0KJmd0OyZndDsgLSBXUlQgdW5peCBzb2NrZXRzLCBJJ20gbm90IGNs ZWFyIHRoYXQgdGhlcmUncyBhPGJyPg0KJmd0OyZndDsgc3VmZmljaWVudGx5IGltcG9ydGFudCBw ZXJmb3JtYW5jZSBpbXByb3ZlbWVudCBpbjxicj4NCiZndDsmZ3Q7IHJlYWwgZGVwbG95bWVudHMg dG8ganVzdGlmeSBpbnRyb2R1Y2luZyB3ZWFrZW5lZDxicj4NCiZndDsmZ3Q7IGNpcGhlcnN1aXRl cyAtIHByZXN1bWFibHkgbWFpbCBzZXJ2ZXJzIGFyZSBnb2luZyB0bzxicj4NCiZndDsmZ3Q7IHVz ZSBzdGFuZGFyZCBUTFMgbGlicmFyaWVzIHRoYXQgKEkgaG9wZSEpIHdvbid0IGJlPGJyPg0KJmd0 OyZndDsgb2ZmZXJpbmcgTlVMTCBlbmNyeXB0aW9uLCBzbyBJJ2QgYmUgc3VycHJpc2VkIGlmPGJy Pg0KJmd0OyZndDsgdGhlIHJpZ2h0IGVuZ2luZWVyaW5nIGRlY2lzaW9uIHdhcyB0byBwcmlvcml0 aXNlPGJyPg0KJmd0OyZndDsgQ1BVIHRvIHRoYXQgZXh0ZW50LCBnaXZlbiB0aGUgcmlza3MgYXNz b2NpYXRlZCB3aXRoPGJyPg0KJmd0OyZndDsgaGF2aW5nIHdlYWsgY2lwaGVyc3VpdGVzIHByZXNl bnQgaW4gd2lkZWx5IHVzZWQ8YnI+DQomZ3Q7Jmd0OyBpbXBsZW1lbnRhdGlvbnMuIElPVywgaXQg c2VlbXMgbW9yZSBzZW5zaWJsZSB0byBtZTxicj4NCiZndDsmZ3Q7IGZvciBtYWlsIHNlcnZlcnMg dG8ganVzdCBzdGljayB0byB1c2luZyBSRUNPTU1FTkRFRDxicj4NCiZndDsmZ3Q7IGNpcGhlcnN1 aXRlcy4gQW5kIGdpdmVuIHRoYXQgeW91IGNvdWxkIHVzZSBTQVNMPGJyPg0KJmd0OyZndDsgd2l0 aCBQb3N0Zml4L0xNVFAgWzVdIEknbSBub3Qgc3VyZSB3aHkgeW91J2Qgd2FudDxicj4NCiZndDsm Z3Q7IGEgd2VpcmRvLXZlcnNpb24gb2YgVExTMS4zIGFueXdheSBidXQgbWF5YmUgdGhlcmUnczxi cj4NCiZndDsmZ3Q7IHNvbWUgcmVhc29uIEkgZG9uJ3QgZ2V0Ljxicj4NCiZndDsmZ3Q7IDxicj4N CiZndDsmZ3Q7IC0gSSB0aGluayB0aGlzIFdHIGhhcyBoYWQgdG8gc3BlbmQgd2FhYWF5IHRvbyBt dWNoPGJyPg0KJmd0OyZndDsgdGltZSBkZWFsaW5nIHdpdGggdGhlICZxdW90O2luc3BlY3Rpb24g b2YgZGF0YSZxdW90OyBkZWJhdGUgaW48YnI+DQomZ3Q7Jmd0OyB2YXJpb3VzIGZvcm1zLCBidXQg d2UgZGlkIGdldCBhbiBhbnN3ZXIgKG5vIGNvbnNlbnN1cyk8YnI+DQomZ3Q7Jmd0OyBpbiB0aGUg ZW5kIGZvciB0aGF0LiBOaWNoZSB1c2UgY2FzZXMgc2VlbSBleHRyZW1lbHk8YnI+DQomZ3Q7Jmd0 OyB1bmxpa2VseSB0byBtZSB0byBqdXN0aWZ5IHJldmlzaXRpbmcgdGhhdCBwYWluZnVsPGJyPg0K Jmd0OyZndDsgdG9waWMuPGJyPg0KJmd0OyZndDsgPGJyPg0KJmd0OyZndDsgU28gYWxsIGluIGFs bCwgSSBqdXN0IGRvbid0IHNlZSBhIG5lZWQgZm9yIHRoZXNlPGJyPg0KJmd0OyZndDsgd2Vhay1i eS1kZXNpZ24gY2lwaGVyc3VpdGVzIHRvIGV2ZW4gYmUgZGVmaW5lZC4gSSdkPGJyPg0KJmd0OyZn dDsgZW5jb3VyYWdlIGZvbGtzIHdobyB0aGluayB0aGV5J3JlIG5lZWRlZCB0byBpbnN0ZWFkPGJy Pg0KJmd0OyZndDsgdGhpbmsgYWJvdXQgaG93IHVzaW5nIFJFQ09NTUVOREVEIGNpcGhlcnN1aXRl cyBtaWdodDxicj4NCiZndDsmZ3Q7IG1ha2UgdGhlaXIgaW1wbGVtZW50YXRpb25zIG1vcmUgd2lk ZWx5IGFwcGxpY2FibGUgYW5kPGJyPg0KJmd0OyZndDsgc2FmZXIuIFNlZW1zIGxpa2UgYSBtdWNo IG1vcmUgcHJvZHVjdGl2ZSBhcHByb2FjaCB0bzxicj4NCiZndDsmZ3Q7IG1lIGFueXdheS48YnI+ DQomZ3Q7Jmd0OyA8YnI+DQomZ3Q7Jmd0OyBSZWdhcmRzLDxicj4NCiZndDsmZ3Q7IFMuPGJyPg0K Jmd0OyZndDsgPGJyPg0KJmd0OyZndDsgWzFdIDxhIGhyZWY9Imh0dHBzOi8vdG9vbHMuaWV0Zi5v cmcvaHRtbC9yZmM3NTI1Ij5odHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvcmZjNzUyNTwvYT48 YnI+DQomZ3Q7Jmd0OyBbMl0gPGEgaHJlZj0iaHR0cHM6Ly9tYWlsYXJjaGl2ZS5pZXRmLm9yZy9h cmNoL21zZy90bHMvdUk4eFZncDdnVHVKZ3dVeVktVWdaZm1Va1JvIj4NCmh0dHBzOi8vbWFpbGFy Y2hpdmUuaWV0Zi5vcmcvYXJjaC9tc2cvdGxzL3VJOHhWZ3A3Z1R1Smd3VXlZLVVnWmZtVWtSbzwv YT48YnI+DQomZ3Q7Jmd0OyBbM10gPGEgaHJlZj0iaHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1s L2RyYWZ0LWlldGYtc3VpdC1hcmNoaXRlY3R1cmUtMDEjc2VjdGlvbi0zLjMiPg0KaHR0cHM6Ly90 b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LWlldGYtc3VpdC1hcmNoaXRlY3R1cmUtMDEjc2VjdGlv bi0zLjM8L2E+PGJyPg0KJmd0OyZndDsgWzRdIDxhIGhyZWY9Imh0dHBzOi8vd3d3LnRhcHIub3Jn L3BkZi9EQ0MyMDEwLUFYLjI1LUF1dGhlbnRpY2F0aW9uRWZmZWN0cy1LRTVMS1kucGRmIj4NCmh0 dHBzOi8vd3d3LnRhcHIub3JnL3BkZi9EQ0MyMDEwLUFYLjI1LUF1dGhlbnRpY2F0aW9uRWZmZWN0 cy1LRTVMS1kucGRmPC9hPjxicj4NCiZndDsmZ3Q7IFs1XSA8YSBocmVmPSJodHRwOi8vd3d3LnBv c3RmaXgub3JnL1NBU0xfUkVBRE1FLmh0bWwjY2xpZW50X3Nhc2wiPmh0dHA6Ly93d3cucG9zdGZp eC5vcmcvU0FTTF9SRUFETUUuaHRtbCNjbGllbnRfc2FzbDwvYT48YnI+DQomZ3Q7Jmd0OyA8YnI+ DQomZ3Q7Jmd0OyA8YnI+DQomZ3Q7Jmd0OyAmbHQ7MHg1QUIyRkFGMTdCMTcyQkVBLmFzYyZndDs8 YnI+DQomZ3Q7Jmd0OyBfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fXzxicj4NCiZndDsmZ3Q7IFRMUyBtYWlsaW5nIGxpc3Q8YnI+DQomZ3Q7Jmd0OyA8YSBocmVm PSJtYWlsdG86VExTQGlldGYub3JnIj5UTFNAaWV0Zi5vcmc8L2E+PGJyPg0KJmd0OyZndDsgPGEg aHJlZj0iaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby90bHMiPmh0dHBzOi8v d3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vdGxzPC9hPjxicj4NCiZndDsgX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX188YnI+DQomZ3Q7IFRMUyBtYWls aW5nIGxpc3Q8YnI+DQomZ3Q7IDxhIGhyZWY9Im1haWx0bzpUTFNAaWV0Zi5vcmciPlRMU0BpZXRm Lm9yZzwvYT48YnI+DQomZ3Q7IDxhIGhyZWY9Imh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4v bGlzdGluZm8vdGxzIj5odHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3Rsczwv YT48YnI+DQo8YnI+DQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fXzxicj4NClRMUyBtYWlsaW5nIGxpc3Q8YnI+DQo8YSBocmVmPSJtYWlsdG86VExTQGlldGYu b3JnIj5UTFNAaWV0Zi5vcmc8L2E+PGJyPg0KPGEgaHJlZj0iaHR0cHM6Ly93d3cuaWV0Zi5vcmcv bWFpbG1hbi9saXN0aW5mby90bHMiPmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGlu Zm8vdGxzPC9hPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2JvZHk+ DQo8L2h0bWw+DQo= --_000_E6C9F0E527F94F4692731382340B337804AEFA24DENBGAT9EH2MSXw_-- From nobody Tue Aug 21 08:52:55 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E973F130F14 for ; Tue, 21 Aug 2018 08:52:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.71 X-Spam-Level: X-Spam-Status: No, score=-2.71 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=akamai.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zLxAz2lIjZn4 for ; Tue, 21 Aug 2018 08:52:53 -0700 (PDT) Received: from mx0a-00190b01.pphosted.com (mx0a-00190b01.pphosted.com [IPv6:2620:100:9001:583::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 21997130F07 for ; Tue, 21 Aug 2018 08:52:53 -0700 (PDT) Received: from pps.filterd (m0122332.ppops.net [127.0.0.1]) by mx0a-00190b01.pphosted.com (8.16.0.22/8.16.0.22) with SMTP id w7LFpbKF006001; Tue, 21 Aug 2018 16:52:40 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=akamai.com; h=from : to : cc : subject : date : message-id : references : in-reply-to : content-type : mime-version; s=jan2016.eng; bh=9GTQIBYWIRQIt1FHaIj5gQwE75M2tKWDy7QT5OHH+Xo=; b=nfT9gRsXgziaFoKA+aTHvz8Oh46cip6TJHy7ACW8QyLdLxxD8YTpKzKD5Yiu84Gviby8 nhJYpRQv2WKNrOW8R1XdGsdQ9yFR3AFE4fR3bz8ckIUb0G/UVChAKiJS3gusfJOJp6Xk x55L7FRHXvIOHhL+4UNxQjR5XpU/N5hawVpiIKirhhZKiskkth7Ir015/gimiT7hXQnj tQ7DEPcY23z+TfZLWz3MLJyfiuw2rF9TQHX535sqLwH0j3e0I/WPrj6g/BRXCEvEU0qA mVUYtD08MKCu0/n4gxLe3zWkvOmHJHpBtEkJGuqP3ZNG/jxF2E75GVMAtycXbIyl8V4i dw== Received: from prod-mail-ppoint2 (prod-mail-ppoint2.akamai.com [184.51.33.19]) by mx0a-00190b01.pphosted.com with ESMTP id 2kxbgfgf7w-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 21 Aug 2018 16:52:40 +0100 Received: from pps.filterd (prod-mail-ppoint2.akamai.com [127.0.0.1]) by prod-mail-ppoint2.akamai.com (8.16.0.21/8.16.0.21) with SMTP id w7LFnkow006774; Tue, 21 Aug 2018 11:52:39 -0400 Received: from email.msg.corp.akamai.com ([172.27.123.53]) by prod-mail-ppoint2.akamai.com with ESMTP id 2kxesuf0dn-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Tue, 21 Aug 2018 11:52:39 -0400 Received: from USMA1EX-DAG1MB1.msg.corp.akamai.com (172.27.123.101) by usma1ex-dag1mb2.msg.corp.akamai.com (172.27.123.102) with Microsoft SMTP Server (TLS) id 15.0.1365.1; Tue, 21 Aug 2018 11:52:38 -0400 Received: from USMA1EX-DAG1MB1.msg.corp.akamai.com ([172.27.123.101]) by usma1ex-dag1mb1.msg.corp.akamai.com ([172.27.123.101]) with mapi id 15.00.1365.000; Tue, 21 Aug 2018 11:52:38 -0400 From: "Salz, Rich" To: "Fries, Steffen" , Andreas Walz , "tls@ietf.org" CC: "ncamwing=40cisco.com@dmarc.ietf.org" Thread-Topic: [TLS] integrity only ciphersuites Thread-Index: AQHUOMcWIQ0ztQCz9UKccOekmBKud6TKWVQAgAAIAoCAABIwgIAABf+AgAAjtwD//78uAA== Date: Tue, 21 Aug 2018 15:52:38 +0000 Message-ID: References: <64d23891-2f32-9bb8-1ec8-f4fad13cdfb9@cs.tcd.ie> <982363FD-A839-4175-BA53-7CA242F9ADA6@ll.mit.edu> <2D7F2926-6376-4B2C-BDE9-7A6F1C0FA748@gmail.com> <5B7C1571020000AC0015C330@gwia2.rz.hs-offenburg.de> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.10.0.180812 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [172.19.35.74] Content-Type: multipart/alternative; boundary="_000_A51CF46A8C5F4013A4CEEB90A9EE94CAakamaicom_" MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2018-08-21_08:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 mlxscore=0 mlxlogscore=708 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1807170000 definitions=main-1808210165 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2018-08-21_08:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1011 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=690 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1807170000 definitions=main-1808210165 Archived-At: Subject: Re: [TLS] integrity only ciphersuites X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Aug 2018 15:52:54 -0000 --_000_A51CF46A8C5F4013A4CEEB90A9EE94CAakamaicom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 ICAqICAgSWYgdGhlcmUgd291bGQgYmUgc3VwcG9ydCBmb3IgaW50ZWdyaXR5IGNpcGhlcnMgaW4g VExTIDEuMyBpdCB3b3VsZCBlbmFibGUgdGhlIHN0cmFpZ2h0IGZvcndhcmQgc3dpdGNoIGZyb20g VExTIDEuMiBhbHNvIGluIHRoZXNlIGVudmlyb25tZW50cyBieSBrZWVwaW5nIGV4aXN0aW5nIG1v bml0b3Jpbmcgb3B0aW9ucy4NCg0KV2h5IGRvIHlvdSB3YW50IHRvIG1vdmUgdG8gVExTIDEuMz8g IFdoeSBpc27igJl0IHlvdXIgZXhpc3Rpbmcgc29sdXRpb24gZ29vZCBlbm91Z2g/DQo= --_000_A51CF46A8C5F4013A4CEEB90A9EE94CAakamaicom_ Content-Type: text/html; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseTpXaW5nZGluZ3M7DQoJcGFub3NlLTE6NSAwIDAgMCAwIDAgMCAwIDAg MDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJDYW1icmlhIE1hdGgiOw0KCXBhbm9zZS0x OjIgNCA1IDMgNSA0IDYgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDYWxpYnJp Ow0KCXBhbm9zZS0xOjIgMTUgNSAyIDIgMiA0IDMgMiA0O30NCi8qIFN0eWxlIERlZmluaXRpb25z ICovDQpwLk1zb05vcm1hbCwgbGkuTXNvTm9ybWFsLCBkaXYuTXNvTm9ybWFsDQoJe21hcmdpbjow aW47DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMS4wcHQ7DQoJZm9udC1m YW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0KYTpsaW5rLCBzcGFuLk1zb0h5cGVybGluaw0K CXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6Ymx1ZTsNCgl0ZXh0LWRlY29yYXRpb246 dW5kZXJsaW5lO30NCmE6dmlzaXRlZCwgc3Bhbi5Nc29IeXBlcmxpbmtGb2xsb3dlZA0KCXttc28t c3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6cHVycGxlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRl cmxpbmU7fQ0KcC5Nc29MaXN0UGFyYWdyYXBoLCBsaS5Nc29MaXN0UGFyYWdyYXBoLCBkaXYuTXNv TGlzdFBhcmFncmFwaA0KCXttc28tc3R5bGUtcHJpb3JpdHk6MzQ7DQoJbWFyZ2luLXRvcDowaW47 DQoJbWFyZ2luLXJpZ2h0OjBpbjsNCgltYXJnaW4tYm90dG9tOjBpbjsNCgltYXJnaW4tbGVmdDou NWluOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQt ZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnAubXNvbm9ybWFsMCwgbGkubXNvbm9ybWFs MCwgZGl2Lm1zb25vcm1hbDANCgl7bXNvLXN0eWxlLW5hbWU6bXNvbm9ybWFsOw0KCW1zby1tYXJn aW4tdG9wLWFsdDphdXRvOw0KCW1hcmdpbi1yaWdodDowaW47DQoJbXNvLW1hcmdpbi1ib3R0b20t YWx0OmF1dG87DQoJbWFyZ2luLWxlZnQ6MGluOw0KCWZvbnQtc2l6ZToxMS4wcHQ7DQoJZm9udC1m YW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0Kc3Bhbi5ncm91cHdpc2VyZXBseWhlYWRlcg0K CXttc28tc3R5bGUtbmFtZTpncm91cHdpc2VyZXBseWhlYWRlcjt9DQpzcGFuLkVtYWlsU3R5bGUx OQ0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fu cy1zZXJpZjsNCgljb2xvcjojMUY0OTdEOw0KCWZvbnQtd2VpZ2h0Om5vcm1hbDsNCglmb250LXN0 eWxlOm5vcm1hbDsNCgl0ZXh0LWRlY29yYXRpb246bm9uZSBub25lO30NCnNwYW4uRW1haWxTdHls ZTIwDQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxp YnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0KLk1zb0NocERlZmF1bHQNCgl7 bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1zaXplOjEwLjBwdDt9DQpAcGFnZSBX b3JkU2VjdGlvbjENCgl7c2l6ZTo4LjVpbiAxMS4waW47DQoJbWFyZ2luOjEuMGluIDEuMGluIDEu MGluIDEuMGluO30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7cGFnZTpXb3JkU2VjdGlvbjE7fQ0KLyog TGlzdCBEZWZpbml0aW9ucyAqLw0KQGxpc3QgbDANCgl7bXNvLWxpc3QtaWQ6MTQwMDkwOTU0NjsN Cgltc28tbGlzdC10eXBlOmh5YnJpZDsNCgltc28tbGlzdC10ZW1wbGF0ZS1pZHM6LTQ4OTc3MjA0 NCAtMjAzOTcyMjM3NiA2NzY5ODY5MSA2NzY5ODY5MyA2NzY5ODY4OSA2NzY5ODY5MSA2NzY5ODY5 MyA2NzY5ODY4OSA2NzY5ODY5MSA2NzY5ODY5Mzt9DQpAbGlzdCBsMDpsZXZlbDENCgl7bXNvLWxl dmVsLXN0YXJ0LWF0OjA7DQoJbXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1s ZXZlbC10ZXh0Ou+DmDsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVt YmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5Oldp bmdkaW5nczsNCgltc28tZmFyZWFzdC1mb250LWZhbWlseTpDYWxpYnJpOw0KCW1zby1iaWRpLWZv bnQtZmFtaWx5OkNhbGlicmk7fQ0KQGxpc3QgbDA6bGV2ZWwyDQoJe21zby1sZXZlbC1udW1iZXIt Zm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDpvOw0KCW1zby1sZXZlbC10YWItc3RvcDpu b25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1 aW47DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3Ijt9DQpAbGlzdCBsMDpsZXZlbDMNCgl7bXNv LWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28t bGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJ dGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMDps ZXZlbDQNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0 Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0 aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpA bGlzdCBsMDpsZXZlbDUNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1s ZXZlbC10ZXh0Om87DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJl ci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseToiQ291 cmllciBOZXciO30NCkBsaXN0IGwwOmxldmVsNg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpi dWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0K CW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJ Zm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwwOmxldmVsNw0KCXttc28tbGV2ZWwtbnVt YmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWIt c3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVu dDotLjI1aW47DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwwOmxldmVsOA0KCXttc28t bGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6bzsNCgltc28tbGV2 ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4 dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyI7fQ0KQGxpc3QgbDA6 bGV2ZWw5DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4 dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3Np dGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7 fQ0Kb2wNCgl7bWFyZ2luLWJvdHRvbTowaW47fQ0KdWwNCgl7bWFyZ2luLWJvdHRvbTowaW47fQ0K LS0+PC9zdHlsZT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9IkVOLVVTIiBsaW5rPSJibHVlIiB2bGlu az0icHVycGxlIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8dWwgc3R5bGU9Im1hcmdp bi10b3A6MGluIiB0eXBlPSJkaXNjIj4NCjxsaSBjbGFzcz0iTXNvTGlzdFBhcmFncmFwaCIgc3R5 bGU9Im1hcmdpbi1sZWZ0OjBpbjttc28tbGlzdDpsMCBsZXZlbDEgbGZvMSI+PHNwYW4gc3R5bGU9 ImNvbG9yOiMxRjQ5N0QiPklmIHRoZXJlIHdvdWxkIGJlIHN1cHBvcnQgZm9yIGludGVncml0eSBj aXBoZXJzIGluIFRMUyAxLjMgaXQgd291bGQgZW5hYmxlIHRoZSBzdHJhaWdodCBmb3J3YXJkIHN3 aXRjaCBmcm9tIFRMUyAxLjIgYWxzbyBpbiB0aGVzZSBlbnZpcm9ubWVudHMgYnkga2VlcGluZw0K IGV4aXN0aW5nIG1vbml0b3Jpbmcgb3B0aW9ucy48L3NwYW4+PG86cD48L286cD48L2xpPjwvdWw+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzFGNDk3RCI+Jm5ic3A7 PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+V2h5IGRvIHlvdSB3 YW50IHRvIG1vdmUgdG8gVExTIDEuMz8mbmJzcDsgV2h5IGlzbuKAmXQgeW91ciBleGlzdGluZyBz b2x1dGlvbiBnb29kIGVub3VnaD88bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9ib2R5Pg0KPC9o dG1sPg0K --_000_A51CF46A8C5F4013A4CEEB90A9EE94CAakamaicom_-- From nobody Tue Aug 21 09:01:25 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 59103130F23 for ; Tue, 21 Aug 2018 09:01:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.9 X-Spam-Level: X-Spam-Status: No, score=-6.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fqK57pDyZufn for ; Tue, 21 Aug 2018 09:01:10 -0700 (PDT) Received: from gecko.sbs.de (gecko.sbs.de [194.138.37.40]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BA59A130F8A for ; Tue, 21 Aug 2018 09:01:09 -0700 (PDT) Received: from mail1.sbs.de (mail1.sbs.de [192.129.41.35]) by gecko.sbs.de (8.15.2/8.15.2) with ESMTPS id w7LG0hhI007358 (version=TLSv1.2 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 21 Aug 2018 18:00:43 +0200 Received: from DEFTHW99ERHMSX.ww902.siemens.net (defthw99erhmsx.ww902.siemens.net [139.22.70.133]) by mail1.sbs.de (8.15.2/8.15.2) with ESMTPS id w7LG0hNi023676 (version=TLSv1.2 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 21 Aug 2018 18:00:43 +0200 Received: from DENBGAT9ERDMSX.ww902.siemens.net (139.22.70.85) by DEFTHW99ERHMSX.ww902.siemens.net (139.22.70.133) with Microsoft SMTP Server (TLS) id 14.3.408.0; Tue, 21 Aug 2018 18:00:43 +0200 Received: from DENBGAT9EH2MSX.ww902.siemens.net ([169.254.6.212]) by DENBGAT9ERDMSX.ww902.siemens.net ([139.22.70.85]) with mapi id 14.03.0408.000; Tue, 21 Aug 2018 18:00:42 +0200 From: "Fries, Steffen" To: "Salz, Rich" , Andreas Walz , "tls@ietf.org" CC: "ncamwing=40cisco.com@dmarc.ietf.org" Thread-Topic: [TLS] integrity only ciphersuites Thread-Index: AQHUOVRDfNtxeeJAEUKLQicbsYfTf6TKVKsw///lHQCAACHjcA== Date: Tue, 21 Aug 2018 16:00:42 +0000 Message-ID: References: <64d23891-2f32-9bb8-1ec8-f4fad13cdfb9@cs.tcd.ie> <982363FD-A839-4175-BA53-7CA242F9ADA6@ll.mit.edu> <2D7F2926-6376-4B2C-BDE9-7A6F1C0FA748@gmail.com> <5B7C1571020000AC0015C330@gwia2.rz.hs-offenburg.de> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [139.22.70.40] Content-Type: multipart/alternative; boundary="_000_E6C9F0E527F94F4692731382340B337804AEFB10DENBGAT9EH2MSXw_" MIME-Version: 1.0 Archived-At: Subject: Re: [TLS] integrity only ciphersuites X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Aug 2018 16:01:24 -0000 --_000_E6C9F0E527F94F4692731382340B337804AEFB10DENBGAT9EH2MSXw_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 DQoNCsOYICBJZiB0aGVyZSB3b3VsZCBiZSBzdXBwb3J0IGZvciBpbnRlZ3JpdHkgY2lwaGVycyBp biBUTFMgMS4zIGl0IHdvdWxkIGVuYWJsZSB0aGUgc3RyYWlnaHQgZm9yd2FyZCBzd2l0Y2ggZnJv bSBUTFMgMS4yIGFsc28gaW4gdGhlc2UgZW52aXJvbm1lbnRzIGJ5IGtlZXBpbmcgZXhpc3Rpbmcg bW9uaXRvcmluZyBvcHRpb25zLg0KDQpXaHkgZG8geW91IHdhbnQgdG8gbW92ZSB0byBUTFMgMS4z PyAgV2h5IGlzbuKAmXQgeW91ciBleGlzdGluZyBzb2x1dGlvbiBnb29kIGVub3VnaD8NCltzdGZd IEN1cnJlbnRseSBpdCBpcyBzdWZmaWNpZW50IHRvIHVzZSBUTFMgMS4yLSBGb3IgY2VydGFpbiB1 c2UgY2FzZXMgdGhlIHV0aWxpemVkIGNvbXBvbmVudHMgaGF2ZSBhIHJhdGhlciBsb25nIGxpZmV0 aW1lLiBPbmUgYXNzdW1wdGlvbiBpcyB0aGF0IFRMUyAxLjMgd2lsbCBleGlzdCBsb25nZXIgdGhh dCBUTFMgMS4yIGFuZCB0aGF0IGNlcnRhaW4gc29mdHdhcmUgdG9vbHMgKGFsc28gYnJvd3NlcnMp IG1heSBub3Qgc3VwcG9ydCBUTFMgMS4yIGluIHRoZSBmdXR1cmUgKEkga25vdyB0aGVyZSBpcyBj dXJyZW50bHkgbm90IGludGVudGlvbiBmb3IgYSBkZXByZWNhdGlvbiBvZiAxLjIsIGJ1dCBpZiBh IGNvbXBvbmVudCBpcyBpbiB0aGUgZmllbGQgZm9yIDIwIHllYXJzLCBpdCBtYXkgYmVjb21lIG1v cmUgbGlrZWx5KS4gSGF2aW5nIHRoZSBvcHRpb24gdG8gYWxzbyBzdXBwb3J0IFRMUyAxLjMgb24g c3VjaCBkZXZpY2VzIG5vdywgbWF5IGVuc3VyZSB0aGF0IHRoZXJlIGFyZSBhY2Nlc3NpYmxlIGJ5 IHN0YW5kYXJkIHNvZnR3YXJlIGFsc28gaW4gdGhlIG1vcmUgZGlzdGFudCBmdXR1cmUuDQo= --_000_E6C9F0E527F94F4692731382340B337804AEFB10DENBGAT9EH2MSXw_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 V2luZ2RpbmdzOw0KCXBhbm9zZS0xOjUgMCAwIDAgMCAwIDAgMCAwIDA7fQ0KQGZvbnQtZmFjZQ0K CXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2IDMg MiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1 IDUgMiAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWws IGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGNtOw0KCW1hcmdpbi1ib3R0 b206LjAwMDFwdDsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixz YW5zLXNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXByaW9y aXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQphOnZp c2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5 Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnAuTXNvTGlz dFBhcmFncmFwaCwgbGkuTXNvTGlzdFBhcmFncmFwaCwgZGl2Lk1zb0xpc3RQYXJhZ3JhcGgNCgl7 bXNvLXN0eWxlLXByaW9yaXR5OjM0Ow0KCW1hcmdpbi10b3A6MGNtOw0KCW1hcmdpbi1yaWdodDow Y207DQoJbWFyZ2luLWJvdHRvbTowY207DQoJbWFyZ2luLWxlZnQ6MzYuMHB0Ow0KCW1hcmdpbi1i b3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJp IixzYW5zLXNlcmlmO30NCnAubXNvbm9ybWFsMCwgbGkubXNvbm9ybWFsMCwgZGl2Lm1zb25vcm1h bDANCgl7bXNvLXN0eWxlLW5hbWU6bXNvbm9ybWFsOw0KCW1zby1tYXJnaW4tdG9wLWFsdDphdXRv Ow0KCW1hcmdpbi1yaWdodDowY207DQoJbXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87DQoJbWFy Z2luLWxlZnQ6MGNtOw0KCWZvbnQtc2l6ZToxMS4wcHQ7DQoJZm9udC1mYW1pbHk6IkNhbGlicmki LHNhbnMtc2VyaWY7fQ0Kc3Bhbi5ncm91cHdpc2VyZXBseWhlYWRlcg0KCXttc28tc3R5bGUtbmFt ZTpncm91cHdpc2VyZXBseWhlYWRlcjt9DQpzcGFuLkVtYWlsU3R5bGUyMA0KCXttc28tc3R5bGUt dHlwZTpwZXJzb25hbDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xv cjojMUY0OTdEOw0KCWZvbnQtd2VpZ2h0Om5vcm1hbDsNCglmb250LXN0eWxlOm5vcm1hbDsNCgl0 ZXh0LWRlY29yYXRpb246bm9uZSBub25lO30NCnNwYW4uRW1haWxTdHlsZTIxDQoJe21zby1zdHls ZS10eXBlOnBlcnNvbmFsOw0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNv bG9yOndpbmRvd3RleHQ7fQ0Kc3Bhbi5FbWFpbFN0eWxlMjINCgl7bXNvLXN0eWxlLXR5cGU6cGVy c29uYWwtcmVwbHk7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6 IzFGNDk3RDsNCglmb250LXdlaWdodDpub3JtYWw7DQoJZm9udC1zdHlsZTpub3JtYWw7DQoJdGV4 dC1kZWNvcmF0aW9uOm5vbmUgbm9uZTt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5bGUtdHlw ZTpleHBvcnQtb25seTsNCglmb250LXNpemU6MTAuMHB0O30NCkBwYWdlIFdvcmRTZWN0aW9uMQ0K CXtzaXplOjYxMi4wcHQgNzkyLjBwdDsNCgltYXJnaW46NzIuMHB0IDcyLjBwdCA3Mi4wcHQgNzIu MHB0O30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7cGFnZTpXb3JkU2VjdGlvbjE7fQ0KLyogTGlzdCBE ZWZpbml0aW9ucyAqLw0KQGxpc3QgbDANCgl7bXNvLWxpc3QtaWQ6NTEzMzQzNTc0Ow0KCW1zby1s aXN0LXRlbXBsYXRlLWlkczo2MzMyMjg4NjI7fQ0KQGxpc3QgbDA6bGV2ZWwxDQoJe21zby1sZXZl bC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVs LXRhYi1zdG9wOjM2LjBwdDsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4 dC1pbmRlbnQ6LTE4LjBwdDsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFt aWx5OlN5bWJvbDt9DQpAbGlzdCBsMDpsZXZlbDINCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6 YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6NzIuMHB0 Ow0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0 Ow0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBs aXN0IGwwOmxldmVsMw0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxl dmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDoxMDguMHB0Ow0KCW1zby1sZXZlbC1u dW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0Ow0KCW1zby1hbnNpLWZv bnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwwOmxldmVsNA0K CXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0K CW1zby1sZXZlbC10YWItc3RvcDoxNDQuMHB0Ow0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246 bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0Ow0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7 DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwwOmxldmVsNQ0KCXttc28tbGV2ZWwtbnVt YmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWIt c3RvcDoxODAuMHB0Ow0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWlu ZGVudDotMTguMHB0Ow0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6 U3ltYm9sO30NCkBsaXN0IGwwOmxldmVsNg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxs ZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDoyMTYuMHB0Ow0K CW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0Ow0K CW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0 IGwwOmxldmVsNw0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVs LXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDoyNTIuMHB0Ow0KCW1zby1sZXZlbC1udW1i ZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0Ow0KCW1zby1hbnNpLWZvbnQt c2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwwOmxldmVsOA0KCXtt c28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1z by1sZXZlbC10YWItc3RvcDoyODguMHB0Ow0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVm dDsNCgl0ZXh0LWluZGVudDotMTguMHB0Ow0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJ Zm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwwOmxldmVsOQ0KCXttc28tbGV2ZWwtbnVtYmVy LWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3Rv cDozMjQuMHB0Ow0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVu dDotMTguMHB0Ow0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6U3lt Ym9sO30NCkBsaXN0IGwxDQoJe21zby1saXN0LWlkOjE0MDA5MDk1NDY7DQoJbXNvLWxpc3QtdHlw ZTpoeWJyaWQ7DQoJbXNvLWxpc3QtdGVtcGxhdGUtaWRzOi00ODk3NzIwNDQgLTIwMzk3MjIzNzYg Njc2OTg2OTEgNjc2OTg2OTMgNjc2OTg2ODkgNjc2OTg2OTEgNjc2OTg2OTMgNjc2OTg2ODkgNjc2 OTg2OTEgNjc2OTg2OTM7fQ0KQGxpc3QgbDE6bGV2ZWwxDQoJe21zby1sZXZlbC1zdGFydC1hdDow Ow0KCW1zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvg5g7 DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjps ZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzOw0KCW1z by1mYXJlYXN0LWZvbnQtZmFtaWx5OkNhbGlicmk7DQoJbXNvLWJpZGktZm9udC1mYW1pbHk6Q2Fs aWJyaTt9DQpAbGlzdCBsMTpsZXZlbDINCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0 Ow0KCW1zby1sZXZlbC10ZXh0Om87DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxl dmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJZm9udC1m YW1pbHk6IkNvdXJpZXIgTmV3Ijt9DQpAbGlzdCBsMTpsZXZlbDMNCgl7bXNvLWxldmVsLW51bWJl ci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0 b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6 LTE4LjBwdDsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDE6bGV2ZWw0DQoJe21z by1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNv LWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0K CXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwxOmxl dmVsNQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6 bzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9u OmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDsNCglmb250LWZhbWlseToiQ291cmllciBOZXci O30NCkBsaXN0IGwxOmxldmVsNg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJ bXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZl bC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0Ow0KCWZvbnQtZmFt aWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMTpsZXZlbDcNCgl7bXNvLWxldmVsLW51bWJlci1mb3Jt YXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9u ZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBw dDsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDE6bGV2ZWw4DQoJe21zby1sZXZlbC1u dW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDpvOw0KCW1zby1sZXZlbC10YWIt c3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVu dDotMTguMHB0Ow0KCWZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyI7fQ0KQGxpc3QgbDE6bGV2ZWw5 DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7 DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjps ZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCm9s DQoJe21hcmdpbi1ib3R0b206MGNtO30NCnVsDQoJe21hcmdpbi1ib3R0b206MGNtO30NCi0tPjwv c3R5bGU+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWRlZmF1bHRzIHY6ZXh0PSJl ZGl0IiBzcGlkbWF4PSIxMDI2IiAvPg0KPC94bWw+PCFbZW5kaWZdLS0+PCEtLVtpZiBndGUgbXNv IDldPjx4bWw+DQo8bzpzaGFwZWxheW91dCB2OmV4dD0iZWRpdCI+DQo8bzppZG1hcCB2OmV4dD0i ZWRpdCIgZGF0YT0iMSIgLz4NCjwvbzpzaGFwZWxheW91dD48L3htbD48IVtlbmRpZl0tLT4NCjwv aGVhZD4NCjxib2R5IGxhbmc9IkRFIiBsaW5rPSJibHVlIiB2bGluaz0icHVycGxlIj4NCjxkaXYg Y2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJF Ti1VUyIgc3R5bGU9ImNvbG9yOiMxRjQ5N0Q7bXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMiPjxv OnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt YXJnaW4tbGVmdDozNS40cHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjcxLjRwdDt0ZXh0LWluZGVudDotMTguMHB0O21zby1s aXN0OmwxIGxldmVsMSBsZm8zIj4NCjwhW2lmICFzdXBwb3J0TGlzdHNdPjxzcGFuIGxhbmc9IkVO LVVTIiBzdHlsZT0iZm9udC1mYW1pbHk6V2luZ2RpbmdzIj48c3BhbiBzdHlsZT0ibXNvLWxpc3Q6 SWdub3JlIj7DmDxzcGFuIHN0eWxlPSJmb250OjcuMHB0ICZxdW90O1RpbWVzIE5ldyBSb21hbiZx dW90OyI+Jm5ic3A7DQo8L3NwYW4+PC9zcGFuPjwvc3Bhbj48IVtlbmRpZl0+PHNwYW4gbGFuZz0i RU4tVVMiIHN0eWxlPSJjb2xvcjojMUY0OTdEIj5JZiB0aGVyZSB3b3VsZCBiZSBzdXBwb3J0IGZv ciBpbnRlZ3JpdHkgY2lwaGVycyBpbiBUTFMgMS4zIGl0IHdvdWxkIGVuYWJsZSB0aGUgc3RyYWln aHQgZm9yd2FyZCBzd2l0Y2ggZnJvbSBUTFMgMS4yIGFsc28gaW4gdGhlc2UgZW52aXJvbm1lbnRz IGJ5IGtlZXBpbmcgZXhpc3RpbmcgbW9uaXRvcmluZyBvcHRpb25zLjwvc3Bhbj48c3BhbiBsYW5n PSJFTi1VUyI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1hcmdpbi1sZWZ0OjM1LjRwdCI+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJjb2xvcjoj MUY0OTdEIj4mbmJzcDs8L3NwYW4+PHNwYW4gbGFuZz0iRU4tVVMiPjxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNS40cHQiPjxz cGFuIGxhbmc9IkVOLVVTIj5XaHkgZG8geW91IHdhbnQgdG8gbW92ZSB0byBUTFMgMS4zPyZuYnNw OyBXaHkgaXNu4oCZdCB5b3VyIGV4aXN0aW5nIHNvbHV0aW9uIGdvb2QgZW5vdWdoPzxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIiBz dHlsZT0iY29sb3I6IzFGNDk3RCI+W3N0Zl0gQ3VycmVudGx5IGl0IGlzIHN1ZmZpY2llbnQgdG8g dXNlIFRMUyAxLjItIEZvciBjZXJ0YWluIHVzZSBjYXNlcyB0aGUgdXRpbGl6ZWQgY29tcG9uZW50 cyBoYXZlIGEgcmF0aGVyIGxvbmcgbGlmZXRpbWUuIE9uZSBhc3N1bXB0aW9uIGlzIHRoYXQgVExT IDEuMyB3aWxsIGV4aXN0IGxvbmdlciB0aGF0IFRMUyAxLjIgYW5kIHRoYXQNCiBjZXJ0YWluIHNv ZnR3YXJlIHRvb2xzIChhbHNvIGJyb3dzZXJzKSBtYXkgbm90IHN1cHBvcnQgVExTIDEuMiBpbiB0 aGUgZnV0dXJlIChJIGtub3cgdGhlcmUgaXMgY3VycmVudGx5IG5vdCBpbnRlbnRpb24gZm9yIGEg ZGVwcmVjYXRpb24gb2YgMS4yLCBidXQgaWYgYSBjb21wb25lbnQgaXMgaW4gdGhlIGZpZWxkIGZv ciAyMCB5ZWFycywgaXQgbWF5IGJlY29tZSBtb3JlIGxpa2VseSkuIEhhdmluZyB0aGUgb3B0aW9u IHRvIGFsc28gc3VwcG9ydCBUTFMNCiAxLjMgb24gc3VjaCBkZXZpY2VzIG5vdywgbWF5IGVuc3Vy ZSB0aGF0IHRoZXJlIGFyZSBhY2Nlc3NpYmxlIGJ5IHN0YW5kYXJkIHNvZnR3YXJlIGFsc28gaW4g dGhlIG1vcmUgZGlzdGFudCBmdXR1cmUuDQo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4N CjwvYm9keT4NCjwvaHRtbD4NCg== --_000_E6C9F0E527F94F4692731382340B337804AEFB10DENBGAT9EH2MSXw_-- From nobody Tue Aug 21 09:13:15 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A821E130E45 for ; Tue, 21 Aug 2018 09:13:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.909 X-Spam-Level: X-Spam-Status: No, score=-1.909 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_DKIMWL_WL_MED=-0.01, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8gMDYdpzLZUe for ; Tue, 21 Aug 2018 09:13:10 -0700 (PDT) Received: from mail-io0-x236.google.com (mail-io0-x236.google.com [IPv6:2607:f8b0:4001:c06::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BA049130DC3 for ; Tue, 21 Aug 2018 09:13:10 -0700 (PDT) Received: by mail-io0-x236.google.com with SMTP id y3-v6so11446782ioc.5 for ; Tue, 21 Aug 2018 09:13:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=3VM+q/J8uH7W3lFdQ4X9NDgCSkMFWkryXsWgIhDMesY=; b=w/7BcgVl3lQFAnnatzqV31mrN1yUuxASS6XCruoDY96XRQwQMqkHsjD711vG1Df4m5 fkF46VDFu9Bk1rsaqwPcHlPq7r1HYI1p4gpifyvYuOPuhUXrLgYQMNdwzzaOHN6rMKEE EvOi+5frglUdhZbyXLKiT278TSA4aA0pZV4KPEGw5jkgeoGSfrOnT9GdltGKGzWzkch0 6jxE6pz4mbjW6uu8GLLsEmK2PsbCIhUKqzqsYuvx2ioiB+eZw9oWpRUNHiz+94SB+rxZ x7ZYhOr/6sWUTVQ9Gzk6va44K1W0IF52Ob6y3gVtGKACsnV1v2AAKqGsLHHTVNyedXgR wdOw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=3VM+q/J8uH7W3lFdQ4X9NDgCSkMFWkryXsWgIhDMesY=; b=R6JjGmXGNls3zJcmWEuIND+qUZXyXwPBcFjh0iLgxh8yL3wk3HU1y5CSPxK6jLBNpX 2EZLFRoLDWtXs+9bfXodimuyKKEyeB5ai9kvgCxWipd0+ZTkdXvaoWKCVCb2X285vzZI vlBG+qmKtUbSFqBIlomryW4NV6aza9I2izZ48sefo8Kd80VcZc91vFLwlYfCNCq2+dfZ H1L6PNEwCOcnM9tCShnIkoIbcZGAoCNpDQCwQsd8oSTwwmw0vy+SC+/MedkhbIEWzebS OgtHsOyjmEMVQyuNZ7TdC8YVkQdRDIujsSo5n2ETsw16Q2dltrWocbjRIN1y62YBSReV JVjA== X-Gm-Message-State: AOUpUlEE9GX1TMW6lMk7dxV9kU3ck1vm5skwZeLAHqu2czZJ2bZNFQqS 8SVXVvu9PjEnkMd9vdzkqw7mu5ozWpWf8poUE3BtXGfs X-Google-Smtp-Source: AA+uWPwQe139sffE9WKLg8e6RJDfdlcfYqWv9i8+DSTR+1Pwg1Ipv1vdBGwF6kYeE6QkL9zb3g9R8ODDmpMas8RgWMc= X-Received: by 2002:a6b:dd01:: with SMTP id f1-v6mr42228310ioc.45.1534867990029; Tue, 21 Aug 2018 09:13:10 -0700 (PDT) MIME-Version: 1.0 Received: by 2002:a4f:a009:0:0:0:0:0 with HTTP; Tue, 21 Aug 2018 09:12:29 -0700 (PDT) In-Reply-To: References: <64d23891-2f32-9bb8-1ec8-f4fad13cdfb9@cs.tcd.ie> <982363FD-A839-4175-BA53-7CA242F9ADA6@ll.mit.edu> <2D7F2926-6376-4B2C-BDE9-7A6F1C0FA748@gmail.com> <5B7C1571020000AC0015C330@gwia2.rz.hs-offenburg.de> From: Ted Lemon Date: Tue, 21 Aug 2018 12:12:29 -0400 Message-ID: To: "Fries, Steffen" Cc: "Salz, Rich" , Andreas Walz , "tls@ietf.org" , "ncamwing=40cisco.com@dmarc.ietf.org" Content-Type: multipart/alternative; boundary="00000000000052c0930573f44d0b" Archived-At: Subject: Re: [TLS] integrity only ciphersuites X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Aug 2018 16:13:14 -0000 --00000000000052c0930573f44d0b Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable This is a situation where there is a clear alternative: use IPsec. IPsec is ideal for the problem space you are in. TLS is actually really not ideal. You are trying to cram a round peg into a square hole. On Tue, Aug 21, 2018 at 12:00 PM, Fries, Steffen wrote: > > > > > =C3=98 If there would be support for integrity ciphers in TLS 1.3 it wou= ld > enable the straight forward switch from TLS 1.2 also in these environment= s > by keeping existing monitoring options. > > > > Why do you want to move to TLS 1.3? Why isn=E2=80=99t your existing solu= tion good > enough? > > [stf] Currently it is sufficient to use TLS 1.2- For certain use cases th= e > utilized components have a rather long lifetime. One assumption is that T= LS > 1.3 will exist longer that TLS 1.2 and that certain software tools (also > browsers) may not support TLS 1.2 in the future (I know there is currentl= y > not intention for a deprecation of 1.2, but if a component is in the fiel= d > for 20 years, it may become more likely). Having the option to also suppo= rt > TLS 1.3 on such devices now, may ensure that there are accessible by > standard software also in the more distant future. > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > > --00000000000052c0930573f44d0b Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
This is a situation where there is a clear alternative: us= e IPsec.=C2=A0 =C2=A0IPsec is ideal for the problem space you are in.=C2=A0= =C2=A0TLS is actually really not ideal.=C2=A0 =C2=A0You are trying to cram= a round peg into a square hole.

On Tue, Aug 21, 2018 at 12:00 PM, Fries, Steffen <steffen.fries@siemens.com> wrote:

= =C2=A0

=C2=A0

=C3=98=C2=A0 If= there would be support for integrity ciphers in TLS 1.3 it would enable th= e straight forward switch from TLS 1.2 also in these environments by keepin= g existing monitoring options.

=C2=A0

Wh= y do you want to move to TLS 1.3?=C2=A0 Why isn=E2=80=99t your existing sol= ution good enough?

= [stf] Currently it is sufficient to use TLS 1.2- For certain use cases the = utilized components have a rather long lifetime. One assumption is that TLS= 1.3 will exist longer that TLS 1.2 and that certain software tools (also browsers) may not support TLS 1.2 in the futu= re (I know there is currently not intention for a deprecation of 1.2, but i= f a component is in the field for 20 years, it may become more likely). Hav= ing the option to also support TLS 1.3 on such devices now, may ensure that there are accessible by standard = software also in the more distant future.


_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls


--00000000000052c0930573f44d0b-- From nobody Tue Aug 21 09:14:06 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 914B9130F52 for ; Tue, 21 Aug 2018 09:13:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.71 X-Spam-Level: X-Spam-Status: No, score=-2.71 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=akamai.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id h5zPtezJwVPs for ; Tue, 21 Aug 2018 09:13:50 -0700 (PDT) Received: from mx0b-00190b01.pphosted.com (mx0b-00190b01.pphosted.com [IPv6:2620:100:9005:57f::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EBA0E130F2B for ; Tue, 21 Aug 2018 09:13:48 -0700 (PDT) Received: from pps.filterd (m0050102.ppops.net [127.0.0.1]) by m0050102.ppops.net-00190b01. (8.16.0.22/8.16.0.22) with SMTP id w7LG6kdk031193; Tue, 21 Aug 2018 17:13:37 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=akamai.com; h=from : to : cc : subject : date : message-id : references : in-reply-to : content-type : mime-version; s=jan2016.eng; bh=Ax5Bms2Y7Kf61QsSLBiSlmaNzoICmf+8/HUEHHovWLc=; b=U8zrslRSSrlFrcDsbdZbKqHwWHdSvjWnTriTw9qIuaVkz0rFw/g7dmBBZaOBwKPtqs6V FCg2CWLLEmGNtjcNsPKhMEZZP79zQSwPosnCOLendnO9BUmo5PF1+hGIRTWwWmQXPBXQ 83QSVZnwt9HIKf4Hg+u/GA3rMO1rMhIb5ud8iUf/FxYnlcFCU+LBIA7cceK/+VyFNDWF bxTcYIqxO4TztlkBOHfZy6ntg65WfmdsUXnJN4iM6yAfJBC1zfT6IUwrXQiwvM/q9IqW lhnwc4N90Ikh2zQJNHuT1HoepO1CiKpl7/uTUjHfbFxqdeTE3SLOyhF965rJHVmvWO0A 7Q== Received: from prod-mail-ppoint1 (prod-mail-ppoint1.akamai.com [184.51.33.18]) by m0050102.ppops.net-00190b01. with ESMTP id 2kx8hc9sb8-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 21 Aug 2018 17:13:36 +0100 Received: from pps.filterd (prod-mail-ppoint1.akamai.com [127.0.0.1]) by prod-mail-ppoint1.akamai.com (8.16.0.21/8.16.0.21) with SMTP id w7LGAxSA020281; Tue, 21 Aug 2018 12:13:36 -0400 Received: from email.msg.corp.akamai.com ([172.27.123.31]) by prod-mail-ppoint1.akamai.com with ESMTP id 2kxesuy6rr-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Tue, 21 Aug 2018 12:13:35 -0400 Received: from USMA1EX-DAG1MB5.msg.corp.akamai.com (172.27.123.105) by usma1ex-dag1mb6.msg.corp.akamai.com (172.27.123.65) with Microsoft SMTP Server (TLS) id 15.0.1365.1; Tue, 21 Aug 2018 12:13:35 -0400 Received: from USMA1EX-DAG1MB1.msg.corp.akamai.com (172.27.123.101) by usma1ex-dag1mb5.msg.corp.akamai.com (172.27.123.105) with Microsoft SMTP Server (TLS) id 15.0.1365.1; Tue, 21 Aug 2018 12:13:35 -0400 Received: from USMA1EX-DAG1MB1.msg.corp.akamai.com ([172.27.123.101]) by usma1ex-dag1mb1.msg.corp.akamai.com ([172.27.123.101]) with mapi id 15.00.1365.000; Tue, 21 Aug 2018 12:13:35 -0400 From: "Salz, Rich" To: "Fries, Steffen" , Andreas Walz , "tls@ietf.org" CC: "ncamwing=40cisco.com@dmarc.ietf.org" Thread-Topic: [TLS] integrity only ciphersuites Thread-Index: AQHUOMcWIQ0ztQCz9UKccOekmBKud6TKWVQAgAAIAoCAABIwgIAABf+AgAAjtwD//78uAIAARU8A///Ai4A= Date: Tue, 21 Aug 2018 16:13:35 +0000 Message-ID: References: <64d23891-2f32-9bb8-1ec8-f4fad13cdfb9@cs.tcd.ie> <982363FD-A839-4175-BA53-7CA242F9ADA6@ll.mit.edu> <2D7F2926-6376-4B2C-BDE9-7A6F1C0FA748@gmail.com> <5B7C1571020000AC0015C330@gwia2.rz.hs-offenburg.de> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.10.0.180812 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [172.19.35.74] Content-Type: multipart/alternative; boundary="_000_D5FF0E0EF9C34843AB7719F45E3C00D5akamaicom_" MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2018-08-21_08:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 mlxscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1807170000 definitions=main-1808210168 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2018-08-21_08:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1807170000 definitions=main-1808210168 Archived-At: Subject: Re: [TLS] integrity only ciphersuites X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Aug 2018 16:14:04 -0000 --_000_D5FF0E0EF9C34843AB7719F45E3C00D5akamaicom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 w5ggIElmIHRoZXJlIHdvdWxkIGJlIHN1cHBvcnQgZm9yIGludGVncml0eSBjaXBoZXJzIGluIFRM UyAxLjMgaXQgd291bGQgZW5hYmxlIHRoZSBzdHJhaWdodCBmb3J3YXJkIHN3aXRjaCBmcm9tIFRM UyAxLjIgYWxzbyBpbiB0aGVzZSBlbnZpcm9ubWVudHMgYnkga2VlcGluZyBleGlzdGluZyBtb25p dG9yaW5nIG9wdGlvbnMuDQoNCldoeSBkbyB5b3Ugd2FudCB0byBtb3ZlIHRvIFRMUyAxLjM/ICBX aHkgaXNu4oCZdCB5b3VyIGV4aXN0aW5nIHNvbHV0aW9uIGdvb2QgZW5vdWdoPw0KDQoNCiAgKiAg IFtzdGZdIEN1cnJlbnRseSBpdCBpcyBzdWZmaWNpZW50IHRvIHVzZSBUTFMgMS4yLSBGb3IgY2Vy dGFpbiB1c2UgY2FzZXMgdGhlIHV0aWxpemVkIGNvbXBvbmVudHMgaGF2ZSBhIHJhdGhlciBsb25n IGxpZmV0aW1lLiBPbmUgYXNzdW1wdGlvbiBpcyB0aGF0IFRMUyAxLjMgd2lsbCBleGlzdCBsb25n ZXIgdGhhdCBUTFMgMS4yIGFuZCB0aGF0IGNlcnRhaW4gc29mdHdhcmUgdG9vbHMgKGFsc28gYnJv d3NlcnMpIG1heSBub3Qgc3VwcG9ydCBUTFMgMS4yIGluIHRoZSBmdXR1cmUgIOKApg0KDQpNb3N0 IGJyb3dzZXJzIGFscmVhZHkgZG8gbm90IHN1cHBvcnQgTlVMTCBlbmNyeXB0aW9uLCBhbmQgaXQg aXMgaGlnaGx5IHVubGlrZWx5IHRoYXQgYW55IHdpbGwgYWRkIGl0IGZvciAxLjMuICBIYXZlIHlv dSBhbnkgaW5kaWNhdGlvbiBvdGhlcndpc2U/ICBJZiB5b3XigJlyZSBub3QgZ29pbmcgdG8gdXNl IHRoZSBhbGdvcml0aG1zIGluIGdlbmVyYWwgdXNlIG9uIHRoZSBwdWJsaWMgSW50ZXJuZXQsIHRo ZW4geW91IHNob3VsZCBleHBlY3QgdGhhdCBzdGFuZGFyZCBjbGllbnRzIHN1Y2ggYXMgYnJvd3Nl cnMsIHdpbGwgbm90IHdvcmsuICBQZXRlckcgY2FuIGF0dGVzdCB0byB0aGlzLiA6KQ0KDQo= --_000_D5FF0E0EF9C34843AB7719F45E3C00D5akamaicom_ Content-Type: text/html; charset="utf-8" Content-ID: <722024D709DF114C8260B49C5F6165C2@akamai.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseTpXaW5nZGluZ3M7DQoJcGFub3NlLTE6NSAwIDAgMCAwIDAgMCAwIDAg MDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJDYW1icmlhIE1hdGgiOw0KCXBhbm9zZS0x OjIgNCA1IDMgNSA0IDYgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDYWxpYnJp Ow0KCXBhbm9zZS0xOjIgMTUgNSAyIDIgMiA0IDMgMiA0O30NCi8qIFN0eWxlIERlZmluaXRpb25z ICovDQpwLk1zb05vcm1hbCwgbGkuTXNvTm9ybWFsLCBkaXYuTXNvTm9ybWFsDQoJe21hcmdpbjow aW47DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMS4wcHQ7DQoJZm9udC1m YW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0KYTpsaW5rLCBzcGFuLk1zb0h5cGVybGluaw0K CXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6Ymx1ZTsNCgl0ZXh0LWRlY29yYXRpb246 dW5kZXJsaW5lO30NCmE6dmlzaXRlZCwgc3Bhbi5Nc29IeXBlcmxpbmtGb2xsb3dlZA0KCXttc28t c3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6cHVycGxlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRl cmxpbmU7fQ0KcC5Nc29MaXN0UGFyYWdyYXBoLCBsaS5Nc29MaXN0UGFyYWdyYXBoLCBkaXYuTXNv TGlzdFBhcmFncmFwaA0KCXttc28tc3R5bGUtcHJpb3JpdHk6MzQ7DQoJbWFyZ2luLXRvcDowaW47 DQoJbWFyZ2luLXJpZ2h0OjBpbjsNCgltYXJnaW4tYm90dG9tOjBpbjsNCgltYXJnaW4tbGVmdDou NWluOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQt ZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnAubXNvbm9ybWFsMCwgbGkubXNvbm9ybWFs MCwgZGl2Lm1zb25vcm1hbDANCgl7bXNvLXN0eWxlLW5hbWU6bXNvbm9ybWFsOw0KCW1zby1tYXJn aW4tdG9wLWFsdDphdXRvOw0KCW1hcmdpbi1yaWdodDowaW47DQoJbXNvLW1hcmdpbi1ib3R0b20t YWx0OmF1dG87DQoJbWFyZ2luLWxlZnQ6MGluOw0KCWZvbnQtc2l6ZToxMS4wcHQ7DQoJZm9udC1m YW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0Kc3Bhbi5ncm91cHdpc2VyZXBseWhlYWRlcg0K CXttc28tc3R5bGUtbmFtZTpncm91cHdpc2VyZXBseWhlYWRlcjt9DQpzcGFuLkVtYWlsU3R5bGUy MA0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fu cy1zZXJpZjsNCgljb2xvcjojMUY0OTdEOw0KCWZvbnQtd2VpZ2h0Om5vcm1hbDsNCglmb250LXN0 eWxlOm5vcm1hbDsNCgl0ZXh0LWRlY29yYXRpb246bm9uZSBub25lO30NCnNwYW4uRW1haWxTdHls ZTIxDQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsOw0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixz YW5zLXNlcmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0Kc3Bhbi5FbWFpbFN0eWxlMjINCgl7bXNv LXN0eWxlLXR5cGU6cGVyc29uYWw7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7 DQoJY29sb3I6IzFGNDk3RDsNCglmb250LXdlaWdodDpub3JtYWw7DQoJZm9udC1zdHlsZTpub3Jt YWw7DQoJdGV4dC1kZWNvcmF0aW9uOm5vbmUgbm9uZTt9DQpzcGFuLkVtYWlsU3R5bGUyMw0KCXtt c28tc3R5bGUtdHlwZTpwZXJzb25hbC1yZXBseTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fu cy1zZXJpZjsNCgljb2xvcjp3aW5kb3d0ZXh0O30NCi5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHls ZS10eXBlOmV4cG9ydC1vbmx5Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7fQ0KQHBhZ2UgV29yZFNlY3Rp b24xDQoJe3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBpbiAxLjBpbiAxLjBp bjt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi8qIExpc3QgRGVm aW5pdGlvbnMgKi8NCkBsaXN0IGwwDQoJe21zby1saXN0LWlkOjE0MDA5MDk1NDY7DQoJbXNvLWxp c3QtdHlwZTpoeWJyaWQ7DQoJbXNvLWxpc3QtdGVtcGxhdGUtaWRzOi00ODk3NzIwNDQgLTIwMzk3 MjIzNzYgNjc2OTg2OTEgNjc2OTg2OTMgNjc2OTg2ODkgNjc2OTg2OTEgNjc2OTg2OTMgNjc2OTg2 ODkgNjc2OTg2OTEgNjc2OTg2OTM7fQ0KQGxpc3QgbDA6bGV2ZWwxDQoJe21zby1sZXZlbC1zdGFy dC1hdDowOw0KCW1zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4 dDrvg5g7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3Np dGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7 DQoJbXNvLWZhcmVhc3QtZm9udC1mYW1pbHk6Q2FsaWJyaTsNCgltc28tYmlkaS1mb250LWZhbWls eTpDYWxpYnJpO30NCkBsaXN0IGwwOmxldmVsMg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpi dWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6bzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCglt c28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZv bnQtZmFtaWx5OiJDb3VyaWVyIE5ldyI7fQ0KQGxpc3QgbDA6bGV2ZWwzDQoJe21zby1sZXZlbC1u dW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRh Yi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5k ZW50Oi0uMjVpbjsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDA6bGV2ZWw0DQoJ e21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJ bXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0 Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDA6 bGV2ZWw1DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4 dDpvOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRp b246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3 Ijt9DQpAbGlzdCBsMDpsZXZlbDYNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0K CW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2 ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFt aWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMDpsZXZlbDcNCgl7bXNvLWxldmVsLW51bWJlci1mb3Jt YXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9u ZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWlu Ow0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMDpsZXZlbDgNCgl7bXNvLWxldmVsLW51 bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Om87DQoJbXNvLWxldmVsLXRhYi1z dG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50 Oi0uMjVpbjsNCglmb250LWZhbWlseToiQ291cmllciBOZXciO30NCkBsaXN0IGwwOmxldmVsOQ0K CXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0K CW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVm dDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCm9sDQoJ e21hcmdpbi1ib3R0b206MGluO30NCnVsDQoJe21hcmdpbi1ib3R0b206MGluO30NCi0tPjwvc3R5 bGU+DQo8L2hlYWQ+DQo8Ym9keSBsYW5nPSJFTi1VUyIgbGluaz0iYmx1ZSIgdmxpbms9InB1cnBs ZSI+DQo8ZGl2IGNsYXNzPSJXb3JkU2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1hcmdpbi1sZWZ0OjcxLjRwdDt0ZXh0LWluZGVudDotLjI1aW47bXNvLWxpc3Q6bDAgbGV2 ZWwxIGxmbzIiPg0KPCFbaWYgIXN1cHBvcnRMaXN0c10+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5 OldpbmdkaW5ncyI+PHNwYW4gc3R5bGU9Im1zby1saXN0Oklnbm9yZSI+w5g8c3BhbiBzdHlsZT0i Zm9udDo3LjBwdCAmcXVvdDtUaW1lcyBOZXcgUm9tYW4mcXVvdDsiPiZuYnNwOw0KPC9zcGFuPjwv c3Bhbj48L3NwYW4+PCFbZW5kaWZdPjxzcGFuIHN0eWxlPSJjb2xvcjojMUY0OTdEIj5JZiB0aGVy ZSB3b3VsZCBiZSBzdXBwb3J0IGZvciBpbnRlZ3JpdHkgY2lwaGVycyBpbiBUTFMgMS4zIGl0IHdv dWxkIGVuYWJsZSB0aGUgc3RyYWlnaHQgZm9yd2FyZCBzd2l0Y2ggZnJvbSBUTFMgMS4yIGFsc28g aW4gdGhlc2UgZW52aXJvbm1lbnRzIGJ5IGtlZXBpbmcgZXhpc3RpbmcgbW9uaXRvcmluZyBvcHRp b25zLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt YXJnaW4tbGVmdDozNS40cHQiPjxzcGFuIHN0eWxlPSJjb2xvcjojMUY0OTdEIj4mbmJzcDs8L3Nw YW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxl ZnQ6MzUuNHB0Ij5XaHkgZG8geW91IHdhbnQgdG8gbW92ZSB0byBUTFMgMS4zPyZuYnNwOyBXaHkg aXNu4oCZdCB5b3VyIGV4aXN0aW5nIHNvbHV0aW9uIGdvb2QgZW5vdWdoPzxvOnA+PC9vOnA+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8dWwgc3R5bGU9 Im1hcmdpbi10b3A6MGluIiB0eXBlPSJkaXNjIj4NCjxsaSBjbGFzcz0iTXNvTGlzdFBhcmFncmFw aCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjBpbjttc28tbGlzdDpsMCBsZXZlbDEgbGZvMiI+PHNwYW4g c3R5bGU9ImNvbG9yOiMxRjQ5N0QiPltzdGZdIEN1cnJlbnRseSBpdCBpcyBzdWZmaWNpZW50IHRv IHVzZSBUTFMgMS4yLSBGb3IgY2VydGFpbiB1c2UgY2FzZXMgdGhlIHV0aWxpemVkIGNvbXBvbmVu dHMgaGF2ZSBhIHJhdGhlciBsb25nIGxpZmV0aW1lLiBPbmUgYXNzdW1wdGlvbiBpcyB0aGF0IFRM UyAxLjMNCiB3aWxsIGV4aXN0IGxvbmdlciB0aGF0IFRMUyAxLjIgYW5kIHRoYXQgY2VydGFpbiBz b2Z0d2FyZSB0b29scyAoYWxzbyBicm93c2VycykgbWF5IG5vdCBzdXBwb3J0IFRMUyAxLjIgaW4g dGhlIGZ1dHVyZQ0KPC9zcGFuPiZuYnNwO+KApjxvOnA+PC9vOnA+PC9saT48L3VsPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij5Nb3N0IGJyb3dzZXJzIGFscmVhZHkgZG8gbm90IHN1cHBvcnQgTlVMTCBlbmNyeXB0aW9uLCBh bmQgaXQgaXMgaGlnaGx5IHVubGlrZWx5IHRoYXQgYW55IHdpbGwgYWRkIGl0IGZvciAxLjMuJm5i c3A7IEhhdmUgeW91IGFueSBpbmRpY2F0aW9uIG90aGVyd2lzZT8mbmJzcDsgSWYgeW914oCZcmUg bm90IGdvaW5nIHRvIHVzZSB0aGUgYWxnb3JpdGhtcyBpbiBnZW5lcmFsIHVzZSBvbiB0aGUgcHVi bGljIEludGVybmV0LCB0aGVuIHlvdQ0KIHNob3VsZCBleHBlY3QgdGhhdCBzdGFuZGFyZCBjbGll bnRzIHN1Y2ggYXMgYnJvd3NlcnMsIHdpbGwgbm90IHdvcmsuJm5ic3A7IFBldGVyRyBjYW4gYXR0 ZXN0IHRvIHRoaXMuIDopPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpw PiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9ib2R5Pg0KPC9odG1sPg0K --_000_D5FF0E0EF9C34843AB7719F45E3C00D5akamaicom_-- From nobody Tue Aug 21 09:16:23 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EC008130E45 for ; Tue, 21 Aug 2018 09:16:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.909 X-Spam-Level: X-Spam-Status: No, score=-1.909 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_DKIMWL_WL_MED=-0.01, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jaQs0K8o8yss for ; Tue, 21 Aug 2018 09:16:17 -0700 (PDT) Received: from mail-io0-x242.google.com (mail-io0-x242.google.com [IPv6:2607:f8b0:4001:c06::242]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6E5FB130DC3 for ; Tue, 21 Aug 2018 09:16:17 -0700 (PDT) Received: by mail-io0-x242.google.com with SMTP id y12-v6so6113029ioj.13 for ; Tue, 21 Aug 2018 09:16:17 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=1DFC3feNXQkNDKHm4GrY/FtsQs8nUd5fHonnqfCKrKM=; b=zzChveEG948ivDVP1IB6fAqM3yE5Tvg2lfo3SRjL2LM7TT/DBjOcgBnC0YID+oA8I7 NrR9rWsZ+Mijo09JCEd5l1yh18NHrGcN1Ok5z6iFTYykHbyV9q1E3jKY9B9crZPI2cIC I8J6mdS53m86YeA4W6erWfkjVk0bHGQAqAvxb872+qnSuGdm31dBUKACg94AoOPeZL9G s2c3Gt7jeymzE3dWxV51UqAI5u0YIwwZmSh5GtKddHF+So/mr7nN5OtGFNmy0M3TOt9b mf9oBZZlqTvjroaNsOUpQoo3ZOnNnNVMAd3GH0RrAyegs7a9UkBoq78av91IiS4B9fky W7EQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=1DFC3feNXQkNDKHm4GrY/FtsQs8nUd5fHonnqfCKrKM=; b=VLUxUCWN07UUX3C+zEZM8lg3+zzshavs90sjHhT3YYhal8s3P7F6kV1MIyMLAPf4BF /h6xy3ft+tDNtiY2EbNsR1oO8ttXxmRp8XNPayG1o4JtO+xaivuv9yC4dH34NGySWoHI VpjjUTRc0jTp1rXbrA84k8iJdLE9dlpxca1Cu92Uko2whSm0navepFdXC3SYGI5JLnft Fhnsh6xcPyhnkQicSf+dolEVAAeo95CO5JI9qnGQa2uQTNF7KjbfIJ05Ln5pstiVhN0K DkkPRPhC1QnCeHZZ5ZMkjpqlcCeQY3F2nVKqrZ/D/XmgCvTHuiO3XV1a93R/h1vxfqD3 U1fw== X-Gm-Message-State: AOUpUlFSZlsawvvkFFinIuNOuq37gF5Sc+CNz1SAtJqAYaDhgk5mN+bZ fJ60nIo5l/ZDHUaoDkoLY9iXquqVscP5Kzw0ePQ56A== X-Google-Smtp-Source: AA+uWPy3cWwN1FbOWO+uH+L3q+8dbdFTY5QB9+etBfmKdKG+jOLcIPkm6E/qCO/BjW/LZld0gQ6b/u856ms+Vrh+c8M= X-Received: by 2002:a6b:4c5:: with SMTP id 188-v6mr44740123ioe.32.1534868176626; Tue, 21 Aug 2018 09:16:16 -0700 (PDT) MIME-Version: 1.0 Received: by 2002:a4f:a009:0:0:0:0:0 with HTTP; Tue, 21 Aug 2018 09:15:36 -0700 (PDT) In-Reply-To: References: <64d23891-2f32-9bb8-1ec8-f4fad13cdfb9@cs.tcd.ie> <982363FD-A839-4175-BA53-7CA242F9ADA6@ll.mit.edu> <2D7F2926-6376-4B2C-BDE9-7A6F1C0FA748@gmail.com> <5B7C1571020000AC0015C330@gwia2.rz.hs-offenburg.de> From: Ted Lemon Date: Tue, 21 Aug 2018 12:15:36 -0400 Message-ID: To: Jack Visoky Cc: Andreas Walz , "tls@ietf.org" , "ncamwing=40cisco.com@dmarc.ietf.org" Content-Type: multipart/alternative; boundary="00000000000071ff320573f45824" Archived-At: Subject: Re: [TLS] EXTERNAL: Re: integrity only ciphersuites X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Aug 2018 16:16:22 -0000 --00000000000071ff320573f45824 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable I asked you if you have any specific devices for which this is an issue. Do you? How did you determine that it was an issue? Do you have A/B testing results on power consumption and/or performance of a null cipher suite versus encryption? On Tue, Aug 21, 2018 at 11:20 AM, Jack Visoky wrote: > Hi Ted, > > > > My apologies for being opaque. There are many different > device/applications/installations so I am sorry if I am mixing ideas > here. Generally the NULL ciphers have the benefit around allowing higher > performance for devices that are lower horsepower. Code space can > certainly be a concern, but I think for industrial applications it=E2=80= =99s more > around throughput of high speed I/O, combined with the use cases that > derive little benefit from the confidentiality of this data. =E2=80=9CHo= rsepower=E2=80=9D > is of course a vague term in of itself, so here I=E2=80=99m talking about= things > that would impact packet processing; this includes processor speed, > available high speed RAM, presence of/lack of crypto acceleration (not in > many Industrial Ethernet devices but growing). I wouldn=E2=80=99t put th= e > executable code size as high on the list of concerns as these items, > although there are certainly devices that are limited in this. This > horsepower limitation is directly related to the fact that these devices > are expected to function for many years. > > > > I=E2=80=99m happy to clarify any of these points further if needed. > > > > Thanks and Best Regards, > > > > --Jack > > > > *From:* Ted Lemon [mailto:mellon@fugue.com] > *Sent:* Tuesday, August 21, 2018 10:58 AM > *To:* Jack Visoky > *Cc:* Andreas Walz ; tls@ietf.org; ncamwing= =3D > 40cisco.com@dmarc.ietf.org > *Subject:* Re: [TLS] EXTERNAL: Re: integrity only ciphersuites > > > > Thanks, Jack, but could you respond to the specific questions that we > asked you? Earlier you were saying that your motivation for using NULL > ciphers was that you had specific hardware that couldn't implement > encryption due to lack of horsepower or memory. Now you seem to be sayi= ng > something completely different. It's going to be difficult for us to > understand your requirements if you talk about different things in each > message. > > > > On Tue, Aug 21, 2018 at 10:27 AM, Jack Visoky > wrote: > > (I=E2=80=99m responding a few different points made here) > > > > In general, although this seems like a niche application, there are > actually millions of Industrial Ethernet nodes, with the numbers trending > upward. As mentioned, many of these are relying on older protocols > designed without security in mind. Our industry has had a debate around > using TLS vs. creating something specific. Many of us prefer to rely on > the security benefits of TLS. To another point, although I work for > Rockwell Automation, here I am working in my capacity within ODVA, a > standards group for Industrial Communications that has several large > vendors as members. We have adopted TLS to protect our industrial Ethern= et > traffic, and one of the selling points of TLS 1.2 was the ability to use > NULL encryption. > > > > NULL encryption is not really as much about code size but capability of > the devices. The TLS handshake of course contains some =E2=80=9Cheavywei= ght=E2=80=9D > operations, although handshakes are pretty infrequent as these connection= s > are often quite long-lived. Once the handshake is over, the I/O data tha= t > is transferred is often quite sensitive to latency, and although the > encryption overhead might not seem like much when the HMAC is considered, > it is still a case where in many applications every bit counts. Regardin= g > older hardware that exists for many years, some hardware does have > cryptographic acceleration although may not have AES-GCM, rather SHA-256 > HMAC. Alternatively, the hardware might not have any crypto acceleration > as it was designed without TLS in mind. At the same time we=E2=80=99d li= ke to > secure this traffic via a firmware upgrade. Despite this, if using > encryption drops performance enough users will simply not use it, which i= s > a net worse outcome. Users will likely not upgrade hardware for many yea= rs > due to a variety of industry factors. > > > > Kathleen=E2=80=99s comment about defining NULL encryption but being clear= about > the risks resonates with me. I=E2=80=99m certainly not suggesting that N= ULL > encryption is needed in all cases, but there are times (as discussed here > and in the RFC draft) where it could be quite beneficial. > > > > Thanks and Best Regards, > > > > --Jack > > > > *From:* TLS [mailto:tls-bounces@ietf.org] *On Behalf Of *Andreas Walz > *Sent:* Tuesday, August 21, 2018 9:37 AM > *To:* tls@ietf.org > *Cc:* ncamwing=3D40cisco.com@dmarc.ietf.org > *Subject:* EXTERNAL: Re: [TLS] integrity only ciphersuites > > > > [Use caution with links & attachments] > > > > +1 > > I fully understand the pursuit of minimizing complexity in TLS. However, > banning from TLS all provisions to serve non-internet cases seems > suboptimal to me. > > I think there is a whole universe of systems and applications that are > just at the very beginning of being armed with security features: think o= f > communication systems driving, e.g., industrial automation and critical > infrastructures. These are quite different from the internet and the web > (different threats, security requirements, architectures, networks, > resources, etc.). Still, IMHO it's not a niche at all; it's just not as > visible to most of us. > > I strongly believe it is *not* a good idea to hold back all the valuable > experience condensed in TLS and entail the design of customized security > protocols for such systems. TLS is state-of-the-art and its benefits shou= ld > be accessible to as many systems as possible. > > > > Cheers, > Andi Walz > > > > > >>> Kathleen Moriarty 08/21/18 3:20 PM > >>> > > > Sent from my mobile device > > > On Aug 21, 2018, at 8:10 AM, Blumenthal, Uri - 0553 - MITLL < > uri@ll.mit.edu> wrote: > > > > "Vulnerable-by-design ciphersuites"? Vulnerable to what? > > > > Suck sites are designed to provide end-point authentication and traffic > integrity. Care to explain/show how these properties would not hold? > > > > Besides, it's been explained several times that some use cases do not > require confidentiality, and in some use cases confidentiality is forbidd= en. > > I agree with Uri here, flexibility to cover these use cases to accommodat= e > the actual security requirements may result in them using something inste= ad > of nothing. It could be defined and not listed as Recommended as well. Th= is > comes down to risk management and options, where the risk can be clearly > explained and the lack of recommendation can also be explained. > > Best regards, > Kathleen > > > > > Regards, > > Uri > > > > Sent from my iPhone > > > >> On Aug 21, 2018, at 07:42, Stephen Farrell > wrote: > >> > >> > >> > >>> On 20/08/18 21:48, Nancy Cam-Winget (ncamwing) wrote: > >>> All, A couple IoT consortiums are trying to embrace the improvements > >>> made to TLS 1.3 and as they define their new security constructs > >>> would like to adopt the latest protocols, in this case TLS 1.3. To > >>> that extent, they have a strong need for mutual authentication, but > >>> integrity only (no confidentiality) requirements. > >>> > >>> In following the new IANA rules, we have posted the draft > >>> https://tools.ietf.org/html/draft-camwinget-tls-ts13- > macciphersuites-00 > >>> to document request for registrations of HMAC based cipher selections > >>> with TLS 1.3=E2=80=A6..and are soliciting feedback from the WG on the= draft > >>> and its path forward. > >> > >> As ekr pointed out, with the new registration rules, > >> there's nothing to stop someone defining any old set > >> of crypto stuff and getting non-recommended codepoints. > >> > >> That said, I don't consider that defining such > >> vulnerable-by-design ciphersuites is a good plan. > >> > >> - It imposes costs on the non-niche users of TLS - once > >> these things are defined then developers and those who > >> deploy/configure applications using TLS need to check > >> that they're not using these undesirable ciphersuites, > >> so costs are being displaced from niche uses to the > >> vast majority of implementations and deployments, which > >> seems to me to be a bad idea. And we know that people > >> will sometimes get those checks wrong leading to unexpected > >> transmission of plaintext over the Internet. > >> > >> - Similarly, just defining such ciphersuites seems likely > >> to lead to less well tested and infrequently used code > >> paths, which is undesirable. (Assuming someone pays some > >> developer to add these to some library, which generally > >> does seem to happen.) > >> > >> - RFC7525 [1] is clear on this topic (after debate in the > >> UTA WG) - "Implementations MUST NOT negotiate the cipher > >> suites with NULL encryption" and I see nothing new to > >> convince me that that ought change for TLS1.3. > >> > >> - Code footprint arguments aren't that convincing to > >> me - to get interop for the few devices where AES being > >> present or absent could make a real difference, you'd > >> need an awful lot more profiling of TLS or DTLS. I don't > >> see evidence of that so the interop/footprint arguments > >> seem pretty weak. I'd also bet that any useful "tiny > >> footprint" profile of that kind would end up targeting > >> loads of use-cases where confidentiality is absolutely > >> required. > >> > >> - (In addition to the good points made by Geoffrey > >> Keating [2]) cleartext payloads would also assist in > >> device fingerprinting, making it easier to exploit > >> vulnerabilities at scale. > >> > >> - IIUC there is also a desire to encrypt firmware > >> updates so that patches can be distributed more quickly > >> than attackers can reverse-engineer attacks. [4] I'm > >> not entirely sure if that's really likely to happen, > >> but if it were, then devices would need to be able to > >> use recommended ciphersuites in any case. > >> > >> - TLS/AX.25 doesn't seem that good a plan in any > >> case - according to [3], which seems reasonable to > >> me, using clear-signed GPG is quicker and better > >> meets the oddball regulations. Attempting to deal > >> with those regulations by weakening TLS seems like > >> a very bad plan, as you'd fail in any case to achieve > >> interop with normal TLS applications like the web. > >> (And the advertising is as illegal as the crypto > >> apparently, though I do like that aspect:-) > >> > >> - WRT unix sockets, I'm not clear that there's a > >> sufficiently important performance improvement in > >> real deployments to justify introducing weakened > >> ciphersuites - presumably mail servers are going to > >> use standard TLS libraries that (I hope!) won't be > >> offering NULL encryption, so I'd be surprised if > >> the right engineering decision was to prioritise > >> CPU to that extent, given the risks associated with > >> having weak ciphersuites present in widely used > >> implementations. IOW, it seems more sensible to me > >> for mail servers to just stick to using RECOMMENDED > >> ciphersuites. And given that you could use SASL > >> with Postfix/LMTP [5] I'm not sure why you'd want > >> a weirdo-version of TLS1.3 anyway but maybe there's > >> some reason I don't get. > >> > >> - I think this WG has had to spend waaaay too much > >> time dealing with the "inspection of data" debate in > >> various forms, but we did get an answer (no consensus) > >> in the end for that. Niche use cases seem extremely > >> unlikely to me to justify revisiting that painful > >> topic. > >> > >> So all in all, I just don't see a need for these > >> weak-by-design ciphersuites to even be defined. I'd > >> encourage folks who think they're needed to instead > >> think about how using RECOMMENDED ciphersuites might > >> make their implementations more widely applicable and > >> safer. Seems like a much more productive approach to > >> me anyway. > >> > >> Regards, > >> S. > >> > >> [1] https://tools.ietf.org/html/rfc7525 > >> [2] https://mailarchive.ietf.org/arch/msg/tls/ > uI8xVgp7gTuJgwUyY-UgZfmUkRo > >> [3] https://tools.ietf.org/html/draft-ietf-suit-architecture- > 01#section-3.3 > >> [4] https://www.tapr.org/pdf/DCC2010-AX.25- > AuthenticationEffects-KE5LKY.pdf > >> [5] http://www.postfix.org/SASL_README.html#client_sasl > >> > >> > >> <0x5AB2FAF17B172BEA.asc> > >> _______________________________________________ > >> TLS mailing list > >> TLS@ietf.org > >> https://www.ietf.org/mailman/listinfo/tls > > _______________________________________________ > > TLS mailing list > > TLS@ietf.org > > https://www.ietf.org/mailman/listinfo/tls > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > > > --00000000000071ff320573f45824 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
I asked you if you have any specific devices for which thi= s is an issue.=C2=A0 =C2=A0Do you?=C2=A0 =C2=A0How did you determine that i= t was an issue?=C2=A0 =C2=A0Do you have A/B testing results on power consum= ption and/or performance of a null cipher suite versus encryption?

On Tue, Aug 21, 2018= at 11:20 AM, Jack Visoky <jmvisoky@ra.rockwell.com> = wrote:

Hi Ted,

=C2=A0

My apologies for being opaque.=C2=A0 = There are many different device/applications/installations so I am sor= ry if I am mixing ideas here.=C2=A0 Generally the NULL ciphers have the benefit around allowing higher performance for devices that are l= ower horsepower.=C2=A0 Code space can certainly be a concern, but I think f= or industrial applications it=E2=80=99s more around throughput of high spee= d I/O, combined with the use cases that derive little benefit from the confidentiality of this data.=C2=A0 =E2=80=9CHorse= power=E2=80=9D is of course a vague term in of itself, so here I=E2=80=99m = talking about things that would impact packet processing; this includes pro= cessor speed, available high speed RAM, presence of/lack of crypto acceleration (not in many Industrial Ethernet devices but growing).=C2=A0 = I wouldn=E2=80=99t put the executable code size as high on the list of conc= erns as these items, although there are certainly devices that are limited = in this.=C2=A0 This horsepower limitation is directly related to the fact that these devices are expected to function for many y= ears.

=C2=A0

I=E2=80=99m happy to clarify any of t= hese points further if needed.

=C2=A0

Thanks and Best Regards,

=C2=A0

--Jack

=C2=A0

From: Ted Lemon [mailto:mellon@fugue.com]
Sent: Tuesday, August 21, 2018 10:58 AM
To: Jack Visoky <jmvisoky@ra.rockwell.com>
Cc: Andreas Walz <andreas.walz@hs-offenburg.de>; tls@ietf.org; ncamwing=3D40cisco.com@dmarc.= ietf.org
Subject: Re: [TLS] EXTERNAL: Re: integrity only ciphersuites<= u>

=C2=A0

Thanks, Jack, but could you respond to the specific = questions that we asked you?=C2=A0 =C2=A0Earlier you were saying that your = motivation for using NULL ciphers was that you had specific hardware that c= ouldn't implement encryption due to lack of horsepower or memory.=C2=A0 =C2=A0Now you seem to be saying something comp= letely different.=C2=A0 =C2=A0It's going to be difficult for us to unde= rstand your requirements if you talk about different things in each message= .

=C2=A0

On Tue, Aug 21, 2018 at 10:27 AM, Jack Visoky <jmvisoky@ra.roc= kwell.com> wrote:

(I=E2=80=99m responding=C2=A0 a few d= ifferent points made here)

=C2=A0

In general, although this seems like = a niche application, there are actually millions of Industrial Ethernet nodes, with the numbers trending upward.=C2=A0 As mentioned, many= of these are relying on older protocols designed without security in mind.= =C2=A0 Our industry has had a debate around using TLS vs. creating somethin= g specific.=C2=A0 Many of us prefer to rely on the security benefits of TLS.=C2=A0 To another point, although I work for = Rockwell Automation, here I am working in my capacity within ODVA, a standa= rds group for Industrial Communications that has several large vendors as m= embers.=C2=A0 We have adopted TLS to protect our industrial Ethernet traffic, and one of the selling points of TLS 1.2 = was the ability to use NULL encryption.

=C2=A0

NULL encryption is not really as much= about code size but capability of the devices.=C2=A0 The TLS handshake of course contains some =E2=80=9Cheavyweight=E2=80=9D operations, although= handshakes are pretty infrequent as these connections are often quite long= -lived.=C2=A0 Once the handshake is over, the I/O data that is transferred = is often quite sensitive to latency, and although the encryption overhead might not seem like much when the HMAC is considered, = it is still a case where in many applications every bit counts.=C2=A0 Regar= ding older hardware that exists for many years, some hardware does have cry= ptographic acceleration although may not have AES-GCM, rather SHA-256 HMAC.=C2=A0 Alternatively, the hardware m= ight not have any crypto acceleration as it was designed without TLS in min= d.=C2=A0 At the same time we=E2=80=99d like to secure this traffic via a fi= rmware upgrade.=C2=A0 Despite this, if using encryption drops performance enough users will simply not use it, which is a net wors= e outcome.=C2=A0 Users will likely not upgrade hardware for many years due = to a variety of industry factors.

=C2=A0

Kathleen=E2=80=99s comment about defi= ning NULL encryption but being clear about the risks resonates with me.=C2= =A0 I=E2=80=99m certainly not suggesting that NULL encryption is needed in all= cases, but there are times (as discussed here and in the RFC draft) where = it could be quite beneficial.

=C2=A0

Thanks and Best Regards,

=C2=A0

--Jack

=C2=A0

From: TLS [mailto:tls-bounces@ietf.org] On Behalf Of Andreas Walz
Sent: Tuesday, August 21, 2018 9:37 AM
To: tls@ietf.org
Cc: ncamwing=3D40cisco.com@dmarc.ietf.org
Subject: EXTERNAL: Re: [TLS] integrity only ciphersuites

=C2=A0

[Use caution with links & attachments]

=C2=A0

+1

I fully understand the pursuit of minimizing complexity in TLS. However, ba= nning from TLS all provisions to serve non-internet cases seems suboptimal = to me.

I think there is a whole universe of systems and applications that are just= at the very beginning of being armed with security features: think of comm= unication systems driving, e.g., industrial automation and critical infrast= ructures. These are quite different from the internet and the web (different threats, security requirements, a= rchitectures, networks, resources, etc.). Still, IMHO it's not a niche = at all; it's just not as visible to most of us.

I strongly believe it is *not* a good idea to hold back all the valuable ex= perience condensed in TLS and entail the design of customized security prot= ocols for such systems. TLS is state-of-the-art and its benefits should be = accessible to as many systems as possible.

=C2=A0

Cheers,
Andi Walz

=C2=A0


>>> Kathleen=C2=A0Moriarty=C2=A0<kathleen.moriarty.ietf@gmai= l.com> 08/21/18 3:20 PM >>>


Sent from my mobile device

> On Aug 21, 2018, at 8:10 AM, Blumenthal, Uri - 0553 - MITLL <uri@ll.mit.edu> wrote:=
>
> "Vulnerable-by-design ciphersuites"? Vulnerable to what? >
> Suck sites are designed to provide end-point authentication and traffi= c integrity. Care to explain/show how these properties would not hold?
>
> Besides, it's been explained several times that some use cases do = not require confidentiality, and in some use cases confidentiality is forbi= dden.

I agree with Uri here, flexibility to cover these use cases to accommodate = the actual security requirements may result in them using something instead= of nothing. It could be defined and not listed as Recommended as well. Thi= s comes down to risk management and options, where the risk can be clearly explained and the lack of recom= mendation can also be explained.

Best regards,
Kathleen

>
> Regards,
> Uri
>
> Sent from my iPhone
>
>> On Aug 21, 2018, at 07:42, Stephen Farrell <stephen.farrell@cs.tcd.ie&g= t; wrote:
>>
>>
>>
>>> On 20/08/18 21:48, Nancy Cam-Winget (ncamwing) wrote:
>>> All, A couple IoT consortiums are trying to embrace the improv= ements
>>> made to TLS 1.3 and as they define their new security construc= ts
>>> would like to adopt the latest protocols, in this case TLS 1.3= . To
>>> that extent, they have a strong need for mutual authentication= , but
>>> integrity only (no confidentiality) requirements.
>>>
>>> In following the new IANA rules, we have posted the draft
>>> https://tools.ietf.org/html/draft-camwinget-tls-ts13-macciphersui= tes-00
>>> to document request for registrations of HMAC based cipher sel= ections
>>> with TLS 1.3=E2=80=A6..and are soliciting feedback from the WG= on the draft
>>> and its path forward.
>>
>> As ekr pointed out, with the new registration rules,
>> there's nothing to stop someone defining any old set
>> of crypto stuff and getting non-recommended codepoints.
>>
>> That said, I don't consider that defining such
>> vulnerable-by-design ciphersuites is a good plan.
>>
>> - It imposes costs on the non-niche users of TLS - once
>> these things are defined then developers and those who
>> deploy/configure applications using TLS need to check
>> that they're not using these undesirable ciphersuites,
>> so costs are being displaced from niche uses to the
>> vast majority of implementations and deployments, which
>> seems to me to be a bad idea. And we know that people
>> will sometimes get those checks wrong leading to unexpected
>> transmission of plaintext over the Internet.
>>
>> - Similarly, just defining such ciphersuites seems likely
>> to lead to less well tested and infrequently used code
>> paths, which is undesirable. (Assuming someone pays some
>> developer to add these to some library, which generally
>> does seem to happen.)
>>
>> - RFC7525 [1] is clear on this topic (after debate in the
>> UTA WG) - "Implementations MUST NOT negotiate the cipher
>> suites with NULL encryption" and I see nothing new to
>> convince me that that ought change for TLS1.3.
>>
>> - Code footprint arguments aren't that convincing to
>> me - to get interop for the few devices where AES being
>> present or absent could make a real difference, you'd
>> need an awful lot more profiling of TLS or DTLS. I don't
>> see evidence of that so the interop/footprint arguments
>> seem pretty weak. I'd also bet that any useful "tiny
>> footprint" profile of that kind would end up targeting
>> loads of use-cases where confidentiality is absolutely
>> required.
>>
>> - (In addition to the good points made by Geoffrey
>> Keating [2]) cleartext payloads would also assist in
>> device fingerprinting, making it easier to exploit
>> vulnerabilities at scale.
>>
>> - IIUC there is also a desire to encrypt firmware
>> updates so that patches can be distributed more quickly
>> than attackers can reverse-engineer attacks. [4] I'm
>> not entirely sure if that's really likely to happen,
>> but if it were, then devices would need to be able to
>> use recommended ciphersuites in any case.
>>
>> - TLS/AX.25 doesn't seem that good a plan in any
>> case - according to [3], which seems reasonable to
>> me, using clear-signed GPG is quicker and better
>> meets the oddball regulations. Attempting to deal
>> with those regulations by weakening TLS seems like
>> a very bad plan, as you'd fail in any case to achieve
>> interop with normal TLS applications like the web.
>> (And the advertising is as illegal as the crypto
>> apparently, though I do like that aspect:-)
>>
>> - WRT unix sockets, I'm not clear that there's a
>> sufficiently important performance improvement in
>> real deployments to justify introducing weakened
>> ciphersuites - presumably mail servers are going to
>> use standard TLS libraries that (I hope!) won't be
>> offering NULL encryption, so I'd be surprised if
>> the right engineering decision was to prioritise
>> CPU to that extent, given the risks associated with
>> having weak ciphersuites present in widely used
>> implementations. IOW, it seems more sensible to me
>> for mail servers to just stick to using RECOMMENDED
>> ciphersuites. And given that you could use SASL
>> with Postfix/LMTP [5] I'm not sure why you'd want
>> a weirdo-version of TLS1.3 anyway but maybe there's
>> some reason I don't get.
>>
>> - I think this WG has had to spend waaaay too much
>> time dealing with the "inspection of data" debate in
>> various forms, but we did get an answer (no consensus)
>> in the end for that. Niche use cases seem extremely
>> unlikely to me to justify revisiting that painful
>> topic.
>>
>> So all in all, I just don't see a need for these
>> weak-by-design ciphersuites to even be defined. I'd
>> encourage folks who think they're needed to instead
>> think about how using RECOMMENDED ciphersuites might
>> make their implementations more widely applicable and
>> safer. Seems like a much more productive approach to
>> me anyway.
>>
>> Regards,
>> S.
>>
>> [1] https://tools.ietf.org/html/rfc7525
>> [2] https://mailarchive.ietf.org/arch/msg/tls/uI8xVgp7gTuJgwUyY-UgZfm= UkRo
>> [3] https://tools.ietf.org/html/draft-ietf-suit-architecture-01#secti= on-3.3
>> [4] https://www.tapr.org/pdf/DCC2010-AX.25-AuthenticationEffects-KE5L= KY.pdf
>> [5] http://www.postfix.org/SASL_README.html#client_sasl
>>
>>
>> <0x5AB2FAF17B172BEA.asc>
>> _______________________________________________
>> TLS mailing list
>> TLS@ietf.org=
>> https://www.ietf.org/mailman/listinfo/tls
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls

_______________________________________________
TLS mailing list
TLS@ietf.org
htt= ps://www.ietf.org/mailman/listinfo/tls


_______________________________________________
TLS mailing list
TLS@ietf.org
htt= ps://www.ietf.org/mailman/listinfo/tls

=C2=A0


--00000000000071ff320573f45824-- From nobody Tue Aug 21 09:37:38 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BB31B130F0D for ; Tue, 21 Aug 2018 09:37:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.301 X-Spam-Level: X-Spam-Status: No, score=-4.301 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id t5p6sqhIejqA for ; Tue, 21 Aug 2018 09:37:34 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1A2D6130DC3 for ; Tue, 21 Aug 2018 09:37:33 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id C0590BE5B; Tue, 21 Aug 2018 17:37:32 +0100 (IST) Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id r1uM3gCJlbyK; Tue, 21 Aug 2018 17:37:32 +0100 (IST) Received: from [134.226.63.102] (cswireless63-102.scss.tcd.ie [134.226.63.102]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 7FC41BE56; Tue, 21 Aug 2018 17:37:32 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1534869452; bh=EQaPIE5jCb8NcQ94ZnF3BxO6t12ZbtMZFFKy3540vBk=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=tgUuFtx3iH4E7xAZ0Ae55ngjIFhtzVDmp8B8pzD75BGHtnrStizgVCCcdnpz++esa lwaU4xF6Q0eWE2irN3MLGjIaQLGG5oWN5Hv8G1+tvCdO09DsUiJyHd5k7J8a+DCxfN VrRxjy405JD3Tek9qyfqGqaoaKOetR3cCRrCvxHg= To: Ted Lemon , Jack Visoky Cc: "ncamwing=40cisco.com@dmarc.ietf.org" , "tls@ietf.org" References: <64d23891-2f32-9bb8-1ec8-f4fad13cdfb9@cs.tcd.ie> <982363FD-A839-4175-BA53-7CA242F9ADA6@ll.mit.edu> <2D7F2926-6376-4B2C-BDE9-7A6F1C0FA748@gmail.com> <5B7C1571020000AC0015C330@gwia2.rz.hs-offenburg.de> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= xsFNBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABzTJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPsLBgAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxM7BTQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAcLBZQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <3e5ce261-bfa9-a543-1824-099599b460d9@cs.tcd.ie> Date: Tue, 21 Aug 2018 17:37:30 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.9.1 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="zbihgNg6MYcoaC6OEjLqpc5l2hGPwusum" Archived-At: Subject: Re: [TLS] EXTERNAL: Re: integrity only ciphersuites X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Aug 2018 16:37:37 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --zbihgNg6MYcoaC6OEjLqpc5l2hGPwusum Content-Type: multipart/mixed; boundary="Uv5hLu5B8cCVZnGuT3fv6byyTPAaa6s1r"; protected-headers="v1" From: Stephen Farrell To: Ted Lemon , Jack Visoky Cc: "ncamwing=40cisco.com@dmarc.ietf.org" , "tls@ietf.org" Message-ID: <3e5ce261-bfa9-a543-1824-099599b460d9@cs.tcd.ie> Subject: Re: [TLS] EXTERNAL: Re: integrity only ciphersuites References: <64d23891-2f32-9bb8-1ec8-f4fad13cdfb9@cs.tcd.ie> <982363FD-A839-4175-BA53-7CA242F9ADA6@ll.mit.edu> <2D7F2926-6376-4B2C-BDE9-7A6F1C0FA748@gmail.com> <5B7C1571020000AC0015C330@gwia2.rz.hs-offenburg.de> In-Reply-To: --Uv5hLu5B8cCVZnGuT3fv6byyTPAaa6s1r Content-Type: multipart/mixed; boundary="------------ABDAEEE93F8C1BDE6E959079" Content-Language: en-GB This is a multi-part message in MIME format. --------------ABDAEEE93F8C1BDE6E959079 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 21/08/18 17:15, Ted Lemon wrote: > I asked you if you have any specific devices for which this is an issue= =2E > Do you? How did you determine that it was an issue? Do you have A/= B > testing results on power consumption and/or performance of a null ciphe= r > suite versus encryption? If doing such comparisons, then it's very well worth noting the significant differences between e.g. h/w accelerated AES, vs s/w AES vs chacha. It'd be hard to evaluate claims about difficulty of implementation/deployment without that. S. --------------ABDAEEE93F8C1BDE6E959079 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1bQyU3RlcGhlbiBGYXJy ZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxsQGNzLnRjZC5pZT6JAkAEEwEIACoC GwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AFAlo+o3cCGQEACgkQWrL6 8XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeOM3P7SW3C3UQYdCgZ/TlvxGgKow5o DSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP2ZK24tw5k6duTh4+sFwUualTMlcp 0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s/69L/fvHmdSKet5LIUAxoYaZkTCr uFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBjMw1xV+p0uCwNbN6XDzcToK7wsm+t AIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k4S+sN2CnYk4tTW7jHjsWarV3FLIS COObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSlAblGjwZe4EIkCXAJUtzJhoFUuGaF /PlWjxqV3UFRcgTERZTijguVyREre8GNERNgvDxZvuXssEjvz9X5JfcIZDIJpdzh LiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/rwWcpGr/MfVPTOik4H7F8rcVJelce ZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o4uBZCQ0GzvsmFA4XLqn2pA5rVizM XnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKAxo/tuHYtk19XCi83QzFhWls5TT+X QeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd8MxYNAbNYgSPtkbhZ8SJARwEEAEI AAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6NXEGtw/r1miKNGcopzvzILQ9oB8r KI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYcJf+RyiH1nMoqUIZiZJaf3bJXinDZ 5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbYtWgsYtRqHLD4IWi37MZrVyjBuF7u 14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1WQOAfD1kfBpW9PvAva5Iw9FWeXpC XRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7EDuTBb/8um1wK7Y9bgeIQC+CYjhYB 5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlve2Q6UTrmHxP5U22DlokCPQQTAQgA JwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrx excr6tJpD/4rrILH+meP07vrx8wW5eYuqCiPGYnh/CXxIF8eLrfbe5d4QRgtq+w6 UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dTMrEGn8QWKx2iNuz9rZMXyOSWFetu O01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9gQ7edR9mfLTdvBf2FR522hg8BRBM 1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZXripS0uFA07dM46Oi/E8osjx6fQt/ lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGFL64/VCQb1YGjf0Z5MBPnWm9jgUoO Y5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2DFeo9+S9f2V53Llz1WIspXJg6f+n9 lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCbhrC3+yobyy/AUOs5Z3E+njjX1FF/ VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10MSU8GEZu9ayU4M3o3N9yxOjaoP0Nu Q4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXtGKvJtFAEppGEYezB+bLKIm6XlpPk hnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA5rEP4lL16BmijmF+CHoPE/zwgKZb KpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ksZgUUnNyvfQr2p7jrQuU3RlcGhl biBGYXJyZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgA JwUCWj1RWgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrx excr6jscEADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvn crAFClVI6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtg rlstjk7hqVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIg pMw0bA1yBU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5c F8R4OvB1n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaP y1/fEgIqhCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5 b1AEzZKw2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7 b9Ocu+nYm2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkpo rMQCTh3T5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXR dS/oDKrBLUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGl Ru78ba0HArxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgA BgUCWj1SoAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89Sq Bd++uG06TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VO dL8zJWJs0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD 4t0VHpWkmfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lz nNiH41x9M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8I WOMqN2woDjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBuQINBFo9UDIB EAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuBHmpvceBRZgRasdbaMc4H Jee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD8U4xxjvR5Mi7+ToQQUOU NuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5MsK1SKfs51pLa5ToC1rc8 tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE4bGjXdJW5pKphFB2lX3d G4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7PbTuW/eITbMbI1eV3+fyym 9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3vDUew1h5QU1yDaWT3NAp vi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcmoazpiKZt91CrFPOaoXDP ck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r+oA/wxWb5jELElAhOpny qMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22fQ0D38zud+CKH3bMP3ayX XJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7Ffa4UbkwlD+dh8GiIAtv T51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1gwARAQABiQIlBBgBCAAP BQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF6TeR83xD6MasqXyrBjwc LmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfdn3BmvqGyh8+ouHX9jMOx iRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx252HKTFdeOrszoOjWjEzwm h+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjNJIXXM+lHqCDrjDaDhNcz mq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjwrIdfQM86H1z5J31lfhqo p+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGsokRina9947fRWxXHh3O6 6ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqYo3pcN2OE0C1chqgDZQxk r+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQkd0YjcqlB1E0svODHTzcS oRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmUyXBIeq6I5z8xBcd+BQ/n /9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhkvMvem9XXh1yyhqN14gfj mLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3YFMVUUfgyudqAV1wWdZi nUk+H3pkqOKoHAy/8fST =3DTOQn -----END PGP PUBLIC KEY BLOCK----- --------------ABDAEEE93F8C1BDE6E959079-- --Uv5hLu5B8cCVZnGuT3fv6byyTPAaa6s1r-- --zbihgNg6MYcoaC6OEjLqpc5l2hGPwusum Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAlt8P8oACgkQWrL68XsX K+rOqw//ROPArDKMFub4mCI65KkfBS1RtKx53x/r2t64Pw2geUf5HwtvYdZ0j1t8 5hGLhaS97X4+3bEpUBxSLsVHFLXH9B7XPQWhJ/6Yx8ASC+sIon8YZURO1qKATa8p tPPp8QDA1IoJ7CLokLne0/bQoELdHvef6s+KtgcEE1tYs3ZAbJy8SLar0tyCrDfh dQwhFspEmlPAlp5B1vTX85ryD5dBa9ggeH+735LISy1nQjiGc8eOq6emEwNcweKz QgTT+9WsIXTylX+UTYPzxnNEKYS97f3SrhBmBFqAfiT8fgnqChVL1oHaEsiC70ak dJ/4wbAOjNLHZ0wTRkc4C4nc36zxtmxLcWqLYcNzpnmwk+tEqXLPHVkJfyFoYaup 0bcbFWtgDJTw4cILcas0wtNEtiDgOj7C1LviBa/D5GykZ0vGkSX6N4DzM2+9GOIN 7No3EM9QDsr2Q1Jy9bHEAcRgjllClZJUUB1BxiMItSide+8nQQNPqViV/nCGIZXa D8lNCKDfRSZ0cilCxKPxLIL3GjbgvgcnKmoyXCsO/B1CX2yyw52C5ukpUneZ12fo M/Zz2YRmitcoSWZL1cHf4+VwUMw3mG/9zZNf6iFFJV1l7kNhkGte99nRsttDVQPt bhN3suNhBcAyZvWIjxXpd1ZTOuYr6kjB0cNfc1CANrCABZE7FPs= =qfAc -----END PGP SIGNATURE----- --zbihgNg6MYcoaC6OEjLqpc5l2hGPwusum-- From nobody Tue Aug 21 09:54:07 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D267B130E40 for ; Tue, 21 Aug 2018 09:54:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.899 X-Spam-Level: X-Spam-Status: No, score=-6.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id c4i3BTf8OWyZ for ; Tue, 21 Aug 2018 09:54:03 -0700 (PDT) Received: from goliath.siemens.de (goliath.siemens.de [192.35.17.28]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 07D3E130DBE for ; Tue, 21 Aug 2018 09:54:02 -0700 (PDT) Received: from mail1.sbs.de (mail1.sbs.de [192.129.41.35]) by goliath.siemens.de (8.15.2/8.15.2) with ESMTPS id w7LGrjbx005231 (version=TLSv1.2 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 21 Aug 2018 18:53:46 +0200 Received: from DEFTHW99ERNMSX.ww902.siemens.net (defthw99ernmsx.ww902.siemens.net [139.22.70.141]) by mail1.sbs.de (8.15.2/8.15.2) with ESMTPS id w7LGrjlr005886 (version=TLSv1.2 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 21 Aug 2018 18:53:45 +0200 Received: from DEFTHW99ERPMSX.ww902.siemens.net (139.22.70.202) by DEFTHW99ERNMSX.ww902.siemens.net (139.22.70.141) with Microsoft SMTP Server (TLS) id 14.3.408.0; Tue, 21 Aug 2018 18:53:45 +0200 Received: from DENBGAT9EH2MSX.ww902.siemens.net ([169.254.6.212]) by DEFTHW99ERPMSX.ww902.siemens.net ([139.22.70.202]) with mapi id 14.03.0408.000; Tue, 21 Aug 2018 18:53:44 +0200 From: "Fries, Steffen" To: "Salz, Rich" CC: Andreas Walz , "tls@ietf.org" , "ncamwing=40cisco.com@dmarc.ietf.org" Thread-Topic: [TLS] integrity only ciphersuites Thread-Index: AQHUOVRDfNtxeeJAEUKLQicbsYfTf6TKVKsw///lHQCAACHjcP//4/iAgAAsvvs= Date: Tue, 21 Aug 2018 16:53:43 +0000 Message-ID: <8A2746A8-6B41-45C3-9D77-6AF3536C6E2D@siemens.com> References: <64d23891-2f32-9bb8-1ec8-f4fad13cdfb9@cs.tcd.ie> <982363FD-A839-4175-BA53-7CA242F9ADA6@ll.mit.edu> <2D7F2926-6376-4B2C-BDE9-7A6F1C0FA748@gmail.com> <5B7C1571020000AC0015C330@gwia2.rz.hs-offenburg.de> , In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: Content-Type: multipart/alternative; boundary="_000_8A2746A86B4145C39D776AF3536C6E2Dsiemenscom_" MIME-Version: 1.0 Archived-At: Subject: Re: [TLS] integrity only ciphersuites X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Aug 2018 16:54:05 -0000 --_000_8A2746A86B4145C39D776AF3536C6E2Dsiemenscom_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable On 21. Aug 2018, at 18:13, Salz, Rich > wrote: =D8 If there would be support for integrity ciphers in TLS 1.3 it would en= able the straight forward switch from TLS 1.2 also in these environments by= keeping existing monitoring options. Why do you want to move to TLS 1.3? Why isn=92t your existing solution goo= d enough? * [stf] Currently it is sufficient to use TLS 1.2- For certain use case= s the utilized components have a rather long lifetime. One assumption is th= at TLS 1.3 will exist longer that TLS 1.2 and that certain software tools (= also browsers) may not support TLS 1.2 in the future =85 Most browsers already do not support NULL encryption, and it is highly unli= kely that any will add it for 1.3. Have you any indication otherwise? If = you=92re not going to use the algorithms in general use on the public Inter= net, then you should expect that standard clients such as browsers, will no= t work. PeterG can attest to this. :) True. I was more referring to an embedded device, which currently supports = TLS 1.2 (for using integrity only) for machine to machine communication If= this device is accessed by a service technician, it will also use today ci= pher suites with encryption. If a browser provider decides to deprecate TLS= 1.2 in the future, access by standard software would be hindered. This wou= ld end up in a device supporting TLS 1.3 for service technicians access and= 1.2 for machine to machine communication to (still) have integrity only. --_000_8A2746A86B4145C39D776AF3536C6E2Dsiemenscom_ Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable

On 21. Aug 2018, at 18:13, Salz, Rich <rsalz@akamai.com> wrote:

=D8  If there w= ould be support for integrity ciphers in TLS 1.3 it would enable the straig= ht forward switch from TLS 1.2 also in these environments by keeping existi= ng monitoring options.

 

Why do you want to move= to TLS 1.3?  Why isn=92t your existing solution good enough?

 

  • [stf] Currently it is sufficient to use= TLS 1.2- For certain use cases the utilized components have a rather long = lifetime. One assumption is that TLS 1.3 will exist longer that TLS 1.2 and that certain software tools (also brows= ers) may not support TLS 1.2 in the future  =85

 

Most browsers already do not support NULL encryption= , and it is highly unlikely that any will add it for 1.3.  Have you an= y indication otherwise?  If you=92re not going to use the algorithms i= n general use on the public Internet, then you should expect that standard clients such as browsers, will not work. = PeterG can attest to this. :)

 

True. I was more referring to an embedded device, which currently supports = TLS 1.2 (for using integrity only) for machine to machine communication &nb= sp;If this device is accessed by a service technician, it will also use tod= ay cipher suites with encryption. If a browser provider decides to deprecate TLS 1.2 in the future, access by s= tandard software would be hindered. This would end up in a device supportin= g TLS 1.3 for service technicians access and 1.2 for machine to machine com= munication to (still) have integrity only. --_000_8A2746A86B4145C39D776AF3536C6E2Dsiemenscom_-- From nobody Tue Aug 21 10:02:31 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B9F28130F1E for ; Tue, 21 Aug 2018 10:02:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5p7pNXZXj2yy for ; Tue, 21 Aug 2018 10:02:27 -0700 (PDT) Received: from NAM01-BN3-obe.outbound.protection.outlook.com (mail-bn3nam01on0073.outbound.protection.outlook.com [104.47.33.73]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2140F130EBA for ; Tue, 21 Aug 2018 10:02:27 -0700 (PDT) Received: from DM5PR2201MB1433.namprd22.prod.outlook.com (10.174.186.154) by DM5PR2201MB1052.namprd22.prod.outlook.com (10.174.186.19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1059.21; Tue, 21 Aug 2018 17:02:25 +0000 Received: from DM5PR2201MB1433.namprd22.prod.outlook.com ([fe80::49f1:7875:b984:9a65]) by DM5PR2201MB1433.namprd22.prod.outlook.com ([fe80::49f1:7875:b984:9a65%2]) with mapi id 15.20.1059.023; Tue, 21 Aug 2018 17:02:25 +0000 From: Jack Visoky To: Stephen Farrell , Ted Lemon CC: "ncamwing=40cisco.com@dmarc.ietf.org" , "tls@ietf.org" Thread-Topic: [TLS] EXTERNAL: Re: integrity only ciphersuites Thread-Index: AQHUOV98dXTtnuVz+kOQWLoA1No/8qTKTN5ggAAUxQCAAAYfAIAABF1g Date: Tue, 21 Aug 2018 17:02:25 +0000 Message-ID: References: <64d23891-2f32-9bb8-1ec8-f4fad13cdfb9@cs.tcd.ie> <982363FD-A839-4175-BA53-7CA242F9ADA6@ll.mit.edu> <2D7F2926-6376-4B2C-BDE9-7A6F1C0FA748@gmail.com> <5B7C1571020000AC0015C330@gwia2.rz.hs-offenburg.de> <3e5ce261-bfa9-a543-1824-099599b460d9@cs.tcd.ie> In-Reply-To: <3e5ce261-bfa9-a543-1824-099599b460d9@cs.tcd.ie> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=jmvisoky@ra.rockwell.com; x-originating-ip: [205.175.250.246] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; DM5PR2201MB1052; 6:PE8yGKlnpJSIUPWUrPCQVVMwDstTcEWhva3GLv+UHPa0410LjPm9OUHhoKJ8INu0VxFE+ErCwvyFTQqhpwjGoASXnnCbIWYGFRN93oGNqlz3K9qzyuMJx33j0+7vs+kZzGdsm4IxdMXgvRYxM6MhTKNl/jHmMU2qL17wHOexnDs52rAXFBL+zSXjF00gh98rs8h8/gDqKNZAtxNHAwvAoHeHJGsRMDuA0iwOLEJRCKs5/H7VLq8yioMvaR2lKBLmfyBEuZDYws+YfLq9n48oTzBU5DxPkxpBJQVKNrm9oj5/HQBvIABnp/JBqB4mBV2jFbqBWQIc5iygoNG4sEkW67I476b8UZ/6eXg31TVjV1aVPJ/ucJfzGGoKiy6XoW0kDR40HFBFAR10nHMbYuOlB27rkltLzM5qD0eK1ZevcLXWfHuy4NrKD+ldJvizuGyhp6LxwwvFDVEWDAd5wApxqA==; 5:/4Sgd28+qK7NKce3o5lGb61zoXJQ8K0wi3wZlvxZs8kjZRiZrDkBGU3o9X1O/BxigVmiUXnheEnb/9kzSyGaoWfGGh1xEbadvWkXNYurQGil7MXwwo8GFbhPFga5jsUxmQSdXbjEjrUUw4eLIVvbMUaqz620L/Ro6N1b2AhXiN8=; 7:vSzoTqHK3w3Ph5LcRo/U6KpRSLBK4qoojzmYSGaIoOBRp2/3u/7zNPl2J+BOKI1E4sxMYN2X5kosjF93tyH+YOrAn/xxoJjADK6jqF6FmMe4ZvzKbTVxqY2ktXmWymJ3YT6CBP21CpbpCYoxDQt5D4ovAAtU89j82L8Phgu/gVsIH1NLTREebaLKKNU4GYKRFw+GjXppPP0NFvHmdRro3PkKly+GXsr3cCrySF0il+bsMsMRDUDHkS2xpwXmeiOy x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-correlation-id: 820d2319-4b8e-4b9e-ea49-08d60787deb2 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(7020095)(4652040)(8989137)(4534165)(4627221)(201703031133081)(201702281549075)(8990107)(5600074)(711020)(4618075)(2017052603328)(7153060)(7193020); SRVR:DM5PR2201MB1052; x-ms-traffictypediagnostic: DM5PR2201MB1052: x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(32856632585715)(269231077054813); x-ms-exchange-senderadcheck: 1 x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(8211001083)(6040522)(2401047)(8121501046)(5005006)(10201501046)(3002001)(93006095)(93001095)(3231311)(944501410)(52105095)(6055026)(149027)(150027)(6041310)(20161123562045)(20161123558120)(20161123564045)(201703131423095)(201703031522075)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123560045)(201708071742011)(7699016); SRVR:DM5PR2201MB1052; BCL:0; PCL:0; RULEID:; SRVR:DM5PR2201MB1052; x-forefront-prvs: 0771670921 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(366004)(39860400002)(376002)(136003)(346002)(396003)(199004)(189003)(13464003)(256004)(5250100002)(4326008)(476003)(14454004)(446003)(8676002)(33656002)(25786009)(9686003)(11346002)(229853002)(68736007)(5660300001)(6246003)(106356001)(2906002)(6436002)(110136005)(97736004)(86362001)(3846002)(6116002)(66066001)(81156014)(99286004)(54906003)(53546011)(316002)(296002)(74316002)(26005)(81166006)(105586002)(7736002)(486006)(186003)(2900100001)(102836004)(53936002)(478600001)(76176011)(305945005)(6506007)(8936002)(7696005)(93886005)(55016002); DIR:OUT; SFP:1101; SCL:1; SRVR:DM5PR2201MB1052; H:DM5PR2201MB1433.namprd22.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: ra.rockwell.com does not designate permitted sender hosts) x-microsoft-antispam-message-info: pE7CmF+IODRMiYZGm60kIK5hPND6cE0i/yBtgLMX2i+R3RjyzORmQDgvbwfuy0ABfsodGYj1+q/V91IRjftCvcpSQ0nnJZ6DYHjdt1e+QJAlwH1fRAoYd42XnDsYD4vB5w/u0U+jN+rZkbunXV6C19UVHRnjwBAWLKeredupJlzEcV4ohL+q+uKR47Shrkhv7A3LLzZdu7wsYgigP7WIz+6YzXdMkj9vcHNKI4fJm8mZs/5nISBxQE8S7K7rpPZ3E4UwpbZaz9OPJ8MbsRRUocq3hFkTQJtHwLquv85fsj96L3u/eHvHRQofOheU8FxKHTNzw8P3uYmI111ewH0u4c7Unl64ejtBnqrsMEX6w14= spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: ra.rockwell.com X-MS-Exchange-CrossTenant-Network-Message-Id: 820d2319-4b8e-4b9e-ea49-08d60787deb2 X-MS-Exchange-CrossTenant-originalarrivaltime: 21 Aug 2018 17:02:25.6799 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 855b093e-7340-45c7-9f0c-96150415893e X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM5PR2201MB1052 Archived-At: Subject: Re: [TLS] EXTERNAL: Re: integrity only ciphersuites X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Aug 2018 17:02:30 -0000 V2UgKGFzIHdlbGwgYXMgb3RoZXIgdmVuZG9ycykgaGF2ZSBjZXJ0YWlubHkgZG9uZSB0ZXN0aW5n IG9uIHRoaXMuICBXZSBoYXZlIHNvbWUgcHJvZHVjdHMgd2l0aCBoYXJkd2FyZSBhY2NlbGVyYXRv cnMgYW5kIHNvbWUgd2l0aG91dCwgdGVzdGluZyBoYXMgYmVlbiBwZXJmb3JtZWQgYWNyb3NzIGEg d2lkZSByYW5nZS4gIEFFUyBpcyBhbHdheXMgYW4gYWRkZXIgd2hlbiBkb25lIGluIHNvZnR3YXJl LCBhbmQgaW4gbWFueSBoYXJkd2FyZSBpbnN0YWxsYXRpb25zIGl0IGlzIHN0aWxsIGEgdGltaW5n IGFkZGVyIChhbmQgYWx3YXlzIGEgcG93ZXIgY29uc3VtcHRpb24gYWRkZXIpLiAgTGVzcyB0ZXN0 aW5nIHdhcyBkb25lIHdpdGggQ2hhIENoYSBhcyB0aGF0IHdhcyBub3QgYXMgcHJvbWluZW50IGlu IFRMUyAxLjIuDQoNClRoZSBmYWN0IGlzIHRoYXQgZm9yIG91cnMgYW5kIG1hbnkgb3RoZXIgdmVu ZG9ycyBkZXZpY2VzIHRoZSBlbmNyeXB0aW9uIGlzIGEgbm9uLXRyaXZpYWwgYWRkZXIgZm9yIGEg bnVtYmVyIG9mIEkvTyBhcHBsaWNhdGlvbnMuDQoNClRoYW5rcyBhbmQgQmVzdCBSZWdhcmRzLA0K DQotLUphY2sNCg0KLS0tLS1PcmlnaW5hbCBNZXNzYWdlLS0tLS0NCkZyb206IFN0ZXBoZW4gRmFy cmVsbCBbbWFpbHRvOnN0ZXBoZW4uZmFycmVsbEBjcy50Y2QuaWVdIA0KU2VudDogVHVlc2RheSwg QXVndXN0IDIxLCAyMDE4IDEyOjM4IFBNDQpUbzogVGVkIExlbW9uIDxtZWxsb25AZnVndWUuY29t PjsgSmFjayBWaXNva3kgPGptdmlzb2t5QHJhLnJvY2t3ZWxsLmNvbT4NCkNjOiBuY2Ftd2luZz00 MGNpc2NvLmNvbUBkbWFyYy5pZXRmLm9yZzsgdGxzQGlldGYub3JnDQpTdWJqZWN0OiBSZTogW1RM U10gRVhURVJOQUw6IFJlOiBpbnRlZ3JpdHkgb25seSBjaXBoZXJzdWl0ZXMNCg0KDQoNCk9uIDIx LzA4LzE4IDE3OjE1LCBUZWQgTGVtb24gd3JvdGU6DQo+IEkgYXNrZWQgeW91IGlmIHlvdSBoYXZl IGFueSBzcGVjaWZpYyBkZXZpY2VzIGZvciB3aGljaCB0aGlzIGlzIGFuIGlzc3VlLg0KPiAgRG8g eW91PyAgIEhvdyBkaWQgeW91IGRldGVybWluZSB0aGF0IGl0IHdhcyBhbiBpc3N1ZT8gICBEbyB5 b3UgaGF2ZSBBL0INCj4gdGVzdGluZyByZXN1bHRzIG9uIHBvd2VyIGNvbnN1bXB0aW9uIGFuZC9v ciBwZXJmb3JtYW5jZSBvZiBhIG51bGwgDQo+IGNpcGhlciBzdWl0ZSB2ZXJzdXMgZW5jcnlwdGlv bj8NCg0KSWYgZG9pbmcgc3VjaCBjb21wYXJpc29ucywgdGhlbiBpdCdzIHZlcnkgd2VsbCB3b3J0 aCBub3RpbmcgdGhlIHNpZ25pZmljYW50IGRpZmZlcmVuY2VzIGJldHdlZW4gZS5nLiBoL3cgYWNj ZWxlcmF0ZWQgQUVTLCB2cyBzL3cgQUVTIHZzIGNoYWNoYS4gSXQnZCBiZSBoYXJkIHRvIGV2YWx1 YXRlIGNsYWltcyBhYm91dCBkaWZmaWN1bHR5IG9mIGltcGxlbWVudGF0aW9uL2RlcGxveW1lbnQg d2l0aG91dCB0aGF0Lg0KDQpTLg0K From nobody Tue Aug 21 10:06:57 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D120E130FF0 for ; Tue, 21 Aug 2018 10:06:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 818lLbCn66uW for ; Tue, 21 Aug 2018 10:06:42 -0700 (PDT) Received: from NAM02-SN1-obe.outbound.protection.outlook.com (mail-sn1nam02on0067.outbound.protection.outlook.com [104.47.36.67]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2AB5F130FEA for ; Tue, 21 Aug 2018 10:06:42 -0700 (PDT) Received: from DM5PR2201MB1433.namprd22.prod.outlook.com (10.174.186.154) by DM5PR2201MB1531.namprd22.prod.outlook.com (10.174.187.22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1059.21; Tue, 21 Aug 2018 17:06:40 +0000 Received: from DM5PR2201MB1433.namprd22.prod.outlook.com ([fe80::49f1:7875:b984:9a65]) by DM5PR2201MB1433.namprd22.prod.outlook.com ([fe80::49f1:7875:b984:9a65%2]) with mapi id 15.20.1059.023; Tue, 21 Aug 2018 17:06:40 +0000 From: Jack Visoky To: "Fries, Steffen" , "Salz, Rich" CC: "ncamwing=40cisco.com@dmarc.ietf.org" , "tls@ietf.org" Thread-Topic: EXTERNAL: Re: [TLS] integrity only ciphersuites Thread-Index: AQHUOUQUkJpihrEzjkez1izxv4krA6TKHVCAgAASLoCAAAX/gIAAI7YAgAACPQCAAAJBAIAAA5mAgAALN4CAAAMNsA== Date: Tue, 21 Aug 2018 17:06:40 +0000 Message-ID: References: <64d23891-2f32-9bb8-1ec8-f4fad13cdfb9@cs.tcd.ie> <982363FD-A839-4175-BA53-7CA242F9ADA6@ll.mit.edu> <2D7F2926-6376-4B2C-BDE9-7A6F1C0FA748@gmail.com> <5B7C1571020000AC0015C330@gwia2.rz.hs-offenburg.de> , <8A2746A8-6B41-45C3-9D77-6AF3536C6E2D@siemens.com> In-Reply-To: <8A2746A8-6B41-45C3-9D77-6AF3536C6E2D@siemens.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [205.175.250.246] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; DM5PR2201MB1531; 6:YgwAcbQSXBcyOrb2PjaK2OQwng4Jt+twvcsRIOQg5uUznqZtjV59kPijLMci/yLy6ntEw+ypWraNTo8+EfsNnYUKnt/DZkh2VkmZ6a5J9WmN5PUAGbJDnRKJnMXTEXUjuyvd4UB9m9f4WiL+0SwS4MX/B2brw73nakLUQo3Jvnd1/YwbCoe5erjF3l/UcLLOIsRbJeelCMI2rSOAZm2R6uZhS6nkg0CX6tc6ZGZWlVye/Dmz4yU/y2lAQa/tMbz+/ei9S9v6kty6X13lJH86SjGIhaVsIZUaAUfKKGeyEFcRQKqY1SOe1oLinn+3JT2f9lsI5kt/FlMjfLsV4dkmDUbdSW2Qz5kvfH1JWWkTULfeikY3xebIF+ISGiV8wejvdRRX7FAfMUmR3gVZVgporkldfKtiNf1ABEugOlCtA9AhrZKLl5LObcbx+fe1+60XQ/6NGKM9WNVJsDdR0UTVkA==; 5:TnQxlK56ygVcMmFRONuLOSsWxIUxyo5DgfrYgciLAsZ//nVEDYdyBg/8QvzrZE0IwoJSDtY9pLu7b3hw/5zQaEEEZpcMK5zXF2qjMdZtyszVWpfJ5+tcoA4b9jhVK3kZ7QBWzb4/QjedNr6klz4O9lUXjxfCMSRgjpeTPxHNvO8=; 7:+J7ulskVJ+WhaFdmdh7/tt8+ebQbxzMDQjVwOv0WZ3ps0372N3tUTIX4Al/F6DATccVHsN8jJymvuiijdYbpq9JMfMOeusHSaPvWNtzzJqktqB1gCUiHBd9FiIEu/tLdAvPtQKjNhcN3zHKSC1Ka487MDJBd9VwRDnTT+LozvkCqXohCNEznftEV/uNICEvPJHUAaU3yuCc0WpXpeql2JKpQkQZX3P2vm6xbcVZ4FdNNnGcRFjTchCs+F+F0n/pk x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-correlation-id: 2081268f-fa7f-489a-8b2f-08d6078876b2 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(7020095)(4652040)(8989137)(4534165)(4627221)(201703031133081)(201702281549075)(8990107)(5600074)(711020)(4618075)(2017052603328)(7153060)(7193020); SRVR:DM5PR2201MB1531; x-ms-traffictypediagnostic: DM5PR2201MB1531: authentication-results: spf=none (sender IP is ) smtp.mailfrom=jmvisoky@ra.rockwell.com; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(28532068793085)(72170088055959)(21748063052155); x-ms-exchange-senderadcheck: 1 x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(8211001083)(6040522)(2401047)(5005006)(8121501046)(3231311)(944501410)(52105095)(10201501046)(3002001)(93006095)(93001095)(6055026)(149027)(150027)(6041310)(20161123562045)(20161123564045)(20161123560045)(20161123558120)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(201708071742011)(7699016); SRVR:DM5PR2201MB1531; BCL:0; PCL:0; RULEID:; SRVR:DM5PR2201MB1531; x-forefront-prvs: 0771670921 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(39860400002)(396003)(346002)(376002)(366004)(136003)(189003)(199004)(110136005)(102836004)(5024004)(106356001)(256004)(14444005)(2900100001)(68736007)(86362001)(5250100002)(105586002)(6506007)(2906002)(53546011)(93886005)(6436002)(8936002)(486006)(446003)(66066001)(476003)(14454004)(229853002)(11346002)(316002)(81156014)(99286004)(19609705001)(53936002)(7696005)(54906003)(33656002)(97736004)(6306002)(478600001)(186003)(76176011)(236005)(6246003)(26005)(54896002)(81166006)(8676002)(55016002)(74316002)(7736002)(790700001)(5660300001)(3846002)(25786009)(4326008)(6116002)(9686003); DIR:OUT; SFP:1101; SCL:1; SRVR:DM5PR2201MB1531; H:DM5PR2201MB1433.namprd22.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: ra.rockwell.com does not designate permitted sender hosts) x-microsoft-antispam-message-info: hxZVaMjbixp249fIZxFOCwb1YcHN0qxBWkExTlbEuSZ7H9zxb0GulcXdMxKzkDqCyrr/QxPnkpuM6RIpZncHDsYsnGixYYhl5Gje3w/DUt0kJOELh0t+kxrcHsIObIB9QjUZr3y7tcRtOb/P4O3/ZdxcLKqyueSTJAdQJilDrg4/05pd5nSIqc7AIBoEzV1cn4dIRgpYHV1lCpZuMyWNJaytTWRTvcTA0rLfiAU36pijbjdp0gc3BWY2XMqoxQkrcvP6ILybOg3PWCqkzKfzdaN6+x4HeKMyOV4spVMh8wtv4xE739K4uZGsstpbyM4dqHmxK/uG70iQjvAu0E1sUKdkkTY8CwVbkEhdck75syE= spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_DM5PR2201MB1433B9D7F9AA3B7B688CD33C99310DM5PR2201MB1433_" MIME-Version: 1.0 X-OriginatorOrg: ra.rockwell.com X-MS-Exchange-CrossTenant-Network-Message-Id: 2081268f-fa7f-489a-8b2f-08d6078876b2 X-MS-Exchange-CrossTenant-originalarrivaltime: 21 Aug 2018 17:06:40.6782 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 855b093e-7340-45c7-9f0c-96150415893e X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM5PR2201MB1531 Archived-At: Subject: Re: [TLS] EXTERNAL: Re: integrity only ciphersuites X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Aug 2018 17:06:54 -0000 --_000_DM5PR2201MB1433B9D7F9AA3B7B688CD33C99310DM5PR2201MB1433_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Just to pile on what Steffen is saying, the motivation for this is mainly a= round device communication that happens at high speeds (sub millisecond is = not uncommon for an update rate). The communications is generally not HTTP= , but rather industrial protocols built on TCP and UDP. Thanks and Best Regards, --Jack From: TLS [mailto:tls-bounces@ietf.org] On Behalf Of Fries, Steffen Sent: Tuesday, August 21, 2018 12:54 PM To: Salz, Rich Cc: ncamwing=3D40cisco.com@dmarc.ietf.org; tls@ietf.org Subject: EXTERNAL: Re: [TLS] integrity only ciphersuites [Use caution with links & attachments] On 21. Aug 2018, at 18:13, Salz, Rich > wrote: ? If there would be support for integrity ciphers in TLS 1.3 it would enab= le the straight forward switch from TLS 1.2 also in these environments by k= eeping existing monitoring options. Why do you want to move to TLS 1.3? Why isn't your existing solution good = enough? ? [stf] Currently it is sufficient to use TLS 1.2- For certain use cases t= he utilized components have a rather long lifetime. One assumption is that = TLS 1.3 will exist longer that TLS 1.2 and that certain software tools (als= o browsers) may not support TLS 1.2 in the future ... Most browsers already do not support NULL encryption, and it is highly unli= kely that any will add it for 1.3. Have you any indication otherwise? If = you're not going to use the algorithms in general use on the public Interne= t, then you should expect that standard clients such as browsers, will not = work. PeterG can attest to this. :) True. I was more referring to an embedded device, which currently supports = TLS 1.2 (for using integrity only) for machine to machine communication If= this device is accessed by a service technician, it will also use today ci= pher suites with encryption. If a browser provider decides to deprecate TLS= 1.2 in the future, access by standard software would be hindered. This wou= ld end up in a device supporting TLS 1.3 for service technicians access and= 1.2 for machine to machine communication to (still) have integrity only. --_000_DM5PR2201MB1433B9D7F9AA3B7B688CD33C99310DM5PR2201MB1433_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Just to pile on what S= teffen is saying, the motivation for this is mainly around device communica= tion that happens at high speeds (sub millisecond is not uncommon for an up= date rate).  The communications is generally not HTTP, but rather industrial protocols built on TCP and UDP.=

 

Thanks and Best Regard= s,

 

--Jack

 

From: TLS [mailto:tls-bounces@ietf.org] On= Behalf Of Fries, Steffen
Sent: Tuesday, August 21, 2018 12:54 PM
To: Salz, Rich <rsalz@akamai.com>
Cc: ncamwing=3D40cisco.com@dmarc.ietf.org; tls@ietf.org
Subject: EXTERNAL: Re: [TLS] integrity only ciphersuites<= /p>

 

[Use caution with links & attachments]

 

 

On 21. Aug 2018, at 1= 8:13, Salz, Rich <rsalz@akamai.com> wrote:

?&nb= sp; If there would= be support for integrity ciphers in TLS 1.3 it would enable the straight f= orward switch from TLS 1.2 also in these environments by keeping existing m= onitoring options.

 

Why do you want to move= to TLS 1.3?  Why isn’t your existing solution good enough?=

 

?&nb= sp; [stf] Currentl= y it is sufficient to use TLS 1.2- For certain use cases the utilized compo= nents have a rather long lifetime. One assumption is that TLS 1.3 will exis= t longer that TLS 1.2 and that certain software tools (also browsers) may not support TLS 1.2 in the future  …

 

Most browsers already do not support NULL encryption= , and it is highly unlikely that any will add it for 1.3.  Have you an= y indication otherwise?  If you’re not going to use the algorith= ms in general use on the public Internet, then you should expect that standard clients such as browsers, will not work. = PeterG can attest to this. :)

 

True. I was more referring to an embedded device= , which currently supports TLS 1.2 (for using integrity only) for machine t= o machine communication  If this device is accessed by a service technician, it will also use today cipher suites with encrypt= ion. If a browser provider decides to deprecate TLS 1.2 in the future, acce= ss by standard software would be hindered. This would end up in a device su= pporting TLS 1.3 for service technicians access and 1.2 for machine to machine communication to (still) have integr= ity only.

--_000_DM5PR2201MB1433B9D7F9AA3B7B688CD33C99310DM5PR2201MB1433_-- From nobody Tue Aug 21 10:13:58 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 135E0130FA5 for ; Tue, 21 Aug 2018 10:13:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.71 X-Spam-Level: X-Spam-Status: No, score=-2.71 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=akamai.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VgcMKIaPWdgS for ; Tue, 21 Aug 2018 10:13:42 -0700 (PDT) Received: from mx0a-00190b01.pphosted.com (mx0a-00190b01.pphosted.com [IPv6:2620:100:9001:583::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C8267130FD4 for ; Tue, 21 Aug 2018 10:13:42 -0700 (PDT) Received: from pps.filterd (m0122333.ppops.net [127.0.0.1]) by mx0a-00190b01.pphosted.com (8.16.0.22/8.16.0.22) with SMTP id w7LHC70U023357; Tue, 21 Aug 2018 18:13:23 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=akamai.com; h=from : to : cc : subject : date : message-id : references : in-reply-to : content-type : mime-version; s=jan2016.eng; bh=PlztCm182X9noEodb0Pb5X2Bh1vYsOyeob/xKWfDvqE=; b=e3BBqZw+gVE5SEQRWvT5BT6u7f+Tkuq9h7CysOjDe4nsCh3DAqAZn6/pSba+jHmCK0Us ShFJss2acsXgLQAigk4yZkzGSP5lLrqobCu+Uhi6M1tktYQZKIXT/RJEk8NJ5VNVJM+f TJ+t3dEu1ty/0jkSXexVBfS6yVQ6es74PkrJCfWLhnN30uGdz3LEvMDc3im5IKDch5GW JVCqwrx664NWxFaYZujMlHbMhe5j8uSXuTTV93ECpnSQx4oDoEeLFNRXii/LqYkxHxEH ubMrw6mWS4kYnLDPZdVu9ANkT7gxbZl4A9sJMG/mHZC3ZimVUG825bN3n4q4hueqvX+u jQ== Received: from prod-mail-ppoint3 (a96-6-114-86.deploy.static.akamaitechnologies.com [96.6.114.86] (may be forged)) by mx0a-00190b01.pphosted.com with ESMTP id 2kxaq70r1p-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 21 Aug 2018 18:13:21 +0100 Received: from pps.filterd (prod-mail-ppoint3.akamai.com [127.0.0.1]) by prod-mail-ppoint3.akamai.com (8.16.0.21/8.16.0.21) with SMTP id w7LH5ODj017617; Tue, 21 Aug 2018 13:12:15 -0400 Received: from email.msg.corp.akamai.com ([172.27.123.31]) by prod-mail-ppoint3.akamai.com with ESMTP id 2kxesvhjmd-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Tue, 21 Aug 2018 13:12:15 -0400 Received: from USMA1EX-DAG1MB1.msg.corp.akamai.com (172.27.123.101) by usma1ex-dag1mb3.msg.corp.akamai.com (172.27.123.103) with Microsoft SMTP Server (TLS) id 15.0.1365.1; Tue, 21 Aug 2018 13:12:14 -0400 Received: from USMA1EX-DAG1MB1.msg.corp.akamai.com ([172.27.123.101]) by usma1ex-dag1mb1.msg.corp.akamai.com ([172.27.123.101]) with mapi id 15.00.1365.000; Tue, 21 Aug 2018 13:12:14 -0400 From: "Salz, Rich" To: "Fries, Steffen" CC: Andreas Walz , "tls@ietf.org" , "ncamwing=40cisco.com@dmarc.ietf.org" Thread-Topic: [TLS] integrity only ciphersuites Thread-Index: AQHUOMcWIQ0ztQCz9UKccOekmBKud6TKWVQAgAAIAoCAABIwgIAABf+AgAAjtwD//78uAIAARU8A///Ai4CAAE5FgP//whwA Date: Tue, 21 Aug 2018 17:12:13 +0000 Message-ID: References: <64d23891-2f32-9bb8-1ec8-f4fad13cdfb9@cs.tcd.ie> <982363FD-A839-4175-BA53-7CA242F9ADA6@ll.mit.edu> <2D7F2926-6376-4B2C-BDE9-7A6F1C0FA748@gmail.com> <5B7C1571020000AC0015C330@gwia2.rz.hs-offenburg.de> <8A2746A8-6B41-45C3-9D77-6AF3536C6E2D@siemens.com> In-Reply-To: <8A2746A8-6B41-45C3-9D77-6AF3536C6E2D@siemens.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.10.0.180812 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [172.19.35.74] Content-Type: multipart/alternative; boundary="_000_B91DE602C4C24A209D188AE676D3ED2Dakamaicom_" MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2018-08-21_08:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 mlxscore=0 mlxlogscore=863 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1807170000 definitions=main-1808210178 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2018-08-21_08:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=855 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1807170000 definitions=main-1808210179 Archived-At: Subject: Re: [TLS] integrity only ciphersuites X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Aug 2018 17:13:56 -0000 --_000_B91DE602C4C24A209D188AE676D3ED2Dakamaicom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Tm93IEkgdGhpbmsgSSBhbSBhcyBjb25mdXNlZCBhcyBTdGVwaGVuIGFuZCBvdGhlcnMuDQoNCk9u ZSBqdXN0aWZpY2F0aW9uIHdhcyDigJxzbWFsbCBmb290cHJpbnQu4oCdICBCdXQgbm93IHlvdeKA mXJlIHNheWluZyB0aGF0IGZvciBkZWJ1Z2dpbmcgZW5jcnlwdGlvbiAoc3RhbmRhcmQ/KSBjaXBo ZXJzIGFyZSB1c2VkIGZvciBicm93c2VyIGFjY2Vzcz8NCg0K --_000_B91DE602C4C24A209D188AE676D3ED2Dakamaicom_ Content-Type: text/html; charset="utf-8" Content-ID: <0A0C9E82A2DE5442BB45A5C62A61D37F@akamai.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseTpXaW5nZGluZ3M7DQoJcGFub3NlLTE6NSAwIDAgMCAwIDAgMCAwIDAg MDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJDYW1icmlhIE1hdGgiOw0KCXBhbm9zZS0x OjIgNCA1IDMgNSA0IDYgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDYWxpYnJp Ow0KCXBhbm9zZS0xOjIgMTUgNSAyIDIgMiA0IDMgMiA0O30NCi8qIFN0eWxlIERlZmluaXRpb25z ICovDQpwLk1zb05vcm1hbCwgbGkuTXNvTm9ybWFsLCBkaXYuTXNvTm9ybWFsDQoJe21hcmdpbjow aW47DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMS4wcHQ7DQoJZm9udC1m YW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0KYTpsaW5rLCBzcGFuLk1zb0h5cGVybGluaw0K CXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6Ymx1ZTsNCgl0ZXh0LWRlY29yYXRpb246 dW5kZXJsaW5lO30NCmE6dmlzaXRlZCwgc3Bhbi5Nc29IeXBlcmxpbmtGb2xsb3dlZA0KCXttc28t c3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6cHVycGxlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRl cmxpbmU7fQ0KcC5Nc29MaXN0UGFyYWdyYXBoLCBsaS5Nc29MaXN0UGFyYWdyYXBoLCBkaXYuTXNv TGlzdFBhcmFncmFwaA0KCXttc28tc3R5bGUtcHJpb3JpdHk6MzQ7DQoJbWFyZ2luLXRvcDowaW47 DQoJbWFyZ2luLXJpZ2h0OjBpbjsNCgltYXJnaW4tYm90dG9tOjBpbjsNCgltYXJnaW4tbGVmdDou NWluOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQt ZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnAubXNvbm9ybWFsMCwgbGkubXNvbm9ybWFs MCwgZGl2Lm1zb25vcm1hbDANCgl7bXNvLXN0eWxlLW5hbWU6bXNvbm9ybWFsOw0KCW1zby1tYXJn aW4tdG9wLWFsdDphdXRvOw0KCW1hcmdpbi1yaWdodDowaW47DQoJbXNvLW1hcmdpbi1ib3R0b20t YWx0OmF1dG87DQoJbWFyZ2luLWxlZnQ6MGluOw0KCWZvbnQtc2l6ZToxMS4wcHQ7DQoJZm9udC1m YW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0Kc3Bhbi5ncm91cHdpc2VyZXBseWhlYWRlcg0K CXttc28tc3R5bGUtbmFtZTpncm91cHdpc2VyZXBseWhlYWRlcjt9DQpzcGFuLkVtYWlsU3R5bGUy MA0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fu cy1zZXJpZjsNCgljb2xvcjojMUY0OTdEOw0KCWZvbnQtd2VpZ2h0Om5vcm1hbDsNCglmb250LXN0 eWxlOm5vcm1hbDsNCgl0ZXh0LWRlY29yYXRpb246bm9uZSBub25lO30NCnNwYW4uRW1haWxTdHls ZTIxDQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsOw0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixz YW5zLXNlcmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0Kc3Bhbi5FbWFpbFN0eWxlMjINCgl7bXNv LXN0eWxlLXR5cGU6cGVyc29uYWw7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7 DQoJY29sb3I6IzFGNDk3RDsNCglmb250LXdlaWdodDpub3JtYWw7DQoJZm9udC1zdHlsZTpub3Jt YWw7DQoJdGV4dC1kZWNvcmF0aW9uOm5vbmUgbm9uZTt9DQpzcGFuLkVtYWlsU3R5bGUyMw0KCXtt c28tc3R5bGUtdHlwZTpwZXJzb25hbDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJp ZjsNCgljb2xvcjp3aW5kb3d0ZXh0O30NCnNwYW4uRW1haWxTdHlsZTI0DQoJe21zby1zdHlsZS10 eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0K CWNvbG9yOndpbmRvd3RleHQ7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhw b3J0LW9ubHk7DQoJZm9udC1zaXplOjEwLjBwdDt9DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6 ZTo4LjVpbiAxMS4waW47DQoJbWFyZ2luOjEuMGluIDEuMGluIDEuMGluIDEuMGluO30NCmRpdi5X b3JkU2VjdGlvbjENCgl7cGFnZTpXb3JkU2VjdGlvbjE7fQ0KLyogTGlzdCBEZWZpbml0aW9ucyAq Lw0KQGxpc3QgbDANCgl7bXNvLWxpc3QtaWQ6MTQwMDkwOTU0NjsNCgltc28tbGlzdC10eXBlOmh5 YnJpZDsNCgltc28tbGlzdC10ZW1wbGF0ZS1pZHM6LTQ4OTc3MjA0NCAtMjAzOTcyMjM3NiA2NzY5 ODY5MSA2NzY5ODY5MyA2NzY5ODY4OSA2NzY5ODY5MSA2NzY5ODY5MyA2NzY5ODY4OSA2NzY5ODY5 MSA2NzY5ODY5Mzt9DQpAbGlzdCBsMDpsZXZlbDENCgl7bXNvLWxldmVsLXN0YXJ0LWF0OjA7DQoJ bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Oj87DQoJbXNv LWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0K CXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7DQoJbXNvLWZhcmVh c3QtZm9udC1mYW1pbHk6Q2FsaWJyaTsNCgltc28tYmlkaS1mb250LWZhbWlseTpDYWxpYnJpO30N CkBsaXN0IGwwOmxldmVsMg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNv LWxldmVsLXRleHQ6bzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVt YmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OiJD b3VyaWVyIE5ldyI7fQ0KQGxpc3QgbDA6bGV2ZWwzDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0 OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDo/Ow0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0K CW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJ Zm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwwOmxldmVsNA0KCXttc28tbGV2ZWwtbnVt YmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6PzsNCgltc28tbGV2ZWwtdGFiLXN0 b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6 LS4yNWluOw0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMDpsZXZlbDUNCgl7bXNvLWxl dmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Om87DQoJbXNvLWxldmVs LXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQt aW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseToiQ291cmllciBOZXciO30NCkBsaXN0IGwwOmxl dmVsNg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6 PzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9u OmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpA bGlzdCBsMDpsZXZlbDcNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1s ZXZlbC10ZXh0Oj87DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJl ci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseTpTeW1i b2w7fQ0KQGxpc3QgbDA6bGV2ZWw4DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsN Cgltc28tbGV2ZWwtdGV4dDpvOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZl bC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1p bHk6IkNvdXJpZXIgTmV3Ijt9DQpAbGlzdCBsMDpsZXZlbDkNCgl7bXNvLWxldmVsLW51bWJlci1m b3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Oj87DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5v bmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVp bjsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDENCgl7bXNvLWxpc3QtaWQ6MTc4 MTI5Mjg5MzsNCgltc28tbGlzdC10ZW1wbGF0ZS1pZHM6MTcxMTQ1MjYzMDt9DQpAbGlzdCBsMTps ZXZlbDENCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0 Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6LjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0 aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4w cHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwxOmxldmVsMg0KCXttc28tbGV2ZWwt bnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10 YWItc3RvcDoxLjBpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1p bmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6 U3ltYm9sO30NCkBsaXN0IGwxOmxldmVsMw0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxs ZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDoxLjVpbjsNCglt c28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1z by1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwx OmxldmVsNA0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRl eHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDoyLjBpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBv c2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZTox MC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwxOmxldmVsNQ0KCXttc28tbGV2 ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZl bC10YWItc3RvcDoyLjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4 dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1p bHk6U3ltYm9sO30NCkBsaXN0IGwxOmxldmVsNg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpi dWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDozLjBpbjsN Cgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0K CW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0 IGwxOmxldmVsNw0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVs LXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDozLjVpbjsNCgltc28tbGV2ZWwtbnVtYmVy LXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6 ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwxOmxldmVsOA0KCXttc28t bGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1s ZXZlbC10YWItc3RvcDo0LjBpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJ dGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1m YW1pbHk6U3ltYm9sO30NCkBsaXN0IGwxOmxldmVsOQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1h dDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDo0LjVp bjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWlu Ow0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCm9s DQoJe21hcmdpbi1ib3R0b206MGluO30NCnVsDQoJe21hcmdpbi1ib3R0b206MGluO30NCi0tPjwv c3R5bGU+DQo8L2hlYWQ+DQo8Ym9keSBsYW5nPSJFTi1VUyIgbGluaz0iYmx1ZSIgdmxpbms9InB1 cnBsZSI+DQo8ZGl2IGNsYXNzPSJXb3JkU2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ Tm93IEkgdGhpbmsgSSBhbSBhcyBjb25mdXNlZCBhcyBTdGVwaGVuIGFuZCBvdGhlcnMuPG86cD48 L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPk9uZSBqdXN0aWZpY2F0aW9uIHdhcyDigJxzbWFsbCBmb290cHJp bnQu4oCdJm5ic3A7IEJ1dCBub3cgeW914oCZcmUgc2F5aW5nIHRoYXQgZm9yIGRlYnVnZ2luZyBl bmNyeXB0aW9uIChzdGFuZGFyZD8pIGNpcGhlcnMgYXJlIHVzZWQgZm9yIGJyb3dzZXIgYWNjZXNz PzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48 L3A+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_B91DE602C4C24A209D188AE676D3ED2Dakamaicom_-- From nobody Tue Aug 21 10:30:03 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A639D130FFB for ; Tue, 21 Aug 2018 10:29:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.909 X-Spam-Level: X-Spam-Status: No, score=-1.909 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_DKIMWL_WL_MED=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wxi-Muf1uJMj for ; Tue, 21 Aug 2018 10:29:47 -0700 (PDT) Received: from mail-it0-x231.google.com (mail-it0-x231.google.com [IPv6:2607:f8b0:4001:c0b::231]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 05963130FE5 for ; Tue, 21 Aug 2018 10:29:46 -0700 (PDT) Received: by mail-it0-x231.google.com with SMTP id 139-v6so5141238itf.0 for ; Tue, 21 Aug 2018 10:29:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=MnwLh5t5q+N6U1UPNBe/SHvdy4OTFGYuqdoKz/XXjOk=; b=O3g/aIrAXELx0YdKSlwXz2brQvNCI3k+OBvCZB5W+ySmNMWIOJODYI+i/EWWCrfqbm UfzIwcVeFWdkZaAxi1SCpwn1anch9IkzU4QRWXrq0/r1YLvtDKrrwKftxy4oxYHz8b+O dd76G4GMwpo7Iq5BlBRqDcXzvNRLRXdQLFlXEYYmdecuh0WgAhGC4++U77JUnL6MFY7B ff26nWSHvEE7SCqDEaB0+5kyP/nBsb9p3V0OhmG+hEK9vyCWKy0GNW0Xuj/c3XgixuMZ Jrzlxqr+DJ3WhsImLwjc5VbihPTVReIqbm6anDNrIIzPzn0X8BJuLuJpyLzyutkXto4n Mi1A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=MnwLh5t5q+N6U1UPNBe/SHvdy4OTFGYuqdoKz/XXjOk=; b=Ld6PwI1XXO+x76RzfXlDOiZe3bntbkE5d7s/uIicTcdqpgKDuSTX8YmOjjP9KG1ubV LvhncjOhevI+8TOADr16gpYa8JhwVgFqapcvRaWvAH8b2H7glmTbZzyhsC6K1v/is7xY Xjh4cSsMSgzEFNDk96wiGuxdK60ByXyDL/pJjkChjiA51x3Tmvl/qM2ByLdz3agRoRa9 uFLmHLxCjE6KpopZYndoTEwWycXCM26V7RTlcNKznIJfoK1zcoK944k13nX78t0aWea9 5GyaUVmBDJyifn/pH0Ejznc0S7zj6yAe+zTl7hJaM+7mE6x2CMeDWtJ/NMYZl0YeMKVA J1Zg== X-Gm-Message-State: APzg51ByZT4wfCJYw1oShMkoeLV4dBEpNi+7ZiIQbLLgpW02/JmYSRYn Zm2gtiDaEzUhaDy5jjZ2w3I0VtcXNIlYV5WkP5/oWg== X-Google-Smtp-Source: ANB0Vdb90o1z2cQdQBwLGrnxMdzbg6eUhWQBPdpSlw4yFVqSanNkAIjzCV3XbL+KP6sUyZ1d/dBye8Ct5T2cmLgknks= X-Received: by 2002:a24:5f92:: with SMTP id r140-v6mr245128itb.95.1534872586094; Tue, 21 Aug 2018 10:29:46 -0700 (PDT) MIME-Version: 1.0 Received: by 2002:a4f:a009:0:0:0:0:0 with HTTP; Tue, 21 Aug 2018 10:29:05 -0700 (PDT) In-Reply-To: References: <64d23891-2f32-9bb8-1ec8-f4fad13cdfb9@cs.tcd.ie> <982363FD-A839-4175-BA53-7CA242F9ADA6@ll.mit.edu> <2D7F2926-6376-4B2C-BDE9-7A6F1C0FA748@gmail.com> <5B7C1571020000AC0015C330@gwia2.rz.hs-offenburg.de> <8A2746A8-6B41-45C3-9D77-6AF3536C6E2D@siemens.com> From: Ted Lemon Date: Tue, 21 Aug 2018 13:29:05 -0400 Message-ID: To: Jack Visoky Cc: "Fries, Steffen" , "Salz, Rich" , "ncamwing=40cisco.com@dmarc.ietf.org" , "tls@ietf.org" Content-Type: multipart/alternative; boundary="00000000000045256b0573f55fe8" Archived-At: Subject: Re: [TLS] EXTERNAL: Re: integrity only ciphersuites X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Aug 2018 17:30:02 -0000 --00000000000045256b0573f55fe8 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable So rather than upgrading to TLS 1.3, why not just upgrade to IPsec? You're going to have to change what you do anyway=E2=80=94rather than argu= ing with us why not bypass us entirely? On Tue, Aug 21, 2018 at 1:06 PM, Jack Visoky wrote: > Just to pile on what Steffen is saying, the motivation for this is mainly > around device communication that happens at high speeds (sub millisecond = is > not uncommon for an update rate). The communications is generally not > HTTP, but rather industrial protocols built on TCP and UDP. > > > > Thanks and Best Regards, > > > > --Jack > > > > *From:* TLS [mailto:tls-bounces@ietf.org] *On Behalf Of *Fries, Steffen > *Sent:* Tuesday, August 21, 2018 12:54 PM > *To:* Salz, Rich > *Cc:* ncamwing=3D40cisco.com@dmarc.ietf.org; tls@ietf.org > *Subject:* EXTERNAL: Re: [TLS] integrity only ciphersuites > > > > [Use caution with links & attachments] > > > > > > On 21. Aug 2018, at 18:13, Salz, Rich wrote: > > ? If there would be support for integrity ciphers in TLS 1.3 it would > enable the straight forward switch from TLS 1.2 also in these environment= s > by keeping existing monitoring options. > > > > Why do you want to move to TLS 1.3? Why isn=E2=80=99t your existing solu= tion good > enough? > > > > ? [stf] Currently it is sufficient to use TLS 1.2- For certain use cases > the utilized components have a rather long lifetime. One assumption is th= at > TLS 1.3 will exist longer that TLS 1.2 and that certain software tools > (also browsers) may not support TLS 1.2 in the future =E2=80=A6 > > > > Most browsers already do not support NULL encryption, and it is highly > unlikely that any will add it for 1.3. Have you any indication otherwise= ? > If you=E2=80=99re not going to use the algorithms in general use on the p= ublic > Internet, then you should expect that standard clients such as browsers, > will not work. PeterG can attest to this. :) > > > > True. I was more referring to an embedded device, which currently support= s > TLS 1.2 (for using integrity only) for machine to machine communication = If > this device is accessed by a service technician, it will also use today > cipher suites with encryption. If a browser provider decides to deprecate > TLS 1.2 in the future, access by standard software would be hindered. Thi= s > would end up in a device supporting TLS 1.3 for service technicians acces= s > and 1.2 for machine to machine communication to (still) have integrity > only. > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > > --00000000000045256b0573f55fe8 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
So rather than upgrading to TLS 1.3, why not just upgrade = to IPsec?=C2=A0 =C2=A0You're going to have to change what you do anyway= =E2=80=94rather than arguing with us why not bypass us entirely?

On Tue, Aug 21, 2018 a= t 1:06 PM, Jack Visoky <jmvisoky@ra.rockwell.com> wro= te:

Just to pile on what S= teffen is saying, the motivation for this is mainly around device communica= tion that happens at high speeds (sub millisecond is not uncommon for an up= date rate).=C2=A0 The communications is generally not HTTP, but rather industrial protocols built on TCP and UDP.<= /u>

=C2=A0

Thanks and Best Regard= s,

=C2=A0

--Jack

=C2=A0

From: TLS [mailto:tls-bounces@ietf.org] On Behalf Of Fries, Steffen
Sent: Tuesday, August 21, 2018 12:54 PM
To: Salz, Rich <rsalz@akamai.com>
Cc: ncamwing=3D40cisco.com@dmarc.ietf.org; tls@ietf.org
Subject: EXTERNAL: Re: [TLS] integrity only ciphersuites

=C2=A0

[Use caution with links & attachments]

=C2=A0

=C2=A0<= /p>

On 21. Aug 2018, at 1= 8:13, Salz, Rich <= rsalz@akamai.com> wrote:

?=C2=A0 If there would be= support for integrity ciphers in TLS 1.3 it would enable the straight forw= ard switch from TLS 1.2 also in these environments by keeping existing moni= toring options.

=C2=A0

Why do you want to move= to TLS 1.3?=C2=A0 Why isn=E2=80=99t your existing solution good enough?=

=C2=A0

?=C2=A0 [stf] Currently i= t is sufficient to use TLS 1.2- For certain use cases the utilized componen= ts have a rather long lifetime. One assumption is that TLS 1.3 will exist l= onger that TLS 1.2 and that certain software tools (also browsers) may not support TLS 1.2 in the future =C2=A0=E2=80=A6

=C2=A0

Most browsers already do not support NULL encryption= , and it is highly unlikely that any will add it for 1.3.=C2=A0 Have you an= y indication otherwise?=C2=A0 If you=E2=80=99re not going to use the algori= thms in general use on the public Internet, then you should expect that standard clients such as browsers, will not work.=C2=A0= PeterG can attest to this. :)

=C2=A0

True. I was more referring to an embedded device= , which currently supports TLS 1.2 (for using integrity only) for machine t= o machine communication =C2=A0If this device is accessed by a service technician, it will also use today cipher suites with encrypt= ion. If a browser provider decides to deprecate TLS 1.2 in the future, acce= ss by standard software would be hindered. This would end up in a device su= pporting TLS 1.3 for service technicians access and 1.2 for machine to machine communication to (still) have integr= ity only.


_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls


--00000000000045256b0573f55fe8-- From nobody Tue Aug 21 10:34:30 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B493E130F72 for ; Tue, 21 Aug 2018 10:34:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id b5_YbANagFBv for ; Tue, 21 Aug 2018 10:34:26 -0700 (PDT) Received: from NAM03-DM3-obe.outbound.protection.outlook.com (mail-dm3nam03on0608.outbound.protection.outlook.com [IPv6:2a01:111:f400:fe49::608]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5D897124D68 for ; Tue, 21 Aug 2018 10:34:26 -0700 (PDT) Received: from DM5PR2201MB1433.namprd22.prod.outlook.com (10.174.186.154) by DM5PR2201MB1705.namprd22.prod.outlook.com (10.164.253.38) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1059.24; Tue, 21 Aug 2018 17:34:24 +0000 Received: from DM5PR2201MB1433.namprd22.prod.outlook.com ([fe80::49f1:7875:b984:9a65]) by DM5PR2201MB1433.namprd22.prod.outlook.com ([fe80::49f1:7875:b984:9a65%2]) with mapi id 15.20.1059.023; Tue, 21 Aug 2018 17:34:24 +0000 From: Jack Visoky To: "Salz, Rich" , "Fries, Steffen" CC: "ncamwing=40cisco.com@dmarc.ietf.org" , "tls@ietf.org" Thread-Topic: EXTERNAL: Re: [TLS] integrity only ciphersuites Thread-Index: AQHUOUQUkJpihrEzjkez1izxv4krA6TKHVCAgAASLoCAAAX/gIAAI7YAgAACPQCAAAJBAIAAA5mAgAALN4CAAAUrgIAABZKw Date: Tue, 21 Aug 2018 17:34:24 +0000 Message-ID: References: <64d23891-2f32-9bb8-1ec8-f4fad13cdfb9@cs.tcd.ie> <982363FD-A839-4175-BA53-7CA242F9ADA6@ll.mit.edu> <2D7F2926-6376-4B2C-BDE9-7A6F1C0FA748@gmail.com> <5B7C1571020000AC0015C330@gwia2.rz.hs-offenburg.de> <8A2746A8-6B41-45C3-9D77-6AF3536C6E2D@siemens.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=jmvisoky@ra.rockwell.com; x-originating-ip: [205.175.250.246] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; DM5PR2201MB1705; 6:Bb8h78erjHX4NiIvxtgamZsVroOoJBebWG2Tit49I0Yc1n8LS/jrj6QY4D0OzuLs0kNrPcyzn1tTSopmwfd57aKQiHe09jWiPahvavusnlVJ+xI9rRsXPHKouuQieUFlOv0cbWhiIhfkIyXXtJ7yMg6j48n1PdTtUYPJQ3DTNvvbw1CRS1putJ/O2F4wsR2tK+XDLANfvfMiWOFTeJlIj84UJm5/EAJYBE6IuK/qAMs7Rr2kDhKi80J4QSjnT/lLK5MrF05xQ3aJJG90bootRIA+rVWDpNfoFBmvPdg8QC76rVdJsvE07omeKdqFTtPfZOPU/FmHk1hUC/oyZkladInZGoZLqq7KNAp7BsXtNYrK2EPSePdR1eiay8lbPsj2qF2JUC5Vqry1gTGSW72bikPsPVddyIJIScS5bQZPiJc2OINxMocRI7tDAoxp8v2a37sEj9w+Z1OIe3hd+6otkw==; 5:kZTs4yC7YSzo/cpb/DYbcwBNGQtBcu2Sfsf5ahuNtUQdAM+sgmp1NGgn4o8FqlkVyf3cYhLNUXe3P0nlRLIkbAZtepjIZZ3D146PtYCxSG8kvV1o40xeT7eiqqnw6BRtotRY14icWPcQvdlOy+OAl4aL8uI3yeYFUIOGyERZo3U=; 7:0WkYuWQzU09KBHScxySou8FIyO7+4STHV1t7QL6RCaK0q6jdIDT/sr8nw5vc5kIh5eQWPYMqo7myV18N0Mnxy2i1gh4J0Ty/xUqrTv61jbN9SoR1tNAXv/6rMaTvKdAiRMUh5AGE+DlYZsv2GNqD1qvtdp8buu6G7dloZ+mT6IyMUjDWJr5WkU5NczHASDq3CNNlY9qpiaNqZo/m56uDuqb/uljH8na17ITNgXxs1LMLZxyfAw6qHbx3qF0TUQsz x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-correlation-id: cd9dbc38-6d28-4bdd-a619-08d6078c5691 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(7020095)(4652040)(8989137)(4534165)(4627221)(201703031133081)(201702281549075)(8990107)(5600074)(711020)(4618075)(2017052603328)(7153060)(7193020); SRVR:DM5PR2201MB1705; x-ms-traffictypediagnostic: DM5PR2201MB1705: x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(28532068793085)(181554191321653)(126837547833334)(21748063052155)(33711482430040); x-ms-exchange-senderadcheck: 1 x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(8211001083)(6040522)(2401047)(8121501046)(5005006)(93006095)(93001095)(3002001)(10201501046)(3231311)(944501410)(52105095)(6055026)(149027)(150027)(6041310)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123564045)(20161123562045)(20161123560045)(20161123558120)(201708071742011)(7699016); SRVR:DM5PR2201MB1705; BCL:0; PCL:0; RULEID:; SRVR:DM5PR2201MB1705; x-forefront-prvs: 0771670921 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(376002)(39860400002)(346002)(136003)(366004)(396003)(189003)(199004)(8936002)(66066001)(110136005)(316002)(54906003)(9326002)(93886005)(76176011)(3846002)(6116002)(790700001)(99286004)(26005)(97736004)(478600001)(33656002)(7696005)(74316002)(6506007)(102836004)(186003)(53546011)(19609705001)(14454004)(5660300001)(7736002)(6246003)(486006)(476003)(53936002)(55016002)(446003)(11346002)(256004)(229853002)(5250100002)(86362001)(5024004)(6436002)(54896002)(105586002)(6306002)(2906002)(4326008)(14444005)(25786009)(81156014)(106356001)(2900100001)(68736007)(9686003)(81166006)(8676002); DIR:OUT; SFP:1101; SCL:1; SRVR:DM5PR2201MB1705; H:DM5PR2201MB1433.namprd22.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: ra.rockwell.com does not designate permitted sender hosts) x-microsoft-antispam-message-info: HNm5mD4Oph5iBhOBhZgoCdjSpJHiVNrcp1Ix2k9bf2wYmcI/yDYlDP6O1Bpyc+tEY12NYtwvox+9j21zRq7VYLPB9wRNck1pOqaEtnldvcX8lsZGHNotzrWAuFZ+lRrzDJwyOUzJMjF1JEyQEm+j4ooXtcsG9W9O4fKynRI2dx/JkWRsfgNHuAFDE0GnQo5Magozpp/r+EsGIZMmepyQL+gh0S2Ox9jQZxoajbve8lIZZ3IgVJBEBq2dPpWEO1Sz3QqSzIe3ljitI33WLw6oK4fDNAIBVILlt6mC0kTazHexyKKVmkW8ABTVV+nRPzhE+ZI8cN42wV2SDOXntGcUy8TpsfYKTZQC5VnSRZ/NoXE= spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_DM5PR2201MB143394A86DA30B3A98D4FC3A99310DM5PR2201MB1433_" MIME-Version: 1.0 X-OriginatorOrg: ra.rockwell.com X-MS-Exchange-CrossTenant-Network-Message-Id: cd9dbc38-6d28-4bdd-a619-08d6078c5691 X-MS-Exchange-CrossTenant-originalarrivaltime: 21 Aug 2018 17:34:24.7794 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 855b093e-7340-45c7-9f0c-96150415893e X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM5PR2201MB1705 Archived-At: Subject: Re: [TLS] EXTERNAL: Re: integrity only ciphersuites X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Aug 2018 17:34:29 -0000 --_000_DM5PR2201MB143394A86DA30B3A98D4FC3A99310DM5PR2201MB1433_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGkgUmljaCwNCg0KSeKAmW0gbm90IHN1cmUgaWYgSeKAmW0gZm9sbG93aW5nIHRoZSBxdWVzdGlv biwgYnV0IHdoYXQgd2FzIG1lYW50IHdhcyB0aGF0IHRoZXNlIGNpcGhlcnMgYXJlIGdlbmVyYWxs eSBOT1QgdXNlZCBmb3IgYnJvd3NlciBhY2Nlc3MuICBNYWNoaW5lIHRvIG1hY2hpbmUgY29tbXVu aWNhdGlvbiB1c3VhbGx5IGRvZXMgbm90IGludm9sdmUgYSBicm93c2VyLiAgQXBvbG9naWVzIGlm IEnigJl2ZSBtaXN1bmRlcnN0b29kIHRoZSBxdWVzdGlvbi4NCg0KVGhhbmtzIGFuZCBCZXN0IFJl Z2FyZHMsDQoNCi0tSmFjaw0KDQpGcm9tOiBUTFMgW21haWx0bzp0bHMtYm91bmNlc0BpZXRmLm9y Z10gT24gQmVoYWxmIE9mIFNhbHosIFJpY2gNClNlbnQ6IFR1ZXNkYXksIEF1Z3VzdCAyMSwgMjAx OCAxOjEyIFBNDQpUbzogRnJpZXMsIFN0ZWZmZW4gPHN0ZWZmZW4uZnJpZXNAc2llbWVucy5jb20+ DQpDYzogbmNhbXdpbmc9NDBjaXNjby5jb21AZG1hcmMuaWV0Zi5vcmc7IHRsc0BpZXRmLm9yZw0K U3ViamVjdDogRVhURVJOQUw6IFJlOiBbVExTXSBpbnRlZ3JpdHkgb25seSBjaXBoZXJzdWl0ZXMN Cg0KDQpbVXNlIGNhdXRpb24gd2l0aCBsaW5rcyAmIGF0dGFjaG1lbnRzXQ0KDQoNCk5vdyBJIHRo aW5rIEkgYW0gYXMgY29uZnVzZWQgYXMgU3RlcGhlbiBhbmQgb3RoZXJzLg0KDQpPbmUganVzdGlm aWNhdGlvbiB3YXMg4oCcc21hbGwgZm9vdHByaW50LuKAnSAgQnV0IG5vdyB5b3XigJlyZSBzYXlp bmcgdGhhdCBmb3IgZGVidWdnaW5nIGVuY3J5cHRpb24gKHN0YW5kYXJkPykgY2lwaGVycyBhcmUg dXNlZCBmb3IgYnJvd3NlciBhY2Nlc3M/DQoNCg== --_000_DM5PR2201MB143394A86DA30B3A98D4FC3A99310DM5PR2201MB1433_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 U2ltU3VuOw0KCXBhbm9zZS0xOjIgMSA2IDAgMyAxIDEgMSAxIDE7fQ0KQGZvbnQtZmFjZQ0KCXtm b250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2IDMgMiA0 O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1IDUg MiAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJcQFNpbVN1biI7DQoJ cGFub3NlLTE6MiAxIDYgMCAzIDEgMSAxIDEgMTt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0K cC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0K CW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5 OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNv LXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVy bGluZTt9DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxl LXByaW9yaXR5Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5l O30NCnANCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCW1zby1tYXJnaW4tdG9wLWFsdDphdXRv Ow0KCW1hcmdpbi1yaWdodDowaW47DQoJbXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87DQoJbWFy Z2luLWxlZnQ6MGluOw0KCWZvbnQtc2l6ZToxMi4wcHQ7DQoJZm9udC1mYW1pbHk6IlRpbWVzIE5l dyBSb21hbiIsc2VyaWY7fQ0KcC5Nc29MaXN0UGFyYWdyYXBoLCBsaS5Nc29MaXN0UGFyYWdyYXBo LCBkaXYuTXNvTGlzdFBhcmFncmFwaA0KCXttc28tc3R5bGUtcHJpb3JpdHk6MzQ7DQoJbWFyZ2lu LXRvcDowaW47DQoJbWFyZ2luLXJpZ2h0OjBpbjsNCgltYXJnaW4tYm90dG9tOjBpbjsNCgltYXJn aW4tbGVmdDouNWluOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTEuMHB0 Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnAubXNvbm9ybWFsMCwgbGku bXNvbm9ybWFsMCwgZGl2Lm1zb25vcm1hbDANCgl7bXNvLXN0eWxlLW5hbWU6bXNvbm9ybWFsOw0K CW1zby1tYXJnaW4tdG9wLWFsdDphdXRvOw0KCW1hcmdpbi1yaWdodDowaW47DQoJbXNvLW1hcmdp bi1ib3R0b20tYWx0OmF1dG87DQoJbWFyZ2luLWxlZnQ6MGluOw0KCWZvbnQtc2l6ZToxMS4wcHQ7 DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0Kc3Bhbi5ncm91cHdpc2VyZXBs eWhlYWRlcg0KCXttc28tc3R5bGUtbmFtZTpncm91cHdpc2VyZXBseWhlYWRlcjt9DQpzcGFuLkVt YWlsU3R5bGUyMA0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbDsNCglmb250LWZhbWlseToiQ2Fs aWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjojMUY0OTdEOw0KCWZvbnQtd2VpZ2h0Om5vcm1hbDsN Cglmb250LXN0eWxlOm5vcm1hbDsNCgl0ZXh0LWRlY29yYXRpb246bm9uZSBub25lO30NCnNwYW4u RW1haWxTdHlsZTIxDQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsOw0KCWZvbnQtZmFtaWx5OiJD YWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0Kc3Bhbi5FbWFpbFN0eWxl MjINCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWw7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNh bnMtc2VyaWY7DQoJY29sb3I6IzFGNDk3RDsNCglmb250LXdlaWdodDpub3JtYWw7DQoJZm9udC1z dHlsZTpub3JtYWw7DQoJdGV4dC1kZWNvcmF0aW9uOm5vbmUgbm9uZTt9DQpzcGFuLkVtYWlsU3R5 bGUyMw0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIs c2Fucy1zZXJpZjsNCgljb2xvcjp3aW5kb3d0ZXh0O30NCnNwYW4uRW1haWxTdHlsZTI0DQoJe21z by1zdHlsZS10eXBlOnBlcnNvbmFsOw0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlm Ow0KCWNvbG9yOndpbmRvd3RleHQ7fQ0KcC5tc2dib3JkZXIsIGxpLm1zZ2JvcmRlciwgZGl2Lm1z Z2JvcmRlcg0KCXttc28tc3R5bGUtbmFtZTptc2dib3JkZXI7DQoJbXNvLW1hcmdpbi10b3AtYWx0 OmF1dG87DQoJbWFyZ2luLXJpZ2h0OjBpbjsNCgltc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzsN CgltYXJnaW4tbGVmdDowaW47DQoJYm9yZGVyOm5vbmU7DQoJcGFkZGluZzowaW47DQoJZm9udC1z aXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIixzZXJpZjt9DQpzcGFu LkVtYWlsU3R5bGUyNw0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1yZXBseTsNCglmb250LWZh bWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjojMUY0OTdEO30NCi5Nc29DaHBEZWZh dWx0DQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7fQ0K QHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAx LjBpbiAxLjBpbiAxLjBpbjt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24x O30NCi0tPjwvc3R5bGU+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWRlZmF1bHRz IHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2IiAvPg0KPC94bWw+PCFbZW5kaWZdLS0+PCEtLVtp ZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWxheW91dCB2OmV4dD0iZWRpdCI+DQo8bzppZG1h cCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4NCjwvbzpzaGFwZWxheW91dD48L3htbD48IVtlbmRp Zl0tLT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9IkVOLVVTIiBsaW5rPSJibHVlIiB2bGluaz0icHVy cGxlIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iY29sb3I6IzFGNDk3RCI+SGkgUmljaCw8bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzFGNDk3RCI+PG86cD4m bmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImNvbG9yOiMxRjQ5N0QiPknigJltIG5vdCBzdXJlIGlmIEnigJltIGZvbGxvd2luZyB0aGUgcXVl c3Rpb24sIGJ1dCB3aGF0IHdhcyBtZWFudCB3YXMgdGhhdCB0aGVzZSBjaXBoZXJzIGFyZSBnZW5l cmFsbHkgTk9UIHVzZWQgZm9yIGJyb3dzZXIgYWNjZXNzLiAmbmJzcDtNYWNoaW5lIHRvIG1hY2hp bmUgY29tbXVuaWNhdGlvbiB1c3VhbGx5IGRvZXMgbm90IGludm9sdmUgYSBicm93c2VyLiZuYnNw OyBBcG9sb2dpZXMNCiBpZiBJ4oCZdmUgbWlzdW5kZXJzdG9vZCB0aGUgcXVlc3Rpb24uPG86cD48 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9y OiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMUY0OTdEIj5UaGFua3MgYW5kIEJlc3QgUmVnYXJkcyw8 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMxRjQ5N0QiPi0tSmFjazxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMUY0OTdE Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVy Om5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjRTFFMUUxIDEuMHB0O3BhZGRpbmc6My4wcHQgMGluIDBp biAwaW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+RnJvbTo8L2I+IFRMUyBbbWFpbHRvOnRs cy1ib3VuY2VzQGlldGYub3JnXSA8Yj5PbiBCZWhhbGYgT2YNCjwvYj5TYWx6LCBSaWNoPGJyPg0K PGI+U2VudDo8L2I+IFR1ZXNkYXksIEF1Z3VzdCAyMSwgMjAxOCAxOjEyIFBNPGJyPg0KPGI+VG86 PC9iPiBGcmllcywgU3RlZmZlbiAmbHQ7c3RlZmZlbi5mcmllc0BzaWVtZW5zLmNvbSZndDs8YnI+ DQo8Yj5DYzo8L2I+IG5jYW13aW5nPTQwY2lzY28uY29tQGRtYXJjLmlldGYub3JnOyB0bHNAaWV0 Zi5vcmc8YnI+DQo8Yj5TdWJqZWN0OjwvYj4gRVhURVJOQUw6IFJlOiBbVExTXSBpbnRlZ3JpdHkg b25seSBjaXBoZXJzdWl0ZXM8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJt c28tZWxlbWVudDpwYXJhLWJvcmRlci1kaXY7Ym9yZGVyOnNvbGlkICNCQjIzMjIgMi4yNXB0O3Bh ZGRpbmc6Mi4wcHQgMi4wcHQgMi4wcHQgMi4wcHQ7YmFja2dyb3VuZDojRThFOEU4Ij4NCjxwIGNs YXNzPSJtc2dib3JkZXIiIHN0eWxlPSJsaW5lLWhlaWdodDoxMi4wcHQ7YmFja2dyb3VuZDojRThF OEU4Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxp YnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2siPltVc2UgY2F1dGlvbiB3aXRoIGxpbmtz ICZhbXA7IGF0dGFjaG1lbnRzXTwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+ DQo8cD4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5O b3cgSSB0aGluayBJIGFtIGFzIGNvbmZ1c2VkIGFzIFN0ZXBoZW4gYW5kIG90aGVycy48bzpwPjwv bzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+T25lIGp1c3RpZmljYXRpb24gd2FzIOKAnHNtYWxsIGZvb3Rwcmlu dC7igJ0mbmJzcDsgQnV0IG5vdyB5b3XigJlyZSBzYXlpbmcgdGhhdCBmb3IgZGVidWdnaW5nIGVu Y3J5cHRpb24gKHN0YW5kYXJkPykgY2lwaGVycyBhcmUgdXNlZCBmb3IgYnJvd3NlciBhY2Nlc3M/ PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwv cD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_DM5PR2201MB143394A86DA30B3A98D4FC3A99310DM5PR2201MB1433_-- From nobody Tue Aug 21 10:39:55 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2464412785F for ; Tue, 21 Aug 2018 10:39:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.909 X-Spam-Level: X-Spam-Status: No, score=-1.909 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_DKIMWL_WL_MED=-0.01, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2DVAhGkWnocI for ; Tue, 21 Aug 2018 10:39:49 -0700 (PDT) Received: from mail-it0-x232.google.com (mail-it0-x232.google.com [IPv6:2607:f8b0:4001:c0b::232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1820E130E4A for ; Tue, 21 Aug 2018 10:39:49 -0700 (PDT) Received: by mail-it0-x232.google.com with SMTP id j81-v6so5294286ite.0 for ; Tue, 21 Aug 2018 10:39:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=yDczz8UC0g+YGx8Qv36hnpJoRiEyJfnE1ErpFFs5aQ0=; b=NcuORbBpLoseaxNmhaStSFGbvWHkbYxaUgraguORAwsafTrkDtVuBlJGI5TqXdZDqz sa6tI3jqdbr49nhfCQ9BrFigUh33VLqd/7GAvq4EQ9bMWh3RWsQ/+gEZ7nEzHSTCaOZH bJrBGUmZXcdYjY/x1Bl1/iMgZ9htUg0XqFN703auvQ9G7J+9KIzbiUHU7GlZ4HO/bH3/ qqn6oQVFnRMpcI/jsmnjhHNsjVTdqNbTb7iaJJaxVYRFaHW73bTXh+LJjQLv6hCrNTkY 2VDff0AFE74zItsz71UNsU/TU7jT+FrSrWx/f/C6K3MgUrCLbGeXmx8PijN+g3df/jhM kshA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=yDczz8UC0g+YGx8Qv36hnpJoRiEyJfnE1ErpFFs5aQ0=; b=R50M6cObR3eItCfThQQaDRRz8e/X9WBIQjcIXC84mr0WT/oXUzYZ4UbuxpGH3MRhn+ RxCBqe4r4dgsBeyySbuRHsEdibjb6vfJw6KvP1WmEoHGkpBcS8Khzi4SE7DqG1uJHfCx VHKQ67gX9qnAxQbOrwyl12lkvg1USqJWppldbZ8L++efhdf3fG/GbodJBovwb5nwk+K5 ucxdGiGFEeQ4JPi/jArH91Z6ieJVpQK1lOVwbBzji8IJjcRz23lZGdHZSj1NHl59IvUP ghO2N/Gyq9NoVIlzTHaDE5su0D8TMPBfhs9mcWpiUHfZ+GPy4kajgGNSBxR2ZvFP+3Ie ovaw== X-Gm-Message-State: AOUpUlE+C57Ow2Lc5ICF6CSrOXvm8fBrh1ufaNsebUv1D3oPUD72Br9u 1lytj5b4Lr86mALmd/hl/gkz0Ym1CqKjUe+MogD1J0NY X-Google-Smtp-Source: ANB0VdYqsoNRSvSu6G0bIp7mfh+En/XI9th7Jf5kjzdEI5GgHB5eXbh8oTALI4+cT6GeLulhYYgM3D6Y8omZ46P0FFY= X-Received: by 2002:a02:9d45:: with SMTP id m5-v6mr4735638jal.72.1534873188333; Tue, 21 Aug 2018 10:39:48 -0700 (PDT) MIME-Version: 1.0 Received: by 2002:a4f:a009:0:0:0:0:0 with HTTP; Tue, 21 Aug 2018 10:39:07 -0700 (PDT) In-Reply-To: References: <64d23891-2f32-9bb8-1ec8-f4fad13cdfb9@cs.tcd.ie> <982363FD-A839-4175-BA53-7CA242F9ADA6@ll.mit.edu> <2D7F2926-6376-4B2C-BDE9-7A6F1C0FA748@gmail.com> <5B7C1571020000AC0015C330@gwia2.rz.hs-offenburg.de> <8A2746A8-6B41-45C3-9D77-6AF3536C6E2D@siemens.com> From: Ted Lemon Date: Tue, 21 Aug 2018 13:39:07 -0400 Message-ID: To: Jack Visoky Cc: "Salz, Rich" , "Fries, Steffen" , "ncamwing=40cisco.com@dmarc.ietf.org" , "tls@ietf.org" Content-Type: multipart/alternative; boundary="0000000000002a91fc0573f58362" Archived-At: Subject: Re: [TLS] EXTERNAL: Re: integrity only ciphersuites X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Aug 2018 17:39:53 -0000 --0000000000002a91fc0573f58362 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable If the device implements the cipher so as to talk to the browser, it's clearly capable of implementing the cipher... On Tue, Aug 21, 2018 at 1:34 PM, Jack Visoky wrote: > Hi Rich, > > > > I=E2=80=99m not sure if I=E2=80=99m following the question, but what was = meant was that > these ciphers are generally NOT used for browser access. Machine to > machine communication usually does not involve a browser. Apologies if > I=E2=80=99ve misunderstood the question. > > > > Thanks and Best Regards, > > > > --Jack > > > > *From:* TLS [mailto:tls-bounces@ietf.org] *On Behalf Of *Salz, Rich > *Sent:* Tuesday, August 21, 2018 1:12 PM > *To:* Fries, Steffen > *Cc:* ncamwing=3D40cisco.com@dmarc.ietf.org; tls@ietf.org > *Subject:* EXTERNAL: Re: [TLS] integrity only ciphersuites > > > > [Use caution with links & attachments] > > > > Now I think I am as confused as Stephen and others. > > > > One justification was =E2=80=9Csmall footprint.=E2=80=9D But now you=E2= =80=99re saying that for > debugging encryption (standard?) ciphers are used for browser access? > > > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > > --0000000000002a91fc0573f58362 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
If the device implements the cipher so as to talk to the b= rowser, it's clearly capable of implementing the cipher...

On Tue, Aug 21, 2018 at = 1:34 PM, Jack Visoky <jmvisoky@ra.rockwell.com> wrote= :

Hi Rich,=

=C2=A0

I=E2=80=99m not sure i= f I=E2=80=99m following the question, but what was meant was that these cip= hers are generally NOT used for browser access.=C2=A0 Machine to machine co= mmunication usually does not involve a browser.=C2=A0 Apologies if I=E2=80=99ve misunderstood the question.

=C2=A0

Thanks and Best Regard= s,

=C2=A0

--Jack

=C2=A0

From: TLS [mailto:tls-bounces@ietf.org] On Behalf Of Salz, Rich
Sent: Tuesday, August 21, 2018 1:12 PM
To: Fries, Steffen <steffen.fries@siemens.com>
Cc: ncamwing=3D40cisco.com@dmarc.ietf.org; tls@ietf.org
Subject: EXTERNAL: Re: [TLS] integrity only ciphersuites

=C2=A0

[Use caution with links & attachments]

=C2=A0

Now I think I am as confused as Stephen and others.<= u>

=C2=A0

One justification was =E2=80=9Csmall footprint.=E2= =80=9D=C2=A0 But now you=E2=80=99re saying that for debugging encryption (s= tandard?) ciphers are used for browser access?

=C2=A0


_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls


--0000000000002a91fc0573f58362-- From nobody Tue Aug 21 10:40:28 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 305B0130F8D for ; Tue, 21 Aug 2018 10:40:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H2=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Z1om9WfertcW for ; Tue, 21 Aug 2018 10:40:10 -0700 (PDT) Received: from elasmtp-curtail.atl.sa.earthlink.net (elasmtp-curtail.atl.sa.earthlink.net [209.86.89.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 482EB130EB5 for ; Tue, 21 Aug 2018 10:40:10 -0700 (PDT) Received: from [174.192.23.50] (helo=Williams-MacBook-Pro.local) by elasmtp-curtail.atl.sa.earthlink.net with esmtpa (Exim 4) (envelope-from ) id 1fsAdT-000Bhb-LC; Tue, 21 Aug 2018 13:40:07 -0400 Date: Tue, 21 Aug 2018 10:40:07 -0700 From: Bill Frantz To: Stephen Farrell cc: tls@ietf.org X-Priority: 3 In-Reply-To: <098c762f-d672-08b3-222e-8aa7a093909d@cs.tcd.ie> Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: quoted-printable X-Mailer: Mailsmith 2.4.3 (480) X-ELNK-Trace: 3a5e54fa03f1b3e21aa676d7e74259b7b3291a7d08dfec794c4c01223814c36974fc94c313fd859a350badd9bab72f9c350badd9bab72f9c350badd9bab72f9c X-Originating-IP: 174.192.23.50 Archived-At: Subject: Re: [TLS] integrity only ciphersuites X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Aug 2018 17:40:26 -0000 On 8/21/18 at 7:24 AM, stephen.farrell@cs.tcd.ie (Stephen=20 =46arrell) wrote: >I agree. Quoting the meat of the abstract of RFC8446: > >TLS allows client/server applications to communicate >over the Internet in a way that is designed to prevent eavesdropping, >tampering, and message forgery. I spent some time thinking about integrity protected,=20 authenticated, replay resistant protocols during the late 1990s=20 as the crypto wars were running hot and heavy. I decided the=20 problem wasn't as simple as the fully encrypted protocols of=20 which TLS is an example. A number of people have concerns about building connections with=20 no secrecy, even when secrecy is desired by the endpoints,=20 either because of specification errors or because of downgrade=20 attacks. I share those concerns, and would be willing to=20 consider a protocol that uses entirely different packet=20 identifiers from those used by TLS as a way to reduce this problem. I do think that the TLS working group is well qualified to=20 analyse the design of such a protocol. Cheers - Bill ----------------------------------------------------------------------- Bill Frantz | Since the IBM Selectric, keyboards have gotten 408-356-8506 | steadily worse. Now we have touchscreen keyboards. www.pwpconsult.com | Can we make something even worse? From nobody Tue Aug 21 10:45:50 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AFEA5128C65 for ; Tue, 21 Aug 2018 10:45:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.71 X-Spam-Level: X-Spam-Status: No, score=-2.71 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=akamai.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id plaKpVsZHngy for ; Tue, 21 Aug 2018 10:45:46 -0700 (PDT) Received: from mx0a-00190b01.pphosted.com (mx0a-00190b01.pphosted.com [IPv6:2620:100:9001:583::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 604EC130DF0 for ; Tue, 21 Aug 2018 10:45:46 -0700 (PDT) Received: from pps.filterd (m0050095.ppops.net [127.0.0.1]) by m0050095.ppops.net-00190b01. (8.16.0.22/8.16.0.22) with SMTP id w7LHflDj029809; Tue, 21 Aug 2018 18:45:46 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=akamai.com; h=from : to : cc : subject : date : message-id : references : in-reply-to : content-type : mime-version; s=jan2016.eng; bh=hVUxe81vTzA/0QLDUQ+LRsZKff9DlsBQecNjxbR6VwE=; b=HxMMTmkip6HrVSpiuVrMPmm+JMqyM1Q0AoOvyL+l1o92wmuTC0L4RSYQ0Y226h8Vv3sW xpeZ5vba9+yE2ylZYy0Zi/DnnPmN1c/sYvnNVSPcygoiWqxOpK+Dx0OuYgRNsCNhk7uT SBDBJjO0uXZ7BKs06AeGLHiu7IXRpvGV2pvpyLTHMPRm5OSzlyC/JAoJJj8bsQ6+63Ey sd3tcVm0fo1Ts9VojuiQ6OXKU7mF1HaMZmX0aStGF5uHJNn2r5NVplQ1XBiBL87BMUh+ VQAIsuDmks/IsdAGEaJwfKVApMEv3GKESsLN2Md2I5BM6pAiUpvGjTJXS/82eRWqYzKs zg== Received: from prod-mail-ppoint1 (prod-mail-ppoint1.akamai.com [184.51.33.18]) by m0050095.ppops.net-00190b01. with ESMTP id 2kxb03hg9h-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 21 Aug 2018 18:45:45 +0100 Received: from pps.filterd (prod-mail-ppoint1.akamai.com [127.0.0.1]) by prod-mail-ppoint1.akamai.com (8.16.0.21/8.16.0.21) with SMTP id w7LHZwH6029153; Tue, 21 Aug 2018 13:45:44 -0400 Received: from email.msg.corp.akamai.com ([172.27.123.30]) by prod-mail-ppoint1.akamai.com with ESMTP id 2kxesuyk11-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Tue, 21 Aug 2018 13:45:43 -0400 Received: from USMA1EX-DAG1MB1.msg.corp.akamai.com (172.27.123.101) by usma1ex-dag1mb6.msg.corp.akamai.com (172.27.123.65) with Microsoft SMTP Server (TLS) id 15.0.1365.1; Tue, 21 Aug 2018 13:45:41 -0400 Received: from USMA1EX-DAG1MB1.msg.corp.akamai.com ([172.27.123.101]) by usma1ex-dag1mb1.msg.corp.akamai.com ([172.27.123.101]) with mapi id 15.00.1365.000; Tue, 21 Aug 2018 13:45:41 -0400 From: "Salz, Rich" To: Jack Visoky , "Salz, Rich" , "Fries, Steffen" CC: "ncamwing=40cisco.com@dmarc.ietf.org" , "tls@ietf.org" Thread-Topic: [TLS] EXTERNAL: Re: integrity only ciphersuites Thread-Index: AQHUOXVDjDSN8wQqNE6fqAUnGgZZsqTKeqOA Date: Tue, 21 Aug 2018 17:45:41 +0000 Message-ID: References: <64d23891-2f32-9bb8-1ec8-f4fad13cdfb9@cs.tcd.ie> <982363FD-A839-4175-BA53-7CA242F9ADA6@ll.mit.edu> <2D7F2926-6376-4B2C-BDE9-7A6F1C0FA748@gmail.com> <5B7C1571020000AC0015C330@gwia2.rz.hs-offenburg.de> <8A2746A8-6B41-45C3-9D77-6AF3536C6E2D@siemens.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.10.0.180812 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [172.19.35.74] Content-Type: multipart/alternative; boundary="_000_E8FA8D6F871F4BC8A6A913291251442Aakamaicom_" MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2018-08-21_08:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 mlxscore=0 mlxlogscore=873 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1807170000 definitions=main-1808210181 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2018-08-21_08:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1011 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=867 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1807170000 definitions=main-1808210183 Archived-At: Subject: Re: [TLS] EXTERNAL: Re: integrity only ciphersuites X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Aug 2018 17:45:49 -0000 --_000_E8FA8D6F871F4BC8A6A913291251442Aakamaicom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 ICAqICAgSeKAmW0gbm90IHN1cmUgaWYgSeKAmW0gZm9sbG93aW5nIHRoZSBxdWVzdGlvbiwgYnV0 IHdoYXQgd2FzIG1lYW50IHdhcyB0aGF0IHRoZXNlIGNpcGhlcnMgYXJlIGdlbmVyYWxseSBOT1Qg dXNlZCBmb3IgYnJvd3NlciBhY2Nlc3MuICBNYWNoaW5lIHRvIG1hY2hpbmUgY29tbXVuaWNhdGlv biB1c3VhbGx5IGRvZXMgbm90IGludm9sdmUgYSBicm93c2VyLiAgQXBvbG9naWVzIGlmIEnigJl2 ZSBtaXN1bmRlcnN0b29kIHRoZSBxdWVzdGlvbi4NCg0KWW91IHVuZGVyc3Rvb2QgbWUuICBTbyB0 aGUgZGV2aWNlcyAob3IgcmF0aGVyIGF0IGxlYXN0IHNvbWUgb2YgdGhlbSBzaW5jZSB0aGV5IGFy ZSBzcGxlbmRpZmVyb3VzIGluIHRoZWlyIHZhcmlhbmNlcykgZG8gc3BlYWsgY29tbW9uIFRMUy4g IEJ1dCBub3QgZm9yIE0yTS4gIFRoYXQgcGFydCBjb25mdXNlcyBtZSwgc2luY2Ug4oCcdG9vIHNt YWxsIHRvIGVuY3J5cHTigJ0gd2FzIGEgcmVhc29uIGdpdmVuLg0K --_000_E8FA8D6F871F4BC8A6A913291251442Aakamaicom_ Content-Type: text/html; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseTpXaW5nZGluZ3M7DQoJcGFub3NlLTE6NSAwIDAgMCAwIDAgMCAwIDAg MDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJDYW1icmlhIE1hdGgiOw0KCXBhbm9zZS0x OjIgNCA1IDMgNSA0IDYgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDYWxpYnJp Ow0KCXBhbm9zZS0xOjIgMTUgNSAyIDIgMiA0IDMgMiA0O30NCi8qIFN0eWxlIERlZmluaXRpb25z ICovDQpwLk1zb05vcm1hbCwgbGkuTXNvTm9ybWFsLCBkaXYuTXNvTm9ybWFsDQoJe21hcmdpbjow aW47DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMS4wcHQ7DQoJZm9udC1m YW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0KYTpsaW5rLCBzcGFuLk1zb0h5cGVybGluaw0K CXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6Ymx1ZTsNCgl0ZXh0LWRlY29yYXRpb246 dW5kZXJsaW5lO30NCmE6dmlzaXRlZCwgc3Bhbi5Nc29IeXBlcmxpbmtGb2xsb3dlZA0KCXttc28t c3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6cHVycGxlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRl cmxpbmU7fQ0KcC5Nc29MaXN0UGFyYWdyYXBoLCBsaS5Nc29MaXN0UGFyYWdyYXBoLCBkaXYuTXNv TGlzdFBhcmFncmFwaA0KCXttc28tc3R5bGUtcHJpb3JpdHk6MzQ7DQoJbWFyZ2luLXRvcDowaW47 DQoJbWFyZ2luLXJpZ2h0OjBpbjsNCgltYXJnaW4tYm90dG9tOjBpbjsNCgltYXJnaW4tbGVmdDou NWluOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQt ZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnAubXNvbm9ybWFsMCwgbGkubXNvbm9ybWFs MCwgZGl2Lm1zb25vcm1hbDANCgl7bXNvLXN0eWxlLW5hbWU6bXNvbm9ybWFsOw0KCW1zby1zdHls ZS1wcmlvcml0eTo5OTsNCgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6 MGluOw0KCW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglm b250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnAu bXNnYm9yZGVyLCBsaS5tc2dib3JkZXIsIGRpdi5tc2dib3JkZXINCgl7bXNvLXN0eWxlLW5hbWU6 bXNnYm9yZGVyOw0KCW1zby1zdHlsZS1wcmlvcml0eTo5OTsNCgltc28tbWFyZ2luLXRvcC1hbHQ6 YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0K CW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1l cyBOZXcgUm9tYW4iLHNlcmlmO30NCnNwYW4uZ3JvdXB3aXNlcmVwbHloZWFkZXINCgl7bXNvLXN0 eWxlLW5hbWU6Z3JvdXB3aXNlcmVwbHloZWFkZXI7fQ0Kc3Bhbi5FbWFpbFN0eWxlMjINCgl7bXNv LXN0eWxlLXR5cGU6cGVyc29uYWw7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7 DQoJY29sb3I6IzFGNDk3RDsNCglmb250LXdlaWdodDpub3JtYWw7DQoJZm9udC1zdHlsZTpub3Jt YWw7DQoJdGV4dC1kZWNvcmF0aW9uOm5vbmUgbm9uZTt9DQpzcGFuLkVtYWlsU3R5bGUyMw0KCXtt c28tc3R5bGUtdHlwZTpwZXJzb25hbDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJp ZjsNCgljb2xvcjp3aW5kb3d0ZXh0O30NCnNwYW4uRW1haWxTdHlsZTI0DQoJe21zby1zdHlsZS10 eXBlOnBlcnNvbmFsOw0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9y OiMxRjQ5N0Q7DQoJZm9udC13ZWlnaHQ6bm9ybWFsOw0KCWZvbnQtc3R5bGU6bm9ybWFsOw0KCXRl eHQtZGVjb3JhdGlvbjpub25lIG5vbmU7fQ0Kc3Bhbi5FbWFpbFN0eWxlMjUNCgl7bXNvLXN0eWxl LXR5cGU6cGVyc29uYWw7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29s b3I6d2luZG93dGV4dDt9DQpzcGFuLkVtYWlsU3R5bGUyNg0KCXttc28tc3R5bGUtdHlwZTpwZXJz b25hbDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjp3aW5kb3d0 ZXh0O30NCnNwYW4uRW1haWxTdHlsZTI3DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsOw0KCWZv bnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOiMxRjQ5N0Q7fQ0Kc3Bhbi5F bWFpbFN0eWxlMjgNCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwtcmVwbHk7DQoJZm9udC1mYW1p bHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6d2luZG93dGV4dDt9DQouTXNvQ2hwRGVm YXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LXNpemU6MTAuMHB0O30N CkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjguNWluIDExLjBpbjsNCgltYXJnaW46MS4waW4g MS4waW4gMS4waW4gMS4waW47fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9u MTt9DQovKiBMaXN0IERlZmluaXRpb25zICovDQpAbGlzdCBsMA0KCXttc28tbGlzdC1pZDoxNzgw OTA0OTczOw0KCW1zby1saXN0LXR5cGU6aHlicmlkOw0KCW1zby1saXN0LXRlbXBsYXRlLWlkczot MTA3NjQ4MTk1NiAxMjYyMjcwNTIwIDY3Njk4NjkxIDY3Njk4NjkzIDY3Njk4Njg5IDY3Njk4Njkx IDY3Njk4NjkzIDY3Njk4Njg5IDY3Njk4NjkxIDY3Njk4NjkzO30NCkBsaXN0IGwwOmxldmVsMQ0K CXttc28tbGV2ZWwtc3RhcnQtYXQ6MDsNCgltc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7 DQoJbXNvLWxldmVsLXRleHQ674OYOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1s ZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1m YW1pbHk6V2luZ2RpbmdzOw0KCW1zby1mYXJlYXN0LWZvbnQtZmFtaWx5OkNhbGlicmk7DQoJbXNv LWJpZGktZm9udC1mYW1pbHk6Q2FsaWJyaTt9DQpAbGlzdCBsMDpsZXZlbDINCgl7bXNvLWxldmVs LW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Om87DQoJbXNvLWxldmVsLXRh Yi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5k ZW50Oi0uMjVpbjsNCglmb250LWZhbWlseToiQ291cmllciBOZXciO30NCkBsaXN0IGwwOmxldmVs Mw0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674Kn Ow0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246 bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBs aXN0IGwwOmxldmVsNA0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxl dmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1i ZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6U3lt Ym9sO30NCkBsaXN0IGwwOmxldmVsNQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7 DQoJbXNvLWxldmVsLXRleHQ6bzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2 ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFt aWx5OiJDb3VyaWVyIE5ldyI7fQ0KQGxpc3QgbDA6bGV2ZWw2DQoJe21zby1sZXZlbC1udW1iZXIt Zm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9w Om5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0u MjVpbjsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDA6bGV2ZWw3DQoJe21zby1s ZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxl dmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRl eHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDA6bGV2ZWw4 DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDpvOw0K CW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVm dDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3Ijt9DQpA bGlzdCBsMDpsZXZlbDkNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1s ZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVt YmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5Oldp bmdkaW5nczt9DQpvbA0KCXttYXJnaW4tYm90dG9tOjBpbjt9DQp1bA0KCXttYXJnaW4tYm90dG9t OjBpbjt9DQotLT48L3N0eWxlPg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0iRU4tVVMiIGxpbms9ImJs dWUiIHZsaW5rPSJwdXJwbGUiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjx1bCBzdHls ZT0ibWFyZ2luLXRvcDowaW4iIHR5cGU9ImRpc2MiPg0KPGxpIGNsYXNzPSJNc29MaXN0UGFyYWdy YXBoIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MGluO21zby1saXN0OmwwIGxldmVsMSBsZm8xIj48c3Bh biBzdHlsZT0iY29sb3I6IzFGNDk3RCI+SeKAmW0gbm90IHN1cmUgaWYgSeKAmW0gZm9sbG93aW5n IHRoZSBxdWVzdGlvbiwgYnV0IHdoYXQgd2FzIG1lYW50IHdhcyB0aGF0IHRoZXNlIGNpcGhlcnMg YXJlIGdlbmVyYWxseSBOT1QgdXNlZCBmb3IgYnJvd3NlciBhY2Nlc3MuICZuYnNwO01hY2hpbmUg dG8gbWFjaGluZSBjb21tdW5pY2F0aW9uDQogdXN1YWxseSBkb2VzIG5vdCBpbnZvbHZlIGEgYnJv d3Nlci4mbmJzcDsgQXBvbG9naWVzIGlmIEnigJl2ZSBtaXN1bmRlcnN0b29kIHRoZSBxdWVzdGlv bi48L3NwYW4+PG86cD48L286cD48L2xpPjwvdWw+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iY29sb3I6IzFGNDk3RCI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+WW91IHVuZGVyc3Rvb2QgbWUuJm5ic3A7IFNvIHRoZSBkZXZpY2Vz IChvciByYXRoZXIgYXQgbGVhc3Qgc29tZSBvZiB0aGVtIHNpbmNlIHRoZXkgYXJlIHNwbGVuZGlm ZXJvdXMgaW4gdGhlaXIgdmFyaWFuY2VzKSBkbyBzcGVhayBjb21tb24gVExTLiZuYnNwOyBCdXQg bm90IGZvciBNMk0uJm5ic3A7IFRoYXQgcGFydCBjb25mdXNlcyBtZSwgc2luY2Ug4oCcdG9vIHNt YWxsIHRvIGVuY3J5cHTigJ0gd2FzIGEgcmVhc29uIGdpdmVuLjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_E8FA8D6F871F4BC8A6A913291251442Aakamaicom_-- From nobody Tue Aug 21 10:53:37 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F005F130F50 for ; Tue, 21 Aug 2018 10:53:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bMmst8RmPGGZ for ; Tue, 21 Aug 2018 10:53:19 -0700 (PDT) Received: from NAM05-BY2-obe.outbound.protection.outlook.com (mail-eopbgr710080.outbound.protection.outlook.com [40.107.71.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6E615130F52 for ; Tue, 21 Aug 2018 10:53:19 -0700 (PDT) Received: from DM5PR2201MB1433.namprd22.prod.outlook.com (10.174.186.154) by DM5PR2201MB1483.namprd22.prod.outlook.com (10.174.187.10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1059.24; Tue, 21 Aug 2018 17:53:18 +0000 Received: from DM5PR2201MB1433.namprd22.prod.outlook.com ([fe80::49f1:7875:b984:9a65]) by DM5PR2201MB1433.namprd22.prod.outlook.com ([fe80::49f1:7875:b984:9a65%2]) with mapi id 15.20.1059.023; Tue, 21 Aug 2018 17:53:18 +0000 From: Jack Visoky To: Ted Lemon CC: "Salz, Rich" , "Fries, Steffen" , "ncamwing=40cisco.com@dmarc.ietf.org" , "tls@ietf.org" Thread-Topic: [TLS] EXTERNAL: Re: integrity only ciphersuites Thread-Index: AQHUOXX4D/UPTTu0A0yVJYh9fFiMkqTKfBBA Date: Tue, 21 Aug 2018 17:53:17 +0000 Message-ID: References: <64d23891-2f32-9bb8-1ec8-f4fad13cdfb9@cs.tcd.ie> <982363FD-A839-4175-BA53-7CA242F9ADA6@ll.mit.edu> <2D7F2926-6376-4B2C-BDE9-7A6F1C0FA748@gmail.com> <5B7C1571020000AC0015C330@gwia2.rz.hs-offenburg.de> <8A2746A8-6B41-45C3-9D77-6AF3536C6E2D@siemens.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=jmvisoky@ra.rockwell.com; x-originating-ip: [205.175.250.246] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; DM5PR2201MB1483; 6:j7n65KwBGjBD32WrX7nORq++WrKyU9a/TNfGt0vYEQZKsqv+AueqkM8ZqTQb5KD+rWLwQJTi6sUcfitRfih25jFFO/K5CxPEbn/sHsl/QSli950moZ1FJ22UF4WEMZ7X8UhjL2m8sIYC8+pHgyKwcJUY2mD5m4GVHO0FzzuR6jm0bjKkRt8ka/IWDaBHOdNlNGF984n4iPU8h7HXZLT2/oz8SdCgyAn1ZaUyBKI7cz+CptfRWRKCJVTCidhMAr4igOGWGUaDRfYcaUz30ePRfgCoGqwqOHg0J9wVNo7/5Rp4x16ezmlykZaLsUTi5zTsqkGkjTpC0rYG6PeLSgMOS/5yPRsibrp5OZLhq0r9XEZRfo81CmSKcXjMBJPXSv24XsvphxPui5ONzq4lX93iK1wZKBLqsij6j8bUqPk1NqqTc5w0zv6nLPA5VUDof7w23KRwvyqCDiXdho99dle6rw==; 5:NRymkT8Oq9We+Iqt3V/JETutigIDBNiiYl3I2BlmdhMBdSQ71ugZR7oIZNs9pm16ofm+X1QTD0dZVP1BgojsXLK53FZZRaulhiyo6gIiPZ2kjkNKHkhl9xLezyZfmO129K78Nx/dhWEfVNhPYV4yJ9A1Ciwwv1zlmljD3M5S5Fo=; 7:srUTylIg6CiOQbjkgh7Fok5afwBe/wpW3wQzt18dyJnpjUJwaidZraiOvzLdCSQMSzUWbZ31npfGVzlfSiW2pjJYJPxwGcuV1RKYOAvLZVkAVvTNGr2p2rEjGl8OENFXeqF3lZSyOSrI7jHgmWlg8P7vbgWfSZxpI5pgfw2x90nsRlQeKwbvhqACzsdxXBaYBPFya+uHUvQtGX0nnM9dLwiV8ClRTuvjm22DJ2lR7jdXl4ppZy4/sOCu7F69664P x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-correlation-id: 017c74ce-706e-491b-4359-08d6078efa00 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(7020095)(4652040)(8989137)(4534165)(4627221)(201703031133081)(201702281549075)(8990107)(5600074)(711020)(4618075)(2017052603328)(7153060)(7193020); SRVR:DM5PR2201MB1483; x-ms-traffictypediagnostic: DM5PR2201MB1483: x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(28532068793085)(181554191321653)(269231077054813)(126837547833334)(21748063052155)(33711482430040); x-ms-exchange-senderadcheck: 1 x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(8211001083)(6040522)(2401047)(8121501046)(5005006)(10201501046)(3231311)(944501410)(52105095)(3002001)(93006095)(93001095)(6055026)(149027)(150027)(6041310)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123564045)(20161123562045)(20161123558120)(20161123560045)(201708071742011)(7699016); SRVR:DM5PR2201MB1483; BCL:0; PCL:0; RULEID:; SRVR:DM5PR2201MB1483; x-forefront-prvs: 0771670921 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(376002)(39860400002)(346002)(396003)(136003)(366004)(199004)(189003)(6246003)(8676002)(4326008)(97736004)(86362001)(186003)(606006)(54906003)(3846002)(316002)(6116002)(25786009)(2900100001)(8936002)(99286004)(2906002)(790700001)(81166006)(76176011)(9326002)(93886005)(7696005)(446003)(33656002)(6916009)(105586002)(102836004)(6436002)(106356001)(81156014)(53546011)(68736007)(476003)(11346002)(229853002)(5250100002)(53936002)(486006)(74316002)(14454004)(7736002)(9686003)(54896002)(6306002)(236005)(966005)(6506007)(55016002)(256004)(19609705001)(14444005)(26005)(66066001)(5024004)(478600001)(5660300001); DIR:OUT; SFP:1101; SCL:1; SRVR:DM5PR2201MB1483; H:DM5PR2201MB1433.namprd22.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: ra.rockwell.com does not designate permitted sender hosts) x-microsoft-antispam-message-info: 5+/AnTkxreLtqkQOd9EbL6G+UQ4gRAT4Pmg/A3trQUH2OLt0dohozXewGgmV149t8F+N4NnSF7SNsNJZ2ZzdOBCtQTY0b4UsqQrYsXS97GHy1hewe+ag8ORzM2eHvgkzp1hPNQvHLtg/0QNIviYsWRM5pK7WCvq/b+lgJbvj4P/igh/x+xaYDLtTt/8zY752gisZasPiwVqUxrbLuvY5N5U0hwfELrEH9Ffv0w74JsCrofoLLiuKrcGB6MJJ98otX5Pc+s7IQvifvKRiA6KitLpHL1txBWT9PIomCqpgn0Q4yT+VMR7UBfF1WrkDsPpFWF6c1TMUDWnIDcAwzrl/KumysfCXYVaz4C+JvF0TwuM= spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_DM5PR2201MB14337FB5126A11B21CA6532699310DM5PR2201MB1433_" MIME-Version: 1.0 X-OriginatorOrg: ra.rockwell.com X-MS-Exchange-CrossTenant-Network-Message-Id: 017c74ce-706e-491b-4359-08d6078efa00 X-MS-Exchange-CrossTenant-originalarrivaltime: 21 Aug 2018 17:53:17.9234 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 855b093e-7340-45c7-9f0c-96150415893e X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM5PR2201MB1483 Archived-At: Subject: Re: [TLS] EXTERNAL: Re: integrity only ciphersuites X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Aug 2018 17:53:35 -0000 --_000_DM5PR2201MB14337FB5126A11B21CA6532699310DM5PR2201MB1433_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGkgVGVkLA0KDQpBIGZldyBwb2ludHM6DQoNCg0KMS4gICAgICAgRG9u4oCZdCBhc3N1bWUgdGhl cmUgaXMgYW55IGJyb3dzZXIgaW52b2x2ZWQuICBUaGVyZSBpcyBvZnRlbiBubyBicm93c2VyLg0K DQoyLiAgICAgICBFdmVuIGlmIHRoZXJlIGlzIGEgYnJvd3NlciAoYW5kIHNlZSBwb2ludCAxIGJl Zm9yZSBhc3N1bWluZykgYW55IEhUVFAgY29tbXVuaWNhdGlvbiB3b3VsZCBiZSBhdCBhIG11Y2gg bXVjaCBzbG93ZXIgcmF0ZSB0aGFuIG1hY2hpbmUgdG8gbWFjaGluZSBJL08NCg0KSG9wZSB0aGF0 IGNsZWFycyBpdCB1cC4NCg0KVGhhbmtzIGFuZCBCZXN0IFJlZ2FyZHMsDQoNCi0tSmFjaw0KDQpG cm9tOiBUZWQgTGVtb24gW21haWx0bzptZWxsb25AZnVndWUuY29tXQ0KU2VudDogVHVlc2RheSwg QXVndXN0IDIxLCAyMDE4IDE6MzkgUE0NClRvOiBKYWNrIFZpc29reSA8am12aXNva3lAcmEucm9j a3dlbGwuY29tPg0KQ2M6IFNhbHosIFJpY2ggPHJzYWx6PTQwYWthbWFpLmNvbUBkbWFyYy5pZXRm Lm9yZz47IEZyaWVzLCBTdGVmZmVuIDxzdGVmZmVuLmZyaWVzQHNpZW1lbnMuY29tPjsgbmNhbXdp bmc9NDBjaXNjby5jb21AZG1hcmMuaWV0Zi5vcmc7IHRsc0BpZXRmLm9yZw0KU3ViamVjdDogUmU6 IFtUTFNdIEVYVEVSTkFMOiBSZTogaW50ZWdyaXR5IG9ubHkgY2lwaGVyc3VpdGVzDQoNCklmIHRo ZSBkZXZpY2UgaW1wbGVtZW50cyB0aGUgY2lwaGVyIHNvIGFzIHRvIHRhbGsgdG8gdGhlIGJyb3dz ZXIsIGl0J3MgY2xlYXJseSBjYXBhYmxlIG9mIGltcGxlbWVudGluZyB0aGUgY2lwaGVyLi4uDQoN Ck9uIFR1ZSwgQXVnIDIxLCAyMDE4IGF0IDE6MzQgUE0sIEphY2sgVmlzb2t5IDxqbXZpc29reUBy YS5yb2Nrd2VsbC5jb208bWFpbHRvOmptdmlzb2t5QHJhLnJvY2t3ZWxsLmNvbT4+IHdyb3RlOg0K SGkgUmljaCwNCg0KSeKAmW0gbm90IHN1cmUgaWYgSeKAmW0gZm9sbG93aW5nIHRoZSBxdWVzdGlv biwgYnV0IHdoYXQgd2FzIG1lYW50IHdhcyB0aGF0IHRoZXNlIGNpcGhlcnMgYXJlIGdlbmVyYWxs eSBOT1QgdXNlZCBmb3IgYnJvd3NlciBhY2Nlc3MuICBNYWNoaW5lIHRvIG1hY2hpbmUgY29tbXVu aWNhdGlvbiB1c3VhbGx5IGRvZXMgbm90IGludm9sdmUgYSBicm93c2VyLiAgQXBvbG9naWVzIGlm IEnigJl2ZSBtaXN1bmRlcnN0b29kIHRoZSBxdWVzdGlvbi4NCg0KVGhhbmtzIGFuZCBCZXN0IFJl Z2FyZHMsDQoNCi0tSmFjaw0KDQpGcm9tOiBUTFMgW21haWx0bzp0bHMtYm91bmNlc0BpZXRmLm9y ZzxtYWlsdG86dGxzLWJvdW5jZXNAaWV0Zi5vcmc+XSBPbiBCZWhhbGYgT2YgU2FseiwgUmljaA0K U2VudDogVHVlc2RheSwgQXVndXN0IDIxLCAyMDE4IDE6MTIgUE0NClRvOiBGcmllcywgU3RlZmZl biA8c3RlZmZlbi5mcmllc0BzaWVtZW5zLmNvbTxtYWlsdG86c3RlZmZlbi5mcmllc0BzaWVtZW5z LmNvbT4+DQpDYzogbmNhbXdpbmc9NDBjaXNjby5jb21AZG1hcmMuaWV0Zi5vcmc8bWFpbHRvOjQw Y2lzY28uY29tQGRtYXJjLmlldGYub3JnPjsgdGxzQGlldGYub3JnPG1haWx0bzp0bHNAaWV0Zi5v cmc+DQpTdWJqZWN0OiBFWFRFUk5BTDogUmU6IFtUTFNdIGludGVncml0eSBvbmx5IGNpcGhlcnN1 aXRlcw0KDQoNCltVc2UgY2F1dGlvbiB3aXRoIGxpbmtzICYgYXR0YWNobWVudHNdDQoNCg0KTm93 IEkgdGhpbmsgSSBhbSBhcyBjb25mdXNlZCBhcyBTdGVwaGVuIGFuZCBvdGhlcnMuDQoNCk9uZSBq dXN0aWZpY2F0aW9uIHdhcyDigJxzbWFsbCBmb290cHJpbnQu4oCdICBCdXQgbm93IHlvdeKAmXJl IHNheWluZyB0aGF0IGZvciBkZWJ1Z2dpbmcgZW5jcnlwdGlvbiAoc3RhbmRhcmQ/KSBjaXBoZXJz IGFyZSB1c2VkIGZvciBicm93c2VyIGFjY2Vzcz8NCg0KDQpfX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fXw0KVExTIG1haWxpbmcgbGlzdA0KVExTQGlldGYub3Jn PG1haWx0bzpUTFNAaWV0Zi5vcmc+DQpodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3Rp bmZvL3Rscw0KDQo= --_000_DM5PR2201MB14337FB5126A11B21CA6532699310DM5PR2201MB1433_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 U2ltU3VuOw0KCXBhbm9zZS0xOjIgMSA2IDAgMyAxIDEgMSAxIDE7fQ0KQGZvbnQtZmFjZQ0KCXtm b250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2IDMgMiA0 O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1IDUg MiAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJcQFNpbVN1biI7DQoJ cGFub3NlLTE6MiAxIDYgMCAzIDEgMSAxIDEgMTt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0K cC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0K CW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5 OiJUaW1lcyBOZXcgUm9tYW4iLHNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7 bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVu ZGVybGluZTt9DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0 eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJs aW5lO30NCnANCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCW1zby1tYXJnaW4tdG9wLWFsdDph dXRvOw0KCW1hcmdpbi1yaWdodDowaW47DQoJbXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87DQoJ bWFyZ2luLWxlZnQ6MGluOw0KCWZvbnQtc2l6ZToxMi4wcHQ7DQoJZm9udC1mYW1pbHk6IlRpbWVz IE5ldyBSb21hbiIsc2VyaWY7fQ0KcC5Nc29MaXN0UGFyYWdyYXBoLCBsaS5Nc29MaXN0UGFyYWdy YXBoLCBkaXYuTXNvTGlzdFBhcmFncmFwaA0KCXttc28tc3R5bGUtcHJpb3JpdHk6MzQ7DQoJbWFy Z2luLXRvcDowaW47DQoJbWFyZ2luLXJpZ2h0OjBpbjsNCgltYXJnaW4tYm90dG9tOjBpbjsNCglt YXJnaW4tbGVmdDouNWluOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTIu MHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iLHNlcmlmO30NCnAubS03NDA0Njk2 MTQ1MDg3ODYxNTE3bXNnYm9yZGVyLCBsaS5tLTc0MDQ2OTYxNDUwODc4NjE1MTdtc2dib3JkZXIs IGRpdi5tLTc0MDQ2OTYxNDUwODc4NjE1MTdtc2dib3JkZXINCgl7bXNvLXN0eWxlLW5hbWU6bV8t NzQwNDY5NjE0NTA4Nzg2MTUxN21zZ2JvcmRlcjsNCgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsN CgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0KCW1hcmdp bi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcg Um9tYW4iLHNlcmlmO30NCnNwYW4uRW1haWxTdHlsZTE5DQoJe21zby1zdHlsZS10eXBlOnBlcnNv bmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOiMx RjQ5N0Q7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJ Zm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJ e3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBpbiAxLjBpbiAxLjBpbjt9DQpk aXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi8qIExpc3QgRGVmaW5pdGlv bnMgKi8NCkBsaXN0IGwwDQoJe21zby1saXN0LWlkOjExNTMxMzU4MDY7DQoJbXNvLWxpc3QtdHlw ZTpoeWJyaWQ7DQoJbXNvLWxpc3QtdGVtcGxhdGUtaWRzOi01ODExMjI1OTIgNjc2OTg3MDMgNjc2 OTg3MTMgNjc2OTg3MTUgNjc2OTg3MDMgNjc2OTg3MTMgNjc2OTg3MTUgNjc2OTg3MDMgNjc2OTg3 MTMgNjc2OTg3MTU7fQ0KQGxpc3QgbDA6bGV2ZWwxDQoJe21zby1sZXZlbC10YWItc3RvcDpub25l Ow0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47 fQ0KQGxpc3QgbDA6bGV2ZWwyDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmFscGhhLWxvd2Vy Ow0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246 bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47fQ0KQGxpc3QgbDA6bGV2ZWwzDQoJe21zby1sZXZl bC1udW1iZXItZm9ybWF0OnJvbWFuLWxvd2VyOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0K CW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246cmlnaHQ7DQoJdGV4dC1pbmRlbnQ6LTkuMHB0O30N CkBsaXN0IGwwOmxldmVsNA0KCXttc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwt bnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluO30NCkBsaXN0IGwwOmxl dmVsNQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDphbHBoYS1sb3dlcjsNCgltc28tbGV2ZWwt dGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1p bmRlbnQ6LS4yNWluO30NCkBsaXN0IGwwOmxldmVsNg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1h dDpyb21hbi1sb3dlcjsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVt YmVyLXBvc2l0aW9uOnJpZ2h0Ow0KCXRleHQtaW5kZW50Oi05LjBwdDt9DQpAbGlzdCBsMDpsZXZl bDcNCgl7bXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlv bjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjt9DQpAbGlzdCBsMDpsZXZlbDgNCgl7bXNvLWxl dmVsLW51bWJlci1mb3JtYXQ6YWxwaGEtbG93ZXI7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7 DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjt9 DQpAbGlzdCBsMDpsZXZlbDkNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6cm9tYW4tbG93ZXI7 DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpy aWdodDsNCgl0ZXh0LWluZGVudDotOS4wcHQ7fQ0KQGxpc3QgbDENCgl7bXNvLWxpc3QtaWQ6MTM0 MDM1MTA5NzsNCgltc28tbGlzdC10eXBlOmh5YnJpZDsNCgltc28tbGlzdC10ZW1wbGF0ZS1pZHM6 LTEzMDU0MzAwMCA2NzY5ODcwMyA2NzY5ODcxMyA2NzY5ODcxNSA2NzY5ODcwMyA2NzY5ODcxMyA2 NzY5ODcxNSA2NzY5ODcwMyA2NzY5ODcxMyA2NzY5ODcxNTt9DQpAbGlzdCBsMTpsZXZlbDENCgl7 bXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0 Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjt9DQpAbGlzdCBsMTpsZXZlbDINCgl7bXNvLWxldmVsLW51 bWJlci1mb3JtYXQ6YWxwaGEtbG93ZXI7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNv LWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjt9DQpAbGlz dCBsMTpsZXZlbDMNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6cm9tYW4tbG93ZXI7DQoJbXNv LWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpyaWdodDsN Cgl0ZXh0LWluZGVudDotOS4wcHQ7fQ0KQGxpc3QgbDE6bGV2ZWw0DQoJe21zby1sZXZlbC10YWIt c3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVu dDotLjI1aW47fQ0KQGxpc3QgbDE6bGV2ZWw1DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmFs cGhhLWxvd2VyOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXIt cG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47fQ0KQGxpc3QgbDE6bGV2ZWw2DQoJ e21zby1sZXZlbC1udW1iZXItZm9ybWF0OnJvbWFuLWxvd2VyOw0KCW1zby1sZXZlbC10YWItc3Rv cDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246cmlnaHQ7DQoJdGV4dC1pbmRlbnQ6 LTkuMHB0O30NCkBsaXN0IGwxOmxldmVsNw0KCXttc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCglt c28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluO30NCkBs aXN0IGwxOmxldmVsOA0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDphbHBoYS1sb3dlcjsNCglt c28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7 DQoJdGV4dC1pbmRlbnQ6LS4yNWluO30NCkBsaXN0IGwxOmxldmVsOQ0KCXttc28tbGV2ZWwtbnVt YmVyLWZvcm1hdDpyb21hbi1sb3dlcjsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28t bGV2ZWwtbnVtYmVyLXBvc2l0aW9uOnJpZ2h0Ow0KCXRleHQtaW5kZW50Oi05LjBwdDt9DQpvbA0K CXttYXJnaW4tYm90dG9tOjBpbjt9DQp1bA0KCXttYXJnaW4tYm90dG9tOjBpbjt9DQotLT48L3N0 eWxlPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVkZWZhdWx0cyB2OmV4dD0iZWRp dCIgc3BpZG1heD0iMTAyNiIgLz4NCjwveG1sPjwhW2VuZGlmXS0tPjwhLS1baWYgZ3RlIG1zbyA5 XT48eG1sPg0KPG86c2hhcGVsYXlvdXQgdjpleHQ9ImVkaXQiPg0KPG86aWRtYXAgdjpleHQ9ImVk aXQiIGRhdGE9IjEiIC8+DQo8L286c2hhcGVsYXlvdXQ+PC94bWw+PCFbZW5kaWZdLS0+DQo8L2hl YWQ+DQo8Ym9keSBsYW5nPSJFTi1VUyIgbGluaz0iYmx1ZSIgdmxpbms9InB1cnBsZSI+DQo8ZGl2 IGNsYXNzPSJXb3JkU2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmO2NvbG9yOiMxRjQ5N0QiPkhpIFRlZCw8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2Nv bG9yOiMxRjQ5N0QiPkEgZmV3IHBvaW50czo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJ0ZXh0 LWluZGVudDotLjI1aW47bXNvLWxpc3Q6bDAgbGV2ZWwxIGxmbzIiPjwhW2lmICFzdXBwb3J0TGlz dHNdPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGli cmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48c3BhbiBzdHlsZT0ibXNvLWxpc3Q6 SWdub3JlIj4xLjxzcGFuIHN0eWxlPSJmb250OjcuMHB0ICZxdW90O1RpbWVzIE5ldyBSb21hbiZx dW90OyI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7DQo8L3NwYW4+PC9zcGFu Pjwvc3Bhbj48IVtlbmRpZl0+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPkRvbuKAmXQg YXNzdW1lIHRoZXJlIGlzIGFueSBicm93c2VyIGludm9sdmVkLiZuYnNwOyBUaGVyZSBpcyBvZnRl biBubyBicm93c2VyLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29MaXN0UGFy YWdyYXBoIiBzdHlsZT0idGV4dC1pbmRlbnQ6LS4yNWluO21zby1saXN0OmwwIGxldmVsMSBsZm8y Ij48IVtpZiAhc3VwcG9ydExpc3RzXT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PHNw YW4gc3R5bGU9Im1zby1saXN0Oklnbm9yZSI+Mi48c3BhbiBzdHlsZT0iZm9udDo3LjBwdCAmcXVv dDtUaW1lcyBOZXcgUm9tYW4mcXVvdDsiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOw0KPC9zcGFuPjwvc3Bhbj48L3NwYW4+PCFbZW5kaWZdPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xv cjojMUY0OTdEIj5FdmVuIGlmIHRoZXJlIGlzIGEgYnJvd3NlciAoYW5kIHNlZSBwb2ludCAxIGJl Zm9yZSBhc3N1bWluZykgYW55IEhUVFAgY29tbXVuaWNhdGlvbiB3b3VsZCBiZSBhdCBhIG11Y2gg bXVjaCBzbG93ZXIgcmF0ZSB0aGFuIG1hY2hpbmUgdG8gbWFjaGluZSBJL088bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFG NDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZx dW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPkhvcGUgdGhhdCBjbGVhcnMgaXQgdXAuPG86 cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlm O2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5UaGFua3MgYW5kIEJlc3Qg UmVnYXJkcyw8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7 LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPi0tSmFj azxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1z ZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkZyb206PC9zcGFuPjwvYj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNh bnMtc2VyaWYiPiBUZWQgTGVtb24gW21haWx0bzptZWxsb25AZnVndWUuY29tXQ0KPGJyPg0KPGI+ U2VudDo8L2I+IFR1ZXNkYXksIEF1Z3VzdCAyMSwgMjAxOCAxOjM5IFBNPGJyPg0KPGI+VG86PC9i PiBKYWNrIFZpc29reSAmbHQ7am12aXNva3lAcmEucm9ja3dlbGwuY29tJmd0Ozxicj4NCjxiPkNj OjwvYj4gU2FseiwgUmljaCAmbHQ7cnNhbHo9NDBha2FtYWkuY29tQGRtYXJjLmlldGYub3JnJmd0 OzsgRnJpZXMsIFN0ZWZmZW4gJmx0O3N0ZWZmZW4uZnJpZXNAc2llbWVucy5jb20mZ3Q7OyBuY2Ft d2luZz00MGNpc2NvLmNvbUBkbWFyYy5pZXRmLm9yZzsgdGxzQGlldGYub3JnPGJyPg0KPGI+U3Vi amVjdDo8L2I+IFJlOiBbVExTXSBFWFRFUk5BTDogUmU6IGludGVncml0eSBvbmx5IGNpcGhlcnN1 aXRlczxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5i c3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPklmIHRoZSBkZXZpY2Ug aW1wbGVtZW50cyB0aGUgY2lwaGVyIHNvIGFzIHRvIHRhbGsgdG8gdGhlIGJyb3dzZXIsIGl0J3Mg Y2xlYXJseSBjYXBhYmxlIG9mIGltcGxlbWVudGluZyB0aGUgY2lwaGVyLi4uPG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpw PjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5PbiBUdWUsIEF1ZyAyMSwgMjAxOCBh dCAxOjM0IFBNLCBKYWNrIFZpc29reSAmbHQ7PGEgaHJlZj0ibWFpbHRvOmptdmlzb2t5QHJhLnJv Y2t3ZWxsLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPmptdmlzb2t5QHJhLnJvY2t3ZWxsLmNvbTwvYT4m Z3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25l O2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowaW4gMGluIDBpbiA2LjBw dDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tcmlnaHQ6MGluIj4NCjxkaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJn aW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iY29sb3I6IzFGNDk3RCI+SGkgUmljaCw8 L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1h cmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxl PSJjb2xvcjojMUY0OTdEIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0 b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJjb2xvcjojMUY0OTdEIj5J4oCZbSBub3Qgc3VyZSBp ZiBJ4oCZbSBmb2xsb3dpbmcgdGhlIHF1ZXN0aW9uLCBidXQgd2hhdCB3YXMgbWVhbnQgd2FzIHRo YXQgdGhlc2UgY2lwaGVycyBhcmUgZ2VuZXJhbGx5IE5PVCB1c2VkIGZvciBicm93c2VyIGFjY2Vz cy4mbmJzcDsgTWFjaGluZSB0byBtYWNoaW5lDQogY29tbXVuaWNhdGlvbiB1c3VhbGx5IGRvZXMg bm90IGludm9sdmUgYSBicm93c2VyLiZuYnNwOyBBcG9sb2dpZXMgaWYgSeKAmXZlIG1pc3VuZGVy c3Rvb2QgdGhlIHF1ZXN0aW9uLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1h bHQ6YXV0byI+PHNwYW4gc3R5bGU9ImNvbG9yOiMxRjQ5N0QiPiZuYnNwOzwvc3Bhbj48bzpwPjwv bzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6 YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImNvbG9yOiMxRjQ5 N0QiPlRoYW5rcyBhbmQgQmVzdCBSZWdhcmRzLDwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2lu LWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImNvbG9yOiMxRjQ5N0QiPiZuYnNwOzwvc3Bh bj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2lu LXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImNv bG9yOiMxRjQ5N0QiPi0tSmFjazwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1h bHQ6YXV0byI+PHNwYW4gc3R5bGU9ImNvbG9yOiMxRjQ5N0QiPiZuYnNwOzwvc3Bhbj48bzpwPjwv bzpwPjwvcD4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlk ICNFMUUxRTEgMS4wcHQ7cGFkZGluZzozLjBwdCAwaW4gMGluIDBpbiI+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20t YWx0OmF1dG8iPjxiPkZyb206PC9iPiBUTFMgW21haWx0bzo8YSBocmVmPSJtYWlsdG86dGxzLWJv dW5jZXNAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj50bHMtYm91bmNlc0BpZXRmLm9yZzwvYT5d DQo8Yj5PbiBCZWhhbGYgT2YgPC9iPlNhbHosIFJpY2g8YnI+DQo8Yj5TZW50OjwvYj4gVHVlc2Rh eSwgQXVndXN0IDIxLCAyMDE4IDE6MTIgUE08YnI+DQo8Yj5Ubzo8L2I+IEZyaWVzLCBTdGVmZmVu ICZsdDs8YSBocmVmPSJtYWlsdG86c3RlZmZlbi5mcmllc0BzaWVtZW5zLmNvbSIgdGFyZ2V0PSJf YmxhbmsiPnN0ZWZmZW4uZnJpZXNAc2llbWVucy5jb208L2E+Jmd0Ozxicj4NCjxiPkNjOjwvYj4g bmNhbXdpbmc9PGEgaHJlZj0ibWFpbHRvOjQwY2lzY28uY29tQGRtYXJjLmlldGYub3JnIiB0YXJn ZXQ9Il9ibGFuayI+NDBjaXNjby5jb21AZG1hcmMuaWV0Zi5vcmc8L2E+Ow0KPGEgaHJlZj0ibWFp bHRvOnRsc0BpZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPnRsc0BpZXRmLm9yZzwvYT48YnI+DQo8 Yj5TdWJqZWN0OjwvYj4gRVhURVJOQUw6IFJlOiBbVExTXSBpbnRlZ3JpdHkgb25seSBjaXBoZXJz dWl0ZXM8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1 dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpzb2xp ZCAjQkIyMzIyIDIuMjVwdDtwYWRkaW5nOjIuMHB0IDIuMHB0IDIuMHB0IDIuMHB0Ij4NCjxwIGNs YXNzPSJtLTc0MDQ2OTYxNDUwODc4NjE1MTdtc2dib3JkZXIiIHN0eWxlPSJsaW5lLWhlaWdodDox Mi4wcHQ7YmFja2dyb3VuZDojRThFOEU4Ij4NCjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpibGFjayI+ W1VzZSBjYXV0aW9uIHdpdGggbGlua3MgJmFtcDsgYXR0YWNobWVudHNdPC9zcGFuPjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28t bWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Tm93IEkgdGhpbmsgSSBhbSBhcyBjb25mdXNlZCBhcyBT dGVwaGVuIGFuZCBvdGhlcnMuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8i PiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1t YXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj5PbmUganVzdGlm aWNhdGlvbiB3YXMg4oCcc21hbGwgZm9vdHByaW50LuKAnSZuYnNwOyBCdXQgbm93IHlvdeKAmXJl IHNheWluZyB0aGF0IGZvciBkZWJ1Z2dpbmcgZW5jcnlwdGlvbiAoc3RhbmRhcmQ/KSBjaXBoZXJz IGFyZSB1c2VkIGZvciBicm93c2VyIGFjY2Vzcz88bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRv bS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWJvdHRvbToxMi4wcHQiPjxicj4N Cl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fPGJyPg0KVExT IG1haWxpbmcgbGlzdDxicj4NCjxhIGhyZWY9Im1haWx0bzpUTFNAaWV0Zi5vcmciPlRMU0BpZXRm Lm9yZzwvYT48YnI+DQo8YSBocmVmPSJodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3Rp bmZvL3RscyIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlz dGluZm8vdGxzPC9hPjxvOnA+PC9vOnA+PC9wPg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8 L2JvZHk+DQo8L2h0bWw+DQo= --_000_DM5PR2201MB14337FB5126A11B21CA6532699310DM5PR2201MB1433_-- From nobody Tue Aug 21 10:57:14 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 81C7A130E21 for ; Tue, 21 Aug 2018 10:57:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.909 X-Spam-Level: X-Spam-Status: No, score=-1.909 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_DKIMWL_WL_MED=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5ipsJ_X2KaE2 for ; Tue, 21 Aug 2018 10:57:10 -0700 (PDT) Received: from mail-it0-x232.google.com (mail-it0-x232.google.com [IPv6:2607:f8b0:4001:c0b::232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BB8DF128CB7 for ; Tue, 21 Aug 2018 10:57:09 -0700 (PDT) Received: by mail-it0-x232.google.com with SMTP id s7-v6so5334279itb.4 for ; Tue, 21 Aug 2018 10:57:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=tz4AUEX8uIoxH3tgfJo9uDMmOG+DBD4LZi+IqdyNz0I=; b=hZmkHnYOeyg8KKMPyECy4UT0pSzedvNSFwea0WLW1HNCacdnDh45uGIdjFjx+Jz1GH E1kCnI/82PWLi48q44JqWWJuBHrCvxRH05+ny8i0BE4jQwAXBfAbjnSNo+Q1g1nA45F/ DTD9bUMT1LyE+Pvz12UHd9A9tMbqWZZIPwpIFuCEb9fzSKBu5wQhI9qJRcTWJUaCo8pd Wz9KryWORC/ICRONL5HVH952C9JxfUMGJ/6DcNK/AETay5+agpqyPcFSgM8XPJYM8FMw Sk2uiRnDMhPZsYixFo7EQnvQ/O2vrXAR7uKwh4lLocUSur5Y+2SW0tYdUXHjOYSMB5DO f+DQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=tz4AUEX8uIoxH3tgfJo9uDMmOG+DBD4LZi+IqdyNz0I=; b=OnZZhXqYo0zw6oBouAoRRTUdfNYfy7aptMwVOASSzAyyqwbg/LnZy9WDtyv5HodLGJ d/RVMQ/rsR8JI/ImkPqPCMqHOChdm91uBc2fkSDwr1Hf5KUaSOE6xoUv9hArI7Ia8L0U 8vFtcKC45JxLeBotzhW7iWSEosfyzfHUj9euCR3YxEpAgp0HINUrHyD3lEYKQ2rLOPs+ rar9jpHsQ01fUzf3nL3Ac/9pahS32Zpm2jskpLWoup1tz4Cs5xxbuKTjWzEZehI8XvP2 A7okGMZjX2yy/TNwfZ5cJLHTlG6F2KbH62YefUwkHFmA1ApIAODxPDoJ/tMB5No/bwQ5 nYJw== X-Gm-Message-State: AOUpUlGdF5H0y9AJ0GnRlT1hET+TeH8S85bCKfr32tyjFGxpU7Mkr7Zn RiJjn235acnlWHDEd7z+dpITtfsL0Y1lY+4T1NF7X6RL X-Google-Smtp-Source: ANB0VdbpVWYVGUmwxNxkPj4PRKPc0KAHqf/1l70wOgfM4yC9XJIycb8A3BYcq861RP93UR76M6g1pkjZxfx+QHhDsiQ= X-Received: by 2002:a02:9d45:: with SMTP id m5-v6mr4784420jal.72.1534874229028; Tue, 21 Aug 2018 10:57:09 -0700 (PDT) MIME-Version: 1.0 Received: by 2002:a4f:a009:0:0:0:0:0 with HTTP; Tue, 21 Aug 2018 10:56:28 -0700 (PDT) In-Reply-To: References: <64d23891-2f32-9bb8-1ec8-f4fad13cdfb9@cs.tcd.ie> <982363FD-A839-4175-BA53-7CA242F9ADA6@ll.mit.edu> <2D7F2926-6376-4B2C-BDE9-7A6F1C0FA748@gmail.com> <5B7C1571020000AC0015C330@gwia2.rz.hs-offenburg.de> <8A2746A8-6B41-45C3-9D77-6AF3536C6E2D@siemens.com> From: Ted Lemon Date: Tue, 21 Aug 2018 13:56:28 -0400 Message-ID: To: Jack Visoky Cc: "Salz, Rich" , "Fries, Steffen" , "ncamwing=40cisco.com@dmarc.ietf.org" , "tls@ietf.org" Content-Type: multipart/alternative; boundary="0000000000003246d90573f5c104" Archived-At: Subject: Re: [TLS] EXTERNAL: Re: integrity only ciphersuites X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Aug 2018 17:57:12 -0000 --0000000000003246d90573f5c104 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable What kind of bandwidth are we talking about here? Also, could you answer my question about IPsec? On Tue, Aug 21, 2018 at 1:53 PM, Jack Visoky wrote: > Hi Ted, > > > > A few points: > > > > 1. Don=E2=80=99t assume there is any browser involved. There is of= ten no > browser. > > 2. Even if there is a browser (and see point 1 before assuming) any > HTTP communication would be at a much much slower rate than machine to > machine I/O > > > > Hope that clears it up. > > > > Thanks and Best Regards, > > > > --Jack > > > > *From:* Ted Lemon [mailto:mellon@fugue.com] > *Sent:* Tuesday, August 21, 2018 1:39 PM > *To:* Jack Visoky > *Cc:* Salz, Rich ; Fries, Steffen < > steffen.fries@siemens.com>; ncamwing=3D40cisco.com@dmarc.ietf.org; > tls@ietf.org > *Subject:* Re: [TLS] EXTERNAL: Re: integrity only ciphersuites > > > > If the device implements the cipher so as to talk to the browser, it's > clearly capable of implementing the cipher... > > > > On Tue, Aug 21, 2018 at 1:34 PM, Jack Visoky > wrote: > > Hi Rich, > > > > I=E2=80=99m not sure if I=E2=80=99m following the question, but what was = meant was that > these ciphers are generally NOT used for browser access. Machine to > machine communication usually does not involve a browser. Apologies if > I=E2=80=99ve misunderstood the question. > > > > Thanks and Best Regards, > > > > --Jack > > > > *From:* TLS [mailto:tls-bounces@ietf.org] *On Behalf Of *Salz, Rich > *Sent:* Tuesday, August 21, 2018 1:12 PM > *To:* Fries, Steffen > *Cc:* ncamwing=3D40cisco.com@dmarc.ietf.org; tls@ietf.org > *Subject:* EXTERNAL: Re: [TLS] integrity only ciphersuites > > > > [Use caution with links & attachments] > > > > Now I think I am as confused as Stephen and others. > > > > One justification was =E2=80=9Csmall footprint.=E2=80=9D But now you=E2= =80=99re saying that for > debugging encryption (standard?) ciphers are used for browser access? > > > > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > > > --0000000000003246d90573f5c104 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
What kind of bandwidth are we talking about here?=C2=A0 = =C2=A0Also, could you answer my question about IPsec?

On Tue, Aug 21, 2018 at 1:53 PM, = Jack Visoky <jmvisoky@ra.rockwell.com> wrote:

Hi Ted,

=C2=A0

A few points:

=C2=A0

1.=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0 Don=E2=80=99t assume there is an= y browser involved.=C2=A0 There is often no browser.

2.=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0 Even if there is a browser (and = see point 1 before assuming) any HTTP communication would be at a much much= slower rate than machine to machine I/O

=C2=A0

Hope that clears it up.=

=C2=A0

Thanks and Best Regards,

=C2=A0

--Jack

=C2=A0

From: Ted Lemon [mailto:mellon@fugue.com]
Sent: Tuesday, August 21, 2018 1:39 PM
To: Jack Visoky <jmvisoky@ra.rockwell.com>
Cc: Salz, Rich <rsalz=3D40akamai.com@dmarc.ietf.org>; Fries, St= effen <st= effen.fries@siemens.com>; ncamwing=3D40cisco.com@dmarc.ietf.org; tls@ietf.org
Subject: Re: [TLS] EXTERNAL: Re: integrity only ciphersuites<= u>

=C2=A0

If the device implements the cipher so as to talk to= the browser, it's clearly capable of implementing the cipher...=

=C2=A0

On Tue, Aug 21, 2018 at 1:34 PM, Jack Visoky <jmvisoky@ra.rock= well.com> wrote:

Hi Rich,=

=C2=A0

I=E2=80=99m not sure i= f I=E2=80=99m following the question, but what was meant was that these cip= hers are generally NOT used for browser access.=C2=A0 Machine to machine communication usually does not involve a browser.=C2=A0 Apologies if I=E2= =80=99ve misunderstood the question.

=C2=A0

Thanks and Best Regard= s,

=C2=A0

--Jack

=C2=A0

From: TLS [mailto:tls-bounces@ietf.org] On Behalf Of Salz, Rich
Sent: Tuesday, August 21, 2018 1:12 PM
To: Fries, Steffen <steffen.fries@siemens.com>
Cc: ncamwing=3D40cisco.com@dmarc.ietf.org; tls@ietf.org
Subject: EXTERNAL: Re: [TLS] integrity only ciphersuites

=C2=A0

[Use caution with links & attachments]

=C2=A0

Now I think I am as confused as Stephen and others.<= u>

=C2=A0

One justification was =E2=80=9Csmall footprint.=E2= =80=9D=C2=A0 But now you=E2=80=99re saying that for debugging encryption (s= tandard?) ciphers are used for browser access?

=C2=A0


_______________________________________________
TLS mailing list
TLS@ietf.org
htt= ps://www.ietf.org/mailman/listinfo/tls

=C2=A0


--0000000000003246d90573f5c104-- From nobody Tue Aug 21 10:58:49 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 08EB6128C65 for ; Tue, 21 Aug 2018 10:58:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pDBJ8BTgODUP for ; Tue, 21 Aug 2018 10:58:45 -0700 (PDT) Received: from NAM03-CO1-obe.outbound.protection.outlook.com (mail-co1nam03on0058.outbound.protection.outlook.com [104.47.40.58]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E466D130DF9 for ; Tue, 21 Aug 2018 10:58:43 -0700 (PDT) Received: from DM5PR2201MB1433.namprd22.prod.outlook.com (10.174.186.154) by DM5PR2201MB1114.namprd22.prod.outlook.com (10.174.186.33) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1059.21; Tue, 21 Aug 2018 17:58:42 +0000 Received: from DM5PR2201MB1433.namprd22.prod.outlook.com ([fe80::49f1:7875:b984:9a65]) by DM5PR2201MB1433.namprd22.prod.outlook.com ([fe80::49f1:7875:b984:9a65%2]) with mapi id 15.20.1059.023; Tue, 21 Aug 2018 17:58:42 +0000 From: Jack Visoky To: "Salz, Rich" , "Salz, Rich" , "Fries, Steffen" CC: "ncamwing=40cisco.com@dmarc.ietf.org" , "tls@ietf.org" Thread-Topic: [TLS] EXTERNAL: Re: integrity only ciphersuites Thread-Index: AQHUOXbMDTTGz32A1EOTWN7nFkknjKTKfNag Date: Tue, 21 Aug 2018 17:58:42 +0000 Message-ID: References: <64d23891-2f32-9bb8-1ec8-f4fad13cdfb9@cs.tcd.ie> <982363FD-A839-4175-BA53-7CA242F9ADA6@ll.mit.edu> <2D7F2926-6376-4B2C-BDE9-7A6F1C0FA748@gmail.com> <5B7C1571020000AC0015C330@gwia2.rz.hs-offenburg.de> <8A2746A8-6B41-45C3-9D77-6AF3536C6E2D@siemens.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=jmvisoky@ra.rockwell.com; x-originating-ip: [205.175.250.246] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; DM5PR2201MB1114; 6:qxZD/MaZrae757GXKx1SsO25Ts1I3foT14TxwLd/AvJ4K2d9iRuw8vWfDsVqTXsgNTivYqxiseundVkYj7AJPL/A578lUmBAAEw6iNBBFly9/AB3dkP4uOmrSK69EgJv1JwimsFXsPe8+RnM5PA7ywMoL0EhDJitb/pCbSdYEgQIeuY96gpncHsux0axrllKrsByotx3Vn6jkKJeh3DC4VqnZgnPGLevkU23xdoPbHnGYI3rrWtGd9JezeOsk5+K0Te9cbFRv14sJEcqLaFISh6oW3DDJ3fnMT0PZRoEIV950rm1yx3pDLlp7xPMXzSRjxrHigX/tzQiXvjkpBJXYhhgCgWWc8M7y27sQYZEKE7zlTKov+CDoFw00+ItyYo7avakxuNAF/1xR/PH5A6QiV7sZPMUaqQWnhySalnKBuG1p/bjvrs1P6qkJ93XsgUzqVpwChHiiEynu0yFFim5iQ==; 5:CbTzfYRXsrKk7LNCYiKEQY+47x5FXfEtsnpSRy2TOpDViiv7MdRvdrqdpRzvWHua49A/gRmdWZYBgMAre8QYxRpC2Bqkkdox7syIq0XuuIwfdRW6J0ANFoJV7GTYm0GweZMOXvM+DJAmuQgJ6Y9KLVWbQrxUAEPWpTC+VFjcTr4=; 7:AWgmWEvBsl4fLJ4MIeznpewFwyOlhs+LsNLCVc5Ek4hjmmGUs0BDC8xsn3iPNBBnDo+CkodRzA3gNipb65vEbImZVfYe026smwjseyMAalvUHm80BblmxfzSWhOkQnPRU8xfE0VmSZ9iMYHE3KJV4WeY3EkPJ1Wq5yUp6JlLjgf64/zXkbEhGq8ICvMqu0vDQqQKT7VJOL24l7mscxyV0alLVJlrfhISRj6oMZ7lhjP/Y9/ldPeCwZ8Imgjvr6LT x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-correlation-id: 2f450749-e42a-49eb-5430-08d6078fbb92 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(7020095)(4652040)(8989137)(4534165)(4627221)(201703031133081)(201702281549075)(8990107)(5600074)(711020)(4618075)(2017052603328)(7153060)(7193020); SRVR:DM5PR2201MB1114; x-ms-traffictypediagnostic: DM5PR2201MB1114: x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(28532068793085)(181554191321653)(269231077054813)(126837547833334)(21748063052155)(33711482430040); x-ms-exchange-senderadcheck: 1 x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(8211001083)(6040522)(2401047)(8121501046)(5005006)(3002001)(93006095)(93001095)(10201501046)(3231311)(944501410)(52105095)(6055026)(149027)(150027)(6041310)(20161123558120)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123560045)(20161123562045)(20161123564045)(201708071742011)(7699016); SRVR:DM5PR2201MB1114; BCL:0; PCL:0; RULEID:; SRVR:DM5PR2201MB1114; x-forefront-prvs: 0771670921 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(396003)(376002)(346002)(366004)(39860400002)(136003)(199004)(189003)(446003)(105586002)(26005)(790700001)(476003)(14454004)(97736004)(11346002)(5250100002)(76176011)(3846002)(86362001)(102836004)(53546011)(25786009)(6506007)(99286004)(6246003)(8936002)(256004)(486006)(106356001)(6116002)(9326002)(2900100001)(7696005)(68736007)(14444005)(4326008)(6436002)(186003)(55016002)(9686003)(54896002)(316002)(6306002)(8676002)(54906003)(33656002)(2906002)(81156014)(81166006)(19609705001)(110136005)(66066001)(478600001)(5660300001)(229853002)(53936002)(93886005)(7736002)(74316002); DIR:OUT; SFP:1101; SCL:1; SRVR:DM5PR2201MB1114; H:DM5PR2201MB1433.namprd22.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: ra.rockwell.com does not designate permitted sender hosts) x-microsoft-antispam-message-info: YJ86fP0X04xqehaZXtG9oMgvzxvPSIjxcJLQTAJYYpfTUnMPVFFb+lXoe5805Bi2/USrU5niuU1dIE9UZ8F4fcoc2wI4b3Srf0WmubrWu5O7lAH5P0Gn+KyYgAze3zxZjL7zoP3/+tuQuhKt698828rJBXfdHWeAJlAG3ak3YDusgk1NsS+/Y7VDLW515RQ8EtZx8y6YyoP+4aRLb8vI1kyY+pwnDhcDYk70QPis/XIYefNdAhWHsG9oR+NnZFAbQwgrge00UBijb/X5n0+OxP1OuZF4vFUzGo5j6t1+pEGx36+/3GnLVAh3V/HPm7xG5cuvhmbIFMIjTtdF+jYss1hM6elfQmj0fZECMHhh9J8= spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_DM5PR2201MB14331CB8DFA008037C716C4099310DM5PR2201MB1433_" MIME-Version: 1.0 X-OriginatorOrg: ra.rockwell.com X-MS-Exchange-CrossTenant-Network-Message-Id: 2f450749-e42a-49eb-5430-08d6078fbb92 X-MS-Exchange-CrossTenant-originalarrivaltime: 21 Aug 2018 17:58:42.6959 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 855b093e-7340-45c7-9f0c-96150415893e X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM5PR2201MB1114 Archived-At: Subject: Re: [TLS] EXTERNAL: Re: integrity only ciphersuites X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Aug 2018 17:58:48 -0000 --_000_DM5PR2201MB14331CB8DFA008037C716C4099310DM5PR2201MB1433_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGkgUmljaCwNCg0KTTJNIG1pZ2h0IGJlIGNvbW1vbiBUTFMsIGJ1dCB3aXRoIHNvbWV0aGluZyBl bHNlIGF0IHRoZSBhcHBsaWNhdGlvbiBsYXllci4gIEnigJlsbCBnaXZlIHRoaXMgZXhhbXBsZSwg YnV0IGFkbWl0dGVkbHkgdGhlIHRlcm1pbm9sb2d5IGlzIGNvbmZ1c2luZzogdGhlcmUgaXMgYW5v dGhlciBwcm90b2NvbCB0aGF0IGlzIGNhbGxlZCBFdGhlck5ldC9JUCAoaGVyZSBJUCBzdGFuZHMg Zm9yIEluZHVzdHJpYWwgUHJvdG9jb2wsIGhlbmNlIHRoZSBjb25jZXJuIGFib3V0IGNvbmZ1c2lv bikuIEluIHRoaXMgY2FzZSB0aGlzIHByb3RvY29sIGlzIGJ1aWx0IHVwb24gVENQIGFuZCBVRFAs IGJ1dCB0aGVuIGFib3ZlIHRoYXQgdGhlcmUgaXMgYSBkaWZmZXJlbnQgcHJvdG9jb2wgbWVhbnQg Zm9yIG1hY2hpbmUgdG8gbWFjaGluZSBjb21tdW5pY2F0aW9uIHRoYXQgd2lsbCBlbmFibGUgYSBu dW1iZXIgb2YgaW5kdXN0cmlhbCBhcHBsaWNhdGlvbnMuICBXaGF0IHdlIGRpZCBpbiBPRFZBIHdh cyB0byBhZGQgVExTIChhbmQgRFRMUyBpbiBzb21lIGNhc2VzKSB0byBwcm90ZWN0IHRoaXMgY29t bXVuaWNhdGlvbi4gIFRoaXMgY29tbXVuaWNhdGlvbiBpcyBvZnRlbiBoaWdoIHNwZWVkIGFuZCBs YXRlbmN5IGlzIGEgbWFqb3IgY29uY2Vybi4gIFNvIGl0IGlzIHN0YW5kYXJkIFRMUywgYnV0IHJh dGhlciB0aGFuIEhUVFAgb24gdG9wIG9mIHRoZSBUTFMsIGl0IGlzIGFuIEluZHVzdHJpYWwgUHJv dG9jb2wuICBFdmVuIGlmIHRoZSBkZXZpY2UgaXMg4oCcY2FwYWJsZeKAnSBvZiBlbmNyeXB0aW9u LCBlbmNyeXB0aW5nIHRoZSBkYXRhIGFkZHMgb3ZlcmhlYWQgYW5kIGlzIHVubmVjZXNzYXJ5IGlu IHNvbWUgYXBwbGljYXRpb25zLiAgU28gY2FwYWJsZSBtaWdodCBtZWFuIGl0IGNhbiBkbyBlbmNy eXB0aW9uLCBidXQgbm90IGF0IHRoZSBzcGVlZHMgbmVjZXNzYXJ5IGZvciBtYWNoaW5lIHRvIG1h Y2hpbmUgSS9PLg0KDQpUaGFua3MgYW5kIEJlc3QgUmVnYXJkcywNCg0KLS1KYWNrDQoNCkZyb206 IFNhbHosIFJpY2ggW21haWx0bzpyc2FsekBha2FtYWkuY29tXQ0KU2VudDogVHVlc2RheSwgQXVn dXN0IDIxLCAyMDE4IDE6NDYgUE0NClRvOiBKYWNrIFZpc29reSA8am12aXNva3lAcmEucm9ja3dl bGwuY29tPjsgU2FseiwgUmljaCA8cnNhbHo9NDBha2FtYWkuY29tQGRtYXJjLmlldGYub3JnPjsg RnJpZXMsIFN0ZWZmZW4gPHN0ZWZmZW4uZnJpZXNAc2llbWVucy5jb20+DQpDYzogbmNhbXdpbmc9 NDBjaXNjby5jb21AZG1hcmMuaWV0Zi5vcmc7IHRsc0BpZXRmLm9yZw0KU3ViamVjdDogUmU6IFtU TFNdIEVYVEVSTkFMOiBSZTogaW50ZWdyaXR5IG9ubHkgY2lwaGVyc3VpdGVzDQoNCsOYICBJ4oCZ bSBub3Qgc3VyZSBpZiBJ4oCZbSBmb2xsb3dpbmcgdGhlIHF1ZXN0aW9uLCBidXQgd2hhdCB3YXMg bWVhbnQgd2FzIHRoYXQgdGhlc2UgY2lwaGVycyBhcmUgZ2VuZXJhbGx5IE5PVCB1c2VkIGZvciBi cm93c2VyIGFjY2Vzcy4gIE1hY2hpbmUgdG8gbWFjaGluZSBjb21tdW5pY2F0aW9uIHVzdWFsbHkg ZG9lcyBub3QgaW52b2x2ZSBhIGJyb3dzZXIuICBBcG9sb2dpZXMgaWYgSeKAmXZlIG1pc3VuZGVy c3Rvb2QgdGhlIHF1ZXN0aW9uLg0KDQpZb3UgdW5kZXJzdG9vZCBtZS4gIFNvIHRoZSBkZXZpY2Vz IChvciByYXRoZXIgYXQgbGVhc3Qgc29tZSBvZiB0aGVtIHNpbmNlIHRoZXkgYXJlIHNwbGVuZGlm ZXJvdXMgaW4gdGhlaXIgdmFyaWFuY2VzKSBkbyBzcGVhayBjb21tb24gVExTLiAgQnV0IG5vdCBm b3IgTTJNLiAgVGhhdCBwYXJ0IGNvbmZ1c2VzIG1lLCBzaW5jZSDigJx0b28gc21hbGwgdG8gZW5j cnlwdOKAnSB3YXMgYSByZWFzb24gZ2l2ZW4uDQo= --_000_DM5PR2201MB14331CB8DFA008037C716C4099310DM5PR2201MB1433_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 V2luZ2RpbmdzOw0KCXBhbm9zZS0xOjUgMCAwIDAgMCAwIDAgMCAwIDA7fQ0KQGZvbnQtZmFjZQ0K CXtmb250LWZhbWlseTpTaW1TdW47DQoJcGFub3NlLTE6MiAxIDYgMCAzIDEgMSAxIDEgMTt9DQpA Zm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJDYW1icmlhIE1hdGgiOw0KCXBhbm9zZS0xOjIgNCA1 IDMgNSA0IDYgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDYWxpYnJpOw0KCXBh bm9zZS0xOjIgMTUgNSAyIDIgMiA0IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IlxAU2ltU3VuIjsNCglwYW5vc2UtMToyIDEgNiAwIDMgMSAxIDEgMSAxO30NCi8qIFN0eWxlIERl ZmluaXRpb25zICovDQpwLk1zb05vcm1hbCwgbGkuTXNvTm9ybWFsLCBkaXYuTXNvTm9ybWFsDQoJ e21hcmdpbjowaW47DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMS4wcHQ7 DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0KYTpsaW5rLCBzcGFuLk1zb0h5 cGVybGluaw0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6Ymx1ZTsNCgl0ZXh0LWRl Y29yYXRpb246dW5kZXJsaW5lO30NCmE6dmlzaXRlZCwgc3Bhbi5Nc29IeXBlcmxpbmtGb2xsb3dl ZA0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6cHVycGxlOw0KCXRleHQtZGVjb3Jh dGlvbjp1bmRlcmxpbmU7fQ0KcC5Nc29MaXN0UGFyYWdyYXBoLCBsaS5Nc29MaXN0UGFyYWdyYXBo LCBkaXYuTXNvTGlzdFBhcmFncmFwaA0KCXttc28tc3R5bGUtcHJpb3JpdHk6MzQ7DQoJbWFyZ2lu LXRvcDowaW47DQoJbWFyZ2luLXJpZ2h0OjBpbjsNCgltYXJnaW4tYm90dG9tOjBpbjsNCgltYXJn aW4tbGVmdDouNWluOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTEuMHB0 Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnAubXNvbm9ybWFsMCwgbGku bXNvbm9ybWFsMCwgZGl2Lm1zb25vcm1hbDANCgl7bXNvLXN0eWxlLW5hbWU6bXNvbm9ybWFsOw0K CW1zby1zdHlsZS1wcmlvcml0eTo5OTsNCgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJn aW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0 OjBpbjsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNl cmlmO30NCnAubXNnYm9yZGVyLCBsaS5tc2dib3JkZXIsIGRpdi5tc2dib3JkZXINCgl7bXNvLXN0 eWxlLW5hbWU6bXNnYm9yZGVyOw0KCW1zby1zdHlsZS1wcmlvcml0eTo5OTsNCgltc28tbWFyZ2lu LXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4tYm90dG9tLWFs dDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFt aWx5OiJUaW1lcyBOZXcgUm9tYW4iLHNlcmlmO30NCnNwYW4uZ3JvdXB3aXNlcmVwbHloZWFkZXIN Cgl7bXNvLXN0eWxlLW5hbWU6Z3JvdXB3aXNlcmVwbHloZWFkZXI7fQ0Kc3Bhbi5FbWFpbFN0eWxl MjENCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWw7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNh bnMtc2VyaWY7DQoJY29sb3I6IzFGNDk3RDsNCglmb250LXdlaWdodDpub3JtYWw7DQoJZm9udC1z dHlsZTpub3JtYWw7DQoJdGV4dC1kZWNvcmF0aW9uOm5vbmUgbm9uZTt9DQpzcGFuLkVtYWlsU3R5 bGUyMg0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIs c2Fucy1zZXJpZjsNCgljb2xvcjp3aW5kb3d0ZXh0O30NCnNwYW4uRW1haWxTdHlsZTIzDQoJe21z by1zdHlsZS10eXBlOnBlcnNvbmFsOw0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlm Ow0KCWNvbG9yOiMxRjQ5N0Q7DQoJZm9udC13ZWlnaHQ6bm9ybWFsOw0KCWZvbnQtc3R5bGU6bm9y bWFsOw0KCXRleHQtZGVjb3JhdGlvbjpub25lIG5vbmU7fQ0Kc3Bhbi5FbWFpbFN0eWxlMjQNCgl7 bXNvLXN0eWxlLXR5cGU6cGVyc29uYWw7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2Vy aWY7DQoJY29sb3I6d2luZG93dGV4dDt9DQpzcGFuLkVtYWlsU3R5bGUyNQ0KCXttc28tc3R5bGUt dHlwZTpwZXJzb25hbDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xv cjp3aW5kb3d0ZXh0O30NCnNwYW4uRW1haWxTdHlsZTI2DQoJe21zby1zdHlsZS10eXBlOnBlcnNv bmFsOw0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOiMxRjQ5N0Q7 fQ0Kc3Bhbi5FbWFpbFN0eWxlMjcNCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWw7DQoJZm9udC1m YW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6d2luZG93dGV4dDt9DQpzcGFuLkVt YWlsU3R5bGUyOA0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1yZXBseTsNCglmb250LWZhbWls eToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjojMUY0OTdEO30NCi5Nc29DaHBEZWZhdWx0 DQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7fQ0KQHBh Z2UgV29yZFNlY3Rpb24xDQoJe3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBp biAxLjBpbiAxLjBpbjt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30N Ci8qIExpc3QgRGVmaW5pdGlvbnMgKi8NCkBsaXN0IGwwDQoJe21zby1saXN0LWlkOjE2NTMyMTUy MjM7DQoJbXNvLWxpc3QtdGVtcGxhdGUtaWRzOjE5MTQ1OTIwNjQ7fQ0KQGxpc3QgbDA6bGV2ZWwx DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7 DQoJbXNvLWxldmVsLXRhYi1zdG9wOi41aW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjps ZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0K CWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMDpsZXZlbDINCgl7bXNvLWxldmVsLW51bWJl ci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0 b3A6MS4waW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50 Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OlN5bWJv bDt9DQpAbGlzdCBsMDpsZXZlbDMNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0K CW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6MS41aW47DQoJbXNvLWxl dmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5z aS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMDpsZXZl bDQNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+C tzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6Mi4waW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlv bjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0 Ow0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMDpsZXZlbDUNCgl7bXNvLWxldmVsLW51 bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFi LXN0b3A6Mi41aW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5k ZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OlN5 bWJvbDt9DQpAbGlzdCBsMDpsZXZlbDYNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0 Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6My4waW47DQoJbXNv LWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28t YW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMDps ZXZlbDcNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0 Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6My41aW47DQoJbXNvLWxldmVsLW51bWJlci1wb3Np dGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAu MHB0Ow0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMDpsZXZlbDgNCgl7bXNvLWxldmVs LW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwt dGFiLXN0b3A6NC4waW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQt aW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5 OlN5bWJvbDt9DQpAbGlzdCBsMDpsZXZlbDkNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVs bGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6NC41aW47DQoJ bXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglt c28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBs MQ0KCXttc28tbGlzdC1pZDoxNzgwOTA0OTczOw0KCW1zby1saXN0LXR5cGU6aHlicmlkOw0KCW1z by1saXN0LXRlbXBsYXRlLWlkczotMTA3NjQ4MTk1NiAxMjYyMjcwNTIwIDY3Njk4NjkxIDY3Njk4 NjkzIDY3Njk4Njg5IDY3Njk4NjkxIDY3Njk4NjkzIDY3Njk4Njg5IDY3Njk4NjkxIDY3Njk4Njkz O30NCkBsaXN0IGwxOmxldmVsMQ0KCXttc28tbGV2ZWwtc3RhcnQtYXQ6MDsNCgltc28tbGV2ZWwt bnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674OYOw0KCW1zby1sZXZlbC10 YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWlu ZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzOw0KCW1zby1mYXJlYXN0LWZvbnQt ZmFtaWx5OkNhbGlicmk7DQoJbXNvLWJpZGktZm9udC1mYW1pbHk6Q2FsaWJyaTt9DQpAbGlzdCBs MTpsZXZlbDINCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10 ZXh0Om87DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3Np dGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseToiQ291cmllciBO ZXciO30NCkBsaXN0IGwxOmxldmVsMw0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7 DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1s ZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1m YW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwxOmxldmVsNA0KCXttc28tbGV2ZWwtbnVtYmVyLWZv cm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDpu b25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1 aW47DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwxOmxldmVsNQ0KCXttc28tbGV2ZWwt bnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6bzsNCgltc28tbGV2ZWwtdGFi LXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRl bnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyI7fQ0KQGxpc3QgbDE6bGV2ZWw2 DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7 DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjps ZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxp c3QgbDE6bGV2ZWw3DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2 ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJl ci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseTpTeW1i b2w7fQ0KQGxpc3QgbDE6bGV2ZWw4DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsN Cgltc28tbGV2ZWwtdGV4dDpvOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZl bC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1p bHk6IkNvdXJpZXIgTmV3Ijt9DQpAbGlzdCBsMTpsZXZlbDkNCgl7bXNvLWxldmVsLW51bWJlci1m b3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6 bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4y NWluOw0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpvbA0KCXttYXJnaW4tYm90dG9tOjBpbjt9 DQp1bA0KCXttYXJnaW4tYm90dG9tOjBpbjt9DQotLT48L3N0eWxlPjwhLS1baWYgZ3RlIG1zbyA5 XT48eG1sPg0KPG86c2hhcGVkZWZhdWx0cyB2OmV4dD0iZWRpdCIgc3BpZG1heD0iMTAyNiIgLz4N CjwveG1sPjwhW2VuZGlmXS0tPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVsYXlv dXQgdjpleHQ9ImVkaXQiPg0KPG86aWRtYXAgdjpleHQ9ImVkaXQiIGRhdGE9IjEiIC8+DQo8L286 c2hhcGVsYXlvdXQ+PC94bWw+PCFbZW5kaWZdLS0+DQo8L2hlYWQ+DQo8Ym9keSBsYW5nPSJFTi1V UyIgbGluaz0iYmx1ZSIgdmxpbms9InB1cnBsZSI+DQo8ZGl2IGNsYXNzPSJXb3JkU2VjdGlvbjEi Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMxRjQ5N0QiPkhpIFJp Y2gsPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImNvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMUY0OTdEIj5NMk0gbWlnaHQgYmUgY29t bW9uIFRMUywgYnV0IHdpdGggc29tZXRoaW5nIGVsc2UgYXQgdGhlIGFwcGxpY2F0aW9uIGxheWVy LiZuYnNwOyBJ4oCZbGwgZ2l2ZSB0aGlzIGV4YW1wbGUsIGJ1dCBhZG1pdHRlZGx5IHRoZSB0ZXJt aW5vbG9neSBpcyBjb25mdXNpbmc6IHRoZXJlIGlzIGFub3RoZXIgcHJvdG9jb2wgdGhhdCBpcyBj YWxsZWQgRXRoZXJOZXQvSVAgKGhlcmUgSVAgc3RhbmRzDQogZm9yIEluZHVzdHJpYWwgUHJvdG9j b2wsIGhlbmNlIHRoZSBjb25jZXJuIGFib3V0IGNvbmZ1c2lvbikuIEluIHRoaXMgY2FzZSB0aGlz IHByb3RvY29sIGlzIGJ1aWx0IHVwb24gVENQIGFuZCBVRFAsIGJ1dCB0aGVuIGFib3ZlIHRoYXQg dGhlcmUgaXMgYSBkaWZmZXJlbnQgcHJvdG9jb2wgbWVhbnQgZm9yIG1hY2hpbmUgdG8gbWFjaGlu ZSBjb21tdW5pY2F0aW9uIHRoYXQgd2lsbCBlbmFibGUgYSBudW1iZXIgb2YgaW5kdXN0cmlhbCBh cHBsaWNhdGlvbnMuJm5ic3A7DQogV2hhdCB3ZSBkaWQgaW4gT0RWQSB3YXMgdG8gYWRkIFRMUyAo YW5kIERUTFMgaW4gc29tZSBjYXNlcykgdG8gcHJvdGVjdCB0aGlzIGNvbW11bmljYXRpb24uJm5i c3A7IFRoaXMgY29tbXVuaWNhdGlvbiBpcyBvZnRlbiBoaWdoIHNwZWVkIGFuZCBsYXRlbmN5IGlz IGEgbWFqb3IgY29uY2Vybi4mbmJzcDsgU28gaXQgaXMgc3RhbmRhcmQgVExTLCBidXQgcmF0aGVy IHRoYW4gSFRUUCBvbiB0b3Agb2YgdGhlIFRMUywgaXQgaXMgYW4gSW5kdXN0cmlhbCBQcm90b2Nv bC4mbmJzcDsNCiBFdmVuIGlmIHRoZSBkZXZpY2UgaXMg4oCcY2FwYWJsZeKAnSBvZiBlbmNyeXB0 aW9uLCBlbmNyeXB0aW5nIHRoZSBkYXRhIGFkZHMgb3ZlcmhlYWQgYW5kIGlzIHVubmVjZXNzYXJ5 IGluIHNvbWUgYXBwbGljYXRpb25zLiZuYnNwOyBTbyBjYXBhYmxlIG1pZ2h0IG1lYW4gaXQgY2Fu IGRvIGVuY3J5cHRpb24sIGJ1dCBub3QgYXQgdGhlIHNwZWVkcyBuZWNlc3NhcnkgZm9yIG1hY2hp bmUgdG8gbWFjaGluZSBJL08uPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMUY0OTdEIj5U aGFua3MgYW5kIEJlc3QgUmVnYXJkcyw8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48 L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMxRjQ5 N0QiPi0tSmFjazxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8 ZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjRTFFMUUxIDEu MHB0O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+ RnJvbTo8L2I+IFNhbHosIFJpY2ggW21haWx0bzpyc2FsekBha2FtYWkuY29tXSA8YnI+DQo8Yj5T ZW50OjwvYj4gVHVlc2RheSwgQXVndXN0IDIxLCAyMDE4IDE6NDYgUE08YnI+DQo8Yj5Ubzo8L2I+ IEphY2sgVmlzb2t5ICZsdDtqbXZpc29reUByYS5yb2Nrd2VsbC5jb20mZ3Q7OyBTYWx6LCBSaWNo ICZsdDtyc2Fsej00MGFrYW1haS5jb21AZG1hcmMuaWV0Zi5vcmcmZ3Q7OyBGcmllcywgU3RlZmZl biAmbHQ7c3RlZmZlbi5mcmllc0BzaWVtZW5zLmNvbSZndDs8YnI+DQo8Yj5DYzo8L2I+IG5jYW13 aW5nPTQwY2lzY28uY29tQGRtYXJjLmlldGYub3JnOyB0bHNAaWV0Zi5vcmc8YnI+DQo8Yj5TdWJq ZWN0OjwvYj4gUmU6IFtUTFNdIEVYVEVSTkFMOiBSZTogaW50ZWdyaXR5IG9ubHkgY2lwaGVyc3Vp dGVzPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2lu LWxlZnQ6LjVpbjt0ZXh0LWluZGVudDotLjI1aW47bXNvLWxpc3Q6bDEgbGV2ZWwxIGxmbzMiPg0K PCFbaWYgIXN1cHBvcnRMaXN0c10+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OldpbmdkaW5ncyI+ PHNwYW4gc3R5bGU9Im1zby1saXN0Oklnbm9yZSI+w5g8c3BhbiBzdHlsZT0iZm9udDo3LjBwdCAm cXVvdDtUaW1lcyBOZXcgUm9tYW4mcXVvdDsiPiZuYnNwOw0KPC9zcGFuPjwvc3Bhbj48L3NwYW4+ PCFbZW5kaWZdPjxzcGFuIHN0eWxlPSJjb2xvcjojMUY0OTdEIj5J4oCZbSBub3Qgc3VyZSBpZiBJ 4oCZbSBmb2xsb3dpbmcgdGhlIHF1ZXN0aW9uLCBidXQgd2hhdCB3YXMgbWVhbnQgd2FzIHRoYXQg dGhlc2UgY2lwaGVycyBhcmUgZ2VuZXJhbGx5IE5PVCB1c2VkIGZvciBicm93c2VyIGFjY2Vzcy4g Jm5ic3A7TWFjaGluZSB0byBtYWNoaW5lIGNvbW11bmljYXRpb24gdXN1YWxseSBkb2VzIG5vdCBp bnZvbHZlIGEgYnJvd3Nlci4mbmJzcDsNCiBBcG9sb2dpZXMgaWYgSeKAmXZlIG1pc3VuZGVyc3Rv b2QgdGhlIHF1ZXN0aW9uLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMUY0OTdEIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5Zb3UgdW5kZXJzdG9vZCBtZS4mbmJzcDsgU28gdGhl IGRldmljZXMgKG9yIHJhdGhlciBhdCBsZWFzdCBzb21lIG9mIHRoZW0gc2luY2UgdGhleSBhcmUg c3BsZW5kaWZlcm91cyBpbiB0aGVpciB2YXJpYW5jZXMpIGRvIHNwZWFrIGNvbW1vbiBUTFMuJm5i c3A7IEJ1dCBub3QgZm9yIE0yTS4mbmJzcDsgVGhhdCBwYXJ0IGNvbmZ1c2VzIG1lLCBzaW5jZSDi gJx0b28gc21hbGwgdG8gZW5jcnlwdOKAnSB3YXMgYSByZWFzb24gZ2l2ZW4uPG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_DM5PR2201MB14331CB8DFA008037C716C4099310DM5PR2201MB1433_-- From nobody Tue Aug 21 11:08:32 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8B007130DF0 for ; Tue, 21 Aug 2018 11:08:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IqRqu-k6y_Dv for ; Tue, 21 Aug 2018 11:08:27 -0700 (PDT) Received: from NAM01-SN1-obe.outbound.protection.outlook.com (mail-sn1nam01on0065.outbound.protection.outlook.com [104.47.32.65]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E38AC130E7B for ; Tue, 21 Aug 2018 11:08:26 -0700 (PDT) Received: from DM5PR2201MB1433.namprd22.prod.outlook.com (10.174.186.154) by DM5PR2201MB1722.namprd22.prod.outlook.com (10.164.253.156) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1080.14; Tue, 21 Aug 2018 18:08:25 +0000 Received: from DM5PR2201MB1433.namprd22.prod.outlook.com ([fe80::49f1:7875:b984:9a65]) by DM5PR2201MB1433.namprd22.prod.outlook.com ([fe80::49f1:7875:b984:9a65%2]) with mapi id 15.20.1059.023; Tue, 21 Aug 2018 18:08:25 +0000 From: Jack Visoky To: Ted Lemon CC: "Salz, Rich" , "Fries, Steffen" , "ncamwing=40cisco.com@dmarc.ietf.org" , "tls@ietf.org" Thread-Topic: [TLS] EXTERNAL: Re: integrity only ciphersuites Thread-Index: AQHUOXX4D/UPTTu0A0yVJYh9fFiMkqTKfBBAgAABlQCAAAFQwA== Date: Tue, 21 Aug 2018 18:08:25 +0000 Message-ID: References: <64d23891-2f32-9bb8-1ec8-f4fad13cdfb9@cs.tcd.ie> <982363FD-A839-4175-BA53-7CA242F9ADA6@ll.mit.edu> <2D7F2926-6376-4B2C-BDE9-7A6F1C0FA748@gmail.com> <5B7C1571020000AC0015C330@gwia2.rz.hs-offenburg.de> <8A2746A8-6B41-45C3-9D77-6AF3536C6E2D@siemens.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=jmvisoky@ra.rockwell.com; x-originating-ip: [205.175.250.246] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; DM5PR2201MB1722; 6:yyMeo/3pNS1ZjeFPJvkv03+LXmw3iIVoDgMptERyI0skFobmZi8MB/oKZyuRCDh/4Oj1D4iBhX/+Ub01wtFMKSQoJLI5+btTfOuv50/jj+sjMQrGnJSyHiCAbO4ieie7xCmws/t8DSRsC6IJ+ERvQg9MXWbIc6EdvW7Dnerbr8xukA890Qb7H1sJhFYSGzWI7UrwjBoSvBQgFwxU5KE1H6l9D3QnCRgvyoux1Q9Z/mvm0md0Z3DJWk1nFBM1F7YEfuCdF1FUyUEWJsM3uImvqtbwlZ/uv+96MlVzl/KdzJNR1QsXJ1jExLj1LQRz0pxPOieFKvTbwpAX0qgZsz8TmkFNgHiAQKs3eVCeQXpGl7k8VwwXQs6QzDViQabG9Zor9p5u9hfgCdIINRFcH1CIzaEcx/Wda/v8MHfvDUA9BOhusS4A+GRdl3kulrduJ0NQskMqxjwg+J7Mzj4Rb0nvGg==; 5:Gr8PBotb59Sc+DdOGUL/p5Px8pgwt8eLn8F721jUqD83fe5ZzRAsa67we7HISEsisVVq09p5Uh6KR5zpXn4aW4NaLvpQWbHleqT3iTgHY6Gl418qbBOqH4piNo0+IM0NoOZS41Wj5dhRLQaqcSxlmT9o+2f7/YkGWirPJrciW6Y=; 7:ZlPiPL9mSuvDu5QZex60F9ZTRSQR4DnlB3dUqFBU7GWdNQud2DyraIr4WKrZUmXtnB+g09ECbeRgoZmlPKIcn+d/n/FTsDTzbxMGMEGOULn9FBOep8jMTiyyy95bQKv/C+q7FotYbu8L3Q3CG9KGnH29zZUWTULG38l+jNtVxGq/MX9BwU6B34xmGIF1JcCqmk9h3Q3M/XgbiJQXG1WgktQBMnNigmOJm4MJMi+KSS3RpwyepAFxF6MEpHRZNQ4I x-ms-exchange-antispam-srfa-diagnostics: SOS; x-ms-office365-filtering-correlation-id: 2ee91c46-934c-45ec-5b98-08d6079116f5 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(7020095)(4652040)(8989137)(4534165)(4627221)(201703031133081)(201702281549075)(8990107)(5600074)(711020)(4618075)(2017052603328)(7153060)(7193020); SRVR:DM5PR2201MB1722; x-ms-traffictypediagnostic: DM5PR2201MB1722: x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(28532068793085)(181554191321653)(269231077054813)(126837547833334)(21748063052155)(33711482430040); x-ms-exchange-senderadcheck: 1 x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(8211001083)(6040522)(2401047)(5005006)(8121501046)(3002001)(93006095)(93001095)(10201501046)(3231311)(944501410)(52105095)(6055026)(149027)(150027)(6041310)(20161123562045)(20161123564045)(20161123560045)(20161123558120)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(201708071742011)(7699016); SRVR:DM5PR2201MB1722; BCL:0; PCL:0; RULEID:; SRVR:DM5PR2201MB1722; x-forefront-prvs: 0771670921 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(396003)(366004)(346002)(136003)(376002)(39860400002)(199004)(189003)(93886005)(606006)(3846002)(7736002)(105586002)(6916009)(316002)(86362001)(106356001)(6116002)(790700001)(5024004)(256004)(102836004)(8936002)(19609705001)(14444005)(446003)(53546011)(11346002)(6506007)(26005)(2900100001)(68736007)(476003)(66066001)(186003)(486006)(966005)(25786009)(2906002)(97736004)(4326008)(5250100002)(6246003)(33656002)(236005)(6436002)(76176011)(99286004)(5660300001)(8676002)(81156014)(81166006)(478600001)(14454004)(229853002)(53936002)(9686003)(54906003)(7696005)(74316002)(54896002)(6306002)(55016002); DIR:OUT; SFP:1101; SCL:1; SRVR:DM5PR2201MB1722; H:DM5PR2201MB1433.namprd22.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: ra.rockwell.com does not designate permitted sender hosts) x-microsoft-antispam-message-info: 8kZs0frMYfcsOtZuhfp5sd9jMlUXPUChy4cFGk6HAossPQcto05wZK1c3LHdUFqGoMHpC57tBdoQcQn6NunJdNTYrgp+vRVjr3vN5b0Lk9RHKM3QykGkqfMHjGnPnTrdSqLmy/8cY4pnHID/4Pk4nnGWmdX+wOUmpjBu749nYoxi0vsGeXYDys8rO08ryjuNvycI8S4NLGtMXbxdyUhdz0Y4Jr/KMbFsRTlxS9uKK4xkNBZ8lGCBls9YLTMIIXNGquD72RdCS3y9GbzuoPUMy8Lg9L92k6epqErgtykpe0NiNyvRzUeY9Sp3aTHqv1lMA6uNAZEyOHsysjNHoFtcuSjsqWAeMhk26V1vsD56Csg= spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_DM5PR2201MB1433E09B441548D8E482EDD599310DM5PR2201MB1433_" MIME-Version: 1.0 X-OriginatorOrg: ra.rockwell.com X-MS-Exchange-CrossTenant-Network-Message-Id: 2ee91c46-934c-45ec-5b98-08d6079116f5 X-MS-Exchange-CrossTenant-originalarrivaltime: 21 Aug 2018 18:08:25.4773 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 855b093e-7340-45c7-9f0c-96150415893e X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM5PR2201MB1722 Archived-At: Subject: Re: [TLS] EXTERNAL: Re: integrity only ciphersuites X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Aug 2018 18:08:31 -0000 --_000_DM5PR2201MB1433E09B441548D8E482EDD599310DM5PR2201MB1433_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Q291bGQgeW91IHBsZWFzZSBjbGFyaWZ5IG9uIHdoYXQgeW91IG1lYW4gYnkgYmFuZHdpZHRoPyAg QXJlIHlvdSB0YWxraW5nIGFib3V0IGlmIGEgZGV2aWNlIGhhcyBhIDEwMCBNYiBjb25uZWN0aW9u IG9yIDEwIE1iIGNvbm5lY3Rpb24sIG9yIHNvbWV0aGluZyBlbHNlPyAgQWxzbywgcHJvY2Vzc29y IHNwZWVkIGFuZCBkZXZpY2UgY2FwYWJpbGl0eSBpcyBvZnRlbiBhIGxpbWl0aW5nIGZhY3RvciBz byBJ4oCZbSBub3Qgc3VyZSBob3cgcmVsZXZhbnQgYmFuZHdpZHRoIGlzLCBidXQgSSBtaWdodCBq dXN0IG5vdCBiZSBmb2xsb3dpbmcgeW91ciB0cmFpbiBvZiB0aG91Z2h0Lg0KDQpJUHNlYyB3YXMg c29tZXRoaW5nIHRoYXQgd2FzIGxvb2tlZCBhdCBpdCBkZXRhaWwsIGFuZCB0cmllZCBpbiBzb21l IGluc3RhbGxhdGlvbnMuICBJdCBjZXJ0YWlubHkgaGFzIGEgcGxhY2UgYnV0IHdl4oCZdmUgZm91 bmQgaXTigJlzIG5vdCBhcyBnZW5lcmFsbHkgYXBwbGljYWJsZSBhcyBUTFMuICBSZWFzb25zIGhh dmUgdG8gZG8gd2l0aCB0aGUgY29tcGxleGl0eSBvZiBjb25maWd1cmF0aW9uIGFzIHdlbGwgYXMg ZGlmZmljdWx0eSBzZXR0aW5nIHVwIHRoZSBuZXR3b3JrLiAgQW5vdGhlciB3YXkgdG8gcHV0IHRo aXMgaXMgdGhhdCB0aGUgbWFya2V0IHdhcyBub3QgcmVjZXB0aXZlIHRvIElQc2VjIGFzIGEgZ2Vu ZXJhbCBzb2x1dGlvbi4NCg0KSW4gZ2VuZXJhbCB3ZSBoYXZlIGEgbG90IG9mIHJlc3BlY3QgZm9y IHdoYXQgd2FzIGRvbmUgd2l0aCBUTFMgYW5kIGl04oCZcyB3aWRlIGFkb3B0aW9uLiAgV2XigJl2 ZSBhZG9wdGVkIGl0IGluIGEgbnVtYmVyIG9mIHByb3RvY29scyB1bmRlciBUTFMgMS4yIGFuZCB3 b3VsZCBsaWtlIHRvIGRvIHRoZSBzYW1lIHdpdGggVExTIDEuMy4NCg0KVGhhbmtzIGFuZCBCZXN0 IFJlZ2FyZHMsDQoNCi0tSmFjaw0KDQpGcm9tOiBUZWQgTGVtb24gW21haWx0bzptZWxsb25AZnVn dWUuY29tXQ0KU2VudDogVHVlc2RheSwgQXVndXN0IDIxLCAyMDE4IDE6NTYgUE0NClRvOiBKYWNr IFZpc29reSA8am12aXNva3lAcmEucm9ja3dlbGwuY29tPg0KQ2M6IFNhbHosIFJpY2ggPHJzYWx6 PTQwYWthbWFpLmNvbUBkbWFyYy5pZXRmLm9yZz47IEZyaWVzLCBTdGVmZmVuIDxzdGVmZmVuLmZy aWVzQHNpZW1lbnMuY29tPjsgbmNhbXdpbmc9NDBjaXNjby5jb21AZG1hcmMuaWV0Zi5vcmc7IHRs c0BpZXRmLm9yZw0KU3ViamVjdDogUmU6IFtUTFNdIEVYVEVSTkFMOiBSZTogaW50ZWdyaXR5IG9u bHkgY2lwaGVyc3VpdGVzDQoNCldoYXQga2luZCBvZiBiYW5kd2lkdGggYXJlIHdlIHRhbGtpbmcg YWJvdXQgaGVyZT8gICBBbHNvLCBjb3VsZCB5b3UgYW5zd2VyIG15IHF1ZXN0aW9uIGFib3V0IElQ c2VjPw0KDQpPbiBUdWUsIEF1ZyAyMSwgMjAxOCBhdCAxOjUzIFBNLCBKYWNrIFZpc29reSA8am12 aXNva3lAcmEucm9ja3dlbGwuY29tPG1haWx0bzpqbXZpc29reUByYS5yb2Nrd2VsbC5jb20+PiB3 cm90ZToNCkhpIFRlZCwNCg0KQSBmZXcgcG9pbnRzOg0KDQoNCjEuICAgICAgIERvbuKAmXQgYXNz dW1lIHRoZXJlIGlzIGFueSBicm93c2VyIGludm9sdmVkLiAgVGhlcmUgaXMgb2Z0ZW4gbm8gYnJv d3Nlci4NCg0KMi4gICAgICAgRXZlbiBpZiB0aGVyZSBpcyBhIGJyb3dzZXIgKGFuZCBzZWUgcG9p bnQgMSBiZWZvcmUgYXNzdW1pbmcpIGFueSBIVFRQIGNvbW11bmljYXRpb24gd291bGQgYmUgYXQg YSBtdWNoIG11Y2ggc2xvd2VyIHJhdGUgdGhhbiBtYWNoaW5lIHRvIG1hY2hpbmUgSS9PDQoNCkhv cGUgdGhhdCBjbGVhcnMgaXQgdXAuDQoNClRoYW5rcyBhbmQgQmVzdCBSZWdhcmRzLA0KDQotLUph Y2sNCg0KRnJvbTogVGVkIExlbW9uIFttYWlsdG86bWVsbG9uQGZ1Z3VlLmNvbTxtYWlsdG86bWVs bG9uQGZ1Z3VlLmNvbT5dDQpTZW50OiBUdWVzZGF5LCBBdWd1c3QgMjEsIDIwMTggMTozOSBQTQ0K VG86IEphY2sgVmlzb2t5IDxqbXZpc29reUByYS5yb2Nrd2VsbC5jb208bWFpbHRvOmptdmlzb2t5 QHJhLnJvY2t3ZWxsLmNvbT4+DQpDYzogU2FseiwgUmljaCA8cnNhbHo9NDBha2FtYWkuY29tQGRt YXJjLmlldGYub3JnPG1haWx0bzo0MGFrYW1haS5jb21AZG1hcmMuaWV0Zi5vcmc+PjsgRnJpZXMs IFN0ZWZmZW4gPHN0ZWZmZW4uZnJpZXNAc2llbWVucy5jb208bWFpbHRvOnN0ZWZmZW4uZnJpZXNA c2llbWVucy5jb20+PjsgbmNhbXdpbmc9NDBjaXNjby5jb21AZG1hcmMuaWV0Zi5vcmc8bWFpbHRv OjQwY2lzY28uY29tQGRtYXJjLmlldGYub3JnPjsgdGxzQGlldGYub3JnPG1haWx0bzp0bHNAaWV0 Zi5vcmc+DQpTdWJqZWN0OiBSZTogW1RMU10gRVhURVJOQUw6IFJlOiBpbnRlZ3JpdHkgb25seSBj aXBoZXJzdWl0ZXMNCg0KSWYgdGhlIGRldmljZSBpbXBsZW1lbnRzIHRoZSBjaXBoZXIgc28gYXMg dG8gdGFsayB0byB0aGUgYnJvd3NlciwgaXQncyBjbGVhcmx5IGNhcGFibGUgb2YgaW1wbGVtZW50 aW5nIHRoZSBjaXBoZXIuLi4NCg0KT24gVHVlLCBBdWcgMjEsIDIwMTggYXQgMTozNCBQTSwgSmFj ayBWaXNva3kgPGptdmlzb2t5QHJhLnJvY2t3ZWxsLmNvbTxtYWlsdG86am12aXNva3lAcmEucm9j a3dlbGwuY29tPj4gd3JvdGU6DQpIaSBSaWNoLA0KDQpJ4oCZbSBub3Qgc3VyZSBpZiBJ4oCZbSBm b2xsb3dpbmcgdGhlIHF1ZXN0aW9uLCBidXQgd2hhdCB3YXMgbWVhbnQgd2FzIHRoYXQgdGhlc2Ug Y2lwaGVycyBhcmUgZ2VuZXJhbGx5IE5PVCB1c2VkIGZvciBicm93c2VyIGFjY2Vzcy4gIE1hY2hp bmUgdG8gbWFjaGluZSBjb21tdW5pY2F0aW9uIHVzdWFsbHkgZG9lcyBub3QgaW52b2x2ZSBhIGJy b3dzZXIuICBBcG9sb2dpZXMgaWYgSeKAmXZlIG1pc3VuZGVyc3Rvb2QgdGhlIHF1ZXN0aW9uLg0K DQpUaGFua3MgYW5kIEJlc3QgUmVnYXJkcywNCg0KLS1KYWNrDQoNCkZyb206IFRMUyBbbWFpbHRv OnRscy1ib3VuY2VzQGlldGYub3JnPG1haWx0bzp0bHMtYm91bmNlc0BpZXRmLm9yZz5dIE9uIEJl aGFsZiBPZiBTYWx6LCBSaWNoDQpTZW50OiBUdWVzZGF5LCBBdWd1c3QgMjEsIDIwMTggMToxMiBQ TQ0KVG86IEZyaWVzLCBTdGVmZmVuIDxzdGVmZmVuLmZyaWVzQHNpZW1lbnMuY29tPG1haWx0bzpz dGVmZmVuLmZyaWVzQHNpZW1lbnMuY29tPj4NCkNjOiBuY2Ftd2luZz00MGNpc2NvLmNvbUBkbWFy Yy5pZXRmLm9yZzxtYWlsdG86NDBjaXNjby5jb21AZG1hcmMuaWV0Zi5vcmc+OyB0bHNAaWV0Zi5v cmc8bWFpbHRvOnRsc0BpZXRmLm9yZz4NClN1YmplY3Q6IEVYVEVSTkFMOiBSZTogW1RMU10gaW50 ZWdyaXR5IG9ubHkgY2lwaGVyc3VpdGVzDQoNCg0KW1VzZSBjYXV0aW9uIHdpdGggbGlua3MgJiBh dHRhY2htZW50c10NCg0KDQpOb3cgSSB0aGluayBJIGFtIGFzIGNvbmZ1c2VkIGFzIFN0ZXBoZW4g YW5kIG90aGVycy4NCg0KT25lIGp1c3RpZmljYXRpb24gd2FzIOKAnHNtYWxsIGZvb3RwcmludC7i gJ0gIEJ1dCBub3cgeW914oCZcmUgc2F5aW5nIHRoYXQgZm9yIGRlYnVnZ2luZyBlbmNyeXB0aW9u IChzdGFuZGFyZD8pIGNpcGhlcnMgYXJlIHVzZWQgZm9yIGJyb3dzZXIgYWNjZXNzPw0KDQoNCl9f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQpUTFMgbWFpbGlu ZyBsaXN0DQpUTFNAaWV0Zi5vcmc8bWFpbHRvOlRMU0BpZXRmLm9yZz4NCmh0dHBzOi8vd3d3Lmll dGYub3JnL21haWxtYW4vbGlzdGluZm8vdGxzDQoNCg0K --_000_DM5PR2201MB1433E09B441548D8E482EDD599310DM5PR2201MB1433_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 U2ltU3VuOw0KCXBhbm9zZS0xOjIgMSA2IDAgMyAxIDEgMSAxIDE7fQ0KQGZvbnQtZmFjZQ0KCXtm b250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2IDMgMiA0 O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1IDUg MiAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJcQFNpbVN1biI7DQoJ cGFub3NlLTE6MiAxIDYgMCAzIDEgMSAxIDEgMTt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0K cC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0K CW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5 OiJUaW1lcyBOZXcgUm9tYW4iLHNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7 bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVu ZGVybGluZTt9DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0 eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJs aW5lO30NCnANCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCW1zby1tYXJnaW4tdG9wLWFsdDph dXRvOw0KCW1hcmdpbi1yaWdodDowaW47DQoJbXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87DQoJ bWFyZ2luLWxlZnQ6MGluOw0KCWZvbnQtc2l6ZToxMi4wcHQ7DQoJZm9udC1mYW1pbHk6IlRpbWVz IE5ldyBSb21hbiIsc2VyaWY7fQ0KcC5tNzczNDY2MDc0NzQ2MTE0ODkzMW1zb2xpc3RwYXJhZ3Jh cGgsIGxpLm03NzM0NjYwNzQ3NDYxMTQ4OTMxbXNvbGlzdHBhcmFncmFwaCwgZGl2Lm03NzM0NjYw NzQ3NDYxMTQ4OTMxbXNvbGlzdHBhcmFncmFwaA0KCXttc28tc3R5bGUtbmFtZTptXzc3MzQ2NjA3 NDc0NjExNDg5MzFtc29saXN0cGFyYWdyYXBoOw0KCW1zby1tYXJnaW4tdG9wLWFsdDphdXRvOw0K CW1hcmdpbi1yaWdodDowaW47DQoJbXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87DQoJbWFyZ2lu LWxlZnQ6MGluOw0KCWZvbnQtc2l6ZToxMi4wcHQ7DQoJZm9udC1mYW1pbHk6IlRpbWVzIE5ldyBS b21hbiIsc2VyaWY7fQ0KcC5tNzczNDY2MDc0NzQ2MTE0ODkzMW0tNzQwNDY5NjE0NTA4Nzg2MTUx N21zZ2JvcmRlciwgbGkubTc3MzQ2NjA3NDc0NjExNDg5MzFtLTc0MDQ2OTYxNDUwODc4NjE1MTdt c2dib3JkZXIsIGRpdi5tNzczNDY2MDc0NzQ2MTE0ODkzMW0tNzQwNDY5NjE0NTA4Nzg2MTUxN21z Z2JvcmRlcg0KCXttc28tc3R5bGUtbmFtZTptXzc3MzQ2NjA3NDc0NjExNDg5MzFtLTc0MDQ2OTYx NDUwODc4NjE1MTdtc2dib3JkZXI7DQoJbXNvLW1hcmdpbi10b3AtYWx0OmF1dG87DQoJbWFyZ2lu LXJpZ2h0OjBpbjsNCgltc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzsNCgltYXJnaW4tbGVmdDow aW47DQoJZm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIixz ZXJpZjt9DQpzcGFuLkVtYWlsU3R5bGUyMA0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1yZXBs eTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjojMUY0OTdEO30N Ci5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0KCWZvbnQtZmFt aWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjgu NWluIDExLjBpbjsNCgltYXJnaW46MS4waW4gMS4waW4gMS4waW4gMS4waW47fQ0KZGl2LldvcmRT ZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQotLT48L3N0eWxlPjwhLS1baWYgZ3RlIG1z byA5XT48eG1sPg0KPG86c2hhcGVkZWZhdWx0cyB2OmV4dD0iZWRpdCIgc3BpZG1heD0iMTAyNiIg Lz4NCjwveG1sPjwhW2VuZGlmXS0tPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVs YXlvdXQgdjpleHQ9ImVkaXQiPg0KPG86aWRtYXAgdjpleHQ9ImVkaXQiIGRhdGE9IjEiIC8+DQo8 L286c2hhcGVsYXlvdXQ+PC94bWw+PCFbZW5kaWZdLS0+DQo8L2hlYWQ+DQo8Ym9keSBsYW5nPSJF Ti1VUyIgbGluaz0iYmx1ZSIgdmxpbms9InB1cnBsZSI+DQo8ZGl2IGNsYXNzPSJXb3JkU2VjdGlv bjEiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0Qi PkNvdWxkIHlvdSBwbGVhc2UgY2xhcmlmeSBvbiB3aGF0IHlvdSBtZWFuIGJ5IGJhbmR3aWR0aD8m bmJzcDsgQXJlIHlvdSB0YWxraW5nIGFib3V0IGlmIGEgZGV2aWNlIGhhcyBhIDEwMCBNYiBjb25u ZWN0aW9uIG9yIDEwIE1iIGNvbm5lY3Rpb24sIG9yIHNvbWV0aGluZyBlbHNlPyZuYnNwOyBBbHNv LA0KIHByb2Nlc3NvciBzcGVlZCBhbmQgZGV2aWNlIGNhcGFiaWxpdHkgaXMgb2Z0ZW4gYSBsaW1p dGluZyBmYWN0b3Igc28gSeKAmW0gbm90IHN1cmUgaG93IHJlbGV2YW50IGJhbmR3aWR0aCBpcywg YnV0IEkgbWlnaHQganVzdCBub3QgYmUgZm9sbG93aW5nIHlvdXIgdHJhaW4gb2YgdGhvdWdodC48 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2Vy aWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPklQc2VjIHdhcyBzb21l dGhpbmcgdGhhdCB3YXMgbG9va2VkIGF0IGl0IGRldGFpbCwgYW5kIHRyaWVkIGluIHNvbWUgaW5z dGFsbGF0aW9ucy4mbmJzcDsgSXQgY2VydGFpbmx5IGhhcyBhIHBsYWNlIGJ1dCB3ZeKAmXZlIGZv dW5kIGl04oCZcyBub3QgYXMgZ2VuZXJhbGx5IGFwcGxpY2FibGUNCiBhcyBUTFMuJm5ic3A7IFJl YXNvbnMgaGF2ZSB0byBkbyB3aXRoIHRoZSBjb21wbGV4aXR5IG9mIGNvbmZpZ3VyYXRpb24gYXMg d2VsbCBhcyBkaWZmaWN1bHR5IHNldHRpbmcgdXAgdGhlIG5ldHdvcmsuJm5ic3A7IEFub3RoZXIg d2F5IHRvIHB1dCB0aGlzIGlzIHRoYXQgdGhlIG1hcmtldCB3YXMgbm90IHJlY2VwdGl2ZSB0byBJ UHNlYyBhcyBhIGdlbmVyYWwgc29sdXRpb24uPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7 PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtj b2xvcjojMUY0OTdEIj5JbiBnZW5lcmFsIHdlIGhhdmUgYSBsb3Qgb2YgcmVzcGVjdCBmb3Igd2hh dCB3YXMgZG9uZSB3aXRoIFRMUyBhbmQgaXTigJlzIHdpZGUgYWRvcHRpb24uJm5ic3A7IFdl4oCZ dmUgYWRvcHRlZCBpdCBpbiBhIG51bWJlciBvZiBwcm90b2NvbHMgdW5kZXIgVExTIDEuMiBhbmQg d291bGQgbGlrZQ0KIHRvIGRvIHRoZSBzYW1lIHdpdGggVExTIDEuMy48bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3 RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPlRoYW5rcyBhbmQgQmVzdCBSZWdhcmRzLDxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtj b2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD YWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+LS1KYWNrPG86cD48L286cD48 L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMx RjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGli cmkmcXVvdDssc2Fucy1zZXJpZiI+RnJvbTo8L3NwYW4+PC9iPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+IFRl ZCBMZW1vbiBbbWFpbHRvOm1lbGxvbkBmdWd1ZS5jb21dDQo8YnI+DQo8Yj5TZW50OjwvYj4gVHVl c2RheSwgQXVndXN0IDIxLCAyMDE4IDE6NTYgUE08YnI+DQo8Yj5Ubzo8L2I+IEphY2sgVmlzb2t5 ICZsdDtqbXZpc29reUByYS5yb2Nrd2VsbC5jb20mZ3Q7PGJyPg0KPGI+Q2M6PC9iPiBTYWx6LCBS aWNoICZsdDtyc2Fsej00MGFrYW1haS5jb21AZG1hcmMuaWV0Zi5vcmcmZ3Q7OyBGcmllcywgU3Rl ZmZlbiAmbHQ7c3RlZmZlbi5mcmllc0BzaWVtZW5zLmNvbSZndDs7IG5jYW13aW5nPTQwY2lzY28u Y29tQGRtYXJjLmlldGYub3JnOyB0bHNAaWV0Zi5vcmc8YnI+DQo8Yj5TdWJqZWN0OjwvYj4gUmU6 IFtUTFNdIEVYVEVSTkFMOiBSZTogaW50ZWdyaXR5IG9ubHkgY2lwaGVyc3VpdGVzPG86cD48L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+V2hhdCBraW5kIG9mIGJhbmR3aWR0aCBhcmUg d2UgdGFsa2luZyBhYm91dCBoZXJlPyZuYnNwOyAmbmJzcDtBbHNvLCBjb3VsZCB5b3UgYW5zd2Vy IG15IHF1ZXN0aW9uIGFib3V0IElQc2VjPzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+T24gVHVlLCBBdWcgMjEsIDIwMTggYXQgMTo1MyBQTSwgSmFjayBWaXNv a3kgJmx0OzxhIGhyZWY9Im1haWx0bzpqbXZpc29reUByYS5yb2Nrd2VsbC5jb20iIHRhcmdldD0i X2JsYW5rIj5qbXZpc29reUByYS5yb2Nrd2VsbC5jb208L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpw PjwvcD4NCjxibG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAj Q0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7 bWFyZ2luLXJpZ2h0OjBpbiI+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZx dW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPkhpIFRlZCw8L3NwYW4+PG86cD48L286cD48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87 bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdE Ij4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5BIGZldyBwb2ludHM6PC9zcGFuPjxvOnA+PC9v OnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDph dXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFG NDk3RCI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Im03NzM0NjYwNzQ3 NDYxMTQ4OTMxbXNvbGlzdHBhcmFncmFwaCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0Qi PjEuPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6Ny4wcHQ7Y29sb3I6IzFGNDk3RCI+Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7DQo8L3NwYW4+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlm O2NvbG9yOiMxRjQ5N0QiPkRvbuKAmXQgYXNzdW1lIHRoZXJlIGlzIGFueSBicm93c2VyIGludm9s dmVkLiZuYnNwOyBUaGVyZSBpcyBvZnRlbiBubyBicm93c2VyLjwvc3Bhbj48bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJtNzczNDY2MDc0NzQ2MTE0ODkzMW1zb2xpc3RwYXJhZ3JhcGgiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj4yLjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjcuMHB0O2NvbG9yOiMxRjQ5N0QiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw Ow0KPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5FdmVuIGlmIHRoZXJlIGlz IGEgYnJvd3NlciAoYW5kIHNlZSBwb2ludCAxIGJlZm9yZSBhc3N1bWluZykgYW55IEhUVFAgY29t bXVuaWNhdGlvbiB3b3VsZCBiZSBhdCBhIG11Y2ggbXVjaCBzbG93ZXIgcmF0ZSB0aGFuIG1hY2hp bmUgdG8gbWFjaGluZSBJL088L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0 OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nh bGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj4mbmJzcDs8L3NwYW4+PG86cD48 L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0 OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjoj MUY0OTdEIj5Ib3BlIHRoYXQgY2xlYXJzIGl0IHVwLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFy Z2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPiZuYnNw Ozwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5z LXNlcmlmO2NvbG9yOiMxRjQ5N0QiPlRoYW5rcyBhbmQgQmVzdCBSZWdhcmRzLDwvc3Bhbj48bzpw PjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1h bHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9y OiMxRjQ5N0QiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6 YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2Fs aWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPi0tSmFjazwvc3Bhbj48bzpwPjwv bzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6 YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMx RjQ5N0QiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0 byI+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2Fs aWJyaSZxdW90OyxzYW5zLXNlcmlmIj5Gcm9tOjwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4g VGVkIExlbW9uIFttYWlsdG86PGEgaHJlZj0ibWFpbHRvOm1lbGxvbkBmdWd1ZS5jb20iIHRhcmdl dD0iX2JsYW5rIj5tZWxsb25AZnVndWUuY29tPC9hPl0NCjxicj4NCjxiPlNlbnQ6PC9iPiBUdWVz ZGF5LCBBdWd1c3QgMjEsIDIwMTggMTozOSBQTTxicj4NCjxiPlRvOjwvYj4gSmFjayBWaXNva3kg Jmx0OzxhIGhyZWY9Im1haWx0bzpqbXZpc29reUByYS5yb2Nrd2VsbC5jb20iIHRhcmdldD0iX2Js YW5rIj5qbXZpc29reUByYS5yb2Nrd2VsbC5jb208L2E+Jmd0Ozxicj4NCjxiPkNjOjwvYj4gU2Fs eiwgUmljaCAmbHQ7cnNhbHo9PGEgaHJlZj0ibWFpbHRvOjQwYWthbWFpLmNvbUBkbWFyYy5pZXRm Lm9yZyIgdGFyZ2V0PSJfYmxhbmsiPjQwYWthbWFpLmNvbUBkbWFyYy5pZXRmLm9yZzwvYT4mZ3Q7 OyBGcmllcywgU3RlZmZlbiAmbHQ7PGEgaHJlZj0ibWFpbHRvOnN0ZWZmZW4uZnJpZXNAc2llbWVu cy5jb20iIHRhcmdldD0iX2JsYW5rIj5zdGVmZmVuLmZyaWVzQHNpZW1lbnMuY29tPC9hPiZndDs7 IG5jYW13aW5nPTxhIGhyZWY9Im1haWx0bzo0MGNpc2NvLmNvbUBkbWFyYy5pZXRmLm9yZyIgdGFy Z2V0PSJfYmxhbmsiPjQwY2lzY28uY29tQGRtYXJjLmlldGYub3JnPC9hPjsNCjxhIGhyZWY9Im1h aWx0bzp0bHNAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj50bHNAaWV0Zi5vcmc8L2E+PGJyPg0K PGI+U3ViamVjdDo8L2I+IFJlOiBbVExTXSBFWFRFUk5BTDogUmU6IGludGVncml0eSBvbmx5IGNp cGhlcnN1aXRlczwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+ Jm5ic3A7PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj5JZiB0 aGUgZGV2aWNlIGltcGxlbWVudHMgdGhlIGNpcGhlciBzbyBhcyB0byB0YWxrIHRvIHRoZSBicm93 c2VyLCBpdCdzIGNsZWFybHkgY2FwYWJsZSBvZiBpbXBsZW1lbnRpbmcgdGhlIGNpcGhlci4uLjxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20t YWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6 YXV0byI+T24gVHVlLCBBdWcgMjEsIDIwMTggYXQgMTozNCBQTSwgSmFjayBWaXNva3kgJmx0Ozxh IGhyZWY9Im1haWx0bzpqbXZpc29reUByYS5yb2Nrd2VsbC5jb20iIHRhcmdldD0iX2JsYW5rIj5q bXZpc29reUByYS5yb2Nrd2VsbC5jb208L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjxi bG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEu MHB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXRv cDo1LjBwdDttYXJnaW4tcmlnaHQ6MGluO21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87 bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJjb2xvcjojMUY0OTdEIj5I aSBSaWNoLDwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNw YW4gc3R5bGU9ImNvbG9yOiMxRjQ5N0QiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFy Z2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImNvbG9yOiMxRjQ5N0QiPknigJltIG5v dCBzdXJlIGlmIEnigJltIGZvbGxvd2luZyB0aGUgcXVlc3Rpb24sIGJ1dCB3aGF0IHdhcyBtZWFu dCB3YXMgdGhhdCB0aGVzZSBjaXBoZXJzIGFyZSBnZW5lcmFsbHkgTk9UIHVzZWQgZm9yIGJyb3dz ZXIgYWNjZXNzLiZuYnNwOyBNYWNoaW5lIHRvIG1hY2hpbmUNCiBjb21tdW5pY2F0aW9uIHVzdWFs bHkgZG9lcyBub3QgaW52b2x2ZSBhIGJyb3dzZXIuJm5ic3A7IEFwb2xvZ2llcyBpZiBJ4oCZdmUg bWlzdW5kZXJzdG9vZCB0aGUgcXVlc3Rpb24uPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iY29sb3I6IzFGNDk3RCI+Jm5ic3A7PC9zcGFu PjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4t dG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iY29s b3I6IzFGNDk3RCI+VGhhbmtzIGFuZCBCZXN0IFJlZ2FyZHMsPC9zcGFuPjxvOnA+PC9vOnA+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21z by1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iY29sb3I6IzFGNDk3RCI+Jm5i c3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1z by1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBz dHlsZT0iY29sb3I6IzFGNDk3RCI+LS1KYWNrPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iY29sb3I6IzFGNDk3RCI+Jm5ic3A7PC9zcGFu PjxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10 b3A6c29saWQgI0UxRTFFMSAxLjBwdDtwYWRkaW5nOjMuMHB0IDBpbiAwaW4gMGluIj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2lu LWJvdHRvbS1hbHQ6YXV0byI+PGI+RnJvbTo8L2I+IFRMUyBbbWFpbHRvOjxhIGhyZWY9Im1haWx0 bzp0bHMtYm91bmNlc0BpZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPnRscy1ib3VuY2VzQGlldGYu b3JnPC9hPl0NCjxiPk9uIEJlaGFsZiBPZiA8L2I+U2FseiwgUmljaDxicj4NCjxiPlNlbnQ6PC9i PiBUdWVzZGF5LCBBdWd1c3QgMjEsIDIwMTggMToxMiBQTTxicj4NCjxiPlRvOjwvYj4gRnJpZXMs IFN0ZWZmZW4gJmx0OzxhIGhyZWY9Im1haWx0bzpzdGVmZmVuLmZyaWVzQHNpZW1lbnMuY29tIiB0 YXJnZXQ9Il9ibGFuayI+c3RlZmZlbi5mcmllc0BzaWVtZW5zLmNvbTwvYT4mZ3Q7PGJyPg0KPGI+ Q2M6PC9iPiBuY2Ftd2luZz08YSBocmVmPSJtYWlsdG86NDBjaXNjby5jb21AZG1hcmMuaWV0Zi5v cmciIHRhcmdldD0iX2JsYW5rIj40MGNpc2NvLmNvbUBkbWFyYy5pZXRmLm9yZzwvYT47DQo8YSBo cmVmPSJtYWlsdG86dGxzQGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+dGxzQGlldGYub3JnPC9h Pjxicj4NCjxiPlN1YmplY3Q6PC9iPiBFWFRFUk5BTDogUmU6IFtUTFNdIGludGVncml0eSBvbmx5 IGNpcGhlcnN1aXRlczxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRv bS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0iYm9y ZGVyOnNvbGlkICNCQjIzMjIgMi4yNXB0O3BhZGRpbmc6Mi4wcHQgMi4wcHQgMi4wcHQgMi4wcHQi Pg0KPHAgY2xhc3M9Im03NzM0NjYwNzQ3NDYxMTQ4OTMxbS03NDA0Njk2MTQ1MDg3ODYxNTE3bXNn Ym9yZGVyIiBzdHlsZT0ibGluZS1oZWlnaHQ6MTIuMHB0O2JhY2tncm91bmQ6I0U4RThFOCI+DQo8 c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1 b3Q7LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2siPltVc2UgY2F1dGlvbiB3aXRoIGxpbmtzICZhbXA7 IGF0dGFjaG1lbnRzXTwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cD4m bmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPk5vdyBJ IHRoaW5rIEkgYW0gYXMgY29uZnVzZWQgYXMgU3RlcGhlbiBhbmQgb3RoZXJzLjxvOnA+PC9vOnA+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRv O21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2lu LWJvdHRvbS1hbHQ6YXV0byI+T25lIGp1c3RpZmljYXRpb24gd2FzIOKAnHNtYWxsIGZvb3Rwcmlu dC7igJ0mbmJzcDsgQnV0IG5vdyB5b3XigJlyZSBzYXlpbmcgdGhhdCBmb3IgZGVidWdnaW5nIGVu Y3J5cHRpb24gKHN0YW5kYXJkPykgY2lwaGVycyBhcmUgdXNlZCBmb3IgYnJvd3NlciBhY2Nlc3M/ PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10 b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21hcmdpbi1ib3R0b206MTIuMHB0Ij48YnI+DQpfX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXzxicj4NClRMUyBtYWls aW5nIGxpc3Q8YnI+DQo8YSBocmVmPSJtYWlsdG86VExTQGlldGYub3JnIiB0YXJnZXQ9Il9ibGFu ayI+VExTQGlldGYub3JnPC9hPjxicj4NCjxhIGhyZWY9Imh0dHBzOi8vd3d3LmlldGYub3JnL21h aWxtYW4vbGlzdGluZm8vdGxzIiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly93d3cuaWV0Zi5vcmcv bWFpbG1hbi9saXN0aW5mby90bHM8L2E+PG86cD48L286cD48L3A+DQo8L2Jsb2NrcXVvdGU+DQo8 L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0 bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9k aXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_DM5PR2201MB1433E09B441548D8E482EDD599310DM5PR2201MB1433_-- From nobody Tue Aug 21 11:11:51 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D2E75130E62 for ; Tue, 21 Aug 2018 11:11:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JfZHW47cZqB7 for ; Tue, 21 Aug 2018 11:11:48 -0700 (PDT) Received: from straasha.imrryr.org (straasha.imrryr.org [100.2.39.101]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5E191130E37 for ; Tue, 21 Aug 2018 11:11:48 -0700 (PDT) Received: from [192.168.1.161] (unknown [192.168.1.161]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by straasha.imrryr.org (Postfix) with ESMTPSA id AD59A4F6D for ; Tue, 21 Aug 2018 14:11:46 -0400 (EDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) From: Viktor Dukhovni In-Reply-To: Date: Tue, 21 Aug 2018 14:11:46 -0400 Content-Transfer-Encoding: quoted-printable Reply-To: "" Message-Id: References: <64d23891-2f32-9bb8-1ec8-f4fad13cdfb9@cs.tcd.ie> <982363FD-A839-4175-BA53-7CA242F9ADA6@ll.mit.edu> <2D7F2926-6376-4B2C-BDE9-7A6F1C0FA748@gmail.com> <5B7C1571020000AC0015C330@gwia2.rz.hs-offenburg.de> <8A2746A8-6B41-45C3-9D77-6AF3536C6E2D@siemens.com> To: "" X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: Re: [TLS] EXTERNAL: Re: integrity only ciphersuites X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Aug 2018 18:11:50 -0000 > On Aug 21, 2018, at 1:29 PM, Ted Lemon wrote: >=20 > You're going to have to change what you do anyway=E2=80=94rather = than arguing with us why not bypass us entirely? TLS is not just a WWW protocol. Other transport security use-cases should not have to justify their existence. It is, of course, appropriate to make sure that proposed TLS code-points that cater to specialized needs are well thought out and include suitable security considerations. It is also reasonable to check that the requirements are not already met without the proposed code-points. I am concerned that we are going beyond that to questioning the legitimacy of the use-cases. IPsec is rarely a practical alternative to TLS. That said, TLS-LTS (a TLS 1.2 profile) may well be a good long-term choice where TLS 1.3 is not sufficiently compatible. As for TLS 1.3, it is indeed missing both null encryption and null authentication ciphers. I've not seen any evidence that their presence in TLS 1.2 has led to either widespread support or non-negligible accidental misuse. TLS in SMTP is (still) largely unauthenticated opportunistic TLS, and in almost all cases certificate verification errors get ignored by sending MTAs. When doing opportunistic unauthenticated TLS, Postfix goes a step further and prefers ADH/AECDH cipher-suites (with TLS <=3D 1.2), since any presented certificates will be ignored. The null auth ciphers are automatically disabled when authentication is required. Similarly, Postfix provides either NO null encryption cipher-suites, or ONLY null encryption cipher-suites. One is unlikely to stumble into a null-only configuration by accident and not notice. With appropriate documentation, sensible default settings, and configuration interfaces that make good choices easy and bad choices more difficult, one can safely provide support for non-mainstream use-cases. This is not to say that null encryption ciphers for TLS 1.3 are unconditionally good, their specification would need to provide sound security considerations and be fit for purpose. But I do think that we should not reject the proposal out of hand. --=20 --=20 Viktor. From nobody Tue Aug 21 11:19:34 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C243A130E6D for ; Tue, 21 Aug 2018 11:19:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.908 X-Spam-Level: X-Spam-Status: No, score=-1.908 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, T_DKIMWL_WL_MED=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RndfTvC-XEOa for ; Tue, 21 Aug 2018 11:19:30 -0700 (PDT) Received: from mail-lj1-x22f.google.com (mail-lj1-x22f.google.com [IPv6:2a00:1450:4864:20::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 67852130E39 for ; Tue, 21 Aug 2018 11:19:30 -0700 (PDT) Received: by mail-lj1-x22f.google.com with SMTP id f8-v6so15056588ljk.1 for ; Tue, 21 Aug 2018 11:19:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to; bh=v1wL1M8Zs1uDRITNo4+IkRf/H9aDdYPZ92O6Sy8as4c=; b=ZzM8r7WQxTz6SvjsDLT9srKI/VRsMDaXPI+oyXMN1vRgLq0lLmLtLYCFYZNQ9VwuYm 8XotEywu+3iwLgNmzzpt53wmBU7PoILEI+3YnI9SkajfWgjAjUIev/P3c/JhD0qe3fp6 TLGKPMjRUZlHz1jDgZzLN8lQ3nU5cAqhlDkt2Z7WcUOt8OwO3wKb16XZC3iW6wDCzpL8 pofhnjlW0goq5B5Kf//n40lvG/6WitrQgiuU6/RrPmfvCTX8J2paPZDJd2w8cDTBKB40 w8UEpzoh4b0YF5QG3bqCVGgztsOqNAPOBe5CVx9Mm1cTsE2makJ7YGkXtiSCu2xBH43S BGZQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to; bh=v1wL1M8Zs1uDRITNo4+IkRf/H9aDdYPZ92O6Sy8as4c=; b=IEfIBKEx+0Sc3hWxep65Cux05aAeNfDW0kAT0BlN8ZJHh9Q3TJbRnyWRBjOhrQn6NX FylbAfqlTB8XPZS0A9482eRhHKW49BTK/fO+3MIz5C/R6PkHcpsiiCxCMEaoa6uKqmpk AWI56ZaKYgoS3rqBHdse7ERi3sW80lJkG+bSlziCxHBy50vR33zEszesXdjd2MNW3g+u 3F39p50uXyk7OGByA8GnvqMhzp+4l0Ydcx27+024IFXjxkXsCQRYeJXDL1KthZTpo9TM DUpGqfxf9Vu8P0yk8kAga0Z39T5iTuhMW3TeuBznkhQ5UIEAX9gOfUjAIJBrndbMD7i+ QF7A== X-Gm-Message-State: AOUpUlEndBGYDQotjg8QTmnwCg+VQ5/xT9XE1GwsOQJ8Pp3OmX165FvB NRA5xWDzp+kOxGVNP1/f4sDnNGqb9PiEptZnaZVao+eAntc= X-Google-Smtp-Source: AA+uWPzkmbjuV5RHAOWG06UiLxehYhiVET6l1bqttQkJcx4KvGiTo+DeC5mrLVwUFLNlvriMRiR+G95XtsGQNGoA0f8= X-Received: by 2002:a2e:458b:: with SMTP id s133-v6mr33846045lja.151.1534875568361; Tue, 21 Aug 2018 11:19:28 -0700 (PDT) MIME-Version: 1.0 Received: by 2002:ab3:4091:0:0:0:0:0 with HTTP; Tue, 21 Aug 2018 11:18:47 -0700 (PDT) In-Reply-To: References: <64d23891-2f32-9bb8-1ec8-f4fad13cdfb9@cs.tcd.ie> <982363FD-A839-4175-BA53-7CA242F9ADA6@ll.mit.edu> <2D7F2926-6376-4B2C-BDE9-7A6F1C0FA748@gmail.com> <5B7C1571020000AC0015C330@gwia2.rz.hs-offenburg.de> <8A2746A8-6B41-45C3-9D77-6AF3536C6E2D@siemens.com> From: Eric Rescorla Date: Tue, 21 Aug 2018 11:18:47 -0700 Message-ID: To: "" Content-Type: multipart/alternative; boundary="00000000000006e91b0573f611da" Archived-At: Subject: Re: [TLS] EXTERNAL: Re: integrity only ciphersuites X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Aug 2018 18:19:33 -0000 --00000000000006e91b0573f611da Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Tue, Aug 21, 2018 at 11:11 AM, Viktor Dukhovni wrote: > > > > On Aug 21, 2018, at 1:29 PM, Ted Lemon wrote: > > > > You're going to have to change what you do anyway=E2=80=94rather than= arguing > with us why not bypass us entirely? > > TLS is not just a WWW protocol. Other transport security use-cases > should not have to justify their existence. > > It is, of course, appropriate to make sure that proposed TLS code-points > that cater to specialized needs are well thought out and include > suitable security considerations. > > It is also reasonable to check that the requirements are not already > met without the proposed code-points. > > I am concerned that we are going beyond that to questioning the > legitimacy of the use-cases. IPsec is rarely a practical alternative > to TLS. > > That said, TLS-LTS (a TLS 1.2 profile) may well be a good long-term > choice where TLS 1.3 is not sufficiently compatible. > > As for TLS 1.3, it is indeed missing both null encryption and null > authentication ciphers. If by "null authentication" you mean "without certificates", then TLS 1.3 does support these via RFC 7250. See: https://tools.ietf.org/rfcmarkup?doc=3D8446#appendix-C.5 This is not to say that null encryption ciphers for TLS 1.3 are > unconditionally good, their specification would need to provide > sound security considerations and be fit for purpose. But I do > think that we should not reject the proposal out of hand. > This isn't a matter of rejecting or accepting them. As I said at the beginning of this thread. No TLS WG approval is required to get a code point. The relevant questions are: 1. Should they be marked "Recommended" in the registry? 2. Should the TLS WG spend time reviewing these documents? Can the authors of this draft please say what they are looking for here? -Ekr > -- > -- > Viktor. > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > --00000000000006e91b0573f611da Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


On Tue, Aug 21, 2018 at 11:11 AM, Viktor Dukhovni <= ;ietf-dane@dukh= ovni.org> wrote:


> On Aug 21, 2018, at 1:29 PM, Ted Lemon <mellon@fugue.com> wrote:
>
>=C2=A0 =C2=A0You're going to have to change what you do anyway=E2= =80=94rather than arguing with us why not bypass us entirely?

TLS is not just a WWW protocol.=C2=A0 Other transport security use-c= ases
should not have to justify their existence.

It is, of course, appropriate to make sure that proposed TLS code-points that cater to specialized needs are well thought out and include
suitable security considerations.

It is also reasonable to check that the requirements are not already
met without the proposed code-points.

I am concerned that we are going beyond that to questioning the
legitimacy of the use-cases.=C2=A0 IPsec is rarely a practical alternative<= br> to TLS.

That said, TLS-LTS (a TLS 1.2 profile) may well be a good long-term
choice where TLS 1.3 is not sufficiently compatible.

As for TLS 1.3, it is indeed missing both null encryption and null
authentication ciphers.=C2=A0

If by "n= ull authentication" you mean "without certificates", then TL= S 1.3 does
support these via RFC 7250. See:

<= div>ht= tps://tools.ietf.org/rfcmarkup?doc=3D8446#appendix-C.5


This is not to say that null encryption ciphers for TLS 1.3 are
unconditionally good, their specification would need to provide
sound security considerations and be fit for purpose.=C2=A0 But I do
think that we should not reject the proposal out of hand.
<= div>
This isn't a matter of rejecting or accepting them. = As I said at the beginning of
this thread. No TLS WG approval is = required to get a code point.

The relevant questio= ns are:

1. Should they be marked "Recommended= " in the registry?
2. Should the TLS WG spend time reviewing= these documents?

Can the authors of this draft pl= ease say what they are looking for here?

-Ekr<= /div>



--
--
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Viktor.

_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls

--00000000000006e91b0573f611da-- From nobody Tue Aug 21 11:33:57 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 40B01130E4F for ; Tue, 21 Aug 2018 11:33:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id S1jtQMKa9uv8 for ; Tue, 21 Aug 2018 11:33:54 -0700 (PDT) Received: from straasha.imrryr.org (straasha.imrryr.org [100.2.39.101]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 75699130E25 for ; Tue, 21 Aug 2018 11:33:54 -0700 (PDT) Received: from [192.168.1.161] (unknown [192.168.1.161]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by straasha.imrryr.org (Postfix) with ESMTPSA id ADE17295085 for ; Tue, 21 Aug 2018 14:33:53 -0400 (EDT) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) From: Viktor Dukhovni In-Reply-To: Date: Tue, 21 Aug 2018 14:33:53 -0400 Content-Transfer-Encoding: quoted-printable Reply-To: "" Message-Id: <3321850E-D95E-457C-A574-2A1A3F7AC06C@dukhovni.org> References: <64d23891-2f32-9bb8-1ec8-f4fad13cdfb9@cs.tcd.ie> <982363FD-A839-4175-BA53-7CA242F9ADA6@ll.mit.edu> <2D7F2926-6376-4B2C-BDE9-7A6F1C0FA748@gmail.com> <5B7C1571020000AC0015C330@gwia2.rz.hs-offenburg.de> <8A2746A8-6B41-45C3-9D77-6AF3536C6E2D@siemens.com> To: "" X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: Re: [TLS] null auth ciphers for TLS 1.3? X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Aug 2018 18:33:56 -0000 > On Aug 21, 2018, at 2:18 PM, Eric Rescorla wrote: >=20 >> As for TLS 1.3, it is indeed missing both null encryption and null >> authentication ciphers. >=20 > If by "null authentication" you mean "without certificates", then TLS = 1.3 does > support these via RFC 7250. See: >=20 > https://tools.ietf.org/rfcmarkup?doc=3D8446#appendix-C.5 My comment was about ADH/AECDH cipher-suites, in which the server does not sign the key exchange, because it has no keys and the client has no intention/means to authenticate such a signature. You are of course right that TLS 1.3 supports raw public keys, which make it possible to do away with X.509 support. I would not call these null authentication, since DANE or key pinning (much less scalably) make it possible to authenticate raw public keys. I've not yet seen raw public key support in any mainstream TLS libraries, though admittedly my focus is primarily on OpenSSL. Do any of NSS, GnuTLS, BoringSSL, LibreSSL, ... support raw public keys? In the case of OpenSSL, adding such support is difficult, because the assumption that the peer returns X.509 certificates and not some more general data type is baked into the API. We'd need to invent some sort of special X.509 object that holds only a public key, but behaves in some sensible way when used with functions that expect X.509 certificates. --=20 Viktor. From nobody Tue Aug 21 11:40:14 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DA8FD130E9F for ; Tue, 21 Aug 2018 11:40:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.908 X-Spam-Level: X-Spam-Status: No, score=-1.908 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, T_DKIMWL_WL_MED=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vdZCOGgFZIV2 for ; Tue, 21 Aug 2018 11:40:10 -0700 (PDT) Received: from mail-lj1-x22e.google.com (mail-lj1-x22e.google.com [IPv6:2a00:1450:4864:20::22e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7F77A130E96 for ; Tue, 21 Aug 2018 11:40:10 -0700 (PDT) Received: by mail-lj1-x22e.google.com with SMTP id m84-v6so3217669lje.10 for ; Tue, 21 Aug 2018 11:40:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to; bh=WzDlKaROKFlSYufCXRP/b6lbb1ObxoVkgoM13D5/sn0=; b=waC41Tuk21flZiGD+uHHGuv2G7YbkNwkH/sNl08swwJ0j5KnduY1dk7hY0k/Peuwg5 cAmQGBflod5RgdSuyiNX8g6Qd76I1oLl4KCce6+xPyNM3dpquHLkIIRtEgP5nDu9F1ER ZfAlIWrWDa7CfQVhlFZbo2jOdIq7yaN/blwL1x4ledZLcmH/byTAbTAqiEyyVMpjOLpt VKRVFI09YnFy8Ss3EOL9z7fwunVfMZ8a1B4XYYOCKBJu2CSXpv2s9h89xnrNY13piIMY bl6tan3IRefY1f/xXZVPULXG53D8kNQD9Vw2GeyRG+zS5eEIZeAM6RBP8tKqORRV7iUx 5Umw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to; bh=WzDlKaROKFlSYufCXRP/b6lbb1ObxoVkgoM13D5/sn0=; b=fdn1be5IDqLM8NhJT3BTf7zVCV7z1u3evLuyMVLApaJg66uuI+jCcj04+2s7X6XjpT LQXQom2VnqLz1gBuPiRqxAy0iaQH9BQXF+2bL3AJNQLrRFw2Pe6dKMnLqoXvV/SoMunR NOuEflwUaYd10r95xWlAKnz8ViqFaH4TlMevJPzLEP9Ff8NS20zrtYGlGjES9MA5NObQ bbGEAzMTXH95+/UfXddaB4K3kUJ/sCZkSBBiCEEIOTKqlzI27rF86ZSEeC9Wmd66egD4 YbSgbP0RwujS1UcPFO4Z/8k5sio+WW64hUUgNbXZvTe4CACNuxMx23tfqXjXJxose5Lu grJg== X-Gm-Message-State: AOUpUlHrIPeTc+RMucpZEWodKDZm9EwRutnx8riDRf089KH0tsHJienz bU6bLWQMTZGzxAeNN2JpwcO1Ya7CW4S/rjcYm5B013lp X-Google-Smtp-Source: AA+uWPwHMdmcHwWvSOa47w1yv0MwmsPeC4rE9vfWkw005rE48RqbynzyZgF3DXm3I9SOffMaEQ4K1vyhRPd1zQkINek= X-Received: by 2002:a2e:954e:: with SMTP id t14-v6mr31777701ljh.68.1534876808435; Tue, 21 Aug 2018 11:40:08 -0700 (PDT) MIME-Version: 1.0 Received: by 2002:ab3:4091:0:0:0:0:0 with HTTP; Tue, 21 Aug 2018 11:39:27 -0700 (PDT) In-Reply-To: <3321850E-D95E-457C-A574-2A1A3F7AC06C@dukhovni.org> References: <64d23891-2f32-9bb8-1ec8-f4fad13cdfb9@cs.tcd.ie> <982363FD-A839-4175-BA53-7CA242F9ADA6@ll.mit.edu> <2D7F2926-6376-4B2C-BDE9-7A6F1C0FA748@gmail.com> <5B7C1571020000AC0015C330@gwia2.rz.hs-offenburg.de> <8A2746A8-6B41-45C3-9D77-6AF3536C6E2D@siemens.com> <3321850E-D95E-457C-A574-2A1A3F7AC06C@dukhovni.org> From: Eric Rescorla Date: Tue, 21 Aug 2018 11:39:27 -0700 Message-ID: To: "" Content-Type: multipart/alternative; boundary="000000000000f0ed300573f65a19" Archived-At: Subject: Re: [TLS] null auth ciphers for TLS 1.3? X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Aug 2018 18:40:13 -0000 --000000000000f0ed300573f65a19 Content-Type: text/plain; charset="UTF-8" On Tue, Aug 21, 2018 at 11:33 AM, Viktor Dukhovni wrote: > > > > On Aug 21, 2018, at 2:18 PM, Eric Rescorla wrote: > > > >> As for TLS 1.3, it is indeed missing both null encryption and null > >> authentication ciphers. > > > > If by "null authentication" you mean "without certificates", then TLS > 1.3 does > > support these via RFC 7250. See: > > > > https://tools.ietf.org/rfcmarkup?doc=8446#appendix-C.5 > > My comment was about ADH/AECDH cipher-suites, in which the server > does not sign the key exchange, because it has no keys and the > client has no intention/means to authenticate such a signature. > Yes. TLS 1.3 explicitly does not support those. > You are of course right that TLS 1.3 supports raw public keys, > which make it possible to do away with X.509 support. I would > not call these null authentication, since DANE or key pinning > (much less scalably) make it possible to authenticate raw public > keys. > > I've not yet seen raw public key support in any mainstream > TLS libraries, though admittedly my focus is primarily on > OpenSSL. Do any of NSS, GnuTLS, BoringSSL, LibreSSL, ... > support raw public keys? > > In the case of OpenSSL, adding such support is difficult, because > the assumption that the peer returns X.509 certificates and not > some more general data type is baked into the API. We'd need to > invent some sort of special X.509 object that holds only a public > key, but behaves in some sensible way when used with functions > that expect X.509 certificates. > Or you could just generate a fresh signing key for each connection. -Ekr > -- > Viktor. > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > --000000000000f0ed300573f65a19 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


On Tue, Aug 21, 2018 at 11:33 AM, Viktor Dukhovni <= ;ietf-dane@dukh= ovni.org> wrote:


> On Aug 21, 2018, at 2:18 PM, Eric Rescorla <ekr@rtfm.com> wrote:
>
>> As for TLS 1.3, it is indeed missing both null encryption and null=
>> authentication ciphers.
>
> If by "null authentication" you mean "without certifica= tes", then TLS 1.3 does
> support these via RFC 7250. See:
>
> https://tools.ietf.org/rfcmarkup?d= oc=3D8446#appendix-C.5

My comment was about ADH/AECDH cipher-suites, in which the server
does not sign the key exchange, because it has no keys and the
client has no intention/means to authenticate such a signature.

Yes. TLS 1.3 explicitly does not support those.

=C2=A0
You are of course right that TLS 1.3 supports raw public keys,
which make it possible to do away with X.509 support.=C2=A0 I would
not call these null authentication, since DANE or key pinning
(much less scalably) make it possible to authenticate raw public
keys.

I've not yet seen raw public key support in any mainstream
TLS libraries, though admittedly my focus is primarily on
OpenSSL.=C2=A0 Do any of NSS, GnuTLS, BoringSSL, LibreSSL, ...
support raw public keys?

In the case of OpenSSL, adding such support is difficult, because
the assumption that the peer returns X.509 certificates and not
some more general data type is baked into the API.=C2=A0 We'd need to invent some sort of special X.509 object that holds only a public
key, but behaves in some sensible way when used with functions
that expect X.509 certificates.

Or you = could just generate a fresh signing key for each connection.

=
-Ekr


--
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Viktor.

_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls

--000000000000f0ed300573f65a19-- From nobody Tue Aug 21 11:45:17 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 89801130E32 for ; Tue, 21 Aug 2018 11:45:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.508 X-Spam-Level: X-Spam-Status: No, score=-9.508 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01, URIBL_BLOCKED=0.001, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=chromium.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CtPm6s3nXLNe for ; Tue, 21 Aug 2018 11:45:09 -0700 (PDT) Received: from mail-qt0-x22b.google.com (mail-qt0-x22b.google.com [IPv6:2607:f8b0:400d:c0d::22b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0A1E5130E5B for ; Tue, 21 Aug 2018 11:45:09 -0700 (PDT) Received: by mail-qt0-x22b.google.com with SMTP id e19-v6so21445061qtp.8 for ; Tue, 21 Aug 2018 11:45:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to; bh=TY7AgwAusGe5Axq60N+7EeYELsw11xu8/hpEnpc3ZZo=; b=Ddim5+YEMEm+Vcw9uH4e5Ki7B9nt9K+Hi45M8vm96rReuWz44Xs/1DnJtYuRtzw7bl 7tZUI8E0VUji8OVHxs7gqiNwDRMT0UzhMJ2OP68W/id9jWz3tQ8XaddjgpcxsnljCZFc Mz/NuAwMDr3jRBLBCBZXXdjgXYS1zpIjq5mbY= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to; bh=TY7AgwAusGe5Axq60N+7EeYELsw11xu8/hpEnpc3ZZo=; b=AtyyvNjWSYG6NAQjhdQMMFm1CaJvy/AO4eCsfERbmC9zQK8jvNTnd4LXp2O+VjUStv Oue0xJe6M5q6fjf96orz8v0hTDDn6eTasYuE4uv1aI3ev0FgKBPNew9a+a6Tb4qo+uqi HaT63Pt9RGCP0bPovUePBJDeibXk5l/fyx1wMEUUANmgTLNgOsMOHOtJoHJM/txZnAse s6Ws/1o6s9mUBfcuXKXWesxoJdWK0KPz9utNGNBJshNsAdesrcABFtJEf6pVPIRsjzMs JNMrPiRYN+wVKUzGhTJptsC+D5113W0MK4JcuwL0CFm3lk8IEZWXKSvOkLyDuhFOhmGV /cYg== X-Gm-Message-State: AOUpUlEGaig2nT81kaJ3jH8vfWiM0Y0SYzfEhFQnHc2ipCt7YymBcbKV 8VicMFXdGLM3vwoM5207n1XmgK0l7KyMl8uNd63zKp0= X-Google-Smtp-Source: AA+uWPx7ISyPElkA8we7H5gH9Gx3N2Yqoq3HMZzYV6q9TIOxL74zAWMDJi/lGn119Xa7W2EcZmREhKoJ/jgWzzXEFpY= X-Received: by 2002:ac8:2541:: with SMTP id 1-v6mr49269059qtn.248.1534877107589; Tue, 21 Aug 2018 11:45:07 -0700 (PDT) MIME-Version: 1.0 References: <64d23891-2f32-9bb8-1ec8-f4fad13cdfb9@cs.tcd.ie> <982363FD-A839-4175-BA53-7CA242F9ADA6@ll.mit.edu> <2D7F2926-6376-4B2C-BDE9-7A6F1C0FA748@gmail.com> <5B7C1571020000AC0015C330@gwia2.rz.hs-offenburg.de> <8A2746A8-6B41-45C3-9D77-6AF3536C6E2D@siemens.com> <3321850E-D95E-457C-A574-2A1A3F7AC06C@dukhovni.org> In-Reply-To: <3321850E-D95E-457C-A574-2A1A3F7AC06C@dukhovni.org> From: David Benjamin Date: Tue, 21 Aug 2018 13:44:55 -0500 Message-ID: To: "" Content-Type: multipart/alternative; boundary="000000000000c61b0b0573f66c91" Archived-At: Subject: Re: [TLS] null auth ciphers for TLS 1.3? X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Aug 2018 18:45:15 -0000 --000000000000c61b0b0573f66c91 Content-Type: text/plain; charset="UTF-8" On Tue, Aug 21, 2018 at 1:34 PM Viktor Dukhovni wrote: > > > > On Aug 21, 2018, at 2:18 PM, Eric Rescorla wrote: > > > >> As for TLS 1.3, it is indeed missing both null encryption and null > >> authentication ciphers. > > > > If by "null authentication" you mean "without certificates", then TLS > 1.3 does > > support these via RFC 7250. See: > > > > https://tools.ietf.org/rfcmarkup?doc=8446#appendix-C.5 > > My comment was about ADH/AECDH cipher-suites, in which the server > does not sign the key exchange, because it has no keys and the > client has no intention/means to authenticate such a signature. > > You are of course right that TLS 1.3 supports raw public keys, > which make it possible to do away with X.509 support. I would > not call these null authentication, since DANE or key pinning > (much less scalably) make it possible to authenticate raw public > keys. > > I've not yet seen raw public key support in any mainstream > TLS libraries, though admittedly my focus is primarily on > OpenSSL. Do any of NSS, GnuTLS, BoringSSL, LibreSSL, ... > support raw public keys? > > In the case of OpenSSL, adding such support is difficult, because > the assumption that the peer returns X.509 certificates and not > some more general data type is baked into the API. We'd need to > invent some sort of special X.509 object that holds only a public > key, but behaves in some sensible way when used with functions > that expect X.509 certificates. > Add a separate function? It's reasonable for a caller which configures a client to expect raw public keys to call a function that returns the peer identity as a raw public key. Likewise, it's reasonable for a caller configuring a server which uses raw public keys to call a raw-public-key-specific configuration function. The same goes for any other non-certificate-based authentication. We have no plans to support this feature in BoringSSL, but if a need of this shape ever arised, that's how I would imagine doing it. David --000000000000c61b0b0573f66c91 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Tue, Aug 21= , 2018 at 1:34 PM Viktor Dukhovni <ietf-dane@dukhovni.org> wrote:


> On Aug 21, 2018, at 2:18 PM, Eric Rescorla <ekr@rtfm.com> wrote:
>
>> As for TLS 1.3, it is indeed missing both null encryption and null=
>> authentication ciphers.
>
> If by "null authentication" you mean "without certifica= tes", then TLS 1.3 does
> support these via RFC 7250. See:
>
> https://tools.ietf.org/rfcmarkup?doc=3D= 8446#appendix-C.5

My comment was about ADH/AECDH cipher-suites, in which the server
does not sign the key exchange, because it has no keys and the
client has no intention/means to authenticate such a signature.

You are of course right that TLS 1.3 supports raw public keys,
which make it possible to do away with X.509 support.=C2=A0 I would
not call these null authentication, since DANE or key pinning
(much less scalably) make it possible to authenticate raw public
keys.

I've not yet seen raw public key support in any mainstream
TLS libraries, though admittedly my focus is primarily on
OpenSSL.=C2=A0 Do any of NSS, GnuTLS, BoringSSL, LibreSSL, ...
support raw public keys?

In the case of OpenSSL, adding such support is difficult, because
the assumption that the peer returns X.509 certificates and not
some more general data type is baked into the API.=C2=A0 We'd need to invent some sort of special X.509 object that holds only a public
key, but behaves in some sensible way when used with functions
that expect X.509 certificates.

Add a s= eparate function? It's reasonable for a caller which configures a clien= t to expect raw public keys to call a function that returns the peer identi= ty as a raw public key. Likewise, it's reasonable for a caller configur= ing a server which uses raw public keys to call a raw-public-key-specific c= onfiguration function. The same goes for any other non-certificate-based au= thentication.

We have no plans to support this fea= ture in BoringSSL, but if a need of this shape ever arised, that's how = I would imagine doing it.

David
--000000000000c61b0b0573f66c91-- From nobody Tue Aug 21 11:46:35 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 556E1130F6F for ; Tue, 21 Aug 2018 11:46:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.197 X-Spam-Level: X-Spam-Status: No, score=-4.197 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, UNPARSEABLE_RELAY=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qebH7PHD382G for ; Tue, 21 Aug 2018 11:46:22 -0700 (PDT) Received: from llmx2.ll.mit.edu (LLMX2.LL.MIT.EDU [129.55.12.48]) by ietfa.amsl.com (Postfix) with ESMTP id EAAB212426A for ; Tue, 21 Aug 2018 11:46:21 -0700 (PDT) Received: from LLE2K16-MBX03.mitll.ad.local (LLE2K16-MBX03.mitll.ad.local) by llmx2.ll.mit.edu (unknown) with ESMTP id w7LIkKI8033145; Tue, 21 Aug 2018 14:46:20 -0400 From: "Blumenthal, Uri - 0553 - MITLL" To: Eric Rescorla CC: "" Thread-Topic: [TLS] EXTERNAL: Re: integrity only ciphersuites Thread-Index: AQHUOXStTZMFprYiOUu3YrlZoYzKf6TKxPwAgAAB9oCAAAdpAA== Date: Tue, 21 Aug 2018 18:45:19 +0000 Message-ID: References: <64d23891-2f32-9bb8-1ec8-f4fad13cdfb9@cs.tcd.ie> <982363FD-A839-4175-BA53-7CA242F9ADA6@ll.mit.edu> <2D7F2926-6376-4B2C-BDE9-7A6F1C0FA748@gmail.com> <5B7C1571020000AC0015C330@gwia2.rz.hs-offenburg.de> <8A2746A8-6B41-45C3-9D77-6AF3536C6E2D@siemens.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 Content-Type: multipart/signed; boundary="Apple-Mail-304785C3-72F7-4F0F-96DD-6416E67773D9"; protocol="application/pkcs7-signature"; micalg=sha1 MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2018-08-21_09:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 mlxscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1807170000 definitions=main-1808210192 Archived-At: Subject: Re: [TLS] EXTERNAL: Re: integrity only ciphersuites X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Aug 2018 18:46:33 -0000 --Apple-Mail-304785C3-72F7-4F0F-96DD-6416E67773D9 Content-Type: multipart/alternative; boundary=Apple-Mail-0A39C6E1-AA46-470E-93B0-5171B14F676F Content-Transfer-Encoding: 7bit --Apple-Mail-0A39C6E1-AA46-470E-93B0-5171B14F676F Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: base64 Tm8gdGhleSBzaG91bGQgbm90IGJlIHJlY29tbWVuZGVkIChhcyBhIHR5cGljYWwgVExTIHVzZSBj YXNlIGluY2x1ZGVzIGNvbmZpZGVudGlhbGl0eSByZXF1aXJlbWVudCkuDQoNClllcyB0aGlzIFdH IHNob3VsZCByZXZpZXcgdGhlbSBhbmQgbWFrZSBhIHNlY3VyaXR5IHN0YXRlbWVudCwgZS5nLiwg bGlrZSAid2UgcmV2aWV3ZWQgdGhlc2Ugc3VpdGVzIGFuZCBmb3VuZCB0aGF0IHRoZXkgZG8gcHJv dmlkZSBhdXRoZW50aWNhdGlvbiBhbmQgaW50ZWdyaXR5IHByb3RlY3Rpb24uIE5vIG90aGVyIHBy b3RlY3Rpb24gc3VjaCBhcyBjb25maWRlbnRpYWxpdHkgaXMgcHJvdmlkZWQiIChhcyBzaG91bGQg YmUgb2J2aW91cyBmcm9tIHRoZWlyIG5hbWVzKS4NCg0KSSBzdXNwZWN0IHRoZSBhdXRob3JzIGFy ZSBsb29raW5nIGZvciBjb2RlIHBvaW50IGFzc2lnbm1lbnQgYW5kIGdlbmVyYWwgYXBwcm92YWwg aGVyZSwgYnV0IHRoZXkgY2FuIHNwZWFrIGZvciB0aGVtc2VsdmVzLiA7LSkNCg0KUmVnYXJkcywN ClVyaQ0KDQpTZW50IGZyb20gbXkgaVBob25lDQoNCj4gT24gQXVnIDIxLCAyMDE4LCBhdCAxNDoy MCwgRXJpYyBSZXNjb3JsYSA8ZWtyQHJ0Zm0uY29tPiB3cm90ZToNCj4gDQo+IA0KPiANCj4+IE9u IFR1ZSwgQXVnIDIxLCAyMDE4IGF0IDExOjExIEFNLCBWaWt0b3IgRHVraG92bmkgPGlldGYtZGFu ZUBkdWtob3ZuaS5vcmc+IHdyb3RlOg0KPj4gDQo+PiANCj4+ID4gT24gQXVnIDIxLCAyMDE4LCBh dCAxOjI5IFBNLCBUZWQgTGVtb24gPG1lbGxvbkBmdWd1ZS5jb20+IHdyb3RlOg0KPj4gPiANCj4+ ID4gICBZb3UncmUgZ29pbmcgdG8gaGF2ZSB0byBjaGFuZ2Ugd2hhdCB5b3UgZG8gYW55d2F54oCU cmF0aGVyIHRoYW4gYXJndWluZyB3aXRoIHVzIHdoeSBub3QgYnlwYXNzIHVzIGVudGlyZWx5Pw0K Pj4gDQo+PiBUTFMgaXMgbm90IGp1c3QgYSBXV1cgcHJvdG9jb2wuICBPdGhlciB0cmFuc3BvcnQg c2VjdXJpdHkgdXNlLWNhc2VzDQo+PiBzaG91bGQgbm90IGhhdmUgdG8ganVzdGlmeSB0aGVpciBl eGlzdGVuY2UuDQo+PiANCj4+IEl0IGlzLCBvZiBjb3Vyc2UsIGFwcHJvcHJpYXRlIHRvIG1ha2Ug c3VyZSB0aGF0IHByb3Bvc2VkIFRMUyBjb2RlLXBvaW50cw0KPj4gdGhhdCBjYXRlciB0byBzcGVj aWFsaXplZCBuZWVkcyBhcmUgd2VsbCB0aG91Z2h0IG91dCBhbmQgaW5jbHVkZQ0KPj4gc3VpdGFi bGUgc2VjdXJpdHkgY29uc2lkZXJhdGlvbnMuDQo+PiANCj4+IEl0IGlzIGFsc28gcmVhc29uYWJs ZSB0byBjaGVjayB0aGF0IHRoZSByZXF1aXJlbWVudHMgYXJlIG5vdCBhbHJlYWR5DQo+PiBtZXQg d2l0aG91dCB0aGUgcHJvcG9zZWQgY29kZS1wb2ludHMuDQo+PiANCj4+IEkgYW0gY29uY2VybmVk IHRoYXQgd2UgYXJlIGdvaW5nIGJleW9uZCB0aGF0IHRvIHF1ZXN0aW9uaW5nIHRoZQ0KPj4gbGVn aXRpbWFjeSBvZiB0aGUgdXNlLWNhc2VzLiAgSVBzZWMgaXMgcmFyZWx5IGEgcHJhY3RpY2FsIGFs dGVybmF0aXZlDQo+PiB0byBUTFMuDQo+PiANCj4+IFRoYXQgc2FpZCwgVExTLUxUUyAoYSBUTFMg MS4yIHByb2ZpbGUpIG1heSB3ZWxsIGJlIGEgZ29vZCBsb25nLXRlcm0NCj4+IGNob2ljZSB3aGVy ZSBUTFMgMS4zIGlzIG5vdCBzdWZmaWNpZW50bHkgY29tcGF0aWJsZS4NCj4+IA0KPj4gQXMgZm9y IFRMUyAxLjMsIGl0IGlzIGluZGVlZCBtaXNzaW5nIGJvdGggbnVsbCBlbmNyeXB0aW9uIGFuZCBu dWxsDQo+PiBhdXRoZW50aWNhdGlvbiBjaXBoZXJzLiANCj4gDQo+IElmIGJ5ICJudWxsIGF1dGhl bnRpY2F0aW9uIiB5b3UgbWVhbiAid2l0aG91dCBjZXJ0aWZpY2F0ZXMiLCB0aGVuIFRMUyAxLjMg ZG9lcw0KPiBzdXBwb3J0IHRoZXNlIHZpYSBSRkMgNzI1MC4gU2VlOg0KPiANCj4gaHR0cHM6Ly90 b29scy5pZXRmLm9yZy9yZmNtYXJrdXA/ZG9jPTg0NDYjYXBwZW5kaXgtQy41DQo+IA0KPiANCj4+ IFRoaXMgaXMgbm90IHRvIHNheSB0aGF0IG51bGwgZW5jcnlwdGlvbiBjaXBoZXJzIGZvciBUTFMg MS4zIGFyZQ0KPj4gdW5jb25kaXRpb25hbGx5IGdvb2QsIHRoZWlyIHNwZWNpZmljYXRpb24gd291 bGQgbmVlZCB0byBwcm92aWRlDQo+PiBzb3VuZCBzZWN1cml0eSBjb25zaWRlcmF0aW9ucyBhbmQg YmUgZml0IGZvciBwdXJwb3NlLiAgQnV0IEkgZG8NCj4+IHRoaW5rIHRoYXQgd2Ugc2hvdWxkIG5v dCByZWplY3QgdGhlIHByb3Bvc2FsIG91dCBvZiBoYW5kLg0KPiANCj4gVGhpcyBpc24ndCBhIG1h dHRlciBvZiByZWplY3Rpbmcgb3IgYWNjZXB0aW5nIHRoZW0uIEFzIEkgc2FpZCBhdCB0aGUgYmVn aW5uaW5nIG9mDQo+IHRoaXMgdGhyZWFkLiBObyBUTFMgV0cgYXBwcm92YWwgaXMgcmVxdWlyZWQg dG8gZ2V0IGEgY29kZSBwb2ludC4NCj4gDQo+IFRoZSByZWxldmFudCBxdWVzdGlvbnMgYXJlOg0K PiANCj4gMS4gU2hvdWxkIHRoZXkgYmUgbWFya2VkICJSZWNvbW1lbmRlZCIgaW4gdGhlIHJlZ2lz dHJ5Pw0KPiAyLiBTaG91bGQgdGhlIFRMUyBXRyBzcGVuZCB0aW1lIHJldmlld2luZyB0aGVzZSBk b2N1bWVudHM/DQo+IA0KPiBDYW4gdGhlIGF1dGhvcnMgb2YgdGhpcyBkcmFmdCBwbGVhc2Ugc2F5 IHdoYXQgdGhleSBhcmUgbG9va2luZyBmb3IgaGVyZT8NCj4gDQo+IC1Fa3INCj4gDQo+IA0KPj4g DQo+PiAtLSANCj4+IC0tIA0KPj4gICAgICAgICBWaWt0b3IuDQo+PiANCj4+IF9fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQo+PiBUTFMgbWFpbGluZyBsaXN0 DQo+PiBUTFNAaWV0Zi5vcmcNCj4+IGh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGlu Zm8vdGxzDQo+IA0KPiBfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fXw0KPiBUTFMgbWFpbGluZyBsaXN0DQo+IFRMU0BpZXRmLm9yZw0KPiBodHRwczovL3d3dy5p ZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3Rscw0K --Apple-Mail-0A39C6E1-AA46-470E-93B0-5171B14F676F Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: base64 PGh0bWw+PGhlYWQ+PG1ldGEgaHR0cC1lcXVpdj0iY29udGVudC10eXBlIiBjb250ZW50PSJ0ZXh0 L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPjwvaGVhZD48Ym9keSBkaXI9ImF1dG8iPk5vIHRoZXkgc2hv dWxkIG5vdCBiZSByZWNvbW1lbmRlZCAoYXMgYSB0eXBpY2FsIFRMUyB1c2UgY2FzZSBpbmNsdWRl cyBjb25maWRlbnRpYWxpdHkgcmVxdWlyZW1lbnQpLjxkaXY+PGJyPjxkaXY+WWVzIHRoaXMgV0cg c2hvdWxkIHJldmlldyB0aGVtIGFuZCBtYWtlIGEgc2VjdXJpdHkgc3RhdGVtZW50LCBlLmcuLCBs aWtlICJ3ZSByZXZpZXdlZCB0aGVzZSBzdWl0ZXMgYW5kIGZvdW5kIHRoYXQgdGhleSBkbyBwcm92 aWRlIGF1dGhlbnRpY2F0aW9uIGFuZCBpbnRlZ3JpdHkgcHJvdGVjdGlvbi4gTm8gb3RoZXIgcHJv dGVjdGlvbiBzdWNoIGFzIGNvbmZpZGVudGlhbGl0eSBpcyBwcm92aWRlZCIgKGFzIHNob3VsZCBi ZSBvYnZpb3VzIGZyb20gdGhlaXIgbmFtZXMpLjwvZGl2PjxkaXY+PGJyPjwvZGl2PjxkaXY+SSBz dXNwZWN0IHRoZSBhdXRob3JzIGFyZSBsb29raW5nIGZvciBjb2RlIHBvaW50IGFzc2lnbm1lbnQg YW5kIGdlbmVyYWwgYXBwcm92YWwgaGVyZSwgYnV0IHRoZXkgY2FuIHNwZWFrIGZvciB0aGVtc2Vs dmVzLiA7LSk8YnI+PGJyPjxkaXYgaWQ9IkFwcGxlTWFpbFNpZ25hdHVyZSI+UmVnYXJkcyw8ZGl2 PlVyaTwvZGl2PjxkaXY+PGJyPjwvZGl2PjxkaXY+U2VudCBmcm9tIG15IGlQaG9uZTwvZGl2Pjwv ZGl2PjxkaXY+PGJyPk9uIEF1ZyAyMSwgMjAxOCwgYXQgMTQ6MjAsIEVyaWMgUmVzY29ybGEgJmx0 OzxhIGhyZWY9Im1haWx0bzpla3JAcnRmbS5jb20iPmVrckBydGZtLmNvbTwvYT4mZ3Q7IHdyb3Rl Ojxicj48YnI+PC9kaXY+PGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+PGRpdj48bWV0YSBodHRwLWVx dWl2PSJDb250ZW50LVR5cGUiIGNvbnRlbnQ9InRleHQvaHRtbDsgY2hhcnNldD11dGYtOCI+PGRp diBkaXI9Imx0ciI+PGJyPjxkaXYgY2xhc3M9ImdtYWlsX2V4dHJhIj48YnI+PGRpdiBjbGFzcz0i Z21haWxfcXVvdGUiPk9uIFR1ZSwgQXVnIDIxLCAyMDE4IGF0IDExOjExIEFNLCBWaWt0b3IgRHVr aG92bmkgPHNwYW4gZGlyPSJsdHIiPiZsdDs8YSBocmVmPSJtYWlsdG86aWV0Zi1kYW5lQGR1a2hv dm5pLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPmlldGYtZGFuZUBkdWtob3ZuaS5vcmc8L2E+Jmd0Ozwv c3Bhbj4gd3JvdGU6PGJyPjxibG9ja3F1b3RlIGNsYXNzPSJnbWFpbF9xdW90ZSIgc3R5bGU9Im1h cmdpbjowcHggMHB4IDBweCAwLjhleDtib3JkZXItbGVmdDoxcHggc29saWQgcmdiKDIwNCwyMDQs MjA0KTtwYWRkaW5nLWxlZnQ6MWV4Ij48c3BhbiBjbGFzcz0iZ21haWwtIj48YnI+DQo8YnI+DQom Z3Q7IE9uIEF1ZyAyMSwgMjAxOCwgYXQgMToyOSBQTSwgVGVkIExlbW9uICZsdDs8YSBocmVmPSJt YWlsdG86bWVsbG9uQGZ1Z3VlLmNvbSI+bWVsbG9uQGZ1Z3VlLmNvbTwvYT4mZ3Q7IHdyb3RlOjxi cj4NCiZndDsgPGJyPg0KJmd0OyZuYnNwOyAmbmJzcDtZb3UncmUgZ29pbmcgdG8gaGF2ZSB0byBj aGFuZ2Ugd2hhdCB5b3UgZG8gYW55d2F54oCUcmF0aGVyIHRoYW4gYXJndWluZyB3aXRoIHVzIHdo eSBub3QgYnlwYXNzIHVzIGVudGlyZWx5Pzxicj4NCjxicj4NCjwvc3Bhbj5UTFMgaXMgbm90IGp1 c3QgYSBXV1cgcHJvdG9jb2wuJm5ic3A7IE90aGVyIHRyYW5zcG9ydCBzZWN1cml0eSB1c2UtY2Fz ZXM8YnI+DQpzaG91bGQgbm90IGhhdmUgdG8ganVzdGlmeSB0aGVpciBleGlzdGVuY2UuPGJyPg0K PGJyPg0KSXQgaXMsIG9mIGNvdXJzZSwgYXBwcm9wcmlhdGUgdG8gbWFrZSBzdXJlIHRoYXQgcHJv cG9zZWQgVExTIGNvZGUtcG9pbnRzPGJyPg0KdGhhdCBjYXRlciB0byBzcGVjaWFsaXplZCBuZWVk cyBhcmUgd2VsbCB0aG91Z2h0IG91dCBhbmQgaW5jbHVkZTxicj4NCnN1aXRhYmxlIHNlY3VyaXR5 IGNvbnNpZGVyYXRpb25zLjxicj4NCjxicj4NCkl0IGlzIGFsc28gcmVhc29uYWJsZSB0byBjaGVj ayB0aGF0IHRoZSByZXF1aXJlbWVudHMgYXJlIG5vdCBhbHJlYWR5PGJyPg0KbWV0IHdpdGhvdXQg dGhlIHByb3Bvc2VkIGNvZGUtcG9pbnRzLjxicj4NCjxicj4NCkkgYW0gY29uY2VybmVkIHRoYXQg d2UgYXJlIGdvaW5nIGJleW9uZCB0aGF0IHRvIHF1ZXN0aW9uaW5nIHRoZTxicj4NCmxlZ2l0aW1h Y3kgb2YgdGhlIHVzZS1jYXNlcy4mbmJzcDsgSVBzZWMgaXMgcmFyZWx5IGEgcHJhY3RpY2FsIGFs dGVybmF0aXZlPGJyPg0KdG8gVExTLjxicj4NCjxicj4NClRoYXQgc2FpZCwgVExTLUxUUyAoYSBU TFMgMS4yIHByb2ZpbGUpIG1heSB3ZWxsIGJlIGEgZ29vZCBsb25nLXRlcm08YnI+DQpjaG9pY2Ug d2hlcmUgVExTIDEuMyBpcyBub3Qgc3VmZmljaWVudGx5IGNvbXBhdGlibGUuPGJyPg0KPGJyPg0K QXMgZm9yIFRMUyAxLjMsIGl0IGlzIGluZGVlZCBtaXNzaW5nIGJvdGggbnVsbCBlbmNyeXB0aW9u IGFuZCBudWxsPGJyPg0KYXV0aGVudGljYXRpb24gY2lwaGVycy4mbmJzcDs8L2Jsb2NrcXVvdGU+ PGRpdj48YnI+PC9kaXY+PGRpdj5JZiBieSAibnVsbCBhdXRoZW50aWNhdGlvbiIgeW91IG1lYW4g IndpdGhvdXQgY2VydGlmaWNhdGVzIiwgdGhlbiBUTFMgMS4zIGRvZXM8L2Rpdj48ZGl2PnN1cHBv cnQgdGhlc2UgdmlhIFJGQyA3MjUwLiBTZWU6PC9kaXY+PGRpdj48YnI+PC9kaXY+PGRpdj48YSBo cmVmPSJodHRwczovL3Rvb2xzLmlldGYub3JnL3JmY21hcmt1cD9kb2M9ODQ0NiNhcHBlbmRpeC1D LjUiPmh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvcmZjbWFya3VwP2RvYz04NDQ2I2FwcGVuZGl4LUMu NTwvYT48L2Rpdj48ZGl2Pjxicj48L2Rpdj48YnI+PGJsb2NrcXVvdGUgY2xhc3M9ImdtYWlsX3F1 b3RlIiBzdHlsZT0ibWFyZ2luOjBweCAwcHggMHB4IDAuOGV4O2JvcmRlci1sZWZ0OjFweCBzb2xp ZCByZ2IoMjA0LDIwNCwyMDQpO3BhZGRpbmctbGVmdDoxZXgiPg0KVGhpcyBpcyBub3QgdG8gc2F5 IHRoYXQgbnVsbCBlbmNyeXB0aW9uIGNpcGhlcnMgZm9yIFRMUyAxLjMgYXJlPGJyPg0KdW5jb25k aXRpb25hbGx5IGdvb2QsIHRoZWlyIHNwZWNpZmljYXRpb24gd291bGQgbmVlZCB0byBwcm92aWRl PGJyPg0Kc291bmQgc2VjdXJpdHkgY29uc2lkZXJhdGlvbnMgYW5kIGJlIGZpdCBmb3IgcHVycG9z ZS4mbmJzcDsgQnV0IEkgZG88YnI+DQp0aGluayB0aGF0IHdlIHNob3VsZCBub3QgcmVqZWN0IHRo ZSBwcm9wb3NhbCBvdXQgb2YgaGFuZC48YnI+PC9ibG9ja3F1b3RlPjxkaXY+PGJyPjwvZGl2Pjxk aXY+VGhpcyBpc24ndCBhIG1hdHRlciBvZiByZWplY3Rpbmcgb3IgYWNjZXB0aW5nIHRoZW0uIEFz IEkgc2FpZCBhdCB0aGUgYmVnaW5uaW5nIG9mPC9kaXY+PGRpdj50aGlzIHRocmVhZC4gTm8gVExT IFdHIGFwcHJvdmFsIGlzIHJlcXVpcmVkIHRvIGdldCBhIGNvZGUgcG9pbnQuPC9kaXY+PGRpdj48 YnI+PC9kaXY+PGRpdj5UaGUgcmVsZXZhbnQgcXVlc3Rpb25zIGFyZTo8L2Rpdj48ZGl2Pjxicj48 L2Rpdj48ZGl2PjEuIFNob3VsZCB0aGV5IGJlIG1hcmtlZCAiUmVjb21tZW5kZWQiIGluIHRoZSBy ZWdpc3RyeT88L2Rpdj48ZGl2PjIuIFNob3VsZCB0aGUgVExTIFdHIHNwZW5kIHRpbWUgcmV2aWV3 aW5nIHRoZXNlIGRvY3VtZW50cz88L2Rpdj48ZGl2Pjxicj48L2Rpdj48ZGl2PkNhbiB0aGUgYXV0 aG9ycyBvZiB0aGlzIGRyYWZ0IHBsZWFzZSBzYXkgd2hhdCB0aGV5IGFyZSBsb29raW5nIGZvciBo ZXJlPzxicj48L2Rpdj48ZGl2Pjxicj48L2Rpdj48ZGl2Pi1Fa3I8L2Rpdj48ZGl2Pjxicj48L2Rp dj48ZGl2Pjxicj48L2Rpdj48YmxvY2txdW90ZSBjbGFzcz0iZ21haWxfcXVvdGUiIHN0eWxlPSJt YXJnaW46MHB4IDBweCAwcHggMC44ZXg7Ym9yZGVyLWxlZnQ6MXB4IHNvbGlkIHJnYigyMDQsMjA0 LDIwNCk7cGFkZGluZy1sZWZ0OjFleCI+DQo8c3BhbiBjbGFzcz0iZ21haWwtSE9FblpiIj48Zm9u dCBjb2xvcj0iIzg4ODg4OCI+PGJyPg0KLS0gPGJyPg0KLS0gPGJyPg0KJm5ic3A7ICZuYnNwOyAm bmJzcDsgJm5ic3A7IFZpa3Rvci48YnI+DQo8L2ZvbnQ+PC9zcGFuPjxkaXYgY2xhc3M9ImdtYWls LUhPRW5aYiI+PGRpdiBjbGFzcz0iZ21haWwtaDUiPjxicj4NCl9fX19fX19fX19fX19fX19fX19f X19fX19fX19fXzx3YnI+X19fX19fX19fX19fX19fX188YnI+DQpUTFMgbWFpbGluZyBsaXN0PGJy Pg0KPGEgaHJlZj0ibWFpbHRvOlRMU0BpZXRmLm9yZyI+VExTQGlldGYub3JnPC9hPjxicj4NCjxh IGhyZWY9Imh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vdGxzIiByZWw9Im5v cmVmZXJyZXIiIHRhcmdldD0iX2JsYW5rIj5odHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuLzx3 YnI+bGlzdGluZm8vdGxzPC9hPjxicj4NCjwvZGl2PjwvZGl2PjwvYmxvY2txdW90ZT48L2Rpdj48 YnI+PC9kaXY+PC9kaXY+DQo8L2Rpdj48L2Jsb2NrcXVvdGU+PGJsb2NrcXVvdGUgdHlwZT0iY2l0 ZSI+PGRpdj48c3Bhbj5fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fXzwvc3Bhbj48YnI+PHNwYW4+VExTIG1haWxpbmcgbGlzdDwvc3Bhbj48YnI+PHNwYW4+PGEg aHJlZj0ibWFpbHRvOlRMU0BpZXRmLm9yZyI+VExTQGlldGYub3JnPC9hPjwvc3Bhbj48YnI+PHNw YW4+PGEgaHJlZj0iaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby90bHMiPmh0 dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vdGxzPC9hPjwvc3Bhbj48YnI+PC9k aXY+PC9ibG9ja3F1b3RlPjwvZGl2PjwvZGl2PjwvYm9keT48L2h0bWw+ --Apple-Mail-0A39C6E1-AA46-470E-93B0-5171B14F676F-- --Apple-Mail-304785C3-72F7-4F0F-96DD-6416E67773D9 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Disposition: attachment; filename="smime.p7s" Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIITojCCBLww ggOkoAMCAQICASkwDQYJKoZIhvcNAQEFBQAwVDELMAkGA1UEBhMCVVMxHzAdBgNVBAoTFk1JVCBM aW5jb2xuIExhYm9yYXRvcnkxDDAKBgNVBAsTA1BLSTEWMBQGA1UEAxMNTUlUTEwgUm9vdCBDQTAe Fw0xMzEyMTcwMDAwMDBaFw0yMDEyMzEyMzU5NTlaMFExCzAJBgNVBAYTAlVTMR8wHQYDVQQKExZN SVQgTGluY29sbiBMYWJvcmF0b3J5MQwwCgYDVQQLEwNQS0kxEzARBgNVBAMTCk1JVExMIENBLTMw ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaMFJ1bXy25bW03EbqHwHSSpyQVlAAC2gc KS9SlQRfqMW8F3yZAjncbIthG4CjgdYml7v+LMVc59IkOzpQzmi+8I59eDZsmANiUEL0kNwsEUif Semk671G+mNZKLG0LnpyvAnlSzlA923G0p16TksleXagrDfDyWKFSLF49vFZp3WbtkwopqC+b3NP Js/oW6YpHF5gmNKkHb5wBiOgYYRtJUfLHy7MebrECgEwfFrxvL7IPPwnOTqw/2KKWA/eJdIagICa HIHO+VBDlA01Y/4Saj2PP+6QqFhUH9XB3G2iq48CqfiJ8MAhoz121vTlzLWBcAVI/dn+JSTHIFll Q5F/AgMBAAGjggGaMIIBljASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBTXYGYOe0mNdUwN /c9G3sjHEofKvzAfBgNVHSMEGDAWgBRnqnrP9AqmuXK1iqDSnfIQw0PtKTAOBgNVHQ8BAf8EBAMC AYYwZgYIKwYBBQUHAQEEWjBYMC0GCCsGAQUFBzAChiFodHRwOi8vY3JsLmxsLm1pdC5lZHUvZ2V0 dG8/TExSQ0EwJwYIKwYBBQUHMAGGG2h0dHA6Ly9vY3NwLmxsLm1pdC5lZHUvb2NzcDAzBgNVHR8E LDAqMCigJqAkhiJodHRwOi8vY3JsLmxsLm1pdC5lZHUvZ2V0Y3JsP0xMUkNBMIGSBgNVHSAEgYow gYcwDQYLKoZIhvcSAgEDAQYwDQYLKoZIhvcSAgEDAQgwDQYLKoZIhvcSAgEDAQcwDQYLKoZIhvcS AgEDAQkwDQYLKoZIhvcSAgEDAQowDQYLKoZIhvcSAgEDAQswDQYLKoZIhvcSAgEDAQ4wDQYLKoZI hvcSAgEDAQ8wDQYLKoZIhvcSAgEDARAwDQYJKoZIhvcNAQEFBQADggEBACx/0cGfvapTtROCTFqu MBzuLKeFwMSBbB7Ngq139IsZJDQOG3MhX8tMLGpQuM534f4dOowlcHz6cefOHKpDjdGycZk4VPlF /M+H3h1v9kneqXbjgPCUkjvJcEDYORlwQSA5YL1sdysSXNTo2eKBqFJbmh1UmuGYf9eFABwxLvsT kfrbLLErVY8+BwGKkZWe7XFIdtOId7sOp9ZDa1UwtR/bddiEi5r3iQmxB3iNKHvU1UPR7sXiycCi pAwj3wzMNh4s6SOXMpGzvuv9oyw8ArHqcxo69EvsLLQ+OnnWLaoWRsaZfyh+eHaR6uNNO9En+Dba vUxXxFHU+S2Myw06w98wggS8MIIDpKADAgECAgEpMA0GCSqGSIb3DQEBBQUAMFQxCzAJBgNVBAYT AlVTMR8wHQYDVQQKExZNSVQgTGluY29sbiBMYWJvcmF0b3J5MQwwCgYDVQQLEwNQS0kxFjAUBgNV BAMTDU1JVExMIFJvb3QgQ0EwHhcNMTMxMjE3MDAwMDAwWhcNMjAxMjMxMjM1OTU5WjBRMQswCQYD VQQGEwJVUzEfMB0GA1UEChMWTUlUIExpbmNvbG4gTGFib3JhdG9yeTEMMAoGA1UECxMDUEtJMRMw EQYDVQQDEwpNSVRMTCBDQS0zMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2jBSdW18 tuW1tNxG6h8B0kqckFZQAAtoHCkvUpUEX6jFvBd8mQI53GyLYRuAo4HWJpe7/izFXOfSJDs6UM5o vvCOfXg2bJgDYlBC9JDcLBFIn0nppOu9RvpjWSixtC56crwJ5Us5QPdtxtKdek5LJXl2oKw3w8li hUixePbxWad1m7ZMKKagvm9zTybP6FumKRxeYJjSpB2+cAYjoGGEbSVHyx8uzHm6xAoBMHxa8by+ yDz8Jzk6sP9iilgP3iXSGoCAmhyBzvlQQ5QNNWP+Emo9jz/ukKhYVB/VwdxtoquPAqn4ifDAIaM9 dtb05cy1gXAFSP3Z/iUkxyBZZUORfwIDAQABo4IBmjCCAZYwEgYDVR0TAQH/BAgwBgEB/wIBADAd BgNVHQ4EFgQU12BmDntJjXVMDf3PRt7IxxKHyr8wHwYDVR0jBBgwFoAUZ6p6z/QKprlytYqg0p3y EMND7SkwDgYDVR0PAQH/BAQDAgGGMGYGCCsGAQUFBwEBBFowWDAtBggrBgEFBQcwAoYhaHR0cDov L2NybC5sbC5taXQuZWR1L2dldHRvP0xMUkNBMCcGCCsGAQUFBzABhhtodHRwOi8vb2NzcC5sbC5t aXQuZWR1L29jc3AwMwYDVR0fBCwwKjAooCagJIYiaHR0cDovL2NybC5sbC5taXQuZWR1L2dldGNy bD9MTFJDQTCBkgYDVR0gBIGKMIGHMA0GCyqGSIb3EgIBAwEGMA0GCyqGSIb3EgIBAwEIMA0GCyqG SIb3EgIBAwEHMA0GCyqGSIb3EgIBAwEJMA0GCyqGSIb3EgIBAwEKMA0GCyqGSIb3EgIBAwELMA0G CyqGSIb3EgIBAwEOMA0GCyqGSIb3EgIBAwEPMA0GCyqGSIb3EgIBAwEQMA0GCSqGSIb3DQEBBQUA A4IBAQAsf9HBn72qU7UTgkxarjAc7iynhcDEgWwezYKtd/SLGSQ0DhtzIV/LTCxqULjOd+H+HTqM JXB8+nHnzhyqQ43RsnGZOFT5RfzPh94db/ZJ3ql244DwlJI7yXBA2DkZcEEgOWC9bHcrElzU6Nni gahSW5odVJrhmH/XhQAcMS77E5H62yyxK1WPPgcBipGVnu1xSHbTiHe7DqfWQ2tVMLUf23XYhIua 94kJsQd4jSh71NVD0e7F4snAoqQMI98MzDYeLOkjlzKRs77r/aMsPAKx6nMaOvRL7Cy0Pjp51i2q FkbGmX8ofnh2kerjTTvRJ/g22r1MV8RR1PktjMsNOsPfMIIE7TCCA9WgAwIBAgIKMziUjwAAAABu ljANBgkqhkiG9w0BAQsFADBRMQswCQYDVQQGEwJVUzEfMB0GA1UEChMWTUlUIExpbmNvbG4gTGFi b3JhdG9yeTEMMAoGA1UECxMDUEtJMRMwEQYDVQQDEwpNSVRMTCBDQS0zMB4XDTE2MDExNDE3MzAz OVoXDTE5MDExMzE3MzAzOVowYTELMAkGA1UEBhMCVVMxHzAdBgNVBAoTFk1JVCBMaW5jb2xuIExh Ym9yYXRvcnkxDzANBgNVBAsTBlBlb3BsZTEgMB4GA1UEAxMXQmx1bWVudGhhbC5VcmkuNTAwMTA1 ODQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDjFDaGib07mHBdNaVMNpj9+4iJa+K9 AcTN3y+iU1ygtvHG4coteDBf77ZN1uwdt+lodW0C8XyG43suSfpNp/owLOUElFagAnPqHAvAUIws l5AjzncpJP+78Ui4u34aMNsddP+QZu9HI2Qg+P6eMD25jkjybT9dQMxXZpO2oTBznlWjYIItdZhK 1DWZqIR0at7n2YjCSQsZNX0lJ4JwrtjHYFrYPnnZC0f1B2M7V54IS863CEyfu5XotoZx8YuHwYpK SFq80SEh6cMDLdTe1ZAjWxsnbyKC64rreStyI2PVN9uBWd+OleGoIAjVogpMKKi0pSRHcCuwDwGe kpQVubK9AgMBAAGjggG1MIIBsTAdBgNVHQ4EFgQU8U/FiJmibLZl2+KcNbVWE2PZipswDgYDVR0P AQH/BAQDAgUgMB8GA1UdIwQYMBaAFNdgZg57SY11TA39z0beyMcSh8q/MDMGA1UdHwQsMCowKKAm oCSGImh0dHA6Ly9jcmwubGwubWl0LmVkdS9nZXRjcmwvTExDQTMwZgYIKwYBBQUHAQEEWjBYMC0G CCsGAQUFBzAChiFodHRwOi8vY3JsLmxsLm1pdC5lZHUvZ2V0dG8vTExDQTMwJwYIKwYBBQUHMAGG G2h0dHA6Ly9vY3NwLmxsLm1pdC5lZHUvb2NzcDA9BgkrBgEEAYI3FQcEMDAuBiYrBgEEAYI3FQiD g+Udh+ynZoathxWD6vBFhbahHx2F69Bwg+vtIAIBZAIBBTAlBgNVHSUEHjAcBgRVHSUABggrBgEF BQcDBAYKKwYBBAGCNwoDBDAYBgNVHSAEETAPMA0GCyqGSIb3EgIBAwEIMBkGA1UdEQQSMBCBDnVy aUBsbC5taXQuZWR1MCcGCSsGAQQBgjcUAgQaHhgATABMAFUAcwBlAHIARQBuAGMALQBTAFcwDQYJ KoZIhvcNAQELBQADggEBABbuvs9m0gS5U8JJuVc+qttV2BWQ0jDepXpYfP/xN8rVScRPHe2SMUaF H5OMRhheGJkdogWVNnMrjHxQfpfc0z8yotlD3xwXENWUY5MoQmpEGB2ksFqgMd121bqzR3WY84Lc osfow0MoplXs8mvO7TnozwM+PtGZs0mpp2PzBkvWdNbs2r/7wXJP6/pLd5zPvywRNhTgoVe1aN4i vIkU8svkKMggv5ZaOsonaW8JS6dUYmvvk0QvDJRIQNRR0zpQpOKp+4V/XhMZRhxQJ3DjVTjh9Q/p HKm7ARFhFr3QAJ6ocCjyzLF5issa1Vshx7ElBIk0cXhep6mLMLqGNX3azAkwggUtMIIEFaADAgEC AgoadMQgAAAAAK0DMA0GCSqGSIb3DQEBCwUAMFExCzAJBgNVBAYTAlVTMR8wHQYDVQQKExZNSVQg TGluY29sbiBMYWJvcmF0b3J5MQwwCgYDVQQLEwNQS0kxEzARBgNVBAMTCk1JVExMIENBLTMwHhcN MTcwMzAxMTgyNTA2WhcNMjAxMjMxMjM1OTU5WjBsMQswCQYDVQQGEwJVUzEfMB0GA1UEChMWTUlU IExpbmNvbG4gTGFib3JhdG9yeTEPMA0GA1UECxMGUGVvcGxlMSswKQYDVQQDEyJCbHVtZW50aGFs LlVyaS41MDAxMDU4NCAoTW9iaWxpdHkpMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA g+8bBB+jySfGyqx/fL9a596qTeq9fGfYXI2yJEZqLzJazzV1u6oLToMnJQ6phCIkQGplPsM+9Ppz Icw5nN8GahHPU6FXXT3BSr6/bny4hftGu05y/n/DWWlPkos6PhSNAB8WG3L+6a3mHcp9yYumPkdt M20+08oiU9S6OhFr6BoFFoeFjKEcFhvvovm9GcRzQ3g1cXHore5p6umBCLGxZi0cGhBI/7ZyJmJU Uo50bAPKdpURqYSsgU7p6GxCgpIcZBUlTxCSliPO/0TqiBMZ857MF4OcehpG7LuxufD0p+g02uX7 Z0aIfYnGHlkm3Y7NgvF6lW2WxCPklqKakb2fuwIDAQABo4IB6jCCAeYwHQYDVR0OBBYEFPbiFDP7 1vJBmRLhxtKU/CWESr+tMA4GA1UdDwEB/wQEAwIGwDAfBgNVHSMEGDAWgBTXYGYOe0mNdUwN/c9G 3sjHEofKvzAzBgNVHR8ELDAqMCigJqAkhiJodHRwOi8vY3JsLmxsLm1pdC5lZHUvZ2V0Y3JsL0xM Q0EzMGYGCCsGAQUFBwEBBFowWDAtBggrBgEFBQcwAoYhaHR0cDovL2NybC5sbC5taXQuZWR1L2dl dHRvL0xMQ0EzMCcGCCsGAQUFBzABhhtodHRwOi8vb2NzcC5sbC5taXQuZWR1L29jc3AwPQYJKwYB BAGCNxUHBDAwLgYmKwYBBAGCNxUIg4PlHYfsp2aGrYcVg+rwRYW2oR8dhYHgQIbXxk0CAWQCAQkw LAYDVR0lAQH/BCIwIAYIKwYBBQUHAwQGCisGAQQBgjcKAwwGCCsGAQUFBwMCMBgGA1UdIAQRMA8w DQYLKoZIhvcSAgEDAQgwQQYDVR0RBDowOIEOdXJpQGxsLm1pdC5lZHWgJgYKKwYBBAGCNxQCA6AY DBZVUjIwOTgwQG1pdGxsLmFkLmxvY2FsMC0GCSsGAQQBgjcUAgQgHh4ATABMAE0AbwBiAGkAbABl AFMAaQBnAEEAdQB0AGgwDQYJKoZIhvcNAQELBQADggEBADbiZo1DkfqhBA4LYklB+i49k6dh7L+n DEg3WdeZ/CRZAon9G3hPsUWd5YIsufRpoYUVJABcVos87kXZmkF1RjH8vLNFOEV8ZVcNxbWC5DiA 6dTswIEhXMSHFuyp3tERvu2z6+f9FC4jvZttYyLyirBJC4KwP/AOLm42Gn4lLeNrY4Ex8nq2Ah3x jB+QqvpxD2k1aaoR0fWaDxv2ZrdaFR43x2MTkiee+wR1diZ7GA7G/HyJg9MUukKq23qm6Ys0VJQc JsKU1Q2/TLL99FRRa18ourBvFwJzcllLhTcqnvbawWt6cYEvGIJ9Dszxz7LQECXI0KrPpM7x32Su lMJjt1YxggLJMIICxQIBATBfMFExCzAJBgNVBAYTAlVTMR8wHQYDVQQKExZNSVQgTGluY29sbiBM YWJvcmF0b3J5MQwwCgYDVQQLEwNQS0kxEzARBgNVBAMTCk1JVExMIENBLTMCChp0xCAAAAAArQMw CQYFKw4DAhoFAKCCAT8wGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcN MTgwODIxMTg0NTE4WjAjBgkqhkiG9w0BCQQxFgQUVIBINBEItegSVqQqfD9mITZOu6AwbgYJKwYB BAGCNxAEMWEwXzBRMQswCQYDVQQGEwJVUzEfMB0GA1UEChMWTUlUIExpbmNvbG4gTGFib3JhdG9y eTEMMAoGA1UECxMDUEtJMRMwEQYDVQQDEwpNSVRMTCBDQS0zAgozOJSPAAAAAG6WMHAGCyqGSIb3 DQEJEAILMWGgXzBRMQswCQYDVQQGEwJVUzEfMB0GA1UEChMWTUlUIExpbmNvbG4gTGFib3JhdG9y eTEMMAoGA1UECxMDUEtJMRMwEQYDVQQDEwpNSVRMTCBDQS0zAgozOJSPAAAAAG6WMA0GCSqGSIb3 DQEBAQUABIIBAFn/+r4oFSWFlH1SuiBgfNjOOJm1z9TY59DMQITSqAodTE7vxIa4nC1voB9Ul+Db rQg8vGjq4eV18WlqqDCW5/azh9h3+892Isrv6HzFMoHj6EFdccHnMQA6/7c0J5mGoEYRLbxYF7G4 Ayt5ubG0hV4fMEI0nP37UvuyFYlBuSoVNt9zdt5fgIEG0NF8QxDB0Nf6Mlnrrtq6OnSmRjnn7Im4 vAWQTr4FfXcEk7XO/zoInEbAZQGR19/tQvnxdDIz5CFzYIHv6kr0jKfzKhAzqo02sE2u9yBZ5/Vg 0bLh7A+/HLXgNyzn4jiohbjVhV3pzQYaTmnswwgJrdryKvf/UBMAAAAAAAA= --Apple-Mail-304785C3-72F7-4F0F-96DD-6416E67773D9-- From nobody Tue Aug 21 16:49:28 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D8026130E54 for ; Tue, 21 Aug 2018 16:49:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QVyg2Y5P4kwx for ; Tue, 21 Aug 2018 16:49:25 -0700 (PDT) Received: from mail-oi0-x233.google.com (mail-oi0-x233.google.com [IPv6:2607:f8b0:4003:c06::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DEFAE130E00 for ; Tue, 21 Aug 2018 16:49:24 -0700 (PDT) Received: by mail-oi0-x233.google.com with SMTP id v8-v6so225490oie.5 for ; Tue, 21 Aug 2018 16:49:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=ZZ/OKI382XTj4OIj0QcGWx8DZFk+/iysZREZB1tvCd4=; b=OKVLg9JkKY9MCmkC405HrRygxTYn6TOcc78dFmkc6bnEY99CyHzF8oOzC9oDNk6sXY y/WtxTeZ2zTe+8rDcMKOuSLQEywx4hQInORyoW6ca5nqIIX24CCpc0IhMfsIKO2wqYR+ hrLBWU6itvosVSs5BWJ62qlmA/HAis3JE3jDsTrTc03IJ26DlpQCoTVT32jXU2dLPt1X 3TWZlHI69oAwC17/WM8qbkTgoVGBC4F23hzHrHTpiwHBmkzJCMj5SJLhipz9FQ6mcIJH oyiczUGLwNpHvUBFCLNpx1e8UVPitqsjX3dW3YOGFtHW2P1ouSDf1ZZ82SNdhtI7rI9d dxiQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=ZZ/OKI382XTj4OIj0QcGWx8DZFk+/iysZREZB1tvCd4=; b=VvSUWZFoco8W8VpxQzO5N9N83E0oReTjmrxQCJfMl9aZ1LkDqA/CbjftxVXL8tLzM/ hJILp8Bbto5cBrDprhwKWK3XT7HE6UT1OYSVvv9lzE8AOXuR3xaXDkFKufZCo1y4RcSa TdzLipydh6wfOFzbNy/z1BrLsgH8LmnnxdnwcAbrdBLymqCW9flrHs0UIcMuxl+Z0LLY otyVY++B166fkMCC6jqIyQQ7gdmDxmWspWfWVFXTaW+WYB+/1U6eC/n9Gal1XWIlbhAW 35cX7rD+kQmdV5e6b2m2Cqx3j8Inuxf7/bBcvuGm1Kbp3QyaxLfh+UuChMyOu/mJUBz3 gnWg== X-Gm-Message-State: APzg51CHi2RZ1HoPrr7G7+Xdar06E2GBV18bR6XInoTgvaDac4MCg5+j Aq56vUJzACnzhVR459Wfqwv9LVriK64xKXnDm7s= X-Google-Smtp-Source: ANB0VdYA6m0AQbDfSWsnTkxn1sJngvFXNfNTSjHZp0wqvDIGcgyoyvJklkj2mdrTnZ8O2r56cZN7gRhTMF6eSplnrdQ= X-Received: by 2002:a54:448b:: with SMTP id v11-v6mr1669698oiv.208.1534895364139; Tue, 21 Aug 2018 16:49:24 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Martin Thomson Date: Wed, 22 Aug 2018 09:49:13 +1000 Message-ID: To: Richard Barnes Cc: Geoffrey Keating , ncamwing=40cisco.com@dmarc.ietf.org, "" Content-Type: text/plain; charset="UTF-8" Archived-At: Subject: Re: [TLS] integrity only ciphersuites X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Aug 2018 23:49:27 -0000 On Wed, Aug 22, 2018 at 12:07 AM Richard Barnes wrote: > I'm agnostic w.r.t. confidentiality of application data -- we've historically been bad at making decision about what does / does not need to be confidential, but hey, it's your data. Isn't this assumption - "this data is mine" - part of the reason we get into trouble here? That is, the decision is often based on a mistaken assumption about who might be affected by a loss of confidentiality. From nobody Tue Aug 21 16:58:34 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3D574130E47 for ; Tue, 21 Aug 2018 16:58:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.009 X-Spam-Level: X-Spam-Status: No, score=-2.009 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cloudflare.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6t2j-WDAitIL for ; Tue, 21 Aug 2018 16:58:31 -0700 (PDT) Received: from mail-oi0-x243.google.com (mail-oi0-x243.google.com [IPv6:2607:f8b0:4003:c06::243]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D01B9130E00 for ; Tue, 21 Aug 2018 16:58:30 -0700 (PDT) Received: by mail-oi0-x243.google.com with SMTP id w126-v6so237618oie.7 for ; Tue, 21 Aug 2018 16:58:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cloudflare.com; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to; bh=fwIbUwzq/N/sBNFcwUUiz4yLi83uOfbQmGXIs/IsltM=; b=tRBchu5+9ehatsxSCORt2/g558utuad2oyrgc2nuB9scY5dKX6drZzN3wvJRSMBJkj KNPOVM4OlnxCHIZt25UkLEflXyiJQIjwASamUu8Azs3CjLi0a1TeVw7GW7fjJRHJOmlo cH3zfOrz4Jv+sv5k4B5AP80LEwqaX85Dpkl2Y= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to; bh=fwIbUwzq/N/sBNFcwUUiz4yLi83uOfbQmGXIs/IsltM=; b=fIlIwTD+mgdSdpiT2qPd0vrQ9DlJNcuYk759AzjNHRWAxNzz5qSh3RvJuC5b0ec5/W 6LSOyxQgKLAOZc4BvfM3SgBrICWWeYrZlS6T003HGOaTOLwoIH0IMUmY6Qa4HqvSJKbL 6hKQlbghnPAwblZky+Jd3FnbW2t1QeuX2FwBOnyYISoh1ioUm0D7pk/5aAyk2pmON7H4 dB4abs7MFwQWWVS9O2L+aeYICdcFO5YQCGtZv2M9ubvaTqRRPO7/N6XHPKYCYHpY6mXD GxOX+M6gHkBns3MD96E7woE0IH/tERJWlfB8zh+Tz5N6ARXeTzWHb+aG6/uKjcnE151B lsNA== X-Gm-Message-State: APzg51DvHcRUxhrMIE6Qzj6pDqmpfST0G4wCe38dq5lD9irhjqTf5wCg rgQ0rDEKeg7DcN7vZaSrf3Q8GayY5GmJCSMPqbQ6FEUkjII= X-Google-Smtp-Source: ANB0VdahCS8CEpFyoWoOUb0o2llXncQeiJ3Xnir37/AwX1a2aaHcxqcF3sb/6usAPtFaHv1GORI4aKDxVAyAmpJpz/s= X-Received: by 2002:aca:ceca:: with SMTP id e193-v6mr1660401oig.37.1534895909893; Tue, 21 Aug 2018 16:58:29 -0700 (PDT) MIME-Version: 1.0 References: <153452996807.17993.9462517497546257447@ietfa.amsl.com> In-Reply-To: <153452996807.17993.9462517497546257447@ietfa.amsl.com> From: Nick Sullivan Date: Tue, 21 Aug 2018 16:58:17 -0700 Message-ID: To: tls@ietf.org Content-Type: multipart/alternative; boundary="0000000000007a17410573facdf6" Archived-At: Subject: Re: [TLS] I-D Action: draft-ietf-tls-subcerts-02.txt X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Aug 2018 23:58:33 -0000 --0000000000007a17410573facdf6 Content-Type: text/plain; charset="UTF-8" tlswg, After incorporating feedback from the working group, we have published draft 02 of Delegated Credentials. It contains the following changes from draft -01: (*) indicates changes to the wire protocol. - Change public key type. (*) - Change DelegationUsage extension to be NULL and define its object identifier. - Drop support for TLS 1.2. - Add the protocol version and credential signature algorithm to the Credential structure. (*) - Specify undefined behavior in a few cases: when the client receives a DC without indicated support; when the client indicates the extension in an invalid protocol version; and when DCs are sent as extensions to certificates other than the end-entity certificate. Nick On Fri, Aug 17, 2018 at 11:19 AM wrote: > > A New Internet-Draft is available from the on-line Internet-Drafts > directories. > This draft is a work item of the Transport Layer Security WG of the IETF. > > Title : Delegated Credentials for TLS > Authors : Richard Barnes > Subodh Iyengar > Nick Sullivan > Eric Rescorla > Filename : draft-ietf-tls-subcerts-02.txt > Pages : 12 > Date : 2018-08-17 > > Abstract: > The organizational separation between the operator of a TLS server > and the certification authority can create limitations. For example, > the lifetime of certificates, how they may be used, and the > algorithms they support are ultimately determined by the > certification authority. This document describes a mechanism by > which operators may delegate their own credentials for use in TLS, > without breaking compatibility with clients that do not support this > specification. > > > The IETF datatracker status page for this draft is: > https://datatracker.ietf.org/doc/draft-ietf-tls-subcerts/ > > There are also htmlized versions available at: > https://tools.ietf.org/html/draft-ietf-tls-subcerts-02 > https://datatracker.ietf.org/doc/html/draft-ietf-tls-subcerts-02 > > A diff from the previous version is available at: > https://www.ietf.org/rfcdiff?url2=draft-ietf-tls-subcerts-02 > > > Please note that it may take a couple of minutes from the time of > submission > until the htmlized version and diff are available at tools.ietf.org. > > Internet-Drafts are also available by anonymous FTP at: > ftp://ftp.ietf.org/internet-drafts/ > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > --0000000000007a17410573facdf6 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
tlswg,

After incorporating f= eedback from the working group, we have published draft 02 of Delegated Cre= dentials. It contains the following changes from draft -01:

<= /div>
=C2=A0(*) indicates changes to the wire protocol.
<= div>- Change public key type. (*)
- Change DelegationUsage ex= tension to be NULL and define its object identifier.
- Drop suppo= rt for TLS 1.2.
- Add the protocol version and credential signatu= re algorithm to the Credential structure. (*)
- Specify undefined= behavior in a few cases: when the client receives a DC without indicated s= upport; when the client indicates the extension in an invalid protocol vers= ion; and when DCs are sent as extensions to certificates other than the end= -entity certificate.

Nick

On Fri, Aug 17, 2018 at 11:19 AM <= ;internet-drafts@ietf.org&g= t; wrote:

A New Internet-Draft is available from the on-line Internet-Drafts director= ies.
This draft is a work item of the Transport Layer Security WG of the IETF.
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Title=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0:= Delegated Credentials for TLS
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Authors=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0: Rich= ard Barnes
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 Subodh Iyengar
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 Nick Sullivan
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 Eric Rescorla
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Filename=C2=A0 =C2=A0 =C2=A0 =C2=A0 : draft-iet= f-tls-subcerts-02.txt
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Pages=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0:= 12
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Date=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 := 2018-08-17

Abstract:
=C2=A0 =C2=A0The organizational separation between the operator of a TLS se= rver
=C2=A0 =C2=A0and the certification authority can create limitations.=C2=A0 = For example,
=C2=A0 =C2=A0the lifetime of certificates, how they may be used, and the =C2=A0 =C2=A0algorithms they support are ultimately determined by the
=C2=A0 =C2=A0certification authority.=C2=A0 This document describes a mecha= nism by
=C2=A0 =C2=A0which operators may delegate their own credentials for use in = TLS,
=C2=A0 =C2=A0without breaking compatibility with clients that do not suppor= t this
=C2=A0 =C2=A0specification.


The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ie= tf-tls-subcerts/

There are also htmlized versions available at:
https://tools.ietf.org/html/draft-ietf-tls-sub= certs-02
https://datatracker.ietf.org/doc/htm= l/draft-ietf-tls-subcerts-02

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=3Ddr= aft-ietf-tls-subcerts-02


Please note that it may take a couple of minutes from the time of submissio= n
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls
--0000000000007a17410573facdf6-- From nobody Tue Aug 21 18:56:01 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 385B11271FF for ; Tue, 21 Aug 2018 18:56:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_MED=-2.3] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=auckland.ac.nz Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zDyoXKs55Lzd for ; Tue, 21 Aug 2018 18:55:57 -0700 (PDT) Received: from mx4-int.auckland.ac.nz (mx4-int.auckland.ac.nz [130.216.125.246]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3B0E9130E06 for ; Tue, 21 Aug 2018 18:55:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=auckland.ac.nz; i=@auckland.ac.nz; q=dns/txt; s=mail; t=1534902956; x=1566438956; h=from:to:subject:date:message-id:references:in-reply-to: content-transfer-encoding:mime-version; bh=8d2wWKgWTQp6QccWoGzY4kxJRAH9t9pzIDh9pdlxhe4=; b=t6DtNUvVBuVM41G7geYpa5sBl+s4nlGDVxtQuzOuDAZoqGuji5Hc11w1 vmhhFewJcTWh4DgkqGndPDuisUJL+PcxL8fcVji9d1iVmX3sbUQpoyViC MZjD31NsaPBkN2yWr5kS20ow5PpBVrAmfKpeYAVa3tSCGtUj7cF9FeNru vWgHMB+fq1IacGlbyu6RpaJGsSA33NfyqSLJfFeapsEiMT6KUqcuDfrB3 2PB/rGpsfy0MQQsAdgx5+SaEWUB+YdTyRHDuTMM4/gMGU+k80/26EnUWX 8DYfuWoRbTH0vJBqQFoykAlCcO+W7vGq7AkWtsXPEoMxZ1FZ68oP9JvQt w==; X-IronPort-AV: E=Sophos;i="5.53,271,1531742400"; d="scan'208";a="27487896" X-Ironport-HAT: MAIL-SERVERS - $RELAYED X-Ironport-Source: 10.6.3.3 - Outgoing - Outgoing Received: from smtp.uoa.auckland.ac.nz (HELO uxcn13-tdc-b.UoA.auckland.ac.nz) ([10.6.3.3]) by mx4-int.auckland.ac.nz with ESMTP/TLS/AES256-SHA; 22 Aug 2018 13:55:48 +1200 Received: from uxcn13-ogg-d.UoA.auckland.ac.nz (10.6.2.5) by uxcn13-tdc-b.UoA.auckland.ac.nz (10.6.3.3) with Microsoft SMTP Server (TLS) id 15.0.1263.5; Wed, 22 Aug 2018 13:55:47 +1200 Received: from uxcn13-ogg-d.UoA.auckland.ac.nz ([10.6.2.25]) by uxcn13-ogg-d.UoA.auckland.ac.nz ([10.6.2.5]) with mapi id 15.00.1263.000; Wed, 22 Aug 2018 13:55:47 +1200 From: Peter Gutmann To: "" Thread-Topic: [TLS] null auth ciphers for TLS 1.3? Thread-Index: AQHUOX2lW5iiFd3Y5EGHioHTXcVVVaTLAvVp Date: Wed, 22 Aug 2018 01:55:47 +0000 Message-ID: <1534902946308.39422@cs.auckland.ac.nz> References: <64d23891-2f32-9bb8-1ec8-f4fad13cdfb9@cs.tcd.ie> <982363FD-A839-4175-BA53-7CA242F9ADA6@ll.mit.edu> <2D7F2926-6376-4B2C-BDE9-7A6F1C0FA748@gmail.com> <5B7C1571020000AC0015C330@gwia2.rz.hs-offenburg.de> <8A2746A8-6B41-45C3-9D77-6AF3536C6E2D@siemens.com> , <3321850E-D95E-457C-A574-2A1A3F7AC06C@dukhovni.org> In-Reply-To: <3321850E-D95E-457C-A574-2A1A3F7AC06C@dukhovni.org> Accept-Language: en-NZ, en-GB, en-US Content-Language: en-NZ X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [130.216.158.4] Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [TLS] null auth ciphers for TLS 1.3? X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Aug 2018 01:56:00 -0000 Viktor Dukhovni writes:=0A= =0A= >I've not yet seen raw public key support in any mainstream TLS libraries,= =0A= >though admittedly my focus is primarily on OpenSSL. Do any of NSS, GnuTLS= ,=0A= >BoringSSL, LibreSSL, ... support raw public keys?=0A= =0A= I've never seen it either. My code does actually support them, but not in = the=0A= way you think, for devices that don't have the ability to deal with certs= =0A= there's the memcpy()-into-send() certificate implementation I've mentioned= =0A= before, you memcpy() a pre-encoded cert chain onto the network, and for=0A= receiving memcpy() the data in and pick out the SPKI. So in effect it's ra= w=0A= public keys, but to anyone watching it looks like it's certificates. There= =0A= are other embedded implementations that do this too, it's a pretty obvious= =0A= optimisation (in other words I'm not trying to claim credit for inventing i= t).=0A= =0A= >We'd need to invent some sort of special X.509 object that holds only a=0A= >public key, but behaves in some sensible way when used with functions that= =0A= >expect X.509 certificates.=0A= =0A= That's exactly what my code does, but with certificates=0A= (CONFIG_USE_PSEUDOCERTIFICATES). So there's no need for raw public keys, y= ou=0A= just treat certs as raw keys and everything works the way it already does w= ith=0A= certificates.=0A= =0A= Is there any known actual use of raw public keys for TLS?=0A= =0A= Peter.=0A= From nobody Tue Aug 21 19:16:08 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E8823130DD4 for ; Tue, 21 Aug 2018 19:16:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_MED=-2.3] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=auckland.ac.nz Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RzIxNG8DAZXL for ; Tue, 21 Aug 2018 19:16:02 -0700 (PDT) Received: from mx4-int.auckland.ac.nz (mx4-int.auckland.ac.nz [130.216.125.246]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2E635129619 for ; Tue, 21 Aug 2018 19:16:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=auckland.ac.nz; i=@auckland.ac.nz; q=dns/txt; s=mail; t=1534904162; x=1566440162; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-transfer-encoding:mime-version; bh=t3N+a//sP+VN7FlvJXEQ1ynYHJi+0AN7gNz2rMKPYe0=; b=hadDckcwG8oJtuUkk3x/Ezd19QBaO3oTBW4m0CD7TeT/gG5PnJg7O7Bf pg/hrx60LhqHoWUVUw2swhWUCssKh1oyl5pzgHVfizIqsrSsljUSNE+nB NygBQXj3xnBRaayTfeqnCD+5C2jrW2Fq4FyX8amgf+HJJTWAAZclissov VNEizH7PQ64xjczZXyOVQeQH8SQ0mrqENenLzy5hKnpKLG5xeTRcZ5SqQ UjfRb06qPEuRDP6SZV8HPZuphVauxctNBjH5/VttCW5I7xQ36zXPYmPRI xJ6QQzV3FfFqoUY76m9+q630M+/BR6Ygj8jaWlkWs91tJIvOyKWoisXpP Q==; X-IronPort-AV: E=Sophos;i="5.53,272,1531742400"; d="scan'208";a="27491309" X-Ironport-HAT: MAIL-SERVERS - $RELAYED X-Ironport-Source: 10.6.2.5 - Outgoing - Outgoing Received: from uxcn13-ogg-d.uoa.auckland.ac.nz ([10.6.2.5]) by mx4-int.auckland.ac.nz with ESMTP/TLS/AES256-SHA; 22 Aug 2018 14:16:00 +1200 Received: from uxcn13-ogg-d.UoA.auckland.ac.nz (10.6.2.5) by uxcn13-ogg-d.UoA.auckland.ac.nz (10.6.2.5) with Microsoft SMTP Server (TLS) id 15.0.1263.5; Wed, 22 Aug 2018 14:15:59 +1200 Received: from uxcn13-ogg-d.UoA.auckland.ac.nz ([10.6.2.25]) by uxcn13-ogg-d.UoA.auckland.ac.nz ([10.6.2.5]) with mapi id 15.00.1263.000; Wed, 22 Aug 2018 14:15:59 +1200 From: Peter Gutmann To: "Salz, Rich" , "Fries, Steffen" , Andreas Walz , "tls@ietf.org" CC: "ncamwing=40cisco.com@dmarc.ietf.org" Thread-Topic: [TLS] integrity only ciphersuites Thread-Index: AQHUOMcWIQ0ztQCz9UKccOekmBKud6TJTRwAgAAIA4CAABIugIAABgCAgAAjtgCAAAI8AIAAAkEAgAADmoCAAXDR3g== Date: Wed, 22 Aug 2018 02:15:58 +0000 Message-ID: <1534904156874.85231@cs.auckland.ac.nz> References: <64d23891-2f32-9bb8-1ec8-f4fad13cdfb9@cs.tcd.ie> <982363FD-A839-4175-BA53-7CA242F9ADA6@ll.mit.edu> <2D7F2926-6376-4B2C-BDE9-7A6F1C0FA748@gmail.com> <5B7C1571020000AC0015C330@gwia2.rz.hs-offenburg.de> , In-Reply-To: Accept-Language: en-NZ, en-GB, en-US Content-Language: en-NZ X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [130.216.158.4] Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [TLS] integrity only ciphersuites X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Aug 2018 02:16:07 -0000 Salz, Rich writes:=0A= =0A= >Most browsers already do not support NULL encryption, and it is highly=0A= >unlikely that any will add it for 1.3. Have you any indication otherwise?= =0A= >If you=92re not going to use the algorithms in general use on the public= =0A= >Internet, then you should expect that standard clients such as browsers, w= ill=0A= >not work. PeterG can attest to this. :)=0A= =0A= I'm going to have to handwave a bit on this, but a lot of TLS in embedded i= s=0A= purely M2M, e.g. in IEDs (that's "intelligent electronic device", not=0A= something that goes bang, although sometimes the things they control like= =0A= reclosers can go bang). One or two levels above that are supervisory syste= ms=0A= that may need to talk a non-SCADA-profile TLS, but then they're often runni= ng=0A= Windows or something similar and will talk whatever the browser needs. So = in=0A= effect you've got a translation layer from SCADA-profile-TLS to whatever fo= rm=0A= of TLS is in fashion in browsers at the moment.=0A= =0A= Alternatively, you get extremely expensive control center software that=0A= probably just wraps the Windows WebBrowser control in a custom app, althoug= h=0A= I've seen some that use oddball ancient cipher suites so presumably they're= =0A= using the programmability of the components to ensure continued support for= =0A= older deployed gear.=0A= =0A= That's only a high-level, handwavy view...=0A= =0A= Peter.=0A= =0A= From nobody Tue Aug 21 19:52:05 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 63263130DE6 for ; Tue, 21 Aug 2018 19:52:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_MED=-2.3] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=auckland.ac.nz Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xWsSpFTwsD2Q for ; Tue, 21 Aug 2018 19:52:01 -0700 (PDT) Received: from mx4-int.auckland.ac.nz (mx4-int.auckland.ac.nz [130.216.125.246]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0F3B8130DE2 for ; Tue, 21 Aug 2018 19:52:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=auckland.ac.nz; i=@auckland.ac.nz; q=dns/txt; s=mail; t=1534906321; x=1566442321; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-transfer-encoding:mime-version; bh=nN4ZnXtoVbGayg69VKopHLUYG82F+fr4SZ4mDeiC86I=; b=2NcoYh2UZTj6GncQbkZ68LirDvq3j7EVwwUJs+oMhjD34hVoogjj9ZxH bnyJvGgPsCDNk7yW4DWwP8kEL3Pp4fVvNm38pCqtFHQUFPDZb+pGH7k7T 3/37JhFadIK92X1f9GA5Cap9zNZE/2G9ZS9GVW4fFkZgXtu+TLNd2CxUI hSZy+X4tN7BJpWzOQZzHygpuK5WgduhsLOB1k+FFbRhjWaX1uBmfBdKp9 tMtiNPd1zQPJSNVXLzWLl7t5cQ34emrUOkcOHkLgX4AZGLNIB4yykoXUD TsEO8YWS8RouLcQP3A4DQKSlIDlyYhd1AiwSpKD2mn8+oCvEoR9/PVQPj Q==; X-IronPort-AV: E=Sophos;i="5.53,272,1531742400"; d="scan'208";a="27497271" X-Ironport-HAT: MAIL-SERVERS - $RELAYED X-Ironport-Source: 10.6.3.4 - Outgoing - Outgoing Received: from exchangemx.uoa.auckland.ac.nz (HELO uxcn13-tdc-c.UoA.auckland.ac.nz) ([10.6.3.4]) by mx4-int.auckland.ac.nz with ESMTP/TLS/AES256-SHA; 22 Aug 2018 14:51:58 +1200 Received: from uxcn13-ogg-d.UoA.auckland.ac.nz (10.6.2.5) by uxcn13-tdc-c.UoA.auckland.ac.nz (10.6.3.4) with Microsoft SMTP Server (TLS) id 15.0.1263.5; Wed, 22 Aug 2018 14:51:57 +1200 Received: from uxcn13-ogg-d.UoA.auckland.ac.nz ([10.6.2.25]) by uxcn13-ogg-d.UoA.auckland.ac.nz ([10.6.2.5]) with mapi id 15.00.1263.000; Wed, 22 Aug 2018 14:51:57 +1200 From: Peter Gutmann To: Jack Visoky , "Salz, Rich" , "Salz, Rich" , "Fries, Steffen" CC: "ncamwing=40cisco.com@dmarc.ietf.org" , "tls@ietf.org" Thread-Topic: [TLS] EXTERNAL: Re: integrity only ciphersuites Thread-Index: AQHUOXVWYE9NHymwGkOkdCwKjbQlv6TJsXmAgAADowCAAV3txw== Date: Wed, 22 Aug 2018 02:51:57 +0000 Message-ID: <1534906315720.1588@cs.auckland.ac.nz> References: <64d23891-2f32-9bb8-1ec8-f4fad13cdfb9@cs.tcd.ie> <982363FD-A839-4175-BA53-7CA242F9ADA6@ll.mit.edu> <2D7F2926-6376-4B2C-BDE9-7A6F1C0FA748@gmail.com> <5B7C1571020000AC0015C330@gwia2.rz.hs-offenburg.de> <8A2746A8-6B41-45C3-9D77-6AF3536C6E2D@siemens.com> , In-Reply-To: Accept-Language: en-NZ, en-GB, en-US Content-Language: en-NZ X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [130.216.158.4] Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [TLS] EXTERNAL: Re: integrity only ciphersuites X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Aug 2018 02:52:04 -0000 Jack Visoky writes:=0A= =0A= >What we did in ODVA was to add TLS (and DTLS in some cases) to protect thi= s=0A= >communication.=0A= =0A= What about using LoRa security?=A0 That's actually a really nice design for= a=0A= lot of SCADA environments (particularly for something that came from a behi= nd-=0A= closed-doors background), and not tied to LoRaWAN in any way.=A0 In particu= lar=0A= they took a complete-infrastructure view, not just "we'll specify the crypt= o,=0A= the rest is someone else's problem", e.g. the concept of device <-> gateway= =0A= and device <-> application security, OTA enrolment, etc.=A0 If you're doing= M2M=0A= then you don't need TLS, just use LoRa.=0A= =0A= Peter.= From nobody Tue Aug 21 20:08:50 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 98E7A130DE6 for ; Tue, 21 Aug 2018 20:08:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uGPHyBx-Pcza for ; Tue, 21 Aug 2018 20:08:47 -0700 (PDT) Received: from straasha.imrryr.org (straasha.imrryr.org [100.2.39.101]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EF0601277D2 for ; Tue, 21 Aug 2018 20:08:46 -0700 (PDT) Received: by straasha.imrryr.org (Postfix, from userid 1001) id 2426B295554; Tue, 21 Aug 2018 23:08:46 -0400 (EDT) Date: Tue, 21 Aug 2018 23:08:46 -0400 From: Viktor Dukhovni To: tls@ietf.org Message-ID: <20180822030846.GN28851@straasha.imrryr.org> Reply-To: tls@ietf.org References: <8A2746A8-6B41-45C3-9D77-6AF3536C6E2D@siemens.com> <3321850E-D95E-457C-A574-2A1A3F7AC06C@dukhovni.org> <1534902946308.39422@cs.auckland.ac.nz> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1534902946308.39422@cs.auckland.ac.nz> User-Agent: Mutt/1.10.1 (2018-07-13) Archived-At: Subject: Re: [TLS] raw public keys in the wild? X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Aug 2018 03:08:49 -0000 On Wed, Aug 22, 2018 at 01:55:47AM +0000, Peter Gutmann wrote: > Viktor Dukhovni writes: > > >I've not yet seen raw public key support in any mainstream TLS libraries, > >though admittedly my focus is primarily on OpenSSL. Do any of NSS, GnuTLS, > >BoringSSL, LibreSSL, ... support raw public keys? > > I've never seen it either. My code does actually support them, but not in the > way you think, for devices that don't have the ability to deal with certs > there's the memcpy()-into-send() certificate implementation I've mentioned > before, you memcpy() a pre-encoded cert chain onto the network, and for > receiving memcpy() the data in and pick out the SPKI. So in effect it's raw > public keys, but to anyone watching it looks like it's certificates. There > are other embedded implementations that do this too, it's a pretty obvious > optimisation (in other words I'm not trying to claim credit for inventing it). Some DANE users have reached similar conclusions, though a bit of ASN.1 parsing is still required to "seek" to the SPKI, which is not at a fixed offset in the certificate. Here is one DANE-authenticated certificate seen on a live SMTP server: serial=C3262B13CAB13672 issuer= notBefore=Jul 27 14:59:59 2014 GMT notAfter=Nov 27 14:59:59 3013 GMT subject= -----BEGIN CERTIFICATE----- MIIE1TCCAr2gAwIBAgIJAMMmKxPKsTZyMA0GCSqGSIb3DQEBCwUAMAAwIBcNMTQw NzI3MTQ1OTU5WhgPMzAxMzExMjcxNDU5NTlaMAAwggIiMA0GCSqGSIb3DQEBAQUA A4ICDwAwggIKAoICAQC200I1aOkqnrr48PS/MLULQM0QSyCUqvzo07G4Fcwkun+V tYWS6dWXcNP9s8mRutWFXcZtmIvDs3l0p0HG9N8UU7uQIXJxuuJWAwoLqdvVktOQ WE7rpItRgNtfVibPmyaoLkLfVBSGTh+tspxXVBZ6OSWjs5CX63CSBCcQtv2ecE+y AuL6bZDrmgxkPDGGTJiZRwB1ttC7gAITx0OXJOwePrEc1se33vzou8bYIHQWCSct FxelpEHQ9mDeooT65I3dHph+GXWkh1IYRdltOT4ssmQaEzcmP3KMff4u1ibXzDeq Bkov6rwPAF/VMHnoESFkA7mR5dpHa31D5l4g6B0dHj24V2IBmBNbzKifa9I04G+G uKydifHpJ7n4Vc6iijMrrDplwPsSuPdaR6bqg4CID8rU1dxiXAjZz+bK/jIAnuPA U5kho8lPZgf8YeIgGAF/Yd3hcrX9w5cjKlG/QlhkDStOzIWgXgFSK3tG8GMZm6Ne LHAjNqOpOrNgLq14aJbOpEzqE3cCl8RVgvP9O/P0ZU7dO/7S3dDaKeg+3anjxhbb 6/iQctxUNxcVyUMf3p1bAl4DqT54dRVNvIS/oH5KaH0rxsW12gmL80VugiuLvuld t7Pw6A0EjOO4yiMd3BAJCS4evyNMZ75kwZD9YlcX1DPmHUxw11j2F17SS9UfmwID AQABo1AwTjAdBgNVHQ4EFgQUmMab1SBcHagxOb14ETf/va1bvVkwHwYDVR0jBBgw FoAUmMab1SBcHagxOb14ETf/va1bvVkwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0B AQsFAAOCAgEAjUcd319j7Nt7o6OmUNB29RqG2iG/eE1Mq++vob7ppSkgawWjiIUO Vxec5oz1h8cHo3vtffQDB1putL+c220zJK5NDjkGVJ5xaPZdWOkZ/+/i5Xypudoh 3RQZ2MFrq679L4YUuY+/d3W4B8wKYooAmMT7Duzv9xGICgUO75vAmOA5R8CDr1r2 qj2PLF2xlbSToYa/HbFFkeV/b2OrWc8DTsA3/s6fLc1koYFiAHkyTbBDLlhux3n3 tnS+yWXGL9DpuFZg1EZI2G3asoFZqfSUjMSf9qsWb/EE5+kquwQfTcXC4AuwYNgc MVnaxjJsd4vb53eITRVFyeq4lVrT1l8Z7c1dhA0wdXCso5ptg/68YPq7K0jXEutK 40C/AVapDdT8SYhwawokNujC3epsZ89e0gp6MbiSk3z1jJGO6dk57B/ymAw91TMz U72xY7YY4yDGUCrxCVBdiGl2kTihwUdxCRJ1baAXcq3meEAY0wQEcDq/dEUMSHp7 /gr9/8uu94VQ+uIjc4dU6oB+yV/agD+vBDpY2EskdVigxZQKuI5iFX4+2kGoooAb xkMDriyM/MeD3zjfuBLSrMEQtGZ1d8ilb0kWxCcEwv5SpO9ihiUA584C501syGCD H0y62RuD2sxdv4k3BKeFYt5NLE7QE8TNgVFKsAdTlW9Cni4yEnscwcM= -----END CERTIFICATE----- Basically, just the public key, and self-signature, authenticated via: _25._tcp.. IN TLSA 3 1 2 ( 1b97b159e9835555d568841b623cf14a 626ccf56fc70b82849cfeb0e802ffc95 c4e6620f5848d3d58f6d9ef8cf6b0402 55093e7ac946d209d7d72639bd917d92 ) It does not stricly comply with RFC5280, which forbids empty RDN sequences for the issuer field, but this does not seem to be a problem in practice. -- Viktor. From nobody Tue Aug 21 21:48:19 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 91C73130E00 for ; Tue, 21 Aug 2018 21:48:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_MED=-2.3] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=auckland.ac.nz Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id U2_KK_p8mGrs for ; Tue, 21 Aug 2018 21:48:15 -0700 (PDT) Received: from mx4-int.auckland.ac.nz (mx4-int.auckland.ac.nz [130.216.125.246]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 55D6C12F1A6 for ; Tue, 21 Aug 2018 21:48:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=auckland.ac.nz; i=@auckland.ac.nz; q=dns/txt; s=mail; t=1534913295; x=1566449295; h=from:to:subject:date:message-id:references:in-reply-to: content-transfer-encoding:mime-version; bh=VyqqWwtMIQaRANLcoVHMj5NLoyBKGei5w8UGVLgYqas=; b=UZnU2py/b26ADEMZmVrP/bJ+nxMMiv9NJaMLcpruzsojQ1lR4ZI+JVlo DmNSngbVivww0DZOIWr9K0bOR+ysDBp4KtFrm3hnoB9wPPiEHKK6wgd1O DEZCAbMbiDerbDyJ3b59avM1EPC0YCrffKG13l4soS6sSweeKezjXl6dt xDM23LwiBETw9PTTGegDrL1QsKwmKaztxcxSsp7cOapzD9mkvqIiJyr4v wENSmnsTFuwOY3Aexs2BQUwg3cobwshYanWS6/5cWbgPonLOJTfLUdeCm Gcne2cZPCJPJ362bFDoooBDGGpgP45fnDs26qgzQNxhUycQ2ggXCL429Z g==; X-IronPort-AV: E=Sophos;i="5.53,272,1531742400"; d="scan'208";a="27516988" X-Ironport-HAT: MAIL-SERVERS - $RELAYED X-Ironport-Source: 10.6.2.8 - Outgoing - Outgoing Received: from exchangemx.uoa.auckland.ac.nz (HELO uxcn13-ogg-e.UoA.auckland.ac.nz) ([10.6.2.8]) by mx4-int.auckland.ac.nz with ESMTP/TLS/AES256-SHA; 22 Aug 2018 16:48:08 +1200 Received: from uxcn13-ogg-d.UoA.auckland.ac.nz (10.6.2.5) by uxcn13-ogg-e.UoA.auckland.ac.nz (10.6.2.28) with Microsoft SMTP Server (TLS) id 15.0.1263.5; Wed, 22 Aug 2018 16:48:08 +1200 Received: from uxcn13-ogg-d.UoA.auckland.ac.nz ([10.6.2.25]) by uxcn13-ogg-d.UoA.auckland.ac.nz ([10.6.2.5]) with mapi id 15.00.1263.000; Wed, 22 Aug 2018 16:48:08 +1200 From: Peter Gutmann To: "tls@ietf.org" Thread-Topic: [TLS] raw public keys in the wild? Thread-Index: AQHUOcWQZiAmmORWDkmlLmr2ZKQP7qTLMsU3 Date: Wed, 22 Aug 2018 04:48:07 +0000 Message-ID: <1534913286161.86694@cs.auckland.ac.nz> References: <8A2746A8-6B41-45C3-9D77-6AF3536C6E2D@siemens.com> <3321850E-D95E-457C-A574-2A1A3F7AC06C@dukhovni.org> <1534902946308.39422@cs.auckland.ac.nz>, <20180822030846.GN28851@straasha.imrryr.org> In-Reply-To: <20180822030846.GN28851@straasha.imrryr.org> Accept-Language: en-NZ, en-GB, en-US Content-Language: en-NZ X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [130.216.158.4] Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [TLS] raw public keys in the wild? X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Aug 2018 04:48:18 -0000 Viktor Dukhovni writes:=0A= =0A= >Some DANE users have reached similar conclusions, though a bit of ASN.1=0A= >parsing is still required to "seek" to the SPKI, which is not at a fixed= =0A= >offset in the certificate.=0A= =0A= It's actually much simpler than that because you've got a nice unique byte= =0A= string, the OID, in front of the key. My code jumps 64 bytes in and then= =0A= scans from there looking for the byte string corresponding to SEQUENCE { RS= A=0A= OID, NULL }. What follows is the public key, you skip the wrapper bytes an= d=0A= grab the two integer values that follow.=0A= =0A= > 41 32: SEQUENCE {=0A= > 43 13: UTCTime 27/07/2014 14:59:59 GMT=0A= > 58 15: GeneralizedTime 27/11/3013 14:59:59 GMT=0A= > : }=0A= =0A= Yeah, seen those sorts of things too, my code has special-case handling to= =0A= clip validTo at 32-bit INT_MAX - 1 if it sees long lifetimes (getting=0A= pedantic, it's actually 2036 since some embedded libraries have problems wi= th=0A= time_t values too close to INT_MAX).=0A= =0A= >It does not stricly comply with RFC5280, which forbids empty RDN sequences= =0A= >for the issuer field, but this does not seem to be a problem in practice.= =0A= =0A= Yup. If all you're doing is a string search for the RSA OID, no-one cares= =0A= what else is or isn't present.=0A= =0A= Peter.=0A= From nobody Tue Aug 21 23:04:54 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 07B47130E48 for ; Tue, 21 Aug 2018 23:04:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.75 X-Spam-Level: X-Spam-Status: No, score=-1.75 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_ENVFROM_END_DIGIT=0.25, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cvXQsBClV0hR for ; Tue, 21 Aug 2018 23:04:51 -0700 (PDT) Received: from mail-io0-x22c.google.com (mail-io0-x22c.google.com [IPv6:2607:f8b0:4001:c06::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A1E3C130DF6 for ; Tue, 21 Aug 2018 23:04:51 -0700 (PDT) Received: by mail-io0-x22c.google.com with SMTP id e12-v6so587248iok.12 for ; Tue, 21 Aug 2018 23:04:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to; bh=jFk6JtJTaRjagN/TEZ+aA/1Ybh7D9PIOsrgXWAdV8hY=; b=B+0y+3flkXLCs2ttFapAOZd58b8A/WvDtHN8DG8rnSJC+JE6UHTWN4OKYfG0H26vh5 wRpXBYYqtD92PIBQj6kF0I0IbyzWngG8RusExXF3lPobBX6n2SNp/jmfXGugM28hBQFt yAtyialyfSRrYVlRJmZO8++wFgIlzMcgKn6rgHjluTL2THN6qH3SELFzZxmdZagxLWMg XHgWnJ2Ou3XbVmc2CGnGnPCYKEt0FTiAlgcJtsOnjlCl1rwCE1+8ThsoxorKfjJU6Wx4 b9mzfI3sEBNc9/KjUlWP3z+2Xr3JYh4LtMOuiMV5ZPrK0o9T9ULi1bHPzqoqkRae2Q5w HhaQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=jFk6JtJTaRjagN/TEZ+aA/1Ybh7D9PIOsrgXWAdV8hY=; b=ofCH0ob1z/rh18HfBuVDmN7woe903dpz7trUGC1VRO96cGqFzBkIL+EErlQ6z1PZMp sO/pTPVPHfMdGI2Om6ZrsZRNx3G/JRnQ/UeodMeaJWjjX1aY/lEHWdsfYBaNCBc3Jckj WHbSZoUdKeCuKjJQ2h9z42cb1kY7V4rJYTJ2kY30oR2FlPkNtfh2z1tI55Mx5bOWpQkS ubsc5kHAvO7i76hYuVqnjOr0sTpRhdcKZKJOhuxPzz5s2xzVSYNlzLOpvWK2XkDZwST/ +cWWE+B2jel9GQl3Umjzsr5ncqxNklXlyoGMfofy7y2FznSsEmxBZVIqjs1gKa4lLQP4 UeTw== X-Gm-Message-State: APzg51AM+bxEb9O8/txNTHYpp5H9p/enAf80lV09WT2Z3GPfJ7J3A9UR 2jWzrvlwg6G1AyO9ue/ixjraiu+lpaIkf23iBx1nhVpN X-Google-Smtp-Source: ANB0VdbVxwNgAGRhzOrFjAusFLJ0pgE0yFd+0co+li4I6L7QO8e8ajHDqA1QQc6SqGwztaNOV+AMRdoeC9A8QIhzflA= X-Received: by 2002:a6b:5911:: with SMTP id n17-v6mr2445695iob.68.1534917890432; Tue, 21 Aug 2018 23:04:50 -0700 (PDT) MIME-Version: 1.0 From: Christopher Wood Date: Tue, 21 Aug 2018 23:04:37 -0700 Message-ID: To: "" Content-Type: text/plain; charset="UTF-8" Archived-At: Subject: [TLS] TLS interim meeting X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Aug 2018 06:04:53 -0000 Below is a Doodle poll link for scheduling the TLS interim meeting wherein we will discuss next steps for draft-ietf-tls-dnssec-chain-extension. Please fill out the poll so that we may find a time that works best for everyone. https://doodle.com/poll/bhqrve377grmtbwh Thanks, Chris, Joe, and Sean From nobody Wed Aug 22 01:40:27 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 981C7130EBB for ; Wed, 22 Aug 2018 01:40:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NmXSxYdK22EZ for ; Wed, 22 Aug 2018 01:40:23 -0700 (PDT) Received: from huawei.com (lhrrgout.huawei.com [185.176.76.210]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6F230130E09 for ; Wed, 22 Aug 2018 01:40:23 -0700 (PDT) Received: from lhreml708-cah.china.huawei.com (unknown [172.18.7.108]) by Forcepoint Email with ESMTP id 23720174F3EC9; Wed, 22 Aug 2018 09:40:17 +0100 (IST) Received: from SINEML705-CAH.china.huawei.com (10.223.161.55) by lhreml708-cah.china.huawei.com (10.201.108.49) with Microsoft SMTP Server (TLS) id 14.3.399.0; Wed, 22 Aug 2018 09:40:18 +0100 Received: from SINEML521-MBX.china.huawei.com ([169.254.1.52]) by SINEML705-CAH.china.huawei.com ([10.223.161.55]) with mapi id 14.03.0399.000; Wed, 22 Aug 2018 16:40:14 +0800 From: Wang Haiguang To: Peter Gutmann , "" Thread-Topic: [TLS] null auth ciphers for TLS 1.3? Thread-Index: AQHUOX2fzC3N3Ph/eEOQyNJiIP7/k6TKfWWAgADyBgA= Date: Wed, 22 Aug 2018 08:40:13 +0000 Message-ID: <0AE05CBFB1A6A0468C8581DAE58A31309E0E98A7@SINEML521-MBX.china.huawei.com> References: <64d23891-2f32-9bb8-1ec8-f4fad13cdfb9@cs.tcd.ie> <982363FD-A839-4175-BA53-7CA242F9ADA6@ll.mit.edu> <2D7F2926-6376-4B2C-BDE9-7A6F1C0FA748@gmail.com> <5B7C1571020000AC0015C330@gwia2.rz.hs-offenburg.de> <8A2746A8-6B41-45C3-9D77-6AF3536C6E2D@siemens.com> , <3321850E-D95E-457C-A574-2A1A3F7AC06C@dukhovni.org>, <1534902946308.39422@cs.auckland.ac.nz> In-Reply-To: <1534902946308.39422@cs.auckland.ac.nz> Accept-Language: en-SG, en-US Content-Language: en-SG X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.45.165.94] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-CFilter-Loop: Reflected Archived-At: Subject: Re: [TLS] null auth ciphers for TLS 1.3? X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Aug 2018 08:40:26 -0000 Hi, all.=0A= =0A= Regarding the raw public, I would like to contribute a few words for you to= think about it. =0A= =0A= Raw public key is useful for IoT networks due to the constraint of bandwidt= h and processing capability of devices. A normal certificate takes about a = few hundred bytes while an raw public key can be less than one hundred byte= s. =0A= =0A= The raw public with TLS can be used together with EAP framework to perform = mutual authentication between device and server, i.e. raw public key with E= AP-TLS. It not only saves transmission bandwidth, but also simplify the imp= lementation at device side. =0A= =0A= Currently we are collaborate with some leading telecom operator on a soluti= on of using raw public key with EAP-TLS. However, with the normal raw publi= c, the server side need to maintain a table that maps the public key and id= entity at server side, which can be huge. =0A= =0A= To solve this issue, we are investigating of using identity-based cryptogra= phy (i.e. ECCSI in RFC 6507) to eliminate the huge mapping table. So far i= t looks good. =0A= =0A= Authentication for IoT could be another huge usage scenarios for TLS, it is= expected to have more than 50 billion iot devices deployed in the next 10 = years. It is good opportunity to extend the usage of TLS.=0A= =0A= Currently, 3GPP has already enable the support for using EAP-TLS in the 5G = neworks. Please find the most recent 5G security specification http://www.3= gpp.org/ftp/Specs/archive/33_series/33.501/. It has been specified in the A= nnex B. =0A= =0A= We hope the scope of raw public key with TLS can be extended in the future.= =0A= =0A= Regards.=0A= =0A= Haiguang Wang=0A= ________________________________________=0A= From: TLS [tls-bounces@ietf.org] on behalf of Peter Gutmann [pgut001@cs.auc= kland.ac.nz]=0A= Sent: Wednesday, 22 August, 2018 9:55:47 AM=0A= To: =0A= Subject: Re: [TLS] null auth ciphers for TLS 1.3?=0A= =0A= Viktor Dukhovni writes:=0A= =0A= >I've not yet seen raw public key support in any mainstream TLS libraries,= =0A= >though admittedly my focus is primarily on OpenSSL. Do any of NSS, GnuTLS= ,=0A= >BoringSSL, LibreSSL, ... support raw public keys?=0A= =0A= I've never seen it either. My code does actually support them, but not in = the=0A= way you think, for devices that don't have the ability to deal with certs= =0A= there's the memcpy()-into-send() certificate implementation I've mentioned= =0A= before, you memcpy() a pre-encoded cert chain onto the network, and for=0A= receiving memcpy() the data in and pick out the SPKI. So in effect it's ra= w=0A= public keys, but to anyone watching it looks like it's certificates. There= =0A= are other embedded implementations that do this too, it's a pretty obvious= =0A= optimisation (in other words I'm not trying to claim credit for inventing i= t).=0A= =0A= >We'd need to invent some sort of special X.509 object that holds only a=0A= >public key, but behaves in some sensible way when used with functions that= =0A= >expect X.509 certificates.=0A= =0A= That's exactly what my code does, but with certificates=0A= (CONFIG_USE_PSEUDOCERTIFICATES). So there's no need for raw public keys, y= ou=0A= just treat certs as raw keys and everything works the way it already does w= ith=0A= certificates.=0A= =0A= Is there any known actual use of raw public keys for TLS?=0A= =0A= Peter.=0A= =0A= _______________________________________________=0A= TLS mailing list=0A= TLS@ietf.org=0A= https://www.ietf.org/mailman/listinfo/tls=0A= From nobody Wed Aug 22 08:09:15 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 95E4012F1AB for ; Wed, 22 Aug 2018 08:09:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.62 X-Spam-Level: X-Spam-Status: No, score=-2.62 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1Zgho5mZ3zGE for ; Wed, 22 Aug 2018 08:09:10 -0700 (PDT) Received: from elasmtp-mealy.atl.sa.earthlink.net (elasmtp-mealy.atl.sa.earthlink.net [209.86.89.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AC519127598 for ; Wed, 22 Aug 2018 08:09:10 -0700 (PDT) Received: from [174.192.23.50] (helo=Williams-MacBook-Pro.local) by elasmtp-mealy.atl.sa.earthlink.net with esmtpa (Exim 4) (envelope-from ) id 1fsUkt-0008tc-Q8; Wed, 22 Aug 2018 11:09:07 -0400 Date: Wed, 22 Aug 2018 08:09:07 -0700 From: Bill Frantz To: Peter Gutmann cc: "" X-Priority: 3 In-Reply-To: <1534902946308.39422@cs.auckland.ac.nz> Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: quoted-printable X-Mailer: Mailsmith 2.4.3 (480) X-ELNK-Trace: 3a5e54fa03f1b3e21aa676d7e74259b7b3291a7d08dfec795bdae1ff0e570130fae8094a563b86f7350badd9bab72f9c350badd9bab72f9c350badd9bab72f9c X-Originating-IP: 174.192.23.50 Archived-At: Subject: Re: [TLS] null auth ciphers for TLS 1.3? X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Aug 2018 15:09:13 -0000 On 8/22/18 at 6:55 PM, pgut001@cs.auckland.ac.nz (Peter Gutmann) wrote: >Is there any known actual use of raw public keys for TLS? I know of a case where TLS (aka SSL) was not used because of the=20 lack of support for raw public keys. This work is 20 years old,=20 but I'm not sure the situation has changed very much. The E programming language for distributed applications uses=20 remote object references of the form =20 to support remote object invocation. TL:DR As part of setting up a connection, the target Vat sends its=20 public key and the initiating Vat checks the hash of that key.=20 The connection parameters are validated by a signature over the=20 entire connection dialog. Once the hash has authenticated the=20 public key and the signature has validated the connection, the=20 initiating Vat can safely send the objectID. There is a writeup explaining why SSL was not used Cheers - Bill ----------------------------------------------------------------------- Bill Frantz | There's nothing so clear as | Periwinkle (408)356-8506 | a design you haven't written | 16345=20 Englewood Ave www.pwpconsult.com | down. - Dean Tribble | Los Gatos,=20 CA 95032 From nobody Wed Aug 22 09:58:33 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9E279130DD5 for ; Wed, 22 Aug 2018 09:58:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.51 X-Spam-Level: X-Spam-Status: No, score=-14.51 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, T_DKIMWL_WL_MED=-0.01, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sbk32KWQB4Ti for ; Wed, 22 Aug 2018 09:58:29 -0700 (PDT) Received: from alln-iport-1.cisco.com (alln-iport-1.cisco.com [173.37.142.88]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D2A7A127598 for ; Wed, 22 Aug 2018 09:58:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=21830; q=dns/txt; s=iport; t=1534957108; x=1536166708; h=from:to:subject:date:message-id:references:in-reply-to: mime-version; bh=dYIvNOLuFPDrP76Zg1hnQt6bFMMFZsiA5FNvB+sW/HM=; b=laikYmpymE10tWB0efOAdenvqxtN95qhlFNKQ0mMRzFDSs9vtYk8EY7Y RD7SsX2ZXytYppmyCcjnA0bj/luxGkANFWpaNeV7vfEQ8EANtLDJk3V7j EKvjDDD9BPDOwFqzpMIVdcs3lZbc2OlFZZCv6uqwZ1MMIdHvTkgXNDzSA 0=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0CbAQCBlX1b/49dJa1aGQEBAQEBAQE?= =?us-ascii?q?BAQEBAQcBAQEBAYJXeGV/KAqDZZQwgg2QcIUugXoLGAEKhEkCF4JvITYWAQI?= =?us-ascii?q?BAQIBAQJtHAyFNwEBAQECAQEBIUsQCwIBCA4DAwECAScDAgICJQsUCQgCBAE?= =?us-ascii?q?SgyIBgR1cCA+kBoEuhGiFdgWJHBeCAIE5H4JMghGBCgEBAgEXgWcWgksxgiY?= =?us-ascii?q?CiHmECI4TCQKGLIk6F4E+hC+IT4gxgmSIAAIRFIEkJAEwgVJwFTsqAYI+CYI?= =?us-ascii?q?cF4hZhT5vAY4UgRwBAQ?= X-IronPort-AV: E=Sophos;i="5.53,274,1531785600"; d="scan'208,217";a="161054622" Received: from rcdn-core-7.cisco.com ([173.37.93.143]) by alln-iport-1.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 22 Aug 2018 16:58:27 +0000 Received: from XCH-RTP-011.cisco.com (xch-rtp-011.cisco.com [64.101.220.151]) by rcdn-core-7.cisco.com (8.15.2/8.15.2) with ESMTPS id w7MGwRAx002551 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL); Wed, 22 Aug 2018 16:58:27 GMT Received: from xch-rtp-015.cisco.com (64.101.220.155) by XCH-RTP-011.cisco.com (64.101.220.151) with Microsoft SMTP Server (TLS) id 15.0.1320.4; Wed, 22 Aug 2018 12:58:26 -0400 Received: from xch-rtp-015.cisco.com ([64.101.220.155]) by XCH-RTP-015.cisco.com ([64.101.220.155]) with mapi id 15.00.1320.000; Wed, 22 Aug 2018 12:58:26 -0400 From: "Nancy Cam-Winget (ncamwing)" To: Eric Rescorla , "" Thread-Topic: [TLS] EXTERNAL: Re: integrity only ciphersuites Thread-Index: AQHUOXTXTB1aINkC3kGxi9ZRvn1Sq6TKxPwAgAAB9oCAAQaKgA== Date: Wed, 22 Aug 2018 16:58:26 +0000 Message-ID: <7BEDB920-DC83-493E-9E07-0E2276EF2BE8@cisco.com> References: <64d23891-2f32-9bb8-1ec8-f4fad13cdfb9@cs.tcd.ie> <982363FD-A839-4175-BA53-7CA242F9ADA6@ll.mit.edu> <2D7F2926-6376-4B2C-BDE9-7A6F1C0FA748@gmail.com> <5B7C1571020000AC0015C330@gwia2.rz.hs-offenburg.de> <8A2746A8-6B41-45C3-9D77-6AF3536C6E2D@siemens.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.c.0.180410 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.155.84.21] Content-Type: multipart/alternative; boundary="_000_7BEDB920DC83493E9E070E2276EF2BE8ciscocom_" MIME-Version: 1.0 X-Outbound-SMTP-Client: 64.101.220.151, xch-rtp-011.cisco.com X-Outbound-Node: rcdn-core-7.cisco.com Archived-At: Subject: Re: [TLS] EXTERNAL: Re: integrity only ciphersuites X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Aug 2018 16:58:32 -0000 --_000_7BEDB920DC83493E9E070E2276EF2BE8ciscocom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGkgRXJpYywNCg0KSW4gcmVzcG9uc2UgdG8geW91ciAyIHF1ZXN0aW9ucyBiZWxvdzoNCg0KICAx LiAgU2hvdWxkIHRoZXkgYmUgbWFya2VkICJSZWNvbW1lbmRlZCIgaW4gdGhlIHJlZ2lzdHJ5Pw0K W05DV10gTm8sIHRoZXNlIGNpcGhlciBzdWl0ZXMgc2hvdWxkIG5vdCBiZSDigJxSZWNvbW1lbmRl ZOKAnSBpbiB0aGUgcmVnaXN0cnkuDQoNCg0KDQogIDEuICBTaG91bGQgdGhlIFRMUyBXRyBzcGVu ZCB0aW1lIHJldmlld2luZyB0aGVzZSBkb2N1bWVudHM/DQpbTkNXXSBJIGFtIG5vdCBzdXJlIHdo YXQgeW91IG1lYW4gKGludGVudC13aXNlKSBieSB0aGUgcXVlc3Rpb24uICBHaXZlbiB0aGVyZSBo YXMgYmVlbiBnb29kIGZlZWRiYWNrIGluIHRoZSBUTFMgV0cgdGhyZWFkLi4gdGhhdCB3ZSB3aWxs IHJlYWN0IHRvIGFuZCB1cGRhdGUgdGhlIGRyYWZ0IGFjY29yZGluZ2x5OyB3ZSBjYW4gY2VydGFp bmx5IGluY2x1ZGUgb3RoZXIgYXBwbGljYWJsZSB1c2UgY2FzZXMgYXMgbm90ZWQgYnkgc29tZSBp biB0aGUgdGhyZWFkLiAgTGFzdGx5LCB3ZeKAmWQgbGlrZSB0byB0aGUgZHJhZnQgcHVibGlzaGVk IGFzIGluZm9ybWF0aW9uYWwgYXMgd2UgZXhwZWN0IHRob3NlIHdpdGggYXBwcm9wcmlhdGUgdXNl IGNhc2VzIHRvIGVtcGxveSB0aGVzZSBjaXBoZXJzLiAgU28sIHByb2NlZHVyYWxseSwgSSB0aGlu ayBzb21lIHJldmlldyBvZiAoYW5kIGF1dGhvcnMgdXBkYXRpbmcpIHRoZSBkcmFmdCB3b3VsZCBi ZSB3YXJyYW50ZWQ/DQoNCldhcm0gcmVnYXJkcywgTmFuY3kNCg0KRnJvbTogVExTIDx0bHMtYm91 bmNlc0BpZXRmLm9yZz4gb24gYmVoYWxmIG9mIEVyaWMgUmVzY29ybGEgPGVrckBydGZtLmNvbT4N CkRhdGU6IFR1ZXNkYXksIEF1Z3VzdCAyMSwgMjAxOCBhdCAxMToyMA0KVG86ICI8dGxzQGlldGYu b3JnPiIgPHRsc0BpZXRmLm9yZz4NClN1YmplY3Q6IFJlOiBbVExTXSBFWFRFUk5BTDogUmU6IGlu dGVncml0eSBvbmx5IGNpcGhlcnN1aXRlcw0KDQoNCg0KT24gVHVlLCBBdWcgMjEsIDIwMTggYXQg MTE6MTEgQU0sIFZpa3RvciBEdWtob3ZuaSA8aWV0Zi1kYW5lQGR1a2hvdm5pLm9yZzxtYWlsdG86 aWV0Zi1kYW5lQGR1a2hvdm5pLm9yZz4+IHdyb3RlOg0KDQoNCj4gT24gQXVnIDIxLCAyMDE4LCBh dCAxOjI5IFBNLCBUZWQgTGVtb24gPG1lbGxvbkBmdWd1ZS5jb208bWFpbHRvOm1lbGxvbkBmdWd1 ZS5jb20+PiB3cm90ZToNCj4NCj4gICBZb3UncmUgZ29pbmcgdG8gaGF2ZSB0byBjaGFuZ2Ugd2hh dCB5b3UgZG8gYW55d2F54oCUcmF0aGVyIHRoYW4gYXJndWluZyB3aXRoIHVzIHdoeSBub3QgYnlw YXNzIHVzIGVudGlyZWx5Pw0KDQpUTFMgaXMgbm90IGp1c3QgYSBXV1cgcHJvdG9jb2wuICBPdGhl ciB0cmFuc3BvcnQgc2VjdXJpdHkgdXNlLWNhc2VzDQpzaG91bGQgbm90IGhhdmUgdG8ganVzdGlm eSB0aGVpciBleGlzdGVuY2UuDQoNCkl0IGlzLCBvZiBjb3Vyc2UsIGFwcHJvcHJpYXRlIHRvIG1h a2Ugc3VyZSB0aGF0IHByb3Bvc2VkIFRMUyBjb2RlLXBvaW50cw0KdGhhdCBjYXRlciB0byBzcGVj aWFsaXplZCBuZWVkcyBhcmUgd2VsbCB0aG91Z2h0IG91dCBhbmQgaW5jbHVkZQ0Kc3VpdGFibGUg c2VjdXJpdHkgY29uc2lkZXJhdGlvbnMuDQoNCkl0IGlzIGFsc28gcmVhc29uYWJsZSB0byBjaGVj ayB0aGF0IHRoZSByZXF1aXJlbWVudHMgYXJlIG5vdCBhbHJlYWR5DQptZXQgd2l0aG91dCB0aGUg cHJvcG9zZWQgY29kZS1wb2ludHMuDQoNCkkgYW0gY29uY2VybmVkIHRoYXQgd2UgYXJlIGdvaW5n IGJleW9uZCB0aGF0IHRvIHF1ZXN0aW9uaW5nIHRoZQ0KbGVnaXRpbWFjeSBvZiB0aGUgdXNlLWNh c2VzLiAgSVBzZWMgaXMgcmFyZWx5IGEgcHJhY3RpY2FsIGFsdGVybmF0aXZlDQp0byBUTFMuDQoN ClRoYXQgc2FpZCwgVExTLUxUUyAoYSBUTFMgMS4yIHByb2ZpbGUpIG1heSB3ZWxsIGJlIGEgZ29v ZCBsb25nLXRlcm0NCmNob2ljZSB3aGVyZSBUTFMgMS4zIGlzIG5vdCBzdWZmaWNpZW50bHkgY29t cGF0aWJsZS4NCg0KQXMgZm9yIFRMUyAxLjMsIGl0IGlzIGluZGVlZCBtaXNzaW5nIGJvdGggbnVs bCBlbmNyeXB0aW9uIGFuZCBudWxsDQphdXRoZW50aWNhdGlvbiBjaXBoZXJzLg0KDQpJZiBieSAi bnVsbCBhdXRoZW50aWNhdGlvbiIgeW91IG1lYW4gIndpdGhvdXQgY2VydGlmaWNhdGVzIiwgdGhl biBUTFMgMS4zIGRvZXMNCnN1cHBvcnQgdGhlc2UgdmlhIFJGQyA3MjUwLiBTZWU6DQoNCmh0dHBz Oi8vdG9vbHMuaWV0Zi5vcmcvcmZjbWFya3VwP2RvYz04NDQ2I2FwcGVuZGl4LUMuNQ0KDQoNClRo aXMgaXMgbm90IHRvIHNheSB0aGF0IG51bGwgZW5jcnlwdGlvbiBjaXBoZXJzIGZvciBUTFMgMS4z IGFyZQ0KdW5jb25kaXRpb25hbGx5IGdvb2QsIHRoZWlyIHNwZWNpZmljYXRpb24gd291bGQgbmVl ZCB0byBwcm92aWRlDQpzb3VuZCBzZWN1cml0eSBjb25zaWRlcmF0aW9ucyBhbmQgYmUgZml0IGZv ciBwdXJwb3NlLiAgQnV0IEkgZG8NCnRoaW5rIHRoYXQgd2Ugc2hvdWxkIG5vdCByZWplY3QgdGhl IHByb3Bvc2FsIG91dCBvZiBoYW5kLg0KDQpUaGlzIGlzbid0IGEgbWF0dGVyIG9mIHJlamVjdGlu ZyBvciBhY2NlcHRpbmcgdGhlbS4gQXMgSSBzYWlkIGF0IHRoZSBiZWdpbm5pbmcgb2YNCnRoaXMg dGhyZWFkLiBObyBUTFMgV0cgYXBwcm92YWwgaXMgcmVxdWlyZWQgdG8gZ2V0IGEgY29kZSBwb2lu dC4NCg0KVGhlIHJlbGV2YW50IHF1ZXN0aW9ucyBhcmU6DQoNCjEuIFNob3VsZCB0aGV5IGJlIG1h cmtlZCAiUmVjb21tZW5kZWQiIGluIHRoZSByZWdpc3RyeT8NCjIuIFNob3VsZCB0aGUgVExTIFdH IHNwZW5kIHRpbWUgcmV2aWV3aW5nIHRoZXNlIGRvY3VtZW50cz8NCg0KQ2FuIHRoZSBhdXRob3Jz IG9mIHRoaXMgZHJhZnQgcGxlYXNlIHNheSB3aGF0IHRoZXkgYXJlIGxvb2tpbmcgZm9yIGhlcmU/ DQoNCi1Fa3INCg0KDQoNCi0tDQotLQ0KICAgICAgICBWaWt0b3IuDQoNCl9fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQpUTFMgbWFpbGluZyBsaXN0DQpUTFNA aWV0Zi5vcmc8bWFpbHRvOlRMU0BpZXRmLm9yZz4NCmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxt YW4vbGlzdGluZm8vdGxzDQoNCg== --_000_7BEDB920DC83493E9E070E2276EF2BE8ciscocom_ Content-Type: text/html; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2 IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToy IDE1IDUgMiAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3Jt YWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1i b3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJp IixzYW5zLXNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXBy aW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQph OnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5 Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnAuTXNv TGlzdFBhcmFncmFwaCwgbGkuTXNvTGlzdFBhcmFncmFwaCwgZGl2Lk1zb0xpc3RQYXJhZ3JhcGgN Cgl7bXNvLXN0eWxlLXByaW9yaXR5OjM0Ow0KCW1hcmdpbi10b3A6MGluOw0KCW1hcmdpbi1yaWdo dDowaW47DQoJbWFyZ2luLWJvdHRvbTowaW47DQoJbWFyZ2luLWxlZnQ6LjVpbjsNCgltYXJnaW4t Ym90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJy aSIsc2Fucy1zZXJpZjt9DQpwLm1zb25vcm1hbDAsIGxpLm1zb25vcm1hbDAsIGRpdi5tc29ub3Jt YWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0 bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0KCW1h cmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJp IixzYW5zLXNlcmlmO30NCnNwYW4uZ21haWwtDQoJe21zby1zdHlsZS1uYW1lOmdtYWlsLTt9DQpz cGFuLmdtYWlsLWhvZW56Yg0KCXttc28tc3R5bGUtbmFtZTpnbWFpbC1ob2VuemI7fQ0Kc3Bhbi5F bWFpbFN0eWxlMjANCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwtcmVwbHk7DQoJZm9udC1mYW1p bHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6d2luZG93dGV4dDt9DQouTXNvQ2hwRGVm YXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LXNpemU6MTAuMHB0O30N CkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjguNWluIDExLjBpbjsNCgltYXJnaW46MS4waW4g MS4waW4gMS4waW4gMS4waW47fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9u MTt9DQovKiBMaXN0IERlZmluaXRpb25zICovDQpAbGlzdCBsMA0KCXttc28tbGlzdC1pZDo2ODA0 NjI4OTsNCgltc28tbGlzdC10eXBlOmh5YnJpZDsNCgltc28tbGlzdC10ZW1wbGF0ZS1pZHM6LTQ4 NTMxMDczMiA2NzY5ODcwMyA2NzY5ODcxMyA2NzY5ODcxNSA2NzY5ODcwMyA2NzY5ODcxMyA2NzY5 ODcxNSA2NzY5ODcwMyA2NzY5ODcxMyA2NzY5ODcxNTt9DQpAbGlzdCBsMDpsZXZlbDENCgl7bXNv LWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0K CXRleHQtaW5kZW50Oi0uMjVpbjt9DQpAbGlzdCBsMDpsZXZlbDINCgl7bXNvLWxldmVsLW51bWJl ci1mb3JtYXQ6YWxwaGEtbG93ZXI7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxl dmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjt9DQpAbGlzdCBs MDpsZXZlbDMNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6cm9tYW4tbG93ZXI7DQoJbXNvLWxl dmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpyaWdodDsNCgl0 ZXh0LWluZGVudDotOS4wcHQ7fQ0KQGxpc3QgbDA6bGV2ZWw0DQoJe21zby1sZXZlbC10YWItc3Rv cDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDot LjI1aW47fQ0KQGxpc3QgbDA6bGV2ZWw1DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmFscGhh LWxvd2VyOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9z aXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47fQ0KQGxpc3QgbDA6bGV2ZWw2DQoJe21z by1sZXZlbC1udW1iZXItZm9ybWF0OnJvbWFuLWxvd2VyOw0KCW1zby1sZXZlbC10YWItc3RvcDpu b25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246cmlnaHQ7DQoJdGV4dC1pbmRlbnQ6LTku MHB0O30NCkBsaXN0IGwwOmxldmVsNw0KCXttc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28t bGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluO30NCkBsaXN0 IGwwOmxldmVsOA0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDphbHBoYS1sb3dlcjsNCgltc28t bGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJ dGV4dC1pbmRlbnQ6LS4yNWluO30NCkBsaXN0IGwwOmxldmVsOQ0KCXttc28tbGV2ZWwtbnVtYmVy LWZvcm1hdDpyb21hbi1sb3dlcjsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2 ZWwtbnVtYmVyLXBvc2l0aW9uOnJpZ2h0Ow0KCXRleHQtaW5kZW50Oi05LjBwdDt9DQpvbA0KCXtt YXJnaW4tYm90dG9tOjBpbjt9DQp1bA0KCXttYXJnaW4tYm90dG9tOjBpbjt9DQotLT48L3N0eWxl Pg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0iRU4tVVMiIGxpbms9ImJsdWUiIHZsaW5rPSJwdXJwbGUi Pg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkhpIEVy aWMsPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkluIHJlc3BvbnNlIHRvIHlvdXIgMiBxdWVzdGlv bnMgYmVsb3c6PG86cD48L286cD48L3A+DQo8b2wgc3R5bGU9Im1hcmdpbi10b3A6MGluIiBzdGFy dD0iMSIgdHlwZT0iMSI+DQo8bGkgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJtYXJn aW4tbGVmdDowaW47bXNvLWxpc3Q6bDAgbGV2ZWwxIGxmbzEiPlNob3VsZCB0aGV5IGJlIG1hcmtl ZCAmcXVvdDtSZWNvbW1lbmRlZCZxdW90OyBpbiB0aGUgcmVnaXN0cnk/PG86cD48L286cD48L2xp Pjwvb2w+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPltO Q1ddIE5vLCB0aGVzZSBjaXBoZXIgc3VpdGVzIHNob3VsZCBub3QgYmUg4oCcUmVjb21tZW5kZWTi gJ0gaW4gdGhlIHJlZ2lzdHJ5LjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29M aXN0UGFyYWdyYXBoIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxvbCBzdHlsZT0ibWFyZ2luLXRv cDowaW4iIHN0YXJ0PSIyIiB0eXBlPSIxIj4NCjxsaSBjbGFzcz0iTXNvTGlzdFBhcmFncmFwaCIg c3R5bGU9Im1hcmdpbi1sZWZ0OjBpbjttc28tbGlzdDpsMCBsZXZlbDEgbGZvMSI+U2hvdWxkIHRo ZSBUTFMgV0cgc3BlbmQgdGltZSByZXZpZXdpbmcgdGhlc2UgZG9jdW1lbnRzPzxvOnA+PC9vOnA+ PC9saT48L29sPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+W05DV108c3BhbiBzdHlsZT0iY29sb3I6 YmxhY2siPiBJIGFtIG5vdCBzdXJlIHdoYXQgeW91IG1lYW4gKGludGVudC13aXNlKSBieSB0aGUg cXVlc3Rpb24uICZuYnNwO0dpdmVuIHRoZXJlIGhhcyBiZWVuIGdvb2QgZmVlZGJhY2sgaW4gdGhl IFRMUyBXRyB0aHJlYWQuLiB0aGF0IHdlIHdpbGwgcmVhY3QgdG8gYW5kIHVwZGF0ZSB0aGUgZHJh ZnQgYWNjb3JkaW5nbHk7IHdlIGNhbiBjZXJ0YWlubHkgaW5jbHVkZSBvdGhlcg0KIGFwcGxpY2Fi bGUgdXNlIGNhc2VzIGFzIG5vdGVkIGJ5IHNvbWUgaW4gdGhlIHRocmVhZC4mbmJzcDsgTGFzdGx5 LCB3ZeKAmWQgbGlrZSB0byB0aGUgZHJhZnQgcHVibGlzaGVkIGFzIGluZm9ybWF0aW9uYWwgYXMg d2UgZXhwZWN0IHRob3NlIHdpdGggYXBwcm9wcmlhdGUgdXNlPC9zcGFuPjxzcGFuIHN0eWxlPSJj b2xvcjpibGFjayI+DQo8L3NwYW4+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj5jYXNlcyB0byBl bXBsb3kgdGhlc2UgY2lwaGVycy4mbmJzcDsgU28sIHByb2NlZHVyYWxseSwgSSB0aGluayBzb21l IHJldmlldyBvZiAoYW5kIGF1dGhvcnMgdXBkYXRpbmcpIHRoZSBkcmFmdCB3b3VsZCBiZSB3YXJy YW50ZWQ/PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImNvbG9yOmJsYWNrIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj5XYXJtIHJlZ2FyZHMsIE5hbmN5PG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXYgc3R5bGU9ImJvcmRlcjpu b25lO2JvcmRlci10b3A6c29saWQgI0I1QzRERiAxLjBwdDtwYWRkaW5nOjMuMHB0IDBpbiAwaW4g MGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIu MHB0O2NvbG9yOmJsYWNrIj5Gcm9tOiA8L3NwYW4+PC9iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTIuMHB0O2NvbG9yOmJsYWNrIj5UTFMgJmx0O3Rscy1ib3VuY2VzQGlldGYub3JnJmd0OyBvbiBi ZWhhbGYgb2YgRXJpYyBSZXNjb3JsYSAmbHQ7ZWtyQHJ0Zm0uY29tJmd0Ozxicj4NCjxiPkRhdGU6 IDwvYj5UdWVzZGF5LCBBdWd1c3QgMjEsIDIwMTggYXQgMTE6MjA8YnI+DQo8Yj5UbzogPC9iPiZx dW90OyZsdDt0bHNAaWV0Zi5vcmcmZ3Q7JnF1b3Q7ICZsdDt0bHNAaWV0Zi5vcmcmZ3Q7PGJyPg0K PGI+U3ViamVjdDogPC9iPlJlOiBbVExTXSBFWFRFUk5BTDogUmU6IGludGVncml0eSBvbmx5IGNp cGhlcnN1aXRlczxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PGEgbmFtZT0iX01haWxPcmlnaW5hbEJvZHkiPjxvOnA+Jm5ic3A7PC9v OnA+PC9hPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0ibXNv LWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpf TWFpbE9yaWdpbmFsQm9keSI+T24gVHVlLCBBdWcgMjEsIDIwMTggYXQgMTE6MTEgQU0sIFZpa3Rv ciBEdWtob3ZuaSAmbHQ7PC9zcGFuPjxhIGhyZWY9Im1haWx0bzppZXRmLWRhbmVAZHVraG92bmku b3JnIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdp bmFsQm9keSI+aWV0Zi1kYW5lQGR1a2hvdm5pLm9yZzwvc3Bhbj48c3BhbiBzdHlsZT0ibXNvLWJv b2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij48L3NwYW4+PC9hPjxzcGFuIHN0eWxlPSJtc28tYm9v a21hcms6X01haWxPcmlnaW5hbEJvZHkiPiZndDsNCiB3cm90ZTo8bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0ND Q0NDQyAxLjBwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21h cmdpbi1yaWdodDowaW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1zby1i b29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+PGJyPg0KPGJyPg0KPHNwYW4gY2xhc3M9ImdtYWls LSI+Jmd0OyBPbiBBdWcgMjEsIDIwMTgsIGF0IDE6MjkgUE0sIFRlZCBMZW1vbiAmbHQ7PC9zcGFu Pjwvc3Bhbj48YSBocmVmPSJtYWlsdG86bWVsbG9uQGZ1Z3VlLmNvbSI+PHNwYW4gc3R5bGU9Im1z by1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+bWVsbG9uQGZ1Z3VlLmNvbTwvc3Bhbj48c3Bh biBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij48L3NwYW4+PC9hPjxzcGFu IHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPjxzcGFuIGNsYXNzPSJnbWFp bC0iPiZndDsNCiB3cm90ZTo8L3NwYW4+PC9zcGFuPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6 X01haWxPcmlnaW5hbEJvZHkiPjxicj4NCjxzcGFuIGNsYXNzPSJnbWFpbC0iPiZndDsgPC9zcGFu Pjxicj4NCjxzcGFuIGNsYXNzPSJnbWFpbC0iPiZndDsmbmJzcDsgJm5ic3A7WW91J3JlIGdvaW5n IHRvIGhhdmUgdG8gY2hhbmdlIHdoYXQgeW91IGRvIGFueXdheeKAlHJhdGhlciB0aGFuIGFyZ3Vp bmcgd2l0aCB1cyB3aHkgbm90IGJ5cGFzcyB1cyBlbnRpcmVseT88L3NwYW4+PGJyPg0KPGJyPg0K VExTIGlzIG5vdCBqdXN0IGEgV1dXIHByb3RvY29sLiZuYnNwOyBPdGhlciB0cmFuc3BvcnQgc2Vj dXJpdHkgdXNlLWNhc2VzPGJyPg0Kc2hvdWxkIG5vdCBoYXZlIHRvIGp1c3RpZnkgdGhlaXIgZXhp c3RlbmNlLjxicj4NCjxicj4NCkl0IGlzLCBvZiBjb3Vyc2UsIGFwcHJvcHJpYXRlIHRvIG1ha2Ug c3VyZSB0aGF0IHByb3Bvc2VkIFRMUyBjb2RlLXBvaW50czxicj4NCnRoYXQgY2F0ZXIgdG8gc3Bl Y2lhbGl6ZWQgbmVlZHMgYXJlIHdlbGwgdGhvdWdodCBvdXQgYW5kIGluY2x1ZGU8YnI+DQpzdWl0 YWJsZSBzZWN1cml0eSBjb25zaWRlcmF0aW9ucy48YnI+DQo8YnI+DQpJdCBpcyBhbHNvIHJlYXNv bmFibGUgdG8gY2hlY2sgdGhhdCB0aGUgcmVxdWlyZW1lbnRzIGFyZSBub3QgYWxyZWFkeTxicj4N Cm1ldCB3aXRob3V0IHRoZSBwcm9wb3NlZCBjb2RlLXBvaW50cy48YnI+DQo8YnI+DQpJIGFtIGNv bmNlcm5lZCB0aGF0IHdlIGFyZSBnb2luZyBiZXlvbmQgdGhhdCB0byBxdWVzdGlvbmluZyB0aGU8 YnI+DQpsZWdpdGltYWN5IG9mIHRoZSB1c2UtY2FzZXMuJm5ic3A7IElQc2VjIGlzIHJhcmVseSBh IHByYWN0aWNhbCBhbHRlcm5hdGl2ZTxicj4NCnRvIFRMUy48YnI+DQo8YnI+DQpUaGF0IHNhaWQs IFRMUy1MVFMgKGEgVExTIDEuMiBwcm9maWxlKSBtYXkgd2VsbCBiZSBhIGdvb2QgbG9uZy10ZXJt PGJyPg0KY2hvaWNlIHdoZXJlIFRMUyAxLjMgaXMgbm90IHN1ZmZpY2llbnRseSBjb21wYXRpYmxl Ljxicj4NCjxicj4NCkFzIGZvciBUTFMgMS4zLCBpdCBpcyBpbmRlZWQgbWlzc2luZyBib3RoIG51 bGwgZW5jcnlwdGlvbiBhbmQgbnVsbDxicj4NCmF1dGhlbnRpY2F0aW9uIGNpcGhlcnMuJm5ic3A7 PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9ibG9ja3F1b3RlPg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPjxv OnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPklmIGJ5 ICZxdW90O251bGwgYXV0aGVudGljYXRpb24mcXVvdDsgeW91IG1lYW4gJnF1b3Q7d2l0aG91dCBj ZXJ0aWZpY2F0ZXMmcXVvdDssIHRoZW4gVExTIDEuMyBkb2VzPG86cD48L286cD48L3NwYW4+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1zby1i b29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+c3VwcG9ydCB0aGVzZSB2aWEgUkZDIDcyNTAuIFNl ZTo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij48bzpwPiZu YnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij48L3NwYW4+PGEg aHJlZj0iaHR0cHM6Ly90b29scy5pZXRmLm9yZy9yZmNtYXJrdXA/ZG9jPTg0NDYjYXBwZW5kaXgt Qy41Ij48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij5odHRwczov L3Rvb2xzLmlldGYub3JnL3JmY21hcmt1cD9kb2M9ODQ0NiNhcHBlbmRpeC1DLjU8L3NwYW4+PHNw YW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+PC9zcGFuPjwvYT48c3Bh biBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij48bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i bXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48 L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJtc28tYm9va21h cms6X01haWxPcmlnaW5hbEJvZHkiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxibG9j a3F1b3RlIHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0 O3BhZGRpbmc6MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXJpZ2h0 OjBpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9N YWlsT3JpZ2luYWxCb2R5Ij5UaGlzIGlzIG5vdCB0byBzYXkgdGhhdCBudWxsIGVuY3J5cHRpb24g Y2lwaGVycyBmb3IgVExTIDEuMyBhcmU8YnI+DQp1bmNvbmRpdGlvbmFsbHkgZ29vZCwgdGhlaXIg c3BlY2lmaWNhdGlvbiB3b3VsZCBuZWVkIHRvIHByb3ZpZGU8YnI+DQpzb3VuZCBzZWN1cml0eSBj b25zaWRlcmF0aW9ucyBhbmQgYmUgZml0IGZvciBwdXJwb3NlLiZuYnNwOyBCdXQgSSBkbzxicj4N CnRoaW5rIHRoYXQgd2Ugc2hvdWxkIG5vdCByZWplY3QgdGhlIHByb3Bvc2FsIG91dCBvZiBoYW5k LjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvYmxvY2txdW90ZT4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij48 bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij5UaGlz IGlzbid0IGEgbWF0dGVyIG9mIHJlamVjdGluZyBvciBhY2NlcHRpbmcgdGhlbS4gQXMgSSBzYWlk IGF0IHRoZSBiZWdpbm5pbmcgb2Y8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3Jp Z2luYWxCb2R5Ij50aGlzIHRocmVhZC4gTm8gVExTIFdHIGFwcHJvdmFsIGlzIHJlcXVpcmVkIHRv IGdldCBhIGNvZGUgcG9pbnQuPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdp bmFsQm9keSI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFs Qm9keSI+VGhlIHJlbGV2YW50IHF1ZXN0aW9ucyBhcmU6PG86cD48L286cD48L3NwYW4+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1zby1ib29r bWFyazpfTWFpbE9yaWdpbmFsQm9keSI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFy azpfTWFpbE9yaWdpbmFsQm9keSI+MS4gU2hvdWxkIHRoZXkgYmUgbWFya2VkICZxdW90O1JlY29t bWVuZGVkJnF1b3Q7IGluIHRoZSByZWdpc3RyeT88bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJr Ol9NYWlsT3JpZ2luYWxCb2R5Ij4yLiBTaG91bGQgdGhlIFRMUyBXRyBzcGVuZCB0aW1lIHJldmll d2luZyB0aGVzZSBkb2N1bWVudHM/PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9y aWdpbmFsQm9keSI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdp bmFsQm9keSI+Q2FuIHRoZSBhdXRob3JzIG9mIHRoaXMgZHJhZnQgcGxlYXNlIHNheSB3aGF0IHRo ZXkgYXJlIGxvb2tpbmcgZm9yIGhlcmU/PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFp bE9yaWdpbmFsQm9keSI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9y aWdpbmFsQm9keSI+LUVrcjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmlnaW5h bEJvZHkiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJv ZHkiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5 bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzow aW4gMGluIDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tcmlnaHQ6MGluIj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmlnaW5h bEJvZHkiPjxzcGFuIHN0eWxlPSJjb2xvcjojODg4ODg4Ij48YnI+DQo8c3BhbiBjbGFzcz0iZ21h aWwtaG9lbnpiIj4tLSA8L3NwYW4+PGJyPg0KPHNwYW4gY2xhc3M9ImdtYWlsLWhvZW56YiI+LS0g PC9zcGFuPjxicj4NCjxzcGFuIGNsYXNzPSJnbWFpbC1ob2VuemIiPiZuYnNwOyAmbmJzcDsgJm5i c3A7ICZuYnNwOyBWaWt0b3IuPC9zcGFuPjwvc3Bhbj48L3NwYW4+PHNwYW4gc3R5bGU9Im1zby1i b29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPGRpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9N YWlsT3JpZ2luYWxCb2R5Ij48YnI+DQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fXzxicj4NClRMUyBtYWlsaW5nIGxpc3Q8YnI+DQo8L3NwYW4+PGEgaHJlZj0i bWFpbHRvOlRMU0BpZXRmLm9yZyI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdp bmFsQm9keSI+VExTQGlldGYub3JnPC9zcGFuPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01h aWxPcmlnaW5hbEJvZHkiPjwvc3Bhbj48L2E+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFp bE9yaWdpbmFsQm9keSI+PGJyPg0KPC9zcGFuPjxhIGhyZWY9Imh0dHBzOi8vd3d3LmlldGYub3Jn L21haWxtYW4vbGlzdGluZm8vdGxzIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9Im1zby1i b29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+aHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9s aXN0aW5mby90bHM8L3NwYW4+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFs Qm9keSI+PC9zcGFuPjwvYT48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxC b2R5Ij48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3Rl Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJr Ol9NYWlsT3JpZ2luYWxCb2R5Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4N CjwvZGl2Pg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_7BEDB920DC83493E9E070E2276EF2BE8ciscocom_-- From nobody Wed Aug 22 10:43:42 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4DD89130E13 for ; Wed, 22 Aug 2018 10:43:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.51 X-Spam-Level: X-Spam-Status: No, score=-14.51 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0y1yowJj7G81 for ; Wed, 22 Aug 2018 10:43:38 -0700 (PDT) Received: from rcdn-iport-4.cisco.com (rcdn-iport-4.cisco.com [173.37.86.75]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1F2D8130E01 for ; Wed, 22 Aug 2018 10:43:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=19464; q=dns/txt; s=iport; t=1534959817; x=1536169417; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=tjWch766SQtIXj2pm5CKpIe6NBwieyuKr98qkYb93n0=; b=XmMY4yxdSH/GJ1pJAzZS6FYvfa2fDQK+zC+66saj6Ij4Zr7igQCvr9e1 ZHyt5p3RzwSyHhGH+AXHYmjHkbZ0x4m9UISk3bCFU/7RcS3/+jCyQxSWE AVSXwoUez8PO4nWMS4/McDR5cXEfDVzF/aIIrgHNw34s9N6vA6u4R2S+P 0=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0DbAADkn31b/4YNJK1aGQEBAQEBAQE?= =?us-ascii?q?BAQEBAQcBAQEBAYJXSS9lfygKgyY/iA2MJIINkHCFLoF6CxgBCoRJAheCbyE?= =?us-ascii?q?0GAECAQECAQECbRwMhTcBAQEBAgEBAQoXSwsFCwIBBgIOAwMBAigDAgICJQs?= =?us-ascii?q?UCQgCBAENBYMiAYEdXAgPiD+bS4EuhGiFdwWGVYEWgRQdF4IAgRInH4JMgxs?= =?us-ascii?q?BAQIBgUgGMBaCSzGCJgKHdIEFhAiOEwkChiyCdoZEF4E+hC+IT4gxgmSIAAI?= =?us-ascii?q?RFIEkHTiBUnAVOyoBgj4JiwyFPm8BjhSBHAEB?= X-IronPort-AV: E=Sophos;i="5.53,274,1531785600"; d="scan'208,217";a="441545098" Received: from alln-core-12.cisco.com ([173.36.13.134]) by rcdn-iport-4.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 22 Aug 2018 17:43:36 +0000 Received: from XCH-RTP-013.cisco.com (xch-rtp-013.cisco.com [64.101.220.153]) by alln-core-12.cisco.com (8.15.2/8.15.2) with ESMTPS id w7MHhaXT021933 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL); Wed, 22 Aug 2018 17:43:36 GMT Received: from xch-rtp-015.cisco.com (64.101.220.155) by XCH-RTP-013.cisco.com (64.101.220.153) with Microsoft SMTP Server (TLS) id 15.0.1320.4; Wed, 22 Aug 2018 13:43:35 -0400 Received: from xch-rtp-015.cisco.com ([64.101.220.155]) by XCH-RTP-015.cisco.com ([64.101.220.155]) with mapi id 15.00.1320.000; Wed, 22 Aug 2018 13:43:35 -0400 From: "Nancy Cam-Winget (ncamwing)" To: Richard Barnes , "geoffk@geoffk.org" CC: "" Thread-Topic: [TLS] integrity only ciphersuites Thread-Index: AQHUOMbv4/TwUeWSFUmhTxfQeZX0pqTJkVGAgADwdACAAVmvgA== Date: Wed, 22 Aug 2018 17:43:35 +0000 Message-ID: <99FAA877-32EC-43FA-BB10-23FDC3242C33@cisco.com> References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.c.0.180410 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.155.84.21] Content-Type: multipart/alternative; boundary="_000_99FAA87732EC43FABB1023FDC3242C33ciscocom_" MIME-Version: 1.0 X-Outbound-SMTP-Client: 64.101.220.153, xch-rtp-013.cisco.com X-Outbound-Node: alln-core-12.cisco.com Archived-At: Subject: Re: [TLS] integrity only ciphersuites X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Aug 2018 17:43:41 -0000 --_000_99FAA87732EC43FABB1023FDC3242C33ciscocom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGkgR2VvZmYgYW5kIFJpY2hhcmQsDQpUaGFua3MgZm9yIHJhaXNpbmcgdGhlc2UgcG9pbnRz4oCm LnBsZWFzZSBzZWUgYmVsb3cgZm9yIG15IGNvbW1lbnRzOg0KDQpGcm9tOiBSaWNoYXJkIEJhcm5l cyA8cmxiQGlwdi5zeD4NCkRhdGU6IFR1ZXNkYXksIEF1Z3VzdCAyMSwgMjAxOCBhdCAwNzowNg0K VG86ICJnZW9mZmtAZ2VvZmZrLm9yZyIgPGdlb2Zma0BnZW9mZmsub3JnPg0KQ2M6ICJuY2Ftd2lu Z0BjaXNjby5jb20iIDxuY2Ftd2luZ0BjaXNjby5jb20+LCAiPHRsc0BpZXRmLm9yZz4iIDx0bHNA aWV0Zi5vcmc+DQpTdWJqZWN0OiBSZTogW1RMU10gaW50ZWdyaXR5IG9ubHkgY2lwaGVyc3VpdGVz DQoNCg0KT24gTW9uLCBBdWcgMjAsIDIwMTggYXQgNzo0NiBQTSBHZW9mZnJleSBLZWF0aW5nIDxn ZW9mZmtAZ2VvZmZrLm9yZzxtYWlsdG86Z2VvZmZrQGdlb2Zmay5vcmc+PiB3cm90ZToNCiJOYW5j eSBDYW0tV2luZ2V0IFwobmNhbXdpbmdcKSIgPG5jYW13aW5nPTQwY2lzY28uY29tQGRtYXJjLmll dGYuLm9yZzxtYWlsdG86NDBjaXNjby5jb21AZG1hcmMuaWV0Zi5vcmc+PiB3cml0ZXM6DQoNCj4g SW4gZm9sbG93aW5nIHRoZSBuZXcgSUFOQSBydWxlcywgd2UgaGF2ZSBwb3N0ZWQgdGhlIGRyYWZ0 DQo+IGh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1jYW13aW5nZXQtdGxzLXRzMTMt bWFjY2lwaGVyc3VpdGVzLTAwDQo+IHRvIGRvY3VtZW50IHJlcXVlc3QgZm9yIHJlZ2lzdHJhdGlv bnMgb2YgSE1BQyBiYXNlZCBjaXBoZXINCj4gc2VsZWN0aW9ucyB3aXRoIFRMUyAxLjPigKYuLmFu ZCBhcmUgc29saWNpdGluZyBmZWVkYmFjayBmcm9tIHRoZSBXRyBvbg0KPiB0aGUgZHJhZnQgYW5k IGl0cyBwYXRoIGZvcndhcmQuDQoNClRoaXMgZHJhZnQgbmVlZHMgbW9yZSBzZWN1cml0eSBhbmFs eXNpcyB0aGFuIGlzIGN1cnJlbnRseSB0aGVyZSwgYW5kDQpwcm9iYWJseSBpdCBuZWVkcyB0byBk ZWZpbmUgbm90IGp1c3QgYSBjaXBoZXJzdWl0ZSBidXQgYW4gZW50aXJlDQpwcm9maWxlIGZvciB1 c2luZyBUTFMgd2l0aCB0aGlzIGNpcGhlcnN1aXRlLiAgU29tZSB0b3BpY3M6DQoNCiogQW55dGhp bmcgdGhhdCByZWxpZXMgb24gRW5jcnlwdGVkRXh0ZW5zaW9ucyBzaG91bGQgcHJvYmFibHkgbm90 IGJlDQp1c2VkLg0KW05DV10gVGhhbmtzIGZvciByYWlzaW5nIHRoaXM7IEkgd2lsbCBoYXZlIHRv IHJldmlldyB0aGVzZSBhbmQgcGVyaGFwcyB1cGRhdGUgdGhlIGRyYWZ0IHdpdGggYXBwcm9wcmlh dGUgY29uc2lkZXJhdGlvbiBmb3IgdGhlbS4NCg0KDQoqIFRoZSBzZXNzaW9uIHRpY2tldCBwcm9w ZXJ0aWVzIGNoYW5nZSBpbiB0aGUgYWJzZW5jZSBvZiBlbmNyeXB0aW9uLiAgSW4NCmV4aXN0aW5n IFRMUyAxLjMsIHRoZXkgYXJlIHNlbnQgb25seSBhZnRlciBGaW5pc2hlZCBhbmQgc28gYXJlDQpl bmNyeXB0ZWQ7IG5vdyB0aGV5IGFyZSBwdWJsaWMuICBJIGFtIG5vdCBzdXJlIGlmIHRoaXMgY2hh bmdlcyB0aGUNCnNlY3VyaXR5IG1vZGVsIGJ1dCBpdCBkZWZpbml0ZWx5IG1ha2VzIGl0IGVhc2ll ciB0byBhdHRhY2sgdGhlIHRpY2tldC4NCltOQ1ddIEnigJltIG5vdCBzdXJlIHRoZSBxdWFudGlm aWFibGUgZWFzZSBpcyBzaWduaWZpY2FudCAodW5sZXNzIHRoZSBzZXNzaW9uIHRpY2tldCBoYXMg YmVlbiB3ZWFrbHkgZW5jcnlwdGVkIGJ5IHRoZSBzZXJ2ZXIpOyBidXQgd2UgY2FuIGNlcnRhaW5s eSBhZGQgdGhhdCBpbnRvIHRoZSBzZWN1cml0eSBjb25zaWRlcmF0aW9ucy4NCg0KKiBBIGxlc3Mt b2J2aW91cyBjb25zZXF1ZW5jZSB0byB0aGUgbGFjayBvZiBjb25maWRlbnRhbGl0eSBpcyB0aGF0 IGENCnR5cGljYWwgaW1wbGVtZW50YXRpb24sIGFuIGF0dGFja2VyIGNhbiBzZWxlY3RpdmVseSBi bG9jayBtZXNzYWdlcw0Ka25vd2luZyB0aGVpciBjb250ZW50cyAoYnkgYnJlYWtpbmcgdGhlIGNv bm5lY3Rpb24pLiAgSW4gdGhlIHdlYXRoZXINCmV4YW1wbGUgdGhpcyBtaWdodCBiZSB1c2VkIHRv IG1hbmlwdWxhdGUgYXZlcmFnZSBkYWlseSB0ZW1wZXJhdHVyZSBieQ0KYmxvY2tpbmcgb25seSBo aWdoZXIgb3Igb25seSBsb3dlciByZWFkaW5ncy4gIEluIHRoZSByb2JvdCBleGFtcGxlDQp0aGlz IG1pZ2h0IGJlIHVzZWQgdG8gY2F1c2UgaXQgdG8gZXhjZWVkIGl0cyBsaW1pdHMgYnkgYWxsb3dp bmcNCm1vdmVtZW50IGNvbW1hbmRzIG9ubHkgaW4gb25lIGRpcmVjdGlvbi4NCltOQ1ddIEZyb20g YW4gYXR0YWNrIHBlcnNwZWN0aXZlLCB5b3VyIGRlc2NyaXB0aW9uIHNlZW1zIHRvIGltcGx5IHNl bGVjdGl2ZSBtZXNzYWdlIGJsb2NraW5nIHdoaWNoIGFtIG5vdCBzdXJlIHdvdWxkIGJlIGVhc2ls eSBhY2hpZXZlZCBpbiB0aGUgdXNlIGNhc2VzIHdlIGxpc3RlZCBhcyBicmVha2luZyB0aGUgY29u bmVjdGlvbiB3b3VsZCBsaWtlbHkgaW1wbHkgYSBzZXNzaW9uIHRlYXJkb3duIGFzIHdlbGwuDQoN Cg0KSSB3b25kZXIgd2hldGhlciBpdCdzIHJlYWxseSBoZWxwZnVsIHRvIGNhbGwgdGhlIHJlc3Vs dCAnVExTJyBhbmQNCm5vdCBzb21ldGhpbmcgZWxzZT8NCg0KSSdtIGFnbm9zdGljIHcuci50LiBj b25maWRlbnRpYWxpdHkgb2YgYXBwbGljYXRpb24gZGF0YSAtLSB3ZSd2ZSBoaXN0b3JpY2FsbHkg YmVlbiBiYWQgYXQgbWFraW5nIGRlY2lzaW9uIGFib3V0IHdoYXQgZG9lcyAvIGRvZXMgbm90IG5l ZWQgdG8gYmUgY29uZmlkZW50aWFsLCBidXQgaGV5LCBpdCdzIHlvdXIgZGF0YS4NCltOQ1ddIFRo aXMgaXMgYW4gdW5mb3J0dW5hdGUgdHJ1dGggOi1QDQoNCkhvd2V2ZXIsIHRoZSBFRSAvIE5TVCBh cmd1bWVudHMgR2VvZmYgbWFrZSBoZXJlIHNlZW0gcHJldHR5IGNvbXBlbGxpbmcgdG8gbWUuICBU aGV5IGluZGljYXRlIHRvIG1lIHRoYXQgaWYgYSBtZWNoYW5pc20gaXMgZGVmaW5lZCB3aGVyZSBh cHBsaWNhdGlvbiBkYXRhIGlzIG5vdCBlbmNyeXB0ZWQsIHJlY29yZHMgdGhhdCBjb250YWluIG5v bi1hcHBsaWNhdGlvbiBkYXRhIHN0aWxsIG5lZWQgdG8gYmUgZW5jcnlwdGVkLiAgVGhhdCBvZiBj b3Vyc2UgYmxvd3MgYXdheSB0aGUgImNvZGUgZm9vdHByaW50IiBhcmd1bWVudCwgYW5kIGl0J3Mg bm90IHRyaXZpYWwgdG8gaW1wbGVtZW50IGdpdmVuIGhvdyB0aGUgYXBwbGljYXRpb25fZGF0YSBj b250ZW50IHR5cGUgaGFzIGJlZW4gb3ZlcmxvYWRlZCBpbiAxLjMuDQoNCklTVE0gdGhhdCBpbiBv cmRlciB0byBkbyB0aGlzIGF0IGFsbCBlbGVnYW50bHksIHlvdSdkIGhhdmUgdG8gYWJhbmRvbiB1 c2luZyBhcHBsaWNhdGlvbl9kYXRhIHJlY29yZHMgZm9yIGFwcGxpY2F0aW9uIGRhdGEsIHNpbmNl IHRob3NlIGhhdmUgdG8gYmUgZW5jcnlwdGVkIGZvciB0aGUgYWJvdmUgcmVhc29ucyksIGFuZCBp bnN0ZWFkIGVpdGhlcjoNCg0KLSBVc2UgYSBkaWZmZXJlbnQgcmVjb3JkIHR5cGUgKHNheSBwbGFp bnRleHRfZGF0YSkNCi0gVXNlIGEgZGlmZmVyZW50IHByb3RvY29sIHRoYXQgY2FuIGJlIG11eGVk IHdpdGggVExTIChhcyB3aXRoIERUTFMtU1JUUCkNCg0KVW5mb3J0dW5hdGVseSB0aGUgZm9ybWVy IGFwcHJvYWNoIHdvdWxkIHJlcXVpcmUgYSBTdGFuZGFyZHMgQWN0aW9uLiAgU28gbWF5YmUgdGhl IGxhdHRlciBpcyB0aGUgd2F5IHRvIGdvLg0KW05DV10gSSBuZWVkIHRvIHJldmlldyB0aGUgRUUg dG8gYXNjZXJ0YWluIHRoZSBuZWVkIGZvciB0aGlz4oCmLnRoYXQgaXMsIGlmIHRoZXNlIGluZGVl ZCBuZWVkIHRvIGJlIGVuY3J5cHRlZCBhcyB3ZWxsIGFzIG1hY+KAmWTigKYuDQoNCi0tUmljaGFy ZA0KDQoNCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQpU TFMgbWFpbGluZyBsaXN0DQpUTFNAaWV0Zi5vcmc8bWFpbHRvOlRMU0BpZXRmLm9yZz4NCmh0dHBz Oi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vdGxzDQo= --_000_99FAA87732EC43FABB1023FDC3242C33ciscocom_ Content-Type: text/html; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2 IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToy IDE1IDUgMiAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3Jt YWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1i b3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJp IixzYW5zLXNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXBy aW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQph OnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5 Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnAubXNv bm9ybWFsMCwgbGkubXNvbm9ybWFsMCwgZGl2Lm1zb25vcm1hbDANCgl7bXNvLXN0eWxlLW5hbWU6 bXNvbm9ybWFsOw0KCW1zby1tYXJnaW4tdG9wLWFsdDphdXRvOw0KCW1hcmdpbi1yaWdodDowaW47 DQoJbXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87DQoJbWFyZ2luLWxlZnQ6MGluOw0KCWZvbnQt c2l6ZToxMS4wcHQ7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0Kc3Bhbi5F bWFpbFN0eWxlMTgNCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwtcmVwbHk7DQoJZm9udC1mYW1p bHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6d2luZG93dGV4dDt9DQouTXNvQ2hwRGVm YXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LXNpemU6MTAuMHB0O30N CkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjguNWluIDExLjBpbjsNCgltYXJnaW46MS4waW4g MS4waW4gMS4waW4gMS4waW47fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9u MTt9DQotLT48L3N0eWxlPg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0iRU4tVVMiIGxpbms9ImJsdWUi IHZsaW5rPSJwdXJwbGUiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPkhpIEdlb2ZmIGFuZCBSaWNoYXJkLDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+VGhhbmtzIGZvciByYWlzaW5nIHRoZXNlIHBvaW50c+KApi5wbGVhc2Ugc2Vl IGJlbG93IGZvciBteSBjb21tZW50czo8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVy LXRvcDpzb2xpZCAjQjVDNERGIDEuMHB0O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4iPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Y29sb3I6 YmxhY2siPkZyb206IDwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Y29s b3I6YmxhY2siPlJpY2hhcmQgQmFybmVzICZsdDtybGJAaXB2LnN4Jmd0Ozxicj4NCjxiPkRhdGU6 IDwvYj5UdWVzZGF5LCBBdWd1c3QgMjEsIDIwMTggYXQgMDc6MDY8YnI+DQo8Yj5UbzogPC9iPiZx dW90O2dlb2Zma0BnZW9mZmsub3JnJnF1b3Q7ICZsdDtnZW9mZmtAZ2VvZmZrLm9yZyZndDs8YnI+ DQo8Yj5DYzogPC9iPiZxdW90O25jYW13aW5nQGNpc2NvLmNvbSZxdW90OyAmbHQ7bmNhbXdpbmdA Y2lzY28uY29tJmd0OywgJnF1b3Q7Jmx0O3Rsc0BpZXRmLm9yZyZndDsmcXVvdDsgJmx0O3Rsc0Bp ZXRmLm9yZyZndDs8YnI+DQo8Yj5TdWJqZWN0OiA8L2I+UmU6IFtUTFNdIGludGVncml0eSBvbmx5 IGNpcGhlcnN1aXRlczxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1ib3R0b206MTIuMHB0Ij48YSBuYW1lPSJf TWFpbE9yaWdpbmFsQm9keSI+PG86cD4mbmJzcDs8L286cD48L2E+PC9wPg0KPGRpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3Jp Z2luYWxCb2R5Ij5PbiBNb24sIEF1ZyAyMCwgMjAxOCBhdCA3OjQ2IFBNIEdlb2ZmcmV5IEtlYXRp bmcgJmx0Ozwvc3Bhbj48YSBocmVmPSJtYWlsdG86Z2VvZmZrQGdlb2Zmay5vcmciPjxzcGFuIHN0 eWxlPSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPmdlb2Zma0BnZW9mZmsub3JnPC9z cGFuPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPjwvc3Bhbj48 L2E+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+Jmd0Ow0KIHdy b3RlOjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJv cmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowaW4gMGlu IDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tcmlnaHQ6MGluIj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJvZHki PiZxdW90O05hbmN5IENhbS1XaW5nZXQgXChuY2Ftd2luZ1wpJnF1b3Q7ICZsdDtuY2Ftd2luZz08 L3NwYW4+PGEgaHJlZj0ibWFpbHRvOjQwY2lzY28uY29tQGRtYXJjLmlldGYub3JnIiB0YXJnZXQ9 Il9ibGFuayI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+NDBj aXNjby5jb21AZG1hcmMuaWV0Zi4ub3JnPC9zcGFuPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6 X01haWxPcmlnaW5hbEJvZHkiPjwvc3Bhbj48L2E+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpf TWFpbE9yaWdpbmFsQm9keSI+Jmd0Ow0KIHdyaXRlczo8YnI+DQo8YnI+DQomZ3Q7IEluIGZvbGxv d2luZyB0aGUgbmV3IElBTkEgcnVsZXMsIHdlIGhhdmUgcG9zdGVkIHRoZSBkcmFmdDxicj4NCiZn dDsgPC9zcGFuPjxhIGhyZWY9Imh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1jYW13 aW5nZXQtdGxzLXRzMTMtbWFjY2lwaGVyc3VpdGVzLTAwIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4g c3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+aHR0cHM6Ly90b29scy5pZXRm Lm9yZy9odG1sL2RyYWZ0LWNhbXdpbmdldC10bHMtdHMxMy1tYWNjaXBoZXJzdWl0ZXMtMDA8L3Nw YW4+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+PC9zcGFuPjwv YT48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij48YnI+DQomZ3Q7 IHRvIGRvY3VtZW50IHJlcXVlc3QgZm9yIHJlZ2lzdHJhdGlvbnMgb2YgSE1BQyBiYXNlZCBjaXBo ZXI8YnI+DQomZ3Q7IHNlbGVjdGlvbnMgd2l0aCBUTFMgMS4z4oCmLi5hbmQgYXJlIHNvbGljaXRp bmcgZmVlZGJhY2sgZnJvbSB0aGUgV0cgb248YnI+DQomZ3Q7IHRoZSBkcmFmdCBhbmQgaXRzIHBh dGggZm9yd2FyZC48YnI+DQo8YnI+DQpUaGlzIGRyYWZ0IG5lZWRzIG1vcmUgc2VjdXJpdHkgYW5h bHlzaXMgdGhhbiBpcyBjdXJyZW50bHkgdGhlcmUsIGFuZDxicj4NCnByb2JhYmx5IGl0IG5lZWRz IHRvIGRlZmluZSBub3QganVzdCBhIGNpcGhlcnN1aXRlIGJ1dCBhbiBlbnRpcmU8YnI+DQpwcm9m aWxlIGZvciB1c2luZyBUTFMgd2l0aCB0aGlzIGNpcGhlcnN1aXRlLiZuYnNwOyBTb21lIHRvcGlj czo8YnI+DQo8YnI+DQoqIEFueXRoaW5nIHRoYXQgcmVsaWVzIG9uIEVuY3J5cHRlZEV4dGVuc2lv bnMgc2hvdWxkIHByb2JhYmx5IG5vdCBiZTxicj4NCnVzZWQuPG86cD48L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9y aWdpbmFsQm9keSI+W05DV10gVGhhbmtzIGZvciByYWlzaW5nIHRoaXM7IEkgd2lsbCBoYXZlIHRv IHJldmlldyB0aGVzZSBhbmQgcGVyaGFwcyB1cGRhdGUgdGhlIGRyYWZ0IHdpdGggYXBwcm9wcmlh dGUgY29uc2lkZXJhdGlvbiBmb3IgdGhlbS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5 Ij48YnI+DQo8YnI+DQoqIFRoZSBzZXNzaW9uIHRpY2tldCBwcm9wZXJ0aWVzIGNoYW5nZSBpbiB0 aGUgYWJzZW5jZSBvZiBlbmNyeXB0aW9uLiZuYnNwOyBJbjxicj4NCmV4aXN0aW5nIFRMUyAxLjMs IHRoZXkgYXJlIHNlbnQgb25seSBhZnRlciBGaW5pc2hlZCBhbmQgc28gYXJlPGJyPg0KZW5jcnlw dGVkOyBub3cgdGhleSBhcmUgcHVibGljLiZuYnNwOyBJIGFtIG5vdCBzdXJlIGlmIHRoaXMgY2hh bmdlcyB0aGU8YnI+DQpzZWN1cml0eSBtb2RlbCBidXQgaXQgZGVmaW5pdGVseSBtYWtlcyBpdCBl YXNpZXIgdG8gYXR0YWNrIHRoZSB0aWNrZXQuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9k eSI+W05DV10gSeKAmW0gbm90IHN1cmUgdGhlIHF1YW50aWZpYWJsZSBlYXNlIGlzIHNpZ25pZmlj YW50ICh1bmxlc3MgdGhlIHNlc3Npb24gdGlja2V0IGhhcyBiZWVuIHdlYWtseSBlbmNyeXB0ZWQg YnkgdGhlIHNlcnZlcik7IGJ1dCB3ZSBjYW4gY2VydGFpbmx5IGFkZCB0aGF0IGludG8gdGhlIHNl Y3VyaXR5IGNvbnNpZGVyYXRpb25zLg0KPGJyPg0KPGJyPg0KKiBBIGxlc3Mtb2J2aW91cyBjb25z ZXF1ZW5jZSB0byB0aGUgbGFjayBvZiBjb25maWRlbnRhbGl0eSBpcyB0aGF0IGE8YnI+DQp0eXBp Y2FsIGltcGxlbWVudGF0aW9uLCBhbiBhdHRhY2tlciBjYW4gc2VsZWN0aXZlbHkgYmxvY2sgbWVz c2FnZXM8YnI+DQprbm93aW5nIHRoZWlyIGNvbnRlbnRzIChieSBicmVha2luZyB0aGUgY29ubmVj dGlvbikuJm5ic3A7IEluIHRoZSB3ZWF0aGVyPGJyPg0KZXhhbXBsZSB0aGlzIG1pZ2h0IGJlIHVz ZWQgdG8gbWFuaXB1bGF0ZSBhdmVyYWdlIGRhaWx5IHRlbXBlcmF0dXJlIGJ5PGJyPg0KYmxvY2tp bmcgb25seSBoaWdoZXIgb3Igb25seSBsb3dlciByZWFkaW5ncy4mbmJzcDsgSW4gdGhlIHJvYm90 IGV4YW1wbGU8YnI+DQp0aGlzIG1pZ2h0IGJlIHVzZWQgdG8gY2F1c2UgaXQgdG8gZXhjZWVkIGl0 cyBsaW1pdHMgYnkgYWxsb3dpbmc8YnI+DQptb3ZlbWVudCBjb21tYW5kcyBvbmx5IGluIG9uZSBk aXJlY3Rpb24uPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+W05DV10gRnJvbSBhbiBh dHRhY2sgcGVyc3BlY3RpdmUsIHlvdXIgZGVzY3JpcHRpb24gc2VlbXMgdG8gaW1wbHkgc2VsZWN0 aXZlIG1lc3NhZ2UgYmxvY2tpbmcgd2hpY2ggYW0gbm90IHN1cmUgd291bGQgYmUgZWFzaWx5IGFj aGlldmVkIGluIHRoZSB1c2UgY2FzZXMgd2UgbGlzdGVkIGFzIGJyZWFraW5nIHRoZSBjb25uZWN0 aW9uIHdvdWxkDQogbGlrZWx5IGltcGx5IGEgc2Vzc2lvbiB0ZWFyZG93biBhcyB3ZWxsLjxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJtc28t Ym9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPjxicj4NCjxicj4NCkkgd29uZGVyIHdoZXRoZXIg aXQncyByZWFsbHkgaGVscGZ1bCB0byBjYWxsIHRoZSByZXN1bHQgJ1RMUycgYW5kPGJyPg0Kbm90 IHNvbWV0aGluZyBlbHNlPzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvYmxvY2txdW90ZT4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWls T3JpZ2luYWxCb2R5Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3Jp Z2luYWxCb2R5Ij5JJ20gYWdub3N0aWMgdy5yLnQuIGNvbmZpZGVudGlhbGl0eSBvZiBhcHBsaWNh dGlvbiBkYXRhIC0tIHdlJ3ZlIGhpc3RvcmljYWxseSBiZWVuIGJhZCBhdCBtYWtpbmcgZGVjaXNp b24gYWJvdXQgd2hhdCBkb2VzIC8gZG9lcyBub3QgbmVlZCB0byBiZSBjb25maWRlbnRpYWwsIGJ1 dCBoZXksIGl0J3MgeW91ciBkYXRhLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPltO Q1ddIFRoaXMgaXMgYW4gdW5mb3J0dW5hdGUgdHJ1dGggOi1QPG86cD48L286cD48L3NwYW4+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1zby1i b29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1zby1ib29r bWFyazpfTWFpbE9yaWdpbmFsQm9keSI+SG93ZXZlciwgdGhlIEVFIC8gTlNUIGFyZ3VtZW50cyBH ZW9mZiBtYWtlIGhlcmUgc2VlbSBwcmV0dHkgY29tcGVsbGluZyB0byBtZS4mbmJzcDsgVGhleSBp bmRpY2F0ZSB0byBtZSB0aGF0IGlmIGEgbWVjaGFuaXNtIGlzIGRlZmluZWQgd2hlcmUgYXBwbGlj YXRpb24gZGF0YSBpcyBub3QgZW5jcnlwdGVkLCByZWNvcmRzIHRoYXQgY29udGFpbg0KIG5vbi1h cHBsaWNhdGlvbiBkYXRhIHN0aWxsIG5lZWQgdG8gYmUgZW5jcnlwdGVkLiZuYnNwOyBUaGF0IG9m IGNvdXJzZSBibG93cyBhd2F5IHRoZSAmcXVvdDtjb2RlIGZvb3RwcmludCZxdW90OyBhcmd1bWVu dCwgYW5kIGl0J3Mgbm90IHRyaXZpYWwgdG8gaW1wbGVtZW50IGdpdmVuIGhvdyB0aGUgYXBwbGlj YXRpb25fZGF0YSBjb250ZW50IHR5cGUgaGFzIGJlZW4gb3ZlcmxvYWRlZCBpbiAxLjMuPG86cD48 L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+PG86cD4mbmJzcDs8L286 cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+SVNUTSB0aGF0IGluIG9yZGVy IHRvIGRvIHRoaXMgYXQgYWxsIGVsZWdhbnRseSwgeW91J2QgaGF2ZSB0byBhYmFuZG9uIHVzaW5n IGFwcGxpY2F0aW9uX2RhdGEgcmVjb3JkcyBmb3IgYXBwbGljYXRpb24gZGF0YSwgc2luY2UgdGhv c2UgaGF2ZSB0byBiZSBlbmNyeXB0ZWQgZm9yIHRoZSBhYm92ZSByZWFzb25zKSwgYW5kIGluc3Rl YWQNCiBlaXRoZXI6PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9k eSI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+ LSBVc2UgYSBkaWZmZXJlbnQgcmVjb3JkIHR5cGUgKHNheSBwbGFpbnRleHRfZGF0YSk8bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij4tIFVzZSBhIGRpZmZlcmVu dCBwcm90b2NvbCB0aGF0IGNhbiBiZSBtdXhlZCB3aXRoIFRMUyAoYXMgd2l0aCBEVExTLVNSVFAp PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+PG86cD4mbmJz cDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+VW5mb3J0dW5hdGVs eSB0aGUgZm9ybWVyIGFwcHJvYWNoIHdvdWxkIHJlcXVpcmUgYSBTdGFuZGFyZHMgQWN0aW9uLiZu YnNwOyBTbyBtYXliZSB0aGUgbGF0dGVyIGlzIHRoZSB3YXkgdG8gZ28uPG86cD48L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpf TWFpbE9yaWdpbmFsQm9keSI+W05DV10gSSBuZWVkIHRvIHJldmlldyB0aGUgRUUgdG8gYXNjZXJ0 YWluIHRoZSBuZWVkIGZvciB0aGlz4oCmLnRoYXQgaXMsIGlmIHRoZXNlIGluZGVlZCBuZWVkIHRv IGJlIGVuY3J5cHRlZCBhcyB3ZWxsIGFzIG1hY+KAmWTigKYuDQo8bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0ibXNv LWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0ibXNvLWJv b2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij4tLVJpY2hhcmQ8bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0ibXNvLWJv b2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAj Q0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7 bWFyZ2luLXJpZ2h0OjBpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0ibXNv LWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij48YnI+DQpfX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fXzxicj4NClRMUyBtYWlsaW5nIGxpc3Q8YnI+DQo8L3Nw YW4+PGEgaHJlZj0ibWFpbHRvOlRMU0BpZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0 eWxlPSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPlRMU0BpZXRmLm9yZzwvc3Bhbj48 c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsT3JpZ2luYWxCb2R5Ij48L3NwYW4+PC9hPjxz cGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPjxicj4NCjwvc3Bhbj48 YSBocmVmPSJodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3RscyIgdGFyZ2V0 PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPmh0 dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vdGxzPC9zcGFuPjxzcGFuIHN0eWxl PSJtc28tYm9va21hcms6X01haWxPcmlnaW5hbEJvZHkiPjwvc3Bhbj48L2E+PHNwYW4gc3R5bGU9 Im1zby1ib29rbWFyazpfTWFpbE9yaWdpbmFsQm9keSI+PG86cD48L286cD48L3NwYW4+PC9wPg0K PC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ib2R5Pg0KPC9odG1sPg0K --_000_99FAA87732EC43FABB1023FDC3242C33ciscocom_-- From nobody Wed Aug 22 15:58:14 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BB3AD1277BB for ; Wed, 22 Aug 2018 15:58:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NvQNvlN-IGLW for ; Wed, 22 Aug 2018 15:58:10 -0700 (PDT) Received: from dmz-mailsec-scanner-3.mit.edu (dmz-mailsec-scanner-3.mit.edu [18.9.25.14]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9A787124C04 for ; Wed, 22 Aug 2018 15:58:10 -0700 (PDT) X-AuditID: 1209190e-1cbff700000058a7-c3-5b7dea806335 Received: from mailhub-auth-1.mit.edu ( [18.9.21.35]) (using TLS with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by dmz-mailsec-scanner-3.mit.edu (Symantec Messaging Gateway) with SMTP id 28.9B.22695.18AED7B5; Wed, 22 Aug 2018 18:58:09 -0400 (EDT) Received: from outgoing.mit.edu (OUTGOING-AUTH-1.MIT.EDU [18.9.28.11]) by mailhub-auth-1.mit.edu (8.13.8/8.9.2) with ESMTP id w7MMw63V008513; Wed, 22 Aug 2018 18:58:07 -0400 Received: from kduck.kaduk.org (24-107-191-124.dhcp.stls.mo.charter.com [24.107.191.124]) (authenticated bits=56) (User authenticated as kaduk@ATHENA.MIT.EDU) by outgoing.mit.edu (8.13.8/8.12.4) with ESMTP id w7MMvvv8025830 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT); Wed, 22 Aug 2018 18:58:00 -0400 Date: Wed, 22 Aug 2018 17:57:57 -0500 From: Benjamin Kaduk To: Masato Gosui Cc: Simon Josefsson , RFC Errata System , "ynir.ietf@gmail.com" , "mpg@elzevir.fr" , "ekr@rtfm.com" , "christopherwood07@gmail.com" , "joe@salowey.net" , "sean+ietf@sn3rd.com" , "tls@ietf.org" Message-ID: <20180822225757.GG43963@kduck.kaduk.org> References: <20180817022137.6C114B80A77@rfc-editor.org> <1937603C-BD24-48A0-8555-B4D8D7BE6D37@josefsson.org> <20180817223735.GW40887@kduck.kaduk.org> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: User-Agent: Mutt/1.9.1 (2017-09-22) X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFrrFKsWRmVeSWpSXmKPExsUixCmqrNv4qjba4PkuEYvp36+xWax4fY7d Ytum/ewWn7ZPYLT4/iLZomn/VzaLSxtWM1nc23IJKH6+i9Fi6bEPTA5cHvc232D22DnrLrvH kiU/mTxmnrnI7tHQdozVY/LjNmaP47s2sHscPMjo0XPjD2sAZxSXTUpqTmZZapG+XQJXxoc5 jxgLDopUXJ05h72BsY2vi5GTQ0LARKJzwT22LkYuDiGBxUwSZw5PYoVwNjJKvNy2gxHCucok sf3tGzaQFhYBVYktU66wg9hsAioSDd2XmUFsEQF1icmLrrOANDALbGGWuHx7JRNIQljAXOLU oy8sIDYv0L71T3dC7bvAKLF/Qg9UQlDi5MwnYDYz0KQ/8y4BTeUAsqUllv/jgAjLSzRvnQ22 jFPAUaLlcR/YfFEBZYm9fYfYJzAKzkIyaRaSSbMQJs1CMmkBI8sqRtmU3Crd3MTMnOLUZN3i 5MS8vNQiXWO93MwSvdSU0k2M4GiT5NvBOKnB+xCjAAejEg+vQGFttBBrYllxZe4hRkkOJiVR 3s/+QCG+pPyUyozE4oz4otKc1OJDjBIczEoivM8310QL8aYkVlalFuXDpKQ5WJTEee/VhEcL CaQnlqRmp6YWpBbBZGU4OJQkeK+9BBoqWJSanlqRlplTgpBm4uAEGc4DNLz4OVANb3FBYm5x ZjpE/hSjLsef91MnMQux5OXnpUqJ8/4BGSQAUpRRmgc3B5QkJbL317xiFAd6S5g3DKSKB5hg 4Sa9AlrCBLSElRlsSUkiQkqqgTHdKfTchivTnTTaNH33J38VXRn6hyP/pfcjW0n5u4LSOpyJ 91j2PQ39HVVsfG3Xfuk7J8NenJ18zsZgTW+H54mz74PCg+ZssE40eCj/xTnxwD3TQr079odl 903ZGr1LwMnk4Y9Ds84tYvc3WH0832EuV/TzYknP2ZcmXJjlMnWWfWCI0/da3n4lluKMREMt 5qLiRADY9VZobQMAAA== Archived-At: Subject: Re: [TLS] [Editorial Errata Reported] RFC8422 (5468) X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Aug 2018 22:58:13 -0000 No need to submit a new one -- I can edit it as needed. -Ben On Tue, Aug 21, 2018 at 05:05:57AM +0000, Masato Gosui wrote: > If a new errata proposing the PDU change is needed, I gladly submit it. > > -- > Masato Gosui > > On Fri, Aug 17, 2018 at 10:25:47AM +0200, Simon Josefsson wrote: > > I think “namedCurve†is better, it matches ASN.1 usage. > > So you want me to change the PDU to be "namedCurve" instead? > > -Ben > > > /Simon > > > > > 17 aug. 2018 kl. 04:21 skrev RFC Errata System : > > > > > > The following errata report has been submitted for RFC8422, > > > "Elliptic Curve Cryptography (ECC) Cipher Suites for Transport Layer Security (TLS) Versions 1.2 and Earlier". > > > > > > -------------------------------------- > > > You may review the report below and at: > > > http://www.rfc-editor.org/errata/eid5468 > > > > > > -------------------------------------- > > > Type: Editorial > > > Reported by: Masato Gosui > > > > > > Section: 5.4 > > > > > > Original Text > > > ------------- > > > namedCurve: Specifies a recommended set of elliptic curve domain > > > > > > Corrected Text > > > -------------- > > > namedcurve: Specifies a recommended set of elliptic curve domain > > > > > > Notes > > > ----- > > > This fixes mismatched names of the variable "namedcurve" in the "Structure of this message" paragraph. > > > > > > Instructions: > > > ------------- > > > This erratum is currently posted as "Reported". If necessary, please > > > use "Reply All" to discuss whether it should be verified or > > > rejected. When a decision is reached, the verifying party > > > can log in to change the status and edit the report, if necessary. > > > > > > -------------------------------------- > > > RFC8422 (draft-ietf-tls-rfc4492bis-17) > > > -------------------------------------- > > > Title : Elliptic Curve Cryptography (ECC) Cipher Suites for Transport Layer Security (TLS) Versions 1.2 and Earlier > > > Publication Date : August 2018 > > > Author(s) : Y. Nir, S. Josefsson, M. Pegourie-Gonnard > > > Category : PROPOSED STANDARD > > > Source : Transport Layer Security > > > Area : Security > > > Stream : IETF > > > Verifying Party : IESG > > > > From nobody Thu Aug 23 14:08:12 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9264D130F01 for ; Thu, 23 Aug 2018 14:08:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.908 X-Spam-Level: X-Spam-Status: No, score=-1.908 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, T_DKIMWL_WL_MED=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=ipv-sx.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CCvh0XuhcHjB for ; Thu, 23 Aug 2018 14:08:08 -0700 (PDT) Received: from mail-oi0-x234.google.com (mail-oi0-x234.google.com [IPv6:2607:f8b0:4003:c06::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6252512F1A2 for ; Thu, 23 Aug 2018 14:08:08 -0700 (PDT) Received: by mail-oi0-x234.google.com with SMTP id c190-v6so11759878oig.6 for ; Thu, 23 Aug 2018 14:08:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipv-sx.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=CEhDX7pzUs8BtgYdltIfbbgiDyL1OSoeXNa8+xIysyQ=; b=EixU8bhHq3hVLWQeAfpJkxSfpIrRBHI6aGoPcP3EWtrgOpEdUP6tjQFi0hv4BwVQZH 9MYE6+umIAmucw1NYLqDJdHcWAbnUGyBbcSe+s2u4HkoYY/Z6JEZZcejv/01XaYN+bzY BnddcNNMHBu2LWqW3pSUMhlWs29sEgLTrEeLf+bPv5LWSjzblLsOFUV6apVWFfqY6pW+ Dd3x+NJxH10Hqg5seLvFB/OZRX+CjWqonzIZSEZh1f6gghGy0Q+xibISrAbvmBlgeYkV ggpixPgzaDnraqCAm+YFWOWg+g+b+PyCV9t9BFd4jbcIESfQk+wsYuDepvvyHPO13p0e 74Rw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=CEhDX7pzUs8BtgYdltIfbbgiDyL1OSoeXNa8+xIysyQ=; b=tHzdH2gwJI7leGPJRIIr6dj8U2dS7PED2NnqE9S+F6gd8ALw21fHt5GE+cNlkRaz6R QaiiTm19UrNhZT7p6IN4uZzSNpJXreFYJg5kvdr4plJBZsu04ytDxtSpbzMqsLYK2EYw 6Nv5ZB75ic6YlAbmsliKNtfXL9OLAT4gMTTvYcLXh40MqTJVXWZ/MKOEAiO8GM4wGyKx 3UGJoLrGO4eJJd/ZFaU3bdjxehCKDKRb3+xqKPH015SOU+u7Fb7s0yc8b1n2FWdoTPRE 5y6v/Hg5qhxlaHJDJVM9OfZQY65xQPaHOmMCm2162VW9V+PToVdDrfHN1T3lsuAdZPW4 OyjA== X-Gm-Message-State: APzg51Al8IEfkQdzAIhAMxi5SsXKIMxL2u4NAdU2bm0kK4I6OMeboUgp HqjycnuFl28bvImulZK0cuNCtUfegYP5jT5D3cFyMhI5pJU= X-Google-Smtp-Source: ANB0VdY7ZFFfhmVT468dWh8AuTScs9pqG4VcXbvjH1I2y3Kwe+8eOwJBAOAuktLYKMWywyYR/ek5jEJXSTHRHaLc+rA= X-Received: by 2002:aca:c74d:: with SMTP id x74-v6mr3862839oif.97.1535058487524; Thu, 23 Aug 2018 14:08:07 -0700 (PDT) MIME-Version: 1.0 References: <8A2746A8-6B41-45C3-9D77-6AF3536C6E2D@siemens.com> <3321850E-D95E-457C-A574-2A1A3F7AC06C@dukhovni.org> <1534902946308.39422@cs.auckland.ac.nz> <20180822030846.GN28851@straasha.imrryr.org> <1534913286161.86694@cs.auckland.ac.nz> In-Reply-To: <1534913286161.86694@cs.auckland.ac.nz> From: Richard Barnes Date: Thu, 23 Aug 2018 17:07:56 -0400 Message-ID: To: pgut001@cs.auckland.ac.nz Cc: "" Content-Type: multipart/alternative; boundary="000000000000dbd0f6057420a7d4" Archived-At: Subject: Re: [TLS] raw public keys in the wild? X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Aug 2018 21:08:11 -0000 --000000000000dbd0f6057420a7d4 Content-Type: text/plain; charset="UTF-8" Since we're talking about bare public keys / not verifying certificates again, a brief reminder: https://tools.ietf.org/html/draft-barnes-dane-uks-00 On Wed, Aug 22, 2018 at 12:49 AM Peter Gutmann wrote: > Viktor Dukhovni writes: > > >Some DANE users have reached similar conclusions, though a bit of ASN.1 > >parsing is still required to "seek" to the SPKI, which is not at a fixed > >offset in the certificate. > > It's actually much simpler than that because you've got a nice unique byte > string, the OID, in front of the key. My code jumps 64 bytes in and then > scans from there looking for the byte string corresponding to SEQUENCE { > RSA > OID, NULL }. What follows is the public key, you skip the wrapper bytes > and > grab the two integer values that follow. > > > 41 32: SEQUENCE { > > 43 13: UTCTime 27/07/2014 14:59:59 GMT > > 58 15: GeneralizedTime 27/11/3013 14:59:59 GMT > > : } > > Yeah, seen those sorts of things too, my code has special-case handling to > clip validTo at 32-bit INT_MAX - 1 if it sees long lifetimes (getting > pedantic, it's actually 2036 since some embedded libraries have problems > with > time_t values too close to INT_MAX). > > >It does not stricly comply with RFC5280, which forbids empty RDN sequences > >for the issuer field, but this does not seem to be a problem in practice. > > Yup. If all you're doing is a string search for the RSA OID, no-one cares > what else is or isn't present. > > Peter. > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > --000000000000dbd0f6057420a7d4 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Since we're talking about bare public keys / not = verifying certificates again, a brief reminder:

https://tool= s.ietf.org/html/draft-barnes-dane-uks-00

On Wed, Aug 22, 2018 at 12:49 AM Peter Gu= tmann <pgut001@cs.auckland.= ac.nz> wrote:
Viktor Dukhovn= i <ietf-dane= @dukhovni.org> writes:

>Some DANE users have reached similar conclusions, though a bit of ASN.1=
>parsing is still required to "seek" to the SPKI, which is not= at a fixed
>offset in the certificate.

It's actually much simpler than that because you've got a nice uniq= ue byte
string, the OID, in front of the key.=C2=A0 My code jumps 64 bytes in and t= hen
scans from there looking for the byte string corresponding to SEQUENCE { RS= A
OID, NULL }.=C2=A0 What follows is the public key, you skip the wrapper byt= es and
grab the two integer values that follow.

>=C2=A0 41=C2=A0 =C2=A032:=C2=A0 =C2=A0 =C2=A0SEQUENCE {
>=C2=A0 43=C2=A0 =C2=A013:=C2=A0 =C2=A0 =C2=A0 =C2=A0UTCTime 27/07/2014 = 14:59:59 GMT
>=C2=A0 58=C2=A0 =C2=A015:=C2=A0 =C2=A0 =C2=A0 =C2=A0GeneralizedTime 27/= 11/3013 14:59:59 GMT
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0:=C2=A0 =C2=A0 =C2=A0 =C2=A0}

Yeah, seen those sorts of things too, my code has special-case handling to<= br> clip validTo at 32-bit INT_MAX - 1 if it sees long lifetimes (getting
pedantic, it's actually 2036 since some embedded libraries have problem= s with
time_t values too close to INT_MAX).

>It does not stricly comply with RFC5280, which forbids empty RDN sequen= ces
>for the issuer field, but this does not seem to be a problem in practic= e.

Yup.=C2=A0 If all you're doing is a string search for the RSA OID, no-o= ne cares
what else is or isn't present.

Peter.

_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls
--000000000000dbd0f6057420a7d4-- From nobody Thu Aug 23 14:15:13 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 40A00130F09 for ; Thu, 23 Aug 2018 14:15:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qrQQYrsV_xaB for ; Thu, 23 Aug 2018 14:15:10 -0700 (PDT) Received: from straasha.imrryr.org (straasha.imrryr.org [100.2.39.101]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5CDA1130E20 for ; Thu, 23 Aug 2018 14:15:10 -0700 (PDT) Received: from [10.200.0.109] (unknown [8.2.105.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by straasha.imrryr.org (Postfix) with ESMTPSA id C28D41BEFF for ; Thu, 23 Aug 2018 17:15:09 -0400 (EDT) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) From: Viktor Dukhovni In-Reply-To: Date: Thu, 23 Aug 2018 17:15:06 -0400 Content-Transfer-Encoding: quoted-printable Reply-To: tls@ietf.org Message-Id: <5D210DCA-F9AF-4B2F-BD26-13877E174DFE@dukhovni.org> References: <8A2746A8-6B41-45C3-9D77-6AF3536C6E2D@siemens.com> <3321850E-D95E-457C-A574-2A1A3F7AC06C@dukhovni.org> <1534902946308.39422@cs.auckland.ac.nz> <20180822030846.GN28851@straasha.imrryr.org> <1534913286161.86694@cs.auckland.ac.nz> To: tls@ietf.org X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: Re: [TLS] raw public keys in the wild? X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Aug 2018 21:15:12 -0000 > On Aug 23, 2018, at 5:07 PM, Richard Barnes wrote: >=20 > Since we're talking about bare public keys / not verifying = certificates again, a brief reminder: >=20 > https://tools.ietf.org/html/draft-barnes-dane-uks-00 Yes, what do you want to do with that draft? The conclusions for HTTPS are correct. For SMTP, UKS surely does not apply, one can already direct one's SMTP traffic to a different server by just pointing MX records there... Ditto for protocols that use SRV indirection. So I'd support moving that forward, but perhaps with a more nuanced set of conditions on when host name checks must not be skipped. --=20 Viktor. From nobody Fri Aug 24 07:09:54 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 457B8127333 for ; Fri, 24 Aug 2018 07:09:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=telecom-paristech.fr Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lGQ0-uuCtcud for ; Fri, 24 Aug 2018 07:09:48 -0700 (PDT) Received: from zproxy110.enst.fr (zproxy110.enst.fr [IPv6:2001:660:330f:2::c0]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9EBEA127332 for ; Fri, 24 Aug 2018 07:09:47 -0700 (PDT) Received: from localhost (localhost [IPv6:::1]) by zproxy110.enst.fr (Postfix) with ESMTP id BEEBD81EE0 for ; Fri, 24 Aug 2018 16:09:45 +0200 (CEST) Received: from zproxy110.enst.fr ([IPv6:::1]) by localhost (zproxy110.enst.fr [IPv6:::1]) (amavisd-new, port 10032) with ESMTP id faJSYRv_6T8J for ; Fri, 24 Aug 2018 16:09:44 +0200 (CEST) Received: from localhost (localhost [IPv6:::1]) by zproxy110.enst.fr (Postfix) with ESMTP id 4BCE381EE8 for ; Fri, 24 Aug 2018 16:09:44 +0200 (CEST) DKIM-Filter: OpenDKIM Filter v2.10.3 zproxy110.enst.fr 4BCE381EE8 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=telecom-paristech.fr; s=A6AEC2EE-1106-11E5-B10E-D103FDDA8F2E; t=1535119784; bh=jhAPcj901FU/Q8gKKE7rQ4cKOsccYv5ppFbVE8m8T0M=; h=Date:From:To:Message-ID:MIME-Version; b=328nOjL2MPOXFOLJ8YMkanN+Btq5qmkgLxTKfMo8Z6abLOPDqGn93E+JN3C3x35lk wmJHH9cSPC5nuHGK5ja8INeRm+PzFHKeC2T+UI6D5KR4WI9C5iIgTL0ey+GBrVUKfQ Du/+IL92uWgpN1X5TyDepR3eaKNyDWSLn7M5rCTI= X-Virus-Scanned: amavisd-new at zproxy110.enst.fr Received: from zproxy110.enst.fr ([IPv6:::1]) by localhost (zproxy110.enst.fr [IPv6:::1]) (amavisd-new, port 10026) with ESMTP id XTPCPuC3KJmD for ; Fri, 24 Aug 2018 16:09:44 +0200 (CEST) Received: from zmail112.enst.fr (zmail112.enst.fr [137.194.2.205]) by zproxy110.enst.fr (Postfix) with ESMTP id 1CFA481EE0 for ; Fri, 24 Aug 2018 16:09:43 +0200 (CEST) Date: Fri, 24 Aug 2018 16:09:43 +0200 (CEST) From: Mounira Msahli To: tls Message-ID: <1231917830.3727154.1535119783361.JavaMail.zimbra@enst.fr> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----=_Part_3727152_1694833488.1535119783358" X-Originating-IP: [::ffff:137.194.205.193] X-Mailer: Zimbra 8.8.9_GA_3006 (ZimbraWebClient - FF61 (Linux)/8.8.9_GA_3006) Thread-Index: IRKOTO01wohZC+RV13doiK1qU2IKWQ== Thread-Topic: TLS 1.3 Authentication using ETSI TS 103 097 and IEEE 1609.2 certificates Archived-At: Subject: [TLS] TLS 1.3 Authentication using ETSI TS 103 097 and IEEE 1609.2 certificates X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Aug 2018 14:09:51 -0000 ------=_Part_3727152_1694833488.1535119783358 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Hi all, The draft: TLS 1.3 Authentication using IEEE 1609.2/ETSI TS 103097 certificates is updated in accordance with TLS 1.3: https://tools.ietf.org/html/draft-tls-certieee1609-01 This document describes the use of certificates specified by the Institute of Electrical and Electronics Engineers IEEE1609.2 and the European Telecommunications Standards Institute ETSI TS 103097. These standards are defined in order to secure communications in vehicular environments. This extension is very useful and has become a pressing need for (Vehicle-To-Internet(V2Internet), Vehicle-To-Cloud(V2Cloud),...). We are soliciting feedback from the WG on the draft. Kind Regards Mounira ------=_Part_3727152_1694833488.1535119783358 Content-Type: text/plain; name=draft-tls-certieee1609-01.txt Content-Disposition: attachment; filename=draft-tls-certieee1609-01.txt Content-Transfer-Encoding: base64 CgoKClRMUyBXb3JraW5nIEdyb3VwICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg IFAuIEthbXBhbmFraXMsIEVkLgpJbnRlcm5ldC1EcmFmdCAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2lzY28KSW50ZW5kZWQgc3RhdHVzOiBJbmZv cm1hdGlvbmFsICAgICAgICAgICAgICAgICAgICAgICAgICAgIE0uIE1zYWhsaSwgRWQuCkV4cGly ZXM6IEZlYnJ1YXJ5IDE5LCAyMDE5ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBUZWxlY29t IFBhcmlzVGVjaAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICBBdWd1c3QgMTgsIDIwMTgKCgogICAgICBUTFMgMS4zIEF1dGhlbnRpY2F0aW9u IHVzaW5nIEVUU0kgVFMgMTAzIDA5NyBhbmQgSUVFRSAxNjA5LjIKICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgY2VydGlmaWNhdGVzCiAgICAgICAgICAgICAgICAgICAgIGRyYWZ0LXRscy1j ZXJ0aWVlZTE2MDktMDEudHh0CgpBYnN0cmFjdAoKICAgVGhpcyBkb2N1bWVudCBzcGVjaWZpZXMg dGhlIHVzZSBvZiB0d28gbmV3IGNlcnRpZmljYXRlIHR5cGVzIHRvCiAgIGF1dGhlbnRpY2F0ZSBU TFMgZW50aXRpZXMuICBUaGUgZmlyc3QgdHlwZSBlbmFibGVzIHRoZSB1c2Ugb2YgYQogICBjZXJ0 aWZpY2F0ZSBzcGVjaWZpZWQgYnkgdGhlIEluc3RpdHV0ZSBvZiBFbGVjdHJpY2FsIGFuZCBFbGVj dHJvbmljcwogICBFbmdpbmVlcnMgKElFRUUpIFtJRUVFMTYwOS4yXSBhbmQgdGhlIHNlY29uZCBi eSB0aGUgRXVyb3BlYW4KICAgVGVsZWNvbW11bmljYXRpb25zIFN0YW5kYXJkcyBJbnN0aXR1dGUg KEVUU0kpIFtUUzEwMzA5N10uCgpTdGF0dXMgb2YgVGhpcyBNZW1vCgogICBUaGlzIEludGVybmV0 LURyYWZ0IGlzIHN1Ym1pdHRlZCBpbiBmdWxsIGNvbmZvcm1hbmNlIHdpdGggdGhlCiAgIHByb3Zp c2lvbnMgb2YgQkNQIDc4IGFuZCBCQ1AgNzkuCgogICBJbnRlcm5ldC1EcmFmdHMgYXJlIHdvcmtp bmcgZG9jdW1lbnRzIG9mIHRoZSBJbnRlcm5ldCBFbmdpbmVlcmluZwogICBUYXNrIEZvcmNlIChJ RVRGKS4gIE5vdGUgdGhhdCBvdGhlciBncm91cHMgbWF5IGFsc28gZGlzdHJpYnV0ZQogICB3b3Jr aW5nIGRvY3VtZW50cyBhcyBJbnRlcm5ldC1EcmFmdHMuICBUaGUgbGlzdCBvZiBjdXJyZW50IElu dGVybmV0LQogICBEcmFmdHMgaXMgYXQgaHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9kcmFm dHMvY3VycmVudC8uCgogICBJbnRlcm5ldC1EcmFmdHMgYXJlIGRyYWZ0IGRvY3VtZW50cyB2YWxp ZCBmb3IgYSBtYXhpbXVtIG9mIHNpeCBtb250aHMKICAgYW5kIG1heSBiZSB1cGRhdGVkLCByZXBs YWNlZCwgb3Igb2Jzb2xldGVkIGJ5IG90aGVyIGRvY3VtZW50cyBhdCBhbnkKICAgdGltZS4gIEl0 IGlzIGluYXBwcm9wcmlhdGUgdG8gdXNlIEludGVybmV0LURyYWZ0cyBhcyByZWZlcmVuY2UKICAg bWF0ZXJpYWwgb3IgdG8gY2l0ZSB0aGVtIG90aGVyIHRoYW4gYXMgIndvcmsgaW4gcHJvZ3Jlc3Mu IgoKICAgVGhpcyBJbnRlcm5ldC1EcmFmdCB3aWxsIGV4cGlyZSBvbiBGZWJydWFyeSAxOSwgMjAx OS4KCkNvcHlyaWdodCBOb3RpY2UKCiAgIENvcHlyaWdodCAoYykgMjAxOCBJRVRGIFRydXN0IGFu ZCB0aGUgcGVyc29ucyBpZGVudGlmaWVkIGFzIHRoZQogICBkb2N1bWVudCBhdXRob3JzLiAgQWxs IHJpZ2h0cyByZXNlcnZlZC4KCiAgIFRoaXMgZG9jdW1lbnQgaXMgc3ViamVjdCB0byBCQ1AgNzgg YW5kIHRoZSBJRVRGIFRydXN0J3MgTGVnYWwKICAgUHJvdmlzaW9ucyBSZWxhdGluZyB0byBJRVRG IERvY3VtZW50cwogICAoaHR0cHM6Ly90cnVzdGVlLmlldGYub3JnL2xpY2Vuc2UtaW5mbykgaW4g ZWZmZWN0IG9uIHRoZSBkYXRlIG9mCiAgIHB1YmxpY2F0aW9uIG9mIHRoaXMgZG9jdW1lbnQuICBQ bGVhc2UgcmV2aWV3IHRoZXNlIGRvY3VtZW50cwogICBjYXJlZnVsbHksIGFzIHRoZXkgZGVzY3Jp YmUgeW91ciByaWdodHMgYW5kIHJlc3RyaWN0aW9ucyB3aXRoIHJlc3BlY3QKICAgdG8gdGhpcyBk b2N1bWVudC4gIENvZGUgQ29tcG9uZW50cyBleHRyYWN0ZWQgZnJvbSB0aGlzIGRvY3VtZW50IG11 c3QKICAgaW5jbHVkZSBTaW1wbGlmaWVkIEJTRCBMaWNlbnNlIHRleHQgYXMgZGVzY3JpYmVkIGlu IFNlY3Rpb24gNC5lIG9mCgoKCkthbXBhbmFraXMgJiBNc2FobGkgICAgIEV4cGlyZXMgRmVicnVh cnkgMTksIDIwMTkgICAgICAgICAgICAgICBbUGFnZSAxXQoMCkludGVybmV0LURyYWZ0ICAgSUVF RSBhbmQgRVRTSSBDZXJ0aWZpY2F0ZSBUeXBlcyBmb3IgVExTICAgICBBdWd1c3QgMjAxOAoKCiAg IHRoZSBUcnVzdCBMZWdhbCBQcm92aXNpb25zIGFuZCBhcmUgcHJvdmlkZWQgd2l0aG91dCB3YXJy YW50eSBhcwogICBkZXNjcmliZWQgaW4gdGhlIFNpbXBsaWZpZWQgQlNEIExpY2Vuc2UuCgpUYWJs ZSBvZiBDb250ZW50cwoKICAgMS4gIEludHJvZHVjdGlvbiAgLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gICAyCiAgIDIuICBSZXF1aXJlbWVudHMgVGVybWlu b2xvZ3kgIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICAgMwogICAzLiAgRXh0 ZW5zaW9uIE92ZXJ2aWV3ICAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAgIDMKICAgNC4gIE1lc3NhZ2UgRmxvdyAgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gICA1CiAgICAgNC4xLiAgQ2xpZW50IEhlbGxvICAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICAgNgogICAgIDQuMi4gIFNlcnZlciBI ZWxsbyAgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAgIDYKICAg NS4gIENlcnRpZmljYXRlIFZlcmlmaWNhdGlvbiAgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gICA2CiAgICAgNS4xLiAgSUVFRSAxNjA5LjIgY2VydGlmaWNhdGVzICAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICAgNgogICAgIDUuMi4gIEVUU0kgVFMgMTAzIDA5NyBj ZXJ0aWZpY2F0ZXMgIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAgIDYKICAgNi4gIEV4YW1w bGVzICAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g ICA3CiAgICAgNi4xLiAgVExTIFNlcnZlciBhbmQgVExTIENsaWVudCB1c2UgdGhlIDE2MDlEb3Qy IENlcnRpZmljYXRlICAuICAgNwogICAgIDYuMi4gIFRMUyBTZXJ2ZXIgdXNlcyB0aGUgSUVFRSAx NjA5LjIgY2VydGlmaWNhdGUgYW5kIFRMUwogICAgICAgICAgIENsaWVudCB1c2VzIHRoZSBYIDUw OSBjZXJ0aWZpY2F0ZSAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAgIDcKICAgICA2LjMuICBUTFMg U2VydmVyIHVzZXMgdGhlIElFRUUgMTYwOS4yIGNlcnRpZmljYXRlIGFuZCBUTFMKICAgICAgICAg ICBDbGllbnQgdXNlcyB0aGUgRVRTSSBUUyAxMDMwOTcgY2VydGlmaWNhdGUgIC4gLiAuIC4gLiAu IC4gICA4CiAgIDcuICBTZWN1cml0eSBDb25zaWRlcmF0aW9ucyAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuICAgOQogICA4LiAgUHJpdmFjeSBDb25zaWRlcmF0aW9ucyAgLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAgIDkKICAgOS4gIElBTkEgQ29uc2lk ZXJhdGlvbnMgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gIDEwCiAg IDEwLiBBY2tub3dsZWRnZW1lbnRzICAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAuICAxMAogICAxMS4gUmVmZXJlbmNlcyAgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAgMTAKICAgICAxMS4xLiAgTm9ybWF0aXZlIFJlZmVy ZW5jZXMgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gIDEwCiAgICAgMTEuMi4g IEluZm9ybWF0aXZlIFJlZmVyZW5jZXMgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu ICAxMQogICBBcHBlbmRpeCBBLiAgQ28tQXV0aG9ycyAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAgMTIKICAgQXV0aG9ycycgQWRkcmVzc2VzICAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gIDEyCgoxLiAgSW50cm9kdWN0aW9uCgog ICBBdCBwcmVzZW50LCBUTFMgMS4zIHByb3RvY29sIFtSRkM4NDQ2XSB1c2VzIFg1MDkgYW5kIFJh dyBQdWJsaWMgS2V5CiAgIGluIG9yZGVyIHRvIGF1dGhlbnRpY2F0ZSBzZXJ2ZXJzIGFuZCBjbGll bnRzLiAgVGhpcyBkb2N1bWVudAogICBkZXNjcmliZXMgdGhlIHVzZSBvZiBjZXJ0aWZpY2F0ZXMg c3BlY2lmaWVkIGVpdGhlciBieSB0aGUgSW5zdGl0dXRlCiAgIG9mIEVsZWN0cmljYWwgYW5kIEVs ZWN0cm9uaWNzIEVuZ2luZWVycyAoSUVFRSkgW0lFRUUxNjA5LjJdIG9yIHRoZQogICBFdXJvcGVh biBUZWxlY29tbXVuaWNhdGlvbnMgU3RhbmRhcmRzIEluc3RpdHV0ZSAoRVRTSSkgW1RTMTAzMDk3 XS4KICAgVGhlc2Ugc3RhbmRhcmRzIGFyZSBkZWZpbmVkIGluIG9yZGVyIHRvIHNlY3VyZSBjb21t dW5pY2F0aW9ucyBpbgogICB2ZWhpY3VsYXIgZW52aXJvbm1lbnRzLiAgRXhpc3RpbmcgYXV0aGVu dGljYXRpb24gbWV0aG9kcywgc3VjaCBhcwogICBYNTA5IGFuZCBSYXcgUHVibGljIEtleSwgYXJl IGRlc2lnbmVkIGZvciBJbnRlcm5ldCB1c2UsIHBhcnRpY3VsYXJseQogICBmb3IgZmxleGliaWxp dHkgYW5kIGV4dGVuc2liaWxpdHksIGFuZCBhcmUgbm90IG9wdGltaXplZCBmb3IKICAgYmFuZHdp ZHRoIGFuZCBwcm9jZXNzaW5nIHRpbWUgdG8gc3VwcG9ydCBkZWxheS1zZW5zaXRpdmUKICAgYXBw bGljYXRpb25zLiAgVGhpcyBpcyB3aHkgc2l6ZS1vcHRpbWl6ZWQgY2VydGlmaWNhdGVzIHRoYXQg bWVldCB0aGUKICAgSVRTIHJlcXVpcmVtZW50cyB3ZXJlIGRlc2lnbmVkIGFuZCBzdGFuZGFyZGl6 ZWQuCgogICBUd28gbmV3IHZhbHVlcyByZWZlcnJpbmcgdGhlIHByZXZpb3VzbHkgbWVudGlvbmVk IGNlcnRpZmljYXRlcyB3aWxsCiAgIGJlIGFkZGVkIHRvIHRoZSAiY2xpZW50X2NlcnRpZmljYXRl X3R5cGUiIGFuZCB0aGUKICAgInNlcnZlcl9jZXJ0aWZpY2F0ZV90eXBlIiBleHRlbnNpb25zIGRl ZmluZWQgaW4gW1JGQzcyNTBdLgoKCgpLYW1wYW5ha2lzICYgTXNhaGxpICAgICBFeHBpcmVzIEZl YnJ1YXJ5IDE5LCAyMDE5ICAgICAgICAgICAgICAgW1BhZ2UgMl0KDApJbnRlcm5ldC1EcmFmdCAg IElFRUUgYW5kIEVUU0kgQ2VydGlmaWNhdGUgVHlwZXMgZm9yIFRMUyAgICAgQXVndXN0IDIwMTgK CgoyLiAgUmVxdWlyZW1lbnRzIFRlcm1pbm9sb2d5CgogICBUaGUga2V5IHdvcmRzICJNVVNUIiwg Ik1VU1QgTk9UIiwgIlJFUVVJUkVEIiwgIlNIQUxMIiwgIlNIQUxMIE5PVCIsCiAgICJTSE9VTEQi LCAiU0hPVUxEIE5PVCIsICJSRUNPTU1FTkRFRCIsICJNQVkiLCBhbmQgIk9QVElPTkFMIiBpbiB0 aGlzCiAgIGRvY3VtZW50IGFyZSB0byBiZSBpbnRlcnByZXRlZCBhcyBkZXNjcmliZWQgaW4gW1JG QzIxMTldLgoKMy4gIEV4dGVuc2lvbiBPdmVydmlldwoKICAgVGhlIGV4dGVuc2lvbiBmb3JtYXQg Zm9yIGV4dGVuZGVkIENsaWVudCBIZWxsbyBhbmQgU2VydmVyIEhlbGxvIHVzZXMKICAgdGhlICJl eHRlbnNpb25fZGF0YSIgZmllbGQgb2YgdGhlICJDZXJ0aWZpY2F0ZV9UeXBlX0V4dGVuc2lvbiIK ICAgc3RydWN0dWUgZGVmaW5lZCBpbiBSRkM3MjUwLiAgVGhlIENlcnRpZmljYXRlVHlwZSBzdHJ1 Y3R1cmUgaXMgYW4KICAgZW51bSB3aXRoIHZhbHVlcyB0YWtlbiBmcm9tIHRoZSBUTFMgMS4zIENl cnRpZmljYXRlIFR5cGVzLiAgSW4gb3JkZXIKICAgdG8gbmVnb3RpYXRlIHRoZSBzdXBwb3J0IG9m IElFRUUgMTYwOS4yIG9yIEVUU0kgVFMgMTAzMDk3CiAgIGNlcnRpZmljYXRlLWJhc2VkIGF1dGhl bnRpY2F0aW9uLCB0aGUgY2xpZW50cyBhbmQgdGhlIHNlcnZlcnMgTUFZCiAgIGluY2x1ZGUgdGhl IGV4dGVuc2lvbiBvZiB0eXBlICJjbGllbnRfY2VydGlmaWNhdGVfdHlwZSIgYW5kCiAgICJzZXJ2 ZXJfY2VydGlmaWNhdGVfdHlwZSIgaW4gdGhlIGV4dGVuZGVkIGNsaWVudCBoZWxsbyBhbmQKICAg RW5jcnlwdGVkRXh0ZW5zaW9ucy4gIFRoZSBleHRlbnNpb25fZGF0YSIgZmllbGQgb2YgdGhpcyBl eHRlbnNpb24KICAgU0hBTEwgY29udGFpbiBhIGxpc3Qgb2Ygc3VwcG9ydGVkIGNlcnRpZmljYXRl IHR5cGVzIHByb3Bvc2VkIGJ5IHRoZQogICBjbGllbnQgYXMgcHJvdmlkZWQgaW4gZmlndXJlIGJl bG93OgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCkthbXBhbmFraXMgJiBNc2FobGkg ICAgIEV4cGlyZXMgRmVicnVhcnkgMTksIDIwMTkgICAgICAgICAgICAgICBbUGFnZSAzXQoMCklu dGVybmV0LURyYWZ0ICAgSUVFRSBhbmQgRVRTSSBDZXJ0aWZpY2F0ZSBUeXBlcyBmb3IgVExTICAg ICBBdWd1c3QgMjAxOAoKCiAgICAgLyogTWFuYWdlZCBieSBJQU5BICovCiAgICAgIGVudW0gewog ICAgICAgICAgWDUwOSgwKSwKICAgICAgICAgIFJhd1B1YmxpY0tleSgyKSwKICAgICAgICAgIDE2 MDlEb3QyKD8pLCAvKiBOdW1iZXIgMyB3aWxsIGJlIHJlcXVlc3RlZCBmb3IgMTYwOS4yICovCiAg ICAgICAgICAoMjU1KQogICAgICAgICAgMTAzMDk3KD8pLCAvKiBOdW1iZXIgNCB3aWxsIGJlIHJl cXVlc3RlZCBmb3IgMTAzMDk3ICovCiAgICAgICAgICAoMjU1KQogICAgICB9IENlcnRpZmljYXRl VHlwZTsKCiAgICAgIHN0cnVjdCB7CiAgICAgICAgICBzZWxlY3QgKGNlcnRpZmljYXRlX3R5cGUp IHsKCiAgICAgICAgICAgICAgIC8qICBjZXJ0aWZpY2F0ZSB0eXBlIGRlZmluZWQgaW4gdGhpcyBk b2N1bWVudC4qLwogICAgICAgICAgICAgICBjYXNlIDEwMzA5NzoKICAgICAgICAgICAgICAgb3Bh cXVlIGNlcnRfZGF0YTwxLi4yXjI0LTE+OwoKICAgICAgICAgICAgICAvKiBjZXJ0aWZpY2F0ZSB0 eXBlIGRlZmluZWQgaW4gdGhpcyBkb2N1bWVudC4qLwogICAgICAgICAgICAgICBjYXNlIDE2MDlE b3QyOgogICAgICAgICAgICAgICBvcGFxdWUgY2VydF9kYXRhPDEuLjJeMjQtMT47CgogICAgICAg ICAgICAgICAvKiBSYXdQdWJsaWNLZXkgZGVmaW5lZCBpbiBSRkMgNzI1MCovCiAgICAgICAgICAg ICAgY2FzZSBSYXdQdWJsaWNLZXk6CiAgICAgICAgICAgICAgb3BhcXVlIEFTTi4xX3N1YmplY3RQ dWJsaWNLZXlJbmZvPDEuLjJeMjQtMT47CgogICAgICAgICAgICAgIC8qIFguNTA5IGNlcnRpZmlj YXRlIGRlZmluZWQgaW4gUkZDIDUyNDYqLwogICAgICAgICAgICAgIGNhc2UgWC41MDk6CiAgICAg ICAgICAgICAgb3BhcXVlIGNlcnRfZGF0YTwxLi4yXjI0LTE+OwoKICAgICAgICAgICAgICAgfTsK CiAgICAgICAgICAgICBFeHRlbnNpb24gZXh0ZW5zaW9uczwwLi4yXjE2LTE+OwogICAgICAgICB9 IENlcnRpZmljYXRlRW50cnk7CgogICBJbiBjYXNlIHdoZXJlIFRMUyBzZXJ2ZXIgYWNjZXB0cyB0 aGUgZGVzY3JpYmVkIGV4dGVuc2lvbiwgaXQgc2VsZWN0cwogICBvbmUgb2YgdGhlIGNlcnRpZmlj YXRlIHR5cGVzIGluIHRoZSBleHRlbnNpb24gZGVzY3JpYmVkIGhlcmUuICBOb3RlCiAgIHRoYXQg YSBzZXJ2ZXIgTUFZIGF1dGhlbnRpY2F0ZSB0aGUgY2xpZW50IHVzaW5nIG90aGVyIGF1dGhlbnRp Y2F0aW9uCiAgIG1ldGhvZHMuICBUaGUgY2xpZW50IE1BWSBhdCBpdHMgZGlzY3JldGlvbiBlaXRo ZXIgY29udGludWUgdGhlCiAgIGhhbmRzaGFrZSwgb3IgcmVzcG9uZCB3aXRoIGEgZmF0YWwgbWVz c2FnZSBhbGVydC4KCiAgIFRoZSBlbmQtZW50aXR5IGNlcnRpZmljYXRlJ3MgcHVibGljIGtleSBo YXMgdG8gYmUgY29tcGF0aWJsZSB3aXRoIG9uZQogICBvZiB0aGUgY2VydGlmaWNhdGUgdHlwZXMg bGlzdGVkIGluIGV4dGVuc2lvbiBkZXNjcmliZWQgaGVyZS4KCiAgIFNlcnZlcnMgYXdhcmUgb2Yg dGhlIGV4dGVuc2lvbiBkZXNjcmliZWQgaGVyZSBidXQgbm90IHdpc2hpbmcgdG8gdXNlCiAgIGl0 LCBTSE9VTEQgZ3JhY2VmdWxseSBub3QgcHJvY2VlZCB3aXRoIHRoZSBuZWdvdGlhdGlvbi4KCgoK CgoKS2FtcGFuYWtpcyAmIE1zYWhsaSAgICAgRXhwaXJlcyBGZWJydWFyeSAxOSwgMjAxOSAgICAg ICAgICAgICAgIFtQYWdlIDRdCgwKSW50ZXJuZXQtRHJhZnQgICBJRUVFIGFuZCBFVFNJIENlcnRp ZmljYXRlIFR5cGVzIGZvciBUTFMgICAgIEF1Z3VzdCAyMDE4CgoKNC4gIE1lc3NhZ2UgRmxvdwoK ICAgVGhlICJjbGllbnRfY2VydGlmaWNhdGVfdHlwZSIgYW5kICJzZXJ2ZXJfY2VydGlmaWNhdGVf dHlwZSIgbWVzc2FnZXMKICAgTVVTVCBiZSBzZW50IGluIGhhbmRzaGFrZSBwaGFzZSBhcyBpbGx1 c3RyYXRlZCBpbiBGaWd1cmUgMSBiZWxvdy4KICAgVGhlIHJlcGx5IG9mIHRoZSBzZXJ2ZXIgTVVT VCBiZSBzZW50IGluIEVuY3J5cHRlZEV4dGVuc2lvbnMuCgogICBDbGllbnQgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgU2VydmVyCgogS2V5ICBeIENsaWVudEhlbGxv CiBFeGNoIHwgKyBzZXJ2ZXJfY2VydGlmaWNhdGVfdHlwZSoKICAgICAgfCArIGNsaWVudF9jZXJ0 aWZpY2F0ZV90eXBlKgogICAgICB8ICsga2V5X3NoYXJlKgogICAgICB2ICsgc2lnbmF0dXJlX2Fs Z29yaXRobXMqICAgICAgIC0tLS0tLS0tPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICBTZXJ2ZXJIZWxsbyAgXiBLZXkKICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICArIGtleV9zaGFyZSogIHYgRXhjaAogICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHtFbmNyeXB0ZWRFeHRlbnNpb25z fSAgXiBTZXJ2ZXIKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeysgc2VydmVy X2NlcnRpZmljYXRlX3R5cGUqfXwgUGFyYW1zCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgIHsrIGNsaWVudF9jZXJ0aWZpY2F0ZV90eXBlKn18CiAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAge0NlcnRpZmljYXRlUmVxdWVzdCp9ICB2CiAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHtDZXJ0aWZpY2F0ZSp9ICBeCiAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHtDZXJ0aWZpY2F0ZVZlcmlm eSp9ICB8IEF1dGgKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgIHtGaW5pc2hlZH0gIHYKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8LS0t LS0tLSAgIFtBcHBsaWNhdGlvbiBEYXRhKl0KICAgICAgXiB7Q2VydGlmaWNhdGUqfQogQXV0aCB8 IHtDZXJ0aWZpY2F0ZVZlcmlmeSp9CiAgICAgIHYge0ZpbmlzaGVkfSAgICAgICAgICAgICAgLS0t LS0tLS0+CiAgICAgICAgW0FwcGxpY2F0aW9uIERhdGFdICAgICAgPC0tLS0tLS0+ICAgW0FwcGxp Y2F0aW9uIERhdGFdCgogICAgICAgICAgICAgICArICBJbmRpY2F0ZXMgbm90ZXdvcnRoeSBleHRl bnNpb25zIHNlbnQgaW4gdGhlCiAgICAgICAgICAgICAgICAgIHByZXZpb3VzbHkgbm90ZWQgbWVz c2FnZS4KCiAgICAgICAgICAgICAgICogIEluZGljYXRlcyBvcHRpb25hbCBvciBzaXR1YXRpb24t ZGVwZW5kZW50CiAgICAgICAgICAgICAgICAgIG1lc3NhZ2VzL2V4dGVuc2lvbnMgdGhhdCBhcmUg bm90IGFsd2F5cyBzZW50LgoKICAgICAgICAgICAgICAge30gSW5kaWNhdGVzIG1lc3NhZ2VzIHBy b3RlY3RlZCB1c2luZyBrZXlzCiAgICAgICAgICAgICAgICAgIGRlcml2ZWQgZnJvbSBhIFtzZW5k ZXJdX2hhbmRzaGFrZV90cmFmZmljX3NlY3JldC4KCiAgICAgICAgICAgICAgIFtdIEluZGljYXRl cyBtZXNzYWdlcyBwcm90ZWN0ZWQgdXNpbmcga2V5cwogICAgICAgICAgICAgICAgICBkZXJpdmVk IGZyb20gW3NlbmRlcl1fYXBwbGljYXRpb25fdHJhZmZpY19zZWNyZXRfTi4KCgoKICAgIEZpZ3Vy ZSAxOiBNZXNzYWdlIEZsb3cgd2l0aCBjZXJ0aWZpY2F0ZSB0eXBlIGV4dGVuc2lvbiBmb3IgRnVs bCBUTFMKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDEuMyBIYW5kc2hha2UKCgoKCgoK CkthbXBhbmFraXMgJiBNc2FobGkgICAgIEV4cGlyZXMgRmVicnVhcnkgMTksIDIwMTkgICAgICAg ICAgICAgICBbUGFnZSA1XQoMCkludGVybmV0LURyYWZ0ICAgSUVFRSBhbmQgRVRTSSBDZXJ0aWZp Y2F0ZSBUeXBlcyBmb3IgVExTICAgICBBdWd1c3QgMjAxOAoKCjQuMS4gIENsaWVudCBIZWxsbwoK ICAgSW4gb3JkZXIgdG8gaW5kaWNhdGUgdGhlIHN1cHBvcnQgb2YgSUVFRSAxNjA5LjIgb3IgRVRT SSBUUyAxMDMwOTcKICAgY2VydGlmaWNhdGVzLCBjbGllbnQgTVVTVCBpbmNsdWRlIGFuIGV4dGVu c2lvbiBvZiB0eXBlCiAgICJjbGllbnRfY2VydGlmaWNhdGVfdHlwZSIgYW5kICJzZXJ2ZXJfY2Vy dGlmaWNhdGVfdHlwZSJ0byB0aGUKICAgZXh0ZW5kZWQgY2xpZW50IGhlbGxvIG1lc3NhZ2UuICBU aGUgaGVsbG8gZXh0ZW5zaW9uIG1lY2hhbmlzbSBpcwogICBkZXNjcmliZWQgaW4gU2VjdGlvbiA0 LjEuMiBvZiBUTFMgMS4zIFtSRkM4NDQ2XS4KCiAgIFRoZSBleHRlbnNpb24gJ2NsaWVudF9jZXJ0 aWZpY2F0ZV90eXBlJyBzZW50IGluIHRoZSBjbGllbnQgaGVsbG8gTUFZCiAgIGNhcnJ5IGEgbGlz dCBvZiBzdXBwb3J0ZWQgY2VydGlmaWNhdGUgdHlwZXMsIHNvcnRlZCBieSBjbGllbnQKICAgcHJl ZmVyZW5jZS4gIEl0IGlzIGEgbGlzdCBpbiB0aGUgY2FzZSB3aGVyZSB0aGUgY2xpZW50IHN1cHBv cnRzCiAgIG11bHRpcGxlIGNlcnRpZmljYXRlIHR5cGVzLgoKICAgQ2xpZW50IE1BWSByZXNwb25k IGFsb25nIHdpdGggc3VwcG9ydGVkIGNlcnRpZmljYXRlIGJ5IHNlbmRpbmcgYQogICAiQ2VydGlm aWNhdGUiIG1lc3NhZ2UgaW1tZWRpYXRlbHkgZm9sbG93ZWQgYnkgdGhlICJDZXRpZmljYXRlVmVy aWZ5IgogICBtZXNzYWdlLgoKNC4yLiAgU2VydmVyIEhlbGxvCgogICBXaGVuIHRoZSBzZXJ2ZXIg cmVjZWl2ZXMgdGhlIGNsaWVudCBoZWxsbyBjb250YWluaW5nIHRoZQogICBjbGllbnRfY2VydGlm aWNhdGVfdHlwZSBleHRlbnNpb24gYW5kL29yIHRoZSBzZXJ2ZXJfY2VydGlmaWNhdGVfdHlwZQog ICBleHRlbnNpb24uICBUaGUgZm9sbG93aW5nIG91dGNvbWVzIGFyZSBwb3NzaWJsZToKCiAgICAg IC0gVGhlIHNlcnZlciBzdXBwb3J0cyB0aGUgZXh0ZW5zaW9uIGRlc2NyaWJlZCBpbiB0aGlzIGRv Y3VtZW50LgogICAgICBJdCBzZWxlY3RzIGEgY2VydGlmaWNhdGUgdHlwZSBmcm9tIHRoZSBjbGll bnRfY2VydGlmaWNhdGVfdHlwZQogICAgICBmaWVsZCBpbiB0aGUgZXh0ZW5kZWQgQ2xpZW50IEhl bGxvIGFuZCBtdXN0IHRha2UgaW50byBhY2NvdW50IHRoZQogICAgICBjbGllbnQgYXV0aGVudGlj YXRpb24gbGlzdCBwcmlvcml0eS4KCiAgICAgIC0gVGhlIHNlcnZlciBkb2VzIG5vdCBzdXBwb3J0 IHRoZSBwcm9wb3NlZCBjZXJ0aWZpY2F0ZSB0eXBlIGFuZAogICAgICB0ZXJtaW5hdGVzIHRoZSBz ZXNzaW9uIHdpdGggYSBmYXRhbCBhbGVydCBvZiB0eXBlCiAgICAgICJ1bnN1cHBvcnRlZF9jZXJ0 aWZpY2F0ZSIuCgo1LiAgQ2VydGlmaWNhdGUgVmVyaWZpY2F0aW9uCgo1LjEuICBJRUVFIDE2MDku MiBjZXJ0aWZpY2F0ZXMKCiAgIFZlcmlmaWNhdGlvbiBvZiBhbiBJRUVFIDE2MDkuMiBjZXJ0aWZp Y2F0ZSBvciBjZXJ0aWZpY2F0ZSBjaGFpbiBpcwogICBkZXNjcmliZWQgaW4gc2VjdGlvbiA1LjUu MiBvZiBbSUVFRTE2MDkuMl0uCgo1LjIuICBFVFNJIFRTIDEwMyAwOTcgY2VydGlmaWNhdGVzCgog ICBWZXJpZmljYXRpb24gb2YgRVRTSSBUUyAxMDMgMDk3IGNlcnRpZmljYXRlIG9yIGNlcnRpZmlj YXRlIGNoYWluIGlzCiAgIGRlc2NyaWJlZCBpbiBbVFMxMDMwOTddLgoKCgoKCgoKCkthbXBhbmFr aXMgJiBNc2FobGkgICAgIEV4cGlyZXMgRmVicnVhcnkgMTksIDIwMTkgICAgICAgICAgICAgICBb UGFnZSA2XQoMCkludGVybmV0LURyYWZ0ICAgSUVFRSBhbmQgRVRTSSBDZXJ0aWZpY2F0ZSBUeXBl cyBmb3IgVExTICAgICBBdWd1c3QgMjAxOAoKCjYuICBFeGFtcGxlcwoKICAgU29tZSBvZiBleGNo YW5nZWQgbWVzc2FnZXMgZXhhbXBsZXMgYXJlIGlsbHVzdHJhdGVkIGluIEZpZ3VyZXMgMiBhbmQK ICAgMy4KCjYuMS4gIFRMUyBTZXJ2ZXIgYW5kIFRMUyBDbGllbnQgdXNlIHRoZSAxNjA5RG90MiBD ZXJ0aWZpY2F0ZQoKICAgVGhpcyBzZWN0aW9uIHNob3dzIGFuIGV4YW1wbGUgd2hlcmUgdGhlIFRM UyBjbGllbnQgYXMgd2VsbCBhcyB0aGUgVExTCiAgIHNlcnZlciB1c2UgdGhlIElFRUUgMTYwOS4y IGNlcnRpZmljYXRlLiAgSW4gY29uc2VxdWVuY2UsIGJvdGggdGhlCiAgIHNlcnZlciBhbmQgdGhl IGNsaWVudCBwb3B1bGF0ZSB0aGUgY2xpZW50X2NlcnRpZmljYXRlX3R5cGUgYW5kCiAgIHNlcnZl cl9jZXJ0aWZpY2F0ZV90eXBlIHdpdGggZXh0ZW5zaW9uIElFRUUgMTYwOS4yIGNlcnRpZmljYXRl cyBhcwogICBtZW50aW9uZWQgaW4gZmlndXJlIDIuCgogICAgICBDbGllbnQgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgU2VydmVyCgogICBDbGllbnRIZWxsbywKICAg Y2xpZW50X2NlcnRpZmljYXRlX3R5cGUqPTE2MDlEb3QyLAogICBzZXJ2ZXJfY2VydGlmaWNhdGVf dHlwZSo9MTYwOURvdDIsICAgLS0tLS0tLS0+ICAgICBTZXJ2ZXJIZWxsbywKICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAge0VuY3J5cHRlZEV4dGVuc2lvbnN9CiAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICB7Y2xpZW50X2NlcnRpZmljYXRlX3R5cGUqPTE2 MDlEb3QyfQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAge3NlcnZlcl9jZXJ0aWZpY2F0 ZV90eXBlKj0xNjA5RG90Mn0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAge0NlcnRpZmljYXRlUmVxdWVzdCp9CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICB7Q2VydGlmaWNhdGUqfQogICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAge0NlcnRpZmljYXRlVmVyaWZ5Kn0KICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB7RmluaXNoZWR9 CiAgICAge0NlcnRpZmljYXRlKn0gICAgICAgICAgIDwtLS0tLS0tICAgICAgICAgW0FwcGxpY2F0 aW9uIERhdGEqXQogICAgIHtDZXJ0aWZpY2F0ZVZlcmlmeSp9CiAgICAge0ZpbmlzaGVkfSAgICAg ICAgICAgICAgLS0tLS0tLS0+CiAgICAgW0FwcGxpY2F0aW9uIERhdGFdICAgICAgPC0tLS0tLS0+ ICAgICAgICAgIFtBcHBsaWNhdGlvbiBEYXRhXQoKCiAgICBGaWd1cmUgMjogVExTIENsaWVudCBh bmQgVExTIFNlcnZlciB1c2UgdGhlIElFRUUgMTYwOS4yIGNlcnRpZmljYXRlCgo2LjIuICBUTFMg U2VydmVyIHVzZXMgdGhlIElFRUUgMTYwOS4yIGNlcnRpZmljYXRlIGFuZCBUTFMgQ2xpZW50IHVz ZXMKICAgICAgdGhlIFggNTA5IGNlcnRpZmljYXRlCgogICBUaGlzIGV4YW1wbGUgc2hvd3MgdGhl IFRMUyBhdXRoZW50aWNhdGlvbiwgd2hlcmUgdGhlIFRMUyBjbGllbnQKICAgaW5kaWNhdGVzIGl0 cyBhYmlsaXR5IHRvIHJlY2VpdmUgYW5kIHRvIHZhbGlkYXRlIGFuIElFRUUgMTYwOS4yCiAgIGNl cnRpZmljYXRlIGZyb20gdGhlIHNlcnZlci4gIFRoZXJlZm9yZSwgdGhlIGNsaWVudCBwb3B1bGF0 ZXMgdGhlCiAgIHNlcnZlcl9jZXJ0aWZpY2F0ZV90eXBlIGV4dGVuc2lvbiB3aXRoIHRoZSBJRUVF IDE2MDkuMiBjZXJ0aWZpY2F0ZQogICB0eXBlIGFzIHByZXNlbnRlZCBpbiBmaWd1cmUgMy4KCgoK CgoKCgoKCkthbXBhbmFraXMgJiBNc2FobGkgICAgIEV4cGlyZXMgRmVicnVhcnkgMTksIDIwMTkg ICAgICAgICAgICAgICBbUGFnZSA3XQoMCkludGVybmV0LURyYWZ0ICAgSUVFRSBhbmQgRVRTSSBD ZXJ0aWZpY2F0ZSBUeXBlcyBmb3IgVExTICAgICBBdWd1c3QgMjAxOAoKCiAgICAgQ2xpZW50ICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFNlcnZlcgoKICAgQ2xpZW50 SGVsbG8sCiAgIGNsaWVudF9jZXJ0aWZpY2F0ZV90eXBlKj0oWC41MDkpLAogICBzZXJ2ZXJfY2Vy dGlmaWNhdGVfdHlwZSo9KDE2MDlEb3QyKSwgLS0tLS0tLT4gICAgU2VydmVySGVsbG8sCiAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB7RW5jcnlwdGVkRXh0ZW5zaW9u c30KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB7Y2xpZW50X2NlcnRpZmljYXRlX3R5 cGUqPVguNTA5fQogICAgICAgICAgICAgICAgICAgICAgICAgICAgIHtzZXJ2ZXJfY2VydGlmaWNh dGVfdHlwZSo9MTYwOURvdDJ9CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAge0NlcnRpZmljYXRlKn0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICB7Q2VydGlmaWNhdGVWZXJpZnkqfQogICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB7RmluaXNoZWR9CiAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICA8LS0tLS0tLS0tICAgIFtBcHBsaWNhdGlvbiBEYXRhKl0KICAge0Zp bmlzaGVkfSAgICAgICAgICAgICAgICAgIC0tLS0tLS0tLT4KICAgW0FwcGxpY2F0aW9uIERhdGFd ICAgICAgICAgIDwtLS0tLS0tLT4gICAgIFtBcHBsaWNhdGlvbiBEYXRhXQoKCiAgIEZpZ3VyZSAz OiBUTFMgU2VydmVyIHVzZXMgdGhlIElFRUUgMTYwOS4yIGNlcnRpZmljYXRlIGFuZCBUTFMgQ2xp ZW50CiAgICAgICAgICAgICAgICAgICAgICAgIHVzZXMgdGhlIFggNTA5IGNlcnRpZmljYXRlCgo2 LjMuICBUTFMgU2VydmVyIHVzZXMgdGhlIElFRUUgMTYwOS4yIGNlcnRpZmljYXRlIGFuZCBUTFMg Q2xpZW50IHVzZXMKICAgICAgdGhlIEVUU0kgVFMgMTAzMDk3IGNlcnRpZmljYXRlCgogICBUaGlz IHNlY3Rpb24gc2hvd3MgYW4gZXhhbXBsZSBjb21iaW5pbmcgYW4gSUVFRSAxNjA5LjIgY2VydGlm aWNhdGUKICAgYW5kIGFuIEVUU0kgVFMgMTAzMDk3IGNlcnRpZmljYXRlLiAgVGhlIGNsaWVudCB1 c2VzIHRoZSBFVFNJIFRTCiAgIDEwMzA5NyBjZXJ0aWZpY2F0ZSBmb3IgY2xpZW50IGF1dGhlbnRp Y2F0aW9uLCBhbmQgdGhlIHNlcnZlciBwcm92aWRlcwogICBhbiBJRUVFIDE2MDkuMiBjZXJ0aWZp Y2F0ZS4gIFRoaXMgZXhjaGFuZ2Ugc3RhcnRzIHdpdGggdGhlIGNsaWVudAogICBpbmRpY2F0aW5n IGl0cyBhYmlsaXR5IHRvIHByb2Nlc3MgYW4gSUVFRSAxNjA5LjIgY2VydGlmaWNhdGUgaWYKICAg cHJvdmlkZWQgYnkgdGhlIHNlcnZlci4gIEZvciBjbGllbnQgYXV0aGVudGljYXRpb24sIHRoZSBz ZXJ2ZXIKICAgaW5kaWNhdGVzIHRoYXQgaXQgaGFzIHNlbGVjdGVkIHRoZSBFVFNJIFRTIDEwMzA5 NyBmb3JtYXQgYW5kIHJlcXVlc3RzCiAgIHRoZSBjZXJ0aWZpY2F0ZSBmcm9tIHRoZSBjbGllbnQg YXMgcHJlc2VudGVkIGluIGZpZ3VyZSA0LgoKCgoKCgoKCgoKCgoKCgoKCgoKCgpLYW1wYW5ha2lz ICYgTXNhaGxpICAgICBFeHBpcmVzIEZlYnJ1YXJ5IDE5LCAyMDE5ICAgICAgICAgICAgICAgW1Bh Z2UgOF0KDApJbnRlcm5ldC1EcmFmdCAgIElFRUUgYW5kIEVUU0kgQ2VydGlmaWNhdGUgVHlwZXMg Zm9yIFRMUyAgICAgQXVndXN0IDIwMTgKCgogICAgIENsaWVudCAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICBTZXJ2ZXIKCiAgIENsaWVudEhlbGxvLAogICBjbGllbnRf Y2VydGlmaWNhdGVfdHlwZSo9KDEwMzA5NyksCiAgIHNlcnZlcl9jZXJ0aWZpY2F0ZV90eXBlKj0o MTYwOURvdDIpLCAtLS0tLS0tPiAgICBTZXJ2ZXJIZWxsbywKICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIHtFbmNyeXB0ZWRFeHRlbnNpb25zfQogICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAge2NsaWVudF9jZXJ0aWZpY2F0ZV90eXBlKj0xMDMwOTd9CiAgICAg ICAgICAgICAgICAgICAgICAgICAgICAge3NlcnZlcl9jZXJ0aWZpY2F0ZV90eXBlKj0xNjA5RG90 Mn0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB7Q2Vy dGlmaWNhdGUqfQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHtD ZXJ0aWZpY2F0ZVZlcmlmeSp9CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgIHtGaW5pc2hlZH0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg IDwtLS0tLS0tLS0gICAgW0FwcGxpY2F0aW9uIERhdGEqXQogICB7RmluaXNoZWR9ICAgICAgICAg ICAgICAgICAgLS0tLS0tLS0tPgogICBbQXBwbGljYXRpb24gRGF0YV0gICAgICAgICAgPC0tLS0t LS0tPiAgICAgW0FwcGxpY2F0aW9uIERhdGFdCgoKICAgRmlndXJlIDQ6IFRMUyBTZXJ2ZXIgdXNl cyB0aGUgSUVFRSAxNjA5LjIgY2VydGlmaWNhdGUgYW5kIFRMUyBDbGllbnQKICAgICAgICAgICAg ICAgICAgICB1c2VzIHRoZSBFVFNJIFRTIDEwMzA5NyBjZXJ0aWZpY2F0ZQoKNy4gIFNlY3VyaXR5 IENvbnNpZGVyYXRpb25zCgogICBUaGlzIHNlY3Rpb24gcHJvdmlkZXMgYW4gb3ZlcnZpZXcgb2Yg dGhlIGJhc2ljIHNlY3VyaXR5CiAgIGNvbnNpZGVyYXRpb25zIHdoaWNoIG5lZWQgdG8gYmUgdGFr ZW4gaW50byBhY2NvdW50IGJlZm9yZQogICBpbXBsZW1lbnRpbmcgdGhlIG5lY2Vzc2FyeSBzZWN1 cml0eSBtZWNoYW5pc21zLiAgVGhlIHNlY3VyaXR5CiAgIGNvbnNpZGVyYXRpb25zIGRlc2NyaWJl ZCB0aHJvdWdob3V0IFtSRkM4NDQ2XSBhcHBseSBoZXJlIGFzIHdlbGwuCgogICBGb3Igc2VjdXJp dHkgY29uc2lkZXJhdGlvbnMgaW4gYSB2ZWhpY3VsYXIgZW52aXJvbm1lbnQsIHRoZSBtaW5pbWFs CiAgIHVzZSBvZiBhbnkgVExTIGV4dGVuc2lvbnMgaXMgcmVjb21tZW5kZWQgc3VjaCBhcyA6Cgog ICBvICBUaGUgImNsaWVudF9jZXJ0aWZpY2F0ZV90eXBlIiBbSUFOQSB2YWx1ZSAxOV0gZXh0ZW5z aW9uIHdobydzCiAgICAgIHB1cnBvc2Ugd2FzIHByZXZpb3VzbHkgZGVzY3JpYmVkIGluIFtSRkM3 MjUwXS4KCiAgIG8gIFRoZSAic2VydmVyX2NlcnRpZmljYXRlX3R5cGUiIFtJQU5BIHZhbHVlIDIw XSBleHRlbnNpb24gd2hvJ3MKICAgICAgcHVycG9zZSB3YXMgcHJldmlvdXNseSBkZXNjcmliZWQg aW4gW1JGQzcyNTBdLgoKICAgbyAgVGhlICJTZXNzaW9uVGlja2V0IiBbSUFOQSB2YWx1ZSAzNV0g ZXh0ZW5zaW9uIGZvciBzZXNzaW9uCiAgICAgIHJlc3VtcHRpb24uCgo4LiAgUHJpdmFjeSBDb25z aWRlcmF0aW9ucwoKICAgRm9yIHByaXZhY3kgY29uc2lkZXJhdGlvbnMgaW4gYSB2ZWhpY3VsYXIg ZW52aXJvbm1lbnQgdGhlIHVzZSBvZiBFVFNJCiAgIFRTIDEwMzA5NyBhbmQgSUVFRSAxNjA5LjIg Y2VydGlmaWNhdGVzIGlzIHJlY29tbWVuZGVkIGZvciBtYW55CiAgIHJlYXNvbnM6CgogICAgICBJ biBvcmRlciB0byBhZGRyZXNzIHRoZSByaXNrIG9mIGEgcGVyc29uYWwgZGF0YSBsZWFrYWdlLCBt ZXNzYWdlcwogICAgICBleGNoYW5nZWQgZm9yIFYyViBjb21tdW5pY2F0aW9ucyBhcmUgc2lnbmVk IHVzaW5nIElFRUUgMTYwOS4yIGFuZAogICAgICBFVFNJIFRTIDEwMzA5NyBwc2V1ZG9ueW0gY2Vy dGlmaWNhdGVzCgoKCgpLYW1wYW5ha2lzICYgTXNhaGxpICAgICBFeHBpcmVzIEZlYnJ1YXJ5IDE5 LCAyMDE5ICAgICAgICAgICAgICAgW1BhZ2UgOV0KDApJbnRlcm5ldC1EcmFmdCAgIElFRUUgYW5k IEVUU0kgQ2VydGlmaWNhdGUgVHlwZXMgZm9yIFRMUyAgICAgQXVndXN0IDIwMTgKCgogICAgICBU aGUgcHVycG9zZSBvZiB0aGVzZSBjZXJ0aWZpY2F0ZXMgaXMgdG8gcHJvdmlkZSBwcml2YWN5IHJl bHlpbmcgb24KICAgICAgZ2VvZ3JhcGhpY2FsIGFuZC9vciB0ZW1wb3JhbCB2YWxpZGl0eSBjcml0 ZXJpYSwgYW5kIG1pbmltaXppbmcgdGhlCiAgICAgIGV4Y2hhbmdlIG9mIHByaXZhdGUgZGF0YQoK OS4gIElBTkEgQ29uc2lkZXJhdGlvbnMKCiAgIEV4aXN0aW5nIElBTkEgcmVmZXJlbmNlcyBoYXZl IG5vdCBiZWVuIHVwZGF0ZWQgeWV0IHRvIHBvaW50IHRvIHRoaXMKICAgZG9jdW1lbnQuCgogICBJ QU5BIGlzIGFza2VkIHRvIHJlZ2lzdGVyIHR3byBuZXcgdmFsdWVzIGluIHRoZSAiVExTIENlcnRp ZmljYXRlCiAgIFR5cGVzIiByZWdpc3RyeSBvZiBUcmFuc3BvcnQgTGF5ZXIgU2VjdXJpdHkgKFRM UykgRXh0ZW5zaW9ucyBbVExTLQogICBDZXJ0aWZpY2F0ZS1UeXBlcy1SZWdpc3RyeV0sIGFzIGZv bGxvd3M6CgogICBvICBWYWx1ZTogVEJEIERlc2NyaXB0aW9uOiAxNjA5RG90MiBSZWZlcmVuY2U6 IFtUSElTIFJGQ10KCiAgIG8gIFZhbHVlOiBUQkQgRGVzY3JpcHRpb246IDEwMzA5NyBSZWZlcmVu Y2U6IFtUSElTIFJGQ10KCjEwLiAgQWNrbm93bGVkZ2VtZW50cwoKICAgVGhpcyBkb2N1bWVudCBi b3Jyb3dzIGEgbG90IGZyb20KICAgW2RyYWZ0LXNlcmhyb3VjaG5pLXRscy1jZXJ0aWVlZTE2MDkt MDBdLiAgVGhlIGF1dGhvcnMgd2lzaCB0byB0aGFuawogICBFcmljIFJlc2NvbGEgYW5kIElsYXJp IExpdXN2YWFyYSBhbmQgV2lsbGlhbSBXaHl0ZSBmb3IgdGhlaXIgZmVlZGJhY2sKICAgYW5kIHN1 Z2dlc3Rpb25zIG9uIGltcHJvdmluZyB0aGlzIGRvY3VtZW50LiAgVGhhbmtzIGFyZSBkdWUgdG8g U2VhbgogICBUdXJuZXIgZm9yIGhpcyB2YWx1YWJsZSBhbmQgZGV0YWlsZWQgY29tbWVudHMuCgox MS4gIFJlZmVyZW5jZXMKCjExLjEuICBOb3JtYXRpdmUgUmVmZXJlbmNlcwoKICAgW0lFRUUxNjA5 LjJdCiAgICAgICAgICAgICAgSUVFRSwgIklFRUUgU3RhbmRhcmQgZm9yIFdpcmVsZXNzIEFjY2Vz cyBpbiBWZWhpY3VsYXIKICAgICAgICAgICAgICBFbnZpcm9ubWVudHMgLSBTZWN1cml0eSBTZXJ2 aWNlcyBmb3IgQXBwbGljYXRpb25zIGFuZAogICAgICAgICAgICAgIE1hbmFnZW1lbnQgTWVzc2Fn ZXMiLCAyMDE2LgoKICAgW1JGQzIxMTldICBCcmFkbmVyLCBTLiwgIktleSB3b3JkcyBmb3IgdXNl IGluIFJGQ3MgdG8gSW5kaWNhdGUKICAgICAgICAgICAgICBSZXF1aXJlbWVudCBMZXZlbHMiLCBN YXJjaCAxOTk3LgoKICAgW1JGQzQ0OTJdICBCbGFrZS1XaWxzb24sIFMuLCBCb2x5YXJkLCBOLiwg R3VwdGEsIFYuLCBIYXdrLCBDLiwgYW5kIEIuCiAgICAgICAgICAgICAgTW9lbGxlciwgIkVsbGlw dGljIEN1cnZlIENyeXB0b2dyYXBoeSAoRUNDKSBDaXBoZXIgU3VpdGVzCiAgICAgICAgICAgICAg Zm9yIFRyYW5zcG9ydCBMYXllciBTZWN1cml0eSAoVExTKSIsIE1heSAyMDA2LgoKICAgW1JGQzUy NDZdICBEaWVya3MsIFQuIGFuZCBFLiBSZXNjb3JsYSwgIlRoZSBUcmFuc3BvcnQgTGF5ZXIgU2Vj dXJpdHkKICAgICAgICAgICAgICAoVExTKSBQcm90b2NvbCBWZXJzaW9uIDEuMiIsIEF1Z3VzdCAy MDA4LgoKICAgW1JGQzU3NDZdICBSZXNjb3JsYSwgRS4sIFJheSwgTS4sIERpc3BlbnNhLCBTLiwg YW5kIE4uIE9za292LAogICAgICAgICAgICAgICJUcmFuc3BvcnQgTGF5ZXIgU2VjdXJpdHkgKFRM UykgUmVuZWdvdGlhdGlvbiBJbmRpY2F0aW9uCiAgICAgICAgICAgICAgRXh0ZW5zaW9uIiIsIEZl YnJ1YXJ5IDIwMTAuCgoKCgpLYW1wYW5ha2lzICYgTXNhaGxpICAgICBFeHBpcmVzIEZlYnJ1YXJ5 IDE5LCAyMDE5ICAgICAgICAgICAgICBbUGFnZSAxMF0KDApJbnRlcm5ldC1EcmFmdCAgIElFRUUg YW5kIEVUU0kgQ2VydGlmaWNhdGUgVHlwZXMgZm9yIFRMUyAgICAgQXVndXN0IDIwMTgKCgogICBb UkZDNzI1MF0gIFdvdXRlcnMsIFAuLCBUc2Nob2ZlbmlnLCBILiwgV2VpbGVyLCBTLiwgYW5kIFQu ICBLaXZpbmVuLAogICAgICAgICAgICAgICJVc2luZyBSYXcgUHVibGljIEtleXMgaW4gVHJhbnNw b3J0IExheWVyIFNlY3VyaXR5IChUTFMpCiAgICAgICAgICAgICAgYW5kIERhdGFncmFtIFRyYW5z cG9ydCBMYXllciBTZWN1cml0eSAoRFRMUykiLCBKdW5lIDIwMTQuCgogICBbUkZDODQ0Nl0gIFJl c2NvcmxhLCBFLiwgIlRoZSBUcmFuc3BvcnQgTGF5ZXIgU2VjdXJpdHkgKFRMUykgUHJvdG9jb2wK ICAgICAgICAgICAgICBWZXJzaW9uIDEuMyIsIEF1Z3VzdCAyMDE4LgoKICAgW1RTMTAzMDk3XQog ICAgICAgICAgICAgIEVUU0ksICJFVFNJIFRTIDEwMyAwOTcgdjEuMy4xICgyMDE3LTEwKTogSW50 ZWxsaWdlbnQKICAgICAgICAgICAgICBUcmFuc3BvcnQgU3lzdGVtcyAoSVRTKTsgU2VjdXJpdHk7 IFNlY3VyaXR5IGhlYWRlciBhbmQKICAgICAgICAgICAgICBjZXJ0aWZpY2F0ZSBmb3JtYXRzIiwg T2N0b2JlciAyMDE3LgoKMTEuMi4gIEluZm9ybWF0aXZlIFJlZmVyZW5jZXMKCiAgIFtkcmFmdC1z ZXJocm91Y2huaS10bHMtY2VydGllZWUxNjA5LTAwXQogICAgICAgICAgICAgIEtBSVNFUiwgQS4s IExBQklPRCwgSC4sIExPTkMsIEIuLCBNU0FITEksIE0uLCBhbmQgQS4KICAgICAgICAgICAgICBT RVJIUk9VQ0hOSSwgIlRyYW5zcG9ydCBMYXllciBTZWN1cml0eSAoVExTKQogICAgICAgICAgICAg IEF1dGhlbnRpY2F0aW9uIHVzaW5nIElUUyBFVFNJIGFuZCBJRUVFIGNlcnRpZmljYXRlcyIsCiAg ICAgICAgICAgICAgYXVndXN0IDIwMTcuCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoK S2FtcGFuYWtpcyAmIE1zYWhsaSAgICAgRXhwaXJlcyBGZWJydWFyeSAxOSwgMjAxOSAgICAgICAg ICAgICAgW1BhZ2UgMTFdCgwKSW50ZXJuZXQtRHJhZnQgICBJRUVFIGFuZCBFVFNJIENlcnRpZmlj YXRlIFR5cGVzIGZvciBUTFMgICAgIEF1Z3VzdCAyMDE4CgoKQXBwZW5kaXggQS4gIENvLUF1dGhv cnMKCiAgIG8gIE5hbmN5IENhbS1XaW5nZXQKICAgICAgQ0lTQ08sIFVTQQogICAgICBuY2Ftd2lu Z0BjaXNjby5jb20KCiAgIG8gIE1haWsgU2Vld2FsZAogICAgICBDSVNDTywgVVNBCiAgICAgIG1h c2Vld2FsQGNpc2NvLmNvbQoKICAgbyAgSG91ZGEgTGFiaW9kCiAgICAgIFRlbGVjb20gUGFyaXN0 ZWNoLCBGcmFuY2UKICAgICAgaG91ZGEubGFiaW9kQHRlbGVjb20tcGFyaXN0ZWNoLmZyCgogICBv ICBBaG1lZCBTZXJocm91Y2huaQogICAgICBUZWxlY29tIFBhcmlzVGVjaAogICAgICBhaG1lZC5z ZXJocm91Y2huaUB0ZWxlY29tLXBhcmlzdGVjaC5mcgoKQXV0aG9ycycgQWRkcmVzc2VzCgogICBQ YW5vcyBLYW1wYW5ha2lzIChlZGl0b3IpCiAgIENpc2NvCiAgIFVTQQoKICAgRU1haWw6IEVNYWls OiBwa2FtcGFuYUBjaXNjby5jb20KCgogICBNb3VuaXJhIE1zYWhsaSAoZWRpdG9yKQogICBUZWxl Y29tIFBhcmlzVGVjaAogICBGcmFuY2UKCiAgIEVNYWlsOiBtb3VuaXJhLm1zYWhsaUB0ZWxlY29t LXBhcmlzdGVjaC5mcgoKCgoKCgoKCgoKCgoKCgoKCgoKS2FtcGFuYWtpcyAmIE1zYWhsaSAgICAg RXhwaXJlcyBGZWJydWFyeSAxOSwgMjAxOSAgICAgICAgICAgICAgW1BhZ2UgMTJdCg== ------=_Part_3727152_1694833488.1535119783358-- From nobody Fri Aug 24 08:16:27 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 57B73130DC8 for ; Fri, 24 Aug 2018 08:16:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.91 X-Spam-Level: X-Spam-Status: No, score=-1.91 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, SPF_PASS=-0.001, T_DKIMWL_WL_MED=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=onboardsecurity-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id llOOxpvXpH_n for ; Fri, 24 Aug 2018 08:16:22 -0700 (PDT) Received: from mail-pl1-x643.google.com (mail-pl1-x643.google.com [IPv6:2607:f8b0:4864:20::643]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DB5B31286E3 for ; Fri, 24 Aug 2018 08:16:22 -0700 (PDT) Received: by mail-pl1-x643.google.com with SMTP id c6-v6so1226953pls.4 for ; Fri, 24 Aug 2018 08:16:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=onboardsecurity-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=Esmmtr2kNwi5+uMXKWJfm6HF7s6pedr48e8RgvUr4ZA=; b=tuilCvEgyRkG9Owjyl+4LdxHMucMkTukm2XHSmQ4vXz9Wd7mKtPNQoblbY1FUuF4Q6 9Bmtzp4XWrHCCmCAMXy6ZP4k+euDtgWVHfPXmr1rh+fFvopdh2GqxVodBxeJAT2/EyB5 31p+synF3H5g3wMP8Jvkj3mJd0dRMDsGsLkPxYKerYmpYpIGjFI4FxaxAtXhOyBFtRRp CQZDwKfTkusV8U1BzO5iFQZARu3Zfisi/Soww63ysYeIsWU9jCtOkIiMLN/eenmGW/dx OjOaS0Su3mgexnqunRi6u/fCdPyoVG1EihTXzd1sFLsyQ1dEX06IuzUZHIWqIu0S8Swn P+gw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=Esmmtr2kNwi5+uMXKWJfm6HF7s6pedr48e8RgvUr4ZA=; b=eAyJ9xaMv65ixUUDizaR6Hu0MecZxxLGDnqjNh8LG3L986Q0ge/yxu4a1+JT59DDej 6q1qJuz5BO/20YC+EZzRqe0dZj6OV8SeuBnnA6QhRcKcViC6MRTlMPmETL81b5fdBaDS W1e8jzZCjdQcZyXKe6NAvxkjNVtkxKSDweAA8Ezbf4yQx2paLLknXbpraOOOOAsMiCa8 9ayq3XS4WXyVW7TdcCx+0rgFMC334HXJNTpa/NnszrFox7sQgOmy+i4MpQ5mMnwvIRCq kIo77Y1Wru1pTcOeNHfmNLU3EhpYgzg3runt0uQ+oZ82Mn/60BRY+rtUnn1KQEK8jQ61 dVZw== X-Gm-Message-State: APzg51CA7FIyBWoOT2Tr/AV8onVzL55A20pEs4KPKqeMWCBD4O+SbGec 2+bdvv0mJ8WjDGfQK0qNZJmZKYt5jJFhucrvO5z9Fp7VWsM= X-Google-Smtp-Source: ANB0VdamYPOyfkspsgsH5zCKXV1IDWBLXIMLfYP8zCz9y4RDk2EgCRF2l9nUvfzhUGKBgIlgMWvrwPTSQu47qX4Q2Ms= X-Received: by 2002:a17:902:bb0c:: with SMTP id l12-v6mr2139167pls.5.1535123782231; Fri, 24 Aug 2018 08:16:22 -0700 (PDT) MIME-Version: 1.0 Received: by 2002:a17:90a:db0f:0:0:0:0 with HTTP; Fri, 24 Aug 2018 08:16:00 -0700 (PDT) In-Reply-To: <1231917830.3727154.1535119783361.JavaMail.zimbra@enst.fr> References: <1231917830.3727154.1535119783361.JavaMail.zimbra@enst.fr> From: William Whyte Date: Fri, 24 Aug 2018 11:16:00 -0400 Message-ID: To: Mounira Msahli Cc: tls Content-Type: multipart/alternative; boundary="000000000000b9fe3d05742fdb2b" Archived-At: Subject: Re: [TLS] TLS 1.3 Authentication using ETSI TS 103 097 and IEEE 1609.2 certificates X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Aug 2018 15:16:26 -0000 --000000000000b9fe3d05742fdb2b Content-Type: text/plain; charset="UTF-8" Hi all -- as editor of 1609.2 (and a contributor to 103 097) I'd like to recommend that the WG moves forward with consideration of this draft. There are a number of initiatives in the connected vehicle space that need TLS with 1609.2 certificates, and in particular ISO 21177, which is currently in ballot, assumes that TLS-with-1609.2 will be available shortly. I have some comments on the detail of the draft which I'll share with the editorial team, but regardless of how those comments are resolved I think this is an important document and we should try to process it quickly. Cheers, William On Fri, Aug 24, 2018 at 10:09 AM, Mounira Msahli < mounira.msahli@telecom-paristech.fr> wrote: > Hi all, > > > The draft: TLS 1.3 Authentication using IEEE 1609.2/ETSI TS 103097 > certificates is updated in accordance with TLS 1.3: > https://tools.ietf.org/html/draft-tls-certieee1609-01 > > This document describes the use of certificates specified by the Institute > of Electrical and Electronics Engineers IEEE1609.2 and the European > Telecommunications Standards > > Institute ETSI TS 103097. These standards are defined in order to secure > communications in vehicular environments. > > This extension is very useful and has become a pressing need for > (Vehicle-To-Internet(V2Internet), Vehicle-To-Cloud(V2Cloud),...). > > We are soliciting feedback from the WG on the draft. > > > > Kind Regards > Mounira > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > > -- PLEASE UPDATE YOUR ADDRESS BOOKS WITH MY NEW ADDRESS: wwhyte@onboardsecurity.com --000000000000b9fe3d05742fdb2b Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi all -- as editor of 1609.2 (and a contributor to 103 09= 7) I'd like to recommend that the WG moves forward with consideration o= f this draft. There are a number of initiatives in the connected vehicle sp= ace that need TLS with 1609.2 certificates, and in particular ISO 21177, wh= ich is currently in ballot, assumes that TLS-with-1609.2 will be available = shortly.

I have some comments on the detail of the draft= which I'll share with the editorial team, but regardless of how those = comments are resolved I think this is an important document and we should t= ry to process it quickly.

Cheers,

William

On Fri, Aug 24, 2018 at 10:09 AM, Mounira Msahli <mounira.msahli@telecom-paristech.fr> wrote:
Hi all,


The draft: TLS 1.3 Authentication using IEEE 1609.2/ETSI TS 103097 certific= ates is updated in accordance with TLS 1.3: htt= ps://tools.ietf.org/html/draft-tls-certieee1609-01

This document describes the use of certificates specified by the Institute = of Electrical and Electronics Engineers IEEE1609.2 and the European Telecom= munications Standards

Institute ETSI TS 103097. These standards are defined in order to secure co= mmunications in vehicular environments.

This extension is very useful and has become a pressing need for (Vehicle-T= o-Internet(V2Internet), Vehicle-To-Cloud(V2Cloud),...).

We are soliciting feedback from the WG on the draft.



Kind Regards
Mounira
___= ____________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls




--
=


PLEASE UPDATE YOUR ADDRESS BOOKS WITH MY NEW = ADDRESS: ww= hyte@onboardsecurity.com
--000000000000b9fe3d05742fdb2b-- From nobody Fri Aug 24 08:57:33 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1F46F127B92 for ; Fri, 24 Aug 2018 08:57:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AHPQgVPrcM4y for ; Fri, 24 Aug 2018 08:57:29 -0700 (PDT) Received: from welho-filter3.welho.com (welho-filter3.welho.com [83.102.41.25]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B709E127333 for ; Fri, 24 Aug 2018 08:57:29 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by welho-filter3.welho.com (Postfix) with ESMTP id B4F0EBF43; Fri, 24 Aug 2018 18:57:26 +0300 (EEST) X-Virus-Scanned: Debian amavisd-new at pp.htv.fi Received: from welho-smtp3.welho.com ([IPv6:::ffff:83.102.41.86]) by localhost (welho-filter3.welho.com [::ffff:83.102.41.25]) (amavisd-new, port 10024) with ESMTP id gSyNv7lSDYS7; Fri, 24 Aug 2018 18:57:24 +0300 (EEST) Received: from LK-Perkele-VII (87-92-19-27.bb.dnainternet.fi [87.92.19.27]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by welho-smtp3.welho.com (Postfix) with ESMTPSA id F32852320; Fri, 24 Aug 2018 18:50:38 +0300 (EEST) Date: Fri, 24 Aug 2018 18:50:38 +0300 From: Ilari Liusvaara To: Mounira Msahli Cc: tls Message-ID: <20180824155038.GA2743@LK-Perkele-VII> References: <1231917830.3727154.1535119783361.JavaMail.zimbra@enst.fr> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <1231917830.3727154.1535119783361.JavaMail.zimbra@enst.fr> User-Agent: Mutt/1.10.1 (2018-07-13) Sender: ilariliusvaara@welho.com Archived-At: Subject: Re: [TLS] TLS 1.3 Authentication using ETSI TS 103 097 and IEEE 1609.2 certificates X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Aug 2018 15:57:32 -0000 On Fri, Aug 24, 2018 at 04:09:43PM +0200, Mounira Msahli wrote: > Hi all, > > > The draft: TLS 1.3 Authentication using IEEE 1609.2/ETSI TS 103097 certificates is updated in accordance with TLS 1.3: https://tools.ietf.org/html/draft-tls-certieee1609-01 > > This document describes the use of certificates specified by the Institute of Electrical and Electronics Engineers IEEE1609.2 and the European Telecommunications Standards > > Institute ETSI TS 103097. These standards are defined in order to secure communications in vehicular environments. > > This extension is very useful and has become a pressing need for (Vehicle-To-Internet(V2Internet), Vehicle-To-Cloud(V2Cloud),...). > > We are soliciting feedback from the WG on the draft. Some quick comments: - I did not see requirements where to place the end-entity certificate anywhere. I think most TLS code outright assumes that the end-entity certificate is the first one. - More generally, I did not see it specified how the certificate chain is laid out to the individual certficate fields (it is fairly obvious, but should still be specified). - The examples could have multiple certificate types in ClientHello to more clearly show what is actually going on. - You should also specify use in TLS 1.2 in the same draft (or say that is prohibited). This is so one only needs one reference for the codepoint allocation. - I found the document quite hard to read due to various editorial issues. -Ilari From nobody Fri Aug 24 10:42:37 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DA088130DE4 for ; Fri, 24 Aug 2018 10:42:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=telecom-paristech.fr Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PvoCiGgEgr5n for ; Fri, 24 Aug 2018 10:42:32 -0700 (PDT) Received: from zproxy110.enst.fr (zproxy110.enst.fr [IPv6:2001:660:330f:2::c0]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 53711127333 for ; Fri, 24 Aug 2018 10:42:32 -0700 (PDT) Received: from localhost (localhost [IPv6:::1]) by zproxy110.enst.fr (Postfix) with ESMTP id 9B38882796; Fri, 24 Aug 2018 19:42:30 +0200 (CEST) Received: from zproxy110.enst.fr ([IPv6:::1]) by localhost (zproxy110.enst.fr [IPv6:::1]) (amavisd-new, port 10032) with ESMTP id 5E_GNYZ90jkd; Fri, 24 Aug 2018 19:42:29 +0200 (CEST) Received: from localhost (localhost [IPv6:::1]) by zproxy110.enst.fr (Postfix) with ESMTP id 9941881B27; Fri, 24 Aug 2018 19:42:29 +0200 (CEST) DKIM-Filter: OpenDKIM Filter v2.10.3 zproxy110.enst.fr 9941881B27 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=telecom-paristech.fr; s=A6AEC2EE-1106-11E5-B10E-D103FDDA8F2E; t=1535132549; bh=T7GFu3/k/rfJqNgyK6abcN/+93qO+xy/REyjiQKIYxk=; h=Date:From:To:Message-ID:MIME-Version; b=LaDE7g3RTTWSYPQFo1aHFlvVxiAHcf4yksDUQ43JDfqL2sRz0nqbZtH+1onCgoeej wxUL9hWF2/tYhM3Fz88MqaSlMB0slfw2NvgmOkrnx11Xee5BNWiu9Vxt/rf/w1dFc9 4mHkS6EyO3T7FnytrHoMNoeVqvPHAqxNZI1Y/gXw= X-Virus-Scanned: amavisd-new at zproxy110.enst.fr Received: from zproxy110.enst.fr ([IPv6:::1]) by localhost (zproxy110.enst.fr [IPv6:::1]) (amavisd-new, port 10026) with ESMTP id WRECezdw3lrm; Fri, 24 Aug 2018 19:42:29 +0200 (CEST) Received: from zmail112.enst.fr (zmail112.enst.fr [137.194.2.205]) by zproxy110.enst.fr (Postfix) with ESMTP id 6ED2B81AF1; Fri, 24 Aug 2018 19:42:29 +0200 (CEST) Date: Fri, 24 Aug 2018 19:42:29 +0200 (CEST) From: Mounira Msahli To: William Whyte Cc: tls Message-ID: <1994081510.3795870.1535132549297.JavaMail.zimbra@enst.fr> In-Reply-To: References: <1231917830.3727154.1535119783361.JavaMail.zimbra@enst.fr> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-Originating-IP: [2a01:cb04:8ec:c300:71c7:2522:342e:9eb2] X-Mailer: Zimbra 8.8.9_GA_3006 (ZimbraWebClient - FF61 (Win)/8.8.9_GA_3006) Thread-Topic: TLS 1.3 Authentication using ETSI TS 103 097 and IEEE 1609.2 certificates Thread-Index: jl+DQ28twCGwBer6oX3OpyyC16xlkA== Archived-At: Subject: Re: [TLS] TLS 1.3 Authentication using ETSI TS 103 097 and IEEE 1609.2 certificates X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Aug 2018 17:42:35 -0000 Hi William,=20 Thank you for these details.=20 And we welcome your comments .=20 Cheers=20 Mounira ----- Mail original ----- De: "William Whyte" =C3=80: "Mounira Msahli" Cc: "tls" Envoy=C3=A9: Vendredi 24 Ao=C3=BBt 2018 17:16:00 Objet: Re: [TLS] TLS 1.3 Authentication using ETSI TS 103 097 and IEEE 1609= .2 certificates Hi all -- as editor of 1609.2 (and a contributor to 103 097) I'd like to re= commend that the WG moves forward with consideration of this draft. There a= re a number of initiatives in the connected vehicle space that need TLS wit= h 1609.2 certificates, and in particular ISO 21177, which is currently in b= allot, assumes that TLS-with-1609.2 will be available shortly.=20 I have some comments on the detail of the draft which I'll share with the e= ditorial team, but regardless of how those comments are resolved I think th= is is an important document and we should try to process it quickly.=20 Cheers,=20 William=20 On Fri, Aug 24, 2018 at 10:09 AM, Mounira Msahli < [ mailto:mounira.msahli@= telecom-paristech.fr | mounira.msahli@telecom-paristech.fr ] > wrote:=20 Hi all,=20 The draft: TLS 1.3 Authentication using IEEE 1609.2/ETSI TS 103097 certific= ates is updated in accordance with TLS 1.3: [ https://tools.ietf.org/html/d= raft-tls-certieee1609-01 | https://tools.ietf.org/html/draft-tls-certieee16= 09-01 ]=20 This document describes the use of certificates specified by the Institute = of Electrical and Electronics Engineers IEEE1609.2 and the European Telecom= munications Standards=20 Institute ETSI TS 103097. These standards are defined in order to secure co= mmunications in vehicular environments.=20 This extension is very useful and has become a pressing need for (Vehicle-T= o-Internet(V2Internet), Vehicle-To-Cloud(V2Cloud),...).=20 We are soliciting feedback from the WG on the draft.=20 Kind Regards=20 Mounira=20 _______________________________________________=20 TLS mailing list=20 [ mailto:TLS@ietf.org | TLS@ietf.org ]=20 [ https://www.ietf.org/mailman/listinfo/tls | https://www.ietf.org/mailman/= listinfo/tls ]=20 --=20 PLEASE UPDATE YOUR ADDRESS BOOKS WITH MY NEW ADDRESS: [ mailto:wwhyte@onboa= rdsecurity.com | wwhyte@onboardsecurity.com ]=20 From nobody Fri Aug 24 10:44:44 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 91973130E19 for ; Fri, 24 Aug 2018 10:44:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=telecom-paristech.fr Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id A92UPfz_MT3Q for ; Fri, 24 Aug 2018 10:44:39 -0700 (PDT) Received: from zproxy130.enst.fr (zproxy130.enst.fr [IPv6:2001:660:330f:2::c2]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5B986130DE4 for ; Fri, 24 Aug 2018 10:44:39 -0700 (PDT) Received: from localhost (localhost [IPv6:::1]) by zproxy130.enst.fr (Postfix) with ESMTP id B949E120B58; Fri, 24 Aug 2018 19:44:37 +0200 (CEST) Received: from zproxy130.enst.fr ([IPv6:::1]) by localhost (zproxy130.enst.fr [IPv6:::1]) (amavisd-new, port 10032) with ESMTP id jZgrhApJh_qH; Fri, 24 Aug 2018 19:44:37 +0200 (CEST) Received: from localhost (localhost [IPv6:::1]) by zproxy130.enst.fr (Postfix) with ESMTP id 185F2120FD9; Fri, 24 Aug 2018 19:44:37 +0200 (CEST) DKIM-Filter: OpenDKIM Filter v2.10.3 zproxy130.enst.fr 185F2120FD9 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=telecom-paristech.fr; s=A6AEC2EE-1106-11E5-B10E-D103FDDA8F2E; t=1535132677; bh=4Qe+q5mJbYpCuA2cboe2v0nswAj154TpBh1lYWuE/2A=; h=Date:From:To:Message-ID:MIME-Version; b=YqOjzbaSenq2mKt/l6NvuDpukmjj1aSkIhMeDi0fl0Fl77yIlEHrmPaFKiqo2x/jf T1I7HugF2VciS417x5zoJYMfpD6bt29uEWU45qmzHIwxb+Bkf7iGb0Ka1agjrHnJXQ i7YgOTVwdnR+ViliIdv9g6FK/38T9VSdpn3aAXps= X-Virus-Scanned: amavisd-new at zproxy130.enst.fr Received: from zproxy130.enst.fr ([IPv6:::1]) by localhost (zproxy130.enst.fr [IPv6:::1]) (amavisd-new, port 10026) with ESMTP id LduMGX5z6jvE; Fri, 24 Aug 2018 19:44:37 +0200 (CEST) Received: from zmail112.enst.fr (zmail112.enst.fr [137.194.2.205]) by zproxy130.enst.fr (Postfix) with ESMTP id E839B120B58; Fri, 24 Aug 2018 19:44:36 +0200 (CEST) Date: Fri, 24 Aug 2018 19:44:36 +0200 (CEST) From: Mounira Msahli To: Ilari Liusvaara Cc: tls Message-ID: <1417403886.3796035.1535132676840.JavaMail.zimbra@enst.fr> In-Reply-To: <20180824155038.GA2743@LK-Perkele-VII> References: <1231917830.3727154.1535119783361.JavaMail.zimbra@enst.fr> <20180824155038.GA2743@LK-Perkele-VII> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-Originating-IP: [2a01:cb04:8ec:c300:71c7:2522:342e:9eb2] X-Mailer: Zimbra 8.8.9_GA_3006 (ZimbraWebClient - FF61 (Win)/8.8.9_GA_3006) Thread-Topic: TLS 1.3 Authentication using ETSI TS 103 097 and IEEE 1609.2 certificates Thread-Index: WRncpOGVZO4KxnrvwpMkJ71MCT00EA== Archived-At: Subject: Re: [TLS] TLS 1.3 Authentication using ETSI TS 103 097 and IEEE 1609.2 certificates X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Aug 2018 17:44:43 -0000 Thank you Ilari,=20 In response to your comments below:=20 - I did not see requirements where to place the end-entity certificate=20 anywhere. I think most TLS code outright assumes that the end-entity=20 certificate is the first one.=20 >>> We will add it. - More generally, I did not see it specified how the certificate chain=20 is laid out to the individual certficate fields (it is fairly=20 obvious, but should still be specified).=20 >>> We will specify it.=20 - The examples could have multiple certificate types in ClientHello to=20 more clearly show what is actually going on.=20 >>> We will add examples with multiple certificate types in Client Hello=20 - You should also specify use in TLS 1.2 in the same draft (or say that=20 is prohibited). This is so one only needs one reference for the=20 codepoint allocation.=20 >>> It is not prohibited, for TLS 1.2 the extension is already specified: [= https://tools.ietf.org/html/draft-serhrouchni-tls-certieee1609-01 ]=20 [ https://tools.ietf.org/html/draft-serhrouchni-tls-certieee1609-01 | https= ://tools.ietf.org/html/draft-serhrouchni-tls-certieee1609-01 ]=20 We will update the draft=20 - I found the document quite hard to read due to various editorial=20 issues.=20 >> We will update the draft=20 Kind Regards=20 Mounira ----- Mail original ----- De: "Ilari Liusvaara" =C3=80: "Mounira Msahli" Cc: "tls" Envoy=C3=A9: Vendredi 24 Ao=C3=BBt 2018 17:50:38 Objet: Re: [TLS] TLS 1.3 Authentication using ETSI TS 103 097 and IEEE 1609= .2 certificates On Fri, Aug 24, 2018 at 04:09:43PM +0200, Mounira Msahli wrote:=20 > Hi all,=20 >=20 >=20 > The draft: TLS 1.3 Authentication using IEEE 1609.2/ETSI TS 103097 certif= icates is updated in accordance with TLS 1.3: https://tools.ietf.org/html/d= raft-tls-certieee1609-01=20 >=20 > This document describes the use of certificates specified by the Institut= e of Electrical and Electronics Engineers IEEE1609.2 and the European Telec= ommunications Standards=20 >=20 > Institute ETSI TS 103097. These standards are defined in order to secure = communications in vehicular environments.=20 >=20 > This extension is very useful and has become a pressing need for (Vehicle= -To-Internet(V2Internet), Vehicle-To-Cloud(V2Cloud),...).=20 >=20 > We are soliciting feedback from the WG on the draft.=20 Some quick comments:=20 - I did not see requirements where to place the end-entity certificate=20 anywhere. I think most TLS code outright assumes that the end-entity=20 certificate is the first one.=20 - More generally, I did not see it specified how the certificate chain=20 is laid out to the individual certficate fields (it is fairly=20 obvious, but should still be specified).=20 - The examples could have multiple certificate types in ClientHello to=20 more clearly show what is actually going on.=20 - You should also specify use in TLS 1.2 in the same draft (or say that=20 is prohibited). This is so one only needs one reference for the=20 codepoint allocation.=20 - I found the document quite hard to read due to various editorial=20 issues.=20 -Ilari=20 From nobody Sun Aug 26 18:44:39 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 68C96128CF2 for ; Sun, 26 Aug 2018 18:44:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dZ7fE40TyaKE for ; Sun, 26 Aug 2018 18:44:35 -0700 (PDT) Received: from huawei.com (lhrrgout.huawei.com [185.176.76.210]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BE82B1277C8 for ; Sun, 26 Aug 2018 18:44:35 -0700 (PDT) Received: from lhreml703-cah.china.huawei.com (unknown [172.18.7.107]) by Forcepoint Email with ESMTP id 0F05ED989DFF0 for ; Mon, 27 Aug 2018 02:44:32 +0100 (IST) Received: from SINEML703-CAH.china.huawei.com (10.223.161.53) by lhreml703-cah.china.huawei.com (10.201.108.44) with Microsoft SMTP Server (TLS) id 14.3.399.0; Mon, 27 Aug 2018 02:44:32 +0100 Received: from SINEML521-MBS.china.huawei.com ([169.254.2.159]) by SINEML703-CAH.china.huawei.com ([10.223.161.53]) with mapi id 14.03.0399.000; Mon, 27 Aug 2018 09:44:29 +0800 From: Wang Haiguang To: Mounira Msahli , Ilari Liusvaara CC: tls Thread-Topic: TLS 1.3 Authentication using ETSI TS 103 097 and IEEE 1609.2 certificates Thread-Index: AQHUO9I4lhe0zAWxK0ehYga4eko23aTS1pDw Date: Mon, 27 Aug 2018 01:44:28 +0000 Message-ID: <0AE05CBFB1A6A0468C8581DAE58A31309E0F34A4@SINEML521-MBS.china.huawei.com> References: <1231917830.3727154.1535119783361.JavaMail.zimbra@enst.fr> <20180824155038.GA2743@LK-Perkele-VII> <1417403886.3796035.1535132676840.JavaMail.zimbra@enst.fr> In-Reply-To: <1417403886.3796035.1535132676840.JavaMail.zimbra@enst.fr> Accept-Language: en-SG, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.215.22.72] Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-CFilter-Loop: Reflected Archived-At: Subject: Re: [TLS] TLS 1.3 Authentication using ETSI TS 103 097 and IEEE 1609.2 certificates X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Aug 2018 01:44:37 -0000 SGksIE1vdW5pcmENCg0KSnVzdCBmb3IgY2xhcmlmaWNhdGlvbi4gDQoNCklmIEkgYW0gbm90IHdy b25nLCB0aGVyZSBhcmUgdHdvIHR5cGVzIG9mIGNlcnRpZmljYXRlcyBzdXBwb3J0ZWQgYnkgMTYw OS4yLiBPbmUgaXMgdGhlIGxlZ2FjeSBYLjUwOSBjZXJ0aWZpY2F0ZSwgdGhlIG90aGVyIGlzIHRo ZSBpbXBsaWNpdCBjZXJ0aWZpY2F0ZS4gDQoNClNvIGZvciB5b3UgZHJhZnQgc3VibWl0dGVkLCB5 b3UgcGxhbiBzdXBwb3J0IGJvdGggdHlwZXMgb2YgY2VydGlmaWNhdGVzIG9yIGp1c3Qgb25lIG9m IHRoZW0sIGkuZS4gdGhlIFguNTA5IGNlcnRpZmljYXRlLiANCg0KQmVzdCByZWdhcmRzLg0KDQpI YWlndWFuZw0KDQotLS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0tLQ0KRnJvbTogVExTIFttYWlsdG86 dGxzLWJvdW5jZXNAaWV0Zi5vcmddIE9uIEJlaGFsZiBPZiBNb3VuaXJhIE1zYWhsaQ0KU2VudDog U2F0dXJkYXksIEF1Z3VzdCAyNSwgMjAxOCAxOjQ1IEFNDQpUbzogSWxhcmkgTGl1c3ZhYXJhIDxp bGFyaWxpdXN2YWFyYUB3ZWxoby5jb20+DQpDYzogdGxzIDx0bHNAaWV0Zi5vcmc+DQpTdWJqZWN0 OiBSZTogW1RMU10gVExTIDEuMyBBdXRoZW50aWNhdGlvbiB1c2luZyBFVFNJIFRTIDEwMyAwOTcg YW5kIElFRUUgMTYwOS4yIGNlcnRpZmljYXRlcw0KDQoNClRoYW5rIHlvdSBJbGFyaSwgDQoNCg0K SW4gcmVzcG9uc2UgdG8geW91ciBjb21tZW50cyBiZWxvdzogDQoNCi0gSSBkaWQgbm90IHNlZSBy ZXF1aXJlbWVudHMgd2hlcmUgdG8gcGxhY2UgdGhlIGVuZC1lbnRpdHkgY2VydGlmaWNhdGUgYW55 d2hlcmUuIEkgdGhpbmsgbW9zdCBUTFMgY29kZSBvdXRyaWdodCBhc3N1bWVzIHRoYXQgdGhlIGVu ZC1lbnRpdHkgY2VydGlmaWNhdGUgaXMgdGhlIGZpcnN0IG9uZS4gDQoNCj4+PiBXZSB3aWxsIGFk ZCBpdC4NCg0KLSBNb3JlIGdlbmVyYWxseSwgSSBkaWQgbm90IHNlZSBpdCBzcGVjaWZpZWQgaG93 IHRoZSBjZXJ0aWZpY2F0ZSBjaGFpbiBpcyBsYWlkIG91dCB0byB0aGUgaW5kaXZpZHVhbCBjZXJ0 ZmljYXRlIGZpZWxkcyAoaXQgaXMgZmFpcmx5IG9idmlvdXMsIGJ1dCBzaG91bGQgc3RpbGwgYmUg c3BlY2lmaWVkKS4gDQo+Pj4gV2Ugd2lsbCBzcGVjaWZ5IGl0LiANCg0KLSBUaGUgZXhhbXBsZXMg Y291bGQgaGF2ZSBtdWx0aXBsZSBjZXJ0aWZpY2F0ZSB0eXBlcyBpbiBDbGllbnRIZWxsbyB0byBt b3JlIGNsZWFybHkgc2hvdyB3aGF0IGlzIGFjdHVhbGx5IGdvaW5nIG9uLiANCj4+PiBXZSB3aWxs IGFkZCBleGFtcGxlcyB3aXRoIG11bHRpcGxlIGNlcnRpZmljYXRlIHR5cGVzIGluIENsaWVudCBI ZWxsbw0KDQotIFlvdSBzaG91bGQgYWxzbyBzcGVjaWZ5IHVzZSBpbiBUTFMgMS4yIGluIHRoZSBz YW1lIGRyYWZ0IChvciBzYXkgdGhhdCANCmlzIHByb2hpYml0ZWQpLiBUaGlzIGlzIHNvIG9uZSBv bmx5IG5lZWRzIG9uZSByZWZlcmVuY2UgZm9yIHRoZSANCmNvZGVwb2ludCBhbGxvY2F0aW9uLiAN Cg0KPj4+IEl0IGlzIG5vdCBwcm9oaWJpdGVkLCBmb3IgVExTIDEuMiB0aGUgZXh0ZW5zaW9uIGlz IGFscmVhZHkgc3BlY2lmaWVkOiBbIGh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1z ZXJocm91Y2huaS10bHMtY2VydGllZWUxNjA5LTAxIF0gDQpbIGh0dHBzOi8vdG9vbHMuaWV0Zi5v cmcvaHRtbC9kcmFmdC1zZXJocm91Y2huaS10bHMtY2VydGllZWUxNjA5LTAxIHwgaHR0cHM6Ly90 b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LXNlcmhyb3VjaG5pLXRscy1jZXJ0aWVlZTE2MDktMDEg XSANCldlIHdpbGwgdXBkYXRlIHRoZSBkcmFmdCANCg0KLSBJIGZvdW5kIHRoZSBkb2N1bWVudCBx dWl0ZSBoYXJkIHRvIHJlYWQgZHVlIHRvIHZhcmlvdXMgZWRpdG9yaWFsIA0KaXNzdWVzLiANCj4+ IFdlIHdpbGwgdXBkYXRlIHRoZSBkcmFmdCANCg0KDQpLaW5kIFJlZ2FyZHMgDQpNb3VuaXJhDQoN Ci0tLS0tIE1haWwgb3JpZ2luYWwgLS0tLS0NCkRlOiAiSWxhcmkgTGl1c3ZhYXJhIiA8aWxhcmls aXVzdmFhcmFAd2VsaG8uY29tPg0Kw4A6ICJNb3VuaXJhIE1zYWhsaSIgPG1vdW5pcmEubXNhaGxp QHRlbGVjb20tcGFyaXN0ZWNoLmZyPg0KQ2M6ICJ0bHMiIDx0bHNAaWV0Zi5vcmc+DQpFbnZvecOp OiBWZW5kcmVkaSAyNCBBb8O7dCAyMDE4IDE3OjUwOjM4DQpPYmpldDogUmU6IFtUTFNdIFRMUyAx LjMgQXV0aGVudGljYXRpb24gdXNpbmcgRVRTSSBUUyAxMDMgMDk3IGFuZCBJRUVFIDE2MDkuMiBj ZXJ0aWZpY2F0ZXMNCg0KT24gRnJpLCBBdWcgMjQsIDIwMTggYXQgMDQ6MDk6NDNQTSArMDIwMCwg TW91bmlyYSBNc2FobGkgd3JvdGU6IA0KPiBIaSBhbGwsIA0KPiANCj4gDQo+IFRoZSBkcmFmdDog VExTIDEuMyBBdXRoZW50aWNhdGlvbiB1c2luZyBJRUVFIDE2MDkuMi9FVFNJIFRTIDEwMzA5NyBj ZXJ0aWZpY2F0ZXMgaXMgdXBkYXRlZCBpbiBhY2NvcmRhbmNlIHdpdGggVExTIDEuMzogaHR0cHM6 Ly90b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LXRscy1jZXJ0aWVlZTE2MDktMDEgDQo+IA0KPiBU aGlzIGRvY3VtZW50IGRlc2NyaWJlcyB0aGUgdXNlIG9mIGNlcnRpZmljYXRlcyBzcGVjaWZpZWQg YnkgdGhlIEluc3RpdHV0ZSBvZiBFbGVjdHJpY2FsIGFuZCBFbGVjdHJvbmljcyBFbmdpbmVlcnMg SUVFRTE2MDkuMiBhbmQgdGhlIEV1cm9wZWFuIFRlbGVjb21tdW5pY2F0aW9ucyBTdGFuZGFyZHMg DQo+IA0KPiBJbnN0aXR1dGUgRVRTSSBUUyAxMDMwOTcuIFRoZXNlIHN0YW5kYXJkcyBhcmUgZGVm aW5lZCBpbiBvcmRlciB0byBzZWN1cmUgY29tbXVuaWNhdGlvbnMgaW4gdmVoaWN1bGFyIGVudmly b25tZW50cy4gDQo+IA0KPiBUaGlzIGV4dGVuc2lvbiBpcyB2ZXJ5IHVzZWZ1bCBhbmQgaGFzIGJl Y29tZSBhIHByZXNzaW5nIG5lZWQgZm9yIChWZWhpY2xlLVRvLUludGVybmV0KFYySW50ZXJuZXQp LCBWZWhpY2xlLVRvLUNsb3VkKFYyQ2xvdWQpLC4uLikuIA0KPiANCj4gV2UgYXJlIHNvbGljaXRp bmcgZmVlZGJhY2sgZnJvbSB0aGUgV0cgb24gdGhlIGRyYWZ0LiANCg0KU29tZSBxdWljayBjb21t ZW50czogDQoNCi0gSSBkaWQgbm90IHNlZSByZXF1aXJlbWVudHMgd2hlcmUgdG8gcGxhY2UgdGhl IGVuZC1lbnRpdHkgY2VydGlmaWNhdGUgDQphbnl3aGVyZS4gSSB0aGluayBtb3N0IFRMUyBjb2Rl IG91dHJpZ2h0IGFzc3VtZXMgdGhhdCB0aGUgZW5kLWVudGl0eSANCmNlcnRpZmljYXRlIGlzIHRo ZSBmaXJzdCBvbmUuIA0KLSBNb3JlIGdlbmVyYWxseSwgSSBkaWQgbm90IHNlZSBpdCBzcGVjaWZp ZWQgaG93IHRoZSBjZXJ0aWZpY2F0ZSBjaGFpbiANCmlzIGxhaWQgb3V0IHRvIHRoZSBpbmRpdmlk dWFsIGNlcnRmaWNhdGUgZmllbGRzIChpdCBpcyBmYWlybHkgDQpvYnZpb3VzLCBidXQgc2hvdWxk IHN0aWxsIGJlIHNwZWNpZmllZCkuIA0KLSBUaGUgZXhhbXBsZXMgY291bGQgaGF2ZSBtdWx0aXBs ZSBjZXJ0aWZpY2F0ZSB0eXBlcyBpbiBDbGllbnRIZWxsbyB0byANCm1vcmUgY2xlYXJseSBzaG93 IHdoYXQgaXMgYWN0dWFsbHkgZ29pbmcgb24uIA0KLSBZb3Ugc2hvdWxkIGFsc28gc3BlY2lmeSB1 c2UgaW4gVExTIDEuMiBpbiB0aGUgc2FtZSBkcmFmdCAob3Igc2F5IHRoYXQgDQppcyBwcm9oaWJp dGVkKS4gVGhpcyBpcyBzbyBvbmUgb25seSBuZWVkcyBvbmUgcmVmZXJlbmNlIGZvciB0aGUgDQpj b2RlcG9pbnQgYWxsb2NhdGlvbi4gDQotIEkgZm91bmQgdGhlIGRvY3VtZW50IHF1aXRlIGhhcmQg dG8gcmVhZCBkdWUgdG8gdmFyaW91cyBlZGl0b3JpYWwgDQppc3N1ZXMuIA0KDQoNCi1JbGFyaSAN Cg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NClRMUyBt YWlsaW5nIGxpc3QNClRMU0BpZXRmLm9yZw0KaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9s aXN0aW5mby90bHMNCg== From nobody Mon Aug 27 01:31:41 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 47FEC130E7B for ; Mon, 27 Aug 2018 01:31:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=telecom-paristech.fr Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lF_Rwe8KAoBN for ; Mon, 27 Aug 2018 01:31:36 -0700 (PDT) Received: from zproxy120.enst.fr (zproxy120.enst.fr [137.194.2.193]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CFAB1128C65 for ; Mon, 27 Aug 2018 01:31:35 -0700 (PDT) Received: from localhost (localhost [IPv6:::1]) by zproxy120.enst.fr (Postfix) with ESMTP id 6523A80DEF; Mon, 27 Aug 2018 10:31:33 +0200 (CEST) Received: from zproxy120.enst.fr ([IPv6:::1]) by localhost (zproxy120.enst.fr [IPv6:::1]) (amavisd-new, port 10032) with ESMTP id kThLrBqYr04x; Mon, 27 Aug 2018 10:31:32 +0200 (CEST) Received: from localhost (localhost [IPv6:::1]) by zproxy120.enst.fr (Postfix) with ESMTP id C4B038153B; Mon, 27 Aug 2018 10:31:32 +0200 (CEST) DKIM-Filter: OpenDKIM Filter v2.10.3 zproxy120.enst.fr C4B038153B DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=telecom-paristech.fr; s=A6AEC2EE-1106-11E5-B10E-D103FDDA8F2E; t=1535358692; bh=s5bz4TgA81wuXNQ3GmHylW4pBVRXAIuMIJY/AMTU6as=; h=Date:From:To:Message-ID:MIME-Version; b=pPE6slDC2i5RENc/C6KvYmNdajEp7PTM9zv8f40t3BoGEP+2fFTMM3CacilAUJZ9m lYo9NzrZrJEXpO9ylSdvJMDTkHE6UmwFe2UzO5hsswmKh5GMaRziiaUq2QfFAgLwyo 905QA8WcyWID/aMEV2kD7LCM0Et1QYfqOefaiOR4= X-Virus-Scanned: amavisd-new at zproxy120.enst.fr Received: from zproxy120.enst.fr ([IPv6:::1]) by localhost (zproxy120.enst.fr [IPv6:::1]) (amavisd-new, port 10026) with ESMTP id iK60ZNA4Ecxj; Mon, 27 Aug 2018 10:31:32 +0200 (CEST) Received: from zmail112.enst.fr (zmail112.enst.fr [137.194.2.205]) by zproxy120.enst.fr (Postfix) with ESMTP id 9797D80E02; Mon, 27 Aug 2018 10:31:32 +0200 (CEST) Date: Mon, 27 Aug 2018 10:31:32 +0200 (CEST) From: Mounira Msahli To: Wang Haiguang Cc: Ilari Liusvaara , tls Message-ID: <1766398978.255182.1535358692070.JavaMail.zimbra@enst.fr> In-Reply-To: <0AE05CBFB1A6A0468C8581DAE58A31309E0F34A4@SINEML521-MBS.china.huawei.com> References: <1231917830.3727154.1535119783361.JavaMail.zimbra@enst.fr> <20180824155038.GA2743@LK-Perkele-VII> <1417403886.3796035.1535132676840.JavaMail.zimbra@enst.fr> <0AE05CBFB1A6A0468C8581DAE58A31309E0F34A4@SINEML521-MBS.china.huawei.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-Originating-IP: [::ffff:137.194.205.118] X-Mailer: Zimbra 8.8.9_GA_3019 (ZimbraWebClient - FF61 (Linux)/8.8.9_GA_3019) Thread-Topic: TLS 1.3 Authentication using ETSI TS 103 097 and IEEE 1609.2 certificates Thread-Index: AQHUO9I4lhe0zAWxK0ehYga4eko23aTS1pDwYjJkqBY= Archived-At: Subject: Re: [TLS] TLS 1.3 Authentication using ETSI TS 103 097 and IEEE 1609.2 certificates X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Aug 2018 08:31:38 -0000 Hi Wang,=20 The purpose of the draft is to extend TLS 1.3 to support IEEE 1609.2/ETSI T= S 103 097 certificates for authentication in addition to X.509 certificate = and raw public keys. Kind Regards=20 Mounira=20 ----- Mail original ----- De: "Wang Haiguang" =C3=80: "Mounira Msahli" , "Ilari Lius= vaara" Cc: "tls" Envoy=C3=A9: Lundi 27 Ao=C3=BBt 2018 03:44:28 Objet: RE: TLS 1.3 Authentication using ETSI TS 103 097 and IEEE 1609.2 cer= tificates Hi, Mounira=20 Just for clarification.=20 If I am not wrong, there are two types of certificates supported by 1609.2.= One is the legacy X.509 certificate, the other is the implicit certificate= .=20 So for you draft submitted, you plan support both types of certificates or = just one of them, i.e. the X.509 certificate.=20 Best regards.=20 Haiguang=20 -----Original Message-----=20 From: TLS [mailto:tls-bounces@ietf.org] On Behalf Of Mounira Msahli=20 Sent: Saturday, August 25, 2018 1:45 AM=20 To: Ilari Liusvaara =20 Cc: tls =20 Subject: Re: [TLS] TLS 1.3 Authentication using ETSI TS 103 097 and IEEE 16= 09.2 certificates=20 Thank you Ilari,=20 In response to your comments below:=20 - I did not see requirements where to place the end-entity certificate anyw= here. I think most TLS code outright assumes that the end-entity certificat= e is the first one.=20 >>> We will add it.=20 - More generally, I did not see it specified how the certificate chain is l= aid out to the individual certficate fields (it is fairly obvious, but shou= ld still be specified).=20 >>> We will specify it.=20 - The examples could have multiple certificate types in ClientHello to more= clearly show what is actually going on.=20 >>> We will add examples with multiple certificate types in Client Hello=20 - You should also specify use in TLS 1.2 in the same draft (or say that=20 is prohibited). This is so one only needs one reference for the=20 codepoint allocation.=20 >>> It is not prohibited, for TLS 1.2 the extension is already specified: [= https://tools.ietf.org/html/draft-serhrouchni-tls-certieee1609-01 ]=20 [ https://tools.ietf.org/html/draft-serhrouchni-tls-certieee1609-01 | https= ://tools.ietf.org/html/draft-serhrouchni-tls-certieee1609-01 ]=20 We will update the draft=20 - I found the document quite hard to read due to various editorial=20 issues.=20 >> We will update the draft=20 Kind Regards=20 Mounira=20 ----- Mail original -----=20 De: "Ilari Liusvaara" =20 =C3=80: "Mounira Msahli" =20 Cc: "tls" =20 Envoy=C3=A9: Vendredi 24 Ao=C3=BBt 2018 17:50:38=20 Objet: Re: [TLS] TLS 1.3 Authentication using ETSI TS 103 097 and IEEE 1609= .2 certificates=20 On Fri, Aug 24, 2018 at 04:09:43PM +0200, Mounira Msahli wrote:=20 > Hi all,=20 >=20 >=20 > The draft: TLS 1.3 Authentication using IEEE 1609.2/ETSI TS 103097 certif= icates is updated in accordance with TLS 1.3: https://tools.ietf.org/html/d= raft-tls-certieee1609-01=20 >=20 > This document describes the use of certificates specified by the Institut= e of Electrical and Electronics Engineers IEEE1609.2 and the European Telec= ommunications Standards=20 >=20 > Institute ETSI TS 103097. These standards are defined in order to secure = communications in vehicular environments.=20 >=20 > This extension is very useful and has become a pressing need for (Vehicle= -To-Internet(V2Internet), Vehicle-To-Cloud(V2Cloud),...).=20 >=20 > We are soliciting feedback from the WG on the draft.=20 Some quick comments:=20 - I did not see requirements where to place the end-entity certificate=20 anywhere. I think most TLS code outright assumes that the end-entity=20 certificate is the first one.=20 - More generally, I did not see it specified how the certificate chain=20 is laid out to the individual certficate fields (it is fairly=20 obvious, but should still be specified).=20 - The examples could have multiple certificate types in ClientHello to=20 more clearly show what is actually going on.=20 - You should also specify use in TLS 1.2 in the same draft (or say that=20 is prohibited). This is so one only needs one reference for the=20 codepoint allocation.=20 - I found the document quite hard to read due to various editorial=20 issues.=20 -Ilari=20 _______________________________________________=20 TLS mailing list=20 TLS@ietf.org=20 https://www.ietf.org/mailman/listinfo/tls=20 From nobody Mon Aug 27 01:43:13 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 31BB0130E80 for ; Mon, 27 Aug 2018 01:43:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FY9Bcy1P2FKQ for ; Mon, 27 Aug 2018 01:43:09 -0700 (PDT) Received: from huawei.com (lhrrgout.huawei.com [185.176.76.210]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C1737128C65 for ; Mon, 27 Aug 2018 01:43:08 -0700 (PDT) Received: from lhreml704-cah.china.huawei.com (unknown [172.18.7.107]) by Forcepoint Email with ESMTP id 674821A48271 for ; Mon, 27 Aug 2018 09:43:04 +0100 (IST) Received: from SINEML705-CAH.china.huawei.com (10.223.161.55) by lhreml704-cah.china.huawei.com (10.201.108.45) with Microsoft SMTP Server (TLS) id 14.3.399.0; Mon, 27 Aug 2018 09:43:05 +0100 Received: from SINEML521-MBS.china.huawei.com ([169.254.2.159]) by SINEML705-CAH.china.huawei.com ([10.223.161.55]) with mapi id 14.03.0399.000; Mon, 27 Aug 2018 16:43:03 +0800 From: Wang Haiguang To: tls Thread-Topic: TLS 1.3 Authentication using ETSI TS 103 097 and IEEE 1609.2 certificates Thread-Index: AQHUO9I4lhe0zAWxK0ehYga4eko23aTS1pDwYjJkqBb87uIUIA== Date: Mon, 27 Aug 2018 08:43:02 +0000 Message-ID: <0AE05CBFB1A6A0468C8581DAE58A31309E0F6993@SINEML521-MBS.china.huawei.com> References: <1231917830.3727154.1535119783361.JavaMail.zimbra@enst.fr> <20180824155038.GA2743@LK-Perkele-VII> <1417403886.3796035.1535132676840.JavaMail.zimbra@enst.fr> <0AE05CBFB1A6A0468C8581DAE58A31309E0F34A4@SINEML521-MBS.china.huawei.com> <1766398978.255182.1535358692070.JavaMail.zimbra@enst.fr> In-Reply-To: <1766398978.255182.1535358692070.JavaMail.zimbra@enst.fr> Accept-Language: en-SG, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.215.22.72] Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-CFilter-Loop: Reflected Archived-At: Subject: Re: [TLS] TLS 1.3 Authentication using ETSI TS 103 097 and IEEE 1609.2 certificates X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Aug 2018 08:43:11 -0000 SGksIE1vdW5pcmENCg0KVGhhbmtzIGZvciB0aGUgY2xhcmlmaWNhdGlvbi4gVGhhdCBtZWFucyBi b3RoIGV4cGxpY2l0IGFuZCBpbXBsaWNpdCBjZXJ0aWZpY2F0ZXMgd2lsbCBiZSBzdXBwb3J0ZWQu IA0KDQpSZWdhcmRzLg0KDQpIYWlndWFuZw0KDQotLS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0tLQ0K RnJvbTogTW91bmlyYSBNc2FobGkgW21haWx0bzptb3VuaXJhLm1zYWhsaUB0ZWxlY29tLXBhcmlz dGVjaC5mcl0gDQpTZW50OiBNb25kYXksIEF1Z3VzdCAyNywgMjAxOCA0OjMyIFBNDQpUbzogV2Fu ZyBIYWlndWFuZyA8d2FuZy5oYWlndWFuZy5zaGllbGRsYWJAaHVhd2VpLmNvbT4NCkNjOiBJbGFy aSBMaXVzdmFhcmEgPGlsYXJpbGl1c3ZhYXJhQHdlbGhvLmNvbT47IHRscyA8dGxzQGlldGYub3Jn Pg0KU3ViamVjdDogUmU6IFRMUyAxLjMgQXV0aGVudGljYXRpb24gdXNpbmcgRVRTSSBUUyAxMDMg MDk3IGFuZCBJRUVFIDE2MDkuMiBjZXJ0aWZpY2F0ZXMNCg0KSGkgV2FuZywgDQoNClRoZSBwdXJw b3NlIG9mIHRoZSBkcmFmdCBpcyB0byBleHRlbmQgVExTIDEuMyB0byBzdXBwb3J0IElFRUUgMTYw OS4yL0VUU0kgVFMgMTAzIDA5NyBjZXJ0aWZpY2F0ZXMgZm9yIGF1dGhlbnRpY2F0aW9uIGluIGFk ZGl0aW9uIHRvIFguNTA5IGNlcnRpZmljYXRlIGFuZCByYXcgcHVibGljIGtleXMuDQoNCktpbmQg UmVnYXJkcyANCk1vdW5pcmEgDQoNCg0KDQotLS0tLSBNYWlsIG9yaWdpbmFsIC0tLS0tDQpEZTog IldhbmcgSGFpZ3VhbmciIDx3YW5nLmhhaWd1YW5nLnNoaWVsZGxhYkBodWF3ZWkuY29tPg0Kw4A6 ICJNb3VuaXJhIE1zYWhsaSIgPG1vdW5pcmEubXNhaGxpQHRlbGVjb20tcGFyaXN0ZWNoLmZyPiwg IklsYXJpIExpdXN2YWFyYSIgPGlsYXJpbGl1c3ZhYXJhQHdlbGhvLmNvbT4NCkNjOiAidGxzIiA8 dGxzQGlldGYub3JnPg0KRW52b3nDqTogTHVuZGkgMjcgQW/Du3QgMjAxOCAwMzo0NDoyOA0KT2Jq ZXQ6IFJFOiBUTFMgMS4zIEF1dGhlbnRpY2F0aW9uIHVzaW5nIEVUU0kgVFMgMTAzIDA5NyBhbmQg SUVFRSAxNjA5LjIgY2VydGlmaWNhdGVzDQoNCkhpLCBNb3VuaXJhIA0KDQpKdXN0IGZvciBjbGFy aWZpY2F0aW9uLiANCg0KSWYgSSBhbSBub3Qgd3JvbmcsIHRoZXJlIGFyZSB0d28gdHlwZXMgb2Yg Y2VydGlmaWNhdGVzIHN1cHBvcnRlZCBieSAxNjA5LjIuIE9uZSBpcyB0aGUgbGVnYWN5IFguNTA5 IGNlcnRpZmljYXRlLCB0aGUgb3RoZXIgaXMgdGhlIGltcGxpY2l0IGNlcnRpZmljYXRlLiANCg0K U28gZm9yIHlvdSBkcmFmdCBzdWJtaXR0ZWQsIHlvdSBwbGFuIHN1cHBvcnQgYm90aCB0eXBlcyBv ZiBjZXJ0aWZpY2F0ZXMgb3IganVzdCBvbmUgb2YgdGhlbSwgaS5lLiB0aGUgWC41MDkgY2VydGlm aWNhdGUuIA0KDQpCZXN0IHJlZ2FyZHMuIA0KDQpIYWlndWFuZyANCg0KLS0tLS1PcmlnaW5hbCBN ZXNzYWdlLS0tLS0gDQpGcm9tOiBUTFMgW21haWx0bzp0bHMtYm91bmNlc0BpZXRmLm9yZ10gT24g QmVoYWxmIE9mIE1vdW5pcmEgTXNhaGxpIA0KU2VudDogU2F0dXJkYXksIEF1Z3VzdCAyNSwgMjAx OCAxOjQ1IEFNIA0KVG86IElsYXJpIExpdXN2YWFyYSA8aWxhcmlsaXVzdmFhcmFAd2VsaG8uY29t PiANCkNjOiB0bHMgPHRsc0BpZXRmLm9yZz4gDQpTdWJqZWN0OiBSZTogW1RMU10gVExTIDEuMyBB dXRoZW50aWNhdGlvbiB1c2luZyBFVFNJIFRTIDEwMyAwOTcgYW5kIElFRUUgMTYwOS4yIGNlcnRp ZmljYXRlcyANCg0KDQpUaGFuayB5b3UgSWxhcmksIA0KDQoNCkluIHJlc3BvbnNlIHRvIHlvdXIg Y29tbWVudHMgYmVsb3c6IA0KDQotIEkgZGlkIG5vdCBzZWUgcmVxdWlyZW1lbnRzIHdoZXJlIHRv IHBsYWNlIHRoZSBlbmQtZW50aXR5IGNlcnRpZmljYXRlIGFueXdoZXJlLiBJIHRoaW5rIG1vc3Qg VExTIGNvZGUgb3V0cmlnaHQgYXNzdW1lcyB0aGF0IHRoZSBlbmQtZW50aXR5IGNlcnRpZmljYXRl IGlzIHRoZSBmaXJzdCBvbmUuIA0KDQo+Pj4gV2Ugd2lsbCBhZGQgaXQuIA0KDQotIE1vcmUgZ2Vu ZXJhbGx5LCBJIGRpZCBub3Qgc2VlIGl0IHNwZWNpZmllZCBob3cgdGhlIGNlcnRpZmljYXRlIGNo YWluIGlzIGxhaWQgb3V0IHRvIHRoZSBpbmRpdmlkdWFsIGNlcnRmaWNhdGUgZmllbGRzIChpdCBp cyBmYWlybHkgb2J2aW91cywgYnV0IHNob3VsZCBzdGlsbCBiZSBzcGVjaWZpZWQpLiANCj4+PiBX ZSB3aWxsIHNwZWNpZnkgaXQuIA0KDQotIFRoZSBleGFtcGxlcyBjb3VsZCBoYXZlIG11bHRpcGxl IGNlcnRpZmljYXRlIHR5cGVzIGluIENsaWVudEhlbGxvIHRvIG1vcmUgY2xlYXJseSBzaG93IHdo YXQgaXMgYWN0dWFsbHkgZ29pbmcgb24uIA0KPj4+IFdlIHdpbGwgYWRkIGV4YW1wbGVzIHdpdGgg bXVsdGlwbGUgY2VydGlmaWNhdGUgdHlwZXMgaW4gQ2xpZW50IEhlbGxvIA0KDQotIFlvdSBzaG91 bGQgYWxzbyBzcGVjaWZ5IHVzZSBpbiBUTFMgMS4yIGluIHRoZSBzYW1lIGRyYWZ0IChvciBzYXkg dGhhdCANCmlzIHByb2hpYml0ZWQpLiBUaGlzIGlzIHNvIG9uZSBvbmx5IG5lZWRzIG9uZSByZWZl cmVuY2UgZm9yIHRoZSANCmNvZGVwb2ludCBhbGxvY2F0aW9uLiANCg0KPj4+IEl0IGlzIG5vdCBw cm9oaWJpdGVkLCBmb3IgVExTIDEuMiB0aGUgZXh0ZW5zaW9uIGlzIGFscmVhZHkgc3BlY2lmaWVk OiBbIGh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1zZXJocm91Y2huaS10bHMtY2Vy dGllZWUxNjA5LTAxIF0gDQpbIGh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1zZXJo cm91Y2huaS10bHMtY2VydGllZWUxNjA5LTAxIHwgaHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1s L2RyYWZ0LXNlcmhyb3VjaG5pLXRscy1jZXJ0aWVlZTE2MDktMDEgXSANCldlIHdpbGwgdXBkYXRl IHRoZSBkcmFmdCANCg0KLSBJIGZvdW5kIHRoZSBkb2N1bWVudCBxdWl0ZSBoYXJkIHRvIHJlYWQg ZHVlIHRvIHZhcmlvdXMgZWRpdG9yaWFsIA0KaXNzdWVzLiANCj4+IFdlIHdpbGwgdXBkYXRlIHRo ZSBkcmFmdCANCg0KDQpLaW5kIFJlZ2FyZHMgDQpNb3VuaXJhIA0KDQotLS0tLSBNYWlsIG9yaWdp bmFsIC0tLS0tIA0KRGU6ICJJbGFyaSBMaXVzdmFhcmEiIDxpbGFyaWxpdXN2YWFyYUB3ZWxoby5j b20+IA0Kw4A6ICJNb3VuaXJhIE1zYWhsaSIgPG1vdW5pcmEubXNhaGxpQHRlbGVjb20tcGFyaXN0 ZWNoLmZyPiANCkNjOiAidGxzIiA8dGxzQGlldGYub3JnPiANCkVudm95w6k6IFZlbmRyZWRpIDI0 IEFvw7t0IDIwMTggMTc6NTA6MzggDQpPYmpldDogUmU6IFtUTFNdIFRMUyAxLjMgQXV0aGVudGlj YXRpb24gdXNpbmcgRVRTSSBUUyAxMDMgMDk3IGFuZCBJRUVFIDE2MDkuMiBjZXJ0aWZpY2F0ZXMg DQoNCk9uIEZyaSwgQXVnIDI0LCAyMDE4IGF0IDA0OjA5OjQzUE0gKzAyMDAsIE1vdW5pcmEgTXNh aGxpIHdyb3RlOiANCj4gSGkgYWxsLCANCj4gDQo+IA0KPiBUaGUgZHJhZnQ6IFRMUyAxLjMgQXV0 aGVudGljYXRpb24gdXNpbmcgSUVFRSAxNjA5LjIvRVRTSSBUUyAxMDMwOTcgY2VydGlmaWNhdGVz IGlzIHVwZGF0ZWQgaW4gYWNjb3JkYW5jZSB3aXRoIFRMUyAxLjM6IGh0dHBzOi8vdG9vbHMuaWV0 Zi5vcmcvaHRtbC9kcmFmdC10bHMtY2VydGllZWUxNjA5LTAxIA0KPiANCj4gVGhpcyBkb2N1bWVu dCBkZXNjcmliZXMgdGhlIHVzZSBvZiBjZXJ0aWZpY2F0ZXMgc3BlY2lmaWVkIGJ5IHRoZSBJbnN0 aXR1dGUgb2YgRWxlY3RyaWNhbCBhbmQgRWxlY3Ryb25pY3MgRW5naW5lZXJzIElFRUUxNjA5LjIg YW5kIHRoZSBFdXJvcGVhbiBUZWxlY29tbXVuaWNhdGlvbnMgU3RhbmRhcmRzIA0KPiANCj4gSW5z dGl0dXRlIEVUU0kgVFMgMTAzMDk3LiBUaGVzZSBzdGFuZGFyZHMgYXJlIGRlZmluZWQgaW4gb3Jk ZXIgdG8gc2VjdXJlIGNvbW11bmljYXRpb25zIGluIHZlaGljdWxhciBlbnZpcm9ubWVudHMuIA0K PiANCj4gVGhpcyBleHRlbnNpb24gaXMgdmVyeSB1c2VmdWwgYW5kIGhhcyBiZWNvbWUgYSBwcmVz c2luZyBuZWVkIGZvciAoVmVoaWNsZS1Uby1JbnRlcm5ldChWMkludGVybmV0KSwgVmVoaWNsZS1U by1DbG91ZChWMkNsb3VkKSwuLi4pLiANCj4gDQo+IFdlIGFyZSBzb2xpY2l0aW5nIGZlZWRiYWNr IGZyb20gdGhlIFdHIG9uIHRoZSBkcmFmdC4gDQoNClNvbWUgcXVpY2sgY29tbWVudHM6IA0KDQot IEkgZGlkIG5vdCBzZWUgcmVxdWlyZW1lbnRzIHdoZXJlIHRvIHBsYWNlIHRoZSBlbmQtZW50aXR5 IGNlcnRpZmljYXRlIA0KYW55d2hlcmUuIEkgdGhpbmsgbW9zdCBUTFMgY29kZSBvdXRyaWdodCBh c3N1bWVzIHRoYXQgdGhlIGVuZC1lbnRpdHkgDQpjZXJ0aWZpY2F0ZSBpcyB0aGUgZmlyc3Qgb25l LiANCi0gTW9yZSBnZW5lcmFsbHksIEkgZGlkIG5vdCBzZWUgaXQgc3BlY2lmaWVkIGhvdyB0aGUg Y2VydGlmaWNhdGUgY2hhaW4gDQppcyBsYWlkIG91dCB0byB0aGUgaW5kaXZpZHVhbCBjZXJ0Zmlj YXRlIGZpZWxkcyAoaXQgaXMgZmFpcmx5IA0Kb2J2aW91cywgYnV0IHNob3VsZCBzdGlsbCBiZSBz cGVjaWZpZWQpLiANCi0gVGhlIGV4YW1wbGVzIGNvdWxkIGhhdmUgbXVsdGlwbGUgY2VydGlmaWNh dGUgdHlwZXMgaW4gQ2xpZW50SGVsbG8gdG8gDQptb3JlIGNsZWFybHkgc2hvdyB3aGF0IGlzIGFj dHVhbGx5IGdvaW5nIG9uLiANCi0gWW91IHNob3VsZCBhbHNvIHNwZWNpZnkgdXNlIGluIFRMUyAx LjIgaW4gdGhlIHNhbWUgZHJhZnQgKG9yIHNheSB0aGF0IA0KaXMgcHJvaGliaXRlZCkuIFRoaXMg aXMgc28gb25lIG9ubHkgbmVlZHMgb25lIHJlZmVyZW5jZSBmb3IgdGhlIA0KY29kZXBvaW50IGFs bG9jYXRpb24uIA0KLSBJIGZvdW5kIHRoZSBkb2N1bWVudCBxdWl0ZSBoYXJkIHRvIHJlYWQgZHVl IHRvIHZhcmlvdXMgZWRpdG9yaWFsIA0KaXNzdWVzLiANCg0KDQotSWxhcmkgDQoNCl9fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fIA0KVExTIG1haWxpbmcgbGlz dCANClRMU0BpZXRmLm9yZyANCmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8v dGxzIA0KDQo= From nobody Mon Aug 27 04:09:56 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 07BF5130E9F for ; Mon, 27 Aug 2018 04:09:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.91 X-Spam-Level: X-Spam-Status: No, score=-1.91 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_DKIMWL_WL_MED=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=onboardsecurity-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id prFqspJYS2Aq for ; Mon, 27 Aug 2018 04:09:51 -0700 (PDT) Received: from mail-pf1-x441.google.com (mail-pf1-x441.google.com [IPv6:2607:f8b0:4864:20::441]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9821112F1A6 for ; Mon, 27 Aug 2018 04:09:51 -0700 (PDT) Received: by mail-pf1-x441.google.com with SMTP id l9-v6so7587714pff.9 for ; Mon, 27 Aug 2018 04:09:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=onboardsecurity-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=mcinVb2YM/b3gdQLiharcWsmAli2FkeCQBuhOlz7qTQ=; b=dG0cy0taP67J5oGxJJc+WSHSUIUIaVH2psbeJ3KReMh7PK6kL4namdDrbOz6siYGPv g8inVQ5xxcFOh7RI0SSvTcGm6rJhKFVqgnoSofM4yxNw+IymGAP80PjWnAXj3vCDC/CZ my/KAISaqfsExazjMte4DWWsIsk05UYknkBw/un+wT0nOYnCKgYKHLuaK5pNhmhSsYCv glYfa/5Xh8ya1LTlisFAB58AqHPDp0/28iRm37lDssat9sAcVu+28sxgmdVEKK3yey3Z VP8Vp6C3M9+oS6iQ24qh7Mb0tp+AoCm3wMGhgKzjTdQBJGxD+b0I6bVy90zItp1NDIM8 98Dw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=mcinVb2YM/b3gdQLiharcWsmAli2FkeCQBuhOlz7qTQ=; b=s3+EnGyB9fQZhD9Kfm8ZJbzkE06llSMHvxtJPJpWkKP0QBSyty495/myMhTmad01xW 69trkjN5Ir8rNJF1QnjkbTaUTxkHNx2pN/5V1IfhjUdMtpOYJSPW+YvAgDrXih1zzsjF sFSYtPlTRO5HDTpiiCbOtkyQhDwFn2IBAL3jvX8KRBG600pDK0alSaZ38FPlM42FoDgZ aYVql/lk3LIBC9NGJGNYqA4ELH8vS2JaWSeiESa/HekUE8jnLSV4tHHEpb62hmy2ThK+ 4Q7wn1PYMd+4wBBB1tEucOdm8sC8ACuvqmZvd59N646BwYUyB0EBI3vZCeG31wnaMm/x 0Oyw== X-Gm-Message-State: APzg51BlWhl5aIrEctO3yI4zxsUsuNPULhTgDK7ws9InsBhc2btFBbvT NtlJHcCCB5qt9iSgew5QTj9tcUZL5UD5fzbVZ6PaDQ== X-Google-Smtp-Source: ANB0VdYD9Bh1NDAKWGWQCcJujf6pRwib6yCwjab5qR998tTtm6T7VkwtVi7+yd+aKn8DiTYiLUfPLmvDT4SNBF0yYRM= X-Received: by 2002:a63:ec43:: with SMTP id r3-v6mr11992199pgj.295.1535368191037; Mon, 27 Aug 2018 04:09:51 -0700 (PDT) MIME-Version: 1.0 Received: by 2002:a17:90a:db0f:0:0:0:0 with HTTP; Mon, 27 Aug 2018 04:09:30 -0700 (PDT) In-Reply-To: <0AE05CBFB1A6A0468C8581DAE58A31309E0F6993@SINEML521-MBS.china.huawei.com> References: <1231917830.3727154.1535119783361.JavaMail.zimbra@enst.fr> <20180824155038.GA2743@LK-Perkele-VII> <1417403886.3796035.1535132676840.JavaMail.zimbra@enst.fr> <0AE05CBFB1A6A0468C8581DAE58A31309E0F34A4@SINEML521-MBS.china.huawei.com> <1766398978.255182.1535358692070.JavaMail.zimbra@enst.fr> <0AE05CBFB1A6A0468C8581DAE58A31309E0F6993@SINEML521-MBS.china.huawei.com> From: William Whyte Date: Mon, 27 Aug 2018 07:09:30 -0400 Message-ID: To: Wang Haiguang Cc: tls Content-Type: multipart/alternative; boundary="000000000000a06586057468c332" Archived-At: Subject: Re: [TLS] TLS 1.3 Authentication using ETSI TS 103 097 and IEEE 1609.2 certificates X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Aug 2018 11:09:55 -0000 --000000000000a06586057468c332 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi Wang, The 1609.2 certificate format consists of both explicit and implicit certificates. The explicit certificates are in 1609.2 format, not in X.509 format. Cheers, William On Mon, Aug 27, 2018 at 4:43 AM, Wang Haiguang < wang.haiguang.shieldlab@huawei.com> wrote: > Hi, Mounira > > Thanks for the clarification. That means both explicit and implicit > certificates will be supported. > > Regards. > > Haiguang > > -----Original Message----- > From: Mounira Msahli [mailto:mounira.msahli@telecom-paristech.fr] > Sent: Monday, August 27, 2018 4:32 PM > To: Wang Haiguang > Cc: Ilari Liusvaara ; tls > Subject: Re: TLS 1.3 Authentication using ETSI TS 103 097 and IEEE 1609.2 > certificates > > Hi Wang, > > The purpose of the draft is to extend TLS 1.3 to support IEEE 1609.2/ETSI > TS 103 097 certificates for authentication in addition to X.509 certifica= te > and raw public keys. > > Kind Regards > Mounira > > > > ----- Mail original ----- > De: "Wang Haiguang" > =C3=80: "Mounira Msahli" , "Ilari > Liusvaara" > Cc: "tls" > Envoy=C3=A9: Lundi 27 Ao=C3=BBt 2018 03:44:28 > Objet: RE: TLS 1.3 Authentication using ETSI TS 103 097 and IEEE 1609.2 > certificates > > Hi, Mounira > > Just for clarification. > > If I am not wrong, there are two types of certificates supported by > 1609.2. One is the legacy X.509 certificate, the other is the implicit > certificate. > > So for you draft submitted, you plan support both types of certificates o= r > just one of them, i.e. the X.509 certificate. > > Best regards. > > Haiguang > > -----Original Message----- > From: TLS [mailto:tls-bounces@ietf.org] On Behalf Of Mounira Msahli > Sent: Saturday, August 25, 2018 1:45 AM > To: Ilari Liusvaara > Cc: tls > Subject: Re: [TLS] TLS 1.3 Authentication using ETSI TS 103 097 and IEEE > 1609.2 certificates > > > Thank you Ilari, > > > In response to your comments below: > > - I did not see requirements where to place the end-entity certificate > anywhere. I think most TLS code outright assumes that the end-entity > certificate is the first one. > > >>> We will add it. > > - More generally, I did not see it specified how the certificate chain is > laid out to the individual certficate fields (it is fairly obvious, but > should still be specified). > >>> We will specify it. > > - The examples could have multiple certificate types in ClientHello to > more clearly show what is actually going on. > >>> We will add examples with multiple certificate types in Client Hello > > - You should also specify use in TLS 1.2 in the same draft (or say that > is prohibited). This is so one only needs one reference for the > codepoint allocation. > > >>> It is not prohibited, for TLS 1.2 the extension is already specified: > [ https://tools.ietf.org/html/draft-serhrouchni-tls-certieee1609-01 ] > [ https://tools.ietf.org/html/draft-serhrouchni-tls-certieee1609-01 | > https://tools.ietf.org/html/draft-serhrouchni-tls-certieee1609-01 ] > We will update the draft > > - I found the document quite hard to read due to various editorial > issues. > >> We will update the draft > > > Kind Regards > Mounira > > ----- Mail original ----- > De: "Ilari Liusvaara" > =C3=80: "Mounira Msahli" > Cc: "tls" > Envoy=C3=A9: Vendredi 24 Ao=C3=BBt 2018 17:50:38 > Objet: Re: [TLS] TLS 1.3 Authentication using ETSI TS 103 097 and IEEE > 1609.2 certificates > > On Fri, Aug 24, 2018 at 04:09:43PM +0200, Mounira Msahli wrote: > > Hi all, > > > > > > The draft: TLS 1.3 Authentication using IEEE 1609.2/ETSI TS 103097 > certificates is updated in accordance with TLS 1.3: > https://tools.ietf.org/html/draft-tls-certieee1609-01 > > > > This document describes the use of certificates specified by the > Institute of Electrical and Electronics Engineers IEEE1609.2 and the > European Telecommunications Standards > > > > Institute ETSI TS 103097. These standards are defined in order to secur= e > communications in vehicular environments. > > > > This extension is very useful and has become a pressing need for > (Vehicle-To-Internet(V2Internet), Vehicle-To-Cloud(V2Cloud),...). > > > > We are soliciting feedback from the WG on the draft. > > Some quick comments: > > - I did not see requirements where to place the end-entity certificate > anywhere. I think most TLS code outright assumes that the end-entity > certificate is the first one. > - More generally, I did not see it specified how the certificate chain > is laid out to the individual certficate fields (it is fairly > obvious, but should still be specified). > - The examples could have multiple certificate types in ClientHello to > more clearly show what is actually going on. > - You should also specify use in TLS 1.2 in the same draft (or say that > is prohibited). This is so one only needs one reference for the > codepoint allocation. > - I found the document quite hard to read due to various editorial > issues. > > > -Ilari > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > --=20 PLEASE UPDATE YOUR ADDRESS BOOKS WITH MY NEW ADDRESS: wwhyte@onboardsecurity.com --000000000000a06586057468c332 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi Wang,

The 1609.2 certificate format = consists of both explicit and implicit certificates. The explicit certifica= tes are in 1609.2 format, not in X.509 format.

Che= ers,

William

On Mon, Aug 27, 2018 at 4:43 AM, Wang Haigu= ang <wang.haiguang.shieldlab@huawei.com> wr= ote:
Hi, Mounira

Thanks for the clarification. That means both explicit and implicit certifi= cates will be supported.

Regards.

Haiguang

-----Original Message-----
From: Mounira Msahli [mailto:mounira.msahli@telecom-paristech.fr]
Sent: Monday, August 27, 2018 4:32 PM
To: Wang Haiguang <wang.haiguang.shieldlab@huawei.com>
Cc: Ilari Liusvaara <ilarili= usvaara@welho.com>; tls <tls@ietf= .org>
Subject: Re: TLS 1.3 Authentication using ETSI TS 103 097 and IEEE 1609.2 c= ertificates

Hi Wang,

The purpose of the draft is to extend TLS 1.3 to support IEEE 1609.2/ETSI T= S 103 097 certificates for authentication in addition to X.509 certificate = and raw public keys.

Kind Regards
Mounira



----- Mail original -----
De: "Wang Haiguang" <wang.haiguang.shieldlab@huawei.com>
=C3=80: "Mounira Msahli" <mounira.msahli@telecom-paristech.fr>, "= Ilari Liusvaara" <ilari= liusvaara@welho.com>
Cc: "tls" <tls@ietf.org>= ;
Envoy=C3=A9: Lundi 27 Ao=C3=BBt 2018 03:44:28
Objet: RE: TLS 1.3 Authentication using ETSI TS 103 097 and IEEE 1609.2 cer= tificates

Hi, Mounira

Just for clarification.

If I am not wrong, there are two types of certificates supported by 1609.2.= One is the legacy X.509 certificate, the other is the implicit certificate= .

So for you draft submitted, you plan support both types of certificates or = just one of them, i.e. the X.509 certificate.

Best regards.

Haiguang

-----Original Message-----
From: TLS [mailto:tls-bounces@ietf.= org] On Behalf Of Mounira Msahli
Sent: Saturday, August 25, 2018 1:45 AM
To: Ilari Liusvaara <ilarili= usvaara@welho.com>
Cc: tls <tls@ietf.org>
Subject: Re: [TLS] TLS 1.3 Authentication using ETSI TS 103 097 and IEEE 16= 09.2 certificates


Thank you Ilari,


In response to your comments below:

- I did not see requirements where to place the end-entity certificate anyw= here. I think most TLS code outright assumes that the end-entity certificat= e is the first one.

>>> We will add it.

- More generally, I did not see it specified how the certificate chain is l= aid out to the individual certficate fields (it is fairly obvious, but shou= ld still be specified).
>>> We will specify it.

- The examples could have multiple certificate types in ClientHello to more= clearly show what is actually going on.
>>> We will add examples with multiple certificate types in Client= Hello

- You should also specify use in TLS 1.2 in the same draft (or say that is prohibited). This is so one only needs one reference for the
codepoint allocation.

>>> It is not prohibited, for TLS 1.2 the extension is already spe= cified: [ https://tools.ietf.org/ht= ml/draft-serhrouchni-tls-certieee1609-01 ]
[ https://tools.ietf.org/html/= draft-serhrouchni-tls-certieee1609-01 | https://tools.ietf.org/html/draft-serhrouchni-tls-c= ertieee1609-01 ]
We will update the draft

- I found the document quite hard to read due to various editorial
issues.
>> We will update the draft


Kind Regards
Mounira

----- Mail original -----
De: "Ilari Liusvaara" <ilariliusvaara@welho.com>
=C3=80: "Mounira Msahli" <mounira.msahli@telecom-paristech.fr>
Cc: "tls" <tls@ietf.org>= ;
Envoy=C3=A9: Vendredi 24 Ao=C3=BBt 2018 17:50:38
Objet: Re: [TLS] TLS 1.3 Authentication using ETSI TS 103 097 and IEEE 1609= .2 certificates

On Fri, Aug 24, 2018 at 04:09:43PM +0200, Mounira Msahli wrote:
> Hi all,
>
>
> The draft: TLS 1.3 Authentication using IEEE 1609.2/ETSI TS 103097 cer= tificates is updated in accordance with TLS 1.3: https://tools.ietf.org/html/draft-tls-certieee1609-01
>
> This document describes the use of certificates specified by the Insti= tute of Electrical and Electronics Engineers IEEE1609.2 and the European Te= lecommunications Standards
>
> Institute ETSI TS 103097. These standards are defined in order to secu= re communications in vehicular environments.
>
> This extension is very useful and has become a pressing need for (Vehi= cle-To-Internet(V2Internet), Vehicle-To-Cloud(V2Cloud),...).
>
> We are soliciting feedback from the WG on the draft.

Some quick comments:

- I did not see requirements where to place the end-entity certificate
anywhere. I think most TLS code outright assumes that the end-entity
certificate is the first one.
- More generally, I did not see it specified how the certificate chain
is laid out to the individual certficate fields (it is fairly
obvious, but should still be specified).
- The examples could have multiple certificate types in ClientHello to
more clearly show what is actually going on.
- You should also specify use in TLS 1.2 in the same draft (or say that is prohibited). This is so one only needs one reference for the
codepoint allocation.
- I found the document quite hard to read due to various editorial
issues.


-Ilari

_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls

_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls



--
=


PLEASE UPDATE YOUR ADDRESS BOOKS WIT= H MY NEW ADDRESS: wwhyte@onboardsecurity.com
--000000000000a06586057468c332-- From nobody Mon Aug 27 07:40:08 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2FA22130DF2 for ; Mon, 27 Aug 2018 07:40:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id z-72vZtmJmU5 for ; Mon, 27 Aug 2018 07:40:04 -0700 (PDT) Received: from mx1.redhat.com (mx3-rdu2.redhat.com [66.187.233.73]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 53F53130DF0 for ; Mon, 27 Aug 2018 07:40:04 -0700 (PDT) Received: from smtp.corp.redhat.com (int-mx03.intmail.prod.int.rdu2.redhat.com [10.11.54.3]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 4B32E4023461; Mon, 27 Aug 2018 14:40:03 +0000 (UTC) Received: from pintsize.usersys.redhat.com (unknown [10.43.21.250]) by smtp.corp.redhat.com (Postfix) with ESMTP id 2FDA61049470; Mon, 27 Aug 2018 14:40:01 +0000 (UTC) From: Hubert Kario To: tls@ietf.org Cc: Mounira Msahli , Ilari Liusvaara Date: Mon, 27 Aug 2018 16:39:56 +0200 Message-ID: <3804815.tkeyhOaURY@pintsize.usersys.redhat.com> In-Reply-To: <1417403886.3796035.1535132676840.JavaMail.zimbra@enst.fr> References: <1231917830.3727154.1535119783361.JavaMail.zimbra@enst.fr> <20180824155038.GA2743@LK-Perkele-VII> <1417403886.3796035.1535132676840.JavaMail.zimbra@enst.fr> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="nextPart1962761.o1J4IrJChC"; micalg="pgp-sha512"; protocol="application/pgp-signature" X-Scanned-By: MIMEDefang 2.78 on 10.11.54.3 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.11.55.6]); Mon, 27 Aug 2018 14:40:03 +0000 (UTC) X-Greylist: inspected by milter-greylist-4.5.16 (mx1.redhat.com [10.11.55.6]); Mon, 27 Aug 2018 14:40:03 +0000 (UTC) for IP:'10.11.54.3' DOMAIN:'int-mx03.intmail.prod.int.rdu2.redhat.com' HELO:'smtp.corp.redhat.com' FROM:'hkario@redhat.com' RCPT:'' Archived-At: Subject: Re: [TLS] TLS 1.3 Authentication using ETSI TS 103 097 and IEEE 1609.2 certificates X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Aug 2018 14:40:06 -0000 --nextPart1962761.o1J4IrJChC Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="UTF-8" On Friday, 24 August 2018 19:44:36 CEST Mounira Msahli wrote: > - You should also specify use in TLS 1.2 in the same draft (or say that > is prohibited). This is so one only needs one reference for the > codepoint allocation. >=20 > >>> It is not prohibited, for TLS 1.2 the extension is already specified:= [ > >>> https://tools.ietf.org/html/draft-serhrouchni-tls-certieee1609-01 ] > [ https://tools.ietf.org/html/draft-serhrouchni-tls-certieee1609-01 | > https://tools.ietf.org/html/draft-serhrouchni-tls-certieee1609-01 ] We wi= ll > update the draft wouldn't then it be better to combine them and have one standard (document)= =20 that describes use in TLS 1.2 and TLS 1.3? I may be missing something but I= =20 don't see anything that would prevent use of the same codepoints in both=20 protocol versions =2D-=20 Regards, Hubert Kario Senior Quality Engineer, QE BaseOS Security team Web: www.cz.redhat.com Red Hat Czech s.r.o., Purky=C5=88ova 115, 612 00 Brno, Czech Republic --nextPart1962761.o1J4IrJChC Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part. Content-Transfer-Encoding: 7Bit -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEYeeuxEU+3unL/K+dkqjRuAHS9fUFAluEDTwACgkQkqjRuAHS 9fW3RQ/8C96Ixnn/o6Zu1+k4NuCnRCz65xgP3yrl5RpluWpiMx9Z9DNKL0NWl4Os yuhmcF/ln3f3SZF+y11tH5pCLEV2ipgTim+2UK5rbkY8id4tB1WEQrjshAS3m7l1 Kwo3ekaIl1b3d+uCuZ/Iw1Qdb6mAxPoVKC2oxYs1/PIMjfliyFB3DjMz+0zADFzd mLuK0Ue269Nr84tgiXFI0lCQBtQ/+CURvKxbrc797YRQg2LVXPWm0Ctls7CapVnt AemDCKDWnzfZkKZkk1HsVeSbYDyZBZnJFKseqef7ePfn3NfcvwwqlEjpNkVKB6v5 cB7tU7ktTE7mLXq7i0rYjMezbV5IL7AxAJK02i5QY0ZKis68oApty3Xn3DRgIX8e z7t5BJXuhLiWzcEFONq+GSqFSh3Dyco0gvcQZVJR5jJKFkOnAkuh1FqGktrdR3+P ERc4djxxgvoNwjB448BtSfecPZNcOWs2jLlH9ecpdz0+msaNVMUtu8Mg8I3HKzLj sXqzLlkHXm3LPDQfZrtHQDf9r2MVgjU/IY/jEoJQJufCn2ku4qotfQIGDgm7PStF JvjkfJd2AoxTGZg5xcNuK3Cfl5JA9IjS1LLDZvlieeFPxx83jvm4rF1pNHEGzupr T/PKhv6bKPJR+0I+Nsjy5xkHk+nVTru7Sp2AU3gPFSPJJZhPstc= =IxN1 -----END PGP SIGNATURE----- --nextPart1962761.o1J4IrJChC-- From nobody Mon Aug 27 09:21:22 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 184AF130E07 for ; Mon, 27 Aug 2018 09:21:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=telecom-paristech.fr Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Y6KJCiezx_d3 for ; Mon, 27 Aug 2018 09:21:18 -0700 (PDT) Received: from zproxy130.enst.fr (zproxy130.enst.fr [IPv6:2001:660:330f:2::c2]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 923EC130E06 for ; Mon, 27 Aug 2018 09:21:18 -0700 (PDT) Received: from localhost (localhost [IPv6:::1]) by zproxy130.enst.fr (Postfix) with ESMTP id C76221207B5; Mon, 27 Aug 2018 18:21:16 +0200 (CEST) Received: from zproxy130.enst.fr ([IPv6:::1]) by localhost (zproxy130.enst.fr [IPv6:::1]) (amavisd-new, port 10032) with ESMTP id zMdrypcuhLfx; Mon, 27 Aug 2018 18:21:16 +0200 (CEST) Received: from localhost (localhost [IPv6:::1]) by zproxy130.enst.fr (Postfix) with ESMTP id 394B21207F0; Mon, 27 Aug 2018 18:21:16 +0200 (CEST) DKIM-Filter: OpenDKIM Filter v2.10.3 zproxy130.enst.fr 394B21207F0 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=telecom-paristech.fr; s=A6AEC2EE-1106-11E5-B10E-D103FDDA8F2E; t=1535386876; bh=eukm1AA/wwLVd8icB7JYFCShWh1rOdUoyfFcIwG6q9o=; h=Date:From:To:Message-ID:MIME-Version; b=CPZFxf9aedEMAUZrqJn4OjyxD/DmEeM9j+/fZwIv0GV+Eh4kSr8q70z9Ft3xMYkuy F6O6nUcHNDURoogwrlu2jBrIxDpdMYj/ALzrkPwrd0Zu0M7QmtMnRx/6VHIIImXQrP KuFal3IT4o0ARTFIrBWnB2SDF5fs/WCzHCM4vG2Q= X-Virus-Scanned: amavisd-new at zproxy130.enst.fr Received: from zproxy130.enst.fr ([IPv6:::1]) by localhost (zproxy130.enst.fr [IPv6:::1]) (amavisd-new, port 10026) with ESMTP id ngFGIdNrsjnX; Mon, 27 Aug 2018 18:21:16 +0200 (CEST) Received: from zmail112.enst.fr (zmail112.enst.fr [137.194.2.205]) by zproxy130.enst.fr (Postfix) with ESMTP id 077B11207B5; Mon, 27 Aug 2018 18:21:15 +0200 (CEST) Date: Mon, 27 Aug 2018 18:21:15 +0200 (CEST) From: Mounira Msahli To: Hubert Kario Cc: tls , Ilari Liusvaara Message-ID: <997722663.579236.1535386875575.JavaMail.zimbra@enst.fr> In-Reply-To: <3804815.tkeyhOaURY@pintsize.usersys.redhat.com> References: <1231917830.3727154.1535119783361.JavaMail.zimbra@enst.fr> <20180824155038.GA2743@LK-Perkele-VII> <1417403886.3796035.1535132676840.JavaMail.zimbra@enst.fr> <3804815.tkeyhOaURY@pintsize.usersys.redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-Originating-IP: [2001:660:330f:cc:f9c7:bf8d:8c3b:8542] X-Mailer: Zimbra 8.8.9_GA_3019 (ZimbraWebClient - FF61 (Linux)/8.8.9_GA_3019) Thread-Topic: TLS 1.3 Authentication using ETSI TS 103 097 and IEEE 1609.2 certificates Thread-Index: jUHmf7eklfd9rZDmSu1Fow8dhdSt1A== Archived-At: Subject: Re: [TLS] TLS 1.3 Authentication using ETSI TS 103 097 and IEEE 1609.2 certificates X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Aug 2018 16:21:21 -0000 Hi Hubert,=20 I can do the exercise but the result will be two sections totally decorrela= ted: one for TLS 1.3 and one for TLS 1.2. Two drafts in one document. - The handshake phase in TLS 1.2 is different from handshake/TLS1.3 - The certificate type is different. One uses cert_type and the other uses = extension defined in [RFC7250].=20 Kind Regards=20 Mounira=20 ----- Mail original ----- De: "Hubert Kario" =C3=80: "tls" Cc: "Mounira Msahli" , "Ilari Liusvaar= a" Envoy=C3=A9: Lundi 27 Ao=C3=BBt 2018 16:39:56 Objet: Re: [TLS] TLS 1.3 Authentication using ETSI TS 103 097 and IEEE 1609= .2 certificates On Friday, 24 August 2018 19:44:36 CEST Mounira Msahli wrote:=20 > - You should also specify use in TLS 1.2 in the same draft (or say that= =20 > is prohibited). This is so one only needs one reference for the=20 > codepoint allocation.=20 >=20 > >>> It is not prohibited, for TLS 1.2 the extension is already specified:= [=20 > >>> https://tools.ietf.org/html/draft-serhrouchni-tls-certieee1609-01 ]= =20 > [ https://tools.ietf.org/html/draft-serhrouchni-tls-certieee1609-01 |=20 > https://tools.ietf.org/html/draft-serhrouchni-tls-certieee1609-01 ] We wi= ll=20 > update the draft=20 wouldn't then it be better to combine them and have one standard (document)= =20 that describes use in TLS 1.2 and TLS 1.3? I may be missing something but I= =20 don't see anything that would prevent use of the same codepoints in both=20 protocol versions=20 --=20 Regards,=20 Hubert Kario=20 Senior Quality Engineer, QE BaseOS Security team=20 Web: www.cz.redhat.com=20 Red Hat Czech s.r.o., Purky=C5=88ova 115, 612 00 Brno, Czech Republic From nobody Mon Aug 27 09:34:14 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 24E47130E1B for ; Mon, 27 Aug 2018 09:34:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lqu0y_DDqfYp for ; Mon, 27 Aug 2018 09:34:10 -0700 (PDT) Received: from welho-filter3.welho.com (welho-filter3.welho.com [83.102.41.25]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AE7BE130E06 for ; Mon, 27 Aug 2018 09:34:10 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by welho-filter3.welho.com (Postfix) with ESMTP id 1A78FB903; Mon, 27 Aug 2018 19:34:08 +0300 (EEST) X-Virus-Scanned: Debian amavisd-new at pp.htv.fi Received: from welho-smtp2.welho.com ([IPv6:::ffff:83.102.41.85]) by localhost (welho-filter3.welho.com [::ffff:83.102.41.25]) (amavisd-new, port 10024) with ESMTP id Ez3RJDpGa_Q5; Mon, 27 Aug 2018 19:34:07 +0300 (EEST) Received: from LK-Perkele-VII (87-92-19-27.bb.dnainternet.fi [87.92.19.27]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by welho-smtp2.welho.com (Postfix) with ESMTPSA id 89E7E72; Mon, 27 Aug 2018 19:34:05 +0300 (EEST) Date: Mon, 27 Aug 2018 19:34:05 +0300 From: Ilari Liusvaara To: Mounira Msahli Cc: tls Message-ID: <20180827163405.GA19628@LK-Perkele-VII> References: <1231917830.3727154.1535119783361.JavaMail.zimbra@enst.fr> <20180824155038.GA2743@LK-Perkele-VII> <1417403886.3796035.1535132676840.JavaMail.zimbra@enst.fr> <3804815.tkeyhOaURY@pintsize.usersys.redhat.com> <997722663.579236.1535386875575.JavaMail.zimbra@enst.fr> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <997722663.579236.1535386875575.JavaMail.zimbra@enst.fr> User-Agent: Mutt/1.10.1 (2018-07-13) Sender: ilariliusvaara@welho.com Archived-At: Subject: Re: [TLS] TLS 1.3 Authentication using ETSI TS 103 097 and IEEE 1609.2 certificates X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Aug 2018 16:34:13 -0000 On Mon, Aug 27, 2018 at 06:21:15PM +0200, Mounira Msahli wrote: > Hi Hubert, > > I can do the exercise but the result will be two sections totally > decorrelated: one for TLS 1.3 and one for TLS 1.2. Two drafts in > one document. The certificate message might be bit annoying as it has different format in TLS 1.2 and 1.3. But most textual discussion probably can be shared between the versions. > - The handshake phase in TLS 1.2 is different from handshake/TLS1.3 One could abbrevate the handshake traces to just show the relevant parts (which could also cut some clutter)? I think the relevant messages always occur in the same order (clienthello, serverhello/ encryptedextensions, certificate, certificate). > - The certificate type is different. One uses cert_type and the > other uses extension defined in [RFC7250]. cert_type is deprecated. One should use the RFC7250 extensions even in TLS 1.2. The TLS 1.3 certificate format negotiation works the same as in TLS 1.2, with exception of extensions being in different message. -Ilari From nobody Mon Aug 27 09:38:18 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 90138130E06 for ; Mon, 27 Aug 2018 09:38:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Z5gr8qCpQ0Zo for ; Mon, 27 Aug 2018 09:38:09 -0700 (PDT) Received: from mail-lj1-x234.google.com (mail-lj1-x234.google.com [IPv6:2a00:1450:4864:20::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AC931130E1B for ; Mon, 27 Aug 2018 09:38:08 -0700 (PDT) Received: by mail-lj1-x234.google.com with SMTP id f8-v6so12943244ljk.1 for ; Mon, 27 Aug 2018 09:38:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=0voB9sDgt9roQ78E3/Gs+N5dR59pWz7jY5pKHLKs4n0=; b=W9JCWcuYen76uZIzDthhPfecRLEyHUzhYyMewSkGJDbocNccbT2CacOZhTyojjwh7G +K77XY5qTX3BgQjzE+rIBCLlEnfjK5z24DsXGQfj9gDQrBz+bLiZsPRtU1I28JbZpCBW oveqOYBZsHbXRhxUs4Qhe4A+Zpf7Wcu3Dru7lVRV0mDF+FnlnZ/eymBjSSOXY5EfZLVf x/yEiQEz0bQ8HZ4Soc50LPQGz/4Ey+HnE43hcCfnu45ndjCSadSfGf0ryMOYzJlQ8oWE Y5uD/fmxPQm17I++zo8B3pXjpZP8uigf+3EmH426NHB6+smxJQUGjpVu5IKQsCLjxf/Y VdRA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=0voB9sDgt9roQ78E3/Gs+N5dR59pWz7jY5pKHLKs4n0=; b=MmaFC8cbNqNqPkFg3pvie/izTiepQeoc5Bnm6ETDAIRpnQU+/9hea9ZXDuwraRM7D9 JciDSp76Z58uAv9SoCNAmCmVscdAtYwFd2TTnl14s9qwQ1qo5eAOeEychqhb22+qHqed nULgjin7sO8aWpdq7BqEQRGjkFTg7wjQRG61Hl2qSE1obxC5ntHsDxwhIJvP1VCksvKB tcg22yyCIhkIRzzz2hy8/2TdooHKj5IX4+jqpOP5uYuCyZhE/xMRSOSMcGImoMei01/E D0y3CXwiloaM15g3VVanMZtLS40dY1FC9YkcOD7ywMeGkPVxPh9+W63CAXYq3m7MvA9f gZ1Q== X-Gm-Message-State: APzg51BH8xNi2OJqp6lfWm54if1Ic4UuDKRn4yYepGXvopWl3pWfn14c ioMnPf6ELlAXZPHzltxgOcVzBpF2UMkhF0BbWVg= X-Google-Smtp-Source: ANB0VdZUo3Q7D+LyNZU4GSglakESpZv974+uFeztmrSpL1eAQBOxSHeFB7liooQeCialNXO+EIHtWev98dqj38fXO54= X-Received: by 2002:a2e:5053:: with SMTP id v19-v6mr7458401ljd.84.1535387886809; Mon, 27 Aug 2018 09:38:06 -0700 (PDT) MIME-Version: 1.0 References: <1231917830.3727154.1535119783361.JavaMail.zimbra@enst.fr> <20180824155038.GA2743@LK-Perkele-VII> <1417403886.3796035.1535132676840.JavaMail.zimbra@enst.fr> <3804815.tkeyhOaURY@pintsize.usersys.redhat.com> <997722663.579236.1535386875575.JavaMail.zimbra@enst.fr> In-Reply-To: <997722663.579236.1535386875575.JavaMail.zimbra@enst.fr> From: Watson Ladd Date: Mon, 27 Aug 2018 08:37:50 -0800 Message-ID: To: Mounira Msahli Cc: Hubert Kario , tls@ietf.org Content-Type: multipart/alternative; boundary="00000000000095f68005746d5905" Archived-At: Subject: Re: [TLS] TLS 1.3 Authentication using ETSI TS 103 097 and IEEE 1609.2 certificates X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Aug 2018 16:38:16 -0000 --00000000000095f68005746d5905 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Mon, Aug 27, 2018, 8:21 AM Mounira Msahli < mounira.msahli@telecom-paristech.fr> wrote: > Hi Hubert, > > I can do the exercise but the result will be two sections totally > decorrelated: one for TLS 1.3 and one for TLS 1.2. Two drafts in one > document. > > - The handshake phase in TLS 1.2 is different from handshake/TLS1.3 > - The certificate type is different. One uses cert_type and the other use= s > extension defined in [RFC7250]. > Why does the first point matter? And the certificates are embedded pretty opaquely in TLS. > > Kind Regards > Mounira > > > > ----- Mail original ----- > De: "Hubert Kario" > =C3=80: "tls" > Cc: "Mounira Msahli" , "Ilari > Liusvaara" > Envoy=C3=A9: Lundi 27 Ao=C3=BBt 2018 16:39:56 > Objet: Re: [TLS] TLS 1.3 Authentication using ETSI TS 103 097 and IEEE > 1609.2 certificates > > On Friday, 24 August 2018 19:44:36 CEST Mounira Msahli wrote: > > - You should also specify use in TLS 1.2 in the same draft (or say that > > is prohibited). This is so one only needs one reference for the > > codepoint allocation. > > > > >>> It is not prohibited, for TLS 1.2 the extension is already > specified: [ > > >>> https://tools.ietf.org/html/draft-serhrouchni-tls-certieee1609-01 ] > > [ https://tools.ietf.org/html/draft-serhrouchni-tls-certieee1609-01 | > > https://tools.ietf.org/html/draft-serhrouchni-tls-certieee1609-01 ] We > will > > update the draft > > wouldn't then it be better to combine them and have one standard > (document) > that describes use in TLS 1.2 and TLS 1.3? I may be missing something but > I > don't see anything that would prevent use of the same codepoints in both > protocol versions > > -- > Regards, > Hubert Kario > Senior Quality Engineer, QE BaseOS Security team > Web: www.cz.redhat.com > Red Hat Czech s.r.o., Purky=C5=88ova 115, 612 00 Brno, Czech Republic > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > --00000000000095f68005746d5905 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


= On Mon, Aug 27, 2018, 8:21 AM Mounira Msahli <mounira.msahli@telecom-paristech.fr> wr= ote:
Hi Hubert,

I can do the exercise but the result will be two sections totally decorrela= ted: one for TLS 1.3 and one for TLS 1.2. Two drafts in one document.

- The handshake phase in TLS 1.2 is different from handshake/TLS1.3
- The certificate type is different. One uses cert_type and the other uses = extension defined in [RFC7250].

Why does the first point matter? And the ce= rtificates are embedded pretty opaquely in TLS.

=


Kind Regards
Mounira



----- Mail original -----
De: "Hubert Kario" <hkario@redhat.com>
=C3=80: "tls" <tls@ietf.org>
Cc: "Mounira Msahli" <mounira.msahli@telecom-= paristech.fr>, "Ilari Liusvaara" <ilariliusvaara@= welho.com>
Envoy=C3=A9: Lundi 27 Ao=C3=BBt 2018 16:39:56
Objet: Re: [TLS] TLS 1.3 Authentication using ETSI TS 103 097 and IEEE 1609= .2 certificates

On Friday, 24 August 2018 19:44:36 CEST Mounira Msahli wrote:
> - You should also specify use in TLS 1.2 in the same draft (or say tha= t
> is prohibited). This is so one only needs one reference for the
> codepoint allocation.
>
> >>> It is not prohibited, for TLS 1.2 the extension is alread= y specified: [
> >>> https:= //tools.ietf.org/html/draft-serhrouchni-tls-certieee1609-01 ]
> [ https://tools.iet= f.org/html/draft-serhrouchni-tls-certieee1609-01 |
> https://tools.ietf.= org/html/draft-serhrouchni-tls-certieee1609-01 ] We will
> update the draft

wouldn't then it be better to combine them and have one standard (docum= ent)
that describes use in TLS 1.2 and TLS 1.3? I may be missing something but I=
don't see anything that would prevent use of the same codepoints in bot= h
protocol versions

--
Regards,
Hubert Kario
Senior Quality Engineer, QE BaseOS Security team
Web: www.cz.redhat.com
Red Hat Czech s.r.o., Purky=C5=88ova 115, 612 00 Brno, Czech Republic

_______________________________________________
TLS mailing list
TLS@ie= tf.org
https://www.ietf.org/mailman/listinfo/tls
--00000000000095f68005746d5905-- From nobody Mon Aug 27 10:24:41 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A8F46130DD0 for ; Mon, 27 Aug 2018 10:24:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=telecom-paristech.fr Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3USCbA_sc_zR for ; Mon, 27 Aug 2018 10:24:38 -0700 (PDT) Received: from zproxy130.enst.fr (zproxy130.enst.fr [137.194.2.194]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B0D63129C6A for ; Mon, 27 Aug 2018 10:24:37 -0700 (PDT) Received: from localhost (localhost [IPv6:::1]) by zproxy130.enst.fr (Postfix) with ESMTP id 3EA3012061F; Mon, 27 Aug 2018 19:24:36 +0200 (CEST) Received: from zproxy130.enst.fr ([IPv6:::1]) by localhost (zproxy130.enst.fr [IPv6:::1]) (amavisd-new, port 10032) with ESMTP id t8VJd8mTdYaF; Mon, 27 Aug 2018 19:24:35 +0200 (CEST) Received: from localhost (localhost [IPv6:::1]) by zproxy130.enst.fr (Postfix) with ESMTP id 0B6B21207EF; Mon, 27 Aug 2018 19:24:35 +0200 (CEST) DKIM-Filter: OpenDKIM Filter v2.10.3 zproxy130.enst.fr 0B6B21207EF DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=telecom-paristech.fr; s=A6AEC2EE-1106-11E5-B10E-D103FDDA8F2E; t=1535390675; bh=AFGNEz1Lm0kocK8BL2e/tMEZc0wUvK5gb0UgCpv+oJY=; h=Date:From:To:Message-ID:MIME-Version; b=v0xmt7uHIjTO/+ELTjoYsOcp1wBq0wleR+jrtClaI7kMVHOtZ9CCmlKGPBChrmITp 1UvX1CNM8R2a5q9V96x8a4phLkwtEUfXmTg8Miq6B+SELmWarPM/sF6b1IhQEUkFLm 1p51yvf1LBXfS2ifp+JBKWuKroAgREmMaCIfT25A= X-Virus-Scanned: amavisd-new at zproxy130.enst.fr Received: from zproxy130.enst.fr ([IPv6:::1]) by localhost (zproxy130.enst.fr [IPv6:::1]) (amavisd-new, port 10026) with ESMTP id 5efYvchmv_6z; Mon, 27 Aug 2018 19:24:34 +0200 (CEST) Received: from zmail112.enst.fr (zmail112.enst.fr [137.194.2.205]) by zproxy130.enst.fr (Postfix) with ESMTP id C313A12061F; Mon, 27 Aug 2018 19:24:34 +0200 (CEST) Date: Mon, 27 Aug 2018 19:24:34 +0200 (CEST) From: Mounira Msahli To: Ilari Liusvaara Cc: tls Message-ID: <235113009.594519.1535390674699.JavaMail.zimbra@enst.fr> In-Reply-To: <20180827163405.GA19628@LK-Perkele-VII> References: <1231917830.3727154.1535119783361.JavaMail.zimbra@enst.fr> <20180824155038.GA2743@LK-Perkele-VII> <1417403886.3796035.1535132676840.JavaMail.zimbra@enst.fr> <3804815.tkeyhOaURY@pintsize.usersys.redhat.com> <997722663.579236.1535386875575.JavaMail.zimbra@enst.fr> <20180827163405.GA19628@LK-Perkele-VII> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-Originating-IP: [::ffff:137.194.205.118] X-Mailer: Zimbra 8.8.9_GA_3019 (ZimbraWebClient - FF61 (Linux)/8.8.9_GA_3019) Thread-Topic: TLS 1.3 Authentication using ETSI TS 103 097 and IEEE 1609.2 certificates Thread-Index: Xcm6mm9O96psfXKxVJT69BwJ+fenOg== Archived-At: Subject: Re: [TLS] TLS 1.3 Authentication using ETSI TS 103 097 and IEEE 1609.2 certificates X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Aug 2018 17:24:40 -0000 One could abbrevate the handshake traces to just show the relevant=20 parts (which could also cut some clutter)? I think the relevant=20 messages always occur in the same order (clienthello, serverhello/=20 encryptedextensions, certificate, certificate).=20 Yes, so we can neglect the ServerHelloDone for TLS 1.2?=20 The table in section 4.2. Extensions of [RFC 8446] (TLS 1.3) indicates the= messages where a given extension may appear: | client_certificate_type [RFC7250] | CH, EE | | | | | server_certificate_type [RFC7250] | CH, EE | But in RFC 7250 (TLS 1.2), the same extensions could appear in CH and SH.= =20 I think, it could be better to make distinction between two TLS versions in= handshake phase in terms of presentation.=20 I don't have any objection to combine both in one document.=20 I agree with you about the rest of comments.=20 Cheers=20 Mounira=20 ----- Mail original ----- De: "Ilari Liusvaara" =C3=80: "Mounira Msahli" Cc: "tls" Envoy=C3=A9: Lundi 27 Ao=C3=BBt 2018 18:34:05 Objet: Re: [TLS] TLS 1.3 Authentication using ETSI TS 103 097 and IEEE 1609= .2 certificates On Mon, Aug 27, 2018 at 06:21:15PM +0200, Mounira Msahli wrote:=20 > Hi Hubert,=20 >=20 > I can do the exercise but the result will be two sections totally=20 > decorrelated: one for TLS 1.3 and one for TLS 1.2. Two drafts in=20 > one document.=20 The certificate message might be bit annoying as it has different=20 format in TLS 1.2 and 1.3. But most textual discussion probably can be=20 shared between the versions.=20 > - The handshake phase in TLS 1.2 is different from handshake/TLS1.3=20 One could abbrevate the handshake traces to just show the relevant=20 parts (which could also cut some clutter)? I think the relevant=20 messages always occur in the same order (clienthello, serverhello/=20 encryptedextensions, certificate, certificate).=20 > - The certificate type is different. One uses cert_type and the=20 > other uses extension defined in [RFC7250].=20 cert_type is deprecated. One should use the RFC7250 extensions even in=20 TLS 1.2. The TLS 1.3 certificate format negotiation works the same as=20 in TLS 1.2, with exception of extensions being in different message.=20 -Ilari=20 From nobody Mon Aug 27 10:31:24 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 25C03130DD0 for ; Mon, 27 Aug 2018 10:31:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=telecom-paristech.fr Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5j4MX4L01Cef for ; Mon, 27 Aug 2018 10:31:18 -0700 (PDT) Received: from zproxy110.enst.fr (zproxy110.enst.fr [137.194.2.192]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E26EA124BE5 for ; Mon, 27 Aug 2018 10:31:17 -0700 (PDT) Received: from localhost (localhost [IPv6:::1]) by zproxy110.enst.fr (Postfix) with ESMTP id 8562581980; Mon, 27 Aug 2018 19:31:16 +0200 (CEST) Received: from zproxy110.enst.fr ([IPv6:::1]) by localhost (zproxy110.enst.fr [IPv6:::1]) (amavisd-new, port 10032) with ESMTP id smWF9eDwWgQC; Mon, 27 Aug 2018 19:31:16 +0200 (CEST) Received: from localhost (localhost [IPv6:::1]) by zproxy110.enst.fr (Postfix) with ESMTP id E4CAD8198F; Mon, 27 Aug 2018 19:31:15 +0200 (CEST) DKIM-Filter: OpenDKIM Filter v2.10.3 zproxy110.enst.fr E4CAD8198F DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=telecom-paristech.fr; s=A6AEC2EE-1106-11E5-B10E-D103FDDA8F2E; t=1535391075; bh=nto+uhimJaR+6+4SP+IgvW+xlqU/x9l8SNZz/hM3bvc=; h=Date:From:To:Message-ID:MIME-Version; b=tx7ULnDDTA80QnHhWGdEyugEUYLAYJHuBsp8iuXy7X3jtsCM6P7C1qVTTKW0wuZIu 2cUL8RhjeQ4UXpiySqgsNba23rYCMteSb3bcACZf8DHIZHWwwb9mx1CFXz7yDYFBOC yBXFVYLsBWy6p/IDjtuhp+9pKCHm4vi9QlXBYfdM= X-Virus-Scanned: amavisd-new at zproxy110.enst.fr Received: from zproxy110.enst.fr ([IPv6:::1]) by localhost (zproxy110.enst.fr [IPv6:::1]) (amavisd-new, port 10026) with ESMTP id qArcONVqAqi1; Mon, 27 Aug 2018 19:31:15 +0200 (CEST) Received: from zmail112.enst.fr (zmail112.enst.fr [137.194.2.205]) by zproxy110.enst.fr (Postfix) with ESMTP id 8841F81980; Mon, 27 Aug 2018 19:31:15 +0200 (CEST) Date: Mon, 27 Aug 2018 19:31:15 +0200 (CEST) From: Mounira Msahli To: Watson Ladd Cc: Hubert Kario , tls Message-ID: <767691109.595536.1535391075424.JavaMail.zimbra@enst.fr> In-Reply-To: References: <1231917830.3727154.1535119783361.JavaMail.zimbra@enst.fr> <20180824155038.GA2743@LK-Perkele-VII> <1417403886.3796035.1535132676840.JavaMail.zimbra@enst.fr> <3804815.tkeyhOaURY@pintsize.usersys.redhat.com> <997722663.579236.1535386875575.JavaMail.zimbra@enst.fr> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-Originating-IP: [::ffff:137.194.205.118] X-Mailer: Zimbra 8.8.9_GA_3019 (ZimbraWebClient - FF61 (Linux)/8.8.9_GA_3019) Thread-Topic: TLS 1.3 Authentication using ETSI TS 103 097 and IEEE 1609.2 certificates Thread-Index: Ocvgh044cguhV91mNm1H8R9mlxu1Tw== Archived-At: Subject: Re: [TLS] TLS 1.3 Authentication using ETSI TS 103 097 and IEEE 1609.2 certificates X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Aug 2018 17:31:22 -0000 Why does the first point matter? And the certificates are embedded pretty o= paquely in TLS.=20 I think, I answered your question in my last mail? Kind Regards=20 Mounira =20 ----- Mail original ----- De: "Watson Ladd" =C3=80: "Mounira Msahli" Cc: "Hubert Kario" , "tls" Envoy=C3=A9: Lundi 27 Ao=C3=BBt 2018 18:37:50 Objet: Re: [TLS] TLS 1.3 Authentication using ETSI TS 103 097 and IEEE 1609= .2 certificates On Mon, Aug 27, 2018, 8:21 AM Mounira Msahli < [ mailto:mounira.msahli@tele= com-paristech.fr | mounira.msahli@telecom-paristech.fr ] > wrote:=20 Hi Hubert,=20 I can do the exercise but the result will be two sections totally decorrela= ted: one for TLS 1.3 and one for TLS 1.2. Two drafts in one document.=20 - The handshake phase in TLS 1.2 is different from handshake/TLS1.3=20 - The certificate type is different. One uses cert_type and the other uses = extension defined in [RFC7250].=20 Why does the first point matter? And the certificates are embedded pretty o= paquely in TLS.=20 BQ_BEGIN Kind Regards=20 Mounira=20 ----- Mail original -----=20 De: "Hubert Kario" < [ mailto:hkario@redhat.com | hkario@redhat.com ] >=20 =C3=80: "tls" < [ mailto:tls@ietf.org | tls@ietf.org ] >=20 Cc: "Mounira Msahli" < [ mailto:mounira.msahli@telecom-paristech.fr | mouni= ra.msahli@telecom-paristech.fr ] >, "Ilari Liusvaara" < [ mailto:ilariliusv= aara@welho.com | ilariliusvaara@welho.com ] >=20 Envoy=C3=A9: Lundi 27 Ao=C3=BBt 2018 16:39:56=20 Objet: Re: [TLS] TLS 1.3 Authentication using ETSI TS 103 097 and IEEE 1609= .2 certificates=20 On Friday, 24 August 2018 19:44:36 CEST Mounira Msahli wrote:=20 > - You should also specify use in TLS 1.2 in the same draft (or say that= =20 > is prohibited). This is so one only needs one reference for the=20 > codepoint allocation.=20 >=20 > >>> It is not prohibited, for TLS 1.2 the extension is already specified:= [=20 > >>> [ https://tools.ietf.org/html/draft-serhrouchni-tls-certieee1609-01 |= https://tools.ietf.org/html/draft-serhrouchni-tls-certieee1609-01 ] ]=20 > [ [ https://tools.ietf.org/html/draft-serhrouchni-tls-certieee1609-01 | h= ttps://tools.ietf.org/html/draft-serhrouchni-tls-certieee1609-01 ] |=20 > [ https://tools.ietf.org/html/draft-serhrouchni-tls-certieee1609-01 | htt= ps://tools.ietf.org/html/draft-serhrouchni-tls-certieee1609-01 ] ] We will= =20 > update the draft=20 wouldn't then it be better to combine them and have one standard (document)= =20 that describes use in TLS 1.2 and TLS 1.3? I may be missing something but I= =20 don't see anything that would prevent use of the same codepoints in both=20 protocol versions=20 --=20 Regards,=20 Hubert Kario=20 Senior Quality Engineer, QE BaseOS Security team=20 Web: [ http://www.cz.redhat.com/ | www.cz.redhat.com ]=20 Red Hat Czech s.r.o., Purky=C5=88ova 115, 612 00 Brno, Czech Republic=20 _______________________________________________=20 TLS mailing list=20 [ mailto:TLS@ietf.org | TLS@ietf.org ]=20 [ https://www.ietf.org/mailman/listinfo/tls | https://www.ietf.org/mailman/= listinfo/tls ]=20 BQ_END From nobody Mon Aug 27 10:39:27 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D7F9E127148 for ; Mon, 27 Aug 2018 10:39:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gOSHtKJczCOe for ; Mon, 27 Aug 2018 10:39:24 -0700 (PDT) Received: from mx1.redhat.com (mx3-rdu2.redhat.com [66.187.233.73]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 29D3C124BE5 for ; Mon, 27 Aug 2018 10:39:24 -0700 (PDT) Received: from smtp.corp.redhat.com (int-mx05.intmail.prod.int.rdu2.redhat.com [10.11.54.5]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 532C340201CB; Mon, 27 Aug 2018 17:39:23 +0000 (UTC) Received: from pintsize.usersys.redhat.com (unknown [10.43.21.250]) by smtp.corp.redhat.com (Postfix) with ESMTP id A22919464C; Mon, 27 Aug 2018 17:39:22 +0000 (UTC) From: Hubert Kario To: tls@ietf.org Cc: Mounira Msahli , Ilari Liusvaara Date: Mon, 27 Aug 2018 19:39:12 +0200 Message-ID: <6170599.o3dyPvx8Gh@pintsize.usersys.redhat.com> In-Reply-To: <235113009.594519.1535390674699.JavaMail.zimbra@enst.fr> References: <1231917830.3727154.1535119783361.JavaMail.zimbra@enst.fr> <20180827163405.GA19628@LK-Perkele-VII> <235113009.594519.1535390674699.JavaMail.zimbra@enst.fr> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="nextPart2837193.Rxpt9CSQf6"; micalg="pgp-sha512"; protocol="application/pgp-signature" X-Scanned-By: MIMEDefang 2.79 on 10.11.54.5 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.11.55.6]); Mon, 27 Aug 2018 17:39:23 +0000 (UTC) X-Greylist: inspected by milter-greylist-4.5.16 (mx1.redhat.com [10.11.55.6]); Mon, 27 Aug 2018 17:39:23 +0000 (UTC) for IP:'10.11.54.5' DOMAIN:'int-mx05.intmail.prod.int.rdu2.redhat.com' HELO:'smtp.corp.redhat.com' FROM:'hkario@redhat.com' RCPT:'' Archived-At: Subject: Re: [TLS] TLS 1.3 Authentication using ETSI TS 103 097 and IEEE 1609.2 certificates X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Aug 2018 17:39:26 -0000 --nextPart2837193.Rxpt9CSQf6 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="UTF-8" On Monday, 27 August 2018 19:24:34 CEST Mounira Msahli wrote: > One could abbrevate the handshake traces to just show the relevant > parts (which could also cut some clutter)? I think the relevant > messages always occur in the same order (clienthello, serverhello/ > encryptedextensions, certificate, certificate). the draft doesn't change the order of messages, doesn't add new messages an= d=20 doesn't change the place in which the relevant extensions are placed =E2=80= =93 so,=20 what is the utility of duplicating the message flow from the TLS RFCs? e.g. RFC 8449 and RFC 7685 don't, and they did define new extensions > The table in section 4.2. Extensions of [RFC 8446] (TLS 1.3) indicates t= he > messages where a given extension may > appear: > | client_certificate_type [RFC7250] | CH, EE | > |=20 > | server_certificate_type [RFC7250] | CH, EE | >=20 > But in RFC 7250 (TLS 1.2), the same extensions could appear in CH and SH. correct, this RFC 8446 table applies only to connections that negotiated TL= S=20 1.3 =2D-=20 Regards, Hubert Kario Senior Quality Engineer, QE BaseOS Security team Web: www.cz.redhat.com Red Hat Czech s.r.o., Purky=C5=88ova 115, 612 00 Brno, Czech Republic --nextPart2837193.Rxpt9CSQf6 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part. Content-Transfer-Encoding: 7Bit -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEYeeuxEU+3unL/K+dkqjRuAHS9fUFAluEN0AACgkQkqjRuAHS 9fVY/BAAmYZb83Q2ZgP+z8CLHIGllk+Pu69msz01Y5mYkiBQJoAA11yUkdhKBKwH 8jlVL8M5KNVBKFOCUI46yKON/hW2SYRu5OvAXlLoVbIiKRmfVV1haNeNgWc0fnVP vozazMWgVWoTJw32wAXT/hCslXjIoN+LDRHoEK6rE9FfOPTAkOcEVmnaWJSFBcCl /nMc1NDIXFPOtiRwzPY4MMveVXfHQFuHn+cIiVizVe3ragUl5fFOIat61f4iupwa tiamohtphKpqiURii4zoE9IIxAVHkFrqpxTRfJMrsdzrHjvV4dEOyyA/cMZbCIT2 ql6a4XoU6qlqpZDReejITlQ8s4Mf0xKZfVPSwuTDmJPC2qSKG5Gmk0z8mppDQdfD nANSvFmNFpHDZqi3C9SeDdKuBHUM5clFLCkn0gKgxeAjLOL0e3T0WXEZmTdtBKcl mSmui8C/n+G9QiUVBlE4rHUnvLfuiXcszrLU9rDQq5iZkD7We5UI+380/dda+DMG KCFx20eIdIfw4Rr9BMcthoLB05/hvzrVW29O7vQrBI7JpH79YHnisOW+erphA/v+ TBj6i6l0x4/n7XLb0szPVakspVxsG4dlZT8FmKc/Z5H048HWbhUjYcQLvHD39syn jyxb5MIEB28dKOBDs+FVEjHcwBzEyxa748C9pwANxEu3BlDQ+eg= =5Oqj -----END PGP SIGNATURE----- --nextPart2837193.Rxpt9CSQf6-- From nobody Mon Aug 27 15:32:18 2018 Return-Path: X-Original-To: tls@ietf.org Delivered-To: tls@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id D68A0130E3C; Mon, 27 Aug 2018 15:32:16 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: IESG Secretary To: "IETF-Announce" Cc: tls@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.83.1 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <153540913675.29910.4522740033148427612@ietfa.amsl.com> Date: Mon, 27 Aug 2018 15:32:16 -0700 Archived-At: Subject: [TLS] Transport Layer Security (tls) WG Virtual Meeting: 2018-09-14 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Aug 2018 22:32:17 -0000 The Transport Layer Security (tls) Working Group will hold a virtual interim meeting on 2018-09-14 from 10:00 to 12:00 America/Los_Angeles. Agenda: Next steps for draft-ietf-tls-dnssec-chain-extension. Information about remote participation: Remote participation information will be obtained at the time of approval From nobody Mon Aug 27 20:30:14 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1492C130E2C for ; Mon, 27 Aug 2018 20:30:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hfmn23fawoBI for ; Mon, 27 Aug 2018 20:30:10 -0700 (PDT) Received: from rfc-editor.org (rfc-editor.org [4.31.198.49]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 78507130E01 for ; Mon, 27 Aug 2018 20:30:10 -0700 (PDT) Received: by rfc-editor.org (Postfix, from userid 30) id 70F7CB81122; Mon, 27 Aug 2018 20:29:52 -0700 (PDT) To: ekr@rtfm.com, kaduk@mit.edu, ekr@rtfm.com, christopherwood07@gmail.com, joe@salowey.net, sean+ietf@sn3rd.com X-PHP-Originating-Script: 30:errata_mail_lib.php From: RFC Errata System Cc: pat.kelsey@notforadio.com, tls@ietf.org, rfc-editor@rfc-editor.org Content-Type: text/plain; charset=UTF-8 Message-Id: <20180828032952.70F7CB81122@rfc-editor.org> Date: Mon, 27 Aug 2018 20:29:52 -0700 (PDT) Archived-At: Subject: [TLS] [Technical Errata Reported] RFC8446 (5483) X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Aug 2018 03:30:13 -0000 The following errata report has been submitted for RFC8446, "The Transport Layer Security (TLS) Protocol Version 1.3". -------------------------------------- You may review the report below and at: http://www.rfc-editor.org/errata/eid5483 -------------------------------------- Type: Technical Reported by: Patrick Kelsey Section: 4.2.8.2 Original Text ------------- For X25519 and X448, the contents of the public value are the byte string inputs and outputs of the corresponding functions defined in [RFC7748]: 32 bytes for X25519 and 56 bytes for X448. Corrected Text -------------- For X25519 and X448, the contents of the public value are the byte string outputs of the corresponding functions defined in [RFC7748]: 32 bytes for X25519 and 56 bytes for X448. Notes ----- Per Section 7.4.2 of this RFC and Section 6 of RFC7748, the byte string inputs to the corresponding ECDH scalar multiplication function are the private key and the u-coordinate of the standard public base point, the former of which of course must not be transmitted and the latter of which is a known constant. >From another perspective, including the byte string inputs in the contents of the public value would contradict the resulting content sizes given at the end of the cited paragraph as well as the statement in Section 7.4.2 that the public key put into the KeyShareEntry is the output of ECDH scalar multiplication function. Instructions: ------------- This erratum is currently posted as "Reported". If necessary, please use "Reply All" to discuss whether it should be verified or rejected. When a decision is reached, the verifying party can log in to change the status and edit the report, if necessary. -------------------------------------- RFC8446 (draft-ietf-tls-tls13-28) -------------------------------------- Title : The Transport Layer Security (TLS) Protocol Version 1.3 Publication Date : August 2018 Author(s) : E. Rescorla Category : PROPOSED STANDARD Source : Transport Layer Security Area : Security Stream : IETF Verifying Party : IESG From nobody Tue Aug 28 01:14:37 2018 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 21449130DC1 for ; Tue, 28 Aug 2018 01:14:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=telecom-paristech.fr Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TKt1Lfsq0zcM for ; Tue, 28 Aug 2018 01:14:33 -0700 (PDT) Received: from zproxy130.enst.fr (zproxy130.enst.fr [IPv6:2001:660:330f:2::c2]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 262A9129C6B for ; Tue, 28 Aug 2018 01:14:33 -0700 (PDT) Received: from localhost (localhost [IPv6:::1]) by zproxy130.enst.fr (Postfix) with ESMTP id 822C7120771; Tue, 28 Aug 2018 10:14:31 +0200 (CEST) Received: from zproxy130.enst.fr ([IPv6:::1]) by localhost (zproxy130.enst.fr [IPv6:::1]) (amavisd-new, port 10032) with ESMTP id ko_wcGcKy-Zk; Tue, 28 Aug 2018 10:14:30 +0200 (CEST) Received: from localhost (localhost [IPv6:::1]) by zproxy130.enst.fr (Postfix) with ESMTP id 55A8F120770; Tue, 28 Aug 2018 10:14:30 +0200 (CEST) DKIM-Filter: OpenDKIM Filter v2.10.3 zproxy130.enst.fr 55A8F120770 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=telecom-paristech.fr; s=A6AEC2EE-1106-11E5-B10E-D103FDDA8F2E; t=1535444070; bh=3iBNO1ty/RwC4aUQE29zXgU6C+6uQ/R7sMXQF1fBUQ4=; h=Date:From:To:Message-ID:MIME-Version; b=cN6p64V+RohlrMpSvj14RpWJos3j0LFX7Tgcr1LWEHJl+KfgNTCyESBnazCeycMXr AX8/bgnkPR3bBrrxTl2NMy+t5A0I4oSahe+zjqmnPfDyS3r03ab4OYXrQTg7bBu4Sl 5j3MdLXa9lWmUlIVitgipqS2zul4Jl+s1IPhnypg= X-Virus-Scanned: amavisd-new at zproxy130.enst.fr Received: from zproxy130.enst.fr ([IPv6:::1]) by localhost (zproxy130.enst.fr [IPv6:::1]) (amavisd-new, port 10026) with ESMTP id T-B4eCUUOtO7; Tue, 28 Aug 2018 10:14:30 +0200 (CEST) Received: from zmail112.enst.fr (zmail112.enst.fr [137.194.2.205]) by zproxy130.enst.fr (Postfix) with ESMTP id 18A43120771; Tue, 28 Aug 2018 10:14:30 +0200 (CEST) Date: Tue, 28 Aug 2018 10:14:29 +0200 (CEST) From: Mounira Msahli To: Hubert Kario Cc: tls , Ilari Liusvaara Message-ID: <820448498.714156.1535444069960.JavaMail.zimbra@enst.fr> In-Reply-To: <6170599.o3dyPvx8Gh@pintsize.usersys.redhat.com> References: <1231917830.3727154.1535119783361.JavaMail.zimbra@enst.fr> <20180827163405.GA19628@LK-Perkele-VII> <235113009.594519.1535390674699.JavaMail.zimbra@enst.fr> <6170599.o3dyPvx8Gh@pintsize.usersys.redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-Originating-IP: [2001:660:330f:cc:f9c7:bf8d:8c3b:8542] X-Mailer: Zimbra 8.8.9_GA_3019 (ZimbraWebClient - FF61 (Linux)/8.8.9_GA_3019) Thread-Topic: TLS 1.3 Authentication using ETSI TS 103 097 and IEEE 1609.2 certificates Thread-Index: 34tCbl3dqt+HJChBWGoQu9V0xufUTg== Archived-At: Subject: Re: [TLS] TLS 1.3 Authentication using ETSI TS 103 097 and IEEE 1609.2 certificates X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Aug 2018 08:14:35 -0000 the draft doesn't change the order of messages, doesn't add new messages an= d=20 doesn't change the place in which the relevant extensions are placed =E2=80= =93 so,=20 what is the utility of duplicating the message flow from the TLS RFCs?=20 >>> The extension could be specified as RFC 7250=20 >>> For the extension, TLS Client and Server Handshake Behavior shall be sp= ecified for two TLS versions. Kind Regards=20 Mounira=20 ----- Mail original ----- De: "Hubert Kario" redhat.com> =C3=80: "tls" Cc: "Mounira Msahli" , "Ilari Liusvaara" com> Envoy=C3=A9: Lundi 27 Ao=C3=BBt 2018 19:39:12 Objet: Re: [TLS] TLS 1.3 Authentication using ETSI TS 103 097 and IEEE 1609= .2 certificates On Monday, 27 August 2018 19:24:34 CEST Mounira Msahli wrote:=20 > One could abbrevate the handshake traces to just show the relevant=20 > parts (which could also cut some clutter)? I think the relevant=20 > messages always occur in the same order (clienthello, serverhello/=20 > encryptedextensions, certificate, certificate).=20 the draft doesn't change the order of messages, doesn't add new messages an= d=20 doesn't change the place in which the relevant extensions are placed =E2=80= =93 so,=20 what is the utility of duplicating the message flow from the TLS RFCs?=20 e.g. RFC 8449 and RFC 7685 don't, and they did define new extensions=20 > The table in section 4.2. Extensions of [RFC 8446] (TLS 1.3) indicates th= e=20 > messages where a given extension may=20 > appear:=20 > | client_certificate_type [RFC7250] | CH, EE |=20 > |=20 > | server_certificate_type [RFC7250] | CH, EE |=20 >=20 > But in RFC 7250 (TLS 1.2), the same extensions could appear in CH and SH.= =20 correct, this RFC 8446 table applies only to connections that negotiated TL= S=20 1.3=20 --=20 Regards,=20 Hubert Kario=20 Senior Quality Engineer, QE BaseOS Security team=20 Web: www.cz.redhat.com=20 Red Hat Czech s.r.o., Purky=C5=88ova 115, 612 00 Brno, Czech Republic=20