From nobody Mon Jul 1 08:12:37 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 473ED1200DE for ; Mon, 1 Jul 2019 08:12:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.5 X-Spam-Level: X-Spam-Status: No, score=-17.5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id m6ankjvRJQkv for ; Mon, 1 Jul 2019 08:12:31 -0700 (PDT) Received: from mail-ua1-x929.google.com (mail-ua1-x929.google.com [IPv6:2607:f8b0:4864:20::929]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 382A21200CC for ; Mon, 1 Jul 2019 08:12:31 -0700 (PDT) Received: by mail-ua1-x929.google.com with SMTP id 8so5187692uaz.11 for ; Mon, 01 Jul 2019 08:12:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=8a3kk8M6lR1eJd+oluxgODlQiWadQiAXf5RHDuGi9RM=; b=LwmrhLcQFV2WfKR6TuynLTEvOS4JqkdFINKpDRISVt5iTHk/kYyySdMRowjGS7sPoJ TT2qcg0xvW8vdE4dtEtT4i6DAUkP7cmEfNXS8xQfO+rEko2CX4/IWcfUTQBDC25mefaC xZDz9ZmNIQ0azXMcv/5Woi0ED8gAWBHmao+3QZwQD9O/3PyxxNkVcC8NtBOeKwg2GRhs b/U6WfB2kJX2LddrXjJdU3jFfr69TDWvNODTIAziGcdo6YkGe6cvkOzTo+N5ubaVrHW9 SCtDwCUIKIqJypgFJOj35OYHwmzs0WAvxKFv9MEvSwQX850oT+/RFXkd5xg2Hqblg2e9 c6DQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=8a3kk8M6lR1eJd+oluxgODlQiWadQiAXf5RHDuGi9RM=; b=cSUiIxzpgcL1JcFzyrQJVup+/HA7vIJM6fU/X9YNAW/MZYkP56Q6m0avA/0zvvNZ2h NzHxd0QFt/WocpSiusvJDJHrrC/i+emQfIEJ+7tPodUGgKVXqIRyCfojctKvG79aklQT KJo+CdOlV8A35PNP4/vZemw2i5s5m26CNzp9ta8xAdeBkAGn3FpoOzo5cgoPatPhUQg/ OWezPOpbrPQOU4NpgxfZO/sVtC2JERT4UpHxbNqGNKGjRvp+F7pnT0PH8XMR2jccW+Gr QdgZ00Ul7GKnfSt2U5ddbtS8MKeD5k2cWjrD5V5CmCA/TyNbbEFL+H3dk93lw8CkasRh zSIg== X-Gm-Message-State: APjAAAVpGmGaTI6aD2GG3tZRHSdtn61V9YO/SmPEFzqQ2sXl7cTPyLzY JNCXaC7BQx6BgRptdaimzUFYQKJbIkuEgCqgQAvetqPSbio= X-Google-Smtp-Source: APXvYqzu9T8O7U1xrXrqmrIrjs+P7irUtP4OnF//8/M9xpFqyxDjamyUsgXHzAone4QCpI5WjGHGClqiYhDfdluind0= X-Received: by 2002:ab0:3d2:: with SMTP id 76mr14490485uau.12.1561993949732; Mon, 01 Jul 2019 08:12:29 -0700 (PDT) MIME-Version: 1.0 References: <156173339678.20700.10472293883370612968.idtracker@ietfa.amsl.com> In-Reply-To: From: Ben Schwartz Date: Mon, 1 Jul 2019 11:12:16 -0400 Message-ID: To: Martin Thomson Cc: "" Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="0000000000008c241a058ca00e00" Archived-At: Subject: Re: [TLS] Fwd: New Version Notification for draft-schwartz-tls-lb-00.txt X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 01 Jul 2019 15:12:34 -0000 --0000000000008c241a058ca00e00 Content-Type: multipart/alternative; boundary="000000000000843eb3058ca00e9a" --000000000000843eb3058ca00e9a Content-Type: text/plain; charset="UTF-8" On Sun, Jun 30, 2019 at 11:36 PM Martin Thomson wrote: > You might like to coordinate with Martin Duke, who is doing similar (but > different) things with QUIC: > > https://tools.ietf.org/html/draft-duke-quic-load-balancers-04 Thanks for this reference. I was not aware of it. Personally, I find this sort of thing difficult to reason about. I would > rather have a separate TLS connection with each backend than to overload or > annotate connections. To be clear, are you suggesting TLS-in-TLS, similar to Stephen's suggestion? Or are you suggesting a parallel connection to deliver the metadata? > Cramming stuff ahead of the real connection is awkward, but I can see how > that might be necessary in order to get back-end systems ready for the new > connection. That won't be sufficient for QUIC though. > > As an aside, the proposed design for QUIC is a very good way to ossify the > QUIC handshake. I don't think that's a good way to do this, even if I > believed that the potential growth in MTU was not a problem. > I don't believe this design introduces any ossification risk beyond that inherent in split-mode ESNI. Split-mode ESNI inherently requires that the load balancer be able to read the ClientHello out of the packet it arrives in, and that is also the only requirement here. I would have thought it easier to use an exporter (plus one to provide a > key identifier) to get shared keys -- if you need them. I don't think that > you do though. > > If you look at Martin Duke's design, the load balancer acts as an oracle. It does? I don't see any oracular behavior. The cryptography appears to consist of a single PSK that is shared by the load balancer and all its servers, and is passed between them in cleartext. > It can do that for ESNI in the split mode you envisage. > I can certainly imagine an ESNI oracle, at the cost of a delay while the backend queries the oracle. Is that what you're imagining? If we assume working 0-RTT, TLS-in-TLS might have less latency overhead than an oracle. Alternatively, we could imagine a "push oracle", at the cost of potentially severe implementation complexity to handle reorderings, failures, etc. On Sat, Jun 29, 2019, at 02:52, Ben Schwartz wrote: > > Hi TLS, > > > > This is a proposal for a very simple new protocol whose main purpose is > > to enable ESNI "split mode". Ultimately, I hope that this protocol can > > also enable more end-to-end TLS, by reducing the need for > > load-balancers to terminate TLS. > > > > Please discuss. > > > > Thanks, > > Ben Schwartz > > > > ---------- Forwarded message --------- > > > > A new version of I-D, draft-schwartz-tls-lb-00.txt > > has been successfully submitted by Benjamin M. Schwartz and posted to > the > > IETF repository. > > > > Name: draft-schwartz-tls-lb > > Revision: 00 > > Title: TLS Metadata for Load Balancers > > Document date: 2019-06-28 > > Group: Individual Submission > > Pages: 8 > > URL: https://www.ietf.org/internet-drafts/draft-schwartz-tls-lb-00.txt > > Status: https://datatracker.ietf.org/doc/draft-schwartz-tls-lb/ > > Htmlized: https://tools.ietf.org/html/draft-schwartz-tls-lb-00 > > Htmlized: https://datatracker.ietf.org/doc/html/draft-schwartz-tls-lb > > > > > > Abstract: > > A load balancer that does not terminate TLS may wish to provide some > > information to the backend server, in addition to forwarding TLS > > data. This draft proposes a protocol between load balancers and > > backends that enables secure, efficient delivery of TLS with > > additional information. The need for such a protocol has recently > > become apparent in the context of split mode ESNI. > > > > > > > > > > Please note that it may take a couple of minutes from the time of > submission > > until the htmlized version and diff are available at tools.ietf.org. > > > > The IETF Secretariat > > > > _______________________________________________ > > TLS mailing list > > TLS@ietf.org > > https://www.ietf.org/mailman/listinfo/tls > > > > Attachments: > > * smime.p7s > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > --000000000000843eb3058ca00e9a Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Sun, Jun 30, 2019 at 11:36 PM Martin T= homson <mt@lowentropy.net> w= rote:
You might like to coordinate with Martin Duke, who is doin= g similar (but different) things with QUIC:

https://tools.ietf.org/html/draft-duke-= quic-load-balancers-04

Thanks for this = reference.=C2=A0 I was not aware of it.

Personally, I find this sort of thing difficult to reason about.=C2=A0 I wo= uld rather have a separate TLS connection with each backend than to overloa= d or annotate connections.

To be clear, are= you suggesting TLS-in-TLS, similar to Stephen's suggestion?=C2=A0 Or a= re you suggesting a parallel connection to deliver the metadata?
= =C2=A0
Cramming stuf= f ahead of the real connection is awkward, but I can see how that might be = necessary in order to get back-end systems ready for the new connection.=C2= =A0 That won't be sufficient for QUIC though.

As an aside, the proposed design for QUIC is a very good way to ossify the = QUIC handshake.=C2=A0 I don't think that's a good way to do this, e= ven if I believed that the potential growth in MTU was not a problem.

I don't believe this design introduces a= ny ossification risk beyond that inherent in split-mode ESNI.=C2=A0 Split-m= ode ESNI inherently requires that the load balancer be able to read the Cli= entHello out of the packet it arrives in, and that is also the only require= ment here.

I would have thought it easier to use an exporter (plus one to provide a ke= y identifier) to get shared keys -- if you need them.=C2=A0 I don't thi= nk that you do though.

If you look at Martin Duke's design, the load balancer acts as an oracl= e.

It does?=C2=A0 I don't see any oracu= lar behavior.=C2=A0 The cryptography appears to consist of a single PSK tha= t is shared by the load balancer and all its servers, and is passed between= them in cleartext.
=C2=A0
It can do that for ESNI in the split mode you e= nvisage.

I can certainly imagine an ESN= I oracle, at the cost of a delay while the backend queries the oracle.=C2= =A0 Is that what you're imagining?

If we assum= e working 0-RTT, TLS-in-TLS might have less latency overhead than an oracle= .=C2=A0 Alternatively, we could imagine a "push oracle", at the c= ost of potentially severe implementation complexity to handle reorderings, = failures, etc.

On Sat, Jun 29, 2019, at 02:52, Ben Schwartz wrote:
> Hi TLS,
>
> This is a proposal for a very simple new protocol whose main purpose i= s
> to enable ESNI "split mode". Ultimately, I hope that this pr= otocol can
> also enable more end-to-end TLS, by reducing the need for
> load-balancers to terminate TLS.
>
> Please discuss.
>
> Thanks,
> Ben Schwartz
>
> ---------- Forwarded message ---------
>
>=C2=A0 A new version of I-D, draft-schwartz-tls-lb-00.txt
>=C2=A0 has been successfully submitted by Benjamin M. Schwartz and post= ed to the
>=C2=A0 IETF repository.
>
>=C2=A0 Name: draft-schwartz-tls-lb
>=C2=A0 Revision: 00
>=C2=A0 Title: TLS Metadata for Load Balancers
>=C2=A0 Document date: 2019-06-28
>=C2=A0 Group: Individual Submission
>=C2=A0 Pages: 8
>=C2=A0 URL: https://www.ietf.or= g/internet-drafts/draft-schwartz-tls-lb-00.txt
>=C2=A0 Status: https://datatracker.ietf.o= rg/doc/draft-schwartz-tls-lb/
>=C2=A0 Htmlized: https://tools.ietf.org/html= /draft-schwartz-tls-lb-00
>=C2=A0 Htmlized: https://datatracker.= ietf.org/doc/html/draft-schwartz-tls-lb
>
>
>=C2=A0 Abstract:
>=C2=A0 A load balancer that does not terminate TLS may wish to provide = some
>=C2=A0 information to the backend server, in addition to forwarding TLS=
>=C2=A0 data. This draft proposes a protocol between load balancers and<= br> >=C2=A0 backends that enables secure, efficient delivery of TLS with
>=C2=A0 additional information. The need for such a protocol has recentl= y
>=C2=A0 become apparent in the context of split mode ESNI.
>
>
>
>
>=C2=A0 Please note that it may take a couple of minutes from the time o= f submission
>=C2=A0 until the htmlized version and diff are available at tools.ietf.org<= /a>.
>
>=C2=A0 The IETF Secretariat
>
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
>
> Attachments:
> * smime.p7s

_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls
--000000000000843eb3058ca00e9a-- --0000000000008c241a058ca00e00 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIIS5wYJKoZIhvcNAQcCoIIS2DCCEtQCAQExDzANBglghkgBZQMEAgEFADALBgkqhkiG9w0BBwGg ghBNMIIEXDCCA0SgAwIBAgIOSBtqDm4P/739RPqw/wcwDQYJKoZIhvcNAQELBQAwZDELMAkGA1UE BhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVy c29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hBMjU2IC0gRzIwHhcNMTYwNjE1MDAwMDAwWhcNMjEw NjE1MDAwMDAwWjBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xvYmFsU2lnbiBudi1zYTEiMCAG A1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC AQoCggEBALR23lKtjlZW/17kthzYcMHHKFgywfc4vLIjfq42NmMWbXkNUabIgS8KX4PnIFsTlD6F GO2fqnsTygvYPFBSMX4OCFtJXoikP2CQlEvO7WooyE94tqmqD+w0YtyP2IB5j4KvOIeNv1Gbnnes BIUWLFxs1ERvYDhmk+OrvW7Vd8ZfpRJj71Rb+QQsUpkyTySaqALXnyztTDp1L5d1bABJN/bJbEU3 Hf5FLrANmognIu+Npty6GrA6p3yKELzTsilOFmYNWg7L838NS2JbFOndl+ce89gM36CW7vyhszi6 6LqqzJL8MsmkP53GGhf11YMP9EkmawYouMDP/PwQYhIiUO0CAwEAAaOCASIwggEeMA4GA1UdDwEB /wQEAwIBBjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwEgYDVR0TAQH/BAgwBgEB/wIB ADAdBgNVHQ4EFgQUyzgSsMeZwHiSjLMhleb0JmLA4D8wHwYDVR0jBBgwFoAUJiSSix/TRK+xsBtt r+500ox4AAMwSwYDVR0fBEQwQjBAoD6gPIY6aHR0cDovL2NybC5nbG9iYWxzaWduLmNvbS9ncy9n c3BlcnNvbmFsc2lnbnB0bnJzc2hhMmcyLmNybDBMBgNVHSAERTBDMEEGCSsGAQQBoDIBKDA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzANBgkqhkiG 9w0BAQsFAAOCAQEACskdySGYIOi63wgeTmljjA5BHHN9uLuAMHotXgbYeGVrz7+DkFNgWRQ/dNse Qa4e+FeHWq2fu73SamhAQyLigNKZF7ZzHPUkSpSTjQqVzbyDaFHtRBAwuACuymaOWOWPePZXOH9x t4HPwRQuur57RKiEm1F6/YJVQ5UTkzAyPoeND/y1GzXS4kjhVuoOQX3GfXDZdwoN8jMYBZTO0H5h isymlIl6aot0E5KIKqosW6mhupdkS1ZZPp4WXR4frybSkLejjmkTYCTUmh9DuvKEQ1Ge7siwsWgA NS1Ln+uvIuObpbNaeAyMZY0U5R/OyIDaq+m9KXPYvrCZ0TCLbcKuRzCCBB4wggMGoAMCAQICCwQA AAAAATGJxkCyMA0GCSqGSIb3DQEBCwUAMEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAt IFIzMRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWduMB4XDTExMDgwMjEw MDAwMFoXDTI5MDMyOTEwMDAwMFowZDELMAkGA1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24g bnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVyc29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hB MjU2IC0gRzIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCg/hRKosYAGP+P7mIdq5NB Kr3J0tg+8lPATlgp+F6W9CeIvnXRGUvdniO+BQnKxnX6RsC3AnE0hUUKRaM9/RDDWldYw35K+sge C8fWXvIbcYLXxWkXz+Hbxh0GXG61Evqux6i2sKeKvMr4s9BaN09cqJ/wF6KuP9jSyWcyY+IgL6u2 52my5UzYhnbf7D7IcC372bfhwM92n6r5hJx3r++rQEMHXlp/G9J3fftgsD1bzS7J/uHMFpr4MXua eoiMLV5gdmo0sQg23j4pihyFlAkkHHn4usPJ3EePw7ewQT6BUTFyvmEB+KDoi7T4RCAZDstgfpzD rR/TNwrK8/FXoqnFAgMBAAGjgegwgeUwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8C AQEwHQYDVR0OBBYEFCYkkosf00SvsbAbba/udNKMeAADMEcGA1UdIARAMD4wPAYEVR0gADA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzA2BgNVHR8E LzAtMCugKaAnhiVodHRwOi8vY3JsLmdsb2JhbHNpZ24ubmV0L3Jvb3QtcjMuY3JsMB8GA1UdIwQY MBaAFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQACAFVjHihZCV/IqJYt 7Nig/xek+9g0dmv1oQNGYI1WWeqHcMAV1h7cheKNr4EOANNvJWtAkoQz+076Sqnq0Puxwymj0/+e oQJ8GRODG9pxlSn3kysh7f+kotX7pYX5moUa0xq3TCjjYsF3G17E27qvn8SJwDsgEImnhXVT5vb7 qBYKadFizPzKPmwsJQDPKX58XmPxMcZ1tG77xCQEXrtABhYC3NBhu8+c5UoinLpBQC1iBnNpNwXT Lmd4nQdf9HCijG1e8myt78VP+QSwsaDT7LVcLT2oDPVggjhVcwljw3ePDwfGP9kNrR+lc8XrfClk WbrdhC2o4Ui28dtIVHd3MIIDXzCCAkegAwIBAgILBAAAAAABIVhTCKIwDQYJKoZIhvcNAQELBQAw TDEgMB4GA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjMxEzARBgNVBAoTCkdsb2JhbFNpZ24x EzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDkwMzE4MTAwMDAwWhcNMjkwMzE4MTAwMDAwWjBMMSAw HgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMzETMBEGA1UEChMKR2xvYmFsU2lnbjETMBEG A1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMwldpB5Bngi FvXAg7aEyiie/QV2EcWtiHL8RgJDx7KKnQRfJMsuS+FggkbhUqsMgUdwbN1k0ev1LKMPgj0MK66X 17YUhhB5uzsTgHeMCOFJ0mpiLx9e+pZo34knlTifBtc+ycsmWQ1z3rDI6SYOgxXG71uL0gRgykmm KPZpO/bLyCiR5Z2KYVc3rHQU3HTgOu5yLy6c+9C7v/U9AOEGM+iCK65TpjoWc4zdQQ4gOsC0p6Hp sk+QLjJg6VfLuQSSaGjlOCZgdbKfd/+RFO+uIEn8rUAVSNECMWEZXriX7613t2Saer9fwRPvm2L7 DWzgVGkWqQPabumDk3F2xmmFghcCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQF MAMBAf8wHQYDVR0OBBYEFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQBL QNvAUKr+yAzv95ZURUm7lgAJQayzE4aGKAczymvmdLm6AC2upArT9fHxD4q/c2dKg8dEe3jgr25s bwMpjjM5RcOO5LlXbKr8EpbsU8Yt5CRsuZRj+9xTaGdWPoO4zzUhw8lo/s7awlOqzJCK6fBdRoyV 3XpYKBovHd7NADdBj+1EbddTKJd+82cEHhXXipa0095MJ6RMG3NzdvQXmcIfeg7jLQitChws/zyr VQ4PkX4268NXSb7hLi18YIvDQVETI53O9zJrlAGomecsMx86OyXShkDOOyyGeMlhLxS67ttVb9+E 7gUJTb0o2HLO02JQZR7rkpeDMdmztcpHWD9fMIIEZDCCA0ygAwIBAgIMB/CJK1MgpV83jiIZMA0G CSqGSIb3DQEBCwUAMEwxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMSIw IAYDVQQDExlHbG9iYWxTaWduIEhWIFMvTUlNRSBDQSAxMB4XDTE5MDMxMzA4MjIxOVoXDTE5MDkw OTA4MjIxOVowIjEgMB4GCSqGSIb3DQEJAQwRYmVtYXNjQGdvb2dsZS5jb20wggEiMA0GCSqGSIb3 DQEBAQUAA4IBDwAwggEKAoIBAQCsphkGEsCh0fF4+6Wsi1u40JxI6W6Izew+dLGK4b93LCRAuJ8y g9wSnwGAtk9/23VmtKwBrMaJD5j9SVZpscvLAjrWwADl/THU22uTW0MsUE2fPOPv2s4hE+vMgRmK P2E+xpI6n0gFvn8qrUHO1dm6PJaP5SWa+zdB/Ja1LgMJTpevQqjK4LKjWmHFPR6CplS4RImjGk7U 0I6invTyQnL5p583t5PI7FcM5UyjAqxGEETdAuc7N4IqjNETvPwL0wLIzxPDA5PMqcWPSzg7sBAB LVUQRYNIAJPlVpUdg1IeAjil5BaaWBjEeCLBSGDFX3WaWfMNzQvRZr4i6oJxzV+1AgMBAAGjggFu MIIBajAcBgNVHREEFTATgRFiZW1hc2NAZ29vZ2xlLmNvbTBQBggrBgEFBQcBAQREMEIwQAYIKwYB BQUHMAKGNGh0dHA6Ly9zZWN1cmUuZ2xvYmFsc2lnbi5jb20vY2FjZXJ0L2dzaHZzbWltZWNhMS5j cnQwHQYDVR0OBBYEFFSy8ovdLNSQc8aqxOgKS7sBOm/UMB8GA1UdIwQYMBaAFMs4ErDHmcB4koyz IZXm9CZiwOA/MEwGA1UdIARFMEMwQQYJKwYBBAGgMgEoMDQwMgYIKwYBBQUHAgEWJmh0dHBzOi8v d3d3Lmdsb2JhbHNpZ24uY29tL3JlcG9zaXRvcnkvMDsGA1UdHwQ0MDIwMKAuoCyGKmh0dHA6Ly9j cmwuZ2xvYmFsc2lnbi5jb20vZ3NodnNtaW1lY2ExLmNybDAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0l BBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMA0GCSqGSIb3DQEBCwUAA4IBAQCbQ++Znz6xh85ZlZEN Y/vAF0vn111O0c2houe4LlLQkoQ1QS4fH5EYcBx/393FTq5n08ezWYVtmeQ6W15e34CqjYNop1Vh mihZ+3J6+LL/6YNi91cp5yMFgxOP9aI/Y8IaIWZJAY2e8yHbYSq0z8kka0H6S4VvFjwtRogkWW95 0SStEwo/8viJ02BwpmVj4YIA6Fva1ZbeN2TnUMCAHJAlKWOGlpHxpcdcWckED0XbSY9w6bllMw1T tsbiUwQxDeO++Y8NfS8rieZgfv3RlobKihE8xbIVGRHIq1gup4nXv6XDwHDYyGhafIfUD4Ix00Wk gnODGb+jPwoQlDX0X64qMYICXjCCAloCAQEwXDBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xv YmFsU2lnbiBudi1zYTEiMCAGA1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMQIMB/CJK1Mg pV83jiIZMA0GCWCGSAFlAwQCAQUAoIHUMC8GCSqGSIb3DQEJBDEiBCDVY/4IxORvqt0hTN49xSYu 82ka8MyoDs3CVdNEFdq/GTAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEP Fw0xOTA3MDExNTEyMzBaMGkGCSqGSIb3DQEJDzFcMFowCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQB FjALBglghkgBZQMEAQIwCgYIKoZIhvcNAwcwCwYJKoZIhvcNAQEKMAsGCSqGSIb3DQEBBzALBglg hkgBZQMEAgEwDQYJKoZIhvcNAQEBBQAEggEAUkEDCdlMztCLAwP78aUYW1/sNLDziKRBcz2J+the 9kkrl9u7vlXiOxGKz3mhu0jw9+loX/d+MFiGoxR7wHv38Q9Mz1M//+7n6l/lO2HPM6xzui+tjSvZ CEPAuJPEXr2JP4lGhi6dOGinXTpLdg4+FvGoJ9MqFwu88hcYWKkmkxYXyZS6I5oyAzDggaJxl3Yn LkwvQQbsCRFobZFGIKt5k0qjJ4RR+umrzHGhEzx2iDmsnrHI2coRMWnyqeguyA9LKo0ksaYiLs1w YIb5rbJdHSjz4KyYdlXH5+HhnZFxpLJYEX5g4iGbubG0P8chRL7Nc108l+bV9TBWIVDYQ6Upvw== --0000000000008c241a058ca00e00-- From nobody Mon Jul 1 19:35:05 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2591B120927 for ; Mon, 1 Jul 2019 11:51:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PCmbcSZSTIU9 for ; Mon, 1 Jul 2019 11:51:35 -0700 (PDT) Received: from mail-wm1-x329.google.com (mail-wm1-x329.google.com [IPv6:2a00:1450:4864:20::329]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DE8FF12016C for ; Mon, 1 Jul 2019 11:51:34 -0700 (PDT) Received: by mail-wm1-x329.google.com with SMTP id v19so586582wmj.5 for ; Mon, 01 Jul 2019 11:51:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to; bh=prz0tzCMnuBS1WOZV2VyVe6TaM70yjeAjXe5vQP/cnc=; b=gdfx+nqNX5+41fHunbIB2k4sJ3NhttGOOkkTLpW6TrrKZZ9Kb7EkX1ze2J5NrT0iH6 OUp85OIFIR+L0N+0VCFsojFp4xcwq6jk6UTryYF8JH0KmQU4W9AgrCAz/6GBdZYGUFhF oLtpm218uXQpUKMbnUeFpsOGbnzc1ZmEdf5iz7h8pHpslD4sDLOtXU1ajHu115+9jP+u GRkKKG7I5Af0540MIN9SdytN/tJKH717YQTfgfReWQWxW877qQMrcYSoWGr/0QcD7jCa H7MR0mATBpc+FwgkhGeq6oxs7eEsj8xj3BOkrBJ2WNI8t072frlqd5E/mFSUAKqQIpIT /zgQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to; bh=prz0tzCMnuBS1WOZV2VyVe6TaM70yjeAjXe5vQP/cnc=; b=rdJmF+kP632W56A1v9alLLSs3EkD3tmRhgJaK+Y5smjPNrpXdHKRC0W0PjjWwtZU3d CyLX5ozrnd7gk3b9leJTXT+LyYei0RIVe4WgaLnxedTLe+TW2IBw6xabVrewxo54aNO+ OsrTelKGcYiNDbzS4ZyLxiuCpUqi1eX+zi78VC5X6H/sWRysDVkHoDCtUtfA3kMfleEm qnnSFtLZxHITBhAVXWuZmGRkQ57SQhHnj4NuBnhIBh/cu0HbnLBSNZ/hHDrpwu4/2Aku vedQnmMOEnTmOL4Czll1/4lX/WYKCh6mH5s7QU2J7rQ/k88BZBfjjF8Nl/aZyLl6591O MbOg== X-Gm-Message-State: APjAAAUv8ModuLNHksqCFDzqzOvuCp8Gb7/26gmkBTmuremrasqmjQee Q3ueI+KI4zJ6wRdXy+nPoCCKG4PVG3vJKvngZaa26A== X-Google-Smtp-Source: APXvYqxj5S9s4tv8zeAzOOMluSOD+eZzL0XEhV4SWCFwfRjRsYnNo1jRKbpNCA35SDOFP/WHoy+5UiXLEsvDco/21vQ= X-Received: by 2002:a1c:18a:: with SMTP id 132mr418391wmb.15.1562007093057; Mon, 01 Jul 2019 11:51:33 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Justice Parham Date: Mon, 1 Jul 2019 13:51:21 -0500 Message-ID: To: tls@ietf.org Content-Type: multipart/alternative; boundary="000000000000eb1d71058ca31d86" Archived-At: X-Mailman-Approved-At: Mon, 01 Jul 2019 19:35:03 -0700 Subject: [TLS] Including Presentation language in draft X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 01 Jul 2019 18:51:37 -0000 --000000000000eb1d71058ca31d86 Content-Type: text/plain; charset="UTF-8" ---------- Forwarded message --------- From: Justice Parham Date: Tue, Jun 18, 2019, 9:17 AM Subject: Re: Including Presentation language in draft To: Eric Rescorla Cc: Would it then be reasonable to mention that in this document? On Wed, Jun 12, 2019, 5:46 PM Eric Rescorla wrote: > Generally we assume that if you are implementing something in TLS you know > the language. TLS 1.3 is intended to stand alone, but this document doe snot > > -Ekr > > > On Wed, Jun 12, 2019 at 12:10 PM Justice Parham > wrote: > >> I believe it will be helpful to understanding this document to either add >> "Presentation Language" to this document or link to Presentation Language >> elsewhere. The TLS/1.3 document has something similar in RFC8446 Section >> 3 >> >> Justice Parham >> > --000000000000eb1d71058ca31d86 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable

---------- Forwarded message ---------
From: Justice Parham <justkinglivecom@gma= il.com>
Date: Tue, Jun 18, 2019, 9:17 AM
Subject: Re: I= ncluding Presentation language in draft
To: Eric Rescorla <ekr@rtfm.com>
Cc: <draft-ietf-tls-esni@ietf.org>
<= br>
Would it then be reasonable to mention that i= n this document?

On Wed, Jun 12, 2019, 5:46 PM Eric Rescorla <ekr@rtfm.com&= gt; wrote:
Ge= nerally we assume that if you are implementing something in TLS you know th= e language. TLS 1.3 is intended to stand alone, but this document doe snot<= br>

-Ekr


On Wed, Jun 12, 2019= at 12:10 PM Justice Parham <justkinglivecom@gmail.com= > wrote:
=
I believe it will be helpful to understanding this doc= ument to either add "Presentation Language" to this document or l= ink to Presentation Language elsewhere. The TLS/1.3 document has something = similar in=C2=A0RFC8446 Section 3=C2=A0

=
Justice Parham
--000000000000eb1d71058ca31d86-- From nobody Mon Jul 1 19:35:15 2019 Return-Path: X-Original-To: tls@ietf.org Delivered-To: tls@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 63EBD120110; Fri, 28 Jun 2019 14:40:25 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit From: Liaison Statement Management Tool To: Cc: Transport Layer Security Discussion List , xiaoya.yang@itu.int, christopherwood07@gmail.com, Scott Mansfield , BenjaminKadukkaduk@mit.edu, Sean Turner , Benjamin Kaduk , Christopher Wood , Joseph Salowey , Roman Danyliw , joe@salowey.net, itu-t-liaison@iab.org, sean+ietf@sn3rd.com, EricResorlaekr@rtfm.com X-Test-IDTracker: no X-IETF-IDTracker: 6.98.1 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <156175802534.21827.16669590454627867637.idtracker@ietfa.amsl.com> Date: Fri, 28 Jun 2019 14:40:25 -0700 Archived-At: X-Mailman-Approved-At: Mon, 01 Jul 2019 19:35:15 -0700 Subject: [TLS] New Liaison Statement, "Liaison to SG17" X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 28 Jun 2019 21:40:26 -0000 Title: Liaison to SG17 Submission Date: 2019-06-28 URL of the IETF Web page: https://datatracker.ietf.org/liaison/1647/ From: Christopher Wood To: tsbsg17@itu.int Cc: Transport Layer Security Discussion List ,Scott Mansfield ,Sean Turner ,Benjamin Kaduk ,Christopher Wood ,Joseph Salowey ,Roman Danyliw ,itu-t-liaison@iab.org,xiaoya.yang@itu.int,Benjamin Kaduk kaduk@mit.edu,Eric Resorla ekr@rtfm.com Response Contacts: Christopher Wood ,Joseph Salowey ,Sean Turner Technical Contacts: christopherwood07@gmail.com, joe@salowey.net , sean+ietf@sn3rd.com Purpose: For information Referenced liaison: LS on SG17 work item X.ibc-iot: Security framework for using Identity Based Cryptography for IoT services over telecom networks (https://datatracker.ietf.org/liaison/1629/) Body: Thank you for the LS concerning SG17’s work item X.ibc-iot [1]. As you are no doubt aware, the TLS WG and the IANA TLS Designated Experts worked with the X.ibc-iot authors, who also are authors of draft-wang-tls-raw-public-key-with-ibc [2], to register four TLS Signature Schemes: eccsi_sha256, ibs1_sha256, ibs2_sha256, sm9_ibs_sm3. These values can be found in the IANA TLS Signature Scheme registry [3]. We would like to thank those authors for working through the IETF process by 1) modifying their draft to add ibs1_sha256, ibs2_sha256, and sm9_ibs_sm3 so that all of the requested values from X.ibc-iot were included, 2) presenting their draft to the TLS WG at IETF 104, 3) resolving comments from the WG and the Designated Experts, and 4) for their patience throughout this process. [1] https://datatracker.ietf.org/liaison/1629/ [2] https://datatracker.ietf.org/doc/draft-wang-tls-raw-public-key-with-ibc/ [3] https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-signaturescheme Attachments: No document has been attached From nobody Mon Jul 1 19:38:38 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 789C11201AF for ; Mon, 1 Jul 2019 19:38:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=lowentropy.net header.b=Ok5BH0+z; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=Sn/moVzx Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id R-3yr9Tke5vx for ; Mon, 1 Jul 2019 19:38:33 -0700 (PDT) Received: from wout1-smtp.messagingengine.com (wout1-smtp.messagingengine.com [64.147.123.24]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 80B491200D7 for ; Mon, 1 Jul 2019 19:38:33 -0700 (PDT) Received: from compute1.internal (compute1.nyi.internal [10.202.2.41]) by mailout.west.internal (Postfix) with ESMTP id 8F83C5AE; Mon, 1 Jul 2019 22:38:32 -0400 (EDT) Received: from imap2 ([10.202.2.52]) by compute1.internal (MEProxy); Mon, 01 Jul 2019 22:38:32 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lowentropy.net; h=mime-version:message-id:in-reply-to:references:date:from:to :cc:subject:content-type; s=fm2; bh=/LrRXgyEF11cTAhdiMdCe4OP/aqw ywbXpDs63ogJ4Fo=; b=Ok5BH0+zuZiLcMpx+OwzO1IT/qSHMc1YOK8p4CqbPigb rQ5gVpFklFZiCakjxqlGKREzh4f6/ueXj6CDaZ6MFea3zBWuB5St3UyVLSPVOPQM lxmA5RdG/4TipDKPRomcpWSPgemC3n5zan0pDH9KOZD6S4W2ebXmoNsMwvAJnDrJ eViobVU7gEbTC9I1XLVj8pLbSH4PwYtoDu2zxESLvpFKhukwk5HNV2rjpRk3L6K1 jgACJcdzbqzbX0mjsYzch73/K3OHd/vc07dY7gNcr+ABaufNoNmhG1t0avCqMPml PIy3UavIaK32BMlH0d1CBw8TMpt13qj69SZQqfOOZg== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-proxy :x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm3; bh=/LrRXg yEF11cTAhdiMdCe4OP/aqwywbXpDs63ogJ4Fo=; b=Sn/moVzxYJFhTDItZ8UiKi LKlxkvRQgDD9K/FvySEGY9qhvaG482N9dOhRmiFNgvcUcR7JpUA2El28LE4PF7or 5aVMxaXd/Dfthdjp3tncB7Q70do+KK/QJxjPBNI4XIdv57kgE3774US3/a5/+w15 H70IOvsveLjEDnbbGyUvhBTLTAYsrjw7eqAUsMniGX2FRf2rSXZbh6/MhPV1tTfT td0/zaIZffOu7EH7AQou/JHGSI92p92TkWR6hBnI17XbTnwcwOGoIsVakS7YEuNh A0OUDqFqLMA4Jk196tewC0nSfHz/UYyhGo2qphL9NS+kYvuvsyQcmFHvmy0IltdA == X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeduvddrvdejgdehlecutefuodetggdotefrodftvf curfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfghnecu uegrihhlohhuthemuceftddtnecunecujfgurhepofgfggfkjghffffhvffutgesthdtre dtreerjeenucfhrhhomhepfdforghrthhinhcuvfhhohhmshhonhdfuceomhhtsehlohif vghnthhrohhphidrnhgvtheqnecurfgrrhgrmhepmhgrihhlfhhrohhmpehmtheslhhofi gvnhhtrhhophihrdhnvghtnecuvehluhhsthgvrhfuihiivgeptd X-ME-Proxy: Received: by mailuser.nyi.internal (Postfix, from userid 501) id C332DE00A2; Mon, 1 Jul 2019 22:38:31 -0400 (EDT) X-Mailer: MessagingEngine.com Webmail Interface User-Agent: Cyrus-JMAP/3.1.6-731-g19d3b16-fmstable-20190627v1 Mime-Version: 1.0 Message-Id: In-Reply-To: References: <156173339678.20700.10472293883370612968.idtracker@ietfa.amsl.com> Date: Tue, 02 Jul 2019 12:38:32 +1000 From: "Martin Thomson" To: "Ben Schwartz" Cc: "" Content-Type: text/plain Archived-At: Subject: Re: [TLS] =?utf-8?q?Fwd=3A_New_Version_Notification_for_draft-schwar?= =?utf-8?q?tz-tls-lb-00=2Etxt?= X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 02 Jul 2019 02:38:36 -0000 On Tue, Jul 2, 2019, at 01:12, Ben Schwartz wrote: > To be clear, are you suggesting TLS-in-TLS, similar to Stephen's > suggestion? Or are you suggesting a parallel connection to deliver the > metadata? I'm thinking that a parallel connection for metadata is going to be more efficient in the general case. If you need specialized things (like getting metadata in ahead of the first packet on a new connection), then you can use exporters and protect special messages, all based on that shared context. > I don't believe this design introduces any ossification risk beyond > that inherent in split-mode ESNI. Split-mode ESNI inherently requires > that the load balancer be able to read the ClientHello out of the > packet it arrives in, and that is also the only requirement here. You are baking assumptions about the format of the Initial packet into your protocol. That tends to ossify things. > > I would have thought it easier to use an exporter (plus one to provide a key identifier) to get shared keys -- if you need them. I don't think that you do though. > > > > If you look at Martin Duke's design, the load balancer acts as an oracle. > > It does? I don't see any oracular behavior. The cryptography appears to > consist of a single PSK that is shared by the load balancer and all its > servers, and is passed between them in cleartext. Ugh, the draft changed again. Nevermind. I think that it should act as an oracle, but that's not what it says. > I can certainly imagine an ESNI oracle, at the cost of a delay while > the backend queries the oracle. Is that what you're imagining? Yeah. > If we assume working 0-RTT, TLS-in-TLS might have less latency overhead > than an oracle. Alternatively, we could imagine a "push oracle", at the > cost of potentially severe implementation complexity to handle > reorderings, failures, etc. Keep in mind that you are going to be racing anyway, unless you are lucky enough to have a protocol that leaves enough space in the MTU for all your extra stuff. From nobody Mon Jul 1 23:44:05 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 923621201DB for ; Mon, 1 Jul 2019 23:44:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KATO3U9vyCy7 for ; Mon, 1 Jul 2019 23:44:00 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1FC201201CE for ; Mon, 1 Jul 2019 23:43:59 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 7A5CABDFA; Tue, 2 Jul 2019 07:43:58 +0100 (IST) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2800RnfsYJFZ; Tue, 2 Jul 2019 07:43:57 +0100 (IST) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id EB520BE20; Tue, 2 Jul 2019 07:43:56 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1562049837; bh=4KOsMNUwEF7JLeyeAQfNMCO8m1WFwhmjMCJNkF1QDaY=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=rLaEKbbuCFEZ2gjAeTTNNt1JrYjPfjSddQIW4IkjTkk35YDtxrxHxywzDu9hXi5BT 5iPcIB9EfXDusS702OfeQ8mTm/ybhLmTUR5vPW8lB/hs8AjN3Cw6LO7rHbOyIGjz2Z PvM10NNoCW/AGXzZigOIjb+Gw8CF5od3RARGaJ0g= To: Martin Thomson , Ben Schwartz Cc: "" References: <156173339678.20700.10472293883370612968.idtracker@ietfa.amsl.com> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <777ccb9a-0a85-bb46-c7a7-74f47301d08f@cs.tcd.ie> Date: Tue, 2 Jul 2019 07:43:55 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.7.2 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="gHtMm5sYxhu2XIndaXJv9ZLbXRp5sOXy6" Archived-At: Subject: Re: [TLS] Fwd: New Version Notification for draft-schwartz-tls-lb-00.txt X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 02 Jul 2019 06:44:03 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --gHtMm5sYxhu2XIndaXJv9ZLbXRp5sOXy6 Content-Type: multipart/mixed; boundary="Sbts98WkU1z65YJRJNnRBtTa5N6sWNQKY"; protected-headers="v1" From: Stephen Farrell To: Martin Thomson , Ben Schwartz Cc: "" Message-ID: <777ccb9a-0a85-bb46-c7a7-74f47301d08f@cs.tcd.ie> Subject: Re: [TLS] Fwd: New Version Notification for draft-schwartz-tls-lb-00.txt References: <156173339678.20700.10472293883370612968.idtracker@ietfa.amsl.com> In-Reply-To: --Sbts98WkU1z65YJRJNnRBtTa5N6sWNQKY Content-Type: multipart/mixed; boundary="------------66F33E9CAEF4BE3BA6A65778" Content-Language: en-GB This is a multi-part message in MIME format. --------------66F33E9CAEF4BE3BA6A65778 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hiya, On 02/07/2019 03:38, Martin Thomson wrote: > Keep in mind that you are going to be racing anyway, unless you are > lucky enough to have a protocol that leaves enough space in the MTU > for all your extra stuff. I guess split-mode MTU issues provide another argument against including padded_length in ESNIKeys on the basis that including it there with a value of 260 as will likely be common (in case of wildcard certs) inflates the CH and that could, though isn't likely to, badly affect the size of the first packet between the LB and backend. I don't expect that to be seen as a winning argument for those who, unlike me, think padded_length is just fine in ESNIKeys, but we may as well record it in passing :-) Cheers, S. --------------66F33E9CAEF4BE3BA6A65778 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------66F33E9CAEF4BE3BA6A65778-- --Sbts98WkU1z65YJRJNnRBtTa5N6sWNQKY-- --gHtMm5sYxhu2XIndaXJv9ZLbXRp5sOXy6 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAl0a/SwACgkQWrL68XsX K+rjjw//bdOXLVOiUs7crSn9nmqYwzACIvU9HpVdSZdzeJwdb8L2OrjgbDY9tOYM XNbhARdmh+2AHffYHDmz5uM9q6wVkOLP9eTiSBglYYD9LQr9GQQXgrjQkQp4t+ET LFwsuyVpLs7q/QrTQ5HQtTkLbCsHZZuPYCDP3wW/L7Voy5Uo56pCiQ8y/uqfvaYT 6+Gg4fxSZh5gsFvZwEESFKCCoPS8Y/mO2/iaa4X0e6m5YqVHO0oGkhbv8mA/Lgum J699moqMVfgSLe2kQEjubjtV5yv/jH3hYYYTPnTmMfc0VRWwUCpLLjlNAbWNKMEB PHFhp0bGoaF6mjlYag1AFelzBUxUvZ2ynyiq7A0sjxL9w9ztIxd+RBC/rJtoT0Wm XRlnxcLA3ZtaZYu3axChONobkxrDzKf6Zke8qbo+GuFi0nSh4oNSzTAk5eIVG/rX 0BZRqDaXwYGptGWXpggsr6B0IZZWZC2lsaEi5yEN4ympGNyObjrL3o0IigRbKyKe JkW8K/qPvdprOiKgGkWdA+G4z1mQA8etJcsoRnyrAnfy6JQeANzVyzaRhsB07Pdz iICk1R0JDwpdGIKjajlIW6BDVGVmGpMypG0iP3UnSUylbPhsc7aP8qhjBny5hRa1 XhjyZeUlg2Ei/2J6ZJdmvDNbQvrqjCcnSeOr1h7SDDdiCCJcJbs= =ebGF -----END PGP SIGNATURE----- --gHtMm5sYxhu2XIndaXJv9ZLbXRp5sOXy6-- From nobody Tue Jul 2 07:43:19 2019 Return-Path: X-Original-To: tls@ietf.org Delivered-To: tls@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 26585120099; Tue, 2 Jul 2019 07:43:18 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Joseph Salowey via Datatracker To: X-Test-IDTracker: no X-IETF-IDTracker: 6.98.1 Auto-Submitted: auto-generated Precedence: bulk Cc: iesg-secretary@ietf.org, joe@salowey.net, Joseph Salowey , tls-chairs@ietf.org, tls@ietf.org Message-ID: <156207859815.23953.4119552810661382340.idtracker@ietfa.amsl.com> Date: Tue, 02 Jul 2019 07:43:18 -0700 Archived-At: Subject: [TLS] Publication has been requested for draft-ietf-tls-tls13-cert-with-extern-psk-02 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 02 Jul 2019 14:43:18 -0000 Joseph Salowey has requested publication of draft-ietf-tls-tls13-cert-with-extern-psk-02 as Experimental on behalf of the TLS working group. Please verify the document's state at https://datatracker.ietf.org/doc/draft-ietf-tls-tls13-cert-with-extern-psk/ From nobody Tue Jul 2 13:02:09 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 82CC51206FA for ; Tue, 2 Jul 2019 13:02:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.499 X-Spam-Level: X-Spam-Status: No, score=-17.499 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jTMZpTYfshHE for ; Tue, 2 Jul 2019 13:02:06 -0700 (PDT) Received: from mail-io1-xd2e.google.com (mail-io1-xd2e.google.com [IPv6:2607:f8b0:4864:20::d2e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0F06D1206CB for ; Tue, 2 Jul 2019 13:02:06 -0700 (PDT) Received: by mail-io1-xd2e.google.com with SMTP id u13so40116289iop.0 for ; Tue, 02 Jul 2019 13:02:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=fuauNRSN/L9MAYUeHmPQG05HfL9acEHJH38ceiknwZk=; b=thW14RdYfdT5iR/qsq8o8TcESasbzuUc3IJywKpgkMD6esnQJ3LEGosqC3mqWrjLXd 8SwhXIYlLQXaNKGJEKKKUpjdr+YjmBKZNGZGTvcd0oV7YKQjLsYg5G5dzBvK8TXZmLO3 bwvB3MZgiVXCXxz2Gjumg/GB9A6kehN7Ez4Cdy3xKqRYuKyF4osMzK1g37+FZ/wFhsrB s7Uo/uH+U9GcbROpTW7PV5zYTzYXBwzWbz+eNwagfPs8epO1E3vchAOsTYFVcz7Kl6pn wYoQHFRzGrzALqRzdlYDla0K8XRSaTpdJTj6SdNhJ2+gE54P/YLeLid74LTe0hNeJRax /WsA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=fuauNRSN/L9MAYUeHmPQG05HfL9acEHJH38ceiknwZk=; b=HSbjywhDYZnQit7sgrt32ql0IU8fzOeQ8xIxxCWY01Sb4UmvXjNahTQW9WYlxSvP50 GDfbxPdwoRfkUUse1VAZqgoWdRD4k8XVIO94zlTgbrNUVlu6HyLcF947014xc1bcsEGf 9lZR9yJxfnhYrJSQZISKFeN3VaBjWoVzB+PWqoCN2NLKUEyd2xQ7oTXW/PK3/ojqN5u4 ipKRb7Jgy8/sEh8/h9l77liasnr0Czx2pPQO3QZq4qEaeSx2Q/FMdlzJ1Lqww/VTaQ4u 3bmw7A4Ghq8xH37EcJ6j2xoDUGQ5TG0wpu3FjH5bBQkujsSDMhiJkaGolaKgjEsd3mKM 3ttw== X-Gm-Message-State: APjAAAVU7TZ5DJpzbd24KFMlN0WECTW4++cC0mBtMqK/GcHOv1WD73Iy uNoRM7IIQrNyFPT/60T97c8bt06oHRvTSrIGzmWpEzDlxkU= X-Google-Smtp-Source: APXvYqxT4TCS3kVKHB/VbVhRessyQ/R/pXADw3cqOZLsC3qv6YOfA9ZL23Dyicrnt2Fl26nbhuk+fQ1TwmlyPgdQMv8= X-Received: by 2002:a05:6638:201:: with SMTP id e1mr36949086jaq.45.1562097724941; Tue, 02 Jul 2019 13:02:04 -0700 (PDT) MIME-Version: 1.0 References: <156173339678.20700.10472293883370612968.idtracker@ietfa.amsl.com> <777ccb9a-0a85-bb46-c7a7-74f47301d08f@cs.tcd.ie> In-Reply-To: <777ccb9a-0a85-bb46-c7a7-74f47301d08f@cs.tcd.ie> From: Ben Schwartz Date: Tue, 2 Jul 2019 16:01:51 -0400 Message-ID: To: Stephen Farrell Cc: Martin Thomson , "" Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="000000000000092960058cb8381e" Archived-At: Subject: Re: [TLS] Fwd: New Version Notification for draft-schwartz-tls-lb-00.txt X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 02 Jul 2019 20:02:08 -0000 --000000000000092960058cb8381e Content-Type: multipart/alternative; boundary="000000000000006f32058cb83820" --000000000000006f32058cb83820 Content-Type: text/plain; charset="UTF-8" Thanks for the suggestions. I've posted a new version: https://tools.ietf.org/html/draft-schwartz-tls-lb-01 This version has: * a diagram! * a security considerations section with the security concerns we've discussed * a different approach to QUIC annotation that avoids increasing the MTU and addresses ossification more directly I'm certainly open to totally different architectures, like TLS-in-TLS, oracles, Cloudflare's Argo, etc. I just want to make sure that we come with an answer that (1) serves the listed use cases and (2) is attractive for widespread deployment. On Tue, Jul 2, 2019 at 2:44 AM Stephen Farrell wrote: > > Hiya, > > On 02/07/2019 03:38, Martin Thomson wrote: > > Keep in mind that you are going to be racing anyway, unless you are > > lucky enough to have a protocol that leaves enough space in the MTU > > for all your extra stuff. > I guess split-mode MTU issues provide another argument > against including padded_length in ESNIKeys on the basis > that including it there with a value of 260 as will likely > be common (in case of wildcard certs) inflates the CH > and that could, though isn't likely to, badly affect the > size of the first packet between the LB and backend. > > I don't expect that to be seen as a winning argument for > those who, unlike me, think padded_length is just fine in > ESNIKeys, but we may as well record it in passing :-) > > Cheers, > S. > --000000000000006f32058cb83820 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Thanks for the suggestions.=C2=A0 I've posted a new ve= rsion:=C2=A0https://tools.ietf.org/html/draft-schwartz-tls-lb-01

This version has:
=C2=A0* a diagram!
=C2=A0* a secur= ity considerations section with the security concerns we've discussed
=C2=A0* a different approach to QUIC annotation that avoids increa= sing the MTU and addresses ossification more directly

<= div>I'm certainly open to totally different architectures, like TLS-in-= TLS, oracles, Cloudflare's Argo, etc.=C2=A0 I just want to make sure th= at we come with an answer that (1) serves the listed use cases and (2) is a= ttractive for widespread deployment.

On Tue, Jul 2, 2019 at 2:44 AM St= ephen Farrell <stephen.farr= ell@cs.tcd.ie> wrote:

Hiya,

On 02/07/2019 03:38, Martin Thomson wrote:
> Keep in mind that you are going to be racing anyway, unless you are > lucky enough to have a protocol that leaves enough space in the MTU > for all your extra stuff.
I guess split-mode MTU issues provide another argument
against including padded_length in ESNIKeys on the basis
that including it there with a value of 260 as will likely
be common (in case of wildcard certs) inflates the CH
and that could, though isn't likely to, badly affect the
size of the first packet between the LB and backend.

I don't expect that to be seen as a winning argument for
those who, unlike me, think padded_length is just fine in
ESNIKeys, but we may as well record it in passing :-)

Cheers,
S.
--000000000000006f32058cb83820-- --000000000000092960058cb8381e Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIIS5wYJKoZIhvcNAQcCoIIS2DCCEtQCAQExDzANBglghkgBZQMEAgEFADALBgkqhkiG9w0BBwGg ghBNMIIEXDCCA0SgAwIBAgIOSBtqDm4P/739RPqw/wcwDQYJKoZIhvcNAQELBQAwZDELMAkGA1UE BhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVy c29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hBMjU2IC0gRzIwHhcNMTYwNjE1MDAwMDAwWhcNMjEw NjE1MDAwMDAwWjBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xvYmFsU2lnbiBudi1zYTEiMCAG A1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC AQoCggEBALR23lKtjlZW/17kthzYcMHHKFgywfc4vLIjfq42NmMWbXkNUabIgS8KX4PnIFsTlD6F GO2fqnsTygvYPFBSMX4OCFtJXoikP2CQlEvO7WooyE94tqmqD+w0YtyP2IB5j4KvOIeNv1Gbnnes BIUWLFxs1ERvYDhmk+OrvW7Vd8ZfpRJj71Rb+QQsUpkyTySaqALXnyztTDp1L5d1bABJN/bJbEU3 Hf5FLrANmognIu+Npty6GrA6p3yKELzTsilOFmYNWg7L838NS2JbFOndl+ce89gM36CW7vyhszi6 6LqqzJL8MsmkP53GGhf11YMP9EkmawYouMDP/PwQYhIiUO0CAwEAAaOCASIwggEeMA4GA1UdDwEB /wQEAwIBBjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwEgYDVR0TAQH/BAgwBgEB/wIB ADAdBgNVHQ4EFgQUyzgSsMeZwHiSjLMhleb0JmLA4D8wHwYDVR0jBBgwFoAUJiSSix/TRK+xsBtt r+500ox4AAMwSwYDVR0fBEQwQjBAoD6gPIY6aHR0cDovL2NybC5nbG9iYWxzaWduLmNvbS9ncy9n c3BlcnNvbmFsc2lnbnB0bnJzc2hhMmcyLmNybDBMBgNVHSAERTBDMEEGCSsGAQQBoDIBKDA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzANBgkqhkiG 9w0BAQsFAAOCAQEACskdySGYIOi63wgeTmljjA5BHHN9uLuAMHotXgbYeGVrz7+DkFNgWRQ/dNse Qa4e+FeHWq2fu73SamhAQyLigNKZF7ZzHPUkSpSTjQqVzbyDaFHtRBAwuACuymaOWOWPePZXOH9x t4HPwRQuur57RKiEm1F6/YJVQ5UTkzAyPoeND/y1GzXS4kjhVuoOQX3GfXDZdwoN8jMYBZTO0H5h isymlIl6aot0E5KIKqosW6mhupdkS1ZZPp4WXR4frybSkLejjmkTYCTUmh9DuvKEQ1Ge7siwsWgA NS1Ln+uvIuObpbNaeAyMZY0U5R/OyIDaq+m9KXPYvrCZ0TCLbcKuRzCCBB4wggMGoAMCAQICCwQA AAAAATGJxkCyMA0GCSqGSIb3DQEBCwUAMEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAt IFIzMRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWduMB4XDTExMDgwMjEw MDAwMFoXDTI5MDMyOTEwMDAwMFowZDELMAkGA1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24g bnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVyc29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hB MjU2IC0gRzIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCg/hRKosYAGP+P7mIdq5NB Kr3J0tg+8lPATlgp+F6W9CeIvnXRGUvdniO+BQnKxnX6RsC3AnE0hUUKRaM9/RDDWldYw35K+sge C8fWXvIbcYLXxWkXz+Hbxh0GXG61Evqux6i2sKeKvMr4s9BaN09cqJ/wF6KuP9jSyWcyY+IgL6u2 52my5UzYhnbf7D7IcC372bfhwM92n6r5hJx3r++rQEMHXlp/G9J3fftgsD1bzS7J/uHMFpr4MXua eoiMLV5gdmo0sQg23j4pihyFlAkkHHn4usPJ3EePw7ewQT6BUTFyvmEB+KDoi7T4RCAZDstgfpzD rR/TNwrK8/FXoqnFAgMBAAGjgegwgeUwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8C AQEwHQYDVR0OBBYEFCYkkosf00SvsbAbba/udNKMeAADMEcGA1UdIARAMD4wPAYEVR0gADA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzA2BgNVHR8E LzAtMCugKaAnhiVodHRwOi8vY3JsLmdsb2JhbHNpZ24ubmV0L3Jvb3QtcjMuY3JsMB8GA1UdIwQY MBaAFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQACAFVjHihZCV/IqJYt 7Nig/xek+9g0dmv1oQNGYI1WWeqHcMAV1h7cheKNr4EOANNvJWtAkoQz+076Sqnq0Puxwymj0/+e oQJ8GRODG9pxlSn3kysh7f+kotX7pYX5moUa0xq3TCjjYsF3G17E27qvn8SJwDsgEImnhXVT5vb7 qBYKadFizPzKPmwsJQDPKX58XmPxMcZ1tG77xCQEXrtABhYC3NBhu8+c5UoinLpBQC1iBnNpNwXT Lmd4nQdf9HCijG1e8myt78VP+QSwsaDT7LVcLT2oDPVggjhVcwljw3ePDwfGP9kNrR+lc8XrfClk WbrdhC2o4Ui28dtIVHd3MIIDXzCCAkegAwIBAgILBAAAAAABIVhTCKIwDQYJKoZIhvcNAQELBQAw TDEgMB4GA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjMxEzARBgNVBAoTCkdsb2JhbFNpZ24x EzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDkwMzE4MTAwMDAwWhcNMjkwMzE4MTAwMDAwWjBMMSAw HgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMzETMBEGA1UEChMKR2xvYmFsU2lnbjETMBEG A1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMwldpB5Bngi FvXAg7aEyiie/QV2EcWtiHL8RgJDx7KKnQRfJMsuS+FggkbhUqsMgUdwbN1k0ev1LKMPgj0MK66X 17YUhhB5uzsTgHeMCOFJ0mpiLx9e+pZo34knlTifBtc+ycsmWQ1z3rDI6SYOgxXG71uL0gRgykmm KPZpO/bLyCiR5Z2KYVc3rHQU3HTgOu5yLy6c+9C7v/U9AOEGM+iCK65TpjoWc4zdQQ4gOsC0p6Hp sk+QLjJg6VfLuQSSaGjlOCZgdbKfd/+RFO+uIEn8rUAVSNECMWEZXriX7613t2Saer9fwRPvm2L7 DWzgVGkWqQPabumDk3F2xmmFghcCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQF MAMBAf8wHQYDVR0OBBYEFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQBL QNvAUKr+yAzv95ZURUm7lgAJQayzE4aGKAczymvmdLm6AC2upArT9fHxD4q/c2dKg8dEe3jgr25s bwMpjjM5RcOO5LlXbKr8EpbsU8Yt5CRsuZRj+9xTaGdWPoO4zzUhw8lo/s7awlOqzJCK6fBdRoyV 3XpYKBovHd7NADdBj+1EbddTKJd+82cEHhXXipa0095MJ6RMG3NzdvQXmcIfeg7jLQitChws/zyr VQ4PkX4268NXSb7hLi18YIvDQVETI53O9zJrlAGomecsMx86OyXShkDOOyyGeMlhLxS67ttVb9+E 7gUJTb0o2HLO02JQZR7rkpeDMdmztcpHWD9fMIIEZDCCA0ygAwIBAgIMB/CJK1MgpV83jiIZMA0G CSqGSIb3DQEBCwUAMEwxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMSIw IAYDVQQDExlHbG9iYWxTaWduIEhWIFMvTUlNRSBDQSAxMB4XDTE5MDMxMzA4MjIxOVoXDTE5MDkw OTA4MjIxOVowIjEgMB4GCSqGSIb3DQEJAQwRYmVtYXNjQGdvb2dsZS5jb20wggEiMA0GCSqGSIb3 DQEBAQUAA4IBDwAwggEKAoIBAQCsphkGEsCh0fF4+6Wsi1u40JxI6W6Izew+dLGK4b93LCRAuJ8y g9wSnwGAtk9/23VmtKwBrMaJD5j9SVZpscvLAjrWwADl/THU22uTW0MsUE2fPOPv2s4hE+vMgRmK P2E+xpI6n0gFvn8qrUHO1dm6PJaP5SWa+zdB/Ja1LgMJTpevQqjK4LKjWmHFPR6CplS4RImjGk7U 0I6invTyQnL5p583t5PI7FcM5UyjAqxGEETdAuc7N4IqjNETvPwL0wLIzxPDA5PMqcWPSzg7sBAB LVUQRYNIAJPlVpUdg1IeAjil5BaaWBjEeCLBSGDFX3WaWfMNzQvRZr4i6oJxzV+1AgMBAAGjggFu MIIBajAcBgNVHREEFTATgRFiZW1hc2NAZ29vZ2xlLmNvbTBQBggrBgEFBQcBAQREMEIwQAYIKwYB BQUHMAKGNGh0dHA6Ly9zZWN1cmUuZ2xvYmFsc2lnbi5jb20vY2FjZXJ0L2dzaHZzbWltZWNhMS5j cnQwHQYDVR0OBBYEFFSy8ovdLNSQc8aqxOgKS7sBOm/UMB8GA1UdIwQYMBaAFMs4ErDHmcB4koyz IZXm9CZiwOA/MEwGA1UdIARFMEMwQQYJKwYBBAGgMgEoMDQwMgYIKwYBBQUHAgEWJmh0dHBzOi8v d3d3Lmdsb2JhbHNpZ24uY29tL3JlcG9zaXRvcnkvMDsGA1UdHwQ0MDIwMKAuoCyGKmh0dHA6Ly9j cmwuZ2xvYmFsc2lnbi5jb20vZ3NodnNtaW1lY2ExLmNybDAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0l BBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMA0GCSqGSIb3DQEBCwUAA4IBAQCbQ++Znz6xh85ZlZEN Y/vAF0vn111O0c2houe4LlLQkoQ1QS4fH5EYcBx/393FTq5n08ezWYVtmeQ6W15e34CqjYNop1Vh mihZ+3J6+LL/6YNi91cp5yMFgxOP9aI/Y8IaIWZJAY2e8yHbYSq0z8kka0H6S4VvFjwtRogkWW95 0SStEwo/8viJ02BwpmVj4YIA6Fva1ZbeN2TnUMCAHJAlKWOGlpHxpcdcWckED0XbSY9w6bllMw1T tsbiUwQxDeO++Y8NfS8rieZgfv3RlobKihE8xbIVGRHIq1gup4nXv6XDwHDYyGhafIfUD4Ix00Wk gnODGb+jPwoQlDX0X64qMYICXjCCAloCAQEwXDBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xv YmFsU2lnbiBudi1zYTEiMCAGA1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMQIMB/CJK1Mg pV83jiIZMA0GCWCGSAFlAwQCAQUAoIHUMC8GCSqGSIb3DQEJBDEiBCBLOe/5KDnx/gSlKG5uWOJu zz4JTxy23DG5m67Lw4ZxOTAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEP Fw0xOTA3MDIyMDAyMDVaMGkGCSqGSIb3DQEJDzFcMFowCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQB FjALBglghkgBZQMEAQIwCgYIKoZIhvcNAwcwCwYJKoZIhvcNAQEKMAsGCSqGSIb3DQEBBzALBglg hkgBZQMEAgEwDQYJKoZIhvcNAQEBBQAEggEAQAG8cHtV7zHZZLOegMLKXSDIxEKlJBW5vt0TlAoJ MzKi9XWNRIVQIXhgKuXLqzxI1DQnRGY9NtP/zwSZtyX3wvUpQQks6iEU5ucnnh7awYIsx46bZsTe TXRAFa5F1L/B+Wh5cGncJYyu89BtZt5PVbMXvnpHaIjCz2D0QquAOa9giXQfMZJXMod5kPpJsGRW sfoGTd9WvdTt3X5uuwlTQs3NKkeU08MYnpOwwaHHTgPaIYZpHemB20djR4o//A3SngCrR50AQw9M YDkv4jKAmwzIejr9LqWmjTamTNmbHAzGv+pcRyZ/rZ1GrbX+nwkt6I4/LK2sQSwUsQiQtyKYKw== --000000000000092960058cb8381e-- From nobody Tue Jul 2 14:11:40 2019 Return-Path: X-Original-To: tls@ietf.org Delivered-To: tls@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id EE9081200D6; Tue, 2 Jul 2019 14:11:33 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: The IESG To: "IETF-Announce" X-Test-IDTracker: no X-IETF-IDTracker: 6.98.1 Auto-Submitted: auto-generated Precedence: bulk Sender: CC: draft-ietf-tls-exported-authenticator@ietf.org, christopherwood07@gmail.com, tls-chairs@ietf.org, Sean Turner , Christopher Wood , tls@ietf.org, kaduk@mit.edu Content-Transfer-Encoding: 7bit Reply-To: ietf@ietf.org Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Message-ID: <156210189393.23887.17036592360591582337.idtracker@ietfa.amsl.com> Date: Tue, 02 Jul 2019 14:11:33 -0700 Archived-At: Subject: [TLS] Last Call: (Exported Authenticators in TLS) to Proposed Standard X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 02 Jul 2019 21:11:34 -0000 The IESG has received a request from the Transport Layer Security WG (tls) to consider the following document: - 'Exported Authenticators in TLS' as Proposed Standard The IESG plans to make a decision in the next few weeks, and solicits final comments on this action. Please send substantive comments to the ietf@ietf.org mailing lists by 2019-07-16. Exceptionally, comments may be sent to iesg@ietf.org instead. In either case, please retain the beginning of the Subject line to allow automated sorting. Abstract This document describes a mechanism in Transport Layer Security (TLS) to provide an exportable proof of ownership of a certificate that can be transmitted out of band and verified by the peer. The file can be obtained via https://datatracker.ietf.org/doc/draft-ietf-tls-exported-authenticator/ IESG discussion can be tracked via https://datatracker.ietf.org/doc/draft-ietf-tls-exported-authenticator/ballot/ No IPR declarations have been submitted directly on this I-D. From nobody Tue Jul 2 14:23:02 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 08810120128; Tue, 2 Jul 2019 14:23:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FZzhoLYZTJ7d; Tue, 2 Jul 2019 14:22:58 -0700 (PDT) Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 502DF1200D6; Tue, 2 Jul 2019 14:22:55 -0700 (PDT) Received: from kduck.mit.edu ([24.16.140.251]) (authenticated bits=56) (User authenticated as kaduk@ATHENA.MIT.EDU) by outgoing.mit.edu (8.14.7/8.12.4) with ESMTP id x62LMo7G017892 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 2 Jul 2019 17:22:53 -0400 Date: Tue, 2 Jul 2019 16:22:50 -0500 From: Benjamin Kaduk To: draft-ietf-tls-sni-encryption.all@ietf.org Cc: tls@ietf.org Message-ID: <20190702212249.GE13810@kduck.mit.edu> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.10.1 (2018-07-13) Archived-At: Subject: [TLS] AD review of draft-ietf-tls-sni-encryption-04 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 02 Jul 2019 21:23:01 -0000 Hi all, I must start with an apology that this review has taken so long. My personal life has kept me quite busy for the past few months and I didn't have much time for anything other than the IESG telechat workload, but things are quieting down and I am starting to clear through the "publication requested" backlog. I don't think there's anything terribly controversial in these review comments, so hopefully it will be easy to spin up a new rev and kick off the IETF LC. -Ben Abstract We should probably say "TLS" somewhere. Section 1 Historically, adversaries have been able to monitor the use of web services through three channels: looking at DNS requests, looking at IP addresses in packet headers, and looking at the data stream between user and services. [...] Is this intended to be an exhaustive list, or just the main channels? Progressive deployment of solutions like DNS in TLS [RFC7858] mitigates the disclosure of DNS information. [...] We could probably mention DoH here as well, especially since we do mention it later on in Section 2.2. However, multiplexed servers rely on the Service Name Information (SNI) to direct TLS connections to the appropriate service implementation. [...] nit: add "TLS extension" after "(SNI)"? In the past, there have been multiple attempts at defining SNI encryption. These attempts have generally floundered, because the simple designs fail to mitigate several of the attacks listed in Section 3. In the absence of a TLS level solution, the most popular approach to SNI privacy is HTTP level fronting, which we discuss in Section 4. Should we mention that this (obviously) does not work for services that do not use HTTP? Section 2 The SNI specification allowed for different types of server names, but only the "hostname" variant was standardized and deployed. [...] We need to be careful about using the word "standardized"; IIUC this stuff has only ever been at proposed standard, so "specified" may keep us safer from the process wonks. server. The SNI extension is carried in clear text in the TLS "Client Hello" message. RFC 8446 also has it in "EncryptedExtensions". nit: we seem to spell it without a space, i.e., "ClientHello", in RFC 8446. Section 2.1 advantage of the information. Many examples of such usage are reviewed in [RFC8404]. They include: o Censorship of specific sites by "national firewalls", "national firewalls" does not appear in RFC 8404, so I don't think the 8404 reference supports this claim. (The claim seems to be true, though, so presumably just a different reference is needed.) o Content filtering by ISP blocking specific web sites in order to implement "parental controls", or to prevent access to fraudulent web sites, such as used for phishing, parental controls and phishing are well-covered in 8404, but the string "fraud" does not appear there. o ISP assigning different QOS profiles to target services, nit: "QoS", to help people searching in 8404 with case-sensitive searches o Enterprise firewalls blocking web sites not deemed appropriate for work, or 8404 includes a great deal of discussion about "enterprise[s]", but a statement from Section 2.3.1 ("Content Filtering") is interesting to note here: % There are numerous reasons why service providers might block content: % to comply with requests from law enforcement or regulatory % authorities, to effectuate parental controls, to enforce content- % based billing, or for other reasons, possibly considered % inappropriate by some. See RFC 7754 [RFC7754] for a survey of % Internet filtering techniques and motivations and the IAB consensus % on those mechanisms. This section is intended to document a % selection of current content-blocking practices by operators and the % effects of encryption on those practices. Content blocking may also % happen at endpoints or at the edge of enterprise networks, but those % scenarios are not addressed in this section. Do we envision these "Enterprise firewalls" appearing at the edge, or elsewhere within the enterprise networks? o Enterprise firewalls exempting specific web sites from MITM inspection, such as healthcare or financial sites for which inspection would intrude with the privacy of employees. (This seems like Section 4.2 of RFC 8404.) Section 2.2 Many deployments still allocate different IP addresses to different services, so that different services can be identified by their IP addresses. However, content distribution networks (CDN) commonly serve a large number of services through a small number of addresses. side note: working as I do for a CDN, I am pretty confident that the number of addresses is not always "small" on an absolute scale. Perhaps "comparatively" is appropriate :) The SNI carries the domain name of the server, which is also sent as part of the DNS queries. Most of the SNI usage described in Section 2.1 could also be implemented by monitoring DNS traffic or controlling DNS usage. But this is changing with the advent of DNS resolvers providing services like DNS over TLS [RFC7858] or DNS over HTTPS [RFC8484]. Do we also want to say something about the need for re-correlation, and the in-band nature of SNI being "more convenient" in some sense? In TLS versions 1.0 [RFC2246], 1.1 [RFC4346], and 1.2 [RFC5246], the server send their certificate in clear text, nit: singular/plural mismatch for "the server" and "send". ensuring that there would be limited benefits in hiding the SNI. But the transmission of the server certificate is protected in TLS 1.3 [RFC8446]. We may want to add some caveats about this protection being limited, and that in many cases replaying a ClientHello with a fresh (known) key share would produce the same Server Certificate in the reply, as is (roughly) described in Section 3.1. The decoupling of IP addresses and server names, the deployment of DNS privacy, and the protection of server certificates transmissions all contribute to user privacy. Encrypting the SNI now will complete This seems to presume a given model of privacy, probably one in which the adversary is an RFC 3552-style in-network attacker. I would suggest to make this explicit, perhaps via "contribute to user privacy in the face of an [RFC3552]-style network attacker". this push for privacy and make it harder to censor specific internet services. "censor" is highly charged language, and while we do consider "censorship of specific sites by "national firewalls"" earlier in the text, we also mention several other unanticipated usages of SNI, which are now being tarred with the same brush. Perhaps "censor or otherwise provide differential treatment to" is more appropriate? Section 2.3 can however be realized by other means. For example, some DNS service providers offer customers the provision to "opt in" filtering services for parental control and phishing protection. Per stream QoS can be provided by a combination of packet marking and end to end agreements. As SNI encryption becomes common, we can expect more deployment of such "end to end" solutions. hyphenation nits: "Per-stream", "end-to-end" At the moment enterprises have the option of installing a firewall nit: comma fater "At the moment". With SNI encryption this becomes ineffective. Obviously, managers could block usage of SNI encryption in enterprise computers, but this wide scale blocking would diminish the privacy protection of traffic nit: "wide-scale" leaving the enterprise, which may not be desirable. Enterprises managers could rely instead on filtering software and management software deployed on enterprises computers. nit: "the enterprise's" (?) Section 3 Over the past years, there have been multiple proposals to add an SNI encryption option in TLS. Many of these proposals appeared promising, but were rejected after security reviews pointed plausible attacks. In this section, we collect a list of these known attacks. nit: "pointed out" Section 3.3 nit: I think "front-end component" is most commonly hyphenated (and "SNI-based" would be as well). We could also reiterate that the affected front-end component would affect multiple back-end services, if we want. Section 3.6 It's not entirely clear what the section title is trying to convey; would something about a "three-party security model" be appropriate? Sectio 3.7 If the SNI encryption solution places too much trust on the fronting server, the fake server could also serve fake content of its own choosing, including various forms of malware. If this is intended to be distinct from the MITM case described in the previous section, more clarification is needed. Even if not, it may be worth trying to consolidate the content into just a single location. Section 3.8 nit: "application-agnostic" is hyphenated. Section 3.8.2 Is this really about transports other than HTTP, or other than TCP (in the section heading)? Section 4 nit: "TLS-level" is hyphenated. o Since the TLS connection is established with the fronting service, the client has no proof that the content does in fact come from the hidden service. The solution does thus not mitigate the context sharing issues described in Section 3.6. nit: perhaps "no cryptographic proof"? o Since this is an HTTP level solution, it would not protect non nit: "HTTP-level" is hyphenated, as is "non-HTTP" spanning the line break. The discovery issue is common to pretty much every SNI encryption solution. The browser issue may be solved by developing a browser nit(?): I don't know if "pretty much every" is in the RFC style. Section 4.2 We can observe that content distribution network have a similar requirement. They need to convince the client that "www.example.com" can be accessed through the seemingly unrelated "cdn-node- xyz.example.net". Most CDN have deployed DNS-based solutions to this problem. nit: "Most CDNs", plural Section 5 Replacing clear text SNI transmission by an encrypted variant will improve the privacy and reliability of TLS connections, but the design of proper SNI encryption solutions is difficult. This document does not present the design of a solution, but provide guidelines for evaluating proposed solutions. nit: "provides". From nobody Tue Jul 2 16:52:16 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1FBAC120106 for ; Tue, 2 Jul 2019 16:52:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sn3rd.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NpGr2Wj0MXqx for ; Tue, 2 Jul 2019 16:52:12 -0700 (PDT) Received: from mail-qt1-x834.google.com (mail-qt1-x834.google.com [IPv6:2607:f8b0:4864:20::834]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 51B951200E7 for ; Tue, 2 Jul 2019 16:52:12 -0700 (PDT) Received: by mail-qt1-x834.google.com with SMTP id d23so622636qto.2 for ; Tue, 02 Jul 2019 16:52:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sn3rd.com; s=google; h=from:content-transfer-encoding:mime-version:subject:message-id:date :to; bh=3MtIxQcuHX3QSCg0yPP5GwiYUL9/lT0ZUwMCgR7sHc4=; b=b+S+EW8uZ2YOfRUc8sBzWHgpvzGjHPCVQuN2s2t3sIL1xqSQSbMqOFRXinVMf2h4Lo D9/7eu4WvKlCex221epHd/yPNA6LUeo+FbrBlF8NYIXhKq+a8/pRhN/jIICXrXJE/Z/2 y958WEEQlm1V5MXvBXxS1MOxH6JlsS9I7ZDrg= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:content-transfer-encoding:mime-version :subject:message-id:date:to; bh=3MtIxQcuHX3QSCg0yPP5GwiYUL9/lT0ZUwMCgR7sHc4=; b=hDBdO9b+Uc1CArKdwjOJVIbzc/HtI7ipXVs0MeiBc3gglFgqv/7jEmGlM1PlF/RebB ErIpZMv5VdV9K4myyRU2Ppvb+pJnc+kraF5W6s0pBZGkFvT6qu3G8tnujILkaZQI1cak LQCJ2KtliOzz6W2XKM0qp73kG4XpUrHKHMh7hCriKET9ZWrjYBYh/d7G8LkcwD8/RutN cPIo92XekhAkGTUMH8HfRn0HsLp5nqQesTuUktzjviujRLB/s2ebt5qnqe3eU2sOsXV9 B9EVkN1J8uf9nMPB1/r2v+ZuoZJp185+NPsxQmjXoi4svVDC/ohsFW2PMkMgJlLRIvUO 0RIg== X-Gm-Message-State: APjAAAX3nj+3lwRUbdxU4ovkCqDBvBsjUjeco/1O74/RoBZgSOjQHfAV sY3SvNKnBrGhWhvUvpZP8K6IBjJHKMA= X-Google-Smtp-Source: APXvYqxz4xU05aK+f8SiUp6AWUl/FuhH+ckVdvFJFhihJ1w+dSwjvBpQMnpdENLwKvm5NHDsan97Cw== X-Received: by 2002:ac8:6747:: with SMTP id n7mr27498270qtp.19.1562111531280; Tue, 02 Jul 2019 16:52:11 -0700 (PDT) Received: from sn3rd.lan ([75.102.131.36]) by smtp.gmail.com with ESMTPSA id n5sm247634qta.29.2019.07.02.16.52.10 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 02 Jul 2019 16:52:10 -0700 (PDT) From: Sean Turner Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Message-Id: <54CE8033-240D-4E4E-8850-7383E3D936E0@sn3rd.com> Date: Tue, 2 Jul 2019 19:52:09 -0400 To: TLS List X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: [TLS] Early code-point assignments for draft-ietf-tls-dtls-connection-id X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 02 Jul 2019 23:52:14 -0000 The following temporary assignments have been made for = draft-ietf-tls-dtls-connection-id: Registry: TLS ExtensionType Values Value: 53 Extension Name: connection_id TLS 1.3: -=20 Recommended: Y Registry: TLS ContentType Registry Value: 25 Description: tls12_cid DTLS-OK: Y J/C/S= From nobody Wed Jul 3 04:01:04 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 398F012004F for ; Wed, 3 Jul 2019 04:01:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qlkGwbPEhi-I for ; Wed, 3 Jul 2019 04:00:59 -0700 (PDT) Received: from de-out1.bosch-org.com (de-out1.bosch-org.com [139.15.230.186]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 355B712025C for ; Wed, 3 Jul 2019 04:00:59 -0700 (PDT) Received: from si0vm1947.rbesz01.com (unknown [139.15.230.188]) by fe0vms0187.rbdmz01.com (Postfix) with ESMTPS id 45dyp13rW0z1XLDR1; Wed, 3 Jul 2019 13:00:57 +0200 (CEST) Received: from fe0vm1741.rbesz01.com (unknown [10.58.172.176]) by si0vm1947.rbesz01.com (Postfix) with ESMTPS id 45dyp13N9hz6CkJjM; Wed, 3 Jul 2019 13:00:57 +0200 (CEST) X-AuditID: 0a3aad15-b2bff70000000e31-67-5d1c8ae9f876 Received: from fe0vm1651.rbesz01.com ( [10.58.173.29]) (using TLS with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by fe0vm1741.rbesz01.com (SMG Outbound) with SMTP id 9F.9C.03633.9EA8C1D5; Wed, 3 Jul 2019 13:00:57 +0200 (CEST) Received: from SI-MBX2033.de.bosch.com (si-mbx2033.de.bosch.com [10.3.230.36]) by fe0vm1651.rbesz01.com (Postfix) with ESMTPS id 45dyp11lw5znr8; Wed, 3 Jul 2019 13:00:57 +0200 (CEST) Received: from SI-MBX2033.de.bosch.com (10.3.230.36) by SI-MBX2033.de.bosch.com (10.3.230.36) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.1.1713.5; Wed, 3 Jul 2019 13:00:57 +0200 Received: from SI-MBX2033.de.bosch.com ([fe80::88a0:7dd8:cf69:6aaa]) by SI-MBX2033.de.bosch.com ([fe80::88a0:7dd8:cf69:6aaa%4]) with mapi id 15.01.1713.007; Wed, 3 Jul 2019 13:00:57 +0200 From: "Kraus Achim (INST/ECS4)" To: Sean Turner , TLS List Thread-Topic: [TLS] Early code-point assignments for draft-ietf-tls-dtls-connection-id Thread-Index: AQHVMTE9FxBY+g1l8kytdt+T2h+y6qa4ulIw Date: Wed, 3 Jul 2019 11:00:56 +0000 Message-ID: <3b7505f7d9e1404f86b47fefdc8aa99f@bosch-si.com> References: <54CE8033-240D-4E4E-8850-7383E3D936E0@sn3rd.com> In-Reply-To: <54CE8033-240D-4E4E-8850-7383E3D936E0@sn3rd.com> Accept-Language: de-DE, en-US Content-Language: de-DE X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.22.83.209] Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Brightmail-Tracker: H4sIAAAAAAAAA21Tf0wbZRjmu2vL0XB6HJS+FFB2M2qcQ8qPMGEg8SdKxhZxsrihO8ZBG/sD ewUHSgKLxFEXsy7MdCTggEoJDLbADCA6pAsWphGysFjAaYRl0m5zBBzTaBqvvbL2D/97vuf9 nud93+e7I3C6lVARWoOZMxlYHSOTS+Q5A8k7PZaksjSPVbFrvq8J37U+a0EFWKHd/jdWODmJ 9mFvyXdXcDptLWd6Jv+wXHPV+l71bOTR8ZZVrBENyCwoigAqE35bdkgsSE7QlA2DmTOXZOJh HEHTwCYSD7cRbBy/KxUPEwim564jv15G5cCps5cj/TiOehY2+20B31iqFBavfIeJ/AG41rkQ xOnwx0+LuB9LqMegp88T4EkqFy62NwYwTe2G75cuBnyiqDz4dnNJ6seISoYLF2YDWpxSwtDN +1JxBwrsX4s8UArwrPiCfArM/DiOxPup4D7dKhPxDujpvIWLfWOElW9ITqL4tjDbtjBJW5ik LUxyFkn6kKKSS6vVq7Mz1ammco6vT1OnHjHqh5D4QIpRtOapdCKKQEw0WdSSVEZL2Vq+Tu9E WQTGKMj+OoF6qNxYUadhec07phodxzMqMmnutUN07AOarynXa3leazQ4ERA4E0dO9CaU0WQF W1fPmYyizIkSCQmjJKuIvYdoqoo1c+9yXDVn2qrmEgQD5Af+GWJMXBV3tFKrM2+VmWQSRURE 0PHhlfC2GBHlRBlEtNAb91uQfDWr57VVQXmCKKe32JD0CnqVOOlp78KJyamOLpyWGIwGTqUk 04Uvl6b89zU1hgdzqJLI/OzEMloRVgh5edECEpKMJRuOC+Jo4W8ITQBkoj+0mCAZEqV/IWio FimcX/kEgW9wSEC+azI4ccdHQPM9KwXu25cV4B0ZjgfbZz1KuDo28wi4TwymwMTN6RTw2U5v g43F9m1wrnX+Sfhl8MzTcMx7aiesuj/PBFu3IwvsG2NZMLhwPQdujHycDx1u1ysw1jy1R3B2 FEPv1FoxrI72lcBHrksl8PNwUylM93QehI65Owfhn/Xlw8JAw6xXiBcT4n3UqPLHa2bN/xNv kA1tp2pELu0TvfsxR1FevfntD++97x3PGpB6MvZlF3QfWV8zxXy5o7XbIVfoajUjRZlqfvun uQ/b7/bDavR9WwI+/2bDn9bSyOaavV/tb4jL+3e5K/G5Y3P2ih9Gtytvlby+50XVN78zxS2j 1l+pv1Jferk0w5V8fuSFJVfcG48/X1B4ziLNXjnASHgNq34KN/Hsf7OO6HCnBAAA Archived-At: Subject: Re: [TLS] Early code-point assignments for draft-ietf-tls-dtls-connection-id X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 03 Jul 2019 11:01:02 -0000 Great news! Thanks a lot!=20 May be you can spend a couple of words to explain " temporary"? I hope, it's more about the description/entry details than the number.=20 Mit freundlichen Gr=FC=DFen / Best regards Achim Kraus Engineering Cloud Services 4 Bosch IoT Hub (INST/ECS4)=20 -----Urspr=FCngliche Nachricht----- Von: TLS Im Auftrag von Sean Turner Gesendet: Mittwoch, 3. Juli 2019 01:52 An: TLS List Betreff: [TLS] Early code-point assignments for draft-ietf-tls-dtls-connect= ion-id The following temporary assignments have been made for draft-ietf-tls-dtls-= connection-id: Registry: TLS ExtensionType Values Value: 53 Extension Name: connection_id TLS 1.3: -=20 Recommended: Y Registry: TLS ContentType Registry Value: 25 Description: tls12_cid DTLS-OK: Y J/C/S _______________________________________________ TLS mailing list TLS@ietf.org https://www.ietf.org/mailman/listinfo/tls From nobody Wed Jul 3 05:13:23 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 26D3E120203 for ; Wed, 3 Jul 2019 05:13:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=akamai.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2CpVbtgsMtKb for ; Wed, 3 Jul 2019 05:13:17 -0700 (PDT) Received: from mx0a-00190b01.pphosted.com (mx0a-00190b01.pphosted.com [IPv6:2620:100:9001:583::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4194E120072 for ; Wed, 3 Jul 2019 05:13:17 -0700 (PDT) Received: from pps.filterd (m0050093.ppops.net [127.0.0.1]) by m0050093.ppops.net-00190b01. (8.16.0.27/8.16.0.27) with SMTP id x63CBkJY022833; Wed, 3 Jul 2019 13:13:11 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=akamai.com; h=from : to : subject : date : message-id : references : in-reply-to : content-type : content-id : content-transfer-encoding : mime-version; s=jan2016.eng; bh=7BQcQkpkqv221sJ+Vvvv6KdRjnluLZBbGVmTNAx7Yjk=; b=fRIhX/p/D+i4hn6czJe/mGqjsJqFt4JsT7c4tUB+Ribj6R463dZQLNrMbrOJ0ov2EpNi aS/byD92SyR124KNR5GnZPMSJyqzslfO2Ax+l6luHcBpWdYm0X1IWVB+gD4LFmQCMKdI 1A+YoRCw8ES0N0mbXL8/yPbYEOlBSuBbEgUi4Wq3C9/hGwgq5VWbsqpnNpJ8lCd5Biww xEvb4+eorrwxoIOTVYIfjCheQu2aHecXl87gepUIzm4M+ET0MlgqqfZ7bQ4sGHvcBQM8 QHMWBtZNYmgiUDQHy7FxTTJbhOOH9+0tvJAPqStbszKPWf3r8bZhvOM11Lwy2e1PEbJT hQ== Received: from prod-mail-ppoint1 (prod-mail-ppoint1.akamai.com [184.51.33.18] (may be forged)) by m0050093.ppops.net-00190b01. with ESMTP id 2tgshg0gbm-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 03 Jul 2019 13:13:11 +0100 Received: from pps.filterd (prod-mail-ppoint1.akamai.com [127.0.0.1]) by prod-mail-ppoint1.akamai.com (8.16.0.27/8.16.0.27) with SMTP id x63C2djD032540; Wed, 3 Jul 2019 08:13:10 -0400 Received: from email.msg.corp.akamai.com ([172.27.123.34]) by prod-mail-ppoint1.akamai.com with ESMTP id 2te3awqeps-2 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Wed, 03 Jul 2019 08:13:08 -0400 Received: from USMA1EX-DAG1MB1.msg.corp.akamai.com (172.27.123.101) by usma1ex-dag1mb1.msg.corp.akamai.com (172.27.123.101) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Wed, 3 Jul 2019 08:12:48 -0400 Received: from USMA1EX-DAG1MB1.msg.corp.akamai.com ([172.27.123.101]) by usma1ex-dag1mb1.msg.corp.akamai.com ([172.27.123.101]) with mapi id 15.00.1473.004; Wed, 3 Jul 2019 08:12:48 -0400 From: "Salz, Rich" To: "Kraus Achim (INST/ECS4)" , Sean Turner , TLS List Thread-Topic: [TLS] Early code-point assignments for draft-ietf-tls-dtls-connection-id Thread-Index: AQHVMTFHQBF4FnjmWkeRlXrVupZsUKa4/dgA///RBwA= Date: Wed, 3 Jul 2019 12:12:47 +0000 Message-ID: References: <54CE8033-240D-4E4E-8850-7383E3D936E0@sn3rd.com> <3b7505f7d9e1404f86b47fefdc8aa99f@bosch-si.com> In-Reply-To: <3b7505f7d9e1404f86b47fefdc8aa99f@bosch-si.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.1a.0.190609 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [172.19.40.233] Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-07-03_03:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 mlxscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1810050000 definitions=main-1907030147 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-07-03_03:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1011 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1810050000 definitions=main-1907030149 Archived-At: Subject: Re: [TLS] Early code-point assignments for draft-ietf-tls-dtls-connection-id X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 03 Jul 2019 12:13:20 -0000 SXQgbWVhbnMgdGhlIGFzc2lnbm1lbnRzIGFyZW4ndCBvZmZpY2lhbCB1bnRpbCB0aGUgUkZDIGlz IHB1Ymxpc2hlZCBhbmQgSUFOQSB1cGRhdGVzIHRoZSByZWdpc3RyeSBmaWxlcyB3aXRoIHRoYXQg aW5mb3JtYXRpb24uDQoNCkZyb20geW91ciBwZXJzcGVjdGl2ZSwgdGhlcmUncyBubyBkaWZmZXJl bmNlLg0KDQrvu79PbiA3LzMvMTksIDc6MDEgQU0sICJLcmF1cyBBY2hpbSAoSU5TVC9FQ1M0KSIg PEFjaGltLktyYXVzQGJvc2NoLXNpLmNvbT4gd3JvdGU6DQoNCiAgICBHcmVhdCBuZXdzISBUaGFu a3MgYSBsb3QhIA0KICAgIA0KICAgIE1heSBiZSB5b3UgY2FuIHNwZW5kIGEgY291cGxlIG9mIHdv cmRzIHRvIGV4cGxhaW4gIiB0ZW1wb3JhcnkiPw0KICAgIEkgaG9wZSwgaXQncyBtb3JlIGFib3V0 IHRoZSBkZXNjcmlwdGlvbi9lbnRyeSBkZXRhaWxzIHRoYW4gdGhlIG51bWJlci4gDQogICAgDQog ICAgTWl0IGZyZXVuZGxpY2hlbiBHcsO8w59lbiAvIEJlc3QgcmVnYXJkcw0KICAgIA0KICAgIEFj aGltIEtyYXVzDQogICAgDQogICAgRW5naW5lZXJpbmcgQ2xvdWQgU2VydmljZXMgNCBCb3NjaCBJ b1QgSHViIChJTlNUL0VDUzQpIA0KICAgIA0KICAgIA0KICAgIC0tLS0tVXJzcHLDvG5nbGljaGUg TmFjaHJpY2h0LS0tLS0NCiAgICBWb246IFRMUyA8dGxzLWJvdW5jZXNAaWV0Zi5vcmc+IEltIEF1 ZnRyYWcgdm9uIFNlYW4gVHVybmVyDQogICAgR2VzZW5kZXQ6IE1pdHR3b2NoLCAzLiBKdWxpIDIw MTkgMDE6NTINCiAgICBBbjogVExTIExpc3QgPHRsc0BpZXRmLm9yZz4NCiAgICBCZXRyZWZmOiBb VExTXSBFYXJseSBjb2RlLXBvaW50IGFzc2lnbm1lbnRzIGZvciBkcmFmdC1pZXRmLXRscy1kdGxz LWNvbm5lY3Rpb24taWQNCiAgICANCiAgICBUaGUgZm9sbG93aW5nIHRlbXBvcmFyeSBhc3NpZ25t ZW50cyBoYXZlIGJlZW4gbWFkZSBmb3IgZHJhZnQtaWV0Zi10bHMtZHRscy1jb25uZWN0aW9uLWlk Og0KICAgIA0KICAgIFJlZ2lzdHJ5OiBUTFMgRXh0ZW5zaW9uVHlwZSBWYWx1ZXMNCiAgICBWYWx1 ZTogNTMNCiAgICBFeHRlbnNpb24gTmFtZTogY29ubmVjdGlvbl9pZA0KICAgIFRMUyAxLjM6IC0g DQogICAgUmVjb21tZW5kZWQ6IFkNCiAgICANCiAgICBSZWdpc3RyeTogVExTIENvbnRlbnRUeXBl IFJlZ2lzdHJ5DQogICAgVmFsdWU6IDI1DQogICAgRGVzY3JpcHRpb246IHRsczEyX2NpZA0KICAg IERUTFMtT0s6IFkNCiAgICANCiAgICBKL0MvUw0KICAgIF9fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fDQogICAgVExTIG1haWxpbmcgbGlzdA0KICAgIFRMU0Bp ZXRmLm9yZw0KICAgIGh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vdGxzDQog ICAgDQogICAgX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18N CiAgICBUTFMgbWFpbGluZyBsaXN0DQogICAgVExTQGlldGYub3JnDQogICAgaHR0cHM6Ly93d3cu aWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby90bHMNCiAgICANCg0K From nobody Wed Jul 3 08:01:51 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 407DE120479 for ; Wed, 3 Jul 2019 08:01:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.299 X-Spam-Level: X-Spam-Status: No, score=-4.299 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Li1qOBSGqLKW for ; Wed, 3 Jul 2019 08:01:40 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 717FA1203E2 for ; Wed, 3 Jul 2019 08:01:24 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 5F549BE51; Wed, 3 Jul 2019 16:01:22 +0100 (IST) Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6973l5dNuR6b; Wed, 3 Jul 2019 16:01:22 +0100 (IST) Received: from [134.226.36.93] (unknown [134.226.36.93]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 25467BE50; Wed, 3 Jul 2019 16:01:22 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1562166082; bh=+BdRkORf3mkLe7d/b5IcKSPwELuuhoqf3zUJ5RnQsK8=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=Tg33h2E2AcwyIv6sSPbMth1lO57d6NMHp1PJukh83xSHytT86oLFOpjjFQqMciCZO 7H12gxsbpCVihmkhB58QAerYRTTTFTDs1rLJTyiN9oxTJRlKo12XokGV5wAnAwKEE2 /7drigp2B+f0bABvGmm+elDnYhO5r7GjsT+eNHe8= To: Christian Huitema Cc: "tls@ietf.org" References: <7374648a-d684-87be-0807-219bc10793ac@cs.tcd.ie> <18514.1561564689@localhost> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: Date: Wed, 3 Jul 2019 16:01:21 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.7.2 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="bw6s0zQztsmZGhEPWtapdIvrVAumE3hZQ" Archived-At: Subject: Re: [TLS] publishing ESNIKeys under a .well-known URI... X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 03 Jul 2019 15:01:50 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --bw6s0zQztsmZGhEPWtapdIvrVAumE3hZQ Content-Type: multipart/mixed; boundary="JQmaIxUk9oLgabwQFJHGmzH8vZrWZ1omE"; protected-headers="v1" From: Stephen Farrell To: Christian Huitema Cc: "tls@ietf.org" Message-ID: Subject: Re: [TLS] publishing ESNIKeys under a .well-known URI... References: <7374648a-d684-87be-0807-219bc10793ac@cs.tcd.ie> <18514.1561564689@localhost> In-Reply-To: --JQmaIxUk9oLgabwQFJHGmzH8vZrWZ1omE Content-Type: multipart/mixed; boundary="------------DC2E5D648C9F918345011783" Content-Language: en-GB This is a multi-part message in MIME format. --------------DC2E5D648C9F918345011783 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 26/06/2019 18:13, Christian Huitema wrote: > I think Stephen's issue will be quite common, especially for small > sites.=20 It doesn't take much to encourage me so I just pushed out that idea in I-D form:-) [1] Comments/PRs etc welcome. > But then, we should ask how often these sites need to update > the ESNI key. Yep. But regardless of where the key lifecycle arithmetic lands, I figure we still need a way to publish the things, for servers that don't have dynamic DNS APIs. Cheers, S. [1] https://tools.ietf.org/html/draft-farrell-tls-wkesni-00 --------------DC2E5D648C9F918345011783 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------DC2E5D648C9F918345011783-- --JQmaIxUk9oLgabwQFJHGmzH8vZrWZ1omE-- --bw6s0zQztsmZGhEPWtapdIvrVAumE3hZQ Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAl0cw0EACgkQWrL68XsX K+pS0w/+OcYAkcsPrwRDpSK1Xqv7Gjge9TvRl0N4VbpHvXfSeCg/Q7onLCt3GtqY oOTjl22EiLzX1OcggFxfvWM+dYZWam6Dpg+0KXIbb9SxaKKeKDtVtH0mDM4ar9lb yrWm8V228zTDB8CzjbgAy7gtYVfkEld8CpMo1mg3h3cerCqDcyyVk4Y09G/gZ5q/ or3SYldJeayi+kneaK5waKFFgCLT8wBcHU5pGg/emVqLMn6/YoUviNn6HR7laWwd VMPl5mm1QDaBZQHD/KyAHT03liRSYUeE07ywG5g83P4gzCiVAnyOK3innstPH/h1 Qq46NwaqmcXgTftlsBuN6Z1jB931HeCOfzqKgu1nw0Lor0rDnn/DhwJisilcF8v4 cK6QUt92HVth3PqtMJQp+MNW/Fgdo0e3nYGFiH9XfqKo8jWvB5hVMZD4rOr/Ay5D DDAx0r/d4lM+c07924zr2nZfp1mC7xyyCHGY/zJP02Y9ifjU9iGXXA0pupKYt6pf HwgrohZeptYmhrH1Wmk+ufZdXe3pg0wYgZWoTor5nPV7YNSFzfLBBDJSQvdiPkni MJpEcbDoDlaVodiRMduAyreSWl+lWKbYgyWgKKaAb++tgU1id0UAeKpfilwP1Jxu 2yAwRbxNc8zR8Nkrpisf833ZHV4luhR/vaF7bQMKDL6knQ10VmY= =Ark2 -----END PGP SIGNATURE----- --bw6s0zQztsmZGhEPWtapdIvrVAumE3hZQ-- From nobody Wed Jul 3 10:11:31 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1D4071203BC; Wed, 3 Jul 2019 10:11:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GRJVyCrmY0_0; Wed, 3 Jul 2019 10:11:26 -0700 (PDT) Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CBAE81203AD; Wed, 3 Jul 2019 10:11:16 -0700 (PDT) Received: from kduck.mit.edu ([24.16.140.251]) (authenticated bits=56) (User authenticated as kaduk@ATHENA.MIT.EDU) by outgoing.mit.edu (8.14.7/8.12.4) with ESMTP id x63HBCrr019913 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 3 Jul 2019 13:11:14 -0400 Date: Wed, 3 Jul 2019 12:11:11 -0500 From: Benjamin Kaduk To: draft-ietf-tls-grease.all@ietf.org Cc: tls@ietf.org Message-ID: <20190703171111.GK13810@kduck.mit.edu> MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: 8bit User-Agent: Mutt/1.10.1 (2018-07-13) Archived-At: Subject: [TLS] AD review of draft-ietf-tls-grease-02 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 03 Jul 2019 17:11:29 -0000 In general this looks to be in good shape, though we do have a remaining TODO item to rebase past the registry changes from RFCs 8446/9447. I see the shepherd writeup says "we hear it is easy to publish RFCs" and note with chagrin that I am not keeping up my end of the bargain. My specific section-by-section comments are below. Thanks! -Ben Section 1 The TLS protocol [RFC8446] includes several points of extensibility, including the list of cipher suites and the list of extensions. The values in these lists identify implementation capabilities. TLS We could probably make this text a little more precise (for one, there's not a single list of extensions since many messages can carry extensions). So, maybe "the list of cipher suites and several lists of extensions" and "The values transmitted in these lists"? Section 2 Can we add an editorial note that values prefaced with "{TBD}" are suggested values but subject to change prior to final allocation by IANA? Future versions of TLS or DTLS [RFC6347] MUST NOT use any of the above values as versions. Process-wise, this feels like an attempt to Update: the (D)TLS core specs, which we can't do in an Informational document. So it would probably be better to say something "The values thusly allocated are no longer available for use as version numbers by (D)TLS implemnetations". Things are made somewhat awkward by there not being a registry of protocol versions, sadly... Section 3.1 Are there any of these for which we want to say "the client MUST NOT advertise a list consisting solely of GREASE values"? It would probably be fine to do this for, say, key_share, but not for, say, cipher_suites. But perhaps the reader will be smart enough to figure out what works without prodding from us... Clients MUST reject GREASE values when negotiated by the server. Specifically, the client MUST fail the connection if a GREASE value appears any in the following: I did not attempt to audit the (omitted) list for completeness; the first sentence should cover any situations that are not specifically listed, right? Section 3.2 When processing a ClientHello, servers MUST NOT treat GREASE values differently from any unknown value. Servers MUST NOT negotiate any GREASE value when offered in a ClientHello. Servers MUST correctly ignore unknown values in a ClientHello and attempt to negotiate with one of the remaining parameters. Similarly to the above, we might consider adding a parenthetical noting that there may not be any remaining valid parameters, and that's not necessarily fatal. Note that these requirements are restatements or corollaries of existing server requirements in TLS. (side note) Some future reviewers might complain about using normative language to duplicate exisiting requirements from other documents; in this case, I don't mind, myself. Section 4.1 o A server MAY select one or more GREASE extension values and advertise corresponding extensions with varying length and contents. nit: I don't think "corresponding" is quite the right word; maybe "advertise those extensions"? o A server MAY select one or more GREASE signature algorithm values and advertise them in the "signature_algorithms" extension. I'm not necessarily expecting any action based on this comment, but I note that status_request, signed_certificate_timestamp, certificate_authorities, oid_filters, and signature_algorithms_cert are also currently defined for CertificateRequest but we do not call out any extension-specific greasing for them. Of that list, only signature_algorithms_cert seems like it might be calling out for special handling, to me... Section 4.2 When processing a CertificateRequest or NewSessionTicket, clients MUST NOT treat GREASE values differently from any unknown value. Clients MUST NOT negotiate any GREASE value when offered by the server. Clients MUST correctly ignore unknown values offered by the server and attempt to negotiate with one of the remaining parameters. (following the theme) I don't remember any cases where the client can succeed if the list becomes empty after pruning unknown values ... if we are deciding that we want to say anything on this topic at all. Section 5 Implementations advertising GREASE values SHOULD select them at random. This is intended to encourage implementations to ignore all unknown values rather than any individual value. Implementations MUST honor protocol specifications when sending GREASE values. For instance, implementations sending multiple GREASE values as extensions MUST NOT send the same GREASE value twice. Feel free to tell me that I'm being internally inconsistent, but in this case "MUST NOT send the same GREASE value twice" does not seem like a good place to use normative language to restate an existing requirement. So I'd rather see lowercase "must not" and possibly a section reference to 8446 4.2 ("[t]here MUST NOT be more than one extension of the same type in a given extension block."). Section 6 [[TODO: Update IANA considerations for TLS 1.3 and rebase over draft- ietf-tls-iana-registry-updates.]] Can the shepherd please work with the author to make the needed changes? IIRC the main change for TLS 1.3 is the "TLS 1.3" column for extensiontype values. Since this document is Informational, we have to be Recommended "N" for everything. Thanks for the note about the specific values listed being just suggestions. From nobody Sun Jul 7 03:58:26 2019 Return-Path: X-Original-To: tls@ietf.org Delivered-To: tls@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id E194812018E; Sun, 7 Jul 2019 03:58:09 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Christer Holmberg via Datatracker To: Cc: draft-ietf-tls-exported-authenticator.all@ietf.org, ietf@ietf.org, tls@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.98.2 Auto-Submitted: auto-generated Precedence: bulk Reply-To: Christer Holmberg Message-ID: <156249708979.14501.13745976049183757305@ietfa.amsl.com> Date: Sun, 07 Jul 2019 03:58:09 -0700 Archived-At: Subject: [TLS] Genart last call review of draft-ietf-tls-exported-authenticator-09 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 07 Jul 2019 10:58:11 -0000 Reviewer: Christer Holmberg Review result: Ready with Issues I am the assigned Gen-ART reviewer for this draft. The General Area Review Team (Gen-ART) reviews all IETF documents being processed by the IESG for the IETF Chair. Please treat these comments just like any other last call comments. For more information, please see the FAQ at . Document: draft-ietf-tls-exported-authenticator-09 Reviewer: Christer Holmberg Review Date: 2019-07-07 IETF LC End Date: 2019-07-16 IESG Telechat date: Not scheduled for a telechat Summary: The document is well written. However, I have found some issues that the author may want to consider clarifying in the document. Major issues: N/A Minor issues: MIN_1: The last sentence of Section 1 says that the mechanism requires TLS version 1.2 or later. Would it be useful to state that in a dedicated Applicability section? MIN_2: Can the mechanism be used also for DTLS? MIN_3: The documents talk about additional certificates. If I only have one additional certificate, can I use that for multiple authenticators throughout the TLS session? MIN_4: Section 3 and 4 say that the authenticator request and authenticator SHOULD be sent using TLS, and Section 1 says that the proof of authentication can be sent out-of-band. I think it would be useful to clarify whether both the authenticator request and authenticator can be sent out-of-band ( i.e., not using the TLS connection that the additional authentication is associated with), and also to state whether it IS allowed to send the authenticator request and authenticator on the TLS connection they are associated with. MIN_5: Section 5 talks about an endpoint sending an empty authenticator. But, what if the sender of the authenticator request does not receive anything? Does it simply move on? Does it terminate the TLS session? Is the action based on local policy? MIN_6: Related to MIN_5, I can't find text about how endpoints inform each other about the support of the mechanism, so maybe a few words about that would be useful. And some words about backward compatibility with endpoints that don't support the mechanism. MIN_7: What happens if the validation of an authenticator fails? Does the requester simply move on? Does it terminate the TLS session? Is the action based on local policy? Nits/editorial comments: ED_1: The document uses "session", "TLS connection" and "TLS communication" terminology. Is that intentional, or wouuld it be possible to use consistent terminology? ED_2: Section 3 says: "The authenticator request is a structured message that can be created..." Section 4 says: "The authenticator is a structured message that can be exported..." In the 2nd paragraph of Section 4 it is stated that "authenticator" is sent based on an "authenticator request". I wonder if that could be stated already in the beginning of Section 4, to further clarify the difference between them. E.g., "The authenticator is a structured message, triggered by an authenticator request, that can be exported from either party of a TLS connection." From nobody Mon Jul 8 11:01:45 2019 Return-Path: X-Original-To: tls@ietf.org Delivered-To: tls@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id CC2DF1205DA; Mon, 8 Jul 2019 11:01:25 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: tls@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.98.3 Auto-Submitted: auto-generated Precedence: bulk Reply-To: tls@ietf.org Message-ID: <156260888577.1035.6354800296631306527@ietfa.amsl.com> Date: Mon, 08 Jul 2019 11:01:25 -0700 Archived-At: Subject: [TLS] I-D Action: draft-ietf-tls-dtls-connection-id-06.txt X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 08 Jul 2019 18:01:38 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Transport Layer Security WG of the IETF. Title : Connection Identifiers for DTLS 1.2 Authors : Eric Rescorla Hannes Tschofenig Thomas Fossati Filename : draft-ietf-tls-dtls-connection-id-06.txt Pages : 15 Date : 2019-07-08 Abstract: This document specifies the Connection ID (CID) construct for the Datagram Transport Layer Security (DTLS) protocol version 1.2. A CID is an identifier carried in the record layer header that gives the recipient additional information for selecting the appropriate security association. In "classical" DTLS, selecting a security association of an incoming DTLS record is accomplished with the help of the 5-tuple. If the source IP address and/or source port changes during the lifetime of an ongoing DTLS session then the receiver will be unable to locate the correct security context. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-tls-dtls-connection-id/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-tls-dtls-connection-id-06 https://datatracker.ietf.org/doc/html/draft-ietf-tls-dtls-connection-id-06 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-tls-dtls-connection-id-06 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Mon Jul 8 13:12:33 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EF423120282 for ; Mon, 8 Jul 2019 13:12:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.704 X-Spam-Level: X-Spam-Status: No, score=-0.704 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, PDS_NO_HELO_DNS=1.295, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cloudflare.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vwFlPNQansrE for ; Mon, 8 Jul 2019 13:12:18 -0700 (PDT) Received: from mail-vs1-xe2c.google.com (mail-vs1-xe2c.google.com [IPv6:2607:f8b0:4864:20::e2c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EE3CD1202A4 for ; Mon, 8 Jul 2019 13:12:17 -0700 (PDT) Received: by mail-vs1-xe2c.google.com with SMTP id 190so9090555vsf.9 for ; Mon, 08 Jul 2019 13:12:17 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cloudflare.com; s=google; h=mime-version:from:date:message-id:subject:to; bh=lgoN1TAoNHDzzxqxk07vj5Cjc5P6InEbdyVTMrHB13Q=; b=y89vDJXfoyf2zJVy5S5Sjn/lhaSCf3DUe/NjQ7sFNYOFzfNcphTX6LxBx2s+nQhGQV 7XqA/HyU6+woak7Hyqf3E2d5w4zPdqi2iCDx0MatQ65JIMmNVuZLIQToWm9y5rxsVx1h vNrsNtyg6bEgyiUsArOpH3MGcKXlcUBQ7Z5F4= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=lgoN1TAoNHDzzxqxk07vj5Cjc5P6InEbdyVTMrHB13Q=; b=GGjxvkUgx3wKlkFK3k6efkcSarwGwTGvcrc/VQY94zNirK5qhuiMu37a192NFjsD9N 4U7Nmo88tPIWoS60v/Bqg2h6jamQovbsVtQ4dlr7K+BoI00cVVi+2l64pSUcH1jVhNyC 3xNU/7E4F2/9+FENhclJbW7qyVnwHXdCf1mYgJ4kKjJm7HPyBp4J1Bk6kMlg7XeLCkKu gATDvBMhYRYZG2W/UjjoqF1/wkVcxzSqzpfHEgCDCJDOqTol2V+aCOJSO/XdYzeTW+v5 z0ZfhVAhvYDrgX6kzJUWLjhuDrZ3leZEg5VaDziEtsY697FFyN7vTvicQXbI40Lb2E7t E43Q== X-Gm-Message-State: APjAAAVp3ZZFvzwsQPxQf0OC90ZVfUH4O96HpDKPX3Ssc3y421qPB06o 3b4KTkJdDnlRE+VjQX+qedVhOrwcAyeOgChWOsQQLueTREY= X-Google-Smtp-Source: APXvYqxWb6r2XddWhbeExIDT79U/KQ8d+XxfQ1U2Oa7MG/UX2+hJ8BeQXhHOOOb/IzEn1HxdNH62wb6D6aYYAYV0b70= X-Received: by 2002:a67:e3d5:: with SMTP id k21mr11588775vsm.172.1562616736542; Mon, 08 Jul 2019 13:12:16 -0700 (PDT) MIME-Version: 1.0 From: Nick Sullivan Date: Mon, 8 Jul 2019 13:12:00 -0700 Message-ID: To: "" Content-Type: multipart/alternative; boundary="00000000000080b383058d310f9a" Archived-At: Subject: [TLS] Delegated Credentials in Client certificates X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 08 Jul 2019 20:12:28 -0000 --00000000000080b383058d310f9a Content-Type: text/plain; charset="UTF-8" Hello TLSWG, At previous meetings (and I think on the list?) there were requests to extend the Delegated Credentials in TLS ( https://tools.ietf.org/html/draft-ietf-tls-subcerts) draft to support client certificates. This turns out to be a pretty minor change to the document. I've put up a PR: https://github.com/tlswg/tls-subcerts/pull/26/files/a502f3055c3eefe59a4b36642cd062267ac0fff7 Let me know if there is opposition to this change. I'm planning on submitting -04 later today. Nick --00000000000080b383058d310f9a Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hello TLSWG,

At previous meetings (and = I think on the list?) there were requests to extend the Delegated Credentia= ls in TLS (= https://tools.ietf.org/html/draft-ietf-tls-subcerts) draft to support c= lient certificates. This turns out to be a pretty minor change to the docum= ent. I've put up a PR:


Let me know if th= ere is opposition to this change. I'm planning on submitting -04 later = today.

Nick
--00000000000080b383058d310f9a-- From nobody Mon Jul 8 13:43:16 2019 Return-Path: X-Original-To: tls@ietf.org Delivered-To: tls@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 2154112009E; Mon, 8 Jul 2019 13:43:02 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: tls@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.98.3 Auto-Submitted: auto-generated Precedence: bulk Reply-To: tls@ietf.org Message-ID: <156261858207.1051.7738624465198272314@ietfa.amsl.com> Date: Mon, 08 Jul 2019 13:43:02 -0700 Archived-At: Subject: [TLS] I-D Action: draft-ietf-tls-dtls13-32.txt X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 08 Jul 2019 20:43:09 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Transport Layer Security WG of the IETF. Title : The Datagram Transport Layer Security (DTLS) Protocol Version 1.3 Authors : Eric Rescorla Hannes Tschofenig Nagendra Modadugu Filename : draft-ietf-tls-dtls13-32.txt Pages : 52 Date : 2019-07-08 Abstract: This document specifies Version 1.3 of the Datagram Transport Layer Security (DTLS) protocol. DTLS 1.3 allows client/server applications to communicate over the Internet in a way that is designed to prevent eavesdropping, tampering, and message forgery. The DTLS 1.3 protocol is intentionally based on the Transport Layer Security (TLS) 1.3 protocol and provides equivalent security guarantees with the exception of order protection/non-replayability. Datagram semantics of the underlying transport are preserved by the DTLS protocol. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-tls-dtls13/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-tls-dtls13-32 https://datatracker.ietf.org/doc/html/draft-ietf-tls-dtls13-32 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-tls-dtls13-32 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Mon Jul 8 13:44:10 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DDE4C1202BD for ; Mon, 8 Jul 2019 13:43:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.598 X-Spam-Level: X-Spam-Status: No, score=-2.598 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=fb.com header.b=Sz1eDzUd; dkim=pass (1024-bit key) header.d=fb.onmicrosoft.com header.b=jkpvTaZF Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mk1S41PN3mBN for ; Mon, 8 Jul 2019 13:43:58 -0700 (PDT) Received: from mx0a-00082601.pphosted.com (mx0a-00082601.pphosted.com [67.231.145.42]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 33BFB1202D5 for ; Mon, 8 Jul 2019 13:43:56 -0700 (PDT) Received: from pps.filterd (m0044012.ppops.net [127.0.0.1]) by mx0a-00082601.pphosted.com (8.16.0.27/8.16.0.27) with SMTP id x68Ke14h010015; Mon, 8 Jul 2019 13:43:53 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fb.com; h=from : to : subject : date : message-id : references : in-reply-to : content-type : mime-version; s=facebook; bh=PmljSxFDkdaGzc0s7ql4QbQwcm+jK+c14ykSe4LsoNA=; b=Sz1eDzUdJtaROrbsppPxdjblmUZhRpgQpVJkpL9pIEG5X4E4sgagnC6QrcYTJOAg5Rxo TfiEnYKbaypPzgaqvKPV2uJ8hjkkdfo2chHvFDVZLVXWMuptK4VMSA8Dz1dIio5uXgrQ //wZu3rIKVQeavHuZK0OvD+VoNUYBWPc2s4= Received: from mail.thefacebook.com (mailout.thefacebook.com [199.201.64.23]) by mx0a-00082601.pphosted.com with ESMTP id 2tmb6ngf0h-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Mon, 08 Jul 2019 13:43:53 -0700 Received: from prn-hub05.TheFacebook.com (2620:10d:c081:35::129) by prn-hub05.TheFacebook.com (2620:10d:c081:35::129) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.1.1713.5; Mon, 8 Jul 2019 13:43:52 -0700 Received: from NAM02-SN1-obe.outbound.protection.outlook.com (192.168.54.28) by o365-in.thefacebook.com (192.168.16.29) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.1.1713.5 via Frontend Transport; Mon, 8 Jul 2019 13:43:52 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fb.onmicrosoft.com; s=selector1-fb-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=PmljSxFDkdaGzc0s7ql4QbQwcm+jK+c14ykSe4LsoNA=; b=jkpvTaZFRmqZ0Jvy6A9oMwqkoBnql4cn8nZDwTjaU9Sa0iF5+hr72lbpzZuXuFW7r4f0iySdLZ0TlseFZGYxU8b9TgDmiQYpTsmW4MjK6m/XoQI96w2FAhO23TJPqu0fcX9/Lz802kIByCOkqqtt6bQHFfsXcn/TMRjf1IAWO1w= Received: from MWHPR15MB1821.namprd15.prod.outlook.com (10.174.255.137) by MWHPR15MB1677.namprd15.prod.outlook.com (10.175.135.150) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2052.20; Mon, 8 Jul 2019 20:43:51 +0000 Received: from MWHPR15MB1821.namprd15.prod.outlook.com ([fe80::6529:3f82:1bc3:7e68]) by MWHPR15MB1821.namprd15.prod.outlook.com ([fe80::6529:3f82:1bc3:7e68%5]) with mapi id 15.20.2052.020; Mon, 8 Jul 2019 20:43:51 +0000 From: Subodh Iyengar To: Nick Sullivan , "" Thread-Topic: [TLS] Delegated Credentials in Client certificates Thread-Index: AQHVNcnTwh8NH4CWLk6hDOnEPqmdZqbBLwnq Date: Mon, 8 Jul 2019 20:43:50 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [2620:10d:c090:180::1:bb3] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: f6358210-df74-4f60-3618-08d703e4fc04 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:MWHPR15MB1677; x-ms-traffictypediagnostic: MWHPR15MB1677: x-ms-exchange-purlcount: 2 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-forefront-prvs: 00922518D8 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(346002)(39860400002)(136003)(396003)(366004)(376002)(189003)(199004)(14454004)(19627405001)(110136005)(54896002)(6306002)(33656002)(76176011)(102836004)(476003)(446003)(5660300002)(11346002)(6506007)(71190400001)(486006)(9686003)(68736007)(81156014)(81166006)(236005)(8676002)(53546011)(46003)(52536014)(8936002)(186003)(256004)(71200400001)(6436002)(66446008)(66556008)(76116006)(66946007)(73956011)(66476007)(64756008)(7736002)(478600001)(966005)(74316002)(55016002)(606006)(53936002)(6606003)(2906002)(99286004)(316002)(6246003)(86362001)(25786009)(7696005)(229853002)(6116002)(491001); DIR:OUT; SFP:1102; SCL:1; SRVR:MWHPR15MB1677; H:MWHPR15MB1821.namprd15.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: fb.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: 1XFxo3PenOuSwoD29EWRzFregbJJdllZPxxiawJyYQ3UNPNKJh1kFKlEvZG97hCWDCHSi8zxG8RzrproPG09rourZHlr7FaG/bVej/XddErh5XtybtGxuMCJuSP3C+0UJ5C9RMBCS+2PPIpms2+JN8XH4Og+iHJdiS8pJCSjkuraOZIsXmMzY1O1QDhnjmEMzYVf19rEM1EgRst8TP7h1BsRHEv1Aim8jQrURgVBpNue/aIz8qBIZyDhbdHyCxaVgFPkARL9LODnZ8Klkx7Fd8YV338lZYygzLOUjqXBiTF1m6ulKiGXJZYCwyyXtnsBGepifJM2QHEYPTwYIXbKcE9OrWjLRlxl2tWM1dkHJC4z0pIVZNaMDIPKZgr5KGwpOdPAII2cdfoXSq0OHqev9Mht0jj66rN1udjWo/ZNjTs= Content-Type: multipart/alternative; boundary="_000_MWHPR15MB1821D118DF017EA5776231DBB6F60MWHPR15MB1821namp_" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: f6358210-df74-4f60-3618-08d703e4fc04 X-MS-Exchange-CrossTenant-originalarrivaltime: 08 Jul 2019 20:43:51.0014 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 8ae927fe-1255-47a7-a2af-5f3a069daaa2 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: subodh@fb.com X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR15MB1677 X-OriginatorOrg: fb.com X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-07-08_07:, , signatures=0 X-Proofpoint-Spam-Details: rule=fb_default_notspam policy=fb_default score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1011 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1810050000 definitions=main-1907080258 X-FB-Internal: deliver Archived-At: Subject: Re: [TLS] Delegated Credentials in Client certificates X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 08 Jul 2019 20:44:08 -0000 --_000_MWHPR15MB1821D118DF017EA5776231DBB6F60MWHPR15MB1821namp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Thanks for writing this up Nick. I support this change. I think one interesting addition to this PR might be a discussion of what c= ould happen if you use the same DC as both a client and server. I suspect t= his is what a lot of people might do in a datacenter environment and that t= his is safe (because of the signature context), but it might push people to= think a little more about this topic. Subodh ________________________________ From: TLS on behalf of Nick Sullivan Sent: Monday, July 8, 2019 1:12:00 PM To: Subject: [TLS] Delegated Credentials in Client certificates Hello TLSWG, At previous meetings (and I think on the list?) there were requests to exte= nd the Delegated Credentials in TLS (https://tools.ietf.org/html/draft-ietf= -tls-subcerts) draft to supp= ort client certificates. This turns out to be a pretty minor change to the = document. I've put up a PR: https://github.com/tlswg/tls-subcerts/pull/26/files/a502f3055c3eefe59a4b366= 42cd062267ac0fff7 Let me know if there is opposition to this change. I'm planning on submitti= ng -04 later today. Nick --_000_MWHPR15MB1821D118DF017EA5776231DBB6F60MWHPR15MB1821namp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Thanks for writing this up Nick.&= nbsp;I support this change. 


I think one interesting addition = to this PR might be a discussion of what could happen if you use the same D= C as both a client and server. I suspect this is what a lot of people might= do in a datacenter environment and that this is safe (because of the signature context), but it might pu= sh people to think a little more about this topic.


Subodh

From: TLS <tls-bounces@i= etf.org> on behalf of Nick Sullivan <nick=3D40cloudflare.com@dmarc.ie= tf.org>
Sent: Monday, July 8, 2019 1:12:00 PM
To: <tls@ietf.org>
Subject: [TLS] Delegated Credentials in Client certificates
 
Hello TLSWG,

At previous meetings (and I think on the list?) there were requests to= extend the Delegated Credentials in TLS (https://tools.ietf.org/htm= l/draft-ietf-tls-subcerts) draft to support client certificates. This turns out to be a pretty minor = change to the document. I've put up a PR:


Let me know if there is opposition to this change. I'm planning on sub= mitting -04 later today.

Nick
--_000_MWHPR15MB1821D118DF017EA5776231DBB6F60MWHPR15MB1821namp_-- From nobody Mon Jul 8 14:27:54 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A75C812031C for ; Mon, 8 Jul 2019 14:27:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.106 X-Spam-Level: X-Spam-Status: No, score=-0.106 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FORGED_FROMDOMAIN=0.247, FREEMAIL_FROM=0.001, HEADER_FROM_DIFFERENT_DOMAINS=0.249, HTML_MESSAGE=0.001, PDS_NO_HELO_DNS=1.295, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id N41Ve76745JK for ; Mon, 8 Jul 2019 14:27:42 -0700 (PDT) Received: from mail-wm1-f48.google.com (mail-wm1-f48.google.com [209.85.128.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 303981202A3 for ; Mon, 8 Jul 2019 14:27:42 -0700 (PDT) Received: by mail-wm1-f48.google.com with SMTP id w9so908897wmd.1 for ; Mon, 08 Jul 2019 14:27:42 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to; bh=JHszSawOh1OhLxFerjlxVACRI8h4l2i9RkY5MWFFkpU=; b=Mu+B77FhME07Di5Z6kcdd0emxqBVt/1GGcaxeZyEocVsnVjaiNBShUeEONv0jlbQKe W7yBVvbrfuWfMocsIGXyZQnIqthHiYh/F//7yW5g8CqmiWYz6OGt/HVO/kNN9okU718m zne0ZSpAFSjj9saSFhd++KKL5dpZbTrYrjBYmfmmB+b5SQQdFRJqsvII3q4VGIPdXyl3 f9VQgkXQet00W2Ar4z+ZH3vERjLCVzv3WB+Hial2Ph9ODXsIDNj/5AYYaWVA5eaHzn50 Udqk9MzRkuVGazZ/GN+mYqs9B8FumYXv3h+6Pm33smKdqRxwKBOP4sUz88+DJdMFaq5Q SqYw== X-Gm-Message-State: APjAAAWEOC7wG4qULHQrN3FdTo2YVdiH2VVv1PdhbtC6w6ikeRSYsknZ d7IU6tzMqj0fIPpdn7h4l493g9YL2MUigmQHWdryeiBl X-Google-Smtp-Source: APXvYqwsrQXdui6n5IOHV2cznUozAb0sara+Xxy1h78oRLSm49vEG99DjM3xEd8BcZFCnuWsmj4bkRvY8AJ5gl6Mpb0= X-Received: by 2002:a1c:f914:: with SMTP id x20mr19027510wmh.142.1562621259845; Mon, 08 Jul 2019 14:27:39 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Erik Nygren Date: Mon, 8 Jul 2019 17:27:28 -0400 Message-ID: To: tls@ietf.org, Ben Schwartz , Mike Bishop Content-Type: multipart/alternative; boundary="0000000000001c943d058d321d81" Archived-At: Subject: [TLS] HTTPSSVC record draft - ESNI alternative for HTTPS X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 08 Jul 2019 21:27:52 -0000 --0000000000001c943d058d321d81 Content-Type: text/plain; charset="UTF-8" For those not on the HTTP-WG or DNSOP lists, Ben Mike and I have a draft for an "HTTPSSVC" DNS record. There's a -03 that incorporates some feedback from the first version: https://tools.ietf.org/html/draft-nygren-httpbis-httpssvc-03 This attempts to address a number of problems (ESNI, QUIC bootstrapping, HTTP-to-HTTPS redirection via DNS, SRV-equivalent for HTTP, etc) in a holistic manner through a new extensible DNS record, rather than in a piecemeal fashion. It is based on some previous proposals such as "Alt-Svc in the DNS" and "Service Bindings" but takes into account feedback received in DNSOP and elsewhere. In particular for the TLS WG, we'd be interested in hearing if this would solve enough of the ESNI-key-delivery-via-DNS needs for the HTTPS use-case. Feedback is most welcome and we're looking forward to discussing with people in Montreal. While this is still an individual draft, we have been tracking it here: https://github.com/MikeBishop/dns-alt-svc but as always, commentary on the IETF lists is generally preferable. There is even a preliminary private type implementation in BIND of the -01 version (with the -02 wire format supported by ifdefs) from Mark Andrews: https://gitlab.isc.org/isc-projects/bind9/merge_requests/2135 >From the abstract: This document specifies an "HTTPSSVC" DNS resource record type to facilitate the lookup of information needed to make connections for HTTPS URIs. The HTTPSSVC DNS RR mechanism allows an HTTPS origin hostname to be served from multiple network services, each with associated parameters (such as transport protocol and keying material for encrypting TLS SNI). It also provides a solution for the inability of the DNS to allow a CNAME to be placed at the apex of a domain name. Finally, it provides a way to indicate that the origin supports HTTPS without having to resort to redirects, allowing clients to remove HTTP from the bootstrapping process. By allowing this information to be bootstrapped in the DNS, it allows for clients to learn of alternative services before their first contact with the origin. This arrangement offers potential benefits to both performance and privacy. This proposal is inspired by and based on recent DNS usage proposals such as ALTSVC, ANAME, and ESNIKEYS (as well as long standing desires to have SRV or a functional equivalent implemented for HTTP). These proposals each provide an important function but are potentially incompatible with each other, such as when an origin is load-balanced across multiple hosting providers (multi-CDN). Furthermore, these each add potential cases for adding additional record lookups in-addition to AAAA/A lookups. This design attempts to provide a unified framework that encompasses the key functionality of these proposals, as well as providing some extensibility for addressing similar future challenges. -- Some likely FAQs (with some others listed in an appendix): Q: Why this is HTTP-specific? A: This is because every protocol has different bootstrap requirements. This draft is concerned with improving the efficiency and security of bootstrapping HTTPS connections. This proposal does offer room for non-HTTPS protocols, but the nature of DNS requires underscore prefixing to support protocol-keyed answers within a single RRTYPE. It's also unlikely that a single RR format would be the ideal bootstrap mechanism for every protocol, and there's no reason that multiple protocols should have to share an RRTYPE. Q: Why is ESNI addressed directly? A: This helps make a major motivation of this draft more clear. Splitting out those sections to a separate-but-associated "alt-svc attribute for ESNI keys" draft might make sense, but keeping it here helps work through some of the issues together. Q: Why does this try to address the HSTS case? A: This is a unique opportunity to fix HTTPS bootstrap and avoid providing insecure defaults. We'd originally proposed a separate Alt-Svc attribute to indicate hsts-style behavior, but then realized that it would make sense to push on that as the default here. Best, Erik --0000000000001c943d058d321d81 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
For those not on the HTTP-WG or DNSOP lists, Ben Mike and I have=
a draft for an "HTTPSSVC" DNS record.=C2=A0 There's a -0= 3 that incorporates
some feedback from the first version:


This = attempts to address a number of problems (ESNI, QUIC bootstrapping, HTTP-to-HTTPS redirection via DNS, SRV-equivalent for HTTP, etc) in a=20 holistic manner through a new extensible DNS record, rather than in a=20 piecemeal fashion.=C2=A0 It is based on some previous proposals such as=20 "Alt-Svc in the DNS" and "Service Bindings" but takes i= nto account=20 feedback received in DNSOP and elsewhere.

In particular for the TLS WG, = we'd be interested in hearing if this would
solve enough of the ESNI-key= -delivery-via-DNS needs for the HTTPS use-case.

Feed= back is most welcome and we're looking forward to discussing with peopl= e in Montreal.

While this is still an individual draft,= we have been tracking it here:
=C2=A0=C2=A0=C2=A0 https://github.com/MikeBisho= p/dns-alt-svc
but as always, commentary on the IETF lists is generally p= referable.
There is even a preliminary private type implementation in BIND
of= the -01 version (with the -02 wire format supported by ifdefs)
from Mar= k Andrews:=C2=A0=20 https://gitlab.isc.org/isc-projects/bin= d9/merge_requests/2135

From the abstract:

= This document specifies an "HTTPSSVC" DNS resource record type to= facilitate the lookup of information needed to make connections for HTTPS = URIs.=C2=A0 The HTTPSSVC DNS RR mechanism allows an HTTPS origin hostname t= o be served from multiple network services, each with associated parameters= (such as transport protocol and keying material for encrypting TLS SNI).= =C2=A0 It also provides a solution for the inability of the DNS to allow a = CNAME to be placed at the apex of a domain name.=C2=A0 Finally, it provides= a way to indicate that the origin supports HTTPS without having to resort = to redirects, allowing clients to remove HTTP from the bootstrapping proces= s.

By allowing this information to be bootstrapped in the DNS, it al= lows for clients to learn of alternative services before their first contac= t with the origin.=C2=A0 This arrangement offers potential benefits to both= performance and privacy.

This proposal is inspired by and based on = recent DNS usage proposals such as ALTSVC, ANAME, and ESNIKEYS (as well as = long standing desires to have SRV or a functional equivalent implemented fo= r HTTP).=C2=A0 These proposals each provide an important function but are p= otentially incompatible with each other, such as when an origin is load-bal= anced across multiple hosting providers (multi-CDN). Furthermore, these eac= h add potential cases for adding additional record lookups in-addition to A= AAA/A lookups.=C2=A0 This design attempts to provide a unified framework th= at encompasses the key functionality of these proposals, as well as providi= ng some extensibility for addressing similar future challenges.

--

Some likely FAQ= s (with some others listed in an appendix):

Q: Why this is HTTP-specific?
A: This is because every protocol has different bootstrap requireme= nts.=C2=A0 This draft is concerned with improving the efficiency and security of bootstrapping=20 HTTPS connections.=C2=A0 This proposal does offer=20 room for non-HTTPS protocols, but the nature of DNS requires underscore=20 prefixing to support protocol-keyed answers within a single RRTYPE.=C2=A0= =20 It's also unlikely that a single RR format would be the ideal bootstrap= =20 mechanism for every protocol, and there's no reason that multiple=20 protocols should have to share an RRTYPE.
=C2=A0
<= /span>
Q: Why is ES= NI addressed directly?
A:= This helps make a major motivation of this draft more clear.=C2=A0 Splitti= ng out those sections to a separate-but-associated "alt-svc attribute = for ESNI keys" draft might make sense, but keeping it here helps work = through some of the issues together.

Q: W= hy does this try to address the HSTS case?
A: This is a unique opportunity to fix HTTPS bootstrap an= d avoid providing insecure defaults.=C2=A0 We'd originally proposed a s= eparate Alt-Svc attribute to indicate hsts-style behavior, but then realize= d that it would make sense to push on that as the default here.

Best, Erik

--0000000000001c943d058d321d81-- From nobody Mon Jul 8 14:40:08 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1AC53120075 for ; Mon, 8 Jul 2019 14:39:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4wa7C_DQtx88 for ; Mon, 8 Jul 2019 14:39:56 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B91B11202BA for ; Mon, 8 Jul 2019 14:39:54 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 1C951BE4D; Mon, 8 Jul 2019 22:39:52 +0100 (IST) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id r84ILM_M00yg; Mon, 8 Jul 2019 22:39:50 +0100 (IST) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 91ADFBE47; Mon, 8 Jul 2019 22:39:50 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1562621990; bh=DpOOAq9fUsqaPVprcYieMnYFf8TI+HTVSjI4GF6Njss=; h=Subject:To:References:From:Date:In-Reply-To:From; b=s9ESlNUSd16OXkRxKO2doAlZKcElzhqi48MzxZ7Ct2Pj9yOIUOMgbXEASINGQmcjN PV7lb3bV9kxDQC+K0nMjXJSR+YCvMFoRCRGU7Cd9ri5b4y1HGajeDP3rko8gOIH4jN MY38Dp0RvcBpZw6SMTHW9ch2FaGBzeNRQ0ectcos= To: Erik Nygren , tls@ietf.org, Ben Schwartz , Mike Bishop References: From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <4fed6c33-912a-948a-63d5-3b4b2e57acc3@cs.tcd.ie> Date: Mon, 8 Jul 2019 22:39:48 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.7.2 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="z739khOzT0w5Wuon9whceA7BnwbzHioi7" Archived-At: Subject: Re: [TLS] HTTPSSVC record draft - ESNI alternative for HTTPS X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 08 Jul 2019 21:40:07 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --z739khOzT0w5Wuon9whceA7BnwbzHioi7 Content-Type: multipart/mixed; boundary="okHK2w0gXjcmTZNqeydoIqcc2bMJTSUJC"; protected-headers="v1" From: Stephen Farrell To: Erik Nygren , tls@ietf.org, Ben Schwartz , Mike Bishop Message-ID: <4fed6c33-912a-948a-63d5-3b4b2e57acc3@cs.tcd.ie> Subject: Re: [TLS] HTTPSSVC record draft - ESNI alternative for HTTPS References: In-Reply-To: --okHK2w0gXjcmTZNqeydoIqcc2bMJTSUJC Content-Type: multipart/mixed; boundary="------------C385CB29E5F071D1AF24D882" Content-Language: en-GB This is a multi-part message in MIME format. --------------C385CB29E5F071D1AF24D882 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hi Erik, On 08/07/2019 22:27, Erik Nygren wrote: >=20 > In particular for the TLS WG, we'd be interested in hearing if this wou= ld > solve enough of the ESNI-key-delivery-via-DNS needs for the HTTPS use-c= ase. I'm not clear if you envisage this entirely replacing the new ESNI RR (as defined in ESNI draft-03), or if you envisage both being defined, with this one (HTTPSSVC) being used for the web and the ESNI RR for non-web uses of TLS, or maybe something else? It'd seem like a bad plan two have multiple ways of doing the same thing, but I guess there're trade-offs in various directions here. BTW - I read an earlier version of your draft and there were a few detailed discrepancies vs. the ESNI draft but those could be resolved later. Cheers, S. --------------C385CB29E5F071D1AF24D882 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------C385CB29E5F071D1AF24D882-- --okHK2w0gXjcmTZNqeydoIqcc2bMJTSUJC-- --z739khOzT0w5Wuon9whceA7BnwbzHioi7 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAl0juCQACgkQWrL68XsX K+rz9RAAiLX06QSYtkkQSr6GdFQQHCkT/FCBovZol68N3/VixVhaK0wiWtMlr0P5 JcHiSDvNmXFYRcxTI8P5PMyN+kttoQ4/YskKIGMLOJ35xOaD0BKLme/YpRYjr9fH vy6yTXW7e6QLU9qQBtPzFt49FuCLVDU7dLYhuVYNDvLLxN3XqBBZHRv71726Tr8f S3NuNs++R5PstnSFI3Plf7qQ7h0lA2A1ai/39TeBm8igrE4uTTdyg0WxgR6o/G2z 7y3e4eDAju0WJHSWQFb42fj3IpBIf0G3RmS4DJVtj0UIciI6SQuVwI2nXM5Krlhu Ud4Xk8BJEzEhHrdzH+uB0wg+d59KH7y/XpZjS5ANhEGyFgkmmoGgFZVJXjSPFWqJ YFBASn5A0w39sUGVc6j1TqYYJGYa56bVWuZehKWKiXEMsxU5IfwRsw3jqL0cfDGc yQyyJG8sAw0jK1NIslS8ysgCEi0rQhruA/2f5DTEdQF6vi2mC8RBrVzsBpanO/l7 y2dIG3XwU/OTZzQ2xpIKvDgIQ/ibWu6GykWSW9lJ/id+vYxKr2N5uzeLXW7l2IkB ssoG+W6QpGf6NKcJUGNirBS1AnMNoKF9LFj0J83JmkAEVH8nlgXOjHf5Xjq5Mn2V 41XE7oXZTodildKvn91fgg4VS5sAembLtpKrEzdrQvJM2Qqrfig= =cpxE -----END PGP SIGNATURE----- --z739khOzT0w5Wuon9whceA7BnwbzHioi7-- From nobody Mon Jul 8 15:09:08 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2EA4C120094 for ; Mon, 8 Jul 2019 15:09:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.106 X-Spam-Level: X-Spam-Status: No, score=-0.106 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FORGED_FROMDOMAIN=0.247, FREEMAIL_FROM=0.001, HEADER_FROM_DIFFERENT_DOMAINS=0.249, HTML_MESSAGE=0.001, PDS_NO_HELO_DNS=1.295, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id S9xBJPPfoZ5U for ; Mon, 8 Jul 2019 15:09:03 -0700 (PDT) Received: from mail-wr1-f45.google.com (mail-wr1-f45.google.com [209.85.221.45]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3C587120077 for ; Mon, 8 Jul 2019 15:09:03 -0700 (PDT) Received: by mail-wr1-f45.google.com with SMTP id x4so18762816wrt.6 for ; Mon, 08 Jul 2019 15:09:03 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=JLhTTMGnG/l9jcqBtKRtBL94jkLrC/UmoUEZlJXfqSA=; b=oWKfr4N6vsr8ac+ay8OrUoZLq48ktNzQaSo/3iiwZGrdoQBe2jjzWnaPGxVWa679Dz h3GZFEvB+ZbvFsq9R4U3Ou1wV1EzTDSdZNKBk9JZuID6Xd6qSLNuNqE7o70pXXE4ndJk EAHqdFGsLjR+05jVM0bHK38qfcA2LKHssy0VKKFQF8c/6+/jQas1quJxRmOxozNKAnUN DgQy6vMJTUS5CitHNFUYzzSviXbSHE8cnm0MrqsmxYP/uqLg2NqrBy5uiLi9DkCIcapv dFS8QrSSMAzW4d2y/VnpcOryDyG8w1T+/f0eXpYFEtiVSLARChxnvDfVZ8pBxFuc1D2I PV8w== X-Gm-Message-State: APjAAAXzxvaEJNJgUWXut0d+HPtmtMuLJqMr/WGObZvevUni4W1x0SE8 5Cs6Oei/z5RHCNsL9/WbcCXMUPpMIgcuGQ3Hhzw= X-Google-Smtp-Source: APXvYqy7bsxLDiqxSCT6UYxP+oMBEvkyrK+TL/404L2cX1fTrdG0UMDQi80VTDcl0XQSHvSIp2UCXDjandmB2M5Lc7w= X-Received: by 2002:a5d:43c9:: with SMTP id v9mr20350223wrr.70.1562623741388; Mon, 08 Jul 2019 15:09:01 -0700 (PDT) MIME-Version: 1.0 References: <4fed6c33-912a-948a-63d5-3b4b2e57acc3@cs.tcd.ie> In-Reply-To: <4fed6c33-912a-948a-63d5-3b4b2e57acc3@cs.tcd.ie> From: Erik Nygren Date: Mon, 8 Jul 2019 18:08:50 -0400 Message-ID: To: Stephen Farrell Cc: tls@ietf.org, Ben Schwartz , Mike Bishop Content-Type: multipart/alternative; boundary="00000000000005ed1b058d32b1bd" Archived-At: Subject: Re: [TLS] HTTPSSVC record draft - ESNI alternative for HTTPS X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 08 Jul 2019 22:09:05 -0000 --00000000000005ed1b058d32b1bd Content-Type: text/plain; charset="UTF-8" Hi Stephen, On Mon, Jul 8, 2019 at 5:39 PM Stephen Farrell wrote: > > On 08/07/2019 22:27, Erik Nygren wrote: > > > > In particular for the TLS WG, we'd be interested in hearing if this would > > solve enough of the ESNI-key-delivery-via-DNS needs for the HTTPS > use-case. > > I'm not clear if you envisage this entirely replacing the > new ESNI RR (as defined in ESNI draft-03), or if you envisage > both being defined, with this one (HTTPSSVC) being used for > the web and the ESNI RR for non-web uses of TLS, or maybe > something else? > > It'd seem like a bad plan two have multiple ways of doing > the same thing, but I guess there're trade-offs in various > directions here. > My thinking is that different protocols have different needs and requirements for key delivery via DNS. As such, separating out the ESNI key format from the DNS record for provisioning makes sense. EKR had the valid point that it would be valuable to have a basic way of doing ESNI key provisioning for protocols lacking complex requirements. This could end up as "protocols should specify bindings for how ESNI keys are delivered via DNS", with a HTTPSSVC RR for the HTTPS use-case, perhaps with other protocol bindings for other things with specific requirements, and with an ESNI RR (which might be able to be made simpler if some of the Web requirements can be abstracted) for generic use-cases. A downside is that this does add complexity for tools that operate entirely at the TLS layer such as openssl s_client that would be happier if only an ESNI record existed. However, the HTTPS use-case already has a bunch of other scenarios such as HTTP/3 that break/blur this abstraction layer such that it may be that this type of HTTPS connection management and DNS resolution needs to be done at the HTTP session layer regardless, with TLS libraries providing an interface to pass in ESNI keys. Encrypting authoritative DNS from recursives to authorities is in its early days, but it would not surprise me if similar requirements show up there and require a new DNS record type. (eg, an extensible NS record or an extensible record named by an NS record that includes information about protocols and ESNI keys and the like.) Best, Erik --00000000000005ed1b058d32b1bd Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi Stephen,

On Mon, Jul 8, 2019 at 5:3= 9 PM Stephen Farrell <steph= en.farrell@cs.tcd.ie> wrote:

On 08/07/2019 22:27, Erik Nygren wrote:
>
> In particular for the TLS WG, we'd be interested in hearing if thi= s would
> solve enough of the ESNI-key-delivery-via-DNS needs for the HTTPS use-= case.

I'm not clear if you envisage this entirely replacing the
new ESNI RR (as defined in ESNI draft-03), or if you envisage
both being defined, with this one (HTTPSSVC) being used for
the web and the ESNI RR for non-web uses of TLS, or maybe
something else?

It'd seem like a bad plan two have multiple ways of doing
the same thing, but I guess there're trade-offs in various
directions here.

My thinking is that differen= t protocols have different needs
and requirements for key delivery via DNS.= =C2=A0 As such, separating
out the ESNI key format from the DNS record for p= rovisioning
makes sense.=C2=A0 EKR had the valid point that it would be valu= able
to have a basic way of doing ESNI key provisioning for protocols
lac= king complex requirements.

This could end up as "protocols should s= pecify bindings for how
ESNI keys are delivered via DNS", with a HTTPSS= VC RR for the HTTPS
use-case, perhaps with other protocol bindings for = other things with
specific requirements, and with an ESNI RR (which might = be able
to be made simpler if some of the Web requirements can be abstracted= )
for generic use-cases.

A downside is that this does add comple= xity for tools that operate entirely
at the TLS layer such as openssl s_clie= nt that would be happier if only
an ESNI record existed.=C2=A0 However, the = HTTPS use-case
already has a bunch of other scenarios such as HTTP/3 that br= eak/blur
this abstraction layer such that it may be that this type of HTTPS = connection
management and DNS resolution needs to be done at the HTTP s= ession layer
regardless, with TLS libraries providing an interface to pass i= n ESNI keys.

Encrypting authoritative DNS from recursives to authori= ties is in
its early days, but it would not surprise me if similar requireme= nts
show up there and require a new DNS record type.=C2=A0 (eg, an extensibl= e
NS record or an extensible record named by an NS record that includes
infor= mation about protocols and ESNI keys and the like.)

Best, Erik

=






--00000000000005ed1b058d32b1bd-- From nobody Mon Jul 8 15:12:57 2019 Return-Path: X-Original-To: tls@ietf.org Delivered-To: tls@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 58D6F12030F; Mon, 8 Jul 2019 15:12:44 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: tls@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.98.3 Auto-Submitted: auto-generated Precedence: bulk Reply-To: tls@ietf.org Message-ID: <156262396426.826.4135578189265196942@ietfa.amsl.com> Date: Mon, 08 Jul 2019 15:12:44 -0700 Archived-At: Subject: [TLS] I-D Action: draft-ietf-tls-subcerts-04.txt X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 08 Jul 2019 22:12:55 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Transport Layer Security WG of the IETF. Title : Delegated Credentials for TLS Authors : Richard Barnes Subodh Iyengar Nick Sullivan Eric Rescorla Filename : draft-ietf-tls-subcerts-04.txt Pages : 13 Date : 2019-07-08 Abstract: The organizational separation between the operator of a TLS endpoint and the certification authority can create limitations. For example, the lifetime of certificates, how they may be used, and the algorithms they support are ultimately determined by the certification authority. This document describes a mechanism by which operators may delegate their own credentials for use in TLS, without breaking compatibility with peers that do not support this specification. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-tls-subcerts/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-tls-subcerts-04 https://datatracker.ietf.org/doc/html/draft-ietf-tls-subcerts-04 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-tls-subcerts-04 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Mon Jul 8 15:24:01 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6A2F6120355 for ; Mon, 8 Jul 2019 15:23:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7.956 X-Spam-Level: X-Spam-Status: No, score=-7.956 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.249, HTML_MESSAGE=0.001, PDS_NO_HELO_DNS=1.295, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, USER_IN_DEF_SPF_WL=-7.5] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=chromium.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VyEpzpu6jFgd for ; Mon, 8 Jul 2019 15:23:48 -0700 (PDT) Received: from mail-qt1-x833.google.com (mail-qt1-x833.google.com [IPv6:2607:f8b0:4864:20::833]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0774F1201D0 for ; Mon, 8 Jul 2019 15:23:48 -0700 (PDT) Received: by mail-qt1-x833.google.com with SMTP id k10so12058611qtq.1 for ; Mon, 08 Jul 2019 15:23:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=XJ7S82p5jErSPYX4MUbNsZskWdtoKfADvqbS652IZy8=; b=DZsjkq0xBiEygh6t2Ngkzjj9i2W1CoJswIF3n6UDIlheku/1ZyG1oRxDeJnz6mKmjP cK65MQhBVX4fLREstBxLuu44e2sG6qfon4GNWEjonXbcBhSuaIyfNVrlOMI28Kq8g101 rAFUm/9pM181Bo3uJFw5/sG6dhrYqKvmXavVw= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=XJ7S82p5jErSPYX4MUbNsZskWdtoKfADvqbS652IZy8=; b=TTHvo8j/7lvrAVevVEEYn0JE65VUwHmUp2BU96oDYcJ9dJMZkFVcdasF2wsjfR/6v3 LSd31wVgcOOKlUChg9HROwO8cyH8Lj0gilKj9Ni7E2TD7eKJoHyRTcJSrVxqOK0WoagY HJcisfFjLiZLtgBfuIv2SU3G3bBS91Xfc9BNXA86ZNA5cMkE5kIR2uFq3Yzps5EnlVXF jVPbKW2UryoA4zuNmg/U3SuqmywHAfX0DVQy2U1Pt0aMsC+ah9ePHLFG9mYWdENodZRM be1f/1XqGxmRa9T5Lp59678n2DdM5SL4vJEm1oUxOejTbO8dYMkbwYLaswj8P3ct9A+0 ykWA== X-Gm-Message-State: APjAAAUaWE41Iqhc/x5U2tmsraprSV1c07TgtHc6KgjPqlHYSansxWzh QHOiMKRudY5ITQJ8gMKTgRHAHzm3+oTRCKoCiYS9 X-Google-Smtp-Source: APXvYqwLQxiHx5EOy/7eHJa23tQkqbDQl0uEGGgpl+hmJwkhYxYMSJyBrnXPa3je+c8FP7E/7M7WYuePYH3fGcSaqF4= X-Received: by 2002:aed:34a6:: with SMTP id x35mr13582841qtd.187.1562624626918; Mon, 08 Jul 2019 15:23:46 -0700 (PDT) MIME-Version: 1.0 References: <20190703171111.GK13810@kduck.mit.edu> In-Reply-To: <20190703171111.GK13810@kduck.mit.edu> From: David Benjamin Date: Mon, 8 Jul 2019 18:23:30 -0400 Message-ID: To: Benjamin Kaduk Cc: draft-ietf-tls-grease.all@ietf.org, "" Content-Type: multipart/alternative; boundary="000000000000ce9cc1058d32e58e" Archived-At: Subject: Re: [TLS] AD review of draft-ietf-tls-grease-02 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 08 Jul 2019 22:23:59 -0000 --000000000000ce9cc1058d32e58e Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Thanks for the comments! I've addressed them in https://github.com/tlswg/draft-ietf-tls-grease/pull/10. On Wed, Jul 3, 2019 at 1:11 PM Benjamin Kaduk wrote: > Section 1 > > The TLS protocol [RFC8446] includes several points of extensibility, > including the list of cipher suites and the list of extensions. The > values in these lists identify implementation capabilities. TLS > > We could probably make this text a little more precise (for one, there's > not a single list of extensions since many messages can carry > extensions). So, maybe "the list of cipher suites and several lists of > extensions" and "The values transmitted in these lists"? > Done. > Section 2 > > Can we add an editorial note that values prefaced with "{TBD}" are > suggested values but subject to change prior to final allocation by > IANA? > Done. Also made the other such notes match the style used in the TLS 1.3 draft. > Future versions of TLS or DTLS [RFC6347] MUST NOT use any of the > above values as versions. > > Process-wise, this feels like an attempt to Update: the (D)TLS core > specs, which we can't do in an Informational document. So it would > probably be better to say something "The values thusly allocated are no > longer available for use as version numbers by (D)TLS implemnetations". > Things are made somewhat awkward by there not being a registry of > protocol versions, sadly... > Done. > Section 3.1 > > Are there any of these for which we want to say "the client MUST NOT > advertise a list consisting solely of GREASE values"? It would probably > be fine to do this for, say, key_share, but not for, say, cipher_suites. > But perhaps the reader will be smart enough to figure out what works > without prodding from us... > I dunno, I feel like that's a bit overkill, but I can include something in that vein if others disagree. A cipher suite list full of GREASE is functionally equivalent to a list containing some weird cipher no one implements. > Clients MUST reject GREASE values when negotiated by the server. > Specifically, the client MUST fail the connection if a GREASE value > appears any in the following: > > I did not attempt to audit the (omitted) list for completeness; the > first sentence should cover any situations that are not specifically > listed, right? > It should. I replaced "Specifically" with "In particular" so that's clearer= . > Section 3.2 > > When processing a ClientHello, servers MUST NOT treat GREASE values > differently from any unknown value. Servers MUST NOT negotiate any > GREASE value when offered in a ClientHello. Servers MUST correctly > ignore unknown values in a ClientHello and attempt to negotiate with > one of the remaining parameters. > > Similarly to the above, we might consider adding a parenthetical noting > that there may not be any remaining valid parameters, and that's not > necessarily fatal. > Done. > Note that these requirements are restatements or corollaries of > existing server requirements in TLS. > > (side note) Some future reviewers might complain about using normative > language to duplicate exisiting requirements from other documents; in > this case, I don't mind, myself. > > Section 4.1 > > o A server MAY select one or more GREASE extension values and > advertise corresponding extensions with varying length and > contents. > > nit: I don't think "corresponding" is quite the right word; maybe > "advertise those extensions"? > Rephrased this and elsewhere. > o A server MAY select one or more GREASE signature algorithm values > and advertise them in the "signature_algorithms" extension. > > I'm not necessarily expecting any action based on this comment, but I > note that status_request, signed_certificate_timestamp, > certificate_authorities, oid_filters, and signature_algorithms_cert are > also currently defined for CertificateRequest but we do not call out any > extension-specific greasing for them. Of that list, only > signature_algorithms_cert seems like it might be calling out for special > handling, to me... > Added signature_algorithms_cert. > Section 4.2 > > When processing a CertificateRequest or NewSessionTicket, clients > MUST NOT treat GREASE values differently from any unknown value. > Clients MUST NOT negotiate any GREASE value when offered by the > server. Clients MUST correctly ignore unknown values offered by the > server and attempt to negotiate with one of the remaining parameters. > > (following the theme) I don't remember any cases where the client can > succeed if the list becomes empty after pruning unknown values ... if we > are deciding that we want to say anything on this topic at all. > Added a similar parenthetical. > Section 5 > > Implementations advertising GREASE values SHOULD select them at > random. This is intended to encourage implementations to ignore all > unknown values rather than any individual value. Implementations > MUST honor protocol specifications when sending GREASE values. For > instance, implementations sending multiple GREASE values as > extensions MUST NOT send the same GREASE value twice. > > Feel free to tell me that I'm being internally inconsistent, but in this > case "MUST NOT send the same GREASE value twice" does not seem like a > good place to use normative language to restate an existing requirement. > So I'd rather see lowercase "must not" and possibly a section reference > to 8446 =C2=A7 4.2 ("[t]here MUST NOT be more than one extension of the s= ame > type in a given extension block."). > Rephrased this. > Section 6 > [[TODO: Update IANA considerations for TLS 1.3 and rebase over draft- > ietf-tls-iana-registry-updates.]] > > Can the shepherd please work with the author to make the needed changes? > > IIRC the main change for TLS 1.3 is the "TLS 1.3" column for > extensiontype values. > > Since this document is Informational, we have to be Recommended "N" for > everything. > Oh oops, I must have missed this when rebasing over TLS 1.3. Added the relevant columns. > Thanks for the note about the specific values listed being just > suggestions. > > --000000000000ce9cc1058d32e58e Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Thanks for the comments! I've addressed them in= =C2=A0https://github.com/tlswg/draft-ietf-tls-grease/pull/10.=

On Wed, Jul 3, 2019 at 1:= 11 PM Benjamin Kaduk <kaduk@mit.edu> wrote:
Section 1

=C2=A0 =C2=A0The TLS protocol [RFC8446] includes several points of extensib= ility,
=C2=A0 =C2=A0including the list of cipher suites and the list of extensions= .=C2=A0 The
=C2=A0 =C2=A0values in these lists identify implementation capabilities.=C2= =A0 TLS

We could probably make this text a little more precise (for one, there'= s
not a single list of extensions since many messages can carry
extensions).=C2=A0 So, maybe "the list of cipher suites and several li= sts of
extensions" and "The values transmitted in these lists"?
=

Done.
=C2=A0
Section 2

Can we add an editorial note that values prefaced with "{TBD}" ar= e
suggested values but subject to change prior to final allocation by
IANA?

Done. Also made the other such no= tes match the style used in the TLS 1.3 draft.
=C2=A0
=C2=A0 =C2=A0Future versions of TLS or DTLS [RFC6347] MUST NOT use any of t= he
=C2=A0 =C2=A0above values as versions.

Process-wise, this feels like an attempt to Update: the (D)TLS core
specs, which we can't do in an Informational document.=C2=A0 So it woul= d
probably be better to say something "The values thusly allocated are n= o
longer available for use as version numbers by (D)TLS implemnetations"= .
Things are made somewhat awkward by there not being a registry of
protocol versions, sadly...

Done.
=
=C2=A0
Section 3.1

Are there any of these for which we want to say "the client MUST NOT advertise a list consisting solely of GREASE values"?=C2=A0 It would p= robably
be fine to do this for, say, key_share, but not for, say, cipher_suites. But perhaps the reader will be smart enough to figure out what works
without prodding from us...

I dunno, I = feel like that's a bit overkill, but I can include something in that ve= in if others disagree. A cipher suite list full of GREASE is functionally e= quivalent to a list containing some weird cipher no one implements.
=C2=A0
=C2=A0 =C2=A0Clients MUST reject GREASE values when negotiated by the serve= r.
=C2=A0 =C2=A0Specifically, the client MUST fail the connection if a GREASE = value
=C2=A0 =C2=A0appears any in the following:

I did not attempt to audit the (omitted) list for completeness; the
first sentence should cover any situations that are not specifically
listed, right?

It should. I replaced &q= uot;Specifically" with "In particular" so that's clearer= .
=C2=A0
Section 3.2

=C2=A0 =C2=A0When processing a ClientHello, servers MUST NOT treat GREASE v= alues
=C2=A0 =C2=A0differently from any unknown value.=C2=A0 Servers MUST NOT neg= otiate any
=C2=A0 =C2=A0GREASE value when offered in a ClientHello.=C2=A0 Servers MUST= correctly
=C2=A0 =C2=A0ignore unknown values in a ClientHello and attempt to negotiat= e with
=C2=A0 =C2=A0one of the remaining parameters.

Similarly to the above, we might consider adding a parenthetical noting
that there may not be any remaining valid parameters, and that's not necessarily fatal.

Done.
=C2= =A0
=C2=A0 =C2=A0Note that these requirements are restatements or corollaries o= f
=C2=A0 =C2=A0existing server requirements in TLS.

(side note) Some future reviewers might complain about using normative
language to duplicate exisiting requirements from other documents; in
this case, I don't mind, myself.

Section 4.1

=C2=A0 =C2=A0o=C2=A0 A server MAY select one or more GREASE extension value= s and
=C2=A0 =C2=A0 =C2=A0 advertise corresponding extensions with varying length= and
=C2=A0 =C2=A0 =C2=A0 contents.

nit: I don't think "corresponding" is quite the right word; m= aybe
"advertise those extensions"?

Rephrased this and elsewhere.
=C2=A0
=C2=A0 =C2=A0o=C2=A0 A server MAY select one or more GREASE signature algor= ithm values
=C2=A0 =C2=A0 =C2=A0 and advertise them in the "signature_algorithms&q= uot; extension.

I'm not necessarily expecting any action based on this comment, but I note that status_request, signed_certificate_timestamp,
certificate_authorities, oid_filters, and signature_algorithms_cert are
also currently defined for CertificateRequest but we do not call out any extension-specific greasing for them.=C2=A0 Of that list, only
signature_algorithms_cert seems like it might be calling out for special handling, to me...

Added signature_algo= rithms_cert.
=C2=A0
Section 4.2

=C2=A0 =C2=A0When processing a CertificateRequest or NewSessionTicket, clie= nts
=C2=A0 =C2=A0MUST NOT treat GREASE values differently from any unknown valu= e.
=C2=A0 =C2=A0Clients MUST NOT negotiate any GREASE value when offered by th= e
=C2=A0 =C2=A0server.=C2=A0 Clients MUST correctly ignore unknown values off= ered by the
=C2=A0 =C2=A0server and attempt to negotiate with one of the remaining para= meters.

(following the theme) I don't remember any cases where the client can succeed if the list becomes empty after pruning unknown values ... if we are deciding that we want to say anything on this topic at all.

Added a similar parenthetical.
=C2=A0
Section 5

=C2=A0 =C2=A0Implementations advertising GREASE values SHOULD select them a= t
=C2=A0 =C2=A0random.=C2=A0 This is intended to encourage implementations to= ignore all
=C2=A0 =C2=A0unknown values rather than any individual value.=C2=A0 Impleme= ntations
=C2=A0 =C2=A0MUST honor protocol specifications when sending GREASE values.= =C2=A0 For
=C2=A0 =C2=A0instance, implementations sending multiple GREASE values as =C2=A0 =C2=A0extensions MUST NOT send the same GREASE value twice.

Feel free to tell me that I'm being internally inconsistent, but in thi= s
case "MUST NOT send the same GREASE value twice" does not seem li= ke a
good place to use normative language to restate an existing requirement. So I'd rather see lowercase "must not" and possibly a section= reference
to 8446 =C2=A7 4.2 ("[t]here MUST NOT be more than one extension of th= e same
type in a given extension block.").

Rephrased this.
=C2=A0
Section 6
=C2=A0 =C2=A0[[TODO: Update IANA considerations for TLS 1.3 and rebase over= draft-
=C2=A0 =C2=A0ietf-tls-iana-registry-updates.]]

Can the shepherd please work with the author to make the needed changes?
IIRC the main change for TLS 1.3 is the "TLS 1.3" column for
extensiontype values.

Since this document is Informational, we have to be Recommended "N&quo= t; for
everything.

Oh oops, I must have missed= this when rebasing over TLS 1.3. Added the relevant columns.=C2=A0
=C2=A0
Thanks for the note about the specific values listed being just
suggestions.

--000000000000ce9cc1058d32e58e-- From nobody Mon Jul 8 15:28:20 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 65A6012015A for ; Mon, 8 Jul 2019 15:28:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id G90pNVvxTX1x for ; Mon, 8 Jul 2019 15:28:04 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DF4A2120311 for ; Mon, 8 Jul 2019 15:28:03 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 14B3ABE4D; Mon, 8 Jul 2019 23:28:00 +0100 (IST) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fRm4sRFdWiQs; Mon, 8 Jul 2019 23:27:58 +0100 (IST) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 875AEBE39; Mon, 8 Jul 2019 23:27:58 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1562624878; bh=UbbccT00d9vhnh6L291gmcb3jTBY7EIoj6FgwQTAnhY=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=UdfQaIoFoQhN25tUQHB5G6Ve2vSg09p8ZTSIg/uG1FOROfI5Pkk0nqMOIJYP/VdiB VpaZP9Z9/52OCnViLNhQ+ref94RFjdKs/R+CTvdmVl9GerF1BjuxLv3KaYTallVOdC Du/xlff2uhBEnbAbsjqoiNN4rpHDjc7FPdEspbJA= To: Erik Nygren Cc: tls@ietf.org, Ben Schwartz , Mike Bishop References: <4fed6c33-912a-948a-63d5-3b4b2e57acc3@cs.tcd.ie> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: Date: Mon, 8 Jul 2019 23:27:57 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.7.2 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="QizYUZUfkov8jsvY5nNgJzm2qypAorBmE" Archived-At: Subject: Re: [TLS] HTTPSSVC record draft - ESNI alternative for HTTPS X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 08 Jul 2019 22:28:18 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --QizYUZUfkov8jsvY5nNgJzm2qypAorBmE Content-Type: multipart/mixed; boundary="c36m93j5qF6RwrH5i2lt7lKHgqRwwaThR"; protected-headers="v1" From: Stephen Farrell To: Erik Nygren Cc: tls@ietf.org, Ben Schwartz , Mike Bishop Message-ID: Subject: Re: [TLS] HTTPSSVC record draft - ESNI alternative for HTTPS References: <4fed6c33-912a-948a-63d5-3b4b2e57acc3@cs.tcd.ie> In-Reply-To: --c36m93j5qF6RwrH5i2lt7lKHgqRwwaThR Content-Type: multipart/mixed; boundary="------------AB4134046EE476C3659B9349" Content-Language: en-GB This is a multi-part message in MIME format. --------------AB4134046EE476C3659B9349 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable I'm not sure what I think about the general idea TBH but just on this bit... On 08/07/2019 23:08, Erik Nygren wrote: >=20 > A downside is that this does add complexity for tools that operate enti= rely > at the TLS layer such as openssl s_client that would be happier if only= > an ESNI record existed.=20 I don't think that's such a big deal for the library as that's unlikely to include the code to do DNS queries. Being able to parse a couple of different wrappers for ESNIKeys isn't that big a deal. And at least the code I've done for s_client assumes it gets the RR value on the command line (for now anyway) so that's also no biggie. But I figure s_client isn't that important as an application anwyay;-) Having different DNS RRTYPEs one might need to probe or otherwise know about would make like harder for real application code that does DNS though, and for servers who might end up having to publish the same things in different ways. So I hope we don't create that kind of problem. Cheers, S. --------------AB4134046EE476C3659B9349 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------AB4134046EE476C3659B9349-- --c36m93j5qF6RwrH5i2lt7lKHgqRwwaThR-- --QizYUZUfkov8jsvY5nNgJzm2qypAorBmE Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAl0jw20ACgkQWrL68XsX K+qLKBAAys4Q2ByR412VNVPJrEDeLDStWo44Ma8+THex8pnJJ1fzf3PkaEpbXnJK xBFUzDNMc8zX9DZtzsuYLz5xjsqhuRrV6vdXeldDIy7BPQLKIpZVQPPfH/cvnQFO unWNBiMQtYxBOaiO9+goYn3SMRhBgGpBb9o3de2B8Dq9u5GMCIxNlSNanKk0C9Wb vakrQsNunePG/NOVdLOHMThc8MpXn1pA7izn+u1ConiwedtfM53k3F126PfYPz/I DtNEiqNMb8usUcUmj9FDoSEBZ61QlrbyCfuSvG9LMym8553HjKy4SVt0uW46Fibi /GwnFz4OZFBDp4kYa3ytGYEmdX6FT50wKDXp9YqDy3RKZVS/PPlUBEwh5w3+RhcT PbP/tFZORcpIoeA8d9h37qjMIrzfwm1s4p5VIJ0puAEmSzdl1t6OoXtVG24uJx5F y85F7UlC0QIqT9PI32QSmiZ9XLxDkhDYDjK7UK1Ko59J3yx7VI2/P1TeaP4PI9Sm b0eGMA64fqQ4XnW2t2Qf9z6Z06nix/CoVX5quDcX/4Ju1CJHIMQho8ikEvzkh/9J Rkj+AlH2V9J21Zu7jWZdWxZotfPbqcnMWISitteBsYJ6ugoXwS3mpwyrar5V8nMA etMfNEUhEYmG4e2QXyfMz5KxveNKKMG9Py0pwkm+pBBxeUUrDGk= =TiQm -----END PGP SIGNATURE----- --QizYUZUfkov8jsvY5nNgJzm2qypAorBmE-- From nobody Mon Jul 8 15:32:38 2019 Return-Path: X-Original-To: tls@ietf.org Delivered-To: tls@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 5870C1202E4; Mon, 8 Jul 2019 15:32:26 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: tls@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.98.3 Auto-Submitted: auto-generated Precedence: bulk Reply-To: tls@ietf.org Message-ID: <156262514628.826.14306034941471840306@ietfa.amsl.com> Date: Mon, 08 Jul 2019 15:32:26 -0700 Archived-At: Subject: [TLS] I-D Action: draft-ietf-tls-esni-04.txt X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 08 Jul 2019 22:32:37 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Transport Layer Security WG of the IETF. Title : Encrypted Server Name Indication for TLS 1.3 Authors : Eric Rescorla Kazuho Oku Nick Sullivan Christopher A. Wood Filename : draft-ietf-tls-esni-04.txt Pages : 30 Date : 2019-07-08 Abstract: This document defines a simple mechanism for encrypting the Server Name Indication for TLS 1.3. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-tls-esni/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-tls-esni-04 https://datatracker.ietf.org/doc/html/draft-ietf-tls-esni-04 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-tls-esni-04 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Tue Jul 9 02:01:22 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 17B5A1203B6 for ; Tue, 9 Jul 2019 02:01:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XhpoNGUYZze1 for ; Tue, 9 Jul 2019 02:01:15 -0700 (PDT) Received: from EUR03-VE1-obe.outbound.protection.outlook.com (mail-eopbgr50046.outbound.protection.outlook.com [40.107.5.46]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E6BE71203B3 for ; Tue, 9 Jul 2019 02:01:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=NCCrYGfIzqewDbyrKWv6sFohJ9tTzCNvWAC6baqC1Qc=; b=vIJ+s707PTDfvBAnk6s5+XwhoGklrChUyhXaElOgbNtpS2LYzqAXZjM4SEcUZBGwu3tPX9UF0J0PuOLpXojsnAeShnkK9JchsGPxttrNO8dDLh3H/e9++lNcQ0Vh6dV5AQu8uf+XLCF7JnA7XIZ37zF4yN9O0b5urZINMZTfgMU= Received: from VI1PR08MB5360.eurprd08.prod.outlook.com (52.133.244.88) by VI1PR08MB3725.eurprd08.prod.outlook.com (20.178.14.144) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2052.18; Tue, 9 Jul 2019 09:01:11 +0000 Received: from VI1PR08MB5360.eurprd08.prod.outlook.com ([fe80::9ce0:faf4:980d:dc77]) by VI1PR08MB5360.eurprd08.prod.outlook.com ([fe80::9ce0:faf4:980d:dc77%3]) with mapi id 15.20.2052.020; Tue, 9 Jul 2019 09:01:11 +0000 From: Hannes Tschofenig To: "tls@ietf.org" Thread-Topic: draft-friel-tls-atls-03 Thread-Index: AdU2M6bbA9UOLqBVTUGqAqIBs49gnA== Date: Tue, 9 Jul 2019 09:01:11 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ts-tracking-id: 556d578e-f39d-46ee-a49a-fae1c3eec205.0 x-checkrecipientchecked: true authentication-results: spf=none (sender IP is ) smtp.mailfrom=Hannes.Tschofenig@arm.com; x-originating-ip: [80.92.119.152] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 85c3966a-5cbf-432c-b0aa-08d7044bfd79 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(4618075)(2017052603328)(7193020); SRVR:VI1PR08MB3725; x-ms-traffictypediagnostic: VI1PR08MB3725: x-ms-exchange-purlcount: 1 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-forefront-prvs: 0093C80C01 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(4636009)(366004)(39860400002)(136003)(396003)(376002)(346002)(40434004)(53754006)(199004)(189003)(53936002)(6436002)(606006)(6506007)(26005)(8676002)(102836004)(33656002)(68736007)(81156014)(81166006)(1730700003)(8936002)(25786009)(3846002)(790700001)(7736002)(6116002)(7696005)(5660300002)(966005)(14454004)(6916009)(71200400001)(99286004)(72206003)(74316002)(71190400001)(66066001)(52536014)(2351001)(9686003)(66476007)(66556008)(64756008)(66446008)(478600001)(2501003)(316002)(2906002)(5640700003)(236005)(476003)(55016002)(73956011)(54896002)(66946007)(86362001)(486006)(76116006)(256004)(14444005)(5024004)(6306002)(186003); DIR:OUT; SFP:1101; SCL:1; SRVR:VI1PR08MB3725; H:VI1PR08MB5360.eurprd08.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: arm.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: ZaIFMBZV4z0hwx9xuJtpXJ+QebuF9G75D8ydu14OJFHNQL21aFuXMGk6Cd/nMqp5LY3xu9g4Ug55h/FccpQmiNa8lRY90+0BVch86BssfDqHbO2ICFPoetguHzBqiwg93VTnR8TZakYM3Fn1k8fAmGfr5rBeML7L5XWKnwSWjIlvHYxt/e5/fYL3Ea8DOmrH/105Fusixt1DBZwNLKCgaqH88zYazak5fkDklMx0BLNSfedzK90VeBV0Hvgw3UgwrUXF/GgDNpzmkxrHT0QY57ahcOK0u09D/r28d+pEZpK0wuX91SbVkkroz4qjCSK7Up2k5sF0EzyH1XnVAFBFczW/G52d+gWBsXanyamqsWCFYjNFxBohGT2wXnZ26JjFTe9jPLNi/2kKpOMapKr33nFc4FCE5CaQFfr5dk0HwKk= Content-Type: multipart/alternative; boundary="_000_VI1PR08MB53600FC4FC6E5DFFDACAFECEFAF10VI1PR08MB5360eurp_" MIME-Version: 1.0 X-OriginatorOrg: arm.com X-MS-Exchange-CrossTenant-Network-Message-Id: 85c3966a-5cbf-432c-b0aa-08d7044bfd79 X-MS-Exchange-CrossTenant-originalarrivaltime: 09 Jul 2019 09:01:11.6742 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: f34e5979-57d9-4aaa-ad4d-b122a662184d X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: Hannes.Tschofenig@arm.com X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR08MB3725 Archived-At: Subject: [TLS] draft-friel-tls-atls-03 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 Jul 2019 09:01:18 -0000 --_000_VI1PR08MB53600FC4FC6E5DFFDACAFECEFAF10VI1PR08MB5360eurp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hi all, Owen and I have been working on a new version of ATLS, which you can find h= ere: https://tools.ietf.org/html/draft-friel-tls-atls-03 The plain version (with the DTLS record layer for protecting application da= ta) is used by Cisco and by us in products. We did, however, add extra functionality to allow the establishment of an O= SCORE and COSE security context. (Conceptually, this is similar to what was done many years ago with the DTL= S-SRTP framework for media security.) What this work provides us is re-use of existing TLS/DTLS stacks for applic= ation layer security. While the actual standardization work is rather small, we noticed that the = idea of using TLS/DTLS handshake at the application layer is still somethin= g that's difficult to understand. I ran into people who thought it is not possible to use TLS/DTLS handshake = at the application layer. For those people, the additional background text = in the draft is quite helpful. Ciao Hannes IMPORTANT NOTICE: The contents of this email and any attachments are confid= ential and may also be privileged. If you are not the intended recipient, p= lease notify the sender immediately and do not disclose the contents to any= other person, use it for any purpose, or store or copy the information in = any medium. Thank you. --_000_VI1PR08MB53600FC4FC6E5DFFDACAFECEFAF10VI1PR08MB5360eurp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Hi all,

 

Owen and I have been working on a new version of ATL= S, which you can find here:

https://tools.ietf.org/html/draft-friel-tls-atls-03

 

The plain version (with the DTLS record layer for pr= otecting application data) is used by Cisco and by us in products.

We did, however, add extra functionality to allow th= e establishment of an OSCORE and COSE security context.

(Conceptually, this is similar to what was done many= years ago with the DTLS-SRTP framework for media security.)

 

What this work provides us is re-use of existing TLS= /DTLS stacks for application layer security.

 

While the actual standardization work is rather smal= l, we noticed that the idea of using TLS/DTLS handshake at the application = layer is still something that’s difficult to understand.

I ran into people who thought it is not possible to = use TLS/DTLS handshake at the application layer. For those people, the addi= tional background text in the draft is quite helpful.

 

Ciao

Hannes

IMPORTANT NOTICE: The contents of this email and any attachments are confid= ential and may also be privileged. If you are not the intended recipient, p= lease notify the sender immediately and do not disclose the contents to any= other person, use it for any purpose, or store or copy the information in any medium. Thank you. --_000_VI1PR08MB53600FC4FC6E5DFFDACAFECEFAF10VI1PR08MB5360eurp_-- From nobody Tue Jul 9 02:05:44 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B7EA01203AF for ; Tue, 9 Jul 2019 02:05:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4WIbQMdnli96 for ; Tue, 9 Jul 2019 02:05:39 -0700 (PDT) Received: from EUR03-VE1-obe.outbound.protection.outlook.com (mail-eopbgr50041.outbound.protection.outlook.com [40.107.5.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D34AE120397 for ; Tue, 9 Jul 2019 02:05:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=vnkXvvLmXUvcwoqhT36VH4xjcNZc66AETpzP6AIVVeo=; b=rfqMfNFB7Li5Fm5oo3mztTm2bn3ORxmeSZ/qilrstMMJYlJQTaJ3BAi0KSPQP4gRn3AJvH9AVoORQSRxcoWeq1T2IGTmJ9fkyhdL4Hqw+ChFl7lXZA2KocNa2DOx6KBaKAYoO3TBm+JmRla4n4RvlwO1EdGeOMsZ9csNNe2JTYM= Received: from VI1PR08MB5360.eurprd08.prod.outlook.com (52.133.244.88) by VI1PR08MB3725.eurprd08.prod.outlook.com (20.178.14.144) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2052.18; Tue, 9 Jul 2019 09:05:36 +0000 Received: from VI1PR08MB5360.eurprd08.prod.outlook.com ([fe80::9ce0:faf4:980d:dc77]) by VI1PR08MB5360.eurprd08.prod.outlook.com ([fe80::9ce0:faf4:980d:dc77%3]) with mapi id 15.20.2052.020; Tue, 9 Jul 2019 09:05:36 +0000 From: Hannes Tschofenig To: "tls@ietf.org" Thread-Topic: draft-tschofenig-tls-dtls-rrc-00 - DTLS Return Routability Check (RRC) Thread-Index: AdU2NXH6l5nrxsDQQh2DGNc/pbIIBA== Date: Tue, 9 Jul 2019 09:05:36 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ts-tracking-id: b3817a9a-9742-4470-b47e-9499f5f60af5.0 x-checkrecipientchecked: true authentication-results: spf=none (sender IP is ) smtp.mailfrom=Hannes.Tschofenig@arm.com; x-originating-ip: [80.92.119.152] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 86ae70a2-6fd6-47d5-87f4-08d7044c9b0e x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(4618075)(2017052603328)(7193020); SRVR:VI1PR08MB3725; x-ms-traffictypediagnostic: VI1PR08MB3725: x-ms-exchange-purlcount: 1 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-forefront-prvs: 0093C80C01 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(4636009)(366004)(39860400002)(136003)(396003)(376002)(346002)(40434004)(53754006)(199004)(189003)(53936002)(6436002)(606006)(6506007)(26005)(8676002)(102836004)(33656002)(68736007)(81156014)(81166006)(1730700003)(8936002)(25786009)(3846002)(790700001)(7736002)(6116002)(7696005)(5660300002)(966005)(14454004)(6916009)(71200400001)(99286004)(72206003)(74316002)(71190400001)(66066001)(52536014)(2351001)(9686003)(66476007)(66556008)(64756008)(66446008)(478600001)(2501003)(316002)(2906002)(5640700003)(236005)(476003)(55016002)(73956011)(54896002)(66946007)(86362001)(486006)(76116006)(256004)(14444005)(5024004)(6306002)(186003); DIR:OUT; SFP:1101; SCL:1; SRVR:VI1PR08MB3725; H:VI1PR08MB5360.eurprd08.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: arm.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: 8b/Pii7oLu6IHgIqNc+NDaFKwZutfkVsUkqC03fpvmfpe8al68cdCgkQ/QlBb2corNs3n/X1vTU6UQZYaycV2seppIUydxbQLPS9p41n6zUIsjZPMJkN3ZC9aKGAzSgt3uqqd8v3dXIKeMixa81n7DK2L/SbjVkKHU73h3vDT5NpwoVZzy8zyBqh3XaQQphpI7by0sIKawfAaPi8+M3v7c4qeoN/WtuewJ7T3Xfjwjwop0MOsiNMfy451clZGAnfCS3OuIkyCgRh8LEDAH4YgIRDTZaVbKDKBW2kxUnwvnNr8zeJ9Y8nlMRJtiB7vZKA/+Op1v/VHHutYsUe4MRGD044Q5+ovVq/Dq78xJq3wQUMUXVNJZRUMH5cZ433c0DwYTFRb0sFE7JWpAdXGnHz3crvhkbAOyNnjMeedeTkr7Q= Content-Type: multipart/alternative; boundary="_000_VI1PR08MB5360A60F2F16D354DA6F9FD2FAF10VI1PR08MB5360eurp_" MIME-Version: 1.0 X-OriginatorOrg: arm.com X-MS-Exchange-CrossTenant-Network-Message-Id: 86ae70a2-6fd6-47d5-87f4-08d7044c9b0e X-MS-Exchange-CrossTenant-originalarrivaltime: 09 Jul 2019 09:05:36.0460 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: f34e5979-57d9-4aaa-ad4d-b122a662184d X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: Hannes.Tschofenig@arm.com X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR08MB3725 Archived-At: Subject: [TLS] draft-tschofenig-tls-dtls-rrc-00 - DTLS Return Routability Check (RRC) X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 Jul 2019 09:05:42 -0000 --_000_VI1PR08MB5360A60F2F16D354DA6F9FD2FAF10VI1PR08MB5360eurp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hi all, working on the DTLS connection id drafts we noticed that there is one secur= ity aspect, which could benefit from an extra mitigation technique. The issue is that an on-path adversary could intercept and modify the sourc= e IP address (and the source port) of a DTLS datagram. Even if receiver c= hecks the authenticity and freshness of the packet, the recipient is fooled= into changing the CID-to-IP/port association. This can lead to black-holed= or redirected traffic. Of course, an on-path adversary can do lots of thin= gs to traffic and the problem is self-fixing but it still lead us to work o= n a solution in form of a return-routability check. Here is the draft: https://tools.ietf.org/html/draft-tschofenig-tls-dtls-rrc-00 Ciao Hannes IMPORTANT NOTICE: The contents of this email and any attachments are confid= ential and may also be privileged. If you are not the intended recipient, p= lease notify the sender immediately and do not disclose the contents to any= other person, use it for any purpose, or store or copy the information in = any medium. Thank you. --_000_VI1PR08MB5360A60F2F16D354DA6F9FD2FAF10VI1PR08MB5360eurp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Hi all,

 

working on the DTLS connection id drafts we noticed = that there is one security aspect, which could benefit from an extra mitiga= tion technique.

 

The issue is that an on-path adversary could intercept and modify the=
 source IP address  (and the source port) of a DTLS datagram.  Ev=
en if receiver checks the authenticity and freshness of the packet, the rec=
ipient is fooled into changing the CID-to-IP/port association. This can lea=
d to black-holed or redirected traffic. Of course, an on-path adversary can=
 do lots of things to traffic and the problem is self-fixing but it still l=
ead us to work on a solution in form of a return-routability check.

 

Here is the draft:

https://tools.ietf.org/html/draft-tschofenig-tls-dtls-= rrc-00

 

Ciao

Hannes

 

IMPORTANT NOTICE: The contents of this email and any attachments are confid= ential and may also be privileged. If you are not the intended recipient, p= lease notify the sender immediately and do not disclose the contents to any= other person, use it for any purpose, or store or copy the information in any medium. Thank you. --_000_VI1PR08MB5360A60F2F16D354DA6F9FD2FAF10VI1PR08MB5360eurp_-- From nobody Tue Jul 9 03:16:00 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 661151203FC for ; Tue, 9 Jul 2019 03:15:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=lowentropy.net header.b=rKZtIi7z; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=YWpowOdK Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SSNYAcU1QWnC for ; Tue, 9 Jul 2019 03:15:56 -0700 (PDT) Received: from out5-smtp.messagingengine.com (out5-smtp.messagingengine.com [66.111.4.29]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 591E91203FB for ; Tue, 9 Jul 2019 03:15:56 -0700 (PDT) Received: from compute1.internal (compute1.nyi.internal [10.202.2.41]) by mailout.nyi.internal (Postfix) with ESMTP id 657CA21E3E for ; Tue, 9 Jul 2019 06:15:55 -0400 (EDT) Received: from imap2 ([10.202.2.52]) by compute1.internal (MEProxy); Tue, 09 Jul 2019 06:15:55 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lowentropy.net; h=mime-version:message-id:in-reply-to:references:date:from:to :subject:content-type:content-transfer-encoding; s=fm2; bh=TIrLm TB43FbOVbpl4IQNymNWMIe9w6zdzC/igR60sYE=; b=rKZtIi7zHrumaB4HGeTAW EK6m312jF9gAeW663hJJyQf5khKO01MJeYu5UsIWTk0Fpiwb7UjO4pEzD7ny3L01 5NMOACmzxGPqZRZP/EVMeyB8aBLcNxFJ4SI136eW3lfsjG2M3wQV9ByyNH9bgHte BY72aoqNB0r3rA7QNNoOu2vQFiiLjYZh+V/QHz8lipXcxl/4CBZbhFTtUJ6ZIrzp 4ZwgGyd8INJjE718vJ/W3pCCj2dkbr10GhD55+kyOlLVjwi8V5DYFJ0kEIFpqyNS U5L9pQK9YneJa6r2vrD2M9QAJNnSs229MEansexL0+TVvuEFg+1fLzs9WEMe7WTT w== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-transfer-encoding:content-type :date:from:in-reply-to:message-id:mime-version:references :subject:to:x-me-proxy:x-me-proxy:x-me-sender:x-me-sender :x-sasl-enc; s=fm3; bh=TIrLmTB43FbOVbpl4IQNymNWMIe9w6zdzC/igR60s YE=; b=YWpowOdKsUGqNgqBr+k7H5EgADKIVgQ6h5EolRFgF3wbifyuqy+IbZBnH coR86Y5XDN+Q/mTj2OTACSY3wBKtmcVIWQWQzAaXv8ddF+RTBreGnA0JbaLRba8F LL2cYkW8oQk0Iij8RLEZHwaDLfKfRJaSSna0D8OryCksqcVNyQ378Ldn2OEt6czP EXgXpwcjBhPhHlGGeuHLa7n+1ideEhYgvsi1oBD72WUrNOxYQ06/3K4Xi7PvoR9z 6aOX8fj0fv7aMtOsG1jjUvweFMOl+ocY79+vQ00ag96Eqy+X1nZ6pqem9M5orQYy sYnLN/pNIz8+5jphowWdlbHChmu/Q== X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeduvddrgedvgddvlecutefuodetggdotefrodftvf curfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfghnecu uegrihhlohhuthemuceftddtnecunecujfgurhepofgfggfkjghffffhvffutgfgsehtqh ertderreejnecuhfhrohhmpedfofgrrhhtihhnucfvhhhomhhsohhnfdcuoehmtheslhho figvnhhtrhhophihrdhnvghtqeenucffohhmrghinhepihgvthhfrdhorhhgnecurfgrrh grmhepmhgrihhlfhhrohhmpehmtheslhhofigvnhhtrhhophihrdhnvghtnecuvehluhhs thgvrhfuihiivgeptd X-ME-Proxy: Received: by mailuser.nyi.internal (Postfix, from userid 501) id 96EDCE0193; Tue, 9 Jul 2019 06:15:54 -0400 (EDT) X-Mailer: MessagingEngine.com Webmail Interface User-Agent: Cyrus-JMAP/3.1.6-731-g19d3b16-fmstable-20190627v1 Mime-Version: 1.0 Message-Id: <47c5fe54-d88d-4333-a443-55aa44e0b4a0@www.fastmail.com> In-Reply-To: References: Date: Tue, 09 Jul 2019 20:15:54 +1000 From: "Martin Thomson" To: tls@ietf.org Content-Type: text/plain;charset=utf-8 Content-Transfer-Encoding: quoted-printable Archived-At: Subject: Re: [TLS] =?utf-8?q?draft-tschofenig-tls-dtls-rrc-00_-_DTLS_Return_R?= =?utf-8?q?outability_Check_=28RRC=29?= X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 Jul 2019 10:15:59 -0000 Hey Hannes, This definitely looks like it needs attention. This looks fairly lightweight, which is a good goal, but we have lots of= experience with this in QUIC now that suggests that there are trivial d= enial of service attacks that can be mounted on simple designs. Have yo= u looked at the connection migration section in QUIC in any detail? The= re are a few cases described there that don't appear to be covered in yo= ur proposed design. =20 It's possible that you have a different threat model in mind, so maybe t= his doesn't apply. We might be well served by having a discussion about= that though. On Tue, Jul 9, 2019, at 19:05, Hannes Tschofenig wrote: > =20 > Hi all,=20 >=20 >=20 > working on the DTLS connection id drafts we noticed that there is one=20= > security aspect, which could benefit from an extra mitigation techniqu= e. >=20 >=20 > The issue is that an on-path adversary could intercept and modify the=20= > source IP address=C2=A0 (and the source port) of a DTLS datagram.=C2=A0= Even if=20 > receiver checks the authenticity and freshness of the packet, the=20 > recipient is fooled into changing the CID-to-IP/port association. This= =20 > can lead to black-holed or redirected traffic. Of course, an on-path=20= > adversary can do lots of things to traffic and the problem is=20 > self-fixing but it still lead us to work on a solution in form of a=20= > return-routability check.=20 >=20 > Here is the draft: >=20 > https://tools.ietf.org/html/draft-tschofenig-tls-dtls-rrc-00 >=20 >=20 > Ciao >=20 > Hannes >=20 >=20 > IMPORTANT NOTICE: The contents of this email and any attachments are=20= > confidential and may also be privileged. If you are not the intended=20= > recipient, please notify the sender immediately and do not disclose th= e=20 > contents to any other person, use it for any purpose, or store or copy= =20 > the information in any medium. Thank you.=20 > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > From nobody Tue Jul 9 05:47:38 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 54F01120145 for ; Tue, 9 Jul 2019 05:47:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Y54SwUTKxeLc for ; Tue, 9 Jul 2019 05:47:33 -0700 (PDT) Received: from 4.mo6.mail-out.ovh.net (4.mo6.mail-out.ovh.net [87.98.184.159]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 201AC1200FE for ; Tue, 9 Jul 2019 05:47:32 -0700 (PDT) Received: from player731.ha.ovh.net (unknown [10.108.35.197]) by mo6.mail-out.ovh.net (Postfix) with ESMTP id 0FD4B1D0F1F for ; Tue, 9 Jul 2019 14:47:28 +0200 (CEST) Received: from simonbernard.eu (134.163-14-84.ripe.coltfrance.com [84.14.163.134]) (Authenticated sender: contact@simonbernard.eu) by player731.ha.ovh.net (Postfix) with ESMTPSA id EF92E7A12BA3; Tue, 9 Jul 2019 12:47:24 +0000 (UTC) To: Hannes Tschofenig , "tls@ietf.org" References: From: Simon Bernard Message-ID: <2d58dc10-6fa1-2d2c-bf84-52fdb3a60a69@simonbernard.eu> Date: Tue, 9 Jul 2019 14:47:19 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.6.1 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/alternative; boundary="------------A40820CA195EE05CDA1D524A" Content-Language: en-US X-Ovh-Tracer-Id: 10151113563571566833 X-VR-SPAMSTATE: OK X-VR-SPAMSCORE: -100 X-VR-SPAMCAUSE: gggruggvucftvghtrhhoucdtuddrgeduvddrgedvgdehlecutefuodetggdotefrodftvfcurfhrohhfihhlvgemucfqggfjpdevjffgvefmvefgnecuuegrihhlohhuthemucehtddtnecusecvtfgvtghiphhivghnthhsucdlqddutddtmd Archived-At: Subject: Re: [TLS] draft-tschofenig-tls-dtls-rrc-00 - DTLS Return Routability Check (RRC) X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 Jul 2019 12:47:36 -0000 This is a multi-part message in MIME format. --------------A40820CA195EE05CDA1D524A Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 8bit Hi, Should "return_routability_check" use flight retransmission [1] ? > Should the heartbeat message be re-used instead of the proposed new > message exchange? It sounds really similar, except that if heartbeat failed we terminate the connection and for "return_routability_check" we update the peer address. Must heartbeat message be authenticated and encrypted using the currently active security context ? reading the RFC[2] it's not clear to me. heartbeat RFC also explains how to handle heartbeat message during handshake. Maybe this RFC should clarify this too. Simon [1] https://tools.ietf.org/html/rfc6347#section-4.2.4 [2] https://tools.ietf.org/html/rfc6520 Le 09/07/2019 11:05, Hannes Tschofenig a crit: > > Hi all, > > working on the DTLS connection id drafts we noticed that there is one > security aspect, which could benefit from an extra mitigation technique. > > The issue is that an on-path adversary could intercept and modify the > source IP address (and the source port) of a DTLS datagram. Even if > receiver checks the authenticity and freshness of the packet, the > recipient is fooled into changing the CID-to-IP/port association. This > can lead to black-holed or redirected traffic. Of course, an on-path > adversary can do lots of things to traffic and the problem is > self-fixing but it still lead us to work on a solution in form of a > return-routability check. > > Here is the draft: > > https://tools.ietf.org/html/draft-tschofenig-tls-dtls-rrc-00 > > Ciao > > Hannes > > IMPORTANT NOTICE: The contents of this email and any attachments are > confidential and may also be privileged. If you are not the intended > recipient, please notify the sender immediately and do not disclose > the contents to any other person, use it for any purpose, or store or > copy the information in any medium. Thank you. > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls --------------A40820CA195EE05CDA1D524A Content-Type: text/html; charset=windows-1252 Content-Transfer-Encoding: 8bit

Hi,

Should "return_routability_check" use flight retransmission [1] ?

Should the heartbeat message be re-used instead of the proposed new message exchange?

It sounds really similar, except that if heartbeat failed we terminate the connection and for "return_routability_check" we update the peer address.

Must heartbeat message be authenticated and encrypted using the currently active security context ? reading the RFC[2] it's not clear to me.

heartbeat RFC also explains how to handle heartbeat message during handshake. Maybe this RFC should clarify this too.

Simon

[1] https://tools.ietf.org/html/rfc6347#section-4.2.4
[2] https://tools.ietf.org/html/rfc6520

Le 09/07/2019 11:05, Hannes Tschofenig a crit:

Hi all,

working on the DTLS connection id drafts we noticed that there is one security aspect, which could benefit from an extra mitigation technique.

The issue is that an on-path adversary could intercept and modify the source IP address (and the source port) of a DTLS datagram. Even if receiver checks the authenticity and freshness of the packet, the recipient is fooled into changing the CID-to-IP/port association. This can lead to black-holed or redirected traffic. Of course, an on-path adversary can do lots of things to traffic and the problem is self-fixing but it still lead us to work on a solution in form of a return-routability check.

Here is the draft:

https://tools.ietf.org/html/draft-tschofenig-tls-dtls-rrc-00

Ciao

Hannes

IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you. 
_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls
--------------A40820CA195EE05CDA1D524A-- From nobody Tue Jul 9 10:42:50 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A81F2120270; Tue, 9 Jul 2019 10:42:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=akamai.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RZZchpu4tY9G; Tue, 9 Jul 2019 10:42:45 -0700 (PDT) Received: from mx0a-00190b01.pphosted.com (mx0a-00190b01.pphosted.com [IPv6:2620:100:9001:583::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9A40F1207FF; Tue, 9 Jul 2019 10:42:45 -0700 (PDT) Received: from pps.filterd (m0050093.ppops.net [127.0.0.1]) by m0050093.ppops.net-00190b01. (8.16.0.27/8.16.0.27) with SMTP id x69Hbu3V017974; Tue, 9 Jul 2019 18:42:35 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=akamai.com; h=from : to : cc : subject : date : message-id : references : in-reply-to : content-type : content-transfer-encoding : mime-version; s=jan2016.eng; bh=ubi978cg1W0/Fe0e0Ut3RaYlZncFBcpswpuXhlcCDAI=; b=Qqlq5I1/uHccXC9XnrLkOXfJO4h+ZKbBOPA4HR+Q30PgIXiOwRgBGJClUhL7SHH7N9KO B3ggIxmehqdKUiyl/4dc+252iJy41gYvD7DV+mKDQ4PJWUskvRJClV+IZpv4xmz7KE7e 4cNfq6iPcm2F3wAJK/4JCHpK7GKk8BEBx/fDEgsESSe+DBvy18aXhvpKuK/ZDnbqgukC uxi7u6+E4jrlSMvXp4cLYURwqWyHEr75oKufuEh++yinhu7SAQnNnt9Y1A7DqioZRtfU l1S86zhgo/kjdp4BKORayfWOTS9naUV2AIe0/Qz/EWflbVKRJUcjmOpBAlhAHlZxcAM1 QA== Received: from prod-mail-ppoint5 (prod-mail-ppoint5.akamai.com [184.51.33.60] (may be forged)) by m0050093.ppops.net-00190b01. with ESMTP id 2tjjwpnw6q-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 09 Jul 2019 18:42:35 +0100 Received: from pps.filterd (prod-mail-ppoint5.akamai.com [127.0.0.1]) by prod-mail-ppoint5.akamai.com (8.16.0.27/8.16.0.27) with SMTP id x69Hf7Bw000559; Tue, 9 Jul 2019 10:42:34 -0700 Received: from email.msg.corp.akamai.com ([172.27.25.32]) by prod-mail-ppoint5.akamai.com with ESMTP id 2tjsm80qch-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Tue, 09 Jul 2019 10:42:34 -0700 Received: from USTX2EX-DAG1MB5.msg.corp.akamai.com (172.27.27.105) by ustx2ex-dag1mb4.msg.corp.akamai.com (172.27.27.104) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Tue, 9 Jul 2019 12:42:32 -0500 Received: from USTX2EX-DAG1MB5.msg.corp.akamai.com ([172.27.27.105]) by ustx2ex-dag1mb5.msg.corp.akamai.com ([172.27.27.105]) with mapi id 15.00.1473.004; Tue, 9 Jul 2019 12:42:33 -0500 From: "Lubashev, Igor" To: Kuhn Nicolas , "tsvwg@ietf.org" , IETF QUIC WG , "'tls@ietf.org'" CC: "'gorry@erg.abdn.ac.uk'" , "'emile.stephan@orange.com'" Thread-Topic: Updates on the "Transport parameters for 0-RTT connections" draft Thread-Index: AdUP24Zg+1VIa8FMRoKfDVG/fwUlTgmnZqQg Date: Tue, 9 Jul 2019 17:42:32 +0000 Message-ID: <998fba75095b4417bb6a41a2cd2075c4@ustx2ex-dag1mb5.msg.corp.akamai.com> References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [172.19.36.122] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-07-09_07:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 mlxscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1810050000 definitions=main-1907090207 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-07-09_07:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1011 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1810050000 definitions=main-1907090208 Archived-At: Subject: Re: [TLS] Updates on the "Transport parameters for 0-RTT connections" draft X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 Jul 2019 17:42:48 -0000 Nico, thanks for caring about clients behind high-latency links. > The NewSessionTicket carries an additional field named 'early_data' > that indicates to the client the maximum size of application data to > insert in the 0-RTT message. I see that draft-ietf-quic-tls requires use of initial_max_data instead and= required "early_data" to carry no information. See section 4.5 "Enabling = 0-RTT". Is there an advantage to use one vs the other?=20 > BDP_metadata All these parameters the client can calculate itself. You mention that the = clients may actually reject BDP_metadata, if its contents seem suspect to i= t. So is this structure useful because some clients will be able to make us= e of these fields on a subsequent 0-RTT connection but would not care to im= plement the needed measurements themselves? Or is there some other reason? Best wishes, - Igor ----------------------- From: Kuhn Nicolas =20 Sent: Tuesday, May 21, 2019 9:47 AM Subject: Updates on the "Transport parameters for 0-RTT connections" draft Dear all,=20 Following the different feedbacks on this draft, we have proposed an update= d version on the "Transport parameters for 0-RTT connections".=20 https://datatracker.ietf.org/doc/draft-kuhn-quic-0rtt-bdp/ The draft proposes a solution where path characteristics are shared between= the peers to improve the ingress traffic for 0-RTT connections. The difference with version 01 are mainly based on the received feedback. In short, we now a BDP_metadata structure so that various path parameters c= an be exposed to the client (MTU, RTT, bandwidth, loss-rate). We have also added a section to discuss what happens when BDP is used incor= rectly. Let us know if we have any views or interest in this proposal.=20 Cheers, Nico for the authors From nobody Tue Jul 9 14:14:10 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7E0A21200C7; Tue, 9 Jul 2019 14:14:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.598 X-Spam-Level: X-Spam-Status: No, score=-2.598 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eLVJg03GefyO; Tue, 9 Jul 2019 14:14:00 -0700 (PDT) Received: from relais-inet.orange.com (relais-inet.orange.com [80.12.66.41]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 654D212006F; Tue, 9 Jul 2019 14:14:00 -0700 (PDT) Received: from opfedar06.francetelecom.fr (unknown [xx.xx.xx.8]) by opfedar21.francetelecom.fr (ESMTP service) with ESMTP id 45jw6Z5Whsz7tkH; Tue, 9 Jul 2019 23:13:58 +0200 (CEST) Received: from Exchangemail-eme6.itn.ftgroup (unknown [xx.xx.13.42]) by opfedar06.francetelecom.fr (ESMTP service) with ESMTP id 45jw6Z45Qkz3wb8; Tue, 9 Jul 2019 23:13:58 +0200 (CEST) Received: from OPEXCAUBM44.corporate.adroot.infra.ftgroup ([fe80::e8a4:8bb:d7c2:f4e2]) by OPEXCAUBMA2.corporate.adroot.infra.ftgroup ([::1]) with mapi id 14.03.0439.000; Tue, 9 Jul 2019 23:13:58 +0200 From: To: "Lubashev, Igor" , Kuhn Nicolas , "tsvwg@ietf.org" , IETF QUIC WG , "'tls@ietf.org'" CC: "'gorry@erg.abdn.ac.uk'" Thread-Topic: QUIC vs TLS1.3 initial_max_data (was RE: Updates on the "Transport parameters for 0-RTT connections" draft) Thread-Index: AdU2myLE/AUABr1hRZ2MXDXAZs+ZWw== Date: Tue, 9 Jul 2019 21:13:57 +0000 Message-ID: <5269_1562706838_5D250396_5269_207_1_5AE9CCAA1B4A2248AB61B4C7F0AD5FB931E78610@OPEXCAUBM44.corporate.adroot.infra.ftgroup> Accept-Language: fr-FR, en-US Content-Language: fr-FR X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.114.13.247] Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: [TLS] QUIC vs TLS1.3 initial_max_data (was RE: Updates on the "Transport parameters for 0-RTT connections" draft) X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 Jul 2019 21:14:03 -0000 Hi Igor, You are right, QUIC TLS spec maps TLS1.3 'early_data' field in the "initia= l_max_data" transport parameter. I don't know the motivation. It sounds good to move transport parameters ou= t of the TLS NewSessionTicket. Regards Emile -----Message d'origine----- De=A0: Lubashev, Igor [mailto:ilubashe@akamai.com]=20 Envoy=E9=A0: mardi 9 juillet 2019 19:43 =C0=A0: Kuhn Nicolas; tsvwg@ietf.org; IETF QUIC WG; 'tls@ietf.org' Cc=A0: 'gorry@erg.abdn.ac.uk'; STEPHAN Emile TGI/OLN Objet=A0: RE: Updates on the "Transport parameters for 0-RTT connections" d= raft Nico, thanks for caring about clients behind high-latency links. > The NewSessionTicket carries an additional field named 'early_data' > that indicates to the client the maximum size of application data to > insert in the 0-RTT message. I see that draft-ietf-quic-tls requires use of initial_max_data instead and= required "early_data" to carry no information. See section 4.5 "Enabling = 0-RTT". Is there an advantage to use one vs the other?=20 > BDP_metadata All these parameters the client can calculate itself. You mention that the = clients may actually reject BDP_metadata, if its contents seem suspect to i= t. So is this structure useful because some clients will be able to make us= e of these fields on a subsequent 0-RTT connection but would not care to im= plement the needed measurements themselves? Or is there some other reason? Best wishes, - Igor ----------------------- From: Kuhn Nicolas =20 Sent: Tuesday, May 21, 2019 9:47 AM Subject: Updates on the "Transport parameters for 0-RTT connections" draft Dear all,=20 Following the different feedbacks on this draft, we have proposed an update= d version on the "Transport parameters for 0-RTT connections".=20 https://datatracker.ietf.org/doc/draft-kuhn-quic-0rtt-bdp/ The draft proposes a solution where path characteristics are shared between= the peers to improve the ingress traffic for 0-RTT connections. The difference with version 01 are mainly based on the received feedback. In short, we now a BDP_metadata structure so that various path parameters c= an be exposed to the client (MTU, RTT, bandwidth, loss-rate). We have also added a section to discuss what happens when BDP is used incor= rectly. Let us know if we have any views or interest in this proposal.=20 Cheers, Nico for the authors ___________________________________________________________________________= ______________________________________________ Ce message et ses pieces jointes peuvent contenir des informations confiden= tielles ou privilegiees et ne doivent donc pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu= ce message par erreur, veuillez le signaler a l'expediteur et le detruire ainsi que les pieces jointes. Les messages el= ectroniques etant susceptibles d'alteration, Orange decline toute responsabilite si ce message a ete altere, deforme ou = falsifie. Merci. This message and its attachments may contain confidential or privileged inf= ormation that may be protected by law; they should not be distributed, used or copied without authorisation. If you have received this email in error, please notify the sender and dele= te this message and its attachments. As emails may be altered, Orange is not liable for messages that have been = modified, changed or falsified. Thank you. From nobody Wed Jul 10 06:28:23 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2552512010C for ; Wed, 10 Jul 2019 06:28:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id l2oZTIs-p34Y for ; Wed, 10 Jul 2019 06:28:18 -0700 (PDT) Received: from de-out1.bosch-org.com (de-out1.bosch-org.com [139.15.230.186]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 402561200DE for ; Wed, 10 Jul 2019 06:28:18 -0700 (PDT) Received: from si0vm1947.rbesz01.com (unknown [139.15.230.188]) by si0vms0216.rbdmz01.com (Postfix) with ESMTPS id 45kKkl0JX8z1XLG79; Wed, 10 Jul 2019 15:28:15 +0200 (CEST) Received: from si0vm2082.rbesz01.com (unknown [10.58.172.176]) by si0vm1947.rbesz01.com (Postfix) with ESMTPS id 45kKkl08MTz6CjR2y; Wed, 10 Jul 2019 15:28:15 +0200 (CEST) X-AuditID: 0a3aad16-4b5ff70000005941-ec-5d25e7ee7ea0 Received: from si0vm1949.rbesz01.com ( [10.58.173.29]) (using TLS with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by si0vm2082.rbesz01.com (SMG Outbound) with SMTP id AE.97.22849.EE7E52D5; Wed, 10 Jul 2019 15:28:14 +0200 (CEST) Received: from SI-MBX2033.de.bosch.com (si-mbx2033.de.bosch.com [10.3.230.36]) by si0vm1949.rbesz01.com (Postfix) with ESMTPS id 45kKkk5FxFz6Cjg8W; Wed, 10 Jul 2019 15:28:14 +0200 (CEST) Received: from SI-MBX2033.de.bosch.com (10.3.230.36) by SI-MBX2033.de.bosch.com (10.3.230.36) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.1.1713.5; Wed, 10 Jul 2019 15:28:14 +0200 Received: from SI-MBX2033.de.bosch.com ([fe80::e8d2:d090:af15:3320]) by SI-MBX2033.de.bosch.com ([fe80::e8d2:d090:af15:3320%4]) with mapi id 15.01.1713.007; Wed, 10 Jul 2019 15:28:14 +0200 From: "Kraus Achim (INST/ECS4)" To: Hannes Tschofenig , "tls@ietf.org" Thread-Topic: draft-tschofenig-tls-dtls-rrc-00 - DTLS Return Routability Check (RRC) Thread-Index: AdU2NXH6l5nrxsDQQh2DGNc/pbIIBAA6VytA Date: Wed, 10 Jul 2019 13:28:14 +0000 Message-ID: References: In-Reply-To: Accept-Language: de-DE, en-US Content-Language: de-DE X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.22.83.209] Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Brightmail-Tracker: H4sIAAAAAAAAA22TYUwbdRjG+d8d5eh2cj1a+tpRozdZjGZY2IgIy/SLbvHLzJxMHeiOcWur 0JJeu7EZtZpJZtVJaseQbYwthehcy9YlWuk6Rjs0oGy64dYSI64UxhAkw2RjiUHvOFj7wS+X 5573fs/7f9+7I3HGRepIs8XO2yxcLatQEsoyn371XzcLqgxdQ2tK4y0DWOnsZRd6Ftt4qu0U 2uj13sNexF5Trqvha827eNuT67crTVdcn2fVD7INYWeCcKJv810omwR6LQz5xhSSZugWDO40 c7I+j8B9VO9CSlFPI7ja/RMh31xA0D0/vUAo6DJwt0ezJK2mN8NnM+4FnUu/DPHGOYXsV8Cl 6S9FmBR1MXguUpJN0AXQN/c7kjRFl8PM/nFCblwJv12/iUs6m64C/y/BhRhE6+H06csLPk5r ITB+N1MegAbvOdkHWgO3RucX/Yeh/1IIyc8XQuygRyHrJ6Dz+J+43FcF/V8kiSaU15oW25qG tKYhrWlIOyJOIo1gNuyqKzaUFhfaqnlhr6GocIe1LoDk95MXRB0DOyMII1EElZAYq6Eafiyo Yh6ottbsMXGC6Q2bo5YXWB2V//MLlUzufVtwVNeZBcFstUQQkDirps5vWFnFUDXcnr28zSpj EbSCJFgtZSQ3VTK0kbPzb/F8PW9bqpaTJAtUu/iFMCobb+Qbdppr7UtlVk+hjIwMJi+9kt4W I7MjaA25XOz9phRBCfVcnWA2LuIPyjiz5KbQAbSJbLp19ARO9va1idf4jPcEzhAWq4XXaanG cTGLliiTw3L/NLp8imLFATVphVTiJIohErG5VIkELxd/gtQ5gFohrU61aKagYq/I0L/mQqyR gq7RjxEEzn6PINFxAIM/mp04+IddOMx5ZghoCX+YCYGvwpkQSvyTCW2JJgVc+OZKFkyOBEno ORQjYe5i4zL49/1ry8Af8FFw8lg3BRPzx3Jgf8KfI3rncuBGeJgG98QRFfQlOxk4sy/MwEg8 zoB77IgaPujyqSEU7FVDbCqqgZbmTi20eaPaSXHHmLjjd19lpR3bOfv/7HjRTQ2ncyJP8JHm 7bd7d4ce4uKzvUb3c/N/b10XuftDz9jVbTeS6+8kH/VlHf7unvN5f8U+Olr+TPsnfd7B/tsq 74bBLY6Rr4dXxZpWHqJGK7CDT6+eyvd8+nrhSz0hw9BHw2WvJDZ37Pa85/JvPWCbeOftoR0l Y09Fr005Zh9LFvUk1l7XZxzGcZolBBNX9DhuE7j/ANSwwh+dBAAA Archived-At: Subject: Re: [TLS] draft-tschofenig-tls-dtls-rrc-00 - DTLS Return Routability Check (RRC) X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 10 Jul 2019 13:28:22 -0000 Hi Hannes, there was already a short discussion about that topic, see https://github.com/tlswg/dtls-conn-id/issues/64. I also created a new issue https://github.com/tlswg/dtls-conn-id/issues/69, because I got aware of a pitfall (record reordering with address changes) c= lose to that original issue. --------------------------- https://tools.ietf.org/html/draft-tschofenig-tls-dtls-rrc-00#section-1 "This attack is possible because the network and transport layer identifiers, such as source IP address and source port numbers, are not integrity protected and authenticated by the DTLS record layer." FMPOV=20 "This attack is possible because the network and transport layer identifiers, such as source IP address and source port numbers, could not be integrity protected and authenticated by the DTLS record layer."=20 Doing so would break NATs, so I think it's better to express, that it is no= t possible to protect them. --------------------------- https://tools.ietf.org/html/draft-tschofenig-tls-dtls-rrc-00#section-3 "Furthermore, when using CID, anti-replay protection MUST be enabled. This is to ensure that a man-on-the-middle attacker sending a previously captured record with a modified source IP address and port will not be able to successfully pass the above check (since the datagram is very likely discarded on receipt - if it falls outside the replay window)." With my new issue https://github.com/tlswg/dtls-conn-id/issues/69 above,=20 I think this could be relaxed to keep the highest "epoch/sequence_number" a= nd=20 the address MUST only be updated, if the received record has a higher order= according that "epoch/sequence_number". I'm not sure, maybe it's unusual, but I would mention=20 https://tools.ietf.org/html/draft-ietf-core-echo-request-tag-05 as example. --------------------------- https://tools.ietf.org/html/draft-tschofenig-tls-dtls-rrc-00#section-4 "Return Routability Check --------> (cookie) Src-IP=3DB Dst-IP=3DZ" FMPOV, if a peer uses TLS12_CID records, all records should use that format= and use the inner type to differentiate that type. https://github.com/tlswg/dtls-conn-id/blob/master/draft-ietf-tls-dtls-conne= ction-id.md#the-connection_id-extension "If DTLS peers have negotiated the use of a CIDs ... the new record layer format with the tls12_cid content type defined in {{dt= ls-ciphertext}} MUST be used." "Return Routability Check --------> (cookie) Src-IP=3DB Dst-IP=3DZ" Adding "" should point to that. As I wrote in https://github.com/tlswg/dtls-conn-id/issues/64, if the heart= beat is used as an inner type send in a TLS12_CID record, it may be also used for t= hat check.=20 Are there reasons not using the heartbeat? If not, I'm also not sure, if a = new=20 record_type pays off (Simon asked this also on his e-mail). Mit freundlichen Gr=FC=DFen / Best regards Achim Kraus Engineering Cloud Services 4 Bosch IoT Hub (INST/ECS4) Von: TLS Im Auftrag von Hannes Tschofenig Gesendet: Dienstag, 9. Juli 2019 11:06 An: tls@ietf.org Betreff: [TLS] draft-tschofenig-tls-dtls-rrc-00 - DTLS Return Routability C= heck (RRC) Hi all,=20 working on the DTLS connection id drafts we noticed that there is one secur= ity aspect, which could benefit from an extra mitigation technique. The issue is that an on-path adversary could intercept and modify the sourc= e IP address=A0 (and the source port) of a DTLS datagram.=A0 Even if receiv= er checks the authenticity and freshness of the packet, the recipient is fo= oled into changing the CID-to-IP/port association. This can lead to black-h= oled or redirected traffic. Of course, an on-path adversary can do lots of = things to traffic and the problem is self-fixing but it still lead us to wo= rk on a solution in form of a return-routability check.=20 Here is the draft: https://tools.ietf.org/html/draft-tschofenig-tls-dtls-rrc-00 Ciao Hannes IMPORTANT NOTICE: The contents of this email and any attachments are confid= ential and may also be privileged. If you are not the intended recipient, p= lease notify the sender immediately and do not disclose the contents to any= other person, use it for any purpose, or store or copy the information in = any medium. Thank you.=20 From nobody Thu Jul 11 12:36:29 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6A1DF12006B for ; Thu, 11 Jul 2019 12:36:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.604 X-Spam-Level: X-Spam-Status: No, score=-0.604 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, PDS_NO_HELO_DNS=1.295, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=plonka-us.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MFbwH3ich5Wq for ; Thu, 11 Jul 2019 12:36:25 -0700 (PDT) Received: from mail-ot1-x330.google.com (mail-ot1-x330.google.com [IPv6:2607:f8b0:4864:20::330]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E496812013B for ; Thu, 11 Jul 2019 12:36:24 -0700 (PDT) Received: by mail-ot1-x330.google.com with SMTP id o101so7048612ota.8 for ; Thu, 11 Jul 2019 12:36:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=plonka-us.20150623.gappssmtp.com; s=20150623; h=mime-version:from:date:message-id:subject:to; bh=mhqKld1nMuXp0PLkS01qKXRab0k6TMmAfJE7yWQAmQ4=; b=RYNBLOlEecOkT+bLoznTPWRD97F82CsJfT3VwELLoMjs24N00SGQ50WytXbpU1Nfhy AYciVMsBL/Qt1fB7WUAPh+uUSAiSExXGID6fBwBeQhkJVY/tk2e6hiWhztVtHaEY27At aJw/yAUEpuzumN1ewpBuVPYJiSW8xRvbjKI/GPTDB2v9VwDSU9wY9p4cloqxAHUDiCd1 yQgVdDc7YDnM17zNySUJi3Fh3iek11kNxHbihDZLIu3qS/XlW2eP4eQT8Nt6COy9baNK mSvx9m1c+lw6GO2I1mloUkJl8mDi8pHBmKtrT0UAGN50XDjm1mfs6R4xYgr6Di4QpttP Xtxw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=mhqKld1nMuXp0PLkS01qKXRab0k6TMmAfJE7yWQAmQ4=; b=oR7gIESAx51IvhS1n6qZ0GKLMyWWB23yV3Ww/e9j3cAlqCughIQp8DvLmOfcg3q+0J 1zYTJgH/PuBkEMqAlFEVXHHkFZap7yBATrzVCG4HPfgyE3AdGuQTLQM+w4AG3OhXhtr0 T0uVY9qA4d8zmELe2XtdS31j8pknLnlz/Tc+q/zmbUDGOVBW5ZGB95kkiGcPakD1XaLq 7RpkuRRkHabZxsdYgw0ICEkhFeEnj4ulGrzUiFWzoygsoyiZBYaQbauHxWUT+3LIHpoS +ZhFIs7glYmQiQbNPpEQeKS8D1/BjQb3DDHWrW3TwY1ZYm5+Zji04zUf3IAynJpmWtJJ JvaA== X-Gm-Message-State: APjAAAWiX0oC7s7upAvdRnxV5x0RIIIZAwGR2cmP5M3ch/B6Vzte5/hl WvZmv1HeRJ3iVnrGJ40WMNUzBB5yU28HeDf8KV3YLVSw X-Google-Smtp-Source: APXvYqyVzRtlhIJgHr5STsi3HnqmDVomOIso+D4I/+cJJfrpfmL65lsDeuXOADLwukJ7ImnMFJRMpeQ2Ia3cKytvu6g= X-Received: by 2002:a9d:390:: with SMTP id f16mr4980037otf.93.1562873783966; Thu, 11 Jul 2019 12:36:23 -0700 (PDT) MIME-Version: 1.0 From: Dave Plonka Date: Thu, 11 Jul 2019 14:36:13 -0500 Message-ID: To: tls@ietf.org Content-Type: text/plain; charset="UTF-8" Archived-At: Subject: [TLS] TLS topics at MAPRG meeting, IETF 105 Montreal, Friday morning X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 11 Jul 2019 19:36:27 -0000 Hi folks, Please note that the Measurement and Analysis for Protocols Research Group (MAPRG) has arranged for presentation of a measurement contributions pertinent to TLS engineering and/or operation at our upcoming meeting during IETF 105 in Montreal: * TLS 1.3 Client Measurements MARG is scheduled to meet as follows: Date: Friday July 26, 10:00-12:00 (Morning session I) Room: Place du Canada and the meeting's full agenda including abstracts is here: https://datatracker.ietf.org/meeting/105/materials/agenda-105-maprg.html Please join us if you are interested! Thanks, Dave & Mirja (MAPRG chairs) -- dave@plonka.us http://www.cs.wisc.edu/~plonka/ From nobody Mon Jul 15 10:19:36 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A4B411201A3 for ; Mon, 15 Jul 2019 10:19:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=salowey-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4mN6nLJHHGGe for ; Mon, 15 Jul 2019 10:19:32 -0700 (PDT) Received: from mail-qk1-x72d.google.com (mail-qk1-x72d.google.com [IPv6:2607:f8b0:4864:20::72d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B0DC41201B0 for ; Mon, 15 Jul 2019 10:19:22 -0700 (PDT) Received: by mail-qk1-x72d.google.com with SMTP id d15so12226793qkl.4 for ; Mon, 15 Jul 2019 10:19:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=salowey-net.20150623.gappssmtp.com; s=20150623; h=mime-version:from:date:message-id:subject:to; bh=lu4FKOiAxGzGErJAb3cX4z7/WXxEuItqnIZtjdyFfhc=; b=ckamgGyEsXZFSRAM+HxUa6TTRfGrkyM4g9CNO4JhN7/mZFhmfKE1LUGcTps3EfTdsE qTVyI0e5CZgpymriGz39eAtpLNfP2QPgcB1h/citFOoVIlNvWzYleMNkWTYMrcF3AEWA eQTDK5n2RWFDAdXjXI/gDmKsbEJlo721uPOFg9p8p504vIAVD3qfAAtNS20tcIW3w3nl /p+6HX4Qi2K3F8lcWhtgo3Hdz1WDebQQL4XU/K2dkoGB6bxiJmOpJ8Mszpk9H9IXzKiV E6Z0CabFWQ/TgGH0F9zzKbNa4rL8JPUFH+uZyIRL64ThsXPcZzusK/tXoeQqFy6CVzAW eevg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=lu4FKOiAxGzGErJAb3cX4z7/WXxEuItqnIZtjdyFfhc=; b=I/Ad0TcAZWXBMToFv6aSWeG3DV5vNj651JEoxX+E4ItcM8U8UbW9TTtMpU2O7zBon3 3Mp9HJLGbbebcX2GCY27LKVExKpkmB/MD4Q5YjPqzDVFBI01IBOykW4a7mw5vyv2qcaq CsRljxJ/lK1DbgvJik8Kzar/xIxsKFNjlFhye93eg7Vg0UvmyotiDN0psGdYu74SwPl3 wzM15gpEe/74MAmiaP5VQkW5tEZjXYgic8FERhrz3IWunk/AskWqfH2FjXya53M2miDP aH+IpAuxXi3GkCErwCevfUsTJPznMpDFXus8dxzlVrCBLV4qO1SKtS2dBwyWWl5AC4Qk 7jvw== X-Gm-Message-State: APjAAAVq9oYGktwnhHf6PB9fgAKU/yh2kw5jLy0s8uz+zKQKpVxSxxy/ wgZeGG7j14Y2JEe7uqYKOx/P0wdkmNKhd/g5IX5j49zz6qU= X-Google-Smtp-Source: APXvYqw53apgJUVu6mXTmitddS4pUmsCJ08hjkRnDRd66b2FH2+sgo9cxtXcE2Rp3oDQTVv7M/ZBcgJtEgMaTSb5ftE= X-Received: by 2002:a37:4a49:: with SMTP id x70mr17483233qka.375.1563211161590; Mon, 15 Jul 2019 10:19:21 -0700 (PDT) MIME-Version: 1.0 From: Joseph Salowey Date: Mon, 15 Jul 2019 10:19:10 -0700 Message-ID: To: "" Content-Type: multipart/alternative; boundary="000000000000fee08e058dbb7508" Archived-At: Subject: [TLS] WGLC for draft-ietf-tls-dtls-connection-id-06 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 15 Jul 2019 17:19:35 -0000 --000000000000fee08e058dbb7508 Content-Type: text/plain; charset="UTF-8" This the working group last call for draft-ietf-tls-dtls-connection-id-06. The diff between the version that was last called (-03) and the current version can be found here: https://tools.ietf.org/rfcdiff?url2=draft-ietf-tls-dtls-connection-id-06.txt&url1=draft-ietf-tls-dtls-connection-id-03 Please focus your review on the changes since the previous last call and send comments to the list by July 22, 2019. Thanks, C,S & J --000000000000fee08e058dbb7508 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
This the working group last call for=C2=A0draft-ietf-tls-d= tls-connection-id-06.=C2=A0 The diff between the version that was last call= ed (-03) and the current version can be found here:=C2=A0https://too= ls.ietf.org/rfcdiff?url2=3Ddraft-ietf-tls-dtls-connection-id-06.txt&url= 1=3Ddraft-ietf-tls-dtls-connection-id-03

Please focu= s your review on the changes since the previous last call and send comments= to the list by July 22, 2019.=C2=A0=C2=A0

Thanks,=

C,S & J
--000000000000fee08e058dbb7508-- From nobody Mon Jul 15 13:45:46 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E77A8120132 for ; Mon, 15 Jul 2019 13:45:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cloudflare.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PgRF88y4qgzL for ; Mon, 15 Jul 2019 13:45:36 -0700 (PDT) Received: from mail-vs1-xe33.google.com (mail-vs1-xe33.google.com [IPv6:2607:f8b0:4864:20::e33]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 66C5C120123 for ; Mon, 15 Jul 2019 13:45:33 -0700 (PDT) Received: by mail-vs1-xe33.google.com with SMTP id y16so12346003vsc.3 for ; Mon, 15 Jul 2019 13:45:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cloudflare.com; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=M4kFpiJpKz2gH8PJb9CrDRXSmbJcZfytwCYxV65exk4=; b=xeDMRtmpU1bb0ptg155PsEVGN6mY6h076DSNsZRkw6peo29NmVLBkvcHLUOyPAcSmr 5kSPMT1dMbso4A8S/BEqfTSoF4OTNyLdk1WrkjxUgkjkQoaqKfoGLG76uhxL+eUuyhh/ d6wLsAW8zz+v69tWq8mCBEPtpuHAYuWC6f7Qg= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=M4kFpiJpKz2gH8PJb9CrDRXSmbJcZfytwCYxV65exk4=; b=MkHbH97Q7CX6Cc4zmk94pkm8ock5g+4fmjTxOeRYRTDWgiyIAs6kjIYAsTpvI3VcO9 s3PVPnfI2Rem5+fCXBWGjc0kU/pyMV2w9PGy0mBpjozLoX44Gp+qI20ETxjC0eltflB7 VB4EXf5ZXIl1xwWgPLvck6zhtK5HbHhpvI7XcXDu6yML5n66qWf8LnV81pJV0B+WAsqs 4msY7zQ5/2OrG5UKSGv0XqwQtHmjGPV7+pEA8s+DfsanyO4wb4HGk/GR2VXeEkd07g5G QM08KIXYsKRWBVIi1WKJabZbsov6ip+zlPaYSgidar//Td3KDZgSlZe7FtTPEv4Vg5Xl v9DA== X-Gm-Message-State: APjAAAWF7t+55PNjcAsV7+fV3YjO0RLlF5l0kZZ05PMajoRiJ6ZAZxmh /ShHVwqwovu72n+dOIrNx1z0heuBAcVujJY5DVH0ZQ== X-Google-Smtp-Source: APXvYqw0TOVjtGw+jDa20rpE/o7RaRS3S1Kyexu3PDQkVbDCXj0P/vF26NClIkMLJ6E+bwFV71vbHtd6UjikdGHNGLg= X-Received: by 2002:a05:6102:252:: with SMTP id a18mr15733524vsq.53.1563223532188; Mon, 15 Jul 2019 13:45:32 -0700 (PDT) MIME-Version: 1.0 References: <156249708979.14501.13745976049183757305@ietfa.amsl.com> In-Reply-To: <156249708979.14501.13745976049183757305@ietfa.amsl.com> From: Nick Sullivan Date: Mon, 15 Jul 2019 13:45:16 -0700 Message-ID: To: Christer Holmberg Cc: gen-art@ietf.org, draft-ietf-tls-exported-authenticator.all@ietf.org, ietf@ietf.org, "" Content-Type: multipart/alternative; boundary="00000000000057768f058dbe5741" Archived-At: Subject: Re: [TLS] Genart last call review of draft-ietf-tls-exported-authenticator-09 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 15 Jul 2019 20:45:38 -0000 --00000000000057768f058dbe5741 Content-Type: text/plain; charset="UTF-8" Christer, Thank you for the review. I'll attempt to address these in time for the submission window to open up again. Best, Nick On Sun, Jul 7, 2019 at 3:58 AM Christer Holmberg via Datatracker < noreply@ietf.org> wrote: > Reviewer: Christer Holmberg > Review result: Ready with Issues > > I am the assigned Gen-ART reviewer for this draft. The General Area > Review Team (Gen-ART) reviews all IETF documents being processed > by the IESG for the IETF Chair. Please treat these comments just > like any other last call comments. > > For more information, please see the FAQ at > > . > > Document: draft-ietf-tls-exported-authenticator-09 > Reviewer: Christer Holmberg > Review Date: 2019-07-07 > IETF LC End Date: 2019-07-16 > IESG Telechat date: Not scheduled for a telechat > > Summary: The document is well written. However, I have found some issues > that > the author may want to consider clarifying in the document. > > Major issues: N/A > > Minor issues: > > MIN_1: > The last sentence of Section 1 says that the mechanism requires TLS > version 1.2 > or later. Would it be useful to state that in a dedicated Applicability > section? > > MIN_2: > Can the mechanism be used also for DTLS? > > MIN_3: > The documents talk about additional certificates. If I only have one > additional > certificate, can I use that for multiple authenticators throughout the TLS > session? > > MIN_4: > Section 3 and 4 say that the authenticator request and authenticator > SHOULD be > sent using TLS, and Section 1 says that the proof of authentication can be > sent > out-of-band. I think it would be useful to clarify whether both the > authenticator request and authenticator can be sent out-of-band ( i.e., not > using the TLS connection that the additional authentication is associated > with), and also to state whether it IS allowed to send the authenticator > request and authenticator on the TLS connection they are associated with. > > MIN_5: > Section 5 talks about an endpoint sending an empty authenticator. But, > what if > the sender of the authenticator request does not receive anything? Does it > simply move on? Does it terminate the TLS session? Is the action based on > local > policy? > > MIN_6: > Related to MIN_5, I can't find text about how endpoints inform each other > about > the support of the mechanism, so maybe a few words about that would be > useful. > And some words about backward compatibility with endpoints that don't > support > the mechanism. > > MIN_7: > What happens if the validation of an authenticator fails? Does the > requester > simply move on? Does it terminate the TLS session? Is the action based on > local > policy? > > Nits/editorial comments: > > ED_1: > The document uses "session", "TLS connection" and "TLS communication" > terminology. Is that intentional, or wouuld it be possible to use > consistent > terminology? > > ED_2: > Section 3 says: "The authenticator request is a structured message that > can be > created..." Section 4 says: "The authenticator is a structured message > that can > be exported..." > > In the 2nd paragraph of Section 4 it is stated that "authenticator" is sent > based on an "authenticator request". I wonder if that could be stated > already > in the beginning of Section 4, to further clarify the difference between > them. > E.g., > > "The authenticator is a structured message, triggered by an authenticator > request, that can be exported from either party of a TLS connection." > > > --00000000000057768f058dbe5741 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Christer,

Thank you for the review. I&#= 39;ll attempt to address these in time for the submission window to open up= again.

Best,
Nick

On Sun, Jul 7, 2= 019 at 3:58 AM Christer Holmberg via Datatracker <noreply@ietf.org> wrote:
Reviewer: Christer Holmberg
Review result: Ready with Issues

I am the assigned Gen-ART reviewer for this draft. The General Area
Review Team (Gen-ART) reviews all IETF documents being processed
by the IESG for the IETF Chair.=C2=A0 Please treat these comments just
like any other last call comments.

For more information, please see the FAQ at

<https://trac.ietf.org/trac/gen/wiki/GenArtfaq&g= t;.

Document: draft-ietf-tls-exported-authenticator-09
Reviewer: Christer Holmberg
Review Date: 2019-07-07
IETF LC End Date: 2019-07-16
IESG Telechat date: Not scheduled for a telechat

Summary: The document is well written. However, I have found some issues th= at
the author may want to consider clarifying in the document.

Major issues: N/A

Minor issues:

MIN_1:
The last sentence of Section 1 says that the mechanism requires TLS version= 1.2
or later. Would it be useful to state that in a dedicated Applicability sec= tion?

MIN_2:
Can the mechanism be used also for DTLS?

MIN_3:
The documents talk about additional certificates. If I only have one additi= onal
certificate, can I use that for multiple authenticators throughout the TLS<= br> session?

MIN_4:
Section 3 and 4 say that the authenticator request and authenticator SHOULD= be
sent using TLS, and Section 1 says that the proof of authentication can be = sent
out-of-band. I think it would be useful to clarify whether both the
authenticator request and authenticator can be sent out-of-band ( i.e., not=
using the TLS connection that the additional authentication is associated with), and also to state whether it IS allowed to send the authenticator request and authenticator on the TLS connection they are associated with.
MIN_5:
Section 5 talks about an endpoint sending an empty authenticator. But, what= if
the sender of the authenticator request does not receive anything?=C2=A0 Do= es it
simply move on? Does it terminate the TLS session? Is the action based on l= ocal
policy?

MIN_6:
Related to MIN_5, I can't find text about how endpoints inform each oth= er about
the support of the mechanism, so maybe a few words about that would be usef= ul.
And some words about backward compatibility with endpoints that don't s= upport
the mechanism.

MIN_7:
What happens if the validation of an authenticator fails? Does the requeste= r
simply move on? Does it terminate the TLS session? Is the action based on l= ocal
policy?

Nits/editorial comments:

ED_1:
The document uses "session", "TLS connection" and "= ;TLS communication"
terminology. Is that intentional, or wouuld it be possible to use consisten= t
terminology?

ED_2:
Section 3 says: "The authenticator request is a structured message tha= t can be
created..." Section 4 says: "The authenticator is a structured me= ssage that can
be exported..."

In the 2nd paragraph of Section 4 it is stated that "authenticator&quo= t; is sent
based on an "authenticator request". I wonder if that could be st= ated already
in the beginning of Section 4, to further clarify the difference between th= em.
E.g.,

"The authenticator is a structured message, triggered by an authentica= tor
request, that can be exported from either party of a TLS connection."<= br>

--00000000000057768f058dbe5741-- From nobody Tue Jul 16 06:01:26 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2DFBB12041A for ; Tue, 16 Jul 2019 06:01:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=bosch-si.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0FRyWwyCWh6V for ; Tue, 16 Jul 2019 06:01:21 -0700 (PDT) Received: from de-out1.bosch-org.com (de-out1.bosch-org.com [139.15.230.186]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BBE40120433 for ; Tue, 16 Jul 2019 06:01:20 -0700 (PDT) Received: from si0vm1948.rbesz01.com (unknown [139.15.230.188]) by fe0vms0187.rbdmz01.com (Postfix) with ESMTPS id 45p0rt4Nhvz1XLDQt; Tue, 16 Jul 2019 15:01:18 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=bosch-si.com; s=key1-intmail; t=1563282078; bh=x8wo1lfoCC9Z1cs/uJkF3BikIHtuS4sF3yjH8X609cU=; l=10; h=From:Subject:From:Reply-To:Sender; b=LkGdVFKi01tCuvxVPdhrCt/Ke01EdTu8PEv82iUfE2l+loiJ/ubcKv6OyCAEB7JFq Xy6k/nDxsSmXUaQudAvlvobEn7M1rRuxSO6zCrRBuvZqbYRbefvAuEtflgqcLp98l6 NppIC/l0BKwrFI4ATto48B3nNhbg2ulpyT27KjZc= Received: from si0vm2082.rbesz01.com (unknown [10.58.172.176]) by si0vm1948.rbesz01.com (Postfix) with ESMTPS id 45p0rt44D1z487; Tue, 16 Jul 2019 15:01:18 +0200 (CEST) X-AuditID: 0a3aad16-4cbff70000005941-df-5d2dca9ed09a Received: from fe0vm1651.rbesz01.com ( [10.58.173.29]) (using TLS with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by si0vm2082.rbesz01.com (SMG Outbound) with SMTP id 05.A0.22849.E9ACD2D5; Tue, 16 Jul 2019 15:01:18 +0200 (CEST) Received: from SI-MBX2033.de.bosch.com (si-mbx2033.de.bosch.com [10.3.230.36]) by fe0vm1651.rbesz01.com (Postfix) with ESMTPS id 45p0rt2KG1znqj; Tue, 16 Jul 2019 15:01:18 +0200 (CEST) Received: from SI-MBX2033.de.bosch.com (10.3.230.36) by SI-MBX2033.de.bosch.com (10.3.230.36) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.1.1713.5; Tue, 16 Jul 2019 15:01:18 +0200 Received: from SI-MBX2033.de.bosch.com ([fe80::e8d2:d090:af15:3320]) by SI-MBX2033.de.bosch.com ([fe80::e8d2:d090:af15:3320%4]) with mapi id 15.01.1713.007; Tue, 16 Jul 2019 15:01:18 +0200 From: "Kraus Achim (INST/ECS4)" To: Joseph Salowey , "" Thread-Topic: [TLS] WGLC for draft-ietf-tls-dtls-connection-id-06 Thread-Index: AQHVOzGCGG9depotj0O986oGEurUyqbNMKgQ Date: Tue, 16 Jul 2019 13:01:17 +0000 Message-ID: References: In-Reply-To: Accept-Language: de-DE, en-US Content-Language: de-DE X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.22.83.209] Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-Brightmail-Tracker: H4sIAAAAAAAAA21Tb0wTdxjmdz3or9XT47D0pciAi3ZRBmLVhOg0btkWs5nBkn1xyGYZBy1C C71itMkydJhl7eKUISlV0AgsGwRb0UAVBqyCCN3AuTHATMLUESDKwrLpyhzbHVdsP+zLm+d9 3nue98/dYRnjxBpsNFk5i0lfxEYpSeX2loTUusHUnHT/dFxGW2u3POP3YTvaTexpaAgQe/qv eeRZxDvKF/O4IuMhzrJp1wGl4Wb7vLykQn2445yHLEfeWDtSYKC3wpePm0k7UmKGdhLwt+tq MOlAMH/q40gpeYRgcPRplJT0IKhx3ZCL+ih6O1Sev76E19CvwlDlLZmIY+jd8PWnnZES/xKM td0lJKyDwMgjUsQkvR7anrqXMEXvgH/vdSARM3QWnKpuXPJU0G/B6LH+JS2iE8DjGV7yl9Fq aJ16EintQENDp8QDrYKZ+4tBPgkGhkRPLDy/AdzXNknSZKhy/CKX2kbDQM0D8iSKdYW5ukIK V5jCFaY4j8gmpOKN6YeKdekZujRLLsfb0jenvW8ubkXSC4r1osbBfB8iMPKhbZhgVdQNb2oO syrXnHfEoOcN71nKijie1VBrb72+n4l5RvNlucVGnjeaTT4EWMauoXb+mZLDUHn6IzbOYpZk PhSPSVZNFeDM/QxdoLdyBzmuhLMsV3dgzAKlHRAaRlu4Au5wvrHIulxmEygUERHBxIZXwtsS WOFDW/BKoXeXaEHxJfpi3lgQlMdJcmaZDUkHUTY+OVN7QYa/6asT4lygXoiXaxuF2CtGhjSZ TZxGTemEr5ehRQdDmenZZJq11BwlLKsKK4TcZ9E4woiNoZA41ErhjwjNBFS8eMboIBkS6RoF Df0rBvd9B4KzV8oJ8F65REDDQAsJzuaRKAicOSaHuZ9qMTQ7RjAcvXBCAdMTwwpwP/avgIut LRRUtMyugm/r+qJhYmg6Bn78qlYFFc11Khh7eF0Fzuov1LDgt8dB753LGrj0V+9zMDY5kgjO toeJ0D11MwkWnaeTofv0k2S4V3WchQftn6+D789OrYeFM+Na6Prohw2zwsEJ4eCJr2wUD27V W//n4EE2tJ2mHO3LvvvybNm72sLfDoDO9sLBntLbOzt2TVSkec2TXe2ZCxH2n9/+Z8snx1/L spXOaVP86sL5wv74TCdaZ9PW1zpWJ3Yn3fns9lZuG7nX4+p5Q766qQbT+ZXK6tGmN1Oqrj7f +12p/4+Zo4vuc519J/Y5JgPaHlK29yKb/WHn+IquD+pZkjfoN2+UWXj9f4rTtVirBAAA Archived-At: Subject: Re: [TLS] WGLC for draft-ietf-tls-dtls-connection-id-06 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 Jul 2019 13:01:24 -0000 SGVsbG8gSm9lLA0KSGVsbG8gTGlzdCwNCg0Kd2l0aCB0aGUgaXNzdWVzIGh0dHBzOi8vZ2l0aHVi LmNvbS90bHN3Zy9kdGxzLWNvbm4taWQvaXNzdWVzLzY0IHJlcG9ydGVkIGJ5IFRob21hcyBGb3Nz YXRpLCANCmFuZCB0aGUgbWFpbCBmcm9tIEhhbm5lcyBUc2Nob2ZlbmlnICAoc2VlIGh0dHA6Ly9p ZXRmLjEwLm43Lm5hYmJsZS5jb20vZHJhZnQtdHNjaG9mZW5pZy10bHMtZHRscy1ycmMtMDAtRFRM Uy1SZXR1cm4tUm91dGFiaWxpdHktQ2hlY2stUlJDLXRkNTk5MTA4Lmh0bWwpLCANCknigJltIG5v dCBzdXJlLCB3aGF0IHRoZSBpbnRlbmRlZCBzY29wZSBvZiAiZHJhZnQtaWV0Zi10bHMtZHRscy1j b25uZWN0aW9uLWlkLTA2LnR4dCIgYWNjb3JkaW5nIHRoaXMgaXNzdWVzIHNob3VsZCBiZS4NCg0K SSB3b3VsZCBwcmVmZXIgdG8gaGF2ZSB0aGUgYmFzaWMgYWR2aWNlLCB0byBhcHBseSBzb21lIGtp bmQgb2YgZmlsdGVyIGFnYWluc3QgbW9kaWZpZWQgcmVwbGF5IGF0dGFja3MgKGVpdGhlciB0aGUg DQpEVExTIDEuMiBBbnRpLVJlcGxheSBwcm90ZWN0aW9uLCBodHRwczovL3Rvb2xzLmlldGYub3Jn L2h0bWwvcmZjNjM0NyNzZWN0aW9uLTQuMS4yLjYsIG9yIG90aGVyIG1lYW5zLCBzZWUNCnByb3Bv c2FsIGh0dHBzOi8vZ2l0aHViLmNvbS90bHN3Zy9kdGxzLWNvbm4taWQvaXNzdWVzLzY5ICkgaW4g dGhlICJkcmFmdC1pZXRmLXRscy1kdGxzLWNvbm5lY3Rpb24taWQiLCANCmluc3RlYWQgb2YgaW5j bHVkaW5nIHRoYXQgdG8gYW4gYWRkaXRpb25hbCBSRkMgdG9nZXRoZXIgd2l0aCB0aGUgbW9yZSBj b21wbGV4ICJvbi1wYXRoIGFkdmVyc2FyeSIgc2NlbmFyaW8uDQoNCiJBbiBvbi1wYXRoIGFkdmVy c2FyeSBjYW4gYWxzbyBibGFjay1ob2xlIHRyYWZmaWMgb3IgY3JlYXRlIGEgcmVmbGVjdGlvbiBh dHRhY2sgYWdhaW5zdCB0aGlyZCBwYXJ0aWVzIGJlY2F1c2UgYSBEVExTIHBlZXIgaGFzIG5vCQ0K IG1lYW5zIHRvIGRpc3Rpbmd1aXNoIGEgZ2VudWluZSBhZGRyZXNzIHVwZGF0ZSBldmVudCAoZm9y IGV4YW1wbGUsIGR1ZQl0byBhIE5BVCByZWJpbmRpbmcpIGZyb20gb25lIHRoYXQgaXMgbWFsaWNp b3VzLiAgDQpUaGlzIGF0dGFjayBpcyBvZgljb25jZXJuIHdoZW4gdGhlcmUgaXMgYSBsYXJnZSBh c3ltbWV0cnkgb2YgcmVxdWVzdC9yZXNwb25zZSBtZXNzYWdlCXNpemVzLiINCg0KSSB3b3VsZCBw cmVmZXIgZWl0aGVyIHRvIHJlbW92ZSB0aGUgImJsYWNrLWhvbGUgdHJhZmZpYyIsIGJlY2F1c2Ug dGhhdCBpcyBub3QgcmVsYXRlZCB0byBEVExTIDEuMiBDSUQsIG9yIGV4dGVuZCBpdCBpbnRvIGEg DQptb3JlIGdlbmVyYWwgc3RhdGVtZW50LCB3aGljaCBjbGFyaWZpZXMsIHRoYXQgaXQncyBub3Qg cmVsYXRlZCB0byBDSUQuDQoNCk1pdCBmcmV1bmRsaWNoZW4gR3LDvMOfZW4gLyBCZXN0IHJlZ2Fy ZHMgDQoNCkFjaGltIEtyYXVzDQoNCkVuZ2luZWVyaW5nIENsb3VkIFNlcnZpY2VzIDQgQm9zY2gg SW9UIEh1YiAoSU5TVC9FQ1M0KSANCg0KDQpWb246IFRMUyA8dGxzLWJvdW5jZXNAaWV0Zi5vcmc+ IEltIEF1ZnRyYWcgdm9uIEpvc2VwaCBTYWxvd2V5DQpHZXNlbmRldDogTW9udGFnLCAxNS4gSnVs aSAyMDE5IDE5OjE5DQpBbjogPHRsc0BpZXRmLm9yZz4gPHRsc0BpZXRmLm9yZz4NCkJldHJlZmY6 IFtUTFNdIFdHTEMgZm9yIGRyYWZ0LWlldGYtdGxzLWR0bHMtY29ubmVjdGlvbi1pZC0wNg0KDQpU aGlzIHRoZSB3b3JraW5nIGdyb3VwIGxhc3QgY2FsbCBmb3LCoGRyYWZ0LWlldGYtdGxzLWR0bHMt Y29ubmVjdGlvbi1pZC0wNi7CoCBUaGUgZGlmZiBiZXR3ZWVuIHRoZSB2ZXJzaW9uIHRoYXQgd2Fz IGxhc3QgY2FsbGVkICgtMDMpIGFuZCB0aGUgY3VycmVudCB2ZXJzaW9uIGNhbiBiZSBmb3VuZCBo ZXJlOsKgaHR0cHM6Ly90b29scy5pZXRmLm9yZy9yZmNkaWZmP3VybDI9ZHJhZnQtaWV0Zi10bHMt ZHRscy1jb25uZWN0aW9uLWlkLTA2LnR4dCZ1cmwxPWRyYWZ0LWlldGYtdGxzLWR0bHMtY29ubmVj dGlvbi1pZC0wMw0KDQpQbGVhc2UgZm9jdXMgeW91ciByZXZpZXcgb24gdGhlIGNoYW5nZXMgc2lu Y2UgdGhlIHByZXZpb3VzIGxhc3QgY2FsbCBhbmQgc2VuZCBjb21tZW50cyB0byB0aGUgbGlzdCBi eSBKdWx5IDIyLCAyMDE5LsKgwqANCg0KVGhhbmtzLA0KDQpDLFMgJiBKDQo= From nobody Tue Jul 16 12:59:54 2019 Return-Path: X-Original-To: tls@ietf.org Delivered-To: tls@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id A202312012B; Tue, 16 Jul 2019 12:59:32 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Yaron Sheffer via Datatracker To: Cc: draft-ietf-tls-exported-authenticator.all@ietf.org, ietf@ietf.org, tls@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.98.4 Auto-Submitted: auto-generated Precedence: bulk Reply-To: Yaron Sheffer Message-ID: <156330717256.15259.2193942101748847069@ietfa.amsl.com> Date: Tue, 16 Jul 2019 12:59:32 -0700 Archived-At: Subject: [TLS] Secdir last call review of draft-ietf-tls-exported-authenticator-09 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 Jul 2019 19:59:33 -0000 Reviewer: Yaron Sheffer Review result: Has Issues The document is generally clear in both its motivation and the proposed solution. I think it's playing a bit too liberal with TLS 1.3, in sort-of but not quite deprecating renegotiation, and in changing the IANA registry in a way that actually changes the protocol. Details below. Other comments: * Abstract: please reword to make it clear that it's the proof (not the cert) that is portable. * Introduction: TLS 1.3 post-handshake auth "has the disadvantage of requiring additional state to be stored as part of the TLS state machine." Why is that an issue is practice, assuming this feature is already supported by TLS libraries? Also, are we in effect deprecating this TLS 1.3 feature because of the security issue of the mismatched record boundaries? * "For simplicity, the mechanisms... require", maybe a normative REQUIRE? * Authenticator Request: please clarify that we use the TLS 1.3 format even when running on TLS 1.2. * Also, I suggest to change "is not encrypted with a handshake key" which is too specific to "is sent unencrypted within the normal TLS-protected data". * Before diving into the detailed messages in Sec. 3, it would be nice to include a quick overview of the message sequence. * Sec. 3: "SHOULD use TLS", change to MUST. There's no way it can work otherwise anyway. * "This message reuses the structure to the CertificateRequest message" - repeats the preceding paragraph. * Sec. 4: again, SHOULD use TLS -> MUST. * Is there a requirement for all protocol messages to be sent over a single TLS connection? If so, please mention it. Certainly this is true for the Authenticator message that must be sent over a single connection and cannot be multiplexed by the high-level protocol. I think this protocol actually assumes "nice" transport properties (no message reorder, reliability) that also require a single, clean TLS connection. * Why no authenticator request for servers? Don't we care about replay? OTOH if the client wants to detect replays, it would need to keep state on received authenticators, which would be very messy. * 4.1: when referencing Exporters, mention this is Sec. 7.5 of [TLS1.3]. * The discussion of Extended Master Secret only applies to TLS 1.2 - please clarify that, plus I suggest to reword this paragraph which I find hard to parse. * 4.2: "the extensions are chosen from the TLS handshake." - What does it mean exactly, and how does an application even know which extensions were used at the TLS layer? Reading further, we mention "ClientHello extensions." Maybe the authenticator should also include a ClientHello message to indicate supported extensions. Assuming we can peek into ClientHello contradicts the hopeful "even if it is possible to implement it at the application layer" in Sec. 6. * 4.2.1: the first sentence of the section is incomplete. * Can I use TLS 1.3-specific extensions (oid_filters) if I'm running on a TLS 1.2 connection? Is there a situation where a certificate is acceptable for TLS 1.3 connections but not for TLS 1.2 connections? * "using a value derived from the connection secrets" - I think we should recommend a specific construction here to ensure people do it securely. * 4.2.3: Are we computing HMAC(MAC-key, Hash(a || b || c || d))? If so, please say so. * 4.2.4: "a constant-time comparison" - why is it actually required, what is the threat? An attacker can do very little because each authenticator being sent is different. * 5: please say explicitly which messages are used in this case to construct the authenticator. * 6.1: the "MUST" is strange in a section that's only supposed to be informative. Also, the library may provide this extension (and possibly others) without requiring it as input. * 6.4: "The API MUST return a failure if the certificate_request_context of the authenticator was used in a previously validated authenticator." Are we requiring the library to keep previous contexts for replay protection? If so, please make it explicit. * 7.1: this is changing TLS 1.3 by allowing this extension in Cert Request! I think it's a really bad idea. Better to hack special support to existing libraries, allowing this specific extension for this special case, than to change the base protocol. Otherwise, this document should UPDATE 8446. * 8: I think the Security Considerations is the right place to talk about interaction between this protocol and TLS 1.3 (or 1.2) renegotiation. Even if we simply RECOMMEND not to do it. Or else explain the use cases where renegotiation is still useful if there are any. From nobody Tue Jul 16 16:25:23 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E722D12002F for ; Tue, 16 Jul 2019 16:25:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cloudflare.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 11MmCMYlSnJ8 for ; Tue, 16 Jul 2019 16:25:04 -0700 (PDT) Received: from mail-ua1-x933.google.com (mail-ua1-x933.google.com [IPv6:2607:f8b0:4864:20::933]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1611912002E for ; Tue, 16 Jul 2019 16:25:02 -0700 (PDT) Received: by mail-ua1-x933.google.com with SMTP id o2so8906052uae.10 for ; Tue, 16 Jul 2019 16:25:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cloudflare.com; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=IJ5quSlIh0Uk0v35w2gsZ7a+TH3iS05tbcSi7VJNxvA=; b=ZyjY2tV9gINWH7fJbo0agWBN7ep5MSu2nw1piO5TE7SO/f0u6IVRAQ2nhANnqYiVQZ b9otd9hZz2jmf6n8kP+zq8nsZb7Y0E1XAt853NwU3VGHXCRHE1zPRw2jy2+s+JXQjv4r yhh0ttY4uHzvbLcfU8TzcTaWQcW2TvxRCKr2I= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=IJ5quSlIh0Uk0v35w2gsZ7a+TH3iS05tbcSi7VJNxvA=; b=k8nuQyzkUoZrgiBxaantZeo31SYXbHWLRNsa9G8OHruJvojelnlnxQwlkp+sU/kPSv esbRy+dzwONCEBXWOdJ9XbkpI09cbhm/sOz5UPpAvh4mLEwZW5RxS+Tka/E8uvGmCZ1q kWtAFC3gCJpWE9/r5GUaYZyqscPnLJQqkNxCH0IlJs0ZRwL580UnrC0WS2HT/Q8kYysf 9iW8d//RUDFbV8ma4ocOksSWQffFyUqUg8JS8A1MPqTi0wKUXrJEXsjyHYBxgygCSv7j 1opPn8R+8tgwsjUe+xSg2llpvZANi+SDoawSEAbp8TYHRFsQVUZuCGWoSpACsi2ejgRX 4emQ== X-Gm-Message-State: APjAAAUF7HhH5WVRRbfqI0/BAOVG3JYSUEMBk9aUrClyFn5uGUWe2con bnGxJfsqJrWFNKAoU/DkuU8eO8C94SuWqMcsLYSd0Q== X-Google-Smtp-Source: APXvYqydOPyUSnSAK5dq/vyORDgrMNbeiRyOli6DC+trreoDds0FAv3NhoKxDcip9n0qDJNBPcWuMt52H6DtCejutNo= X-Received: by 2002:ab0:64c4:: with SMTP id j4mr21992256uaq.97.1563319500284; Tue, 16 Jul 2019 16:25:00 -0700 (PDT) MIME-Version: 1.0 References: <156330717256.15259.2193942101748847069@ietfa.amsl.com> In-Reply-To: <156330717256.15259.2193942101748847069@ietfa.amsl.com> From: Nick Sullivan Date: Tue, 16 Jul 2019 16:24:44 -0700 Message-ID: To: Yaron Sheffer Cc: secdir@ietf.org, draft-ietf-tls-exported-authenticator.all@ietf.org, ietf@ietf.org, "" Content-Type: multipart/alternative; boundary="0000000000007c5e01058dd4af42" Archived-At: Subject: Re: [TLS] Secdir last call review of draft-ietf-tls-exported-authenticator-09 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 Jul 2019 23:25:07 -0000 --0000000000007c5e01058dd4af42 Content-Type: text/plain; charset="UTF-8" Yaron, Thank you for this review. I'm going to internalize it, come up with potential ways forward and get back to you soon. Best, Nick On Tue, Jul 16, 2019 at 12:59 PM Yaron Sheffer via Datatracker < noreply@ietf.org> wrote: > Reviewer: Yaron Sheffer > Review result: Has Issues > > The document is generally clear in both its motivation and the proposed > solution. > > I think it's playing a bit too liberal with TLS 1.3, in sort-of but not > quite > deprecating renegotiation, and in changing the IANA registry in a way that > actually changes the protocol. Details below. > > Other comments: > > * Abstract: please reword to make it clear that it's the proof (not the > cert) > that is portable. * Introduction: TLS 1.3 post-handshake auth "has the > disadvantage of requiring additional state to be stored as part of the TLS > state machine." Why is that an issue is practice, assuming this feature is > already supported by TLS libraries? Also, are we in effect deprecating > this TLS > 1.3 feature because of the security issue of the mismatched record > boundaries? > * "For simplicity, the mechanisms... require", maybe a normative REQUIRE? * > Authenticator Request: please clarify that we use the TLS 1.3 format even > when > running on TLS 1.2. * Also, I suggest to change "is not encrypted with a > handshake key" which is too specific to "is sent unencrypted within the > normal > TLS-protected data". * Before diving into the detailed messages in Sec. 3, > it > would be nice to include a quick overview of the message sequence. * Sec. > 3: > "SHOULD use TLS", change to MUST. There's no way it can work otherwise > anyway. > * "This message reuses the structure to the CertificateRequest message" - > repeats the preceding paragraph. * Sec. 4: again, SHOULD use TLS -> MUST. > * Is > there a requirement for all protocol messages to be sent over a single TLS > connection? If so, please mention it. Certainly this is true for the > Authenticator message that must be sent over a single connection and > cannot be > multiplexed by the high-level protocol. I think this protocol actually > assumes > "nice" transport properties (no message reorder, reliability) that also > require > a single, clean TLS connection. * Why no authenticator request for servers? > Don't we care about replay? OTOH if the client wants to detect replays, it > would need to keep state on received authenticators, which would be very > messy. > * 4.1: when referencing Exporters, mention this is Sec. 7.5 of [TLS1.3]. * > The > discussion of Extended Master Secret only applies to TLS 1.2 - please > clarify > that, plus I suggest to reword this paragraph which I find hard to parse. * > 4.2: "the extensions are chosen from the TLS handshake." - What does it > mean > exactly, and how does an application even know which extensions were used > at > the TLS layer? Reading further, we mention "ClientHello extensions." Maybe > the > authenticator should also include a ClientHello message to indicate > supported > extensions. Assuming we can peek into ClientHello contradicts the hopeful > "even > if it is possible to implement it at the application layer" in Sec. 6. * > 4.2.1: > the first sentence of the section is incomplete. * Can I use TLS > 1.3-specific > extensions (oid_filters) if I'm running on a TLS 1.2 connection? Is there a > situation where a certificate is acceptable for TLS 1.3 connections but > not for > TLS 1.2 connections? * "using a value derived from the connection secrets" > - I > think we should recommend a specific construction here to ensure people do > it > securely. * 4.2.3: Are we computing HMAC(MAC-key, Hash(a || b || c || d))? > If > so, please say so. * 4.2.4: "a constant-time comparison" - why is it > actually > required, what is the threat? An attacker can do very little because each > authenticator being sent is different. * 5: please say explicitly which > messages are used in this case to construct the authenticator. * 6.1: the > "MUST" is strange in a section that's only supposed to be informative. > Also, > the library may provide this extension (and possibly others) without > requiring > it as input. * 6.4: "The API MUST return a failure if the > certificate_request_context of the authenticator was used in a previously > validated authenticator." Are we requiring the library to keep previous > contexts for replay protection? If so, please make it explicit. * 7.1: > this is > changing TLS 1.3 by allowing this extension in Cert Request! I think it's a > really bad idea. Better to hack special support to existing libraries, > allowing > this specific extension for this special case, than to change the base > protocol. Otherwise, this document should UPDATE 8446. * 8: I think the > Security Considerations is the right place to talk about interaction > between > this protocol and TLS 1.3 (or 1.2) renegotiation. Even if we simply > RECOMMEND > not to do it. Or else explain the use cases where renegotiation is still > useful > if there are any. > > --0000000000007c5e01058dd4af42 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Yaron,

Thank you for this review. I'= ;m going to internalize it, come up with potential ways forward and get bac= k to you soon.

Best,
Nick
On Tue, J= ul 16, 2019 at 12:59 PM Yaron Sheffer via Datatracker <noreply@ietf.org> wrote:
Reviewer: Yaron Sheffe= r
Review result: Has Issues

The document is generally clear in both its motivation and the proposed
solution.

I think it's playing a bit too liberal with TLS 1.3, in sort-of but not= quite
deprecating renegotiation, and in changing the IANA registry in a way that<= br> actually changes the protocol. Details below.

Other comments:

* Abstract: please reword to make it clear that it's the proof (not the= cert)
that is portable. * Introduction: TLS 1.3 post-handshake auth "has the=
disadvantage of requiring additional state to be stored as part of the TLS<= br> state machine." Why is that an issue is practice, assuming this featur= e is
already supported by TLS libraries? Also, are we in effect deprecating this= TLS
1.3 feature because of the security issue of the mismatched record boundari= es?
* "For simplicity, the mechanisms... require", maybe a normative = REQUIRE? *
Authenticator Request: please clarify that we use the TLS 1.3 format even w= hen
running on TLS 1.2. * Also, I suggest to change "is not encrypted with= a
handshake key" which is too specific to "is sent unencrypted with= in the normal
TLS-protected data". * Before diving into the detailed messages in Sec= . 3, it
would be nice to include a quick overview of the message sequence. * Sec. 3= :
"SHOULD use TLS", change to MUST. There's no way it can work = otherwise anyway.
* "This message reuses the structure to the CertificateRequest message= " -
repeats the preceding paragraph. * Sec. 4: again, SHOULD use TLS -> MUST= . * Is
there a requirement for all protocol messages to be sent over a single TLS<= br> connection? If so, please mention it. Certainly this is true for the
Authenticator message that must be sent over a single connection and cannot= be
multiplexed by the high-level protocol. I think this protocol actually assu= mes
"nice" transport properties (no message reorder, reliability) tha= t also require
a single, clean TLS connection. * Why no authenticator request for servers?=
Don't we care about replay? OTOH if the client wants to detect replays,= it
would need to keep state on received authenticators, which would be very me= ssy.
* 4.1: when referencing Exporters, mention this is Sec. 7.5 of [TLS1.3]. * = The
discussion of Extended Master Secret only applies to TLS 1.2 - please clari= fy
that, plus I suggest to reword this paragraph which I find hard to parse. *=
4.2: "the extensions are chosen from the TLS handshake." - What d= oes it mean
exactly, and how does an application even know which extensions were used a= t
the TLS layer? Reading further, we mention "ClientHello extensions.&qu= ot; Maybe the
authenticator should also include a ClientHello message to indicate support= ed
extensions. Assuming we can peek into ClientHello contradicts the hopeful &= quot;even
if it is possible to implement it at the application layer" in Sec. 6.= * 4.2.1:
the first sentence of the section is incomplete. * Can I use TLS 1.3-specif= ic
extensions (oid_filters) if I'm running on a TLS 1.2 connection? Is the= re a
situation where a certificate is acceptable for TLS 1.3 connections but not= for
TLS 1.2 connections? * "using a value derived from the connection secr= ets" - I
think we should recommend a specific construction here to ensure people do = it
securely. * 4.2.3: Are we computing HMAC(MAC-key, Hash(a || b || c || d))? = If
so, please say so. * 4.2.4: "a constant-time comparison" - why is= it actually
required, what is the threat? An attacker can do very little because each authenticator being sent is different. * 5: please say explicitly which
messages are used in this case to construct the authenticator. * 6.1: the "MUST" is strange in a section that's only supposed to be inf= ormative. Also,
the library may provide this extension (and possibly others) without requir= ing
it as input. * 6.4: "The API MUST return a failure if the
certificate_request_context of the authenticator was used in a previously validated authenticator." Are we requiring the library to keep previou= s
contexts for replay protection? If so, please make it explicit. *=C2=A0 7.1= : this is
changing TLS 1.3 by allowing this extension in Cert Request! I think it'= ;s a
really bad idea. Better to hack special support to existing libraries, allo= wing
this specific extension for this special case, than to change the base
protocol. Otherwise, this document should UPDATE 8446. * 8: I think the
Security Considerations is the right place to talk about interaction betwee= n
this protocol and TLS 1.3 (or 1.2) renegotiation. Even if we simply RECOMME= ND
not to do it. Or else explain the use cases where renegotiation is still us= eful
if there are any.

--0000000000007c5e01058dd4af42-- From nobody Wed Jul 17 08:33:23 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 50BE2120758 for ; Wed, 17 Jul 2019 08:33:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=lowentropy.net header.b=eepVbRL7; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=nLYhP6NQ Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dxoCORqyA_Dv for ; Wed, 17 Jul 2019 08:33:19 -0700 (PDT) Received: from new3-smtp.messagingengine.com (new3-smtp.messagingengine.com [66.111.4.229]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 344C612008B for ; Wed, 17 Jul 2019 08:33:19 -0700 (PDT) Received: from compute1.internal (compute1.nyi.internal [10.202.2.41]) by mailnew.nyi.internal (Postfix) with ESMTP id 3C1D5231F for ; Wed, 17 Jul 2019 11:33:10 -0400 (EDT) Received: from imap2 ([10.202.2.52]) by compute1.internal (MEProxy); Wed, 17 Jul 2019 11:33:10 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lowentropy.net; h=mime-version:message-id:in-reply-to:references:date:from:to :subject:content-type; s=fm2; bh=AGMEy8KBqSZoV3+cPqA8sIJPU3QIuwV Ohi2uJarFBxU=; b=eepVbRL7VZeq8/PkbFnIAC15pzkeqBcYKUTqVxz2Tgfw9jb wAYHmHr24Rbtpuw1Z6X4E1reOupex9KKEcPcdmUJZXf/dWxtl2pmDPLJxugBv/Aa IceeoSYms0MSouhlgqB5xrN17YOL+J9hTWbXkBPpzovzNH26te6dAbB1tkuER9ja /w1fqrZ+wnWHctLSk2b37/XPnidhmrJ0DT6AFokjfMKmtWghVsepSiq1zBrXaNRU v/SUOqngpFSnUgcoC0RbF9FRKH7F6YvSL268GWlyz8oVXDIhzIwdKDfQnpasgSiq TA8QZWPrhL6lLN6PyIl18RF1aymmGwR1e+a7yqQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-proxy :x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm3; bh=AGMEy8 KBqSZoV3+cPqA8sIJPU3QIuwVOhi2uJarFBxU=; b=nLYhP6NQG2sjzD8uBXBEQr cSert6XKeedYkRpmtYriQNazPokezVeZp58XxR6V7RJzelPoqL0nCKrsA4HlTzEO m9YbfrNnv0ZFmF/cN80u57uwxlwEFBliY3q2/L8cZGVyr8P+QMRvwt1WI5k7Obv0 oDVRzKBz9U2SBk6AvHphH1xZJuET0sQkF+rTq8Ak97KITF/GkcrittYD9/lsD1+j c+lykHS6TETuoOEzN69cnP/ooKCWuqFwR0YZmNvapZxLzdb6HThKQRGdINDdU/Q8 ov24enntFG2JmDk54LQ8lFer6cVxJjb7PeZX3baEMR67vw93JyB2i4wFjmAa/Lqw == X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeduvddrieefgdeiiecutefuodetggdotefrodftvf curfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfghnecu uegrihhlohhuthemuceftddtnecunecujfgurhepofgfggfkjghffffhvffutgesthdtre dtreertdenucfhrhhomhepfdforghrthhinhcuvfhhohhmshhonhdfuceomhhtsehlohif vghnthhrohhphidrnhgvtheqnecuffhomhgrihhnpehivghtfhdrohhrghenucfrrghrrg hmpehmrghilhhfrhhomhepmhhtsehlohifvghnthhrohhphidrnhgvthenucevlhhushht vghrufhiiigvpedt X-ME-Proxy: Received: by mailuser.nyi.internal (Postfix, from userid 501) id 74115E0432; Wed, 17 Jul 2019 11:33:09 -0400 (EDT) X-Mailer: MessagingEngine.com Webmail Interface User-Agent: Cyrus-JMAP/3.1.6-731-g19d3b16-fmstable-20190627v1 Mime-Version: 1.0 Message-Id: In-Reply-To: References: Date: Wed, 17 Jul 2019 11:33:20 -0400 From: "Martin Thomson" To: tls@ietf.org Content-Type: text/plain Archived-At: Subject: Re: [TLS] WGLC for draft-ietf-tls-dtls-connection-id-06 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 17 Jul 2019 15:33:21 -0000 These changes look fine. Mostly. I'm really concerned about shipping a protocol that enables the sorts of attacks that connection IDs enable. I think that we should discuss that issue when we meet. I know that Hannes' new draft is an attempt to tackle this issue, but that's a long way from being done. If we ship a spec with this hole, it will only be usable in certain narrow contexts, like with ICE, where this really isn't a concern anyway. This is something we are grappling with in QUIC too. A good design that handles migration to new network paths is non-trivial. Adding a connection ID is just the smallest and easiest part. But it leaves the protocol in the worst possible state. Functionally, you can move to a new path. And everything works fine, unless you have an attacker. But without any further defense, you are completely exposed to that attacker, both to the connection being denied service and to being used for amplification attacks. Nit: Search for "use the with" in the newly added text. On Mon, Jul 15, 2019, at 13:19, Joseph Salowey wrote: > This the working group last call for > draft-ietf-tls-dtls-connection-id-06. The diff between the version that > was last called (-03) and the current version can be found here: > https://tools.ietf.org/rfcdiff?url2=draft-ietf-tls-dtls-connection-id-06.txt&url1=draft-ietf-tls-dtls-connection-id-03 > > Please focus your review on the changes since the previous last call > and send comments to the list by July 22, 2019. > > Thanks, > > C,S & J > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > From nobody Wed Jul 17 09:42:14 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 10978120405 for ; Wed, 17 Jul 2019 09:42:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com header.b=1wmBpa9a; dkim=fail (1024-bit key) reason="fail (body has been altered)" header.d=armh.onmicrosoft.com header.b=iqOqhR3e Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tBSXB0ILeuK2 for ; Wed, 17 Jul 2019 09:42:09 -0700 (PDT) Received: from EUR04-DB3-obe.outbound.protection.outlook.com (mail-eopbgr60065.outbound.protection.outlook.com [40.107.6.65]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AF0941203BD for ; Wed, 17 Jul 2019 09:42:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=/gJCU2vo4Ow62gGWXGSxeD3HOgsyfUHkCbfIlgbJa6A=; b=1wmBpa9axeGqsrHiqUk1vfiDRhCXGsJtUYFllzJY1oGD0mIi23wVA7pWmBdZMKusIznj/sXMFhUisVTHSGyyNov6kYjtsWv9+wpb3cJxdDWx+eo2M3T46fxp3BmqxN+eR1qDMW7QATyyu3hh3EAVrG9FdmBgAsbG0JgibQNY3IQ= Received: from HE1PR0802CA0021.eurprd08.prod.outlook.com (2603:10a6:3:bd::31) by HE1PR0801MB1849.eurprd08.prod.outlook.com (2603:10a6:3:89::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2094.11; Wed, 17 Jul 2019 16:42:05 +0000 Received: from VE1EUR03FT015.eop-EUR03.prod.protection.outlook.com (2a01:111:f400:7e09::206) by HE1PR0802CA0021.outlook.office365.com (2603:10a6:3:bd::31) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.2073.14 via Frontend Transport; Wed, 17 Jul 2019 16:42:04 +0000 Authentication-Results: spf=temperror (sender IP is 63.35.35.123) smtp.mailfrom=arm.com; ietf.org; dkim=pass (signature was verified) header.d=armh.onmicrosoft.com;ietf.org; dmarc=temperror action=none header.from=arm.com; Received-SPF: TempError (protection.outlook.com: error in processing during lookup of arm.com: DNS Timeout) Received: from 64aa7808-outbound-1.mta.getcheckrecipient.com (63.35.35.123) by VE1EUR03FT015.mail.protection.outlook.com (10.152.18.176) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.2052.18 via Frontend Transport; Wed, 17 Jul 2019 16:42:02 +0000 Received: ("Tessian outbound c2673421c4c6:v24"); Wed, 17 Jul 2019 16:41:59 +0000 X-CheckRecipientChecked: true X-CR-MTA-CID: be49bf7e29a1deb8 X-CR-MTA-TID: 64aa7808 Received: from 419eced53aad.2 (cr-mta-lb-1.cr-mta-net [104.47.0.57]) by 64aa7808-outbound-1.mta.getcheckrecipient.com id 33324744-6B69-4676-B79F-A75F9DDE9709.1; Wed, 17 Jul 2019 16:41:54 +0000 Received: from EUR01-HE1-obe.outbound.protection.outlook.com (mail-he1eur01lp2057.outbound.protection.outlook.com [104.47.0.57]) by 64aa7808-outbound-1.mta.getcheckrecipient.com with ESMTPS id 419eced53aad.2 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384); Wed, 17 Jul 2019 16:41:54 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=GJmA0HCiM6xdjP2XWzWMXy6t4o34nKJkoOwXuUuDY1gNtPIfQkYwFrrtkQYTmKzjOH/ySsLkN1dBbhc0ZvNbU6XG+NnpLXmhI9gSJnBInrDi2bPCcV+BDC2fYjSNOwmsQjDlk4B1Ux13/uUZMVm2036t6uCzQC1XwK1nDuWKVfofLwsuzJMznHV4Q1qcNXxheJ8icesLE+/ttVr8Hn1rUfpKUp5sAUkY+eEwwr0U5+F1vGa+BEkIzzWW5HKRiH6NKZrT973gJ+98Nfsqs/no71QY/tsZ12+1o2XLwWQ6Zp8//a/+T+vvJXR3OhBvEqgiFNIzFRXMueEvfmFtlcwJUQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Uh68F2U4lWuYyyOLZT8FiSHG3EQkWyYRpwc2PRdOk+c=; b=C9oDMFnXQQb97b8coTLyak+9SzoGGHXR30n0u9v9xsFjrAQVlk8NHPp3UDRNzPG2059HhIfurICcIkalQ8z5muhJGJuaEPVp0Q9bHfg7on2A59b1TrujiDUU7GDqiNRCgpz+5Gde7NnmxLDnWmvAYTHK+uakw3GM4b7ZPbrmx/HccdNfFqdpvgGS5UhqxiK+oky+Ev8M4hWp69be2NwkCmsvQR32QLmDF9Br1Z+Cf7Ds7fV80r6fghzUNVaOV7/fDw1rEIYmUGAM1dQ52+/MNuyO8QtTIYE8ct5njUEV5d+eRC9lhkG143R/+v2ltEMEp2rE4X85pz7dpeNefuCBKg== ARC-Authentication-Results: i=1; mx.microsoft.com 1;spf=pass smtp.mailfrom=arm.com;dmarc=pass action=none header.from=arm.com;dkim=pass header.d=arm.com;arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Uh68F2U4lWuYyyOLZT8FiSHG3EQkWyYRpwc2PRdOk+c=; b=iqOqhR3ePF5CyQ+SfghdDbDK67oKiHHW3q9tEprb49XyeX1QXcE57XQkAOxHfO4WJC3alI6HdmCemg7PVz+4Y+GWU5/UEmsC3mwup58RLmUZDw+guy2ztg3/gU//J5y36YKa2lBCBbrF/Kg2L24myJxnq6RgFJCywLpp9kVP/9c= Received: from AM6PR08MB4231.eurprd08.prod.outlook.com (20.179.4.202) by AM6PR08MB3094.eurprd08.prod.outlook.com (52.135.165.22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2073.14; Wed, 17 Jul 2019 16:41:52 +0000 Received: from AM6PR08MB4231.eurprd08.prod.outlook.com ([fe80::a0cb:7d43:97aa:b4fa]) by AM6PR08MB4231.eurprd08.prod.outlook.com ([fe80::a0cb:7d43:97aa:b4fa%7]) with mapi id 15.20.2073.015; Wed, 17 Jul 2019 16:41:52 +0000 From: Thomas Fossati To: Martin Thomson , "tls@ietf.org" Thread-Topic: [TLS] WGLC for draft-ietf-tls-dtls-connection-id-06 Thread-Index: AQHVOzGDQTLI3l+ruUWjXKcgx5CgF6bO84kAgAAj6QA= Date: Wed, 17 Jul 2019 16:41:52 +0000 Message-ID: <28361FA1-92AA-4FEB-9372-E6BDE794A067@arm.com> References: In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: Authentication-Results-Original: spf=none (sender IP is ) smtp.mailfrom=Thomas.Fossati@arm.com; x-originating-ip: [217.140.106.54] x-ms-publictraffictype: Email X-MS-Office365-Filtering-Correlation-Id: 69fa7e1a-494a-444f-a10a-08d70ad5b1fa X-MS-Office365-Filtering-HT: Tenant X-Microsoft-Antispam-Untrusted: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(4618075)(2017052603328)(7193020); SRVR:AM6PR08MB3094; X-MS-TrafficTypeDiagnostic: AM6PR08MB3094:|HE1PR0801MB1849: X-MS-Exchange-PUrlCount: 2 X-Microsoft-Antispam-PRVS: x-checkrecipientrouted: true x-ms-oob-tlc-oobclassifiers: OLM:10000;OLM:10000; x-forefront-prvs: 01018CB5B3 X-Forefront-Antispam-Report-Untrusted: SFV:NSPM; SFS:(10009020)(4636009)(136003)(366004)(396003)(39860400002)(376002)(346002)(189003)(199004)(51444003)(81156014)(81166006)(66946007)(68736007)(8936002)(66066001)(66446008)(66556008)(11346002)(91956017)(5660300002)(446003)(66476007)(476003)(76116006)(2616005)(478600001)(64756008)(53936002)(53546011)(186003)(26005)(6506007)(102836004)(6246003)(76176011)(305945005)(33656002)(229853002)(6436002)(6512007)(966005)(14454004)(7736002)(6486002)(6306002)(36756003)(316002)(110136005)(6116002)(71200400001)(99286004)(71190400001)(3846002)(14444005)(256004)(4326008)(25786009)(2501003)(486006)(2906002)(86362001)(8676002); DIR:OUT; SFP:1101; SCL:1; SRVR:AM6PR08MB3094; H:AM6PR08MB4231.eurprd08.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: arm.com does not designate permitted sender hosts) X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam-Message-Info-Original: EbHwdJh9UGXfSVwCwnL3bMR8e3r/l/BVvLUKhRaNFcxGuGb8oAL0nip9OjsBnkTCkUwX8ROtI+iwDKfBaKO6xPzZ/9BifqVS1SxzXEHPbiC63h2h+RnZ6zrecDlhFY1t0mxqh3cOCSdhITO2U1J9A7nTCuvKc9dw4K2hOOi4okJ3Sl5ysSH73PjrsQOvL2y4kZTnPMt4vkpLMjbCRbw7IEj3vNqmbuAe/2Ei1I5tdgas5Qc7K9aYDWnvtLHrfT/Q4IHOzVo4OcjZaCQVLx7JQBIOFp/XyHpM289xe3sFEOHO3fgvVWbz1J9VXBuQsvovmPRXhjkn6qVjBwKwqCZb25wfAug6vnbTOXK+YZ91PHhPf+B3Xh8WbBMWHfEUdw4a57umsbb2WBKXILSqfeG/HJy4KlCss/aT6RSL9eVdiRw= Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM6PR08MB3094 Original-Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=Thomas.Fossati@arm.com; X-EOPAttributedMessage: 0 X-MS-Exchange-Transport-CrossTenantHeadersStripped: VE1EUR03FT015.eop-EUR03.prod.protection.outlook.com X-Forefront-Antispam-Report: CIP:63.35.35.123; IPV:CAL; SCL:-1; CTRY:IE; EFV:NLI; SFV:NSPM; SFS:(10009020)(4636009)(396003)(136003)(346002)(376002)(39860400002)(2980300002)(51444003)(40434004)(189003)(199004)(81156014)(99286004)(6116002)(8936002)(3846002)(81166006)(14444005)(5024004)(2906002)(36906005)(8676002)(33656002)(25786009)(14454004)(22756006)(316002)(110136005)(2501003)(486006)(6506007)(102836004)(76176011)(53546011)(229853002)(4326008)(2486003)(356004)(23676004)(26005)(76130400001)(5660300002)(66066001)(70586007)(47776003)(70206006)(36756003)(63350400001)(436003)(86362001)(63370400001)(2616005)(476003)(186003)(11346002)(446003)(336012)(126002)(26826003)(478600001)(6306002)(6512007)(6486002)(7736002)(305945005)(50466002)(966005)(6246003); DIR:OUT; SFP:1101; SCL:1; SRVR:HE1PR0801MB1849; H:64aa7808-outbound-1.mta.getcheckrecipient.com; FPR:; SPF:TempError; LANG:en; PTR:ec2-63-35-35-123.eu-west-1.compute.amazonaws.com; MX:1; A:1; X-MS-Office365-Filtering-Correlation-Id-Prvs: a808903e-c3d1-44f3-6342-08d70ad5abe0 X-Microsoft-Antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(710020)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:HE1PR0801MB1849; X-Forefront-PRVS: 01018CB5B3 X-Microsoft-Antispam-Message-Info: hKyu46i3PRlsq8C2IDxpsoDqv2ZwFtEzDrGC67o/uNSx4IhyXDTms+ma6+YyLG/nWMfOiTOBqaWarmvuZeahc3X921YMrvDByVDOWrry6ZBBcnnbR+nziJ6s/CNm5KBcOAW1UdtQVoQA9P3qDCuWclRG+W5rrlufJyMXgTz0z8cowh836LZee0BhIr+CeocSxgn6/5+yzLPv5fkRPCw/VSAIVof2Gz3VxGqmxxdVyqTi4ZRyDVqLTHvstnUYUBJII8o+uAcUWmokSLh4SCg0ZhpN2BhqkH2xy+M6jMyO9XorAgAAz6A6rbBdFRkl1wdasIA4ZVyJZO/ublwQpYiUV5F17FM6qenJ4n0/36XtE3qcApHRbJVBOPf2GQwZPNZivpQegu5cTUeLJ0DlMXXCL/YxHlOiEMd/YDL/CigNAzQ= X-OriginatorOrg: arm.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 17 Jul 2019 16:42:02.5237 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 69fa7e1a-494a-444f-a10a-08d70ad5b1fa X-MS-Exchange-CrossTenant-Id: f34e5979-57d9-4aaa-ad4d-b122a662184d X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=f34e5979-57d9-4aaa-ad4d-b122a662184d; Ip=[63.35.35.123]; Helo=[64aa7808-outbound-1.mta.getcheckrecipient.com] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR0801MB1849 Archived-At: Subject: Re: [TLS] WGLC for draft-ietf-tls-dtls-connection-id-06 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 17 Jul 2019 16:42:12 -0000 T24gMTcvMDcvMjAxOSwgMTY6MzMsICJUTFMgb24gYmVoYWxmIG9mIE1hcnRpbiBUaG9tc29uIiA8 dGxzLWJvdW5jZXNAaWV0Zi5vcmcgb24gYmVoYWxmIG9mIG10QGxvd2VudHJvcHkubmV0PiB3cm90 ZToNCj4gSSdtIHJlYWxseSBjb25jZXJuZWQgYWJvdXQgc2hpcHBpbmcgYSBwcm90b2NvbCB0aGF0 IGVuYWJsZXMgdGhlIHNvcnRzDQo+IG9mIGF0dGFja3MgdGhhdCBjb25uZWN0aW9uIElEcyBlbmFi bGUuICBJIHRoaW5rIHRoYXQgd2Ugc2hvdWxkIGRpc2N1c3MNCj4gdGhhdCBpc3N1ZSB3aGVuIHdl IG1lZXQuICBJIGtub3cgdGhhdCBIYW5uZXMnIG5ldyBkcmFmdCBpcyBhbiBhdHRlbXB0DQo+IHRv IHRhY2tsZSB0aGlzIGlzc3VlLCBidXQgdGhhdCdzIGEgbG9uZyB3YXkgZnJvbSBiZWluZyBkb25l LiAgSWYgd2UNCj4gc2hpcCBhIHNwZWMgd2l0aCB0aGlzIGhvbGUsIGl0IHdpbGwgb25seSBiZSB1 c2FibGUgaW4gY2VydGFpbiBuYXJyb3cNCj4gY29udGV4dHMsIGxpa2Ugd2l0aCBJQ0UsIHdoZXJl IHRoaXMgcmVhbGx5IGlzbid0IGEgY29uY2VybiBhbnl3YXkuDQoNCkkgc2hhcmUgdGhlIHNhbWUg d29ycnkgdGhhdCB0aGUgZG9jdW1lbnQgYXMgaXQgaXMgYXQgdGhlIG1vbWVudCBjcmVhdGVzDQph IGRhbmdlcm91cyBzaXR1YXRpb24gaWYgaW1wbGVtZW50ZWQgaW4gaXNvbGF0aW9uLCBpLmUuIHdp dGhvdXQgUlJDLg0KDQpPcmlnaW5hbGx5IEkgaGFkIHByb3Bvc2VkIHRoZSB0ZXh0IGluIFsxXS4g IFRoZSB0d28gTVVTVHMgaW4gdGhhdCBQUg0Kc2hvdWxkIGNvdW50ZXIgdGhlIG1hbi1vbi10aGUt c2lkZSBhdHRhY2tzIGRlc2NyaWJlZCBpbiBbMl0uICBUaGV5IGFyZQ0Kc2VsZi1jb250YWluZWQs IGNoZWFwIGFuZCBlZmZlY3RpdmUgY291bnRlcm1lYXN1cmVzIHRoYXQgYW4gZW5kcG9pbnQgY2Fu DQppbXBsZW1lbnQgdW5pbGF0ZXJhbGx5Lg0KDQpUaGlzIHdhcyBiZWZvcmUgUlJDIHdhcyBkcmFm dGVkLiAgVGhvc2UgcGFyYWdyYXBocyBoYXZlIG5vdyBiZWVuIG1vdmVkDQp0aGVyZTsgaG93ZXZl ciwgSSB0aGluayB0aGV5IHJlYWxseSBiZWxvbmcgdG8gY29ubi1pZC4NCg0KTXkgc3VnZ2VzdGlv biBpcyB3ZSBtb3ZlIHRoYXQgc2VjdGlvbiBiYWNrIGFuZCBwb2ludCB0byBSUkMgZm9yIHRoZQ0K ImZpbmFsIiBzb2x1dGlvbi4gIFRoaXMgZG9lc24ndCBnaXZlIGNvbXBsZXRlIGludGVybmFsIGNv aGVyZW5jeSB0bw0KY29ubi1pZCAtLSB3aGljaCBpcyBpbmRlZWQgc3Vib3B0aW1hbCAtLSBidXQg dGhlIHJlY29tbWVuZGF0aW9uIHRvDQpwcm92aWRlIHBlZXIgYWRkcmVzcyB1cGRhdGUgY2FsbC1i YWNrcyBwcm92aWRlcyBhdCBsZWFzdCBhIHdheSBvdXQgYW5kDQpsb29rcyB0byBtZSBsaWtlIHRo ZSBsZWFzdCB3b3JzZSBzb2x1dGlvbiBnaXZlbiB3aGVyZSB3ZSBhcmUuDQoNCkNoZWVycywgdA0K DQpbMV0gaHR0cHM6Ly9naXRodWIuY29tL3Rsc3dnL2R0bHMtY29ubi1pZC9wdWxsLzY1L2ZpbGVz DQpbMl0gaHR0cHM6Ly9naXRodWIuY29tL3Rsc3dnL2R0bHMtY29ubi1pZC9pc3N1ZXMvNjQjaXNz dWUtNDQ4MzA3ODEwDQoNCg0KDQpJTVBPUlRBTlQgTk9USUNFOiBUaGUgY29udGVudHMgb2YgdGhp cyBlbWFpbCBhbmQgYW55IGF0dGFjaG1lbnRzIGFyZSBjb25maWRlbnRpYWwgYW5kIG1heSBhbHNv IGJlIHByaXZpbGVnZWQuIElmIHlvdSBhcmUgbm90IHRoZSBpbnRlbmRlZCByZWNpcGllbnQsIHBs ZWFzZSBub3RpZnkgdGhlIHNlbmRlciBpbW1lZGlhdGVseSBhbmQgZG8gbm90IGRpc2Nsb3NlIHRo ZSBjb250ZW50cyB0byBhbnkgb3RoZXIgcGVyc29uLCB1c2UgaXQgZm9yIGFueSBwdXJwb3NlLCBv ciBzdG9yZSBvciBjb3B5IHRoZSBpbmZvcm1hdGlvbiBpbiBhbnkgbWVkaXVtLiBUaGFuayB5b3Uu DQo= From nobody Thu Jul 18 09:01:27 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8547B1207ED for ; Thu, 18 Jul 2019 09:01:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id K-AR0dTE7eni for ; Thu, 18 Jul 2019 09:01:22 -0700 (PDT) Received: from cranberry.cse-cst.gc.ca (cranberry.cse-cst.gc.ca [205.193.218.38]) (using TLSv1.2 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 75DBF120806 for ; Thu, 18 Jul 2019 09:01:14 -0700 (PDT) From: "Hammell, Jonathan F" To: "'tls@ietf.org'" Thread-Topic: Comments on draft-ietf-tls-tls13-cert-with-extern-psk-02 Thread-Index: AdU9gb6zaT80scqmTia+rfA7cCzu0g== Date: Thu, 18 Jul 2019 16:01:12 +0000 Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-classification: UNCLASSIFIED Content-Type: multipart/alternative; boundary="_000_9e7a09914b644bdc93f5ba4e074c83a3cybergcca_" MIME-Version: 1.0 Message-Id: <20190718160114.75DBF120806@ietfa.amsl.com> Archived-At: Subject: [TLS] Comments on draft-ietf-tls-tls13-cert-with-extern-psk-02 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 Jul 2019 16:01:25 -0000 --_000_9e7a09914b644bdc93f5ba4e074c83a3cybergcca_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Classification: UNCLASSIFIED I realize publication has been requested for this draft, but I have a few c= omments that the author might want to address, if still possible. 1. The draft says that if none of the PSKs provided by the client are accep= table to the server, then the extension must be omitted from the ServerHell= o message. Nothing is said about how the client should behave if it receiv= es this: continue or abort with what error code? 2. It can be detected if two PSK identifiers sent in the same ClientHello h= ave the same PSK value by observing the binder values. Granted, I can't th= ink why this would occur, but it might be important to point this out in th= e Security Considerations in order for implementers to be clear about secur= ity guarantees. 3. Section 4, paragraph 3 states that "If none of the external PSKs in the list provided by the client is acceptable to the server, then the "tls_cert_with_extern_psk" extension is omitted from the ServerHello message." Section 5 has a similar statement but using the word "MUST": "If none of th= e offered external PSKs in the list provided by the client are acceptable to the server, then the "tls_cert_with_extern_psk" extension MUST be omitted from the ServerHello message." These statements should be consistent in the requirement language. 4. Section 5, paragraph starting with "The identities are a list of externa= l PSK identities...": s/identities may be know to other parties/identities = may be known to other parties Best regards, Jonathan -- Jonathan Hammell Canadian Centre for Cyber Security Jonathan.Hammell@cyber.gc.ca --_000_9e7a09914b644bdc93f5ba4e074c83a3cybergcca_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable <= a name=3D"Classify_Bookmark">
Classification: UNCLASSIFIE= D
&nbs= p;
I re= alize publication has been requested for this draft, but I have a few comme= nts that the author might want to address, if still possible.=
&nbs= p;
1. T= he draft says that if none of the PSKs provided by the client are acceptabl= e to the server, then the extension must be omitted from the ServerHello me= ssage.  Nothing is said about how the client should behave if it receives this: continue or abort with what error= code?
&nbs= p;
2. I= t can be detected if two PSK identifiers sent in the same ClientHello have = the same PSK value by observing the binder values.  Granted, I can't t= hink why this would occur, but it might be important to point this out in the Security Considerations in order for imp= lementers to be clear about security guarantees.
&nbs= p;
3. S= ection 4, paragraph 3 states that "If none of the external
&nbs= p;  PSKs in the list provided by the client is acceptable to the serve= r,
&nbs= p;  then the "tls_cert_with_extern_psk" extension is omitted= from the
&nbs= p;  ServerHello message."
&nbs= p;
Sect= ion 5 has a similar statement but using the word "MUST": "If= none of the
&nbs= p;  offered external PSKs in the list provided by the client are
&nbs= p;  acceptable to the server, then the "tls_cert_with_extern_psk&= quot;
&nbs= p;  extension MUST be omitted from the ServerHello message."
&nbs= p;
Thes= e statements should be consistent in the requirement language.
&nbs= p;
4. S= ection 5, paragraph starting with "The identities are a list of extern= al PSK identities...": s/identities may be know to other parties/ident= ities may be known to other parties
&nbs= p;
&nbs= p;
Best= regards,
Jona= than
&nbs= p;
--=
Jo= nathan Hammell
Ca= nadian Centre for Cyber Security
Jo= nathan.Hammell@cyber.gc.ca
&n= bsp;
&nbs= p;
&nbs= p;
 --_000_9e7a09914b644bdc93f5ba4e074c83a3cybergcca_-- From nobody Thu Jul 18 12:39:21 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A16C31205CC for ; Thu, 18 Jul 2019 12:39:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pENhGcfZbI6E for ; Thu, 18 Jul 2019 12:39:17 -0700 (PDT) Received: from mail.smeinc.net (mail.smeinc.net [209.135.209.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5924B1200C4 for ; Thu, 18 Jul 2019 12:39:17 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mail.smeinc.net (Postfix) with ESMTP id 615DB300AFF for ; Thu, 18 Jul 2019 15:19:59 -0400 (EDT) X-Virus-Scanned: amavisd-new at mail.smeinc.net Received: from mail.smeinc.net ([127.0.0.1]) by localhost (mail.smeinc.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id nVZqp20Ok2aq for ; Thu, 18 Jul 2019 15:19:57 -0400 (EDT) Received: from [5.5.33.74] (unknown [204.194.23.17]) by mail.smeinc.net (Postfix) with ESMTPSA id 40C933005D8; Thu, 18 Jul 2019 15:19:57 -0400 (EDT) From: Russ Housley Message-Id: <50C20275-C247-46AD-8CC1-FCF6CCDCBADB@vigilsec.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_625A3BCC-C2FC-4D45-9A88-E1620DB28E8D" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Thu, 18 Jul 2019 15:39:13 -0400 In-Reply-To: <20190718160114.75DBF120806@ietfa.amsl.com> Cc: IETF TLS To: "Hammell, Jonathan F" References: <20190718160114.75DBF120806@ietfa.amsl.com> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [TLS] Comments on draft-ietf-tls-tls13-cert-with-extern-psk-02 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 Jul 2019 19:39:21 -0000 --Apple-Mail=_625A3BCC-C2FC-4D45-9A88-E1620DB28E8D Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii The document s with the IESG, and it should soon be in IETF Last Call. = I will address these as early IETF Last Call comments when that happens. Russ > On Jul 18, 2019, at 12:01 PM, Hammell, Jonathan F = wrote: >=20 > <>Classification: UNCLASSIFIED > =20 > I realize publication has been requested for this draft, but I have a = few comments that the author might want to address, if still possible. > =20 > 1. The draft says that if none of the PSKs provided by the client are = acceptable to the server, then the extension must be omitted from the = ServerHello message. Nothing is said about how the client should behave = if it receives this: continue or abort with what error code? > =20 > 2. It can be detected if two PSK identifiers sent in the same = ClientHello have the same PSK value by observing the binder values. = Granted, I can't think why this would occur, but it might be important = to point this out in the Security Considerations in order for = implementers to be clear about security guarantees. > =20 > 3. Section 4, paragraph 3 states that "If none of the external > PSKs in the list provided by the client is acceptable to the = server, > then the "tls_cert_with_extern_psk" extension is omitted from the > ServerHello message." > =20 > Section 5 has a similar statement but using the word "MUST": "If none = of the > offered external PSKs in the list provided by the client are > acceptable to the server, then the "tls_cert_with_extern_psk" > extension MUST be omitted from the ServerHello message." > =20 > These statements should be consistent in the requirement language. > =20 > 4. Section 5, paragraph starting with "The identities are a list of = external PSK identities...": s/identities may be know to other = parties/identities may be known to other parties > =20 > =20 > Best regards, > Jonathan > =20 > -- > Jonathan Hammell > Canadian Centre for Cyber Security > Jonathan.Hammell@cyber.gc.ca > =20 > =20 > =20 > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls = --Apple-Mail=_625A3BCC-C2FC-4D45-9A88-E1620DB28E8D Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii The = document s with the IESG, and it should soon be in IETF Last Call. =  I will address these as early IETF Last Call comments when that = happens.

Russ


On Jul 18, 2019, at 12:01 PM, Hammell, Jonathan F <Jonathan.Hammell@cyber.gc.ca> wrote:

Classification: = UNCLASSIFIED
 
I realize publication has been requested for this draft, but = I have a few comments that the author might want to address, if still = possible.
 
1. The draft says that if none of the PSKs provided by the = client are acceptable to the server, then the extension must be omitted = from the ServerHello message.  Nothing is said about how the client = should behave if it receives this: continue or abort with what error = code?
 
2. It can be detected if two PSK identifiers sent in the same = ClientHello have the same PSK value by observing the binder = values.  Granted, I can't think why this would occur, but it might = be important to point this out in the Security Considerations in order = for implementers to be clear about security = guarantees.
 
3. Section 4, paragraph 3 states that "If none of the = external
   PSKs in the list provided by the client is = acceptable to the server,
   then the "tls_cert_with_extern_psk" extension is = omitted from the
   ServerHello message."
 
Section 5 has a similar statement = but using the word "MUST": "If none of the
   offered external PSKs = in the list provided by the client are
   acceptable to the = server, then the "tls_cert_with_extern_psk"
   extension MUST be = omitted from the ServerHello message."
 
These statements should be = consistent in the requirement language.
 
4. Section 5, paragraph starting = with "The identities are a list of external PSK identities...": = s/identities may be know to other parties/identities may be known to = other parties
 
 
Best regards,
Jonathan
 
--
Jonathan Hammell
Canadian Centre for Cyber = Security
Jonathan.Hammell@cyber.gc.ca
 
 
 
_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls

= --Apple-Mail=_625A3BCC-C2FC-4D45-9A88-E1620DB28E8D-- From nobody Thu Jul 18 13:00:28 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 39F9A120B6E for ; Thu, 18 Jul 2019 13:00:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mWPd7dCU4YbY for ; Thu, 18 Jul 2019 13:00:20 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DBF2A1208BB for ; Thu, 18 Jul 2019 13:00:19 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 60312BE7B for ; Thu, 18 Jul 2019 21:00:17 +0100 (IST) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5KE4d5He0WIw for ; Thu, 18 Jul 2019 21:00:16 +0100 (IST) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id E8D83BE5B for ; Thu, 18 Jul 2019 21:00:15 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1563480016; bh=cq7W+fhVqR6z94GMLfx+DYpHDx1OAzcPT0z5ga3Sc9M=; h=To:From:Subject:Date:From; b=LY/3jYq8bqM6BU/Zpj8guWZRysCESBAkcLhX94N0L23iBojlvlbD0T4nEBC1Klq5G WVLMY3EV3Xt3WvR/Ki4D8mb3tw8Ya/0bBKXIc9SSXhn/NNRh8E2X5Y8ccoy4M8ghqa +S3qGKLeVuJnh9I1wkQ0V28p5I8NZwTXlSMzfggE= To: "tls@ietf.org" From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <7c36a8e6-8e94-3a99-57c9-2d4c66f0b76b@cs.tcd.ie> Date: Thu, 18 Jul 2019 21:00:14 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="6VwVXUQVK4iYrxgvlRkckEh412oIzJeYv" Archived-At: Subject: [TLS] non-editorial nit in esni-04 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 Jul 2019 20:00:26 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --6VwVXUQVK4iYrxgvlRkckEh412oIzJeYv Content-Type: multipart/mixed; boundary="m9Gwdl9HmeHS2II1xqoObXCzNZ1SZzabS"; protected-headers="v1" From: Stephen Farrell To: "tls@ietf.org" Message-ID: <7c36a8e6-8e94-3a99-57c9-2d4c66f0b76b@cs.tcd.ie> Subject: non-editorial nit in esni-04 --m9Gwdl9HmeHS2II1xqoObXCzNZ1SZzabS Content-Type: multipart/mixed; boundary="------------8DD80224A13CA033BF6450F5" Content-Language: en-GB This is a multi-part message in MIME format. --------------8DD80224A13CA033BF6450F5 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hiya, Just spotted that: opaque zeros[ESNIKeys.padded_length - length(sni)]; should I guess now be: opaque zeros[ESNIKeys.padded_length - length(dns_name)]; And maybe s/PaddedServerNameList/PaddedDNSName/ would also make sense. Cheers, S. PS: sorry if this'd be easier to handle as a GH issue, or if there's one for it already, but it's easier for me to send mail than log in to GH;-) --------------8DD80224A13CA033BF6450F5 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------8DD80224A13CA033BF6450F5-- --m9Gwdl9HmeHS2II1xqoObXCzNZ1SZzabS-- --6VwVXUQVK4iYrxgvlRkckEh412oIzJeYv Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAl0wz88ACgkQWrL68XsX K+pHgxAAyDTcUZWVMGFLodpTVDvaUMlYgwUBXN1fRs6J8aVAGJjIDzpFOS8W6Biu 5CCuWJHULwhvqV9DDKUUImPnr9CTtkyXWp3ulVRWRyxALSClWIiDoVLVku3cwWlV Utjd52HVQ8qZG9/JxJbeI4rY758sKtkq/xOBRRQ2ENSlX76ml2X04F5E00npmaU5 ri+7BKd4rVdtMlxWgykSnF65bITCcNkbxbvRFL3uNIZQ488ej2XIMuobqHMNhK1z aJs5/zdqBbgKYy/TxU9I71YcGUK5iC2IG6GU4QQlOG5nRlBLPxkUetwLlwh1GSHE pDxN/UW1lK1Uka5UOATVeFlZrCmNN9sN57DfbVMR4UO4KL0R0ELRjePPwRy9CdG1 Z6zxPoO6v+EjveHEVXlm4dFOCBzrc2c311P0cBLjVjv/jFf6AR50UW9uR2A+0qbl bEApEiJTws9Q28DlDCsnpIKm01IFkbE8ik+O4Hvn9Dy42J/ECDi2pjEWqljhgUTz vH0x+DFk5GPgyaU0xQo4t6tFqg7x5iYQhHGovYxel6g5RMiG8xL4Pvnqtyhz7diM 0BfomYvvbNb5qyT6n+ZmDPfJhzSkgQAUhaw105TKYM5lMbmx19Fa4zYfMifnQ0rX VjIWtIkuPDQ08k0qd8bX+Tp1dqzPADxvXJukwMGga0kU3jWCMJU= =nBis -----END PGP SIGNATURE----- --6VwVXUQVK4iYrxgvlRkckEh412oIzJeYv-- From nobody Thu Jul 18 15:10:20 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1AAC9120099 for ; Thu, 18 Jul 2019 15:10:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com header.b=hiEQ0w5n; dkim=fail (1024-bit key) reason="fail (body has been altered)" header.d=armh.onmicrosoft.com header.b=jZGDwB54 Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JcflFqApZIsL for ; Thu, 18 Jul 2019 15:10:12 -0700 (PDT) Received: from EUR03-VE1-obe.outbound.protection.outlook.com (mail-ve1eur03on0612.outbound.protection.outlook.com [IPv6:2a01:111:f400:fe09::612]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 49025120114 for ; Thu, 18 Jul 2019 15:10:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=2BDd82YIu0a0HhfQjJpLk3cMmMpC5Sh4skigjhAs7Yg=; b=hiEQ0w5ns11Xd0eedZ1h3Nbgpl3SG5/BepGW0D1NzH/9uxHJSNNeo3gBbDAt0NpR2nmHKdry2cS5DnCOu02YjbNE34SrCVjTgGtOnvHc44I0Kjs72dYXLAycyew/tDurtOuVjBGTa3EPET/fckUEwhsF4QRkPUmqvIT/2Nt5sQc= Received: from DB6PR0802CA0038.eurprd08.prod.outlook.com (2603:10a6:4:a3::24) by DB8PR08MB4954.eurprd08.prod.outlook.com (2603:10a6:10:bf::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2073.14; Thu, 18 Jul 2019 22:10:08 +0000 Received: from AM5EUR03FT031.eop-EUR03.prod.protection.outlook.com (2a01:111:f400:7e08::208) by DB6PR0802CA0038.outlook.office365.com (2603:10a6:4:a3::24) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2094.12 via Frontend Transport; Thu, 18 Jul 2019 22:10:08 +0000 Authentication-Results: spf=temperror (sender IP is 63.35.35.123) smtp.mailfrom=arm.com; ietf.org; dkim=pass (signature was verified) header.d=armh.onmicrosoft.com;ietf.org; dmarc=temperror action=none header.from=arm.com; Received-SPF: TempError (protection.outlook.com: error in processing during lookup of arm.com: DNS Timeout) Received: from 64aa7808-outbound-1.mta.getcheckrecipient.com (63.35.35.123) by AM5EUR03FT031.mail.protection.outlook.com (10.152.16.111) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2052.18 via Frontend Transport; Thu, 18 Jul 2019 22:10:06 +0000 Received: ("Tessian outbound 96ba4cc141ab:v24"); Thu, 18 Jul 2019 22:10:04 +0000 X-CheckRecipientChecked: true X-CR-MTA-CID: 612ccf9ffe99bc0b X-CR-MTA-TID: 64aa7808 Received: from 19212369ec75.2 (cr-mta-lb-1.cr-mta-net [104.47.13.54]) by 64aa7808-outbound-1.mta.getcheckrecipient.com id 296B6F14-CBA9-4B0C-9D81-607940B4230B.1; Thu, 18 Jul 2019 22:09:58 +0000 Received: from EUR04-HE1-obe.outbound.protection.outlook.com (mail-he1eur04lp2054.outbound.protection.outlook.com [104.47.13.54]) by 64aa7808-outbound-1.mta.getcheckrecipient.com with ESMTPS id 19212369ec75.2 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384); Thu, 18 Jul 2019 22:09:58 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=kMEMjsO3EfGLwfLCr3SIrgWWW681BmCR1xJUJeLknhjizFo1qN2nA69+RfACz6YKrxnC6YeMbU2nkvdrDgcS9NqAKTO8RnGVAvTagqiY/TX5eb8Omov4TsF8xKrdTlpgz4CJNdUMoKJpH1gw+nnr9+9ED9nZmRDBAzCKIh6rCFdflsrGnJH818Ia/gCmHfRRuOZeFrdn0V6bsEDZ4Lm76036zK2INNktNoV4m7PM5FCxuvoDywV/Prk79yPJGPGn41WfCx4ueRKR2MC22y8nmfWwJKmmj+XGiEtadv3dW7IERUhdc8yasIcBpQ0IC1RUE8M2m6rCS6t/C6g+f8ddxQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=8zCJ0S0ABxJB52GB59CG08L2bP6u+tb8+mWXG99i9Ec=; b=An7KrhDOlD79LT+Gv11hfJ70KxtUSepMVbCRiBoIgLE1obPqjRXjNu9fHZ2QGdcX7uj29Js1d//4Pijk5lKUEgC0pYKBOySe6Z8UtzckccD3Xv076bqNft3K5mUBaiKO+TDkINENYpsi0C6YNhs4BAL56ETijhvRXXLVyyvu8G37bEcs+E2OPdjnAlFWN6a/FkjgzKH9019deQpi5OWWrYeG44JLkM+ZtiUeYQblEOAuDe5Pz+dm1MaN+0Mdo8IENGE7sjLQqnhSjMhhqMXu1MCjTlkx4rSMyX1Fheh6NAQF3DwEc4waf0Fr52zvvZXTP1MooiwLkWgq7b2oyHavWA== ARC-Authentication-Results: i=1; mx.microsoft.com 1;spf=pass smtp.mailfrom=arm.com;dmarc=pass action=none header.from=arm.com;dkim=pass header.d=arm.com;arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=8zCJ0S0ABxJB52GB59CG08L2bP6u+tb8+mWXG99i9Ec=; b=jZGDwB541tNg4dxXE5TyyVqG6HI/LkuPX4LAHpioycoJAYlnFaUsbdB5XxUcVGoPnr749bxis0Zn16si4i5Pq+E6rVQ9eltDCS6bz2CHdEGP2eXEmiOlZZUQzZD1qTW6PZ0BWgKO/CXGuHgI8hwqCO2Ke4va3UlvYjySFv4pLgU= Received: from AM6PR08MB4231.eurprd08.prod.outlook.com (20.179.4.202) by AM6PR08MB4344.eurprd08.prod.outlook.com (20.179.6.75) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2094.12; Thu, 18 Jul 2019 22:09:57 +0000 Received: from AM6PR08MB4231.eurprd08.prod.outlook.com ([fe80::a0cb:7d43:97aa:b4fa]) by AM6PR08MB4231.eurprd08.prod.outlook.com ([fe80::a0cb:7d43:97aa:b4fa%7]) with mapi id 15.20.2094.011; Thu, 18 Jul 2019 22:09:57 +0000 From: Thomas Fossati To: Martin Thomson , "tls@ietf.org" Thread-Topic: [TLS] WGLC for draft-ietf-tls-dtls-connection-id-06 Thread-Index: AQHVOzGDQTLI3l+ruUWjXKcgx5CgF6bO84kAgAAj6QCAAe3+AA== Date: Thu, 18 Jul 2019 22:09:56 +0000 Message-ID: <099A6FF0-87BC-4448-A30E-27A0D7839B92@arm.com> References: <28361FA1-92AA-4FEB-9372-E6BDE794A067@arm.com> In-Reply-To: <28361FA1-92AA-4FEB-9372-E6BDE794A067@arm.com> Accept-Language: en-GB, en-US Content-Language: en-GB X-MS-Has-Attach: X-MS-TNEF-Correlator: Authentication-Results-Original: spf=none (sender IP is ) smtp.mailfrom=Thomas.Fossati@arm.com; x-originating-ip: [82.11.185.80] x-ms-publictraffictype: Email X-MS-Office365-Filtering-Correlation-Id: 698791db-426b-4718-8679-08d70bccb0e6 X-MS-Office365-Filtering-HT: Tenant X-Microsoft-Antispam-Untrusted: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(4618075)(2017052603328)(7193020); SRVR:AM6PR08MB4344; X-MS-TrafficTypeDiagnostic: AM6PR08MB4344:|DB8PR08MB4954: X-MS-Exchange-PUrlCount: 1 X-Microsoft-Antispam-PRVS: x-checkrecipientrouted: true x-ms-oob-tlc-oobclassifiers: OLM:6108;OLM:6108; x-forefront-prvs: 01026E1310 X-Forefront-Antispam-Report-Untrusted: SFV:NSPM; SFS:(10009020)(4636009)(366004)(39860400002)(346002)(376002)(396003)(136003)(189003)(199004)(66476007)(64756008)(66946007)(91956017)(66446008)(66556008)(966005)(76116006)(256004)(66066001)(14444005)(25786009)(305945005)(6306002)(6512007)(3846002)(6116002)(33656002)(53936002)(2906002)(5660300002)(478600001)(8676002)(4744005)(7736002)(110136005)(14454004)(6506007)(86362001)(26005)(186003)(11346002)(81156014)(81166006)(4326008)(229853002)(68736007)(2501003)(446003)(2616005)(99286004)(76176011)(486006)(476003)(6246003)(36756003)(71200400001)(71190400001)(6436002)(6486002)(53546011)(316002)(102836004)(8936002); DIR:OUT; SFP:1101; SCL:1; SRVR:AM6PR08MB4344; H:AM6PR08MB4231.eurprd08.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: arm.com does not designate permitted sender hosts) X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam-Message-Info-Original: 20y5DBefUG76aiYxkKMy19xlgcLt6KitC4DRjwq3kjanI2XjSaHoLkINLvo+apTKkGy/0uqemRSFWVp0arwZehtScBsSxZ7B7QrbHUGhb90y2KHIDE58Py4vSTzo0Jv8UZxCyoLRbjow4Qe+0gjL2/JWyMVWDaE0yocXd4gp0dq18Z8f5U7HruDzpQF7FB+UXND507yryeslbgdUP21GwfGT11mxRZHIUJKtshHynGIguFl8KRGldqvkqj7aH4Avfw9g9iLlhaLjTdQLYRaRGc+V+O0qI1fNT4XriSQ/VPX56lo71AyhP6JaArXy7iKD3opRLHzjMH6oQZoR+CprLVQ+P25litKG4/Uw29UUiuZWOt3O4NPD69FYRzXbkjJ0HdUHOeg6KXtGp7qZS9bcACL/stFlvzTj/HdE2KX6BtY= Content-Type: text/plain; charset="utf-8" Content-ID: <20647F35D9B55C41A7CEF76C228B731C@eurprd08.prod.outlook.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM6PR08MB4344 Original-Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=Thomas.Fossati@arm.com; X-EOPAttributedMessage: 0 X-MS-Exchange-Transport-CrossTenantHeadersStripped: AM5EUR03FT031.eop-EUR03.prod.protection.outlook.com X-Forefront-Antispam-Report: CIP:63.35.35.123; IPV:CAL; SCL:-1; CTRY:IE; EFV:NLI; SFV:NSPM; SFS:(10009020)(4636009)(39860400002)(396003)(376002)(346002)(136003)(2980300002)(40434004)(199004)(189003)(229853002)(336012)(2906002)(476003)(63370400001)(126002)(2616005)(25786009)(486006)(305945005)(3846002)(76176011)(2501003)(446003)(966005)(63350400001)(2486003)(14454004)(23676004)(8676002)(102836004)(6506007)(53546011)(11346002)(436003)(478600001)(26005)(36756003)(66066001)(186003)(26826003)(47776003)(70586007)(316002)(70206006)(110136005)(36906005)(6306002)(99286004)(50466002)(4744005)(33656002)(76130400001)(8936002)(6116002)(81166006)(7736002)(6246003)(81156014)(22756006)(4326008)(14444005)(5024004)(6486002)(5660300002)(356004)(86362001)(6512007); DIR:OUT; SFP:1101; SCL:1; SRVR:DB8PR08MB4954; H:64aa7808-outbound-1.mta.getcheckrecipient.com; FPR:; SPF:TempError; LANG:en; PTR:ec2-63-35-35-123.eu-west-1.compute.amazonaws.com; A:1; MX:1; X-MS-Office365-Filtering-Correlation-Id-Prvs: b6d529e5-7b19-403c-4e3a-08d70bccab3d X-Microsoft-Antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(710020)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:DB8PR08MB4954; X-Forefront-PRVS: 01026E1310 X-Microsoft-Antispam-Message-Info: YGlb6ATtTsc0J3M07fdgxMYqOQtib+ZXWi5viB49L6rcyEazDxRQpMDQ1jnEFQtrIwDXw5AYJJdzO2odbd70/+3OHasHLJz4caW7FdxbKrrripzt9Gqf85teZ7i9xo8+CHhzU/Jrf35OakgZPdNWYzvhWFp9Ca2o78baduLnAi1IAU3KARrFqQqv53uL47sicokGg9BywFmU6ThCm7sYS+p2lENxgHSME5lCbIgyeOQZ9LYD+dplJypsPPAAvBOIPaFRNQhxIbkhXfOyUCvkKRPS2manRXC2v0dYIXaNU8lALk4Qbov9Om3KwzddiS27JkE+KLg6XZyCtK32no8FQxBamYS64/+uxK2ZKxqMQfvW+5oqRvvkdDBtOIzq4Xl3bNdBfAJKZndXAntMbZgDzud++IFhSXlWbLwPG08yW+I= X-OriginatorOrg: arm.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 18 Jul 2019 22:10:06.4575 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 698791db-426b-4718-8679-08d70bccb0e6 X-MS-Exchange-CrossTenant-Id: f34e5979-57d9-4aaa-ad4d-b122a662184d X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=f34e5979-57d9-4aaa-ad4d-b122a662184d; Ip=[63.35.35.123]; Helo=[64aa7808-outbound-1.mta.getcheckrecipient.com] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB8PR08MB4954 Archived-At: Subject: Re: [TLS] WGLC for draft-ietf-tls-dtls-connection-id-06 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 Jul 2019 22:10:15 -0000 T24gMTcvMDcvMjAxOSwgMTc6NDIsICJUaG9tYXMgRm9zc2F0aSIgPFRob21hcy5Gb3NzYXRpQGFy bS5jb20+IHdyb3RlOg0KPiBNeSBzdWdnZXN0aW9uIGlzIHdlIG1vdmUgdGhhdCBzZWN0aW9uIGJh Y2sgYW5kIHBvaW50IHRvIFJSQyBmb3IgdGhlDQo+ICJmaW5hbCIgc29sdXRpb24uICBUaGlzIGRv ZXNuJ3QgZ2l2ZSBjb21wbGV0ZSBpbnRlcm5hbCBjb2hlcmVuY3kgdG8NCj4gY29ubi1pZCAtLSB3 aGljaCBpcyBpbmRlZWQgc3Vib3B0aW1hbCAtLSBidXQgdGhlIHJlY29tbWVuZGF0aW9uIHRvDQo+ IHByb3ZpZGUgcGVlciBhZGRyZXNzIHVwZGF0ZSBjYWxsLWJhY2tzIHByb3ZpZGVzIGF0IGxlYXN0 IGEgd2F5IG91dCBhbmQNCj4gbG9va3MgdG8gbWUgbGlrZSB0aGUgbGVhc3Qgd29yc2Ugc29sdXRp b24gZ2l2ZW4gd2hlcmUgd2UgYXJlLg0KDQpKdXN0IEZZSSwgdGhlIGN1cnJlbnQgc3RhdGUgb2Yg dGhlIGNvbmZhYiBiZXR3ZWVuIEFjaGltLCBQaGlsaXBwZSBhbmQNCm15c2VsZiBpcyBjYXB0dXJl ZCBhdDoNCmh0dHBzOi8vZ2l0aHViLmNvbS90bHN3Zy9kdGxzLWNvbm4taWQvY29tcGFyZS9tYXN0 ZXIuLi50aG9tYXMtZm9zc2F0aTphZGRyZXNzLXZhbGlkYXRpb24tdGFrZS0yDQoNCmNoZWVycywg dA0KDQpJTVBPUlRBTlQgTk9USUNFOiBUaGUgY29udGVudHMgb2YgdGhpcyBlbWFpbCBhbmQgYW55 IGF0dGFjaG1lbnRzIGFyZSBjb25maWRlbnRpYWwgYW5kIG1heSBhbHNvIGJlIHByaXZpbGVnZWQu IElmIHlvdSBhcmUgbm90IHRoZSBpbnRlbmRlZCByZWNpcGllbnQsIHBsZWFzZSBub3RpZnkgdGhl IHNlbmRlciBpbW1lZGlhdGVseSBhbmQgZG8gbm90IGRpc2Nsb3NlIHRoZSBjb250ZW50cyB0byBh bnkgb3RoZXIgcGVyc29uLCB1c2UgaXQgZm9yIGFueSBwdXJwb3NlLCBvciBzdG9yZSBvciBjb3B5 IHRoZSBpbmZvcm1hdGlvbiBpbiBhbnkgbWVkaXVtLiBUaGFuayB5b3UuDQo= From nobody Thu Jul 18 15:12:22 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 77B60120114 for ; Thu, 18 Jul 2019 15:12:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com header.b=tRpUg4WC; dkim=fail (1024-bit key) reason="fail (body has been altered)" header.d=armh.onmicrosoft.com header.b=0hHzSoNx Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xWu0Uz5-2bwv for ; Thu, 18 Jul 2019 15:12:18 -0700 (PDT) Received: from EUR01-DB5-obe.outbound.protection.outlook.com (mail-eopbgr150072.outbound.protection.outlook.com [40.107.15.72]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B935E1200A1 for ; Thu, 18 Jul 2019 15:12:17 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=2BDd82YIu0a0HhfQjJpLk3cMmMpC5Sh4skigjhAs7Yg=; b=tRpUg4WC1immI0DHwcFdMKYsqWtjZGix1LVx7SH4W71qGSwFAjhkB0oqSk8CCOlH8yaxcBroj6ve/IfLoKolg/BQSME/HMos6o3YAEy5I8qPoUN2Y+l5erywCGUqWs2Ww+UZGTuR3MoreKR/N3LOS6/5aEwbIiJZikqhS2A7Swk= Received: from VE1PR08CA0012.eurprd08.prod.outlook.com (2603:10a6:803:104::25) by AM0PR08MB4946.eurprd08.prod.outlook.com (2603:10a6:208:165::13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2073.14; Thu, 18 Jul 2019 22:12:13 +0000 Received: from VE1EUR03FT008.eop-EUR03.prod.protection.outlook.com (2a01:111:f400:7e09::208) by VE1PR08CA0012.outlook.office365.com (2603:10a6:803:104::25) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.2094.12 via Frontend Transport; Thu, 18 Jul 2019 22:12:13 +0000 Authentication-Results: spf=temperror (sender IP is 63.35.35.123) smtp.mailfrom=arm.com; ietf.org; dkim=pass (signature was verified) header.d=armh.onmicrosoft.com;ietf.org; dmarc=temperror action=none header.from=arm.com; Received-SPF: TempError (protection.outlook.com: error in processing during lookup of arm.com: DNS Timeout) Received: from 64aa7808-outbound-1.mta.getcheckrecipient.com (63.35.35.123) by VE1EUR03FT008.mail.protection.outlook.com (10.152.18.75) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.2052.18 via Frontend Transport; Thu, 18 Jul 2019 22:12:11 +0000 Received: ("Tessian outbound 96ba4cc141ab:v24"); Thu, 18 Jul 2019 22:12:09 +0000 X-CheckRecipientChecked: true X-CR-MTA-CID: 612ccf9ffe99bc0b X-CR-MTA-TID: 64aa7808 Received: from d965782fbb4a.1 (cr-mta-lb-1.cr-mta-net [104.47.10.51]) by 64aa7808-outbound-1.mta.getcheckrecipient.com id 47F9AE88-733F-4C7A-ADB9-E4BD1B79A31B.1; Thu, 18 Jul 2019 22:12:09 +0000 Received: from EUR03-DB5-obe.outbound.protection.outlook.com (mail-db5eur03lp2051.outbound.protection.outlook.com [104.47.10.51]) by 64aa7808-outbound-1.mta.getcheckrecipient.com with ESMTPS id d965782fbb4a.1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384); Thu, 18 Jul 2019 22:12:09 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=iPcj7xHBYH5ksAO4d6kllK45NoC04+z69ycRVftwbBk3BpT7ivedGifX5qzMEX/dRwwpugw2qLoVeSRFWMyPtrU9lGB0JcM638gkE++G9P54IIeDCYpV94vyHDBjemShH+X+s/o2S21y/V7O0dZqgu4S/aEV5ODo3QYWNW1rFJyBsp1MZwP6Kau9MLwBVjZRrINDuu6UhsMBTcNbCCkc6P/0mZe1FWBqXruayP2e5fGtbe/NqBgpBKKXt3q4mfR12i9drknJnQTIewJotQW6SlgCGclZYKZWk+kICLXuU/GIWtszXu7NHJJsUWUV2KnxrqB6R8KBmqHdeYl2h52PmQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=8zCJ0S0ABxJB52GB59CG08L2bP6u+tb8+mWXG99i9Ec=; b=UGse2qAj7/ubjNBrYA6IJd5Fg77U/RihY+TY6gVlKQA06bk1BCoA1rK2BwqmAkLTu8osr2TAMIH4hLeA31j/Lv3LFEi+Fi+/vPt45SHmzXA1UtBw6dZyOs/EBTjkP7QsE8iX5jRLAqV8RF4exEBNXTdhPsLOyLyVX08ocH+ssdeWUATlNUY6CmtF2s2UcOYJ6RGfa51CI/VAoT0m4PxlO3xL8RCKiV+NYKwLM+5azxWEe1bCrrurHuqZg8T0+C8VVJFsyBa4Byo2p0MMCVv1P7YtSbcQcmGFMq5Q9ZX9h1GvGfXDjzpU/Xe0QqTfOKETlw69t0qqjnxPrKdacOWeaA== ARC-Authentication-Results: i=1; mx.microsoft.com 1;spf=pass smtp.mailfrom=arm.com;dmarc=pass action=none header.from=arm.com;dkim=pass header.d=arm.com;arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=8zCJ0S0ABxJB52GB59CG08L2bP6u+tb8+mWXG99i9Ec=; b=0hHzSoNxT/Bw7hiX1gNmQANTEAJy3m6HjJLIbBVh30rJEPDD1I9rBMwD/FcBQkW/ZS079jbbncF0UqgxOH4iE7Buw7MBi+xspHFarPWJaXQJi0vnPZ1Z7FR7GjPqwaLwdlX7MRjJZvGw03ra3wn4NI2Gesx4EbkNEqrzHXSGJII= Received: from AM6PR08MB4231.eurprd08.prod.outlook.com (20.179.4.202) by AM6PR08MB4373.eurprd08.prod.outlook.com (20.179.6.146) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2073.14; Thu, 18 Jul 2019 22:12:07 +0000 Received: from AM6PR08MB4231.eurprd08.prod.outlook.com ([fe80::a0cb:7d43:97aa:b4fa]) by AM6PR08MB4231.eurprd08.prod.outlook.com ([fe80::a0cb:7d43:97aa:b4fa%7]) with mapi id 15.20.2094.011; Thu, 18 Jul 2019 22:12:07 +0000 From: Thomas Fossati To: Martin Thomson , "tls@ietf.org" Thread-Topic: [TLS] WGLC for draft-ietf-tls-dtls-connection-id-06 Thread-Index: AQHVOzGDQTLI3l+ruUWjXKcgx5CgF6bO84kAgAAj6QCAAe3+AA== Date: Thu, 18 Jul 2019 22:12:07 +0000 Message-ID: <099A6FF0-87BC-4448-A30E-27A0D7839B92@arm.com> References: <28361FA1-92AA-4FEB-9372-E6BDE794A067@arm.com> In-Reply-To: <28361FA1-92AA-4FEB-9372-E6BDE794A067@arm.com> Accept-Language: en-GB, en-US Content-Language: en-GB X-MS-Has-Attach: X-MS-TNEF-Correlator: Authentication-Results-Original: spf=none (sender IP is ) smtp.mailfrom=Thomas.Fossati@arm.com; x-originating-ip: [82.11.185.80] x-ms-publictraffictype: Email X-MS-Office365-Filtering-Correlation-Id: 3ee805c3-892b-4879-7d7c-08d70bccfba9 X-MS-Office365-Filtering-HT: Tenant X-Microsoft-Antispam-Untrusted: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(4618075)(2017052603328)(7193020); SRVR:AM6PR08MB4373; X-MS-TrafficTypeDiagnostic: AM6PR08MB4373:|AM0PR08MB4946: X-MS-Exchange-PUrlCount: 1 X-Microsoft-Antispam-PRVS: x-checkrecipientrouted: true x-ms-oob-tlc-oobclassifiers: OLM:6108;OLM:6108; x-forefront-prvs: 01026E1310 X-Forefront-Antispam-Report-Untrusted: SFV:NSPM; SFS:(10009020)(4636009)(376002)(346002)(136003)(39860400002)(396003)(366004)(199004)(189003)(11346002)(66066001)(486006)(478600001)(229853002)(36756003)(71200400001)(4744005)(71190400001)(5660300002)(6486002)(76176011)(186003)(6436002)(305945005)(8936002)(81156014)(81166006)(99286004)(6246003)(66476007)(256004)(66446008)(4326008)(6116002)(68736007)(3846002)(7736002)(2501003)(76116006)(14444005)(110136005)(476003)(91956017)(33656002)(86362001)(8676002)(53936002)(6306002)(446003)(26005)(6506007)(966005)(2906002)(2616005)(6512007)(14454004)(64756008)(25786009)(316002)(102836004)(53546011)(66946007)(66556008); DIR:OUT; SFP:1101; SCL:1; SRVR:AM6PR08MB4373; H:AM6PR08MB4231.eurprd08.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: arm.com does not designate permitted sender hosts) X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam-Message-Info-Original: D8Ed16wVZzM1zszNJvo0hu+01P3TgZVXeKBMWMopBCdiZGi08iXQzoSR2ehqooRDvIUclf5TBivV3i8GMgcRpPx5jxmvUaQmgqQu9vWllbT3bGrfcO/AY/9uNwUSJNIPjcsDq3sh0bH4zptyR9jFEzfDXm9eq/rrZ84xEqbYLoXWwkdNGvqJAOi8nuWg1v41CuygYXUBDe8RFAO1lNsz2CMdM1g3iRymonkkyeKz8yBXC1dLeBOMzCcCr06JRKNOL/ucbGRiYHYcE5Ssbt8QHxt6KlJzSJBATMTS1/73T1iWFbMiiQJANRvWmsBij3afY4kFAtYGEzImjQBPAMnQWz9z4zOAu3Rfw4QpfnuPymIhBpEa2Jwu3OeQnYfnPAK/8v6l4axBppMc+XIwCyRA6zROz2ypJOOcR9h/MGTkfNQ= Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM6PR08MB4373 Original-Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=Thomas.Fossati@arm.com; X-EOPAttributedMessage: 0 X-MS-Exchange-Transport-CrossTenantHeadersStripped: VE1EUR03FT008.eop-EUR03.prod.protection.outlook.com X-Forefront-Antispam-Report: CIP:63.35.35.123; IPV:CAL; SCL:-1; CTRY:IE; EFV:NLI; SFV:NSPM; SFS:(10009020)(4636009)(136003)(346002)(396003)(39860400002)(376002)(2980300002)(189003)(199004)(40434004)(436003)(63350400001)(36756003)(99286004)(63370400001)(476003)(2616005)(2906002)(4326008)(70206006)(6246003)(6506007)(81156014)(126002)(25786009)(11346002)(478600001)(53546011)(446003)(2501003)(26826003)(26005)(336012)(47776003)(6486002)(110136005)(86362001)(356004)(5660300002)(22756006)(50466002)(70586007)(186003)(6512007)(81166006)(76176011)(66066001)(8676002)(33656002)(4744005)(76130400001)(966005)(486006)(36906005)(14444005)(23676004)(6116002)(3846002)(2486003)(316002)(7736002)(6306002)(14454004)(8936002)(5024004)(229853002)(305945005)(102836004); DIR:OUT; SFP:1101; SCL:1; SRVR:AM0PR08MB4946; H:64aa7808-outbound-1.mta.getcheckrecipient.com; FPR:; SPF:TempError; LANG:en; PTR:ec2-63-35-35-123.eu-west-1.compute.amazonaws.com; MX:1; A:1; X-MS-Office365-Filtering-Correlation-Id-Prvs: 946edb38-08e9-40f2-d706-08d70bccf92b X-Microsoft-Antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(710020)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:AM0PR08MB4946; X-Forefront-PRVS: 01026E1310 X-Microsoft-Antispam-Message-Info: ceDItgiIt5JZ7qZG8dGajSFxLwbu39Ma5JLSZNBBfXoQ8rJs0rsnrpvWN+02y3e7SYKfr53kV9qf6ezUOyuHjPaLSi86dI5KZnSWkY3ivxDPFXKCIQnVHR7aCgSnbiNegkHCjc37+aQ/i3v+fdg0mdM38j/Inr6ANdQ77Sbn9jvHgFw7M6ayn2aVEGyow1AVrPJoZj2s4q7nQWCT8+1qXSQnwbPkjM+Jq/iYH7kool+pMznkSnASfps8kt+PSln+3IyX+x4f+TpLI+W18HqKEMHeDq88R8qezFPjZ555oBOO6ruOJPRqphhPKQ8lubrkT2t1kEtFw1r0+qGQYTMGSBLtAfkq6KlVOokBbx94Qb2Ij8qRcGgxGsPp3dlW5DaGyzEG+liODsGbCFeMJOw/gsfe3D2sntffnvN7Eg1NSw4= X-OriginatorOrg: arm.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 18 Jul 2019 22:12:11.8006 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 3ee805c3-892b-4879-7d7c-08d70bccfba9 X-MS-Exchange-CrossTenant-Id: f34e5979-57d9-4aaa-ad4d-b122a662184d X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=f34e5979-57d9-4aaa-ad4d-b122a662184d; Ip=[63.35.35.123]; Helo=[64aa7808-outbound-1.mta.getcheckrecipient.com] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM0PR08MB4946 Archived-At: Subject: Re: [TLS] WGLC for draft-ietf-tls-dtls-connection-id-06 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 Jul 2019 22:12:21 -0000 T24gMTcvMDcvMjAxOSwgMTc6NDIsICJUaG9tYXMgRm9zc2F0aSIgPFRob21hcy5Gb3NzYXRpQGFy bS5jb20+IHdyb3RlOg0KPiBNeSBzdWdnZXN0aW9uIGlzIHdlIG1vdmUgdGhhdCBzZWN0aW9uIGJh Y2sgYW5kIHBvaW50IHRvIFJSQyBmb3IgdGhlDQo+ICJmaW5hbCIgc29sdXRpb24uICBUaGlzIGRv ZXNuJ3QgZ2l2ZSBjb21wbGV0ZSBpbnRlcm5hbCBjb2hlcmVuY3kgdG8NCj4gY29ubi1pZCAtLSB3 aGljaCBpcyBpbmRlZWQgc3Vib3B0aW1hbCAtLSBidXQgdGhlIHJlY29tbWVuZGF0aW9uIHRvDQo+ IHByb3ZpZGUgcGVlciBhZGRyZXNzIHVwZGF0ZSBjYWxsLWJhY2tzIHByb3ZpZGVzIGF0IGxlYXN0 IGEgd2F5IG91dCBhbmQNCj4gbG9va3MgdG8gbWUgbGlrZSB0aGUgbGVhc3Qgd29yc2Ugc29sdXRp b24gZ2l2ZW4gd2hlcmUgd2UgYXJlLg0KDQpKdXN0IEZZSSwgdGhlIGN1cnJlbnQgc3RhdGUgb2Yg dGhlIGNvbmZhYiBiZXR3ZWVuIEFjaGltLCBQaGlsaXBwZSBhbmQNCm15c2VsZiBpcyBjYXB0dXJl ZCBhdDoNCmh0dHBzOi8vZ2l0aHViLmNvbS90bHN3Zy9kdGxzLWNvbm4taWQvY29tcGFyZS9tYXN0 ZXIuLi50aG9tYXMtZm9zc2F0aTphZGRyZXNzLXZhbGlkYXRpb24tdGFrZS0yDQoNCmNoZWVycywg dA0KDQpJTVBPUlRBTlQgTk9USUNFOiBUaGUgY29udGVudHMgb2YgdGhpcyBlbWFpbCBhbmQgYW55 IGF0dGFjaG1lbnRzIGFyZSBjb25maWRlbnRpYWwgYW5kIG1heSBhbHNvIGJlIHByaXZpbGVnZWQu IElmIHlvdSBhcmUgbm90IHRoZSBpbnRlbmRlZCByZWNpcGllbnQsIHBsZWFzZSBub3RpZnkgdGhl IHNlbmRlciBpbW1lZGlhdGVseSBhbmQgZG8gbm90IGRpc2Nsb3NlIHRoZSBjb250ZW50cyB0byBh bnkgb3RoZXIgcGVyc29uLCB1c2UgaXQgZm9yIGFueSBwdXJwb3NlLCBvciBzdG9yZSBvciBjb3B5 IHRoZSBpbmZvcm1hdGlvbiBpbiBhbnkgbWVkaXVtLiBUaGFuayB5b3UuDQo= From nobody Sat Jul 20 18:57:25 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 14B80120041; Sat, 20 Jul 2019 18:57:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hqfMAv7LNp1j; Sat, 20 Jul 2019 18:57:06 -0700 (PDT) Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 663A6120018; Sat, 20 Jul 2019 18:57:06 -0700 (PDT) Received: from kduck.mit.edu ([24.16.140.251]) (authenticated bits=56) (User authenticated as kaduk@ATHENA.MIT.EDU) by outgoing.mit.edu (8.14.7/8.12.4) with ESMTP id x6L1v0Ug014784 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 20 Jul 2019 21:57:03 -0400 Date: Sat, 20 Jul 2019 20:57:00 -0500 From: Benjamin Kaduk To: Yaron Sheffer Cc: secdir@ietf.org, draft-ietf-tls-exported-authenticator.all@ietf.org, ietf@ietf.org, tls@ietf.org Message-ID: <20190721015659.GL23137@kduck.mit.edu> References: <156330717256.15259.2193942101748847069@ietfa.amsl.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <156330717256.15259.2193942101748847069@ietfa.amsl.com> User-Agent: Mutt/1.10.1 (2018-07-13) Archived-At: Subject: Re: [TLS] Secdir last call review of draft-ietf-tls-exported-authenticator-09 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 21 Jul 2019 01:57:09 -0000 Hi Yaron, Thanks for the thoughtful review. It seems like we'll need to think about some points a bit more... On Tue, Jul 16, 2019 at 12:59:32PM -0700, Yaron Sheffer via Datatracker wrote: > Reviewer: Yaron Sheffer > Review result: Has Issues > > The document is generally clear in both its motivation and the proposed > solution. > > I think it's playing a bit too liberal with TLS 1.3, in sort-of but not quite > deprecating renegotiation, and in changing the IANA registry in a way that > actually changes the protocol. Details below. To be clear, 1.3 does not have renegotiation at all, so that deprecation has already been done and not by this document. > Other comments: > > > * Abstract: please reword to make it clear that it's the proof (not the cert) > that is portable. > * Introduction: TLS 1.3 post-handshake auth "has the > disadvantage of requiring additional state to be stored as part of the TLS > state machine." Why is that an issue is practice, assuming this feature is It requires either caching the entire handshake messages (including certificate), which can add up, or being able to "fork" a copy of internal hash state, which is a pretty uncommon API. > already supported by TLS libraries? Also, are we in effect deprecating this TLS > 1.3 feature because of the security issue of the mismatched record boundaries? I think in some peoples' minds that would be a good thing, though it's not entirely clear that we are actually doing so. > * "For simplicity, the mechanisms... require", maybe a normative REQUIRE? > * > Authenticator Request: please clarify that we use the TLS 1.3 format even when > running on TLS 1.2. > * Also, I suggest to change "is not encrypted with a > handshake key" which is too specific to "is sent unencrypted within the normal > TLS-protected data". > * Before diving into the detailed messages in Sec. 3, it > would be nice to include a quick overview of the message sequence. > * Sec. 3: > "SHOULD use TLS", change to MUST. There's no way it can work otherwise anyway. What about QUIC? > * "This message reuses the structure to the CertificateRequest message" - > repeats the preceding paragraph. > * Sec. 4: again, SHOULD use TLS -> MUST. > * Is > there a requirement for all protocol messages to be sent over a single TLS > connection? If so, please mention it. Certainly this is true for the > Authenticator message that must be sent over a single connection and cannot be > multiplexed by the high-level protocol. I think this protocol actually assumes > "nice" transport properties (no message reorder, reliability) that also require > a single, clean TLS connection. It seems like we should be more clear about what we do (and do not) require. Though IIRC we can do separate authenticators in parallel and not require them to be ordered with respect to each other. > * Why no authenticator request for servers? > Don't we care about replay? OTOH if the client wants to detect replays, it > would need to keep state on received authenticators, which would be very messy. IIUC the thinking is that there's no way to revoke an authenticator for a connection, so replay (if not detected by another layer anyway) would not cause the authentication state to change. > * 4.1: when referencing Exporters, mention this is Sec. 7.5 of [TLS1.3]. > * The > discussion of Extended Master Secret only applies to TLS 1.2 - please clarify > that, plus I suggest to reword this paragraph which I find hard to parse. (RFC 8446 tries to say "when something requires EMS, TLS 1.3 counts for that", but it's not great.) > * > 4.2: "the extensions are chosen from the TLS handshake." - What does it mean > exactly, and how does an application even know which extensions were used at > the TLS layer? Reading further, we mention "ClientHello extensions." Maybe the > authenticator should also include a ClientHello message to indicate supported > extensions. Assuming we can peek into ClientHello contradicts the hopeful "even > if it is possible to implement it at the application layer" in Sec. 6. > * 4.2.1: > the first sentence of the section is incomplete. > * Can I use TLS 1.3-specific > extensions (oid_filters) if I'm running on a TLS 1.2 connection? Is there a > situation where a certificate is acceptable for TLS 1.3 connections but not for > TLS 1.2 connections? > * "using a value derived from the connection secrets" - I > think we should recommend a specific construction here to ensure people do it > securely. > * 4.2.3: Are we computing HMAC(MAC-key, Hash(a || b || c || d))? If > so, please say so. > * 4.2.4: "a constant-time comparison" - why is it actually > required, what is the threat? An attacker can do very little because each > authenticator being sent is different. I think this text was added because of a question I asked during AD review, and we didn't put a huge amount of thought into it. > * 5: please say explicitly which > messages are used in this case to construct the authenticator. > * 6.1: the > "MUST" is strange in a section that's only supposed to be informative. Also, > the library may provide this extension (and possibly others) without requiring > it as input. > * 6.4: "The API MUST return a failure if the > certificate_request_context of the authenticator was used in a previously > validated authenticator." Are we requiring the library to keep previous > contexts for replay protection? If so, please make it explicit. > * 7.1: this is > changing TLS 1.3 by allowing this extension in Cert Request! I think it's a > really bad idea. Better to hack special support to existing libraries, allowing > this specific extension for this special case, than to change the base > protocol. Otherwise, this document should UPDATE 8446. Or, since extension codepoints are cheap, just use a newcodepoint. -Ben > * 8: I think the > Security Considerations is the right place to talk about interaction between > this protocol and TLS 1.3 (or 1.2) renegotiation. Even if we simply RECOMMEND > not to do it. Or else explain the use cases where renegotiation is still useful > if there are any. > From nobody Sat Jul 20 21:11:49 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4A8511200C3 for ; Sat, 20 Jul 2019 21:11:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id j1a3VSvM0EGz for ; Sat, 20 Jul 2019 21:11:46 -0700 (PDT) Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0D7A112006A for ; Sat, 20 Jul 2019 21:11:45 -0700 (PDT) Received: from kduck.mit.edu ([24.16.140.251]) (authenticated bits=56) (User authenticated as kaduk@ATHENA.MIT.EDU) by outgoing.mit.edu (8.14.7/8.12.4) with ESMTP id x6L4Bfh1025425 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Sun, 21 Jul 2019 00:11:44 -0400 Date: Sat, 20 Jul 2019 23:11:41 -0500 From: Benjamin Kaduk To: tls@ietf.org Message-ID: <20190721041140.GT23137@kduck.mit.edu> References: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: User-Agent: Mutt/1.10.1 (2018-07-13) Archived-At: Subject: [TLS] Fwd: [Cfrg] PAKE selection process: Maybe we need a modular approach for integrating authentication of human individuals with TLS? X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 21 Jul 2019 04:11:48 -0000 Björn wanted to give folks a heads-up for thinking about potential TLS-PAKE integrations (I note that draft-barnes-tls-pake-04 has expired). -Ben On Fri, Jul 19, 2019 at 09:45:03AM +0000, Björn Haase wrote: > Hello to all, > > I am writing this mail in order to prepare the future steps regarding PAKE on and after the Montreal Conference. > > My personal perception is that among the set of current nominations no protocol was proposed that is obviously inadequate. (I personally am somewhat sceptic regarding the proof situations for “SPAKE2+EE/BSPAKE” and “SPEKE”, but even for these two I don’t see obvious flaws if integrated properly.) My expectation is that regarding the security-topics, we might reach consensus in the CFRG community quite easily, once we have established a common understanding of the design priorities regarding patents, round efficiency, computational efficiency and security-guarantees. > > I believe that the main objections regarding PAKE will come from elsewhere: The people that would have to integrate it into larger systems like TLS, browsers, OS or password database management modules (such as PAM). > > I see the urgent need to standardize a sound PAKE for human user authentication and I think that for this purpose we will need to consider the concerns and needs of the “system integration” people very seriously. Otherwise, we might not be successful with the project of improving security and usability. > > When trying to “wear the hat” of these people, I came to the conclusion that we might need some kind of a modular system integration approach. I have spend quite some time and discussions on this topic. I would appreciate your feedback regarding the problem analysis and solution approach that I tried to summarize in the slides available at https://github.com/BjoernMHaase/fe25519/blob/master/Concept_For_Modularized_PAKE_integration_into_TLS.pdf . > > Maybe somebody might also spread this link to the TLS working group people or discuss the topic of TLS integration of PAKE at the upcoming conference in Montreal. (There seems to be an issue with my mail accounts being blocked from posting to the TLS mailing list ☹). > > I am looking forward to entering a discussion with you. > > Yours, > > Björn. > > > Mit freundlichen Grüßen I Best Regards > > Dr. Björn Haase > > Senior Expert Electronics | TGREH Electronics Hardware > Endress+Hauser Conducta GmbH+Co.KG | Dieselstrasse 24 | 70839 Gerlingen | Germany > Phone: +49 7156 209 377 | Fax: +49 7156 209 221 > bjoern.haase@endress.com | www.conducta.endress.com > > > > Endress+Hauser Conducta GmbH+Co.KG > Amtsgericht Stuttgart HRA 201908 > Sitz der Gesellschaft: Gerlingen > Persönlich haftende Gesellschafterin: > Endress+Hauser Conducta Verwaltungsgesellschaft mbH > Sitz der Gesellschaft: Gerlingen > Amtsgericht Stuttgart HRA 201929 > Geschäftsführer: Dr. Manfred Jagiella > >   > Gemäss Datenschutzgrundverordnung sind wir verpflichtet, Sie zu informieren, wenn wir personenbezogene Daten von Ihnen erheben. > Dieser Informationspflicht kommen wir mit folgendem Datenschutzhinweis (https://www.endress.com/de/cookies-endress+hauser-website) nach. > >   > > Disclaimer: > > The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential, proprietary, and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you receive this in error, please contact the sender and delete the material from any computer. This e-mail does not constitute a contract offer, a contract amendment, or an acceptance of a contract offer unless explicitly and conspicuously designated or stated as such. > > _______________________________________________ > Cfrg mailing list > Cfrg@irtf.org > https://www.irtf.org/mailman/listinfo/cfrg From nobody Sun Jul 21 06:51:41 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9D566120024 for ; Sun, 21 Jul 2019 06:51:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.5 X-Spam-Level: X-Spam-Status: No, score=-14.5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=IJ27qypq; dkim=pass (1024-bit key) header.d=cisco.onmicrosoft.com header.b=tVcVt7bE Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LJcrJBQukffk for ; Sun, 21 Jul 2019 06:51:36 -0700 (PDT) Received: from rcdn-iport-1.cisco.com (rcdn-iport-1.cisco.com [173.37.86.72]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 46651120020 for ; Sun, 21 Jul 2019 06:51:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=4339; q=dns/txt; s=iport; t=1563717096; x=1564926696; h=from:to:subject:date:message-id:mime-version; bh=PDl+bfqq9Z70PloWXkn/9mcdHeY2v3cifwor0B1sd30=; b=IJ27qypqPqr7YsAAaqVXpvXDrQsoDgTzOSriSQL2zVrpSYJdq70oOl7d ZCSjn8wnNjIyXu0YdP6awqBjsp2QrfWqxgif/0evCr8qFcBVnOo9/NhK2 hPfuEmFpdH//NF4Tp6rZUn4QspEE3vm0jXkLuqK5rYNdwvUUlRzkZLDuT I=; IronPort-PHdr: =?us-ascii?q?9a23=3A/JFZfRBv2ixWYHhv8zkJUyQJPHJ1sqjoPgMT9p?= =?us-ascii?q?ssgq5PdaLm5Zn5IUjD/qs03kTRU9Dd7PRJw6rNvqbsVHZIwK7JsWtKMfkuHw?= =?us-ascii?q?QAld1QmgUhBMCfDkiuKvXjajM7GstqX15+9Hb9Ok9QS47z?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0CEAABObTRd/5FdJa1lHgEGBwaBUwk?= =?us-ascii?q?LAYEUL1ADbVUgBAsqhB2DRwONfUyVCoRVgS6BJANUCQEBAQwBASMKAgEBhEA?= =?us-ascii?q?ZgjsjNAkOAQMBAQQBAQIBBm2FHgELhWMRChMBATgRAQw+AgQwJwQ1gwABgR1?= =?us-ascii?q?NAx0BDp4LAoE4iGBxgTKCeQEBBYE2AoEPgjoYghMDBoE0AYteF4F/gTgfgh6?= =?us-ascii?q?DTQEBA4ILgl4ygiaOeIR+lnEJAoIZhliNNBuYCo01h0iQCAIEAgQFAg4BAQW?= =?us-ascii?q?BUDgqgS5wFWUBgkGCQoNxhRSFP3KBKY4qAQE?= X-IronPort-AV: E=Sophos;i="5.64,290,1559520000"; d="scan'208,217";a="599052098" Received: from rcdn-core-9.cisco.com ([173.37.93.145]) by rcdn-iport-1.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 21 Jul 2019 13:51:35 +0000 Received: from XCH-RCD-014.cisco.com (xch-rcd-014.cisco.com [173.37.102.24]) by rcdn-core-9.cisco.com (8.15.2/8.15.2) with ESMTPS id x6LDpZnO002069 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL) for ; Sun, 21 Jul 2019 13:51:35 GMT Received: from xhs-rcd-001.cisco.com (173.37.227.246) by XCH-RCD-014.cisco.com (173.37.102.24) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Sun, 21 Jul 2019 08:51:34 -0500 Received: from xhs-aln-001.cisco.com (173.37.135.118) by xhs-rcd-001.cisco.com (173.37.227.246) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Sun, 21 Jul 2019 08:51:34 -0500 Received: from NAM02-CY1-obe.outbound.protection.outlook.com (173.37.151.57) by xhs-aln-001.cisco.com (173.37.135.118) with Microsoft SMTP Server (TLS) id 15.0.1473.3 via Frontend Transport; Sun, 21 Jul 2019 08:51:34 -0500 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=btGHrYtX1Ro+Itop5rj+dQYVMrOqfATxyh/3TC7YjXu0bLfqlEs81cfY/GLc4bPem8q/9CGSGosRN50M9DK0DVtWBvr7ESYO0PBMCpeM1vi34mZbME88/aI8OKEXvex94C5kbH+ETnm42P7zmwygjrfdJAOipq8h9cae0iw/Sd5rwqaZuy7st2O6NtlGlyqhTzy/bWtuzBlrl2IErN8ePOIxr5yaXaNzFZMxngxqg+WP9uiq2ypiJEaiTy4fWwPrw9EBgTulY129LuRy6gR3ekhAqAwCiRatfyw2Jmut890FcGU1h0Dg8CO9MdqI77agon19lrnyHy7eCIrXztgeLA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=PDl+bfqq9Z70PloWXkn/9mcdHeY2v3cifwor0B1sd30=; b=FRdrpw7o1ER6udSqbo8ZHptIX/3BLm3I0ZfGJ8sV0hoDp5sy9n0aGhgcTOmq9N8PaDIefqaWs4sil+z10gsTsTjMBFpd4IjCwsDZY0VDJgaFHrBymKCfvZp9ufk368P27DwyHS7t/96iz5tlI7XbdxAA/WcjBM96Mhoaic/x71q5TdSBZmETf/vCgzWuXM3VI8oJ5EkSZ/Bm23GGWMd9QeQLm6Rrg2DISAtyW9umALjdEeQpvDERvlzr+2ADtzAHzDIhT5qvEop7aXJUH+GWSj1hq/GGTBPpVU5NaJgXUMdFhQaYMOa/gpGukOyBsa2HLqmm6asU9Q6pEGWV2x9vNA== ARC-Authentication-Results: i=1; mx.microsoft.com 1;spf=pass smtp.mailfrom=cisco.com;dmarc=pass action=none header.from=cisco.com;dkim=pass header.d=cisco.com;arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector2-cisco-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=PDl+bfqq9Z70PloWXkn/9mcdHeY2v3cifwor0B1sd30=; b=tVcVt7bEuovLocFKn8jU8RaObHXKEqtdhiCAP9FFwg9PTyU7Tzmu04A1935XMPEcxITxo7Zd7jcVNT/laXPpX3E0LPAdILDRmUok1WG7uHkkj9jgsrrTPnnDYe3daZ36WnVL3txM5no0CJHVVpLhcwCiuucUpAz3FW+Mv5MhdrU= Received: from MWHPR11MB1791.namprd11.prod.outlook.com (10.175.53.138) by MWHPR11MB2064.namprd11.prod.outlook.com (10.169.235.137) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2094.14; Sun, 21 Jul 2019 13:51:33 +0000 Received: from MWHPR11MB1791.namprd11.prod.outlook.com ([fe80::2ce7:1210:d2a0:620a]) by MWHPR11MB1791.namprd11.prod.outlook.com ([fe80::2ce7:1210:d2a0:620a%3]) with mapi id 15.20.2094.011; Sun, 21 Jul 2019 13:51:32 +0000 From: "Nancy Cam-Winget (ncamwing)" To: "tls@ietf.org" Thread-Topic: TLS Impact on Network Security draft updated Thread-Index: AQHVP8tnovYBmAyQbUu5TybMCHUv6w== Date: Sun, 21 Jul 2019 13:51:32 +0000 Message-ID: <6AF48228-19C2-41C7-BA86-BA16940C3CFF@cisco.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.10.c.190715 authentication-results: spf=none (sender IP is ) smtp.mailfrom=ncamwing@cisco.com; x-originating-ip: [2001:420:c0c8:1005::724] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 4978c684-4c5e-4692-9d93-08d70de28a39 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:MWHPR11MB2064; x-ms-traffictypediagnostic: MWHPR11MB2064: x-ms-exchange-purlcount: 3 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8273; x-forefront-prvs: 0105DAA385 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(4636009)(396003)(376002)(39860400002)(346002)(136003)(366004)(189003)(199004)(54164003)(53936002)(966005)(86362001)(81156014)(2351001)(68736007)(81166006)(1730700003)(6486002)(6916009)(7736002)(236005)(6436002)(8936002)(6306002)(54896002)(790700001)(9326002)(6512007)(33656002)(606006)(6116002)(8676002)(14454004)(5640700003)(316002)(36756003)(558084003)(76116006)(5660300002)(91956017)(58126008)(66946007)(64756008)(2501003)(2906002)(15650500001)(2420400007)(14444005)(25786009)(256004)(66476007)(66556008)(66446008)(71190400001)(486006)(71200400001)(99286004)(476003)(2616005)(46003)(7110500001)(478600001)(102836004)(6506007)(186003); DIR:OUT; SFP:1101; SCL:1; SRVR:MWHPR11MB2064; H:MWHPR11MB1791.namprd11.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: cisco.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: slrUiM4pg4YmFekDw92qjQ3YHNzTWkjaZVBXzfiOFTwlhPWro/OXnKP8G8ucDccBjHDDEjH+4YymCRsRg6w9ihOCI0+LmjdNNEpBJZhx7OcDBhqctllbogMSWR3rzLQTc8pr84Vhg0gNqWpRS2HO7lBsZwBIzT6ESJQqJFJ8EA297ZIkFeJzIQtxj9o5ak0zPJMrrceG3lIzIawrE8KnLsP4xtY7xuQmJmqbOA8eh4ouf96WFdnGDry1SmRliMoOEWSUR/FXyIFZvBN0eJ6m0NlPiOQ8VVWJBEJ+oRnWFp5jIiyUkhVGFmXB7TDwg8f61cjPwPZovOfWtn5sYFCL8PSmdUCCifvPwTgF7/Auvstu4WDOnMNFQJAdcbYuKNB5osQr/xCL8bAQMOpEjEh5XD5Yc4v8gReJtxUBdj2IwlY= Content-Type: multipart/alternative; boundary="_000_6AF4822819C241C7BA86BA16940C3CFFciscocom_" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: 4978c684-4c5e-4692-9d93-08d70de28a39 X-MS-Exchange-CrossTenant-originalarrivaltime: 21 Jul 2019 13:51:32.7294 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: ncamwing@cisco.com X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR11MB2064 X-OriginatorOrg: cisco.com X-Outbound-SMTP-Client: 173.37.102.24, xch-rcd-014.cisco.com X-Outbound-Node: rcdn-core-9.cisco.com Archived-At: Subject: [TLS] TLS Impact on Network Security draft updated X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 21 Jul 2019 13:51:39 -0000 --_000_6AF4822819C241C7BA86BA16940C3CFFciscocom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGksDQpUaGFua3MgdG8gYWxsIHRoZSBmZWVkYmFjayBwcm92aWRlZCwgd2UgaGF2ZSB1cGRhdGVk IHRoZSBodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQtY2Ftd2luZ2V0LXRscy11c2Ut Y2FzZXMtMDQNCmRyYWZ0LiAgQXQgdGhpcyBwb2ludCwgd2UgYmVsaWV2ZSB0aGUgZHJhZnQgaXMg c3RhYmxlIGFuZCB3b3VsZCBsaWtlIHRvIHJlcXVlc3QgaXRzIHB1YmxpY2F0aW9uIGFzIGFuIGlu Zm9ybWF0aW9uYWwgZHJhZnQuDQoNCldhcm0gcmVnYXJkcywNCiAgICBOYW5jeQ0KDQoNCg== --_000_6AF4822819C241C7BA86BA16940C3CFFciscocom_ Content-Type: text/html; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQph OmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xv cjojMDU2M0MxOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFu Lk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjoj OTU0RjcyOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0Kc3Bhbi5FbWFpbFN0eWxlMTcN Cgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwtY29tcG9zZTsNCglmb250LWZhbWlseToiQ2FsaWJy aSIsc2Fucy1zZXJpZjsNCgljb2xvcjp3aW5kb3d0ZXh0O30NCi5Nc29DaHBEZWZhdWx0DQoJe21z by1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNl cmlmO30NCkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjguNWluIDExLjBpbjsNCgltYXJnaW46 MS4waW4gMS4waW4gMS4waW4gMS4waW47fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRT ZWN0aW9uMTt9DQotLT48L3N0eWxlPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVk ZWZhdWx0cyB2OmV4dD0iZWRpdCIgc3BpZG1heD0iMTAyNiIgLz4NCjwveG1sPjwhW2VuZGlmXS0t PjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVsYXlvdXQgdjpleHQ9ImVkaXQiPg0K PG86aWRtYXAgdjpleHQ9ImVkaXQiIGRhdGE9IjEiIC8+DQo8L286c2hhcGVsYXlvdXQ+PC94bWw+ PCFbZW5kaWZdLS0+DQo8L2hlYWQ+DQo8Ym9keSBsYW5nPSJFTi1VUyIgbGluaz0iIzA1NjNDMSIg dmxpbms9IiM5NTRGNzIiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij5IaSw8bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdCI+VGhhbmtzIHRvIGFsbCB0aGUgZmVlZGJhY2sgcHJvdmlkZWQsIHdlIGhhdmUgdXBkYXRl ZCB0aGUNCjwvc3Bhbj48YSBocmVmPSJodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQt Y2Ftd2luZ2V0LXRscy11c2UtY2FzZXMtMDQiPmh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9k cmFmdC1jYW13aW5nZXQtdGxzLXVzZS1jYXNlcy0wNDwvYT48bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij5kcmFmdC4mbmJz cDsgQXQgdGhpcyBwb2ludCwgd2UgYmVsaWV2ZSB0aGUgZHJhZnQgaXMgc3RhYmxlIGFuZCB3b3Vs ZCBsaWtlIHRvIHJlcXVlc3QgaXRzIHB1YmxpY2F0aW9uIGFzIGFuIGluZm9ybWF0aW9uYWwgZHJh ZnQuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij5XYXJtIHJlZ2Fy ZHMsIDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0Ij4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDtOYW5jeTxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+PG86cD4mbmJzcDs8L286cD48 L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_6AF4822819C241C7BA86BA16940C3CFFciscocom_-- From nobody Sun Jul 21 22:05:03 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D11EC120163; Sun, 21 Jul 2019 22:05:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IPrMfjYrbWqC; Sun, 21 Jul 2019 22:05:00 -0700 (PDT) Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DE93112013D; Sun, 21 Jul 2019 22:04:59 -0700 (PDT) Received: from kduck.mit.edu ([24.16.140.251]) (authenticated bits=56) (User authenticated as kaduk@ATHENA.MIT.EDU) by outgoing.mit.edu (8.14.7/8.12.4) with ESMTP id x6M54q8e009951 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 22 Jul 2019 01:04:54 -0400 Date: Mon, 22 Jul 2019 00:04:51 -0500 From: Benjamin Kaduk To: secdir@ietf.org, tls@ietf.org Message-ID: <20190722050451.GU99187@kduck.mit.edu> References: <156330717256.15259.2193942101748847069@ietfa.amsl.com> <20190721015659.GL23137@kduck.mit.edu> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.10.1 (2018-07-13) Archived-At: Subject: Re: [TLS] Secdir last call review of draft-ietf-tls-exported-authenticator-09 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 22 Jul 2019 05:05:02 -0000 It seemed worth copying this to the WG list; sorry for those getting an extra copy. -Ben On Sun, Jul 21, 2019 at 10:26:56AM -0400, Martin Thomson wrote: > On Sat, Jul 20, 2019, at 21:57, Benjamin Kaduk wrote: > > > already supported by TLS libraries? Also, are we in effect deprecating this TLS > > > 1.3 feature because of the security issue of the mismatched record boundaries? > > > > I think in some peoples' minds that would be a good thing, though it's not > > entirely clear that we are actually doing so. > > This wouldn't deprecate post-HS auth. It is intended to cover the cases where post-HS auth does not work. See draft-ietf-httpbis-http2-secondary-certs. > > > > "SHOULD use TLS", change to MUST. There's no way it can work otherwise anyway. > > > > What about QUIC? > > I think that we can safely regard QUIC (at least those versions that use TLS) as TLS. An informative mention might help avoid any confusion regarding this point. We might also regard DTLS-SRTP as one such protocol. > > > > * Is > > > there a requirement for all protocol messages to be sent over a single TLS > > > connection? If so, please mention it. Certainly this is true for the > > > Authenticator message that must be sent over a single connection and cannot be > > > multiplexed by the high-level protocol. I think this protocol actually assumes > > > "nice" transport properties (no message reorder, reliability) that also require > > > a single, clean TLS connection. > > > > It seems like we should be more clear about what we do (and do not) > > require. Though IIRC we can do separate authenticators in parallel and not > > require them to be ordered with respect to each other. > > See above regarding DTLS-SRTP. Being too crisp might constrain usage inappropriately. > > > > * Why no authenticator request for servers? > > > Don't we care about replay? OTOH if the client wants to detect replays, it > > > would need to keep state on received authenticators, which would be very messy. > > > > IIUC the thinking is that there's no way to revoke an authenticator for a > > connection, so replay (if not detected by another layer anyway) would not > > cause the authentication state to change. > > Ben is correct. > > > > * 7.1: this is > > > changing TLS 1.3 by allowing this extension in Cert Request! I think it's a > > > really bad idea. Better to hack special support to existing libraries, allowing > > > this specific extension for this special case, than to change the base > > > protocol. Otherwise, this document should UPDATE 8446. > > > > Or, since extension codepoints are cheap, just use a newcodepoint. > > We might want to discuss this one this week if we can. > From nobody Mon Jul 22 05:29:37 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7BDEE12027F for ; Mon, 22 Jul 2019 05:29:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LxhMjFhvvBtm for ; Mon, 22 Jul 2019 05:29:33 -0700 (PDT) Received: from mail-lj1-x22a.google.com (mail-lj1-x22a.google.com [IPv6:2a00:1450:4864:20::22a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8B44C120275 for ; Mon, 22 Jul 2019 05:29:33 -0700 (PDT) Received: by mail-lj1-x22a.google.com with SMTP id v18so37370762ljh.6 for ; Mon, 22 Jul 2019 05:29:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=EcTnqkrLeRPof7Pz9zc/iEza9QYTYv68e0b/WL8nYpo=; b=wGevnu2TwEgX6cCoo/CP9i+80h9UrauVPWQwjSUHN/3qVZocY5QrATl6RwqgEzpbh0 aAiHLQcE5+QvIqHfV4gLa0LJGU6i6gE4A5yM7bD60rhKa9HYw9DMzddBof3GJzGfRa4K jV01aQYsXAA+rRfxuE8ltMGJztNd8+Fyz+xgPhOMKwJ1+wL60kjdkTF/UtRVUYiERRX5 HKyEzFMIHGkd9Xb/2XnCDIwLzz++X+4q13mED3KsqYc/Ekct/9XeMlUUGlS9mTsuURMR qz+NW7pham7D/OLtitDnxYmXOZB/KzeM7H1SJ25LnlbuggKSdIJdKTbpUVUxGqvMxkYj iuag== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=EcTnqkrLeRPof7Pz9zc/iEza9QYTYv68e0b/WL8nYpo=; b=LjT+J+RAjfpNn8c8GgFxOe4J1QFAHmpKvKGu1mGZtGXDpq0mTRXi8S6l5AkywJC+pi MenYXMfSSWkPsr4aK1svW9X5w20MlriC3msuoCvybaQZ+O6SF+PORfnfoXoJPErMcVnD Chy0Y9KT/xuM1KF21vL5bl+gzm7FyWHU4M8lB6B3+FZcnNiLxEf7lgBzvmaW2x4WZ+4k 2DTDH4CtzOzJ2k/fPQ9HB8uUdCCK+MAHKWzkC64H1i/73wvj338dBp5AqY9VufMDIKOa gpD3mhBqzIu9Dt7yRz0X8mdHWc3rjwTaXLUGxgn9QeULHyGfx16bmq96KHhdNy0ywGE2 Xjog== X-Gm-Message-State: APjAAAWYeMY3ZU5MB7A3FAEn+Bd2DB896MdElO++V1pKPV8SJDrvna8c H48JTu4y4NfNzd+YVnT6d29dscf9/kCGwkTEyAM= X-Google-Smtp-Source: APXvYqxKVpUDrEADum6P+yD5W2nWBWcoThyLXZy7NCPefuuYQB86WH8GlqkJDTNuOquuBVHkjBWxnahSJczEvV3UrZk= X-Received: by 2002:a2e:890a:: with SMTP id d10mr36527115lji.145.1563798571838; Mon, 22 Jul 2019 05:29:31 -0700 (PDT) MIME-Version: 1.0 References: <6AF48228-19C2-41C7-BA86-BA16940C3CFF@cisco.com> In-Reply-To: <6AF48228-19C2-41C7-BA86-BA16940C3CFF@cisco.com> From: Eric Rescorla Date: Mon, 22 Jul 2019 05:28:55 -0700 Message-ID: To: "Nancy Cam-Winget (ncamwing)" Cc: "tls@ietf.org" Content-Type: multipart/alternative; boundary="00000000000060020b058e443ae2" Archived-At: Subject: Re: [TLS] TLS Impact on Network Security draft updated X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 22 Jul 2019 12:29:35 -0000 --00000000000060020b058e443ae2 Content-Type: text/plain; charset="UTF-8" Nancy, Not sure what you're asking for here. This doesn't appear to be a WG document, so that question would be prior to asking for publication in the WG. Or are you planning to ask the AD to sponsor it and this is just an FYI to the WG? -Ekr On Sun, Jul 21, 2019 at 6:51 AM Nancy Cam-Winget (ncamwing) < ncamwing@cisco.com> wrote: > Hi, > > Thanks to all the feedback provided, we have updated the > https://tools.ietf.org/html/draft-camwinget-tls-use-cases-04 > > draft. At this point, we believe the draft is stable and would like to > request its publication as an informational draft. > > > > Warm regards, > > Nancy > > > > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > --00000000000060020b058e443ae2 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Nancy,

Not sure what you'= ;re asking for here. This doesn't appear to be a WG document, so that q= uestion would be prior to asking for publication in the WG. Or are you plan= ning to ask the AD to sponsor it and this is just an FYI to the WG?

-Ekr


On Sun, Jul 21, 2019 at 6:51= AM Nancy Cam-Winget (ncamwing) <n= camwing@cisco.com> wrote:

Hi,

Thanks to all the fee= dback provided, we have updated the https://tools.ietf.org/html/draft-camwinget-tls-use-= cases-04

draft.=C2=A0 At this = point, we believe the draft is stable and would like to request its publica= tion as an informational draft.

=C2=A0<= /span>

Warm regards, =

=C2=A0=C2=A0=C2=A0=C2= =A0Nancy

=C2=A0<= /span>

=C2=A0<= /span>

_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls
--00000000000060020b058e443ae2-- From nobody Mon Jul 22 06:54:55 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DA36B120059 for ; Mon, 22 Jul 2019 06:54:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.5 X-Spam-Level: X-Spam-Status: No, score=-14.5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=GugIffN4; dkim=pass (1024-bit key) header.d=cisco.onmicrosoft.com header.b=tL+GSiK0 Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Em1U5gSw1KGp for ; Mon, 22 Jul 2019 06:54:51 -0700 (PDT) Received: from alln-iport-7.cisco.com (alln-iport-7.cisco.com [173.37.142.94]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9103B120121 for ; Mon, 22 Jul 2019 06:54:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=6458; q=dns/txt; s=iport; t=1563803691; x=1565013291; h=from:to:subject:date:message-id:references:in-reply-to: content-transfer-encoding:mime-version; bh=xnBlAM+uuZv+Qn1JGbyuz4FpqyiTkiVnTi7EUsxihNs=; b=GugIffN4FZhltBR9spHgKf3LQT2ewqEYnayBKPv2p1y7HIBsi6BZSVqW SjGW4HO7oMnaOjdpE0gS4I9mOq76YdYwmPM7e7YMPH32bj35kV73NmYuy 65utDGgRSsKYxdP3Ip7343F0foNcOpQi+TG/C4fLhReAvDrjL6/cG25th 0=; IronPort-PHdr: =?us-ascii?q?9a23=3AzTF0hhbnXoiR7D9Cf9zUOIP/LSx94ef9IxIV55?= =?us-ascii?q?w7irlHbqWk+dH4MVfC4el20Q6bRp3VvvRDjeee87vtX2AN+96giDgDa9QNMn?= =?us-ascii?q?1NksAKh0olCc+BB1f8KavtYTY7EcBqX15+9Hb9Ok9QS47z?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0AGAACnvzVd/4wNJK1lDgsBAQEBAQE?= =?us-ascii?q?BAQEBAQEHAQEBAQEBgVMEAQEBAQELAYFDJAUnA21VIAQLKoQdg0cDhFKJLEy?= =?us-ascii?q?CD5dQgS6BJANUCQEBAQwBARgPBgIBAYRAAheCTCM0CQ4BAwEBBAEBAgEGbYU?= =?us-ascii?q?eDIVKAQEBAQEBAQEBEBERDAEBBx8DAwwEBwICAgEGAhEEAQEBAgIUCwcCAgI?= =?us-ascii?q?ZDAsVCAgBAQQBEggMBweDAYFqAw4PAQIMjw+QYAKBOIhgcYEygnkBAQWBMgE?= =?us-ascii?q?DAgKDSxiCEwkFgQcoAYRxhU+BHheBQD8ma0aCTD6CPCUBAQECgT4BASAKCzi?= =?us-ascii?q?CPDKCJowKEBKCTIcrlEQJAoIZhliEbohhgi2HJY44jTWHSJAIAgQCBAUCDgE?= =?us-ascii?q?BBYFQOESBFHAVO4JsCYI5N28BAwiCP4MSggKFBDtyAYEojC4Vgi4BAQ?= X-IronPort-AV: E=Sophos;i="5.64,295,1559520000"; d="scan'208";a="296200266" Received: from alln-core-7.cisco.com ([173.36.13.140]) by alln-iport-7.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 22 Jul 2019 13:54:50 +0000 Received: from XCH-RCD-015.cisco.com (xch-rcd-015.cisco.com [173.37.102.25]) by alln-core-7.cisco.com (8.15.2/8.15.2) with ESMTPS id x6MDsotP005617 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL); Mon, 22 Jul 2019 13:54:50 GMT Received: from xhs-rtp-001.cisco.com (64.101.210.228) by XCH-RCD-015.cisco.com (173.37.102.25) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Mon, 22 Jul 2019 08:54:49 -0500 Received: from xhs-rcd-001.cisco.com (173.37.227.246) by xhs-rtp-001.cisco.com (64.101.210.228) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Mon, 22 Jul 2019 09:54:48 -0400 Received: from NAM02-CY1-obe.outbound.protection.outlook.com (72.163.14.9) by xhs-rcd-001.cisco.com (173.37.227.246) with Microsoft SMTP Server (TLS) id 15.0.1473.3 via Frontend Transport; Mon, 22 Jul 2019 08:54:48 -0500 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=Gq2/4WkSCXNvqsjfVvvM0BMy2wbvF4SunptD08nKoYE/iX/6/CaCsg2X8bmMkHz50TRGbfcudab75fOwg7KdJJtkHiCNHhjDEOubFVEHal8aiDpkN9AWK5eEV6y8gX/dMoh0haxijIGWEqBDxhaAz4XDVJKzD9LNhbU0QR6OzkDBj9kwqEUCkp4Dyh9yFrn3ivz5drQJ3YFAaBNL3EciEjcg0YCRiQvMwIxe6k5OenDiG7Yn+MtpipMeN+lWGGi1y+8Wil94p1sa+N6I8yNG60BoGfthFaIMrV+7o3QZWeAOdCOI9Fw5jn63PsB9+mhk7+gZ910nLmvk3RVDxbXiCQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=xnBlAM+uuZv+Qn1JGbyuz4FpqyiTkiVnTi7EUsxihNs=; b=JcjgyKuz2HLpxYzDoiq1Kp0YkEEdqZmhw3voNaLNTdb0K35sz+4tnICgjkcGwmHZae+wQd/xyVobHLFGnjUYO7xVD/E6CiCInCOHoOkkf/hgyIwHO8lAo+RlkBQ4Me9zCb0zLExsfhep7KF9nr8WjSy6X+3WmUYpZWVUuR9e16ic1XEf2nS0AMLBz+pYr44lD9JxZ6QuFzk0f/rUAuYk/mcEjcn69P2kbRKtPIgVuRK9q27XPZIhVLGfmFbT698sDtGLKrysTuyDqAPjB25K+qoyrKjoZ9ij52kXzlsFtpZiG07gK8dvi72KI7o16RrWl4uA71ABHp2OLZ/X3SmCpA== ARC-Authentication-Results: i=1; mx.microsoft.com 1;spf=pass smtp.mailfrom=cisco.com;dmarc=pass action=none header.from=cisco.com;dkim=pass header.d=cisco.com;arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector2-cisco-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=xnBlAM+uuZv+Qn1JGbyuz4FpqyiTkiVnTi7EUsxihNs=; b=tL+GSiK0fMAX1NnFqVdQqHkGEpfxQXgWZJiJw2zNhOubmNUIfbjSV5SdvKhM5azmNWy4kBfk+GRGqxh3GnY+Qu+TKW/8UyQ/AJFoudMa3laaX/co97UrRQQmWJZwmOdFayOV70ymFSkENh35aSwxM/XBaPScgAzZvksf47eFASU= Received: from DM6PR11MB3385.namprd11.prod.outlook.com (20.176.123.12) by DM6PR11MB3738.namprd11.prod.outlook.com (20.179.16.20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2073.14; Mon, 22 Jul 2019 13:54:46 +0000 Received: from DM6PR11MB3385.namprd11.prod.outlook.com ([fe80::21d7:6788:7090:d0ae]) by DM6PR11MB3385.namprd11.prod.outlook.com ([fe80::21d7:6788:7090:d0ae%7]) with mapi id 15.20.2073.012; Mon, 22 Jul 2019 13:54:46 +0000 From: "Owen Friel (ofriel)" To: Benjamin Kaduk , "tls@ietf.org" Thread-Topic: [TLS] Fwd: [Cfrg] PAKE selection process: Maybe we need a modular approach for integrating authentication of human individuals with TLS? Thread-Index: AdU+FdEY7bQUSXEZQf6qgCUw0t3LJgAAIekwAFkDW4AARpKE0A== Date: Mon, 22 Jul 2019 13:54:46 +0000 Message-ID: References: <20190721041140.GT23137@kduck.mit.edu> In-Reply-To: <20190721041140.GT23137@kduck.mit.edu> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=ofriel@cisco.com; x-originating-ip: [2001:420:c0c8:1002::7a] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: aa01e68e-ffd3-43b1-58c2-08d70eac2846 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:DM6PR11MB3738; x-ms-traffictypediagnostic: DM6PR11MB3738: x-ms-exchange-purlcount: 7 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-forefront-prvs: 01068D0A20 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(4636009)(346002)(366004)(39860400002)(376002)(396003)(136003)(13464003)(189003)(199004)(51444003)(26234003)(71190400001)(8676002)(14454004)(966005)(478600001)(66946007)(66574012)(33656002)(99286004)(71200400001)(110136005)(46003)(7736002)(25786009)(316002)(6116002)(229853002)(74316002)(81166006)(7696005)(86362001)(52536014)(8936002)(5660300002)(66446008)(476003)(446003)(11346002)(66476007)(66556008)(2501003)(486006)(102836004)(6506007)(53546011)(76176011)(76116006)(64756008)(6306002)(15974865002)(9686003)(256004)(554214002)(68736007)(6436002)(81156014)(14444005)(55016002)(2906002)(186003)(305945005)(53936002)(2171002)(6246003)(23603002); DIR:OUT; SFP:1101; SCL:1; SRVR:DM6PR11MB3738; H:DM6PR11MB3385.namprd11.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: cisco.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: 8x2edaKqZ9bRpZdFp9ItDRXR1ZIDCr+VSDRLds6Aus1eVFq4IS92EnW0xRzcfQBxAVyoM/sfaDN8Y36sypzQ/x+xvLooM+W67EdF+jrh+XoEPvTrkFc3Laoqb55Fh0AfDJ6Dsvxn0eGi3jPglaCw/xbmNkiKav9E9CmuRNKUMZbovqG0qX6ejSsfHmfurJrEJa7gFlfYahYTl7WVJq5lD2HrRBgftCfm4SwIjpDQ9xFN4TCV4DA+zecn5lhz1/nD0D5a3v3O9FSjR/WflyKoIcM+5sgtdlqNn+9apjeApetyxFj1LBRxhOcxkDzaXB8IsX4cUCqLVTwU6eKA5QRD/tKZ/h94gMBK/6MD9HCDdSUS89NDIvUl6IlbbwbotWEeIx3lU+8FPBgdt2tqSDo/Df7OEplJwFlS30vLDPH/+7E= Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: aa01e68e-ffd3-43b1-58c2-08d70eac2846 X-MS-Exchange-CrossTenant-originalarrivaltime: 22 Jul 2019 13:54:46.7807 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: ofriel@cisco.com X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR11MB3738 X-OriginatorOrg: cisco.com X-Outbound-SMTP-Client: 173.37.102.25, xch-rcd-015.cisco.com X-Outbound-Node: alln-core-7.cisco.com Archived-At: Subject: Re: [TLS] Fwd: [Cfrg] PAKE selection process: Maybe we need a modular approach for integrating authentication of human individuals with TLS? X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 22 Jul 2019 13:54:54 -0000 VGhlcmUgaXMgYWxzbyB0aGUgT1BBUVVFLXNwZWNpZmljICBodHRwczovL3Rvb2xzLmlldGYub3Jn L2h0bWwvZHJhZnQtc3VsbGl2YW4tdGxzLW9wYXF1ZS0wMCB3aGljaCBOaWNrIHByZXNlbnRlZCBh dCAxMDQ6IGh0dHBzOi8vZGF0YXRyYWNrZXIuaWV0Zi5vcmcvbWVldGluZy8xMDQvbWF0ZXJpYWxz L3NsaWRlcy0xMDQtdGxzLXNsaWRlcy1pZXRmMTA0LXRscy1vcGFxdWUtMDANCg0KT3dlbg0KDQot LS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0tLQ0KRnJvbTogVExTIDx0bHMtYm91bmNlc0BpZXRmLm9y Zz4gT24gQmVoYWxmIE9mIEJlbmphbWluIEthZHVrDQpTZW50OiAyMSBKdWx5IDIwMTkgMDU6MTIN ClRvOiB0bHNAaWV0Zi5vcmcNClN1YmplY3Q6IFtUTFNdIEZ3ZDogW0NmcmddIFBBS0Ugc2VsZWN0 aW9uIHByb2Nlc3M6IE1heWJlIHdlIG5lZWQgYSBtb2R1bGFyIGFwcHJvYWNoIGZvciBpbnRlZ3Jh dGluZyBhdXRoZW50aWNhdGlvbiBvZiBodW1hbiBpbmRpdmlkdWFscyB3aXRoIFRMUz8NCg0KQmrD tnJuIHdhbnRlZCB0byBnaXZlIGZvbGtzIGEgaGVhZHMtdXAgZm9yIHRoaW5raW5nIGFib3V0ICBw b3RlbnRpYWwgVExTLVBBS0UgaW50ZWdyYXRpb25zIChJIG5vdGUgdGhhdCBkcmFmdC1iYXJuZXMt dGxzLXBha2UtMDQgaGFzIGV4cGlyZWQpLg0KDQotQmVuDQoNCk9uIEZyaSwgSnVsIDE5LCAyMDE5 IGF0IDA5OjQ1OjAzQU0gKzAwMDAsIEJqw7ZybiBIYWFzZSB3cm90ZToNCj4gSGVsbG8gdG8gYWxs LA0KPiANCj4gSSBhbSB3cml0aW5nIHRoaXMgbWFpbCBpbiBvcmRlciB0byBwcmVwYXJlIHRoZSBm dXR1cmUgc3RlcHMgcmVnYXJkaW5nIFBBS0Ugb24gYW5kIGFmdGVyIHRoZSBNb250cmVhbCBDb25m ZXJlbmNlLg0KPiANCj4gTXkgcGVyc29uYWwgcGVyY2VwdGlvbiBpcyB0aGF0IGFtb25nIHRoZSBz ZXQgb2YgY3VycmVudCBub21pbmF0aW9ucyBubyBwcm90b2NvbCB3YXMgcHJvcG9zZWQgdGhhdCBp cyBvYnZpb3VzbHkgaW5hZGVxdWF0ZS4gKEkgcGVyc29uYWxseSBhbSBzb21ld2hhdCBzY2VwdGlj IHJlZ2FyZGluZyB0aGUgcHJvb2Ygc2l0dWF0aW9ucyBmb3Ig4oCcU1BBS0UyK0VFL0JTUEFLReKA nSBhbmQg4oCcU1BFS0XigJ0sIGJ1dCBldmVuIGZvciB0aGVzZSB0d28gSSBkb27igJl0IHNlZSAg b2J2aW91cyBmbGF3cyBpZiBpbnRlZ3JhdGVkIHByb3Blcmx5LikgTXkgZXhwZWN0YXRpb24gaXMg dGhhdCByZWdhcmRpbmcgdGhlIHNlY3VyaXR5LXRvcGljcywgd2UgbWlnaHQgcmVhY2ggY29uc2Vu c3VzIGluIHRoZSBDRlJHIGNvbW11bml0eSBxdWl0ZSBlYXNpbHksIG9uY2Ugd2UgaGF2ZSBlc3Rh Ymxpc2hlZCBhIGNvbW1vbiB1bmRlcnN0YW5kaW5nIG9mIHRoZSBkZXNpZ24gcHJpb3JpdGllcyBy ZWdhcmRpbmcgcGF0ZW50cywgcm91bmQgZWZmaWNpZW5jeSwgY29tcHV0YXRpb25hbCBlZmZpY2ll bmN5IGFuZCBzZWN1cml0eS1ndWFyYW50ZWVzLg0KPiANCj4gSSBiZWxpZXZlIHRoYXQgdGhlIG1h aW4gb2JqZWN0aW9ucyByZWdhcmRpbmcgUEFLRSB3aWxsIGNvbWUgZnJvbSBlbHNld2hlcmU6IFRo ZSBwZW9wbGUgdGhhdCB3b3VsZCBoYXZlIHRvIGludGVncmF0ZSBpdCBpbnRvIGxhcmdlciBzeXN0 ZW1zIGxpa2UgVExTLCBicm93c2VycywgT1Mgb3IgcGFzc3dvcmQgZGF0YWJhc2UgbWFuYWdlbWVu dCBtb2R1bGVzIChzdWNoIGFzIFBBTSkuDQo+IA0KPiBJIHNlZSB0aGUgdXJnZW50IG5lZWQgdG8g c3RhbmRhcmRpemUgYSBzb3VuZCBQQUtFIGZvciBodW1hbiB1c2VyIGF1dGhlbnRpY2F0aW9uIGFu ZCBJIHRoaW5rIHRoYXQgZm9yIHRoaXMgcHVycG9zZSB3ZSB3aWxsIG5lZWQgdG8gY29uc2lkZXIg dGhlIGNvbmNlcm5zIGFuZCBuZWVkcyBvZiB0aGUg4oCcc3lzdGVtIGludGVncmF0aW9u4oCdIHBl b3BsZSB2ZXJ5IHNlcmlvdXNseS4gT3RoZXJ3aXNlLCB3ZSBtaWdodCBub3QgYmUgc3VjY2Vzc2Z1 bCB3aXRoIHRoZSBwcm9qZWN0IG9mIGltcHJvdmluZyBzZWN1cml0eSBhbmQgdXNhYmlsaXR5Lg0K PiANCj4gV2hlbiB0cnlpbmcgdG8g4oCcd2VhciB0aGUgaGF04oCdIG9mIHRoZXNlIHBlb3BsZSwg SSBjYW1lIHRvIHRoZSBjb25jbHVzaW9uIHRoYXQgd2UgbWlnaHQgbmVlZCBzb21lIGtpbmQgb2Yg YSBtb2R1bGFyIHN5c3RlbSBpbnRlZ3JhdGlvbiBhcHByb2FjaC4gSSBoYXZlIHNwZW5kIHF1aXRl IHNvbWUgdGltZSBhbmQgZGlzY3Vzc2lvbnMgb24gdGhpcyB0b3BpYy4gSSB3b3VsZCBhcHByZWNp YXRlIHlvdXIgZmVlZGJhY2sgcmVnYXJkaW5nIHRoZSBwcm9ibGVtIGFuYWx5c2lzIGFuZCBzb2x1 dGlvbiBhcHByb2FjaCB0aGF0IEkgdHJpZWQgdG8gc3VtbWFyaXplIGluIHRoZSBzbGlkZXMgYXZh aWxhYmxlIGF0IGh0dHBzOi8vZ2l0aHViLmNvbS9Cam9lcm5NSGFhc2UvZmUyNTUxOS9ibG9iL21h c3Rlci9Db25jZXB0X0Zvcl9Nb2R1bGFyaXplZF9QQUtFX2ludGVncmF0aW9uX2ludG9fVExTLnBk ZiAuDQo+IA0KPiBNYXliZSBzb21lYm9keSBtaWdodCBhbHNvIHNwcmVhZCB0aGlzIGxpbmsgdG8g dGhlIFRMUyB3b3JraW5nIGdyb3VwIHBlb3BsZSBvciBkaXNjdXNzIHRoZSB0b3BpYyBvZiBUTFMg aW50ZWdyYXRpb24gb2YgUEFLRSBhdCB0aGUgdXBjb21pbmcgY29uZmVyZW5jZSBpbiBNb250cmVh bC4gKFRoZXJlIHNlZW1zIHRvIGJlIGFuIGlzc3VlIHdpdGggbXkgbWFpbCBhY2NvdW50cyBiZWlu ZyBibG9ja2VkIGZyb20gcG9zdGluZyB0byB0aGUgVExTIG1haWxpbmcgbGlzdCDimLkpLg0KPiAN Cj4gSSBhbSBsb29raW5nIGZvcndhcmQgdG8gZW50ZXJpbmcgYSBkaXNjdXNzaW9uIHdpdGggeW91 Lg0KPiANCj4gWW91cnMsDQo+IA0KPiBCasO2cm4uDQo+IA0KPiANCj4gTWl0IGZyZXVuZGxpY2hl biBHcsO8w59lbiBJIEJlc3QgUmVnYXJkcw0KPiANCj4gRHIuIEJqw7ZybiBIYWFzZQ0KPiANCj4g U2VuaW9yIEV4cGVydCBFbGVjdHJvbmljcyB8IFRHUkVIIEVsZWN0cm9uaWNzIEhhcmR3YXJlDQo+ IEVuZHJlc3MrSGF1c2VyIENvbmR1Y3RhIEdtYkgrQ28uS0cgfCBEaWVzZWxzdHJhc3NlIDI0IHwg NzA4MzkgDQo+IEVuZHJlc3MrR2VybGluZ2VuIHwgR2VybWFueQ0KPiBQaG9uZTogKzQ5IDcxNTYg MjA5IDM3NyB8IEZheDogKzQ5IDcxNTYgMjA5IDIyMSANCj4gYmpvZXJuLmhhYXNlQGVuZHJlc3Mu Y29tIHwgIHd3dy5jb25kdWN0YS5lbmRyZXNzLmNvbQ0KPiANCj4gDQo+IA0KPiBFbmRyZXNzK0hh dXNlciBDb25kdWN0YSBHbWJIK0NvLktHDQo+IEFtdHNnZXJpY2h0IFN0dXR0Z2FydCBIUkEgMjAx OTA4DQo+IFNpdHogZGVyIEdlc2VsbHNjaGFmdDogR2VybGluZ2VuDQo+IFBlcnPDtm5saWNoIGhh ZnRlbmRlIEdlc2VsbHNjaGFmdGVyaW46DQo+IEVuZHJlc3MrSGF1c2VyIENvbmR1Y3RhIFZlcndh bHR1bmdzZ2VzZWxsc2NoYWZ0IG1iSA0KPiBTaXR6IGRlciBHZXNlbGxzY2hhZnQ6IEdlcmxpbmdl bg0KPiBBbXRzZ2VyaWNodCBTdHV0dGdhcnQgSFJBIDIwMTkyOQ0KPiBHZXNjaMOkZnRzZsO8aHJl cjogRHIuIE1hbmZyZWQgSmFnaWVsbGENCj4gDQo+IMKgDQo+IEdlbcOkc3MgRGF0ZW5zY2h1dHpn cnVuZHZlcm9yZG51bmcgc2luZCB3aXIgdmVycGZsaWNodGV0LCBTaWUgenUgaW5mb3JtaWVyZW4s IHdlbm4gd2lyIHBlcnNvbmVuYmV6b2dlbmUgRGF0ZW4gdm9uIElobmVuIGVyaGViZW4uDQo+IERp ZXNlciBJbmZvcm1hdGlvbnNwZmxpY2h0IGtvbW1lbiB3aXIgbWl0IGZvbGdlbmRlbSBEYXRlbnNj aHV0emhpbndlaXMgKGh0dHBzOi8vd3d3LmVuZHJlc3MuY29tL2RlL2Nvb2tpZXMtZW5kcmVzcyto YXVzZXItd2Vic2l0ZSkgbmFjaC4NCj4gDQo+IMKgDQo+IA0KPiBEaXNjbGFpbWVyOiANCj4gDQo+ IFRoZSBpbmZvcm1hdGlvbiB0cmFuc21pdHRlZCBpcyBpbnRlbmRlZCBvbmx5IGZvciB0aGUgcGVy c29uIG9yIGVudGl0eSB0byB3aGljaCBpdCBpcyBhZGRyZXNzZWQgYW5kIG1heSBjb250YWluIGNv bmZpZGVudGlhbCwgcHJvcHJpZXRhcnksIGFuZC9vciBwcml2aWxlZ2VkIG1hdGVyaWFsLiBBbnkg cmV2aWV3LCByZXRyYW5zbWlzc2lvbiwgZGlzc2VtaW5hdGlvbiBvciBvdGhlciB1c2Ugb2YsIG9y IHRha2luZyBvZiBhbnkgYWN0aW9uIGluIHJlbGlhbmNlIHVwb24sIHRoaXMgaW5mb3JtYXRpb24g YnkgcGVyc29ucyBvciBlbnRpdGllcyBvdGhlciB0aGFuIHRoZSBpbnRlbmRlZCByZWNpcGllbnQg aXMgcHJvaGliaXRlZC4gSWYgeW91IHJlY2VpdmUgdGhpcyBpbiBlcnJvciwgcGxlYXNlIGNvbnRh Y3QgdGhlIHNlbmRlciBhbmQgZGVsZXRlIHRoZSBtYXRlcmlhbCBmcm9tIGFueSBjb21wdXRlci4g VGhpcyBlLW1haWwgZG9lcyBub3QgY29uc3RpdHV0ZSBhIGNvbnRyYWN0IG9mZmVyLCBhIGNvbnRy YWN0IGFtZW5kbWVudCwgb3IgYW4gYWNjZXB0YW5jZSBvZiBhIGNvbnRyYWN0IG9mZmVyIHVubGVz cyBleHBsaWNpdGx5IGFuZCBjb25zcGljdW91c2x5IGRlc2lnbmF0ZWQgb3Igc3RhdGVkIGFzIHN1 Y2guDQo+ICANCg0KPiBfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fXw0KPiBDZnJnIG1haWxpbmcgbGlzdA0KPiBDZnJnQGlydGYub3JnDQo+IGh0dHBzOi8vd3d3 LmlydGYub3JnL21haWxtYW4vbGlzdGluZm8vY2ZyZw0KDQpfX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fXw0KVExTIG1haWxpbmcgbGlzdA0KVExTQGlldGYub3Jn DQpodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3Rscw0K From nobody Tue Jul 23 08:07:31 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EE21C1203AF for ; Tue, 23 Jul 2019 08:07:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yM1okw39uU_7 for ; Tue, 23 Jul 2019 08:07:19 -0700 (PDT) Received: from mail-qk1-x72d.google.com (mail-qk1-x72d.google.com [IPv6:2607:f8b0:4864:20::72d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 40B77120396 for ; Tue, 23 Jul 2019 08:07:19 -0700 (PDT) Received: by mail-qk1-x72d.google.com with SMTP id g18so31364991qkl.3 for ; Tue, 23 Jul 2019 08:07:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=jslVqXegKKgvl9rB3M5iQLejyK3SVmO7tahfWhEbneA=; b=nzGmpjrttxEOESk4E1f+mnkteGXZkJcKhrhuLkLMwtovGp+ZGCkGvmLCp8N0TxqHa3 DmUgMTVsML2r5Sg2gMNvHMwkLzXUps3Ys5uI8QLLDWbA6rI0ygSowgk6KAuoQzm0CqFY S57cTBJdX8TRhtn5qcQatrGvfKq/uPFm6/BjJqoRs75kBj6stwcTfxC21Na+8dfxDKbH /TMy8WFd4/rwh4Bch457GFuU/XybVVQa/4L5zseM+YQvmgrefpsqpIMzMVk7F+c10BpO /onhhqLaH2VtQ7vejWyE/U7Fguib0eqVn/PHwyED5BecNs22fAhgFVbSMuPfWHha2PUX HsLw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=jslVqXegKKgvl9rB3M5iQLejyK3SVmO7tahfWhEbneA=; b=PSeLUpMHpFfInnmYm51ydnn2RqMp03VTNqprfhiMzS1jBuORo7n64WmJic2h0NlKaj zxpQAsLnNAUCAU288rYB0qdreiQ+Ywp0MnYa455c1hTqyp4FlmiSMNME4GRJxRouW5N5 oVsaW07x+akUoH3wSgCKszaSTu4Cx+KtZn0nZG8ATbTWSE+A9QIKR2p3/mZDB4H1btGs v/5a1DmD8DHzQhNAeaL8BT2ziJN8pvTZ0JpqS9KBKHGRAGgPKiSjl4isvxtdWWUxigs/ hnLMpFdNkWaTkgjm2X7HqpCG1crr/MbEu+J2Y5+1Shhz8ABV03MIEml672mC13YOrk1d auHg== X-Gm-Message-State: APjAAAXRx3O7Zg95lKGU6zhHsnyNTOc7ZKi2NSa8mkRPsrO29wqVeWA0 K9yU91SQP2PtborhcX//mu8= X-Google-Smtp-Source: APXvYqyRwHXZDy+4gN2Jgry4lLszbLZ4pUYP7WTEDz7g11ATICnSaYSAay/iEYsivJCIXscV9I7TzA== X-Received: by 2002:a37:680e:: with SMTP id d14mr51744128qkc.207.1563894438423; Tue, 23 Jul 2019 08:07:18 -0700 (PDT) Received: from ?IPv6:2001:67c:370:128:f8a5:58f9:7463:df69? ([2001:67c:370:128:f8a5:58f9:7463:df69]) by smtp.gmail.com with ESMTPSA id 47sm26326150qtw.90.2019.07.23.08.07.17 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 23 Jul 2019 08:07:17 -0700 (PDT) From: Bret Jordan Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_86B9A786-D0D3-4655-90CC-CF5F0577D5F6" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Tue, 23 Jul 2019 11:07:14 -0400 In-Reply-To: <6AF48228-19C2-41C7-BA86-BA16940C3CFF@cisco.com> Cc: "tls@ietf.org" To: "Nancy Cam-Winget (ncamwing)" References: <6AF48228-19C2-41C7-BA86-BA16940C3CFF@cisco.com> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [TLS] TLS Impact on Network Security draft updated X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 Jul 2019 15:07:30 -0000 --Apple-Mail=_86B9A786-D0D3-4655-90CC-CF5F0577D5F6 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Nancy, I support this work and think this draft should be published. This is a = yet another good write up on some of the requirements that are needed = for operational security.=20 Thanks, Bret PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 "Without cryptography vihv vivc ce xhrnrw, however, the only thing that = can not be unscrambled is an egg." > On Jul 21, 2019, at 9:51 AM, Nancy Cam-Winget (ncamwing) = wrote: >=20 > Hi, > Thanks to all the feedback provided, we have updated the = https://tools.ietf.org/html/draft-camwinget-tls-use-cases-04 = > draft. At this point, we believe the draft is stable and would like = to request its publication as an informational draft. > =20 > Warm regards,=20 > Nancy > =20 > =20 > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls = --Apple-Mail=_86B9A786-D0D3-4655-90CC-CF5F0577D5F6 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii Nancy,

I = support this work and think this draft should be published. This is a = yet another good write up on some of the requirements that are needed = for operational security. 

Thanks,
Bret
PGP = Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 = 0050
"Without = cryptography vihv vivc ce xhrnrw, however, the only thing that can not = be unscrambled is an = egg."

= --Apple-Mail=_86B9A786-D0D3-4655-90CC-CF5F0577D5F6-- From nobody Tue Jul 23 11:36:20 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 28176120821 for ; Tue, 23 Jul 2019 11:36:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VSljaH1KrM0X for ; Tue, 23 Jul 2019 11:36:04 -0700 (PDT) Received: from mail-lf1-x136.google.com (mail-lf1-x136.google.com [IPv6:2a00:1450:4864:20::136]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 40D62120830 for ; Tue, 23 Jul 2019 11:36:04 -0700 (PDT) Received: by mail-lf1-x136.google.com with SMTP id 62so25184293lfa.8 for ; Tue, 23 Jul 2019 11:36:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=s7rarKO2D0J4apBXoHFvdTqGFjJolVwySAPLfH+WT5M=; b=nifMBAaPOy0/v0/ghiUV+H1hipjmR2l3I851a0A4Dqs+U1XyZwAdO566NT21gL8ZH7 s5Q3wfcnqrTLka5kBlHJ65/hVcJ017xhFVrJODWW7192y8XkzqcdAQpZSwN2s0S1ObUN NJFnSEx3AwzxWoVCevMktKE2kla6aLaL6vcLfI5jB6avlz7f9PNkzjDvH+nH0NakZX0f iA0dtrKVVJbPtVKo8dXBjgj3ryrNuBT6OFNf+r7df5NdtnPNY37Onp9N2gc3gTgsb/tT H6gd/YW8cfCjiWEhY+tyJiGHTRTcXZPhyNXGW3eQeb6a1tkzrdwB3NkDe2vJhVsZ1pBL SRiw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=s7rarKO2D0J4apBXoHFvdTqGFjJolVwySAPLfH+WT5M=; b=QTX9nBc7HjqqXfXSOqLLVFx/LLiOMfZykgBSta/poZ6RiVnW6UpJIHi7wBWgqTJG9b jIwe68zlHYRzoJDXiA5vP+agXKpJd7B9XdyWm7qgMpBrfOEkRm2XurnndmrtRnRqr4w8 /ay/z/TMtXlbioXClNPKZcGfx+am22Gg4Sak7TVXO55sMcfKjhgqzyuwtbfU+kYFJXwI 1WXUku5F/Ef+mWT3Q2InB0QevB57+2P5FkC7xIlmzxhmZuggMyXjihBQE7yw4BIJ47ch Wc5OCc1LZFA/pU6LOkpFRouYQEFoHLfH5VILU72OUIKiEBWmuZ6g5wC0zi0NbJWjSn8c 4UNg== X-Gm-Message-State: APjAAAW3W9NOBK6ltVWj0gPIemBv/aU8EkGid/28x/w+V1XZ9tMSpoyc /wqdrbk3SGshZAoMQ0Kq3/dGWfe9H/ZwANmXXxg= X-Google-Smtp-Source: APXvYqx7P1vhJHSJvBJbiMsfTjkhuSiZ2QWoH7+PmH6MjySCEPi7P0+5V1tJjgcKPZ0Dy4V5frZwo3fTiR6RzR6GAQ0= X-Received: by 2002:a19:6904:: with SMTP id e4mr16775138lfc.156.1563906962373; Tue, 23 Jul 2019 11:36:02 -0700 (PDT) MIME-Version: 1.0 References: <6AF48228-19C2-41C7-BA86-BA16940C3CFF@cisco.com> In-Reply-To: From: Watson Ladd Date: Tue, 23 Jul 2019 11:35:49 -0700 Message-ID: To: Bret Jordan Cc: "Nancy Cam-Winget (ncamwing)" , TLS List Content-Type: multipart/alternative; boundary="000000000000f44e24058e5d7619" Archived-At: Subject: Re: [TLS] TLS Impact on Network Security draft updated X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 Jul 2019 18:36:17 -0000 --000000000000f44e24058e5d7619 Content-Type: text/plain; charset="UTF-8" This draft contains substantial omissions in section 3. Nothing in TLS 1.3 prevents scanning for servers and examining the certificates they present. Nothing in TLS 1.3 prevents using reverse proxies to provide WAF functionality. PCI-DSS compliance is not at odds with deploying TLS 1.3. In fact the citation to A2 is to a sun-setting of all pre TLS 1.2 versions for point of sale terminals. I really don't see where the conflict exists since all ciphers in 1.3 are secure. The absence of these solutions means the draft overstates the impact of the increased protection TLS 1.3 provides. It's disappointing to see sustained and persistent opposition to encryption and privacy despite multiple RFCs saying that yes we should encrypt all the things. On Tue, Jul 23, 2019, 8:08 AM Bret Jordan wrote: > Nancy, > > I support this work and think this draft should be published. This is a > yet another good write up on some of the requirements that are needed for > operational security. > > Thanks, > Bret > PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 > "Without cryptography vihv vivc ce xhrnrw, however, the only thing that > can not be unscrambled is an egg." > > On Jul 21, 2019, at 9:51 AM, Nancy Cam-Winget (ncamwing) < > ncamwing@cisco.com> wrote: > > Hi, > Thanks to all the feedback provided, we have updated the > https://tools.ietf.org/html/draft-camwinget-tls-use-cases-04 > draft. At this point, we believe the draft is stable and would like to > request its publication as an informational draft. > > Warm regards, > Nancy > > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > --000000000000f44e24058e5d7619 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
This draft contains substantial omissions in section= 3.

Nothing in TLS 1.3 prevent= s scanning for servers and examining the certificates they present. Nothing= in TLS 1.3 prevents using reverse proxies to provide WAF functionality. PC= I-DSS compliance is not at odds with deploying TLS 1.3. In fact the citatio= n to A2 is to a sun-setting of all pre TLS 1.2 versions for point of sale t= erminals. I really don't see where the conflict exists since all cipher= s in 1.3 are secure.

The= absence of these solutions means the draft overstates the impact of the in= creased protection TLS 1.3 provides. It's disappointing to see sustaine= d and persistent opposition to encryption and privacy despite multiple RFCs= saying that yes we should encrypt all the things.


On Tue, Jul 23, 2019= , 8:08 AM Bret Jordan <jordan.ietf@gmail.com> wrote:
Nancy,

I support this work and th= ink this draft should be published. This is a yet another good write up on = some of the requirements that are needed for operational security.=C2=A0

Thanks,
Bret
PGP Fingerprint:= =C2=A0= 63B4 FC53 680A 6B7D 1447 = =C2=A0F2C0 74F8 ACAE 7415 0050
"Without cryptography vihv vivc ce xhrnrw, ho= wever, the only thing that can not be unscrambled is an egg."

On Jul 21, 2019, at 9:51 AM, Nancy = Cam-Winget (ncamwing) <ncamwing@cisco.com> wrote:
Hi,
Thanks to al= l the feedback provided, we have updated the=C2=A0https://tools.ietf.org/html/draft-camwinget-tls-u= se-cases-04
draft.=C2=A0 At this point, we believe the draft is stable and would like = to request its publication as an informational draft.<= /div>
=C2=A0
Warm regards,=C2=A0
=C2= =A0=C2=A0=C2=A0=C2=A0Nancy
=C2=A0
=C2=A0
_________________________________= ______________
TLS mailing list
TLS@ietf.org
htt= ps://www.ietf.org/mailman/listinfo/tls

_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo= /tls
--000000000000f44e24058e5d7619-- From nobody Tue Jul 23 13:05:20 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 50B8812036D for ; Tue, 23 Jul 2019 13:05:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id c_PXQNiCv9m6 for ; Tue, 23 Jul 2019 13:05:15 -0700 (PDT) Received: from mail-ot1-x32d.google.com (mail-ot1-x32d.google.com [IPv6:2607:f8b0:4864:20::32d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7194512039B for ; Tue, 23 Jul 2019 13:05:15 -0700 (PDT) Received: by mail-ot1-x32d.google.com with SMTP id x21so6923151otq.12 for ; Tue, 23 Jul 2019 13:05:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=J2Di3xkG+cmD2Fx+NZYY3fg3cEFNyqhTrbSLHeE9pOM=; b=tGDo7u1rvfWH3mrdXt4dk6q22ltyXYaGWU8j5F/KvsYQabRxP2G/Ngtj/epaiLM8rk l7x4GOkgJ/qmVHjriiEReqmp9Wp31x9SzIFb73JN/MTHLm6L13LLlCvlg6goVKUTBHJr 5K773/fVU0/Xm9Y1r/0X7OlZBJ2+TQD99f9JXB3vHJRjMbYfj4RVb1SMha9Yjjs9jWQn rlTB973UP6J3RXNurNwHBbazuAnFbbRkxOMZpP3XuXpObG6aN4lA727bu20DRzaRYeLe XJXeg4QEGrzJ7hN4ubT57YpLLUtMd1luRoq8KcZU/vLJdTXIl3cZKjA7bE6HjLDtgoUV q4Gw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=J2Di3xkG+cmD2Fx+NZYY3fg3cEFNyqhTrbSLHeE9pOM=; b=MYiHo17iBfjd30fq3hkSJlYjy7b6A+NWxbHC5+Qm7aUgTiK0xMwAat4fNln08km/Tb plulC2nfYnUJYhC9BQJMMTGZnRlAYuPB/RfNbqLU0B454w17eLhAABRMmIPs5ge9OCx1 v9h2Orp9CPk9AUej8nz0ZkiasYpMdRUDHtas38ya3A7l7LZ0ynO354zmKCaJpD8rZlbn v5tCOqOPvPc+kKCc3Uoh9dgXC0CQlDhvqDUihLdQ5jEtcYKEqYbgECwK+nq8HrMBrXyn 2uxdPZ6jloMHKLPNph3ZgXi8sj44il5umSsJbD4mjKSaVovsJgaFdH7SBFHfWXOmWRa2 2ksA== X-Gm-Message-State: APjAAAXIJ9TbjIdeqFytI24kONLvrddzD+PFgcqTUBsVioTr/IUBj/k8 O3BdewUS0attIOFc6AiFTWLnMv8TYu3cGXCryyk= X-Google-Smtp-Source: APXvYqzxKN3cnTPqg4gsNN0JUWFZ1k9qqxAaPmxC1VhDB3PFenwBFK5wj4nqgIzPc/WYMd9D5FukeWf1uCT2xbjUEIc= X-Received: by 2002:a9d:5787:: with SMTP id q7mr17895087oth.75.1563912314652; Tue, 23 Jul 2019 13:05:14 -0700 (PDT) MIME-Version: 1.0 References: <6AF48228-19C2-41C7-BA86-BA16940C3CFF@cisco.com> In-Reply-To: <6AF48228-19C2-41C7-BA86-BA16940C3CFF@cisco.com> From: Tony Arcieri Date: Tue, 23 Jul 2019 13:05:03 -0700 Message-ID: To: "Nancy Cam-Winget (ncamwing)" Cc: "tls@ietf.org" Content-Type: multipart/alternative; boundary="000000000000f98db4058e5eb5f4" Archived-At: Subject: Re: [TLS] TLS Impact on Network Security draft updated X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 Jul 2019 20:05:18 -0000 --000000000000f98db4058e5eb5f4 Content-Type: text/plain; charset="UTF-8" On Sun, Jul 21, 2019 at 6:51 AM Nancy Cam-Winget (ncamwing) < ncamwing@cisco.com> wrote: > Hi, > > Thanks to all the feedback provided, we have updated the > https://tools.ietf.org/html/draft-camwinget-tls-use-cases-04 > > draft. At this point, we believe the draft is stable and would like to > request its publication as an informational draft. > I read this draft as the latest attempt in a disinformation campaign by manufacturers and users of middleboxes that passively decrypt TLS connections to politicize and reframe the argument around what is, at its core, a fundamentally insecure practice which is incompatible with technically sound and highly desirable protocol improvements to TLS. I implore you stop using overly broad terminology, euphemisms, weasel words, and other deceptive language to argue your points. This draft is titled "TLS 1.3 Impact on Network-Based Security", but the subtext is quite clearly the much narrower subfield of middlebox TLS decryption. By using such a grandiose title which is deceptively hiding the true subject matter, you are implying that middleboxes are the sum total of network security. The draft begins "Enterprises [...] need to defend their information systems from attacks originating from both inside and outside their networks." I am co-owner of a company which heavily leverages firewalls for layer 3/4 network security in conjunction with TLS. We care deeply about network security, and believe that our network is *more secure* specifically because we *don't* perform middlebox interception of TLS. I consider our company to be in the category of enterprise TLS users, and as an enterprise TLS user who cares deeply about network security, I do not identify whatsoever with the claims this draft is making about the needs of enterprise TLS users as a whole. In as much as what it describes to "network security", it is but one niche consideration within a vastly broader field, and one which is increasingly controversial. I will point out, since you appear to work at Cisco, that your company works on approaches to network security (e.g. malware detection) which avoid decrypting TLS: https://blogs.cisco.com/security/detecting-encrypted-malware-traffic-without-decryption There is an entire world of network IDS systems beyond middleboxes which passively decrypt TLS. It is factually inaccurate for this draft to be described as "TLS 1.3 Impact on Network-Based Security". If you are going to write a draft about the impact of TLS 1.3 on middleboxes for passive TLS decryption, please call a spade a spade and don't try to hide your true intentions under a bunch of weasel words and overly broad claims that make it sound like middlebox-related TLS decryption problems are the end of network security as we know it. My 2c, on behalf of non-middlebox-using enterprise TLS users who feel that attempts by middlebox-using enterprise TLS users to weaken TLS in order to retain compatibility with their traffic decryption appliances is a threat to the security of our enterprise TLS deployments. --000000000000f98db4058e5eb5f4 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Sun, Jul 21, 2019 at 6:51 AM Nancy Cam= -Winget (ncamwing) <ncamwing@cisco= .com> wrote:

Hi,

Thanks to all the fee= dback provided, we have updated the https://tools.ietf.org/html/draft-camwinget-tls-use-= cases-04

draft.=C2=A0 At this = point, we believe the draft is stable and would like to request its publica= tion as an informational draft.

I read this draft as the latest attempt in a disinformation cam= paign by manufacturers and users of middleboxes that passively decrypt TLS = connections to politicize and reframe the argument around what is, at its c= ore, a fundamentally insecure practice which is incompatible with technical= ly sound and highly desirable protocol improvements to TLS.

<= /div>
I implore you stop using overly broad terminology, euphemisms, we= asel words, and other deceptive language to argue your points.

This draft is titled "TLS 1.3 Impact on Network-Based Secu= rity", but the subtext is quite clearly the much narrower subfield of = middlebox TLS decryption. By using such a grandiose title which is deceptiv= ely hiding the true subject matter, you are implying that middleboxes are t= he sum total of network security.

The draft begins "Enterprises [...] need t= o defend their information systems from attacks originating from both insid= e and outside their networks." I am co-owner of a company which heavil= y leverages firewalls for layer 3/4 network security in conjunction with TL= S. We care deeply about network security, and believe that our network is *= more secure* specifically because we *don't* perform middlebox intercep= tion of TLS.

I consider our company to be in the category of enterprise TLS users= , and as an enterprise TLS user who cares deeply about network security, I = do not identify whatsoever with the claims this draft is making about the n= eeds of enterprise TLS users as a whole. In as much as what it describes to= "network security", it is but one niche consideration within a v= astly broader field, and one which is increasingly controversial.

I will point ou= t, since you appear to work at Cisco, that your company works on approaches= to network security (e.g. malware detection) which avoid decrypting TLS:

https://blogs.cisco.com/security/detecting-encrypted-malw= are-traffic-without-decryption

There is an entire world of network IDS system= s beyond middleboxes which passively decrypt TLS.

It is factually inaccurate for this draft to be described = as "TLS 1.3 Impact on Network-Based Security". If you are going t= o write a draft about the impact of TLS 1.3 on middleboxes for passive TLS = decryption, please call a spade a spade and don't try to hide your true= intentions under a bunch of weasel words and overly broad claims that make= it sound like middlebox-related TLS decryption problems are the end of net= work security as we know it.

My 2c, on behalf of non-mid= dlebox-using enterprise TLS users who feel that attempts by middlebox-using= enterprise TLS users to weaken TLS in order to retain compatibility with t= heir traffic decryption appliances is a threat to the security of our enter= prise TLS deployments.
--000000000000f98db4058e5eb5f4-- From nobody Tue Jul 23 13:15:00 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4795C120987 for ; Tue, 23 Jul 2019 13:14:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.199 X-Spam-Level: X-Spam-Status: No, score=-4.199 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id I0ScxnySdAa4 for ; Tue, 23 Jul 2019 13:14:45 -0700 (PDT) Received: from straasha.imrryr.org (straasha.imrryr.org [100.2.39.101]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DA3121209C6 for ; Tue, 23 Jul 2019 13:14:45 -0700 (PDT) Received: by straasha.imrryr.org (Postfix, from userid 1001) id E4A362F8F5; Tue, 23 Jul 2019 16:14:44 -0400 (EDT) Date: Tue, 23 Jul 2019 16:14:44 -0400 From: Viktor Dukhovni To: tls@ietf.org Message-ID: <20190723201444.GB98742@straasha.imrryr.org> Reply-To: tls@ietf.org References: <6AF48228-19C2-41C7-BA86-BA16940C3CFF@cisco.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <6AF48228-19C2-41C7-BA86-BA16940C3CFF@cisco.com> User-Agent: Mutt/1.11.4 (2019-03-13) Archived-At: Subject: Re: [TLS] TLS Impact on Network Security draft updated X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 Jul 2019 20:14:59 -0000 On Sun, Jul 21, 2019 at 01:51:32PM +0000, Nancy Cam-Winget (ncamwing) wrote: > Thanks to all the feedback provided, we have updated the https://tools.ietf.org/html/draft-camwinget-tls-use-cases-04 > draft. At this point, we believe the draft is stable and would like to request its publication as an informational draft. I found the language of the draft (especially the introduction) somewhat turgid and repetitive to the point of significantly detracting from readability. I think the draft needs substantial editing for simplicity and clarity. As to specific technical issues, I don't understand the point being made in Section 2.2.2 about client key shares and resumption: In TLS 1.3, the above mechanism is replaced by Pre-Shared Keys (PSK), which can be negotiated as part of an initial handshake and then used in a subsequent handshake to perform resumption using the PSK. TLS 1.3 states that the client SHOULD include a "key_share" extension to enable the server to decline resumption and fall back to a full handshake, however it is not an absolute requirement. Example scenarios that are impacted by this are middleboxes that were not part of the initial handshake, and hence do not know the PSK. If the client does not include the "key_share" extension, the middlebox cannot force a fallback to the full handshake. If the middlebox policy requires it to inspect the session, it will have to fail the connection instead. [ AFAIK, even with PSK-based resumption, and even when the client's initial key share was not acceptable to server, the server can still perform a full handshake after HRR. An MiTM middle-box can replace the server's HRR with its own, and then decline the client's PSK and perform a full handshake. ] I also found the malicious server argument in section 2.2.1 somewhat unconvincing, since malicious servers have lots of (previously) innocuous domains to choose from, or can present self-signed certificates for any SNI of their choice. The impact of TLS 1.3 is largely limited to making it more difficult to whitelist "known good" servers from MiTM inspection. With TLS 1.3 a middle box that wants to be sure to MiTM sessions to "bad" servers, must also MiTM sessions to "good" servers (in order to determine that they're really "known good"), because authenticating a "good" server is no longer possible without MiTM interception. Blacklists of "known bad" are easily bypassed even with TLS 1.2. Middleboxes that are limited to closing TCP connections for the "known bad", are not particularly effective with TLS 1.2, and will be increasingly less so as attacks become more sophisticated. A middlebox that wants to detect the bad must do MiTM interception, and with TLS 1.3 will need to intercept *all* traffic, even the previously "known good", once the "known good" peer deploys TLS 1.3. Yes, optimizing out interception of the "authenticated known good" is no longer possible. -- Viktor. From nobody Tue Jul 23 13:27:53 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 18551120950 for ; Tue, 23 Jul 2019 13:27:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ncsc.gov.uk Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mwFdIEOylK9d for ; Tue, 23 Jul 2019 13:27:49 -0700 (PDT) Received: from GBR01-CWL-obe.outbound.protection.outlook.com (mail-eopbgr110137.outbound.protection.outlook.com [40.107.11.137]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 95BBA1203C2 for ; Tue, 23 Jul 2019 13:27:48 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=RAQz5U7+aURWAPyZaTsibCWh78J32+aaQUaW76XgCHmHFjglWP1QfD+tBnD86uIqtWS5nvZGbLYjdo/ARLkxZE2uAhnMckMI3drUvsApFMWOkKLiZwaNkO4WOdusuZQug1b+R3Dofr94+49NcMdXDjPDk/94JTpDo4FTfPmSZHc5lHLRPXQJCOPOYxrTWKXqoeBJMyZQRdHLBajTnc0it9/gckK/dUd3m/KovRALzl1v7dOUrj0vPPsrQnglPyDo3y0smnVPN/CY1ypOhkGx6QHy32MSn/w5WU6ggZL8VfnBYB9uIFu7weEkp8zHvHGMsOxxCw/rZLmR0vCHSjEKMA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=CdI4hfxYqBtHj10QTANto19cmYm2dSQc+jexa6gHiKE=; b=TpIOWHnuU2ryivtumcDFINCklonADWPd1DP2k7cC6TJoGdSO2OktPM9ap68vySzeg5CgNqpzoqU9UtF4y8+AYATBwcNXTH4DHPYwlpPZXK/jIFE66nQhLV8WyJxRGYu2dd7eh2pTD2bewNgju0zbGvg/7FDrqlAc42TOYstdhIw8VFYAPbxdX6hh1rpTC6/cXUuJmoPLVv5jx6Ii3NoW4clgyUFej7G8QvmIT+w3i2YUFlmHxaVXo/LWPC6Bvf4IFe6a6uWdToryR/kczpE58H1bum3b4g0g/H2R1s5ClECQPK6et/Z02hX+wtJY0qacjp1Xrn26MahNSM4Lv5rxcQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1;spf=pass smtp.mailfrom=ncsc.gov.uk;dmarc=pass action=none header.from=ncsc.gov.uk;dkim=pass header.d=ncsc.gov.uk;arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ncsc.gov.uk; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=CdI4hfxYqBtHj10QTANto19cmYm2dSQc+jexa6gHiKE=; b=MmAqfOrAFNsAq959cYbtXiqxjhrgxznvZE5GqfD1BKjxZQ66uLDI3ssUpkJLWs0MLzx2Ww5CmeP4DVfukZBwoIfqItHy4pPmIwuSr+CNFYQOtavEt5njErxdr93a/u86v2ceVA3bnQTwRCyUryTADD0s8j7vPoKycWVfxgga16w= Received: from LNXP123MB2570.GBRP123.PROD.OUTLOOK.COM (20.176.159.147) by LNXP123MB2252.GBRP123.PROD.OUTLOOK.COM (20.179.128.149) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2094.16; Tue, 23 Jul 2019 20:27:46 +0000 Received: from LNXP123MB2570.GBRP123.PROD.OUTLOOK.COM ([fe80::36:e9a5:cb51:4859]) by LNXP123MB2570.GBRP123.PROD.OUTLOOK.COM ([fe80::36:e9a5:cb51:4859%5]) with mapi id 15.20.2094.013; Tue, 23 Jul 2019 20:27:46 +0000 From: Mark O To: "tls@ietf.org" Thread-Topic: Re: [TLS] TLS Impact on Network Security draft updated Thread-Index: AdVBlEsEpQQ4zuheRNyyIiMVYmF2vA== Date: Tue, 23 Jul 2019 20:27:46 +0000 Message-ID: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Mark.O@ncsc.gov.uk; x-originating-ip: [51.141.26.231] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: aaf8a0db-054a-47bb-f0f7-08d70fac3939 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(7168020)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:LNXP123MB2252; x-ms-traffictypediagnostic: LNXP123MB2252: x-ms-exchange-purlcount: 2 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-forefront-prvs: 0107098B6C x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(4636009)(366004)(396003)(39850400004)(136003)(346002)(376002)(199004)(189003)(54164003)(476003)(86362001)(2420400007)(6436002)(66066001)(8936002)(14454004)(2906002)(790700001)(66446008)(64756008)(2351001)(6116002)(5640700003)(3846002)(66556008)(66476007)(76116006)(66946007)(1730700003)(256004)(52536014)(26005)(15650500001)(486006)(606006)(81156014)(81166006)(316002)(5660300002)(14444005)(966005)(71200400001)(25786009)(71190400001)(53936002)(2501003)(74316002)(33656002)(8676002)(99286004)(102836004)(55236004)(7110500001)(186003)(53546011)(68736007)(7736002)(54896002)(6306002)(55016002)(7696005)(229853002)(6916009)(236005)(478600001)(6246003)(6506007)(9686003); DIR:OUT; SFP:1102; SCL:1; SRVR:LNXP123MB2252; H:LNXP123MB2570.GBRP123.PROD.OUTLOOK.COM; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: ncsc.gov.uk does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: KfNTV3Br/qYo2AwPs+xwSVlPK+NnmztZNA9Xa/U13kami+yf5TUWqguazdqf/l4jJf8hCx067QQHck6O2kdrHfoMfH2qBGbLyCHS7xh6gi2XGFJQfSdtDyNCR9Q/845hf4aGQpS6e+Hld5bCykmbxKoGKG73mGCN+n13fAO3kuRJFFsqgIsZ09lGjLkIzpTLKLXHgRzRMJ9tfw56ioJ2KiW8lG/41xNoxx0z4MoKooDZppHd5Jfw1NTNkJFWCP7tEgYpUTsWxlnKHz64eNPGFz2ZF4Nef4f4Fr3V3RZpWda0i3NVQ0G/KMH/O2FDPJGXeIs9Po8ZP1rTQOCyERZHKBLx4YoRQbD3YZnqP/HYfjPRj+AUt/rDOkzZWQQGiwCGFZNJaT9mtQpztxADUiNDdBH+zp5DkeY1us38wM/MUpg= Content-Type: multipart/alternative; boundary="_000_LNXP123MB2570E01BA9FFF9412F565800D3C70LNXP123MB2570GBRP_" MIME-Version: 1.0 X-OriginatorOrg: ncsc.gov.uk X-MS-Exchange-CrossTenant-Network-Message-Id: aaf8a0db-054a-47bb-f0f7-08d70fac3939 X-MS-Exchange-CrossTenant-originalarrivaltime: 23 Jul 2019 20:27:46.3995 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 14aa5744-ece1-474e-a2d7-34f46dda64a1 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: Mark38706@ncsc.gov.uk X-MS-Exchange-Transport-CrossTenantHeadersStamped: LNXP123MB2252 Archived-At: Subject: Re: [TLS] TLS Impact on Network Security draft updated X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 Jul 2019 20:27:51 -0000 --_000_LNXP123MB2570E01BA9FFF9412F565800D3C70LNXP123MB2570GBRP_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SSBkb27igJl0IGhhdmUgYSBwcmVmZXJlbmNlIGZvciB3aGV0aGVyIHRoaXMgZHJhZnQgc2hvdWxk IGJlY29tZSBhIHdvcmtpbmcgZ3JvdXAgaXRlbSwgb3IgYmVjb21lIGFuIEFELXNwb25zb3JlZCBv ciBpbmRpdmlkdWFsIHN1Ym1pc3Npb27igIssIGJ1dCBpbiBhbnkgY2FzZSBpdCBjb250YWlucyBp bXBvcnRhbnQgYWRkaXRpb25zIHRvIHRoZSBzZWN1cml0eSBjb25zaWRlcmF0aW9ucyBvZiBSRkMg ODQ0Ni4gVGhlIHVzZS1jYXNlcyBpdCBkZXRhaWxzIGFyZSByZWFsLWxpZmUgc2NlbmFyaW9zIHdo ZXJlIHRoZSBpbnRyb2R1Y3Rpb24gb2YgVExTIDEuMyBpbiBwbGFjZSBvZiAxLjIgaGFzIGFuIGlt cGFjdCBvbiB0aGUgc2VjdXJpdHkgb2Ygc3lzdGVtcyAoYWNjb3JkaW5nIHRvIHRoZSB0aHJlYXQg bW9kZWwgb3V0bGluZWQgaW4gUkZDIDM1NTIgYW5kIHRoZSBhZGRpdGlvbmFsIG5vbi1Db21TZWMg dGhyZWF0cyB0aGF0IGhhdmUgYmVlbiBpZGVudGlmaWVkIHN1YnNlcXVlbnQgdG8gdGhlIHB1Ymxp Y2F0aW9uIG9mIFJGQyAzNTUyKTsgdGhlcmVmb3JlIHRoZXkgc2hvdWxkIGJlIGFjY3VyYXRlbHkg YW5kIHB1YmxpY2x5IHJlY29yZGVkLg0KDQotLSBNYXJrDQoNCg0KDQpPbiBTdW4sIEp1bCAyMSwg MjAxOSBhdCA2OjUxIEFNIE5hbmN5IENhbS1XaW5nZXQgKG5jYW13aW5nKSA8bmNhbXdpbmdAY2lz Y28uY29tPjxtYWlsdG86bmNhbXdpbmdAY2lzY28uY29tJTNlPjsgd3JvdGU6DQoNCg0KDQo+IEhp LA0KDQo+DQoNCj4gVGhhbmtzIHRvIGFsbCB0aGUgZmVlZGJhY2sgcHJvdmlkZWQsIHdlIGhhdmUg dXBkYXRlZCB0aGUNCg0KPiBodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQtY2Ftd2lu Z2V0LXRscy11c2UtY2FzZXMtMDQNCg0KPg0KDQo+IGRyYWZ0LiAgQXQgdGhpcyBwb2ludCwgd2Ug YmVsaWV2ZSB0aGUgZHJhZnQgaXMgc3RhYmxlIGFuZCB3b3VsZCBsaWtlIHRvDQoNCj4gcmVxdWVz dCBpdHMgcHVibGljYXRpb24gYXMgYW4gaW5mb3JtYXRpb25hbCBkcmFmdC4NCg0KPg0KDQo+DQoN Cj4NCg0KPiBXYXJtIHJlZ2FyZHMsDQoNCj4NCg0KPiAgICAgTmFuY3kNCg0KPg0KDQo+DQoNCj4N Cg0KPg0KDQo+IF9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f DQoNCj4gVExTIG1haWxpbmcgbGlzdA0KDQo+IFRMU0BpZXRmLm9yZzxtYWlsdG86VExTQGlldGYu b3JnPg0KDQo+IGh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vdGxzDQoNCg0K DQoNCg0KDQpUaGlzIGluZm9ybWF0aW9uIGlzIGV4ZW1wdCB1bmRlciB0aGUgRnJlZWRvbSBvZiBJ bmZvcm1hdGlvbiBBY3QgMjAwMCAoRk9JQSkgYW5kIG1heSBiZSBleGVtcHQgdW5kZXIgb3RoZXIg VUsgaW5mb3JtYXRpb24gbGVnaXNsYXRpb24uIFJlZmVyIGFueSBGT0lBIHF1ZXJpZXMgdG8gbmNz Y2luZm9sZWdAbmNzYy5nb3YudWsuIEFsbCBtYXRlcmlhbCBpcyBVSyBDcm93biBDb3B5cmlnaHQg wqkNCg0K --_000_LNXP123MB2570E01BA9FFF9412F565800D3C70LNXP123MB2570GBRP_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 V2luZ2RpbmdzOw0KCXBhbm9zZS0xOjUgMCAwIDAgMCAwIDAgMCAwIDA7fQ0KQGZvbnQtZmFjZQ0K CXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2IDMg MiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1 IDUgMiAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNvbnNvbGFzOw0K CXBhbm9zZS0xOjIgMTEgNiA5IDIgMiA0IDMgMiA0O30NCi8qIFN0eWxlIERlZmluaXRpb25zICov DQpwLk1zb05vcm1hbCwgbGkuTXNvTm9ybWFsLCBkaXYuTXNvTm9ybWFsDQoJe21hcmdpbjowY207 DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMS4wcHQ7DQoJZm9udC1mYW1p bHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0KYTpsaW5rLCBzcGFuLk1zb0h5cGVybGluaw0KCXtt c28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6IzA1NjNDMTsNCgl0ZXh0LWRlY29yYXRpb246 dW5kZXJsaW5lO30NCmE6dmlzaXRlZCwgc3Bhbi5Nc29IeXBlcmxpbmtGb2xsb3dlZA0KCXttc28t c3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6Izk1NEY3MjsNCgl0ZXh0LWRlY29yYXRpb246dW5k ZXJsaW5lO30NCnByZQ0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJbXNvLXN0eWxlLWxpbms6 IkhUTUwgUHJlZm9ybWF0dGVkIENoYXIiOw0KCW1hcmdpbjowY207DQoJbWFyZ2luLWJvdHRvbTou MDAwMXB0Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3Ijt9 DQpzcGFuLkVtYWlsU3R5bGUxNw0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1jb21wb3NlOw0K CWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0K c3Bhbi5IVE1MUHJlZm9ybWF0dGVkQ2hhcg0KCXttc28tc3R5bGUtbmFtZToiSFRNTCBQcmVmb3Jt YXR0ZWQgQ2hhciI7DQoJbXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCW1zby1zdHlsZS1saW5rOiJI VE1MIFByZWZvcm1hdHRlZCI7DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3IjsNCgltc28tZmFy ZWFzdC1sYW5ndWFnZTpFTi1HQjt9DQpwLnhtc29ub3JtYWwsIGxpLnhtc29ub3JtYWwsIGRpdi54 bXNvbm9ybWFsDQoJe21zby1zdHlsZS1uYW1lOnhfbXNvbm9ybWFsOw0KCW1hcmdpbjowY207DQoJ bWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMS4wcHQ7DQoJZm9udC1mYW1pbHk6 IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6 ZXhwb3J0LW9ubHk7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJbXNvLWZh cmVhc3QtbGFuZ3VhZ2U6RU4tVVM7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6NjEyLjBw dCA3OTIuMHB0Ow0KCW1hcmdpbjo3Mi4wcHQgNzIuMHB0IDcyLjBwdCA3Mi4wcHQ7fQ0KZGl2Lldv cmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQovKiBMaXN0IERlZmluaXRpb25zICov DQpAbGlzdCBsMA0KCXttc28tbGlzdC1pZDoxNjEyNDIwMTg7DQoJbXNvLWxpc3QtdHlwZTpoeWJy aWQ7DQoJbXNvLWxpc3QtdGVtcGxhdGUtaWRzOjcyOTgxOTQzNiAtMTYxMTEwNDgxNiAxMzQ4MDc1 NTUgMTM0ODA3NTU3IDEzNDgwNzU1MyAxMzQ4MDc1NTUgMTM0ODA3NTU3IDEzNDgwNzU1MyAxMzQ4 MDc1NTUgMTM0ODA3NTU3O30NCkBsaXN0IGwwOmxldmVsMQ0KCXttc28tbGV2ZWwtc3RhcnQtYXQ6 MDsNCgltc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674Gu Ow0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246 bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczsNCglt c28tZmFyZWFzdC1mb250LWZhbWlseTpDYWxpYnJpOw0KCW1zby1iaWRpLWZvbnQtZmFtaWx5OiJD b3VyaWVyIE5ldyI7fQ0KQGxpc3QgbDA6bGV2ZWwyDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0 OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDpvOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0K CW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0Ow0K CWZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyI7fQ0KQGxpc3QgbDA6bGV2ZWwzDQoJe21zby1sZXZl bC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVs LXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQt aW5kZW50Oi0xOC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwwOmxldmVs NA0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3 Ow0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246 bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0Ow0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlz dCBsMDpsZXZlbDUNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZl bC10ZXh0Om87DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1w b3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJZm9udC1mYW1pbHk6IkNvdXJp ZXIgTmV3Ijt9DQpAbGlzdCBsMDpsZXZlbDYNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVs bGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCglt c28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDsNCglm b250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDA6bGV2ZWw3DQoJe21zby1sZXZlbC1udW1i ZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1z dG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50 Oi0xOC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwwOmxldmVsOA0KCXttc28t bGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6bzsNCgltc28tbGV2 ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4 dC1pbmRlbnQ6LTE4LjBwdDsNCglmb250LWZhbWlseToiQ291cmllciBOZXciO30NCkBsaXN0IGww OmxldmVsOQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRl eHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9z aXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5n czt9DQpvbA0KCXttYXJnaW4tYm90dG9tOjBjbTt9DQp1bA0KCXttYXJnaW4tYm90dG9tOjBjbTt9 DQotLT48L3N0eWxlPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVkZWZhdWx0cyB2 OmV4dD0iZWRpdCIgc3BpZG1heD0iMTAyNiIgLz4NCjwveG1sPjwhW2VuZGlmXS0tPjwhLS1baWYg Z3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVsYXlvdXQgdjpleHQ9ImVkaXQiPg0KPG86aWRtYXAg djpleHQ9ImVkaXQiIGRhdGE9IjEiIC8+DQo8L286c2hhcGVsYXlvdXQ+PC94bWw+PCFbZW5kaWZd LS0+DQo8L2hlYWQ+DQo8Ym9keSBsYW5nPSJFTi1HQiIgbGluaz0iIzA1NjNDMSIgdmxpbms9IiM5 NTRGNzIiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIHN0eWxlPSJiYWNrZ3JvdW5k OndoaXRlIj48c3BhbiBzdHlsZT0iY29sb3I6IzMyMzEzMCI+SSBkb27igJl0IGhhdmUgYSBwcmVm ZXJlbmNlIGZvciB3aGV0aGVyIHRoaXMgZHJhZnQgc2hvdWxkIGJlY29tZSBhIHdvcmtpbmcgZ3Jv dXAgaXRlbSwgb3IgYmVjb21lIGFuIEFELXNwb25zb3JlZCBvciBpbmRpdmlkdWFsIHN1Ym1pc3Np b248L3NwYW4+PHNwYW4gc3R5bGU9ImNvbG9yOiNDODI2MTMiPuKAiywNCjwvc3Bhbj48c3BhbiBz dHlsZT0iY29sb3I6YmxhY2siPmJ1dCBpbiBhbnkgY2FzZSBpdCBjb250YWlucyBpbXBvcnRhbnQg YWRkaXRpb25zIHRvIHRoZSBzZWN1cml0eSBjb25zaWRlcmF0aW9ucyBvZiBSRkMgODQ0Njwvc3Bh bj48c3BhbiBzdHlsZT0iY29sb3I6IzMyMzEzMCI+LiBUaGUgdXNlLWNhc2VzIGl0IGRldGFpbHMg YXJlIHJlYWwtbGlmZSBzY2VuYXJpb3Mgd2hlcmUgdGhlIGludHJvZHVjdGlvbiBvZiBUTFMgMS4z IGluIHBsYWNlIG9mIDEuMg0KIGhhcyBhbiBpbXBhY3Qgb24gdGhlIHNlY3VyaXR5IG9mIHN5c3Rl bXMgKGFjY29yZGluZyB0byB0aGUgdGhyZWF0IG1vZGVsIG91dGxpbmVkIGluIFJGQyAzNTUyIGFu ZCB0aGUgYWRkaXRpb25hbCBub24tQ29tU2VjIHRocmVhdHMgdGhhdCBoYXZlIGJlZW4gaWRlbnRp ZmllZCBzdWJzZXF1ZW50IHRvIHRoZSBwdWJsaWNhdGlvbiBvZiBSRkMNCjwvc3Bhbj48c3BhbiBz dHlsZT0iY29sb3I6YmxhY2siPjM1NTIpOyB0aGVyZWZvcmUgdGhleSBzaG91bGQgYmUgYWNjdXJh dGVseSBhbmQgcHVibGljbHkgcmVjb3JkZWQuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgc3R5 bGU9ImJhY2tncm91bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+LS0gTWFyazxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj48c3BhbiBz dHlsZT0iY29sb3I6YmxhY2siPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwcmUgc3R5 bGU9ImJhY2tncm91bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1m YW1pbHk6Q29uc29sYXM7Y29sb3I6IzIxMjUyOSI+T24gU3VuLCBKdWwgMjEsIDIwMTkgYXQgNjo1 MSBBTSBOYW5jeSBDYW0tV2luZ2V0IChuY2Ftd2luZykgJmx0OzxhIGhyZWY9Im1haWx0bzpuY2Ft d2luZ0BjaXNjby5jb20lM2UiPm5jYW13aW5nQGNpc2NvLmNvbSZndDs8L2E+OyB3cm90ZTo8L3Nw YW4+PG86cD48L286cD48L3ByZT4NCjxwcmUgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6Q29uc29sYXM7Y29sb3I6IzIxMjUy OSI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlIHN0eWxlPSJiYWNrZ3JvdW5k OndoaXRlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OkNvbnNvbGFz O2NvbG9yOiMyMTI1MjkiPiZndDsgSGksPC9zcGFuPjxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlIHN0 eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQt ZmFtaWx5OkNvbnNvbGFzO2NvbG9yOiMyMTI1MjkiPiZndDsmbmJzcDs8L3NwYW4+PG86cD48L286 cD48L3ByZT4NCjxwcmUgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6Q29uc29sYXM7Y29sb3I6IzIxMjUyOSI+Jmd0OyBUaGFu a3MgdG8gYWxsIHRoZSBmZWVkYmFjayBwcm92aWRlZCwgd2UgaGF2ZSB1cGRhdGVkIHRoZTwvc3Bh bj48bzpwPjwvbzpwPjwvcHJlPg0KPHByZSBzdHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTpDb25zb2xhcztjb2xvcjojMjEyNTI5 Ij4mZ3Q7IDxhIGhyZWY9Imh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1jYW13aW5n ZXQtdGxzLXVzZS1jYXNlcy0wNCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMzMzdBQjciPmh0dHBzOi8v dG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1jYW13aW5nZXQtdGxzLXVzZS1jYXNlcy0wNDwvc3Bh bj48L2E+PC9zcGFuPjxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlIHN0eWxlPSJiYWNrZ3JvdW5kOndo aXRlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OkNvbnNvbGFzO2Nv bG9yOiMyMTI1MjkiPiZndDsmbmJzcDs8L3NwYW4+PG86cD48L286cD48L3ByZT4NCjxwcmUgc3R5 bGU9ImJhY2tncm91bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1m YW1pbHk6Q29uc29sYXM7Y29sb3I6IzIxMjUyOSI+Jmd0OyBkcmFmdC4mbmJzcDsgQXQgdGhpcyBw b2ludCwgd2UgYmVsaWV2ZSB0aGUgZHJhZnQgaXMgc3RhYmxlIGFuZCB3b3VsZCBsaWtlIHRvPC9z cGFuPjxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OkNvbnNvbGFzO2NvbG9yOiMyMTI1 MjkiPiZndDsgcmVxdWVzdCBpdHMgcHVibGljYXRpb24gYXMgYW4gaW5mb3JtYXRpb25hbCBkcmFm dC48L3NwYW4+PG86cD48L286cD48L3ByZT4NCjxwcmUgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6Q29uc29sYXM7Y29sb3I6 IzIxMjUyOSI+Jmd0OyZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcHJlPg0KPHByZSBzdHlsZT0i YmFja2dyb3VuZDp3aGl0ZSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWls eTpDb25zb2xhcztjb2xvcjojMjEyNTI5Ij4mZ3Q7Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9w cmU+DQo8cHJlIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjkuMHB0O2ZvbnQtZmFtaWx5OkNvbnNvbGFzO2NvbG9yOiMyMTI1MjkiPiZndDsmbmJzcDs8L3Nw YW4+PG86cD48L286cD48L3ByZT4NCjxwcmUgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6Q29uc29sYXM7Y29sb3I6IzIxMjUy OSI+Jmd0OyBXYXJtIHJlZ2FyZHMsPC9zcGFuPjxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlIHN0eWxl PSJiYWNrZ3JvdW5kOndoaXRlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFt aWx5OkNvbnNvbGFzO2NvbG9yOiMyMTI1MjkiPiZndDsmbmJzcDs8L3NwYW4+PG86cD48L286cD48 L3ByZT4NCjxwcmUgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6OS4wcHQ7Zm9udC1mYW1pbHk6Q29uc29sYXM7Y29sb3I6IzIxMjUyOSI+Jmd0OyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyBOYW5jeTwvc3Bhbj48bzpwPjwvbzpwPjwvcHJlPg0KPHByZSBzdHls ZT0iYmFja2dyb3VuZDp3aGl0ZSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZh bWlseTpDb25zb2xhcztjb2xvcjojMjEyNTI5Ij4mZ3Q7Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+ PC9wcmU+DQo8cHJlIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjkuMHB0O2ZvbnQtZmFtaWx5OkNvbnNvbGFzO2NvbG9yOiMyMTI1MjkiPiZndDsmbmJzcDs8 L3NwYW4+PG86cD48L286cD48L3ByZT4NCjxwcmUgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6Q29uc29sYXM7Y29sb3I6IzIx MjUyOSI+Jmd0OyZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcHJlPg0KPHByZSBzdHlsZT0iYmFj a2dyb3VuZDp3aGl0ZSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTpD b25zb2xhcztjb2xvcjojMjEyNTI5Ij4mZ3Q7Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wcmU+ DQo8cHJlIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjku MHB0O2ZvbnQtZmFtaWx5OkNvbnNvbGFzO2NvbG9yOiMyMTI1MjkiPiZndDsgX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX188L3NwYW4+PG86cD48L286cD48L3By ZT4NCjxwcmUgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 OS4wcHQ7Zm9udC1mYW1pbHk6Q29uc29sYXM7Y29sb3I6IzIxMjUyOSI+Jmd0OyBUTFMgbWFpbGlu ZyBsaXN0PC9zcGFuPjxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlIHN0eWxlPSJiYWNrZ3JvdW5kOndo aXRlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OkNvbnNvbGFzO2Nv bG9yOiMyMTI1MjkiPiZndDsgPGEgaHJlZj0ibWFpbHRvOlRMU0BpZXRmLm9yZyI+PHNwYW4gc3R5 bGU9ImNvbG9yOiMzMzdBQjciPlRMU0BpZXRmLm9yZzwvc3Bhbj48L2E+PC9zcGFuPjxvOnA+PC9v OnA+PC9wcmU+DQo8cHJlIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OkNvbnNvbGFzO2NvbG9yOiMyMTI1MjkiPiZndDsgPGEg aHJlZj0iaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby90bHMiPjxzcGFuIHN0 eWxlPSJjb2xvcjojMzM3QUI3Ij5odHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZv L3Rsczwvc3Bhbj48L2E+PG86cD48L286cD48L3NwYW4+PC9wcmU+DQo8cHJlIHN0eWxlPSJiYWNr Z3JvdW5kOndoaXRlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OkNv bnNvbGFzO2NvbG9yOiMyMTI1MjkiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcHJlPg0KPHBy ZSBzdHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+PG86cD4mbmJzcDs8L286cD48L3ByZT4NCjxwcmUg c3R5bGU9ImJhY2tncm91bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9u dC1mYW1pbHk6Q29uc29sYXM7Y29sb3I6IzIxMjUyOSI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+ PC9wcmU+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5UaGlzIGluZm9ybWF0aW9uIGlzIGV4ZW1wdCB1 bmRlciB0aGUgRnJlZWRvbSBvZiBJbmZvcm1hdGlvbiBBY3QgMjAwMCAoRk9JQSkgYW5kIG1heSBi ZSBleGVtcHQgdW5kZXIgb3RoZXIgVUsgaW5mb3JtYXRpb24gbGVnaXNsYXRpb24uIFJlZmVyIGFu eSBGT0lBIHF1ZXJpZXMgdG8gbmNzY2luZm9sZWdAbmNzYy5nb3YudWsuIEFsbCBtYXRlcmlhbCBp cyBVSyBDcm93biBDb3B5cmlnaHQgwqkNCjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9Im1zby1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTIj48bzpwPiZuYnNw OzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_LNXP123MB2570E01BA9FFF9412F565800D3C70LNXP123MB2570GBRP_-- From nobody Tue Jul 23 13:46:59 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 51B5D120159 for ; Tue, 23 Jul 2019 13:46:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.299 X-Spam-Level: X-Spam-Status: No, score=-4.299 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); domainkeys=pass (1024-bit key) header.from=MAckermann@bcbsm.com header.d=bcbsm.com; dkim=pass (1024-bit key) header.d=bcbsm.com header.b=Pzjlxnoo; dkim=fail (1024-bit key) reason="fail (body has been altered)" header.d=bcbsm.onmicrosoft.com header.b=TsuiV4Ru Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eW0-R8ovp7Q1 for ; Tue, 23 Jul 2019 13:46:47 -0700 (PDT) Received: from mx.z120.zixworks.com (bcbsm.zixworks.com [199.30.235.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0E634120986 for ; Tue, 23 Jul 2019 13:46:47 -0700 (PDT) Received: from 127.0.0.1 (ZixVPM [127.0.0.1]) by Outbound.z120.zixworks.com (Proprietary) with SMTP id 7CDA71C4619 for ; Tue, 23 Jul 2019 15:46:46 -0500 (CDT) DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=ZIXVPM1670e2ded26; d=bcbsm.com; h=From:To:Subject:Date; b=meALcuZmUPNdo5tCokFhb7iLvMWtNvjsY9C10KID0Y3bvExzS6jB4JuKG1ZQVSfX U2wbgGDALQ+mCF+pvj82CerB6pHftlWgTPrWqH4hys9Sn0Rig9c3cMCxJqEhxo yOhq3b+cXqZlJOjeghH1PxOOawpG1U6TxDaONTzswvc24=; DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bcbsm.com; s=ZIXVPM1670e2ded26; t=1563914806; bh=MKO6LsmN6dFPfbKjZcdjftQLDtUQC4w9Gzm3s+NxX0k=; h=From:To:Subject:Date; b=PzjlxnoowBc6GfB3lpco+iTui0FnpPfriDSA7FcTBksnLPJUQJXb1/ZTJjb4n3+pS uY5rUM/e43pOPcEe9+wbLaPyToF9Ezm7uLTqNetIJ9djqVgKpCJ9LYxk7T4wRi9L9q DfcyDj+Cgqbkwx9QSFAjHLJwfC0z9sgrb0ZOu/wE= Received: from imsva1.bcbsm.com (inetmta03.bcbsm.com [12.107.172.80]) by mx.z120.zixworks.com (Proprietary) with SMTP id 06ED21C45C4; Tue, 23 Jul 2019 15:46:44 -0500 (CDT) Received: from imsva1.bcbsm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id C31BE9206A; Tue, 23 Jul 2019 16:46:44 -0400 (EDT) Received: from imsva1.bcbsm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 6001B92053; Tue, 23 Jul 2019 16:46:44 -0400 (EDT) Received: from NAM05-BY2-obe.outbound.protection.outlook.com (unknown [104.47.50.56]) by imsva1.bcbsm.com (Postfix) with ESMTPS; Tue, 23 Jul 2019 16:46:44 -0400 (EDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=et2aHMG1lEsZfbdaL3VXrDa774+ciWPhhg0K56evl6kIaaFkMOYdQY6LRNtYYVUgnhCTj9n7ZwsDH7ffd65JFAsl2IABiC81XlwTZPlMsKhd4tn1YuvZAmHE1Cs/g1mbEkZHoTvuBlBg9lDGODRLGuzO28lJXACcRwPf6xxroryzIfZ+b6P2gVMVAwpsrViMDcJ4IH7tAZ6aYm43mWbrojSDOTiIJoM80Y98aj1Lyp/eFjzdtNtFq5FDyLs3DoRQSurzX/WoQogs/LGfNkWvtQQq1ye7HiucKHoh4RvmogdaTJYnXF9pIktla6Qx+a2aM4VdyHeLnhw/kSlOEAlV/w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=NNCl62rc9itYpKL1hsfqG3JdRZgEqLlazuJWM+VlHkg=; b=R+ATdsOK+15iU3PgJoMJE7k12kvKPHKh9NvKgIUpqGp7JfVReLOcTXzNuogzj0IF10rYEKoUyRF55STwMAGaR9y3RVOlJb424mTbwoyczzH/laqLk4hPI94mPOE2i04CjLYHb8r+/AXraR61AyPZrbWB0JBnWIYt3iY7SKHPN/uFOIyCjLlDtL0t0wCzmGQanw8ujUqsl3xuJP+ghBBmI2aVN/f0sGu9SFIC8XkS8uXQqQr1bqetuwXUb1IpEZeWBYgtXFEs7tyu1zla4/QsXNbOjHOVFuTS7LGJa12G0a6mSeUy+uD0l0WtCE1sMJkzsxfAM0MpGw8n4WYPXCpeAQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1;spf=pass smtp.mailfrom=bcbsm.com;dmarc=pass action=none header.from=bcbsm.com;dkim=pass header.d=bcbsm.com;arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bcbsm.onmicrosoft.com; s=selector1-bcbsm-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=NNCl62rc9itYpKL1hsfqG3JdRZgEqLlazuJWM+VlHkg=; b=TsuiV4Ru7wBXhvg3JXe1fftZeHhy43W4CxaV48cGmhOALpjij/vT/xzmWwe0cZa3ZsVi4PtYQGbTeyqtNKul7tQjX3eOqNwadUpozXT9OHTTY7mbb3a8ge3Bpz4s9627PFgqS8b6HAptQEQ1UgGunyVDQFnbwZdYy0c2Cf4wtbA= Received: from DM6PR14MB2474.namprd14.prod.outlook.com (20.177.221.205) by DM6PR14MB3632.namprd14.prod.outlook.com (20.179.166.23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2094.17; Tue, 23 Jul 2019 20:46:42 +0000 Received: from DM6PR14MB2474.namprd14.prod.outlook.com ([fe80::168:5560:a095:93e3]) by DM6PR14MB2474.namprd14.prod.outlook.com ([fe80::168:5560:a095:93e3%7]) with mapi id 15.20.2094.013; Tue, 23 Jul 2019 20:46:42 +0000 From: "Ackermann, Michael" To: Mark O , "tls@ietf.org" Thread-Topic: Re: [TLS] TLS Impact on Network Security draft updated Thread-Index: AdVBlEsEpQQ4zuheRNyyIiMVYmF2vAAAsnSw Date: Tue, 23 Jul 2019 20:46:42 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=MAckermann@bcbsm.com; x-originating-ip: [165.225.39.74] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 89bf015f-a4ca-4d11-11fe-08d70faede87 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(7168020)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(2017052603328)(7167020)(7193020); SRVR:DM6PR14MB3632; x-ms-traffictypediagnostic: DM6PR14MB3632: x-ms-exchange-purlcount: 4 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-forefront-prvs: 0107098B6C x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(136003)(396003)(346002)(39860400002)(366004)(376002)(199004)(189003)(54164003)(64756008)(8676002)(76176011)(71190400001)(110136005)(71200400001)(81156014)(2906002)(102836004)(7736002)(81166006)(316002)(8936002)(186003)(33656002)(486006)(15650500001)(11346002)(446003)(6116002)(7696005)(74316002)(99286004)(7110500001)(790700001)(966005)(53546011)(2420400007)(6506007)(68736007)(5024004)(14444005)(55236004)(3846002)(256004)(52536014)(25786009)(6306002)(55016002)(9686003)(606006)(478600001)(476003)(2501003)(236005)(6246003)(86362001)(14454004)(53936002)(66066001)(229853002)(66946007)(26005)(5660300002)(66556008)(66446008)(66476007)(54896002)(76116006)(80792005)(6436002); DIR:OUT; SFP:1102; SCL:1; SRVR:DM6PR14MB3632; H:DM6PR14MB2474.namprd14.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: bcbsm.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: Rd7EM507T/2YYB1Al2yFjUoQ2C/U2ovEepDF5FhffENCRZi6x44s/vFttBmOfk/rM8skx36VWTWEmvUuJ1Qo9bWekGIZbM8aQVyogrkvUIVeMCIDFUCFeprDadqWphJZqSYmJ8+gxVq7wg9wT8I/Cnz/QKpBOH9UBhVPMgVUcm4WsCxFHrvf33zjJd7AWzxq8Cx0PTL0T746OQFLFwk4wosSCRrkuqRgv9Zrk22Vv118bche6f2N4DCcjAP8QU74v1nX/34U6UlAeVMBE68tpfhgOMB+Frce1niCC7jzdjVPZCvcmcTFqodKTCbzUhZ1dKbMIhPiUXNFLSIFOfYTpBf5apA1AJAAEHl2WowEMZilX6jSiHUYdpJ89Ao+ff73Dnb8tyQi8OapeFGXkK0AqkfToWB237pnYAX5Q0+f9ps= Content-Type: multipart/alternative; boundary="_000_DM6PR14MB24748FF357654E2971904BFFD7C70DM6PR14MB2474namp_" MIME-Version: 1.0 X-OriginatorOrg: bcbsm.com X-MS-Exchange-CrossTenant-Network-Message-Id: 89bf015f-a4ca-4d11-11fe-08d70faede87 X-MS-Exchange-CrossTenant-originalarrivaltime: 23 Jul 2019 20:46:42.6605 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 6f56d3fa-5682-4261-b169-bc0d615da17c X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: MAckermann@bcbsm.com X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR14MB3632 X-TM-AS-GCONF: 00 X-VPM-HOST: vmvpm01.z120.zixworks.com X-VPM-GROUP-ID: fc2df9f5-4dd6-4da5-8930-de8d93c9c5d7 X-VPM-MSG-ID: 423b7aad-3f58-4399-bf0d-fbcec52c7206 X-VPM-ENC-REGIME: Plaintext X-VPM-IS-HYBRID: 0 Archived-At: Subject: Re: [TLS] TLS Impact on Network Security draft updated X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 Jul 2019 20:46:58 -0000 --_000_DM6PR14MB24748FF357654E2971904BFFD7C70DM6PR14MB2474namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 KzENCkFuZCBJIHdvdWxkIGFkZCB0aGF0IHRoZSBwZXJ2YXNpdmUgZWZmZWN0cyBvZiBlbmNy eXB0aW9uIGFyZSBub3QgbGltaXRlZCB0byBzZWN1cml0eSBvZiBzeXN0ZW1zLCAgYnV0IGxp bWl0IHRoZSBhYmlsaXRpZXMgb2Ygb3RoZXIgc3lzdGVtIG1hbmFnZW1lbnQsIG1vbml0b3Jp bmcgYW5kIGRpYWdub3N0aWMgcGxhdGZvcm1zIGFzIHdlbGwuDQoNCg0KRnJvbTogVExTIDx0 bHMtYm91bmNlc0BpZXRmLm9yZz4gT24gQmVoYWxmIE9mIE1hcmsgTw0KU2VudDogVHVlc2Rh eSwgSnVseSAyMywgMjAxOSA0OjI4IFBNDQpUbzogdGxzQGlldGYub3JnDQpTdWJqZWN0OiBS ZTogW1RMU10gVExTIEltcGFjdCBvbiBOZXR3b3JrIFNlY3VyaXR5IGRyYWZ0IHVwZGF0ZWQN Cg0KIEFMRVJUIFRoaXMgZW1haWwgd2FzIHNlbnQgZnJvbSBhIHNvdXJjZSBleHRlcm5hbCB0 byBCQ0JTTS9CQ04uDQogRE8gTk9UIENMSUNLIGxpbmtzIG9yIGF0dGFjaG1lbnRzIHVubGVz cyB5b3UgcmVjb2duaXplIHRoZSBzZW5kZXIgYW5kIHRydXN0IHRoZSBjb250ZW50Lg0KDQoN CkkgZG9u4oCZdCBoYXZlIGEgcHJlZmVyZW5jZSBmb3Igd2hldGhlciB0aGlzIGRyYWZ0IHNo b3VsZCBiZWNvbWUgYSB3b3JraW5nIGdyb3VwIGl0ZW0sIG9yIGJlY29tZSBhbiBBRC1zcG9u c29yZWQgb3IgaW5kaXZpZHVhbCBzdWJtaXNzaW9u4oCLLCBidXQgaW4gYW55IGNhc2UgaXQg Y29udGFpbnMgaW1wb3J0YW50IGFkZGl0aW9ucyB0byB0aGUgc2VjdXJpdHkgY29uc2lkZXJh dGlvbnMgb2YgUkZDIDg0NDYuIFRoZSB1c2UtY2FzZXMgaXQgZGV0YWlscyBhcmUgcmVhbC1s aWZlIHNjZW5hcmlvcyB3aGVyZSB0aGUgaW50cm9kdWN0aW9uIG9mIFRMUyAxLjMgaW4gcGxh Y2Ugb2YgMS4yIGhhcyBhbiBpbXBhY3Qgb24gdGhlIHNlY3VyaXR5IG9mIHN5c3RlbXMgKGFj Y29yZGluZyB0byB0aGUgdGhyZWF0IG1vZGVsIG91dGxpbmVkIGluIFJGQyAzNTUyIGFuZCB0 aGUgYWRkaXRpb25hbCBub24tQ29tU2VjIHRocmVhdHMgdGhhdCBoYXZlIGJlZW4gaWRlbnRp ZmllZCBzdWJzZXF1ZW50IHRvIHRoZSBwdWJsaWNhdGlvbiBvZiBSRkMgMzU1Mik7IHRoZXJl Zm9yZSB0aGV5IHNob3VsZCBiZSBhY2N1cmF0ZWx5IGFuZCBwdWJsaWNseSByZWNvcmRlZC4N Cg0KLS0gTWFyaw0KDQoNCg0KT24gU3VuLCBKdWwgMjEsIDIwMTkgYXQgNjo1MSBBTSBOYW5j eSBDYW0tV2luZ2V0IChuY2Ftd2luZykgPG5jYW13aW5nQGNpc2NvLmNvbT48bWFpbHRvOm5j YW13aW5nQGNpc2NvLmNvbSUzZT47IHdyb3RlOg0KDQoNCg0KPiBIaSwNCg0KPg0KDQo+IFRo YW5rcyB0byBhbGwgdGhlIGZlZWRiYWNrIHByb3ZpZGVkLCB3ZSBoYXZlIHVwZGF0ZWQgdGhl DQoNCj4gaHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LWNhbXdpbmdldC10bHMt dXNlLWNhc2VzLTA0DQoNCj4NCg0KPiBkcmFmdC4gIEF0IHRoaXMgcG9pbnQsIHdlIGJlbGll dmUgdGhlIGRyYWZ0IGlzIHN0YWJsZSBhbmQgd291bGQgbGlrZSB0bw0KDQo+IHJlcXVlc3Qg aXRzIHB1YmxpY2F0aW9uIGFzIGFuIGluZm9ybWF0aW9uYWwgZHJhZnQuDQoNCj4NCg0KPg0K DQo+DQoNCj4gV2FybSByZWdhcmRzLA0KDQo+DQoNCj4gICAgIE5hbmN5DQoNCj4NCg0KPg0K DQo+DQoNCj4NCg0KPiBfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fXw0KDQo+IFRMUyBtYWlsaW5nIGxpc3QNCg0KPiBUTFNAaWV0Zi5vcmc8bWFpbHRv OlRMU0BpZXRmLm9yZz4NCg0KPiBodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3Rp bmZvL3Rscw0KDQoNCg0KDQoNCg0KVGhpcyBpbmZvcm1hdGlvbiBpcyBleGVtcHQgdW5kZXIg dGhlIEZyZWVkb20gb2YgSW5mb3JtYXRpb24gQWN0IDIwMDAgKEZPSUEpIGFuZCBtYXkgYmUg ZXhlbXB0IHVuZGVyIG90aGVyIFVLIGluZm9ybWF0aW9uIGxlZ2lzbGF0aW9uLiBSZWZlciBh bnkgRk9JQSBxdWVyaWVzIHRvIG5jc2NpbmZvbGVnQG5jc2MuZ292LnVrPG1haWx0bzpuY3Nj aW5mb2xlZ0BuY3NjLmdvdi51az4uIEFsbCBtYXRlcmlhbCBpcyBVSyBDcm93biBDb3B5cmln aHQgwqkNCg0KCgpUaGUgaW5mb3JtYXRpb24gY29udGFpbmVkIGluIHRoaXMgY29tbXVuaWNh dGlvbiBpcyBoaWdobHkgY29uZmlkZW50aWFsIGFuZCBpcyBpbnRlbmRlZCBzb2xlbHkgZm9y IHRoZSB1c2Ugb2YgdGhlIGluZGl2aWR1YWwocykgdG8gd2hvbSB0aGlzIGNvbW11bmljYXRp b24gaXMgZGlyZWN0ZWQuIElmIHlvdSBhcmUgbm90IHRoZSBpbnRlbmRlZCByZWNpcGllbnQs IHlvdSBhcmUgaGVyZWJ5IG5vdGlmaWVkIHRoYXQgYW55IHZpZXdpbmcsIGNvcHlpbmcsIGRp c2Nsb3N1cmUgb3IgZGlzdHJpYnV0aW9uIG9mIHRoaXMgaW5mb3JtYXRpb24gaXMgcHJvaGli aXRlZC4gUGxlYXNlIG5vdGlmeSB0aGUgc2VuZGVyLCBieSBlbGVjdHJvbmljIG1haWwgb3Ig dGVsZXBob25lLCBvZiBhbnkgdW5pbnRlbmRlZCByZWNlaXB0IGFuZCBkZWxldGUgdGhlIG9y aWdpbmFsIG1lc3NhZ2Ugd2l0aG91dCBtYWtpbmcgYW55IGNvcGllcy4KIAogQmx1ZSBDcm9z cyBCbHVlIFNoaWVsZCBvZiBNaWNoaWdhbiBhbmQgQmx1ZSBDYXJlIE5ldHdvcmsgb2YgTWlj aGlnYW4gYXJlIG5vbnByb2ZpdCBjb3Jwb3JhdGlvbnMgYW5kIGluZGVwZW5kZW50IGxpY2Vu c2VlcyBvZiB0aGUgQmx1ZSBDcm9zcyBhbmQgQmx1ZSBTaGllbGQgQXNzb2NpYXRpb24uCg== --_000_DM6PR14MB24748FF357654E2971904BFFD7C70DM6PR14MB2474namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89 InVybjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJu OnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3Nj aGVtYXMubWljcm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDov L3d3dy53My5vcmcvVFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9 IkNvbnRlbnQtVHlwZSIgY29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxt ZXRhIG5hbWU9IkdlbmVyYXRvciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRl cmVkIG1lZGl1bSkiPg0KPHN0eWxlPjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBm b250LWZhY2UNCgl7Zm9udC1mYW1pbHk6IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0 IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7 DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250 LWZhbWlseTpDb25zb2xhczsNCglwYW5vc2UtMToyIDExIDYgOSAyIDIgNCAzIDIgNDt9DQov KiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1hbCwgZGl2 Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglm b250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30N CmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0K CWNvbG9yOiMwNTYzQzE7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQphOnZpc2l0 ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5 Ow0KCWNvbG9yOiM5NTRGNzI7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwcmUN Cgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCW1zby1zdHlsZS1saW5rOiJIVE1MIFByZWZv cm1hdHRlZCBDaGFyIjsNCgltYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsN Cglmb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyI7fQ0Kc3Bh bi5IVE1MUHJlZm9ybWF0dGVkQ2hhcg0KCXttc28tc3R5bGUtbmFtZToiSFRNTCBQcmVmb3Jt YXR0ZWQgQ2hhciI7DQoJbXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCW1zby1zdHlsZS1saW5r OiJIVE1MIFByZWZvcm1hdHRlZCI7DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3IjsNCglt c28tZmFyZWFzdC1sYW5ndWFnZTpFTi1HQjt9DQpwLm1zb25vcm1hbDAsIGxpLm1zb25vcm1h bDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCgltc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTEuMHB0 Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnAueG1zb25vcm1hbCwg bGkueG1zb25vcm1hbCwgZGl2Lnhtc29ub3JtYWwNCgl7bXNvLXN0eWxlLW5hbWU6eF9tc29u b3JtYWw7DQoJbWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1z aXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQpzcGFu LkVtYWlsU3R5bGUyMQ0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbDsNCglmb250LWZhbWls eToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjp3aW5kb3d0ZXh0O30NCnNwYW4uRW1h aWxTdHlsZTI0DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFt aWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0KLk1zb0No cERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1zaXplOjEw LjBwdDt9DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo4LjVpbiAxMS4waW47DQoJbWFy Z2luOjEuMGluIDEuMGluIDEuMGluIDEuMGluO30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7cGFn ZTpXb3JkU2VjdGlvbjE7fQ0KLS0+PC9zdHlsZT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4N CjxvOnNoYXBlZGVmYXVsdHMgdjpleHQ9ImVkaXQiIHNwaWRtYXg9IjEwMjYiIC8+DQo8L3ht bD48IVtlbmRpZl0tLT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlbGF5b3V0 IHY6ZXh0PSJlZGl0Ij4NCjxvOmlkbWFwIHY6ZXh0PSJlZGl0IiBkYXRhPSIxIiAvPg0KPC9v OnNoYXBlbGF5b3V0PjwveG1sPjwhW2VuZGlmXS0tPg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0i RU4tVVMiIGxpbms9IiMwNTYzQzEiIHZsaW5rPSIjOTU0RjcyIj4NCjxkaXYgY2xhc3M9Ildv cmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mIzQzOzE8bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkFuZCBJIHdvdWxkIGFkZCB0aGF0IHRoZSBwZXJ2 YXNpdmUgZWZmZWN0cyBvZiBlbmNyeXB0aW9uIGFyZSBub3QgbGltaXRlZCB0byBzZWN1cml0 eSBvZiBzeXN0ZW1zLCZuYnNwOyBidXQgbGltaXQgdGhlIGFiaWxpdGllcyBvZiBvdGhlciBz eXN0ZW0gbWFuYWdlbWVudCwgbW9uaXRvcmluZyBhbmQgZGlhZ25vc3RpYyBwbGF0Zm9ybXMg YXMgd2VsbC4NCjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7 PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpw PjwvcD4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlk ICNFMUUxRTEgMS4wcHQ7cGFkZGluZzozLjBwdCAwaW4gMGluIDBpbiI+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48Yj5Gcm9tOjwvYj4gVExTICZsdDt0bHMtYm91bmNlc0BpZXRmLm9yZyZn dDsgPGI+T24gQmVoYWxmIE9mIDwvYj4NCk1hcmsgTzxicj4NCjxiPlNlbnQ6PC9iPiBUdWVz ZGF5LCBKdWx5IDIzLCAyMDE5IDQ6MjggUE08YnI+DQo8Yj5Ubzo8L2I+IHRsc0BpZXRmLm9y Zzxicj4NCjxiPlN1YmplY3Q6PC9iPiBSZTogW1RMU10gVExTIEltcGFjdCBvbiBOZXR3b3Jr IFNlY3VyaXR5IGRyYWZ0IHVwZGF0ZWQ8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIGFsaWduPSJjZW50ZXIiIHN0eWxlPSJ0ZXh0LWFsaWduOmNlbnRlcjts aW5lLWhlaWdodDoxMjAlIj48Yj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6 ZToxMi41cHQ7bGluZS1oZWlnaHQ6MTIwJTtjb2xvcjpyZWQ7YmFja2dyb3VuZDp5ZWxsb3c7 bXNvLWhpZ2hsaWdodDp5ZWxsb3ciPiZuYnNwO0FMRVJUPC9zcGFuPjwvYj48c3BhbiBsYW5n PSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZToxMi41cHQ7bGluZS1oZWlnaHQ6MTIwJTtjb2xv cjpibGFjaztiYWNrZ3JvdW5kOnllbGxvdzttc28taGlnaGxpZ2h0OnllbGxvdyI+DQogVGhp cyBlbWFpbCB3YXMgc2VudCBmcm9tIGEgc291cmNlIGV4dGVybmFsIHRvIEJDQlNNL0JDTi4g PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgYWxpZ249ImNl bnRlciIgc3R5bGU9InRleHQtYWxpZ246Y2VudGVyO2xpbmUtaGVpZ2h0OjEyMCUiPjxiPjxz cGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjEyLjVwdDtsaW5lLWhlaWdodDox MjAlO2NvbG9yOnJlZDtiYWNrZ3JvdW5kOnllbGxvdzttc28taGlnaGxpZ2h0OnllbGxvdyI+ Jm5ic3A7RE8gTk9UIENMSUNLPC9zcGFuPjwvYj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9 ImZvbnQtc2l6ZToxMi41cHQ7bGluZS1oZWlnaHQ6MTIwJTtjb2xvcjpyZWQ7YmFja2dyb3Vu ZDp5ZWxsb3c7bXNvLWhpZ2hsaWdodDp5ZWxsb3ciPg0KPC9zcGFuPjxzcGFuIGxhbmc9IkVO LUdCIiBzdHlsZT0iZm9udC1zaXplOjEyLjVwdDtsaW5lLWhlaWdodDoxMjAlO2NvbG9yOmJs YWNrO2JhY2tncm91bmQ6eWVsbG93O21zby1oaWdobGlnaHQ6eWVsbG93Ij5saW5rcyBvciBh dHRhY2htZW50cyB1bmxlc3MgeW91IHJlY29nbml6ZSB0aGUgc2VuZGVyIGFuZCB0cnVzdCB0 aGUgY29udGVudC4NCjwvc3Bhbj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6 ZToxMi41cHQ7bGluZS1oZWlnaHQ6MTIwJSI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgYWxpZ249ImNlbnRlciIgc3R5bGU9InRleHQtYWxpZ246Y2Vu dGVyIj48c3BhbiBsYW5nPSJFTi1HQiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0K PGRpdj4NCjxwIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj48c3BhbiBsYW5nPSJFTi1HQiIg c3R5bGU9ImNvbG9yOiMzMjMxMzAiPkkgZG9u4oCZdCBoYXZlIGEgcHJlZmVyZW5jZSBmb3Ig d2hldGhlciB0aGlzIGRyYWZ0IHNob3VsZCBiZWNvbWUgYSB3b3JraW5nIGdyb3VwIGl0ZW0s IG9yIGJlY29tZSBhbiBBRC1zcG9uc29yZWQgb3IgaW5kaXZpZHVhbCBzdWJtaXNzaW9uPC9z cGFuPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iY29sb3I6I0M4MjYxMyI+4oCLLA0KPC9z cGFuPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iY29sb3I6YmxhY2siPmJ1dCBpbiBhbnkg Y2FzZSBpdCBjb250YWlucyBpbXBvcnRhbnQgYWRkaXRpb25zIHRvIHRoZSBzZWN1cml0eSBj b25zaWRlcmF0aW9ucyBvZiBSRkMgODQ0Njwvc3Bhbj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5 bGU9ImNvbG9yOiMzMjMxMzAiPi4gVGhlIHVzZS1jYXNlcyBpdCBkZXRhaWxzIGFyZSByZWFs LWxpZmUgc2NlbmFyaW9zIHdoZXJlIHRoZSBpbnRyb2R1Y3Rpb24NCiBvZiBUTFMgMS4zIGlu IHBsYWNlIG9mIDEuMiBoYXMgYW4gaW1wYWN0IG9uIHRoZSBzZWN1cml0eSBvZiBzeXN0ZW1z IChhY2NvcmRpbmcgdG8gdGhlIHRocmVhdCBtb2RlbCBvdXRsaW5lZCBpbiBSRkMgMzU1MiBh bmQgdGhlIGFkZGl0aW9uYWwgbm9uLUNvbVNlYyB0aHJlYXRzIHRoYXQgaGF2ZSBiZWVuIGlk ZW50aWZpZWQgc3Vic2VxdWVudCB0byB0aGUgcHVibGljYXRpb24gb2YgUkZDDQo8L3NwYW4+ PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJjb2xvcjpibGFjayI+MzU1Mik7IHRoZXJlZm9y ZSB0aGV5IHNob3VsZCBiZSBhY2N1cmF0ZWx5IGFuZCBwdWJsaWNseSByZWNvcmRlZC48bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBzdHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+PHNwYW4g bGFuZz0iRU4tR0IiIHN0eWxlPSJjb2xvcjpibGFjayI+LS0gTWFyazxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjxwIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj48c3BhbiBsYW5nPSJFTi1H QiIgc3R5bGU9ImNvbG9yOmJsYWNrIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8 cHJlIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9 ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTpDb25zb2xhcztjb2xvcjojMjEyNTI5Ij5P biBTdW4sIEp1bCAyMSwgMjAxOSBhdCA2OjUxIEFNIE5hbmN5IENhbS1XaW5nZXQgKG5jYW13 aW5nKSAmbHQ7PGEgaHJlZj0ibWFpbHRvOm5jYW13aW5nQGNpc2NvLmNvbSUzZSI+bmNhbXdp bmdAY2lzY28uY29tJmd0OzwvYT47IHdyb3RlOjwvc3Bhbj48c3BhbiBsYW5nPSJFTi1HQiI+ PG86cD48L286cD48L3NwYW4+PC9wcmU+DQo8cHJlIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRl Ij48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWls eTpDb25zb2xhcztjb2xvcjojMjEyNTI5Ij4mbmJzcDs8L3NwYW4+PHNwYW4gbGFuZz0iRU4t R0IiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcHJlPg0KPHByZSBzdHlsZT0iYmFja2dyb3VuZDp3 aGl0ZSI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1m YW1pbHk6Q29uc29sYXM7Y29sb3I6IzIxMjUyOSI+Jmd0OyBIaSw8L3NwYW4+PHNwYW4gbGFu Zz0iRU4tR0IiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcHJlPg0KPHByZSBzdHlsZT0iYmFja2dy b3VuZDp3aGl0ZSI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7 Zm9udC1mYW1pbHk6Q29uc29sYXM7Y29sb3I6IzIxMjUyOSI+Jmd0OyZuYnNwOzwvc3Bhbj48 c3BhbiBsYW5nPSJFTi1HQiI+PG86cD48L286cD48L3NwYW4+PC9wcmU+DQo8cHJlIHN0eWxl PSJiYWNrZ3JvdW5kOndoaXRlIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6 ZTo5LjBwdDtmb250LWZhbWlseTpDb25zb2xhcztjb2xvcjojMjEyNTI5Ij4mZ3Q7IFRoYW5r cyB0byBhbGwgdGhlIGZlZWRiYWNrIHByb3ZpZGVkLCB3ZSBoYXZlIHVwZGF0ZWQgdGhlPC9z cGFuPjxzcGFuIGxhbmc9IkVOLUdCIj48bzpwPjwvbzpwPjwvc3Bhbj48L3ByZT4NCjxwcmUg c3R5bGU9ImJhY2tncm91bmQ6d2hpdGUiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9u dC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OkNvbnNvbGFzO2NvbG9yOiMyMTI1MjkiPiZndDsg PGEgaHJlZj0iaHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LWNhbXdpbmdldC10 bHMtdXNlLWNhc2VzLTA0Ij48c3BhbiBzdHlsZT0iY29sb3I6IzMzN0FCNyI+aHR0cHM6Ly90 b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LWNhbXdpbmdldC10bHMtdXNlLWNhc2VzLTA0PC9z cGFuPjwvYT48L3NwYW4+PHNwYW4gbGFuZz0iRU4tR0IiPjxvOnA+PC9vOnA+PC9zcGFuPjwv cHJlPg0KPHByZSBzdHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+PHNwYW4gbGFuZz0iRU4tR0Ii IHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6Q29uc29sYXM7Y29sb3I6IzIx MjUyOSI+Jmd0OyZuYnNwOzwvc3Bhbj48c3BhbiBsYW5nPSJFTi1HQiI+PG86cD48L286cD48 L3NwYW4+PC9wcmU+DQo8cHJlIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj48c3BhbiBsYW5n PSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTpDb25zb2xhcztj b2xvcjojMjEyNTI5Ij4mZ3Q7IGRyYWZ0LiZuYnNwOyBBdCB0aGlzIHBvaW50LCB3ZSBiZWxp ZXZlIHRoZSBkcmFmdCBpcyBzdGFibGUgYW5kIHdvdWxkIGxpa2UgdG88L3NwYW4+PHNwYW4g bGFuZz0iRU4tR0IiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcHJlPg0KPHByZSBzdHlsZT0iYmFj a2dyb3VuZDp3aGl0ZSI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6OS4w cHQ7Zm9udC1mYW1pbHk6Q29uc29sYXM7Y29sb3I6IzIxMjUyOSI+Jmd0OyByZXF1ZXN0IGl0 cyBwdWJsaWNhdGlvbiBhcyBhbiBpbmZvcm1hdGlvbmFsIGRyYWZ0Ljwvc3Bhbj48c3BhbiBs YW5nPSJFTi1HQiI+PG86cD48L286cD48L3NwYW4+PC9wcmU+DQo8cHJlIHN0eWxlPSJiYWNr Z3JvdW5kOndoaXRlIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZTo5LjBw dDtmb250LWZhbWlseTpDb25zb2xhcztjb2xvcjojMjEyNTI5Ij4mZ3Q7Jm5ic3A7PC9zcGFu PjxzcGFuIGxhbmc9IkVOLUdCIj48bzpwPjwvbzpwPjwvc3Bhbj48L3ByZT4NCjxwcmUgc3R5 bGU9ImJhY2tncm91bmQ6d2hpdGUiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1z aXplOjkuMHB0O2ZvbnQtZmFtaWx5OkNvbnNvbGFzO2NvbG9yOiMyMTI1MjkiPiZndDsmbmJz cDs8L3NwYW4+PHNwYW4gbGFuZz0iRU4tR0IiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcHJlPg0K PHByZSBzdHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxl PSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6Q29uc29sYXM7Y29sb3I6IzIxMjUyOSI+ Jmd0OyZuYnNwOzwvc3Bhbj48c3BhbiBsYW5nPSJFTi1HQiI+PG86cD48L286cD48L3NwYW4+ PC9wcmU+DQo8cHJlIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj48c3BhbiBsYW5nPSJFTi1H QiIgc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTpDb25zb2xhcztjb2xvcjoj MjEyNTI5Ij4mZ3Q7IFdhcm0gcmVnYXJkcyw8L3NwYW4+PHNwYW4gbGFuZz0iRU4tR0IiPjxv OnA+PC9vOnA+PC9zcGFuPjwvcHJlPg0KPHByZSBzdHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+ PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6 Q29uc29sYXM7Y29sb3I6IzIxMjUyOSI+Jmd0OyZuYnNwOzwvc3Bhbj48c3BhbiBsYW5nPSJF Ti1HQiI+PG86cD48L286cD48L3NwYW4+PC9wcmU+DQo8cHJlIHN0eWxlPSJiYWNrZ3JvdW5k OndoaXRlIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250 LWZhbWlseTpDb25zb2xhcztjb2xvcjojMjEyNTI5Ij4mZ3Q7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7IE5hbmN5PC9zcGFuPjxzcGFuIGxhbmc9IkVOLUdCIj48bzpwPjwvbzpwPjwvc3Bh bj48L3ByZT4NCjxwcmUgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUiPjxzcGFuIGxhbmc9IkVO LUdCIiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OkNvbnNvbGFzO2NvbG9y OiMyMTI1MjkiPiZndDsmbmJzcDs8L3NwYW4+PHNwYW4gbGFuZz0iRU4tR0IiPjxvOnA+PC9v OnA+PC9zcGFuPjwvcHJlPg0KPHByZSBzdHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+PHNwYW4g bGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6Q29uc29s YXM7Y29sb3I6IzIxMjUyOSI+Jmd0OyZuYnNwOzwvc3Bhbj48c3BhbiBsYW5nPSJFTi1HQiI+ PG86cD48L286cD48L3NwYW4+PC9wcmU+DQo8cHJlIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRl Ij48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWls eTpDb25zb2xhcztjb2xvcjojMjEyNTI5Ij4mZ3Q7Jm5ic3A7PC9zcGFuPjxzcGFuIGxhbmc9 IkVOLUdCIj48bzpwPjwvbzpwPjwvc3Bhbj48L3ByZT4NCjxwcmUgc3R5bGU9ImJhY2tncm91 bmQ6d2hpdGUiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2Zv bnQtZmFtaWx5OkNvbnNvbGFzO2NvbG9yOiMyMTI1MjkiPiZndDsmbmJzcDs8L3NwYW4+PHNw YW4gbGFuZz0iRU4tR0IiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcHJlPg0KPHByZSBzdHlsZT0i YmFja2dyb3VuZDp3aGl0ZSI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6 OS4wcHQ7Zm9udC1mYW1pbHk6Q29uc29sYXM7Y29sb3I6IzIxMjUyOSI+Jmd0OyBfX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXzwvc3Bhbj48c3BhbiBs YW5nPSJFTi1HQiI+PG86cD48L286cD48L3NwYW4+PC9wcmU+DQo8cHJlIHN0eWxlPSJiYWNr Z3JvdW5kOndoaXRlIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQtc2l6ZTo5LjBw dDtmb250LWZhbWlseTpDb25zb2xhcztjb2xvcjojMjEyNTI5Ij4mZ3Q7IFRMUyBtYWlsaW5n IGxpc3Q8L3NwYW4+PHNwYW4gbGFuZz0iRU4tR0IiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcHJl Pg0KPHByZSBzdHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0 eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6Q29uc29sYXM7Y29sb3I6IzIxMjUy OSI+Jmd0OyA8YSBocmVmPSJtYWlsdG86VExTQGlldGYub3JnIj48c3BhbiBzdHlsZT0iY29s b3I6IzMzN0FCNyI+VExTQGlldGYub3JnPC9zcGFuPjwvYT48L3NwYW4+PHNwYW4gbGFuZz0i RU4tR0IiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcHJlPg0KPHByZSBzdHlsZT0iYmFja2dyb3Vu ZDp3aGl0ZSI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9u dC1mYW1pbHk6Q29uc29sYXM7Y29sb3I6IzIxMjUyOSI+Jmd0OyA8YSBocmVmPSJodHRwczov L3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3RscyI+PHNwYW4gc3R5bGU9ImNvbG9y OiMzMzdBQjciPmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vdGxzPC9z cGFuPjwvYT48bzpwPjwvbzpwPjwvc3Bhbj48L3ByZT4NCjxwcmUgc3R5bGU9ImJhY2tncm91 bmQ6d2hpdGUiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2Zv bnQtZmFtaWx5OkNvbnNvbGFzO2NvbG9yOiMyMTI1MjkiPjxvOnA+Jm5ic3A7PC9vOnA+PC9z cGFuPjwvcHJlPg0KPHByZSBzdHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+PHNwYW4gbGFuZz0i RU4tR0IiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcHJlPg0KPHByZSBzdHlsZT0iYmFj a2dyb3VuZDp3aGl0ZSI+PHNwYW4gbGFuZz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6OS4w cHQ7Zm9udC1mYW1pbHk6Q29uc29sYXM7Y29sb3I6IzIxMjUyOSI+Jm5ic3A7PC9zcGFuPjxz cGFuIGxhbmc9IkVOLUdCIj48bzpwPjwvbzpwPjwvc3Bhbj48L3ByZT4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tYm90dG9tOjguMHB0O2xpbmUtaGVpZ2h0OjEyMCUi PjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjEyLjVwdDtsaW5lLWhlaWdo dDoxMjAlIj5UaGlzIGluZm9ybWF0aW9uIGlzIGV4ZW1wdCB1bmRlciB0aGUgRnJlZWRvbSBv ZiBJbmZvcm1hdGlvbiBBY3QgMjAwMCAoRk9JQSkgYW5kIG1heSBiZSBleGVtcHQgdW5kZXIg b3RoZXIgVUsgaW5mb3JtYXRpb24gbGVnaXNsYXRpb24uDQogUmVmZXIgYW55IEZPSUEgcXVl cmllcyB0byA8YSBocmVmPSJtYWlsdG86bmNzY2luZm9sZWdAbmNzYy5nb3YudWsiPm5jc2Np bmZvbGVnQG5jc2MuZ292LnVrPC9hPi4gQWxsIG1hdGVyaWFsIGlzIFVLIENyb3duIENvcHly aWdodCDCqQ0KPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1hcmdpbi1ib3R0b206OC4wcHQ7bGluZS1oZWlnaHQ6MTIwJSI+PHNwYW4gbGFu Zz0iRU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTIuNXB0O2xpbmUtaGVpZ2h0OjEyMCUiPjxv OnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2JvZHk+DQo8 L2h0bWw+DQoKCjxCUj4KPGh0bWw+CiA8cD5UaGUgaW5mb3JtYXRpb24gY29udGFpbmVkIGlu IHRoaXMgY29tbXVuaWNhdGlvbiBpcyBoaWdobHkgY29uZmlkZW50aWFsIGFuZCBpcyBpbnRl bmRlZCBzb2xlbHkgZm9yIHRoZSB1c2Ugb2YgdGhlIGluZGl2aWR1YWwocykgdG8gd2hvbSB0 aGlzIGNvbW11bmljYXRpb24gaXMgZGlyZWN0ZWQuIElmIHlvdSBhcmUgbm90IHRoZSBpbnRl bmRlZCByZWNpcGllbnQsIHlvdSBhcmUgaGVyZWJ5IG5vdGlmaWVkIHRoYXQgYW55IHZpZXdp bmcsIGNvcHlpbmcsIGRpc2Nsb3N1cmUgb3IgZGlzdHJpYnV0aW9uIG9mIHRoaXMgaW5mb3Jt YXRpb24gaXMgcHJvaGliaXRlZC4gUGxlYXNlIG5vdGlmeSB0aGUgc2VuZGVyLCBieSBlbGVj dHJvbmljIG1haWwgb3IgdGVsZXBob25lLCBvZiBhbnkgdW5pbnRlbmRlZCByZWNlaXB0IGFu ZCBkZWxldGUgdGhlIG9yaWdpbmFsIG1lc3NhZ2Ugd2l0aG91dCBtYWtpbmcgYW55IGNvcGll cy48L3A+CiA8cD5CbHVlIENyb3NzIEJsdWUgU2hpZWxkIG9mIE1pY2hpZ2FuIGFuZCBCbHVl IENhcmUgTmV0d29yayBvZiBNaWNoaWdhbiBhcmUgbm9ucHJvZml0IGNvcnBvcmF0aW9ucyBh bmQgaW5kZXBlbmRlbnQgbGljZW5zZWVzIG9mIHRoZSBCbHVlIENyb3NzIGFuZCBCbHVlIFNo aWVsZCBBc3NvY2lhdGlvbi48L3A+CiAgPC9odG1sPgoK --_000_DM6PR14MB24748FF357654E2971904BFFD7C70DM6PR14MB2474namp_-- From nobody Tue Jul 23 13:51:25 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0EE58120159 for ; Tue, 23 Jul 2019 13:51:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.5 X-Spam-Level: X-Spam-Status: No, score=-14.5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Xr2JRcbNrKia for ; Tue, 23 Jul 2019 13:51:19 -0700 (PDT) Received: from rcdn-iport-4.cisco.com (rcdn-iport-4.cisco.com [173.37.86.75]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 25108120153 for ; Tue, 23 Jul 2019 13:51:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=18255; q=dns/txt; s=iport; t=1563915079; x=1565124679; h=subject:to:cc:references:from:message-id:date: mime-version:in-reply-to; bh=/MT02I7U4sOhFSqZS9fQOIWcjptoodQPCWj3/eluqYw=; b=geuD/A/IRzFHVmKMl1TLHsauovodRJC9gvg4cwF02dEvHYEm4B7rfUd8 hbnxYzTHSSblNHrQgeJo/9CGZGBrc0N+GcgJ4rphL0gQ/nQvnbL0gRRg0 qkClRhzTuXCzxCuElYoByR4bEcWCl69vblYIZFMjCVkH4/n0iB+JQbHBJ w=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0BCAAAKcjdd/5xdJa1mHAEBAQQBAQc?= =?us-ascii?q?EAQGBUwcBAQsBgRSBAm1RATIqhB2IHItcCCWJVA6PHIF7CQEBAQ4YAQoMAQG?= =?us-ascii?q?EQAKCTiM0CQ4BAwEBBAEBAgEGbYUeDIVLAQEBAwEBIUsLEAkCGCcDAgIhBh8?= =?us-ascii?q?RBgEMBgIBARAHgwcBgWoDCRQPjyCba4EyH4QXAoEPgkANX4FIgTQBi0AeF4F?= =?us-ascii?q?AP4ERJwyCMS4+ghpHAQEDgUiDIYJYBKojQAmCG4ZYiUCDbgYbgi1tih2KU40?= =?us-ascii?q?1gTGGF4F1jjuBUDgqgS5NIxU7gmwJiz6FWyMDMI9mAQE?= X-IronPort-AV: E=Sophos;i="5.64,300,1559520000"; d="scan'208,217";a="602947912" Received: from rcdn-core-5.cisco.com ([173.37.93.156]) by rcdn-iport-4.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 23 Jul 2019 20:51:18 +0000 Received: from [10.86.255.110] ([10.86.255.110]) by rcdn-core-5.cisco.com (8.15.2/8.15.2) with ESMTP id x6NKpH1a004347; Tue, 23 Jul 2019 20:51:17 GMT To: Watson Ladd , Bret Jordan Cc: TLS List References: <6AF48228-19C2-41C7-BA86-BA16940C3CFF@cisco.com> From: Flemming Andreasen Message-ID: <016da638-6973-809b-0a24-42b2c9682b64@cisco.com> Date: Tue, 23 Jul 2019 16:51:16 -0400 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/alternative; boundary="------------65BC65A4A11BDFB312D53EFE" Content-Language: en-US X-Outbound-SMTP-Client: 10.86.255.110, [10.86.255.110] X-Outbound-Node: rcdn-core-5.cisco.com Archived-At: Subject: Re: [TLS] TLS Impact on Network Security draft updated X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 Jul 2019 20:51:22 -0000 This is a multi-part message in MIME format. --------------65BC65A4A11BDFB312D53EFE Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit On 7/23/19 2:35 PM, Watson Ladd wrote: > This draft contains substantial omissions in section 3. > > Nothing in TLS 1.3 prevents scanning for servers and examining the > certificates they present. Agreed, however there is no guarantee that the server will present the same certificate and other TLS parameters as it will for a particular client connection > Nothing in TLS 1.3 prevents using reverse proxies to provide WAF > functionality. Agreed however you need to terminate the TLS 1.3 connection at that WAF > PCI-DSS compliance is not at odds with deploying TLS 1.3. In fact the > citation to A2 is to a sun-setting of all pre TLS 1.2 versions for > point of sale terminals. I really don't see where the conflict exists > since all ciphers in 1.3 are secure. > I'll defer to one of my co-authors on this one. > The absence of these solutions means the draft overstates the impact > of the increased protection TLS 1.3 provides. It's disappointing to > see sustained and persistent opposition to encryption and privacy > despite multiple RFCs saying that yes we should encrypt all the things. > The draft is submitted with the intent of informing the community about impacts as we see them. The authors welcome discussion and constructive feedback and we will be happy to update and improve the draft accordingly when such information is provided and consensus forms around it. Specific text suggestions will be even better. Thanks -- Flemming > > On Tue, Jul 23, 2019, 8:08 AM Bret Jordan > wrote: > > Nancy, > > I support this work and think this draft should be published. This > is a yet another good write up on some of the requirements that > are needed for operational security. > > Thanks, > Bret > PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050 > "Without cryptography vihv vivc ce xhrnrw, however, the only thing > that can not be unscrambled is an egg." > >> On Jul 21, 2019, at 9:51 AM, Nancy Cam-Winget (ncamwing) >> > wrote: >> >> Hi, >> Thanks to all the feedback provided, we have updated >> thehttps://tools.ietf.org/html/draft-camwinget-tls-use-cases-04 >> draft.  At this point, we believe the draft is stable and would >> like to request its publication as an informational draft. >> Warm regards, >>     Nancy >> _______________________________________________ >> TLS mailing list >> TLS@ietf.org >> https://www.ietf.org/mailman/listinfo/tls > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls --------------65BC65A4A11BDFB312D53EFE Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 8bit

On 7/23/19 2:35 PM, Watson Ladd wrote:
This draft contains substantial omissions in section 3.

Nothing in TLS 1.3 prevents scanning for servers and examining the certificates they present.
Agreed, however there is no guarantee that the server will present the same certificate and other TLS parameters as it will for a particular client connection
Nothing in TLS 1.3 prevents using reverse proxies to provide WAF functionality.
Agreed however you need to terminate the TLS 1.3 connection at that WAF
PCI-DSS compliance is not at odds with deploying TLS 1.3. In fact the citation to A2 is to a sun-setting of all pre TLS 1.2 versions for point of sale terminals. I really don't see where the conflict exists since all ciphers in 1.3 are secure.

I'll defer to one of my co-authors on this one.
The absence of these solutions means the draft overstates the impact of the increased protection TLS 1.3 provides. It's disappointing to see sustained and persistent opposition to encryption and privacy despite multiple RFCs saying that yes we should encrypt all the things.

The draft is submitted with the intent of informing the community about impacts as we see them. The authors welcome discussion and constructive feedback and we will be happy to update and improve the draft accordingly when such information is provided and consensus forms around it. Specific text suggestions will be even better.

Thanks

-- Flemming

On Tue, Jul 23, 2019, 8:08 AM Bret Jordan <jordan.ietf@gmail.com> wrote:
Nancy,

I support this work and think this draft should be published. This is a yet another good write up on some of the requirements that are needed for operational security. 

Thanks,
Bret
PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050
"Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg."

On Jul 21, 2019, at 9:51 AM, Nancy Cam-Winget (ncamwing) <ncamwing@cisco.com> wrote:

Hi,
Thanks to all the feedback provided, we have updated the https://tools.ietf.org/html/draft-camwinget-tls-use-cases-04
draft.  At this point, we believe the draft is stable and would like to request its publication as an informational draft.
 
Warm regards, 
    Nancy
 
 
_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls

_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls

_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls

--------------65BC65A4A11BDFB312D53EFE-- From nobody Tue Jul 23 13:52:07 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AACEF1209BB for ; Tue, 23 Jul 2019 13:51:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sn3rd.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vzlXzQVSjgCZ for ; Tue, 23 Jul 2019 13:51:52 -0700 (PDT) Received: from mail-qt1-x830.google.com (mail-qt1-x830.google.com [IPv6:2607:f8b0:4864:20::830]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8EA8D1209B1 for ; Tue, 23 Jul 2019 13:51:52 -0700 (PDT) Received: by mail-qt1-x830.google.com with SMTP id 44so12237878qtg.11 for ; Tue, 23 Jul 2019 13:51:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sn3rd.com; s=google; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=yj8AqBxGazdHsz8y3crUcCwVWptiGX4PJDhrJB7Byew=; b=YEnC8mI/B9W8fG5ny9K3l5obyPpLqXvTLapCRWx2E6jVtLJKIx4QRsequkB/ICcg/f 2erKPQoVJYT81f6KuUkE8S+0ABtGQzieLRHNUfMcOooLDaKA7d3tR7uu9BM30PzIoZUf tuDdNSvd3NLWZpVcR7SyqMZOx4smZx04t4YqY= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=yj8AqBxGazdHsz8y3crUcCwVWptiGX4PJDhrJB7Byew=; b=Xlf9x0jZvREJc7nYTkLrYIJwEUTY8wF9IshUEtLOWLEtRAAbkMmd6Q9TjiEeuHDGkl sdIaUGCSLg83CyLXgzHf/GU+m27o5b6FS8MycUIKPBpobhI0nziLhwuppauJ8A/kJCnX UKcIceTGaWEd3jui1umNLyOvPVus6vn6Lvwcjz+vV900VHteayitml9RmaEjuEQHKmiV Ozv4EwxGR7hocYa1yARixPax0rwPffPmLXenhWmBrqx96ag3mS/Hv1taLgbL9uRydTIf 1ziD8v+mOe/SatdCiSLr65W8akHTmFUy6aVH6KYsS9xlvQ1z7TDmMPW37vcACFSCtt27 7duw== X-Gm-Message-State: APjAAAV/ytDA0/tlb49jslW69qkaWLULrsKqmjRdo9wBRca2PJgS8ttk h2QokRwE3q66rQ8x4+oAXCWlg0nvhHY= X-Google-Smtp-Source: APXvYqzZL5qBGBTshUvJvdJfkGdtlUP3aEdNUI6uf0pIOtiqWoabMmH1bTfBVoRBOVOCO3g/+p4frQ== X-Received: by 2002:ac8:43d8:: with SMTP id w24mr54708165qtn.25.1563915111708; Tue, 23 Jul 2019 13:51:51 -0700 (PDT) Received: from ?IPv6:2001:67c:370:128:851c:9e9f:d285:b1b? ([2001:67c:370:128:851c:9e9f:d285:b1b]) by smtp.gmail.com with ESMTPSA id u18sm18906914qkj.98.2019.07.23.13.51.50 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 23 Jul 2019 13:51:51 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) From: Sean Turner In-Reply-To: Date: Tue, 23 Jul 2019 16:51:50 -0400 Cc: Nancy Cam-Winget , "tls@ietf.org" Content-Transfer-Encoding: quoted-printable Message-Id: References: <6AF48228-19C2-41C7-BA86-BA16940C3CFF@cisco.com> To: Tony Arcieri X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [TLS] TLS Impact on Network Security draft updated X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 Jul 2019 20:52:06 -0000 Tony, While you may have concerns or otherwise disagree with the contents of = this draft, let=E2=80=99s please keep discussion on this list, on all = issues, polite and professional. spt (as co-chair) > On Jul 23, 2019, at 16:05, Tony Arcieri wrote: >=20 > On Sun, Jul 21, 2019 at 6:51 AM Nancy Cam-Winget (ncamwing) = wrote: > Hi, >=20 > Thanks to all the feedback provided, we have updated the = https://tools.ietf.org/html/draft-camwinget-tls-use-cases-04 >=20 > draft. At this point, we believe the draft is stable and would like = to request its publication as an informational draft. >=20 >=20 > I read this draft as the latest attempt in a disinformation campaign = by manufacturers and users of middleboxes that passively decrypt TLS = connections to politicize and reframe the argument around what is, at = its core, a fundamentally insecure practice which is incompatible with = technically sound and highly desirable protocol improvements to TLS. >=20 > I implore you stop using overly broad terminology, euphemisms, weasel = words, and other deceptive language to argue your points. >=20 > This draft is titled "TLS 1.3 Impact on Network-Based Security", but = the subtext is quite clearly the much narrower subfield of middlebox TLS = decryption. By using such a grandiose title which is deceptively hiding = the true subject matter, you are implying that middleboxes are the sum = total of network security. >=20 > The draft begins "Enterprises [...] need to defend their information = systems from attacks originating from both inside and outside their = networks." I am co-owner of a company which heavily leverages firewalls = for layer 3/4 network security in conjunction with TLS. We care deeply = about network security, and believe that our network is *more secure* = specifically because we *don't* perform middlebox interception of TLS. >=20 > I consider our company to be in the category of enterprise TLS users, = and as an enterprise TLS user who cares deeply about network security, I = do not identify whatsoever with the claims this draft is making about = the needs of enterprise TLS users as a whole. In as much as what it = describes to "network security", it is but one niche consideration = within a vastly broader field, and one which is increasingly = controversial. >=20 > I will point out, since you appear to work at Cisco, that your company = works on approaches to network security (e.g. malware detection) which = avoid decrypting TLS: >=20 > = https://blogs.cisco.com/security/detecting-encrypted-malware-traffic-witho= ut-decryption >=20 > There is an entire world of network IDS systems beyond middleboxes = which passively decrypt TLS. >=20 > It is factually inaccurate for this draft to be described as "TLS 1.3 = Impact on Network-Based Security". If you are going to write a draft = about the impact of TLS 1.3 on middleboxes for passive TLS decryption, = please call a spade a spade and don't try to hide your true intentions = under a bunch of weasel words and overly broad claims that make it sound = like middlebox-related TLS decryption problems are the end of network = security as we know it. >=20 > My 2c, on behalf of non-middlebox-using enterprise TLS users who feel = that attempts by middlebox-using enterprise TLS users to weaken TLS in = order to retain compatibility with their traffic decryption appliances = is a threat to the security of our enterprise TLS deployments. > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls From nobody Tue Jul 23 13:57:26 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 127511209A7 for ; Tue, 23 Jul 2019 13:57:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.5 X-Spam-Level: X-Spam-Status: No, score=-14.5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ofIg17Ew2ooc for ; Tue, 23 Jul 2019 13:57:10 -0700 (PDT) Received: from rcdn-iport-3.cisco.com (rcdn-iport-3.cisco.com [173.37.86.74]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F02C612099C for ; Tue, 23 Jul 2019 13:57:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=12815; q=dns/txt; s=iport; t=1563915429; x=1565125029; h=subject:to:cc:references:from:message-id:date: mime-version:in-reply-to; bh=ift57/cc/xlp51BVuIDzy3TEIFaeQqEAQaHpLpf3E0I=; b=J+l8TlwQMp08wQ0+kMh5oKpt4ZsFBFl6N8OsBdD+OJGgVnhHRKiF12vy e9FcDhGW/ZX8WcIM0MQAn/Iscjz6Ibzoeq+Snq1dwF/neCOs1Dvs1JLSm 2WfhpK8jCaqn4R2scLb6VNAE3WbROm/LqVMDORudAVL8egTRPCm7TMb5S A=; X-IronPort-AV: E=Sophos;i="5.64,300,1559520000"; d="scan'208,217";a="590579615" Received: from rcdn-core-3.cisco.com ([173.37.93.154]) by rcdn-iport-3.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 23 Jul 2019 20:57:09 +0000 Received: from [10.86.255.110] ([10.86.255.110]) by rcdn-core-3.cisco.com (8.15.2/8.15.2) with ESMTP id x6NKv8cG008938; Tue, 23 Jul 2019 20:57:08 GMT To: Tony Arcieri , "Nancy Cam-Winget (ncamwing)" Cc: "tls@ietf.org" References: <6AF48228-19C2-41C7-BA86-BA16940C3CFF@cisco.com> From: Flemming Andreasen Message-ID: <7a1c2576-10db-2086-63e5-0020f45d0997@cisco.com> Date: Tue, 23 Jul 2019 16:57:08 -0400 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/alternative; boundary="------------B934EA3B29DFD896AAA0157A" Content-Language: en-US X-Outbound-SMTP-Client: 10.86.255.110, [10.86.255.110] X-Outbound-Node: rcdn-core-3.cisco.com Archived-At: Subject: Re: [TLS] TLS Impact on Network Security draft updated X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 Jul 2019 20:57:25 -0000 This is a multi-part message in MIME format. --------------B934EA3B29DFD896AAA0157A Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit On 7/23/19 4:05 PM, Tony Arcieri wrote: > On Sun, Jul 21, 2019 at 6:51 AM Nancy Cam-Winget (ncamwing) > > wrote: > > Hi, > > Thanks to all the feedback provided, we have updated the > https://tools.ietf.org/html/draft-camwinget-tls-use-cases-04 > > draft. At this point, we believe the draft is stable and would > like to request its publication as an informational draft. > > > I read this draft as the latest attempt in a disinformation campaign > by manufacturers and users of middleboxes that passively decrypt TLS > connections to politicize and reframe the argument around what is, at > its core, a fundamentally insecure practice which is incompatible with > technically sound and highly desirable protocol improvements to TLS. > > I implore you stop using overly broad terminology, euphemisms, weasel > words, and other deceptive language to argue your points. > I am not a mind-reader, so I will refrain from attributing malice to your choice of words - I would appreciate it if you would extend the same courtesy. > This draft is titled "TLS 1.3 Impact on Network-Based Security", but > the subtext is quite clearly the much narrower subfield of middlebox > TLS decryption. By using such a grandiose title which is deceptively > hiding the true subject matter, you are implying that middleboxes are > the sum total of network security. No such implication is intended - we will look for a more accurate document title. > > The draft begins "Enterprises [...] need to defend their information > systems from attacks originating from both inside and outside their > networks." I am co-owner of a company which heavily leverages > firewalls for layer 3/4 network security in conjunction with TLS. We > care deeply about network security, and believe that our network is > *more secure* specifically because we *don't* perform middlebox > interception of TLS. > > I consider our company to be in the category of enterprise TLS users, > and as an enterprise TLS user who cares deeply about network security, > I do not identify whatsoever with the claims this draft is making > about the needs of enterprise TLS users as a whole. In as much as what > it describes to "network security", it is but one niche consideration > within a vastly broader field, and one which is increasingly > controversial. > It is indeed controversial, and different enterprises have different views on these. I know this because I regularly interact with a number of these across different industries. > I will point out, since you appear to work at Cisco, that your company > works on approaches to network security (e.g. malware detection) which > avoid decrypting TLS: > > https://blogs.cisco.com/security/detecting-encrypted-malware-traffic-without-decryption > I am quite familiar with this. Please note that it does not provide a full replacement for all existing capabilities > There is an entire world of network IDS systems beyond middleboxes > which passively decrypt TLS. > Are you saying that it is possible to passively decrypt TLS 1.3 sessions without being a MITM (or otherwise sharing keying material) ? > It is factually inaccurate for this draft to be described as "TLS 1.3 > Impact on Network-Based Security". If you are going to write a draft > about the impact of TLS 1.3 on middleboxes for passive TLS decryption, > please call a spade a spade and don't try to hide your true intentions > under a bunch of weasel words and overly broad claims that make it > sound like middlebox-related TLS decryption problems are the end of > network security as we know it. > > My 2c, on behalf of non-middlebox-using enterprise TLS users who feel > that attempts by middlebox-using enterprise TLS users to weaken TLS in > order to retain compatibility with their traffic decryption appliances > is a threat to the security of our enterprise TLS deployments. Please see my earlier comments on this. Thanks -- Flemming > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls --------------B934EA3B29DFD896AAA0157A Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 8bit

On 7/23/19 4:05 PM, Tony Arcieri wrote:
On Sun, Jul 21, 2019 at 6:51 AM Nancy Cam-Winget (ncamwing) <ncamwing@cisco..com> wrote:

Hi,

Thanks to all the feedback provided, we have updated the https://tools.ietf.org/html/draft-camwinget-tls-use-cases-04

draft.  At this point, we believe the draft is stable and would like to request its publication as an informational draft.


I read this draft as the latest attempt in a disinformation campaign by manufacturers and users of middleboxes that passively decrypt TLS connections to politicize and reframe the argument around what is, at its core, a fundamentally insecure practice which is incompatible with technically sound and highly desirable protocol improvements to TLS.

I implore you stop using overly broad terminology, euphemisms, weasel words, and other deceptive language to argue your points.

I am not a mind-reader, so I will refrain from attributing malice to your choice of words - I would appreciate it if you would extend the same courtesy.

This draft is titled "TLS 1.3 Impact on Network-Based Security", but the subtext is quite clearly the much narrower subfield of middlebox TLS decryption. By using such a grandiose title which is deceptively hiding the true subject matter, you are implying that middleboxes are the sum total of network security.
No such implication is intended - we will look for a more accurate document title.

The draft begins "Enterprises [...] need to defend their information systems from attacks originating from both inside and outside their networks." I am co-owner of a company which heavily leverages firewalls for layer 3/4 network security in conjunction with TLS. We care deeply about network security, and believe that our network is *more secure* specifically because we *don't* perform middlebox interception of TLS.

I consider our company to be in the category of enterprise TLS users, and as an enterprise TLS user who cares deeply about network security, I do not identify whatsoever with the claims this draft is making about the needs of enterprise TLS users as a whole. In as much as what it describes to "network security", it is but one niche consideration within a vastly broader field, and one which is increasingly controversial.

It is indeed controversial, and different enterprises have different views on these. I know this because I regularly interact with a number of these across different industries.

I will point out, since you appear to work at Cisco, that your company works on approaches to network security (e.g. malware detection) which avoid decrypting TLS:

https://blogs.cisco.com/security/detecting-encrypted-malware-traffic-without-decryption

I am quite familiar with this. Please note that it does not provide a full replacement for all existing capabilities

There is an entire world of network IDS systems beyond middleboxes which passively decrypt TLS.

Are you saying that it is possible to passively decrypt TLS 1.3 sessions without being a MITM (or otherwise sharing keying material) ?

It is factually inaccurate for this draft to be described as "TLS 1.3 Impact on Network-Based Security". If you are going to write a draft about the impact of TLS 1.3 on middleboxes for passive TLS decryption, please call a spade a spade and don't try to hide your true intentions under a bunch of weasel words and overly broad claims that make it sound like middlebox-related TLS decryption problems are the end of network security as we know it.

My 2c, on behalf of non-middlebox-using enterprise TLS users who feel that attempts by middlebox-using enterprise TLS users to weaken TLS in order to retain compatibility with their traffic decryption appliances is a threat to the security of our enterprise TLS deployments.
Please see my earlier comments on this.

Thanks

-- Flemming 


_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls

--------------B934EA3B29DFD896AAA0157A-- From nobody Tue Jul 23 14:04:33 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8DB571209B5 for ; Tue, 23 Jul 2019 14:04:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.5 X-Spam-Level: X-Spam-Status: No, score=-14.5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9NNTQFPhs1qU for ; Tue, 23 Jul 2019 14:04:19 -0700 (PDT) Received: from rcdn-iport-1.cisco.com (rcdn-iport-1.cisco.com [173.37.86.72]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 922491209AA for ; Tue, 23 Jul 2019 14:04:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=8310; q=dns/txt; s=iport; t=1563915859; x=1565125459; h=subject:to:references:from:message-id:date:mime-version: in-reply-to; bh=aM9JPHP+C0EtjOEpJIYjz6TvmJlnbjIhGUIrTd4iuno=; b=H/8Fc+F4V6ht3KXJ1Kd13Mu+iIBpb+B6pGUxPfnHruSkJSQSo/dM9AQv xioDglTL3wy7ypeBW16ty25/oxTfqU20eS3nWPbglZMhhy5BPOPDtwVuo AujuSOg7cfzRh9LoFHGM9OVO0q0/XEyOPigzHnSFzPjiXHW6WIDLoDoCo 0=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0CuAAC2dTdd/5hdJa1mGgEBAQEBAgE?= =?us-ascii?q?BAQEHAgEBAQGBZ4IXbVEBMoRHkhaBYggliWKJGYd+CQEBAQ4jDAEBhEACgk4?= =?us-ascii?q?jOBMBAwEBBAEBAgEGbYUeDIVKAQEBAQIBI2YLGCoCAlcGAQwIAQGDHgGBdgU?= =?us-ascii?q?PD6sKgTIfhBcCgQ+DLoFCBoE0i18XgUA/gTgMgioHLj6CYQEBA4E3EYMhglg?= =?us-ascii?q?ElHGVcgmCG4ZYhG6DfgWEPQYbgi2HJYNlilONNYdIkDCBZyGBWE0jFYMoi0a?= =?us-ascii?q?FPh0jA41EglIBAQ?= X-IronPort-AV: E=Sophos;i="5.64,300,1559520000"; d="scan'208,217";a="600922302" Received: from rcdn-core-1.cisco.com ([173.37.93.152]) by rcdn-iport-1.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 23 Jul 2019 21:04:18 +0000 Received: from [10.86.255.110] ([10.86.255.110]) by rcdn-core-1.cisco.com (8.15.2/8.15.2) with ESMTP id x6NL4HTR030085; Tue, 23 Jul 2019 21:04:18 GMT To: tls@ietf.org, Viktor Dukhovni References: <6AF48228-19C2-41C7-BA86-BA16940C3CFF@cisco.com> <20190723201444.GB98742@straasha.imrryr.org> From: Flemming Andreasen Message-ID: <5a5a2bd5-24d4-ba8b-6919-c5c00f13966d@cisco.com> Date: Tue, 23 Jul 2019 17:04:17 -0400 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: <20190723201444.GB98742@straasha.imrryr.org> Content-Type: multipart/alternative; boundary="------------E3F3453CD12AD7FF397ADBAF" Content-Language: en-US X-Outbound-SMTP-Client: 10.86.255.110, [10.86.255.110] X-Outbound-Node: rcdn-core-1.cisco.com Archived-At: Subject: Re: [TLS] TLS Impact on Network Security draft updated X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 Jul 2019 21:04:33 -0000 This is a multi-part message in MIME format. --------------E3F3453CD12AD7FF397ADBAF Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit On 7/23/19 4:14 PM, Viktor Dukhovni wrote: > On Sun, Jul 21, 2019 at 01:51:32PM +0000, Nancy Cam-Winget (ncamwing) wrote: > >> Thanks to all the feedback provided, we have updated the https://tools.ietf.org/html/draft-camwinget-tls-use-cases-04 >> draft. At this point, we believe the draft is stable and would like to request its publication as an informational draft. > I found the language of the draft (especially the introduction) > somewhat turgid and repetitive to the point of significantly > detracting from readability. I think the draft needs substantial > editing for simplicity and clarity. If you have any specific text suggestions, please let us know. > As to specific technical issues, I don't understand the point being > made in Section 2.2.2 about client key shares and resumption: > > In TLS 1.3, the above mechanism is replaced by Pre-Shared Keys (PSK), > which can be negotiated as part of an initial handshake and then used > in a subsequent handshake to perform resumption using the PSK. TLS > 1.3 states that the client SHOULD include a "key_share" extension to > enable the server to decline resumption and fall back to a full > handshake, however it is not an absolute requirement. > > Example scenarios that are impacted by this are middleboxes that were > not part of the initial handshake, and hence do not know the PSK. If > the client does not include the "key_share" extension, the middlebox > cannot force a fallback to the full handshake. If the middlebox > policy requires it to inspect the session, it will have to fail the > connection instead. > > [ AFAIK, even with PSK-based resumption, and even when the client's > initial key share was not acceptable to server, the server can still > perform a full handshake after HRR. An MiTM middle-box can replace > the server's HRR with its own, and then decline the client's PSK > and perform a full handshake. ] We will take another look at this part. > > I also found the malicious server argument in section 2.2.1 somewhat > unconvincing, since malicious servers have lots of (previously) > innocuous domains to choose from, or can present self-signed > certificates for any SNI of their choice. It all depends on what you are willing to accept. I still see a difference with TLS 1.3 here. > > The impact of TLS 1.3 is largely limited to making it more difficult > to whitelist "known good" servers from MiTM inspection. With TLS > 1.3 a middle box that wants to be sure to MiTM sessions to "bad" > servers, must also MiTM sessions to "good" servers (in order to > determine that they're really "known good"), because authenticating > a "good" server is no longer possible without MiTM interception. > Blacklists of "known bad" are easily bypassed even with TLS 1.2. > > Middleboxes that are limited to closing TCP connections for the > "known bad", are not particularly effective with TLS 1.2, and will > be increasingly less so as attacks become more sophisticated. A > middlebox that wants to detect the bad must do MiTM interception, > and with TLS 1.3 will need to intercept *all* traffic, even the > previously "known good", once the "known good" peer deploys TLS 1.3. > > Yes, optimizing out interception of the "authenticated known good" > is no longer possible. > Ok - thanks for the feedback. -- Flemming --------------E3F3453CD12AD7FF397ADBAF Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 7bit

On 7/23/19 4:14 PM, Viktor Dukhovni wrote:
On Sun, Jul 21, 2019 at 01:51:32PM +0000, Nancy Cam-Winget (ncamwing) wrote:


Thanks to all the feedback provided, we have updated the https://tools.ietf.org/html/draft-camwinget-tls-use-cases-04
draft.  At this point, we believe the draft is stable and would like to request its publication as an informational draft.

I found the language of the draft (especially the introduction)
somewhat turgid and repetitive to the point of significantly
detracting from readability.  I think the draft needs substantial
editing for simplicity and clarity.
If you have any specific text suggestions, please let us know. 
As to specific technical issues, I don't understand the point being
made in Section 2.2.2 about client key shares and resumption:

   In TLS 1.3, the above mechanism is replaced by Pre-Shared Keys (PSK),
   which can be negotiated as part of an initial handshake and then used
   in a subsequent handshake to perform resumption using the PSK.  TLS
   1.3 states that the client SHOULD include a "key_share" extension to
   enable the server to decline resumption and fall back to a full
   handshake, however it is not an absolute requirement.

   Example scenarios that are impacted by this are middleboxes that were
   not part of the initial handshake, and hence do not know the PSK.  If
   the client does not include the "key_share" extension, the middlebox
   cannot force a fallback to the full handshake.  If the middlebox
   policy requires it to inspect the session, it will have to fail the
   connection instead.

[ AFAIK, even with PSK-based resumption, and even when the client's
  initial key share was not acceptable to server, the server can still
  perform a full handshake after HRR.  An MiTM middle-box can replace
  the server's HRR with its own, and then decline the client's PSK
  and perform a full handshake. ]

We will take another look at this part. 

I also found the malicious server argument in section 2.2.1 somewhat
unconvincing, since malicious servers have lots of (previously)
innocuous domains to choose from, or can present self-signed
certificates for any SNI of their choice.
It all depends on what you are willing to accept. I still see a difference with TLS 1.3 here. 


The impact of TLS 1.3 is largely limited to making it more difficult
to whitelist "known good" servers from MiTM inspection.  With TLS
1.3 a middle box that wants to be sure to MiTM sessions to "bad"
servers, must also MiTM sessions to "good" servers (in order to
determine that they're really "known good"), because authenticating
a "good" server is no longer possible without MiTM interception.
Blacklists of "known bad" are easily bypassed even with TLS 1.2.

Middleboxes that are limited to closing TCP connections for the
"known bad", are not particularly effective with TLS 1.2, and will
be increasingly less so as attacks become more sophisticated.  A
middlebox that wants to detect the bad must do MiTM interception,
and with TLS 1.3 will need to intercept *all* traffic, even the
previously "known good", once the "known good" peer deploys TLS 1.3.

Yes, optimizing out interception of the "authenticated known good"
is no longer possible.
Ok - thanks for the feedback.

-- Flemming
--------------E3F3453CD12AD7FF397ADBAF-- From nobody Tue Jul 23 14:05:35 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 543D21209CC for ; Tue, 23 Jul 2019 14:05:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=akamai.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Dw2nApBmHHsB for ; Tue, 23 Jul 2019 14:05:22 -0700 (PDT) Received: from mx0b-00190b01.pphosted.com (mx0b-00190b01.pphosted.com [IPv6:2620:100:9005:57f::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 888931209D1 for ; Tue, 23 Jul 2019 14:05:22 -0700 (PDT) Received: from pps.filterd (m0122330.ppops.net [127.0.0.1]) by mx0b-00190b01.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id x6NL26Kc028306; Tue, 23 Jul 2019 22:05:20 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=akamai.com; h=from : to : cc : subject : date : message-id : references : in-reply-to : content-type : mime-version; s=jan2016.eng; bh=vXBdtveGumpEVBNKbrX7lykmd9o5Y2nu2jus32nK/To=; b=OdAmhRwvPLf+/SDxM7cGcQ27b/BgJdWRsXg7BYXJZe6wYuLuvnjnmhSnXIDXV4P6m72I vFcuicsossn2922tRLzu5NVqrYhqVGm83UxhVb+gldhVIGCsVDGJColmFb2TmAZmcCHC WL5OcpnZTMcteSaB2e2HD32d6Sc3Y3An82kVIpxEvZWs2s8jtn49Gp3BoUQLdtajhtyB akwkbI4Zoeere8+9vyO+7VW8k2EJZ4G5+iFSIIIsNDVJ27iUNmfE6KdxzFqmFXxRfYNh Dm40K8RaFt+uUm0MLumpfqHHhPQfh3QjEyPn5rMdE3foGdz6UgTEjMxJLU9ai0sGAOzK 1w== Received: from prod-mail-ppoint5 (prod-mail-ppoint5.akamai.com [184.51.33.60] (may be forged)) by mx0b-00190b01.pphosted.com with ESMTP id 2tx60trr7q-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 23 Jul 2019 22:05:20 +0100 Received: from pps.filterd (prod-mail-ppoint5.akamai.com [127.0.0.1]) by prod-mail-ppoint5.akamai.com (8.16.0.27/8.16.0.27) with SMTP id x6NL3Bf1011820; Tue, 23 Jul 2019 14:05:19 -0700 Received: from email.msg.corp.akamai.com ([172.27.123.34]) by prod-mail-ppoint5.akamai.com with ESMTP id 2tx62xr6jq-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Tue, 23 Jul 2019 14:05:18 -0700 Received: from USMA1EX-DAG1MB5.msg.corp.akamai.com (172.27.123.105) by usma1ex-dag1mb1.msg.corp.akamai.com (172.27.123.101) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Tue, 23 Jul 2019 17:05:18 -0400 Received: from USMA1EX-DAG1MB1.msg.corp.akamai.com (172.27.123.101) by usma1ex-dag1mb5.msg.corp.akamai.com (172.27.123.105) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Tue, 23 Jul 2019 17:05:18 -0400 Received: from USMA1EX-DAG1MB1.msg.corp.akamai.com ([172.27.123.101]) by usma1ex-dag1mb1.msg.corp.akamai.com ([172.27.123.101]) with mapi id 15.00.1473.005; Tue, 23 Jul 2019 17:05:18 -0400 From: "Salz, Rich" To: Flemming Andreasen , Watson Ladd , Bret Jordan CC: TLS List Thread-Topic: [TLS] TLS Impact on Network Security draft updated Thread-Index: AQHVP8tnovYBmAyQbUu5TybMCHUv66bYlBUAgAA6R4CAACXZAP//wNyA Date: Tue, 23 Jul 2019 21:05:17 +0000 Message-ID: <8810E389-0317-4198-88B2-6AA40E85E65B@akamai.com> References: <6AF48228-19C2-41C7-BA86-BA16940C3CFF@cisco.com> <016da638-6973-809b-0a24-42b2c9682b64@cisco.com> In-Reply-To: <016da638-6973-809b-0a24-42b2c9682b64@cisco.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.1b.0.190715 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [172.19.36.156] Content-Type: multipart/alternative; boundary="_000_8810E3890317419888B26AA40E85E65Bakamaicom_" MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-07-23_09:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 mlxscore=0 mlxlogscore=801 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1906280000 definitions=main-1907230213 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:5.22.84,1.0.8 definitions=2019-07-23_09:2019-07-23,2019-07-23 signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 mlxscore=0 spamscore=0 suspectscore=0 adultscore=0 priorityscore=1501 mlxlogscore=769 lowpriorityscore=0 malwarescore=0 impostorscore=0 bulkscore=0 phishscore=0 clxscore=1011 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-1906280000 definitions=main-1907230213 Archived-At: Subject: Re: [TLS] TLS Impact on Network Security draft updated X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 Jul 2019 21:05:34 -0000 --_000_8810E3890317419888B26AA40E85E65Bakamaicom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 V2hhdCBkb2VzIGl0IHNheSB0aGF0IFJGQyA4NDA0IGRvZXNu4oCZdD8NCg== --_000_8810E3890317419888B26AA40E85E65Bakamaicom_ Content-Type: text/html; charset="utf-8" Content-ID: <2965010A309EC94285FB638FAA757FFD@akamai.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2 IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToy IDE1IDUgMiAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNvbnNvbGFz Ow0KCXBhbm9zZS0xOjIgMTEgNiA5IDIgMiA0IDMgMiA0O30NCi8qIFN0eWxlIERlZmluaXRpb25z ICovDQpwLk1zb05vcm1hbCwgbGkuTXNvTm9ybWFsLCBkaXYuTXNvTm9ybWFsDQoJe21hcmdpbjow aW47DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMS4wcHQ7DQoJZm9udC1m YW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0KYTpsaW5rLCBzcGFuLk1zb0h5cGVybGluaw0K CXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6Ymx1ZTsNCgl0ZXh0LWRlY29yYXRpb246 dW5kZXJsaW5lO30NCmE6dmlzaXRlZCwgc3Bhbi5Nc29IeXBlcmxpbmtGb2xsb3dlZA0KCXttc28t c3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6cHVycGxlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRl cmxpbmU7fQ0KcHJlDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgltc28tc3R5bGUtbGluazoi SFRNTCBQcmVmb3JtYXR0ZWQgQ2hhciI7DQoJbWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4w MDAxcHQ7DQoJZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseToiQ291cmllciBOZXciO30N CnAubXNvbm9ybWFsMCwgbGkubXNvbm9ybWFsMCwgZGl2Lm1zb25vcm1hbDANCgl7bXNvLXN0eWxl LW5hbWU6bXNvbm9ybWFsOw0KCW1zby1tYXJnaW4tdG9wLWFsdDphdXRvOw0KCW1hcmdpbi1yaWdo dDowaW47DQoJbXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87DQoJbWFyZ2luLWxlZnQ6MGluOw0K CWZvbnQtc2l6ZToxMS4wcHQ7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0K c3Bhbi5tMjYwMTg4ODIyNjMyMzg5MTY3N20tNzQ5NDMxNTU1MDQ5MTE1MDg1N2FwcGxlLXN0eWxl LXNwYW4NCgl7bXNvLXN0eWxlLW5hbWU6bV8yNjAxODg4MjI2MzIzODkxNjc3bV8tNzQ5NDMxNTU1 MDQ5MTE1MDg1N2FwcGxlLXN0eWxlLXNwYW47fQ0Kc3Bhbi5tMjYwMTg4ODIyNjMyMzg5MTY3N20t NzQ5NDMxNTU1MDQ5MTE1MDg1N2FwcGxlLWNvbnZlcnRlZC1zcGFjZQ0KCXttc28tc3R5bGUtbmFt ZTptXzI2MDE4ODgyMjYzMjM4OTE2NzdtXy03NDk0MzE1NTUwNDkxMTUwODU3YXBwbGUtY29udmVy dGVkLXNwYWNlO30NCnNwYW4uSFRNTFByZWZvcm1hdHRlZENoYXINCgl7bXNvLXN0eWxlLW5hbWU6 IkhUTUwgUHJlZm9ybWF0dGVkIENoYXIiOw0KCW1zby1zdHlsZS1wcmlvcml0eTo5OTsNCgltc28t c3R5bGUtbGluazoiSFRNTCBQcmVmb3JtYXR0ZWQiOw0KCWZvbnQtZmFtaWx5OkNvbnNvbGFzO30N CnNwYW4uRW1haWxTdHlsZTIyDQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZv bnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0KLk1z b0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1zaXplOjEw LjBwdDt9DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo4LjVpbiAxMS4waW47DQoJbWFyZ2lu OjEuMGluIDEuMGluIDEuMGluIDEuMGluO30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7cGFnZTpXb3Jk U2VjdGlvbjE7fQ0KLS0+PC9zdHlsZT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9IkVOLVVTIiBsaW5r PSJibHVlIiB2bGluaz0icHVycGxlIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj5XaGF0IGRvZXMgaXQgc2F5IHRoYXQgUkZDIDg0MDQgZG9lc27igJl0 PzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_8810E3890317419888B26AA40E85E65Bakamaicom_-- From nobody Tue Jul 23 14:10:08 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 247FE120A0C for ; Tue, 23 Jul 2019 14:09:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CJXG9d_K3Ne1 for ; Tue, 23 Jul 2019 14:09:56 -0700 (PDT) Received: from mail-lj1-x229.google.com (mail-lj1-x229.google.com [IPv6:2a00:1450:4864:20::229]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D6B8A1209C6 for ; Tue, 23 Jul 2019 14:09:55 -0700 (PDT) Received: by mail-lj1-x229.google.com with SMTP id m23so42346061lje.12 for ; Tue, 23 Jul 2019 14:09:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=LsKoG9VIsT7zXF+JoQg4hXtFTcqa81V5IViPgWKDcp8=; b=uvBFNBu81BhCaHV2tZ8Kbhu4NFaM2wrBZM/DkeZfC0PtgF7ZJUxsT2PsAyJcYyn93V A6L79Qbn07eH/Ul8wkcRRlFcZGMUeJgLU8irCh4z/WQ7eW1VWO2aiVE1RNU7N/RZptF8 NjEfMj2fIpP2G9ITQtnjJtibvbn/hQ91CjofBTCtOCrWdgJFBu8Gy3+GTntmXrIYnD+o t3N5Zo5k3+JJNPnk1cGZ4wHL2sxH8I3Hx6r5XddW/zVy/b9f8XElTQZ0Y/gd7SToOXLu ov29T+pB1A3Uht5Q0fpDEnpw/t5yfyCqB0rEURTzRuvbgWPxZOp5r1dRfExD51CFVxu9 qv/w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=LsKoG9VIsT7zXF+JoQg4hXtFTcqa81V5IViPgWKDcp8=; b=Ann1mijwvTlRXflxRdRijsnxsDHkT3yDkxBbjQ2++LLuBh3qRnkwtUwdsEn2Ul+z/m Bhu/QiDq2I46VCEatF3xaHHiSISXHm9yxvNaTppnHDfIxvL2PDtXJ+WiI/oOy1UeZWJH 9f7VIzXlsHPYDcoYQKOY5nV0R2SO4za3ZH1ykFjYehXlAbnNVNRIBDt0sPYnknJWYvr9 431PX7yKP/xnBuiVwDGOQmI1MiTFlPYNPuOejR7e1+o9KA5fHvJkWbVq35224Aw3fFCo kSV/lwZFT7uNL03hNDhGD7ggt0I1m/6ZwS61KTi+FKkfP2nMgt/ofrmqjGmEgMWD4jHD bNYA== X-Gm-Message-State: APjAAAU6riOA20Yc67hvYy3uPxMB0Q0QbELMLNzs9dupPz2FsclETF2D 5cbDTnetdg2HdG5oBgF6Xf6Jd4LN3FttaM+qmvM= X-Google-Smtp-Source: APXvYqwBIZeIknY98o/c7sv7tCTkjElPa6AAPJx2DruG3FdV+GyM5txjNQ11696ShmTgcjRvkKwK33poRBn20EntZNE= X-Received: by 2002:a2e:b0e6:: with SMTP id h6mr38969757ljl.18.1563916194022; Tue, 23 Jul 2019 14:09:54 -0700 (PDT) MIME-Version: 1.0 References: <6AF48228-19C2-41C7-BA86-BA16940C3CFF@cisco.com> <016da638-6973-809b-0a24-42b2c9682b64@cisco.com> In-Reply-To: <016da638-6973-809b-0a24-42b2c9682b64@cisco.com> From: Watson Ladd Date: Tue, 23 Jul 2019 14:09:41 -0700 Message-ID: To: "Flemming Andreasen (fandreas)" Cc: Bret Jordan , TLS List Content-Type: multipart/alternative; boundary="000000000000340a34058e5f9d2e" Archived-At: Subject: Re: [TLS] TLS Impact on Network Security draft updated X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 Jul 2019 21:10:06 -0000 --000000000000340a34058e5f9d2e Content-Type: text/plain; charset="UTF-8" On Tue, Jul 23, 2019, 1:51 PM Flemming Andreasen wrote: > > > On 7/23/19 2:35 PM, Watson Ladd wrote: > > This draft contains substantial omissions in section 3. > > Nothing in TLS 1.3 prevents scanning for servers and examining the > certificates they present. > > Agreed, however there is no guarantee that the server will present the > same certificate and other TLS parameters as it will for a particular > client connection > True but for 99% (WAG) of setups this is driven by SNI and ciphersuite which you see in the clear. Nothing in TLS 1.3 prevents using reverse proxies to provide WAF > functionality. > > Agreed however you need to terminate the TLS 1.3 connection at that WAF > That doesn't sound like a big difficulty especially given the WAF was intercepting and decrypting before. What is the gain here? It's also more secure: there is fun with headers that doesnt work if the WAF normalizes. PCI-DSS compliance is not at odds with deploying TLS 1.3. In fact the > citation to A2 is to a sun-setting of all pre TLS 1.2 versions for point of > sale terminals. I really don't see where the conflict exists since all > ciphers in 1.3 are secure. > > I'll defer to one of my co-authors on this one. > > The absence of these solutions means the draft overstates the impact of > the increased protection TLS 1.3 provides. It's disappointing to see > sustained and persistent opposition to encryption and privacy despite > multiple RFCs saying that yes we should encrypt all the things. > > The draft is submitted with the intent of informing the community about > impacts as we see them. The authors welcome discussion and constructive > feedback and we will be happy to update and improve the draft accordingly > when such information is provided and consensus forms around it. Specific > text suggestions will be even better. > I seem to remember a discussion during the last call of TLS 1.3 where these issues were raised. I think at minimum pointing out that this only affects some networks with some choices of how to do things and that other techniques (like reverse proxies) can achieve the same ends is necessary if the goal is actually to help operators cope with TLS 1.3. > Thanks > > -- Flemming > > > On Tue, Jul 23, 2019, 8:08 AM Bret Jordan wrote: > >> Nancy, >> >> I support this work and think this draft should be published. This is a >> yet another good write up on some of the requirements that are needed for >> operational security. >> >> Thanks, >> Bret >> PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 >> "Without cryptography vihv vivc ce xhrnrw, however, the only thing that >> can not be unscrambled is an egg." >> >> On Jul 21, 2019, at 9:51 AM, Nancy Cam-Winget (ncamwing) < >> ncamwing@cisco.com> wrote: >> >> Hi, >> Thanks to all the feedback provided, we have updated the >> https://tools.ietf.org/html/draft-camwinget-tls-use-cases-04 >> draft. At this point, we believe the draft is stable and would like to >> request its publication as an informational draft. >> >> Warm regards, >> Nancy >> >> >> _______________________________________________ >> TLS mailing list >> TLS@ietf.org >> https://www.ietf.org/mailman/listinfo/tls >> >> >> _______________________________________________ >> TLS mailing list >> TLS@ietf.org >> https://www.ietf.org/mailman/listinfo/tls >> > > _______________________________________________ > TLS mailing listTLS@ietf.orghttps://www.ietf.org/mailman/listinfo/tls > > > --000000000000340a34058e5f9d2e Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


On Tue, Jul 23, 2019, 1:51 PM Flemming Andreasen <<= a href=3D"mailto:fandreas@cisco.com">fandreas@cisco.com> wrote:
<= /div>
=20 =20 =20


On 7/23/19 2:35 PM= , Watson Ladd wrote:
=20
This draft contains substantial omissions in section 3.

Nothing in TLS 1.3 prevents scanning for servers and examining the certificates they present.
Agreed, however there is no guarantee that the server will present the same certificate and other TLS parameters as it will for a particular client connection

True but for 99% (WAG) of setups this is = driven by SNI and ciphersuite which you see in the clear.

Nothing in TLS 1.3 prevents using reverse proxies to provide WAF functionality.
Agreed however you need to terminate the TLS 1.3 connection at that WAF

That doesn't sound like a big difficulty especially given the= WAF was intercepting and decrypting before. What is the gain here? It'= s also more secure: there is fun with headers that doesnt work if the WAF n= ormalizes.

PCI-DSS compliance is not at odds with deploying TLS 1.3. In fact the citation to A2 is to a sun-setting of all pre TLS 1.2 versions for point of sale terminals. I really don't see where the conflict exists since all ciphers in 1.3 are secure.

I'll defer to one of my co-authors on this one.
The absence of these solutions means the draft overstates the impact of the increased protection TLS 1.3 provides. It's disappointing to see sustained and persisten= t opposition to encryption and privacy despite multiple RFCs saying that yes we should encrypt all the things.

The draft is submitted with the intent of informing the community about impacts as we see them. The authors welcome discussion and constructive feedback and we will be happy to update and improve the draft accordingly when such information is provided and consensus forms around it. Specific text suggestions will be even better.

I = seem to remember a discussion during the last call of TLS 1.3 where these i= ssues were raised. I think at minimum pointing out that this only affects s= ome networks with some choices of how to do things and that other technique= s (like reverse proxies) can achieve the same ends is necessary if the goal= is actually to help operators cope with TLS 1.3.

Thanks

-- Flemming

On Tue, Jul 23, 2019, 8:0= 8 AM Bret Jordan <jordan.ietf@gmail.com>= ; wrote:
Nancy,

I support this work and think this draft should be published. This is a yet another good write up on some of the requirements that are needed for operational security.=C2=A0

Thanks,
Br= et
PGP Fingerprint:=C2=A063= B4 FC53 680A 6B7D 1447 =C2=A0F2C= 0 74F8 ACAE 7415 0050
"Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg."

On Jul 21, 2019, at 9:51 AM, Nancy Cam-Winget (ncamwing) <ncamwing@cisco= .com> wrote:

Hi,
Thanks t= o all the feedback provided, we have updated the=C2=A0https://tools.ietf.org/html/draft-camwinget-tls-use-cases-04
draft.= =C2=A0 At this point, we believe the draft is stable and would like to request its publication as an informational draft.
=C2=A0
Warm reg= ards,=C2=A0
=C2=A0= =C2=A0=C2=A0=C2=A0Nancy
=C2=A0
=C2=A0
_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls=

_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.= ietf.org/mailman/listinfo/tls

__________________=
_____________________________
TLS mailing list
TLS@ietf.org
https=
://www.ietf.org/mailman/listinfo/tls

--000000000000340a34058e5f9d2e-- From nobody Tue Jul 23 14:52:33 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1FFD81200FD for ; Tue, 23 Jul 2019 14:52:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1LyXK1Nbqjd0 for ; Tue, 23 Jul 2019 14:52:28 -0700 (PDT) Received: from mail-qt1-x82c.google.com (mail-qt1-x82c.google.com [IPv6:2607:f8b0:4864:20::82c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0640D12001B for ; Tue, 23 Jul 2019 14:52:28 -0700 (PDT) Received: by mail-qt1-x82c.google.com with SMTP id d23so43461484qto.2 for ; Tue, 23 Jul 2019 14:52:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=K8Wr+YLmq7lyehunZmpJvJao+3TyPrR5jDICGIz58Nw=; b=hkRZ5QVWxE8ZDg6jinnvFmtpgNq4OJa900maW638bIXwjWp7N1hodcf3KJkVXfz7wQ D/+z4Odf9/44SRnPzNurcD89srr0ucHWkGqlXceGzNmmC7STNN7uoyGQYn5BujrrdXGh 7/igdTZ2uu7dBL6KdO8Kpxn4M6ypwaZdZY3/Jqx3Cw9698rpMGo9e280mD+t69If6+k2 yHvBiuysVv5l+VRv1sYsPLqfh1Ct9S8KHS4TO3WAvkE9z60FvFRa/D8R9+lZ0Uppxjre L/j4NWVWf/Yd5gKlUR7RabWDT065qEtcmTrVTzv1QzLXcjNx/BZVMqs7Jr6k1iELwzfW 0GVg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=K8Wr+YLmq7lyehunZmpJvJao+3TyPrR5jDICGIz58Nw=; b=ThiD8ctYgksForCj7KxVWn2tk2nnRXDVJ571j+L4jaMKq13Xxatwr8r7P2DJh/u9a7 fc1g28tYO1irJf7eIDTn2QFVCOCjzLKgg/RiigStl5It6Lrfk6Bxp3fWFRQitkiaQau3 hZDZABG7wPVW296dQqo4L0VknyC41MITqpJNbS+MYfjb8ZaAjYmpqoM/Vv+a34q23fDx TaaEiFf4dJ0T/ki+6LjDIlsPzmPLfoiiy0JlQ/SLM3+9nQR748f6jZ0ouqD8i1A9jSH0 /O1slxr04iE5qz0wDyFo4gw14agIOy7o08lYpI7olILOX2O/dsEpXaJ+8BBtzwYG0SMQ f9+A== X-Gm-Message-State: APjAAAUMlpB4eWDLaiclucgsOAEayk9xj0M8rmaXWp540V/ep9qsGonR GheUomSTlEYdkf8pQIocgpk= X-Google-Smtp-Source: APXvYqzmyT9s57M2B5KYvvzBgdhgzYcvQcXxLdPF1MLBZZL5f/LB3YRqi+fHEROzYPcuOXfuUVe4zw== X-Received: by 2002:a0c:b095:: with SMTP id o21mr57533557qvc.73.1563918747083; Tue, 23 Jul 2019 14:52:27 -0700 (PDT) Received: from ?IPv6:2001:67c:370:128:19cc:7940:a396:841a? ([2001:67c:370:128:19cc:7940:a396:841a]) by smtp.gmail.com with ESMTPSA id g3sm18779549qkk.125.2019.07.23.14.52.25 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 23 Jul 2019 14:52:26 -0700 (PDT) From: Bret Jordan Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_67774989-F7DA-4BD9-B4C6-11A969E8C417" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Tue, 23 Jul 2019 17:52:21 -0400 In-Reply-To: Cc: Tony Arcieri , "tls@ietf.org" To: Sean Turner References: <6AF48228-19C2-41C7-BA86-BA16940C3CFF@cisco.com> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [TLS] TLS Impact on Network Security draft updated X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 Jul 2019 21:52:31 -0000 --Apple-Mail=_67774989-F7DA-4BD9-B4C6-11A969E8C417 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Thanks Sean. =20 It is critical that we understand and discuss all sides of an issue and = address all use cases that market has. Beating people down and trying to = attack people or their use cases is not something we should be doing in = formal standards, especially here at the IETF. Thanks, Bret PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 "Without cryptography vihv vivc ce xhrnrw, however, the only thing that = can not be unscrambled is an egg." > On Jul 23, 2019, at 4:51 PM, Sean Turner wrote: >=20 > Tony, >=20 > While you may have concerns or otherwise disagree with the contents of = this draft, let=E2=80=99s please keep discussion on this list, on all = issues, polite and professional. >=20 > spt > (as co-chair) >=20 >> On Jul 23, 2019, at 16:05, Tony Arcieri wrote: >>=20 >> On Sun, Jul 21, 2019 at 6:51 AM Nancy Cam-Winget (ncamwing) = wrote: >> Hi, >>=20 >> Thanks to all the feedback provided, we have updated the = https://tools.ietf.org/html/draft-camwinget-tls-use-cases-04 >>=20 >> draft. At this point, we believe the draft is stable and would like = to request its publication as an informational draft. >>=20 >>=20 >> I read this draft as the latest attempt in a disinformation campaign = by manufacturers and users of middleboxes that passively decrypt TLS = connections to politicize and reframe the argument around what is, at = its core, a fundamentally insecure practice which is incompatible with = technically sound and highly desirable protocol improvements to TLS. >>=20 >> I implore you stop using overly broad terminology, euphemisms, weasel = words, and other deceptive language to argue your points. >>=20 >> This draft is titled "TLS 1.3 Impact on Network-Based Security", but = the subtext is quite clearly the much narrower subfield of middlebox TLS = decryption. By using such a grandiose title which is deceptively hiding = the true subject matter, you are implying that middleboxes are the sum = total of network security. >>=20 >> The draft begins "Enterprises [...] need to defend their information = systems from attacks originating from both inside and outside their = networks." I am co-owner of a company which heavily leverages firewalls = for layer 3/4 network security in conjunction with TLS. We care deeply = about network security, and believe that our network is *more secure* = specifically because we *don't* perform middlebox interception of TLS. >>=20 >> I consider our company to be in the category of enterprise TLS users, = and as an enterprise TLS user who cares deeply about network security, I = do not identify whatsoever with the claims this draft is making about = the needs of enterprise TLS users as a whole. In as much as what it = describes to "network security", it is but one niche consideration = within a vastly broader field, and one which is increasingly = controversial. >>=20 >> I will point out, since you appear to work at Cisco, that your = company works on approaches to network security (e.g. malware detection) = which avoid decrypting TLS: >>=20 >> = https://blogs.cisco.com/security/detecting-encrypted-malware-traffic-witho= ut-decryption >>=20 >> There is an entire world of network IDS systems beyond middleboxes = which passively decrypt TLS. >>=20 >> It is factually inaccurate for this draft to be described as "TLS 1.3 = Impact on Network-Based Security". If you are going to write a draft = about the impact of TLS 1.3 on middleboxes for passive TLS decryption, = please call a spade a spade and don't try to hide your true intentions = under a bunch of weasel words and overly broad claims that make it sound = like middlebox-related TLS decryption problems are the end of network = security as we know it. >>=20 >> My 2c, on behalf of non-middlebox-using enterprise TLS users who feel = that attempts by middlebox-using enterprise TLS users to weaken TLS in = order to retain compatibility with their traffic decryption appliances = is a threat to the security of our enterprise TLS deployments. >> _______________________________________________ >> TLS mailing list >> TLS@ietf.org >> https://www.ietf.org/mailman/listinfo/tls >=20 > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls --Apple-Mail=_67774989-F7DA-4BD9-B4C6-11A969E8C417 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Thanks Sean.  

It is critical that we understand and discuss all sides of an = issue and address all use cases that market has. Beating people down and = trying to attack people or their use cases is not something we should be = doing in formal standards, especially here at the IETF.

Thanks,
Bret
PGP = Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 = 0050
"Without = cryptography vihv vivc ce xhrnrw, however, the only thing that can not = be unscrambled is an = egg."

On Jul 23, 2019, at 4:51 PM, Sean Turner <sean@sn3rd.com> = wrote:

Tony,

While you may have = concerns or otherwise disagree with the contents of this draft, let=E2=80=99= s please keep discussion on this list, on all issues, polite and = professional.

spt
(as = co-chair)

On Jul 23, 2019, at 16:05, Tony Arcieri <bascule@gmail.com> = wrote:

On Sun, Jul 21, 2019 at 6:51 AM = Nancy Cam-Winget (ncamwing) <ncamwing@cisco..com> wrote:
Hi,

Thanks to all the feedback = provided, we have updated the https://tools.ietf.org/html/draft-camwinget-tls-use-cases-04

draft.  At this point, we believe = the draft is stable and would like to request its publication as an = informational draft.


I read = this draft as the latest attempt in a disinformation campaign by = manufacturers and users of middleboxes that passively decrypt TLS = connections to politicize and reframe the argument around what is, at = its core, a fundamentally insecure practice which is incompatible with = technically sound and highly desirable protocol improvements to TLS.

I implore you stop using overly broad = terminology, euphemisms, weasel words, and other deceptive language to = argue your points.

This draft is titled = "TLS 1.3 Impact on Network-Based Security", but the subtext is quite = clearly the much narrower subfield of middlebox TLS decryption. By using = such a grandiose title which is deceptively hiding the true subject = matter, you are implying that middleboxes are the sum total of network = security.

The draft begins "Enterprises = [...] need to defend their information systems from attacks originating = from both inside and outside their networks." I am co-owner of a company = which heavily leverages firewalls for layer 3/4 network security in = conjunction with TLS. We care deeply about network security, and believe = that our network is *more secure* specifically because we *don't* = perform middlebox interception of TLS.

I = consider our company to be in the category of enterprise TLS users, and = as an enterprise TLS user who cares deeply about network security, I do = not identify whatsoever with the claims this draft is making about the = needs of enterprise TLS users as a whole. In as much as what it = describes to "network security", it is but one niche consideration = within a vastly broader field, and one which is increasingly = controversial.

I will point out, since you = appear to work at Cisco, that your company works on approaches to = network security (e.g. malware detection) which avoid decrypting TLS:

https://blogs.cisco.com/security/detecting-encrypted-malware-tr= affic-without-decryption

There is an = entire world of network IDS systems beyond middleboxes which passively = decrypt TLS.

It is factually inaccurate for = this draft to be described as "TLS 1.3 Impact on Network-Based = Security". If you are going to write a draft about the impact of TLS 1.3 = on middleboxes for passive TLS decryption, please call a spade a spade = and don't try to hide your true intentions under a bunch of weasel words = and overly broad claims that make it sound like middlebox-related TLS = decryption problems are the end of network security as we know it.

My 2c, on behalf of non-middlebox-using = enterprise TLS users who feel that attempts by middlebox-using = enterprise TLS users to weaken TLS in order to retain compatibility with = their traffic decryption appliances is a threat to the security of our = enterprise TLS deployments.
_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls

_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls

= --Apple-Mail=_67774989-F7DA-4BD9-B4C6-11A969E8C417-- From nobody Tue Jul 23 14:55:59 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E6BA31202D7 for ; Tue, 23 Jul 2019 14:55:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.127 X-Spam-Level: X-Spam-Status: No, score=-1.127 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, FROM_WORDY=1.571, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=protonmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KhvGh77bdYJu for ; Tue, 23 Jul 2019 14:55:44 -0700 (PDT) Received: from mail2.protonmail.ch (mail2.protonmail.ch [185.70.40.22]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 947411209B9 for ; Tue, 23 Jul 2019 14:55:44 -0700 (PDT) Date: Tue, 23 Jul 2019 21:55:39 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=protonmail.com; s=default; t=1563918942; bh=6PlGuVig/yimIPeSb2Y5icaMsqSWaUxuwzM5HVRn0jc=; h=Date:To:From:Cc:Reply-To:Subject:In-Reply-To:References: Feedback-ID:From; b=sXjpvhNrRlOiOODoFw1YL3Jnnvr0Q0Y/sJlkRfQuNCKcFdCs+mwZJvS+Qf27S04TR p49u80J4K93TsCCL2l05b7Cb6zN/pO23JejnOt1fGGVq0uULn22BSuYxa0OuqtOQjT GSQp8csDfdQhSveWWjXXBayXMnmU/PfC66Beqcrg= To: Bret Jordan From: "Arnaud.Taddei.IETF" Cc: Sean Turner , Tony Arcieri , "tls@ietf.org" Reply-To: "Arnaud.Taddei.IETF" Message-ID: In-Reply-To: References: <6AF48228-19C2-41C7-BA86-BA16940C3CFF@cisco.com> Feedback-ID: kou6vaSHQeY5dgFN9dCIYKo4z6hnnNmKuV4IBJw2wx4vSVPtftyhWUTBigri6zMJ3K1hxYJjI-3RAIGaizMt5g==:Ext:ProtonMail MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="b1_8156179df14d6be93e71654e0ba9d934" Archived-At: Subject: Re: [TLS] TLS Impact on Network Security draft updated X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 Jul 2019 21:55:56 -0000 This is a multi-part message in MIME format. --b1_8156179df14d6be93e71654e0ba9d934 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: base64 KzEsIG5ldXRyYWxpdHkgaXMgYXBwcmVjaWF0ZWQsIHRoYW5rIHlvdSBTZWFuCgpDb2xsZWN0aW5n IGV4cHJlc3NlZCB2aWV3cyBzaG91bGQgcHJldmFpbCBpbiBhIG5ldXRyYWwgd2F5LCB0aGVyZSBp cyBubyByZWFzb24gd2h5IGluYXBwcm9wcmlhdGUgYmVoYXZpb3VyIHNob3VsZCBiZSB0b2xlcmF0 ZWQgYW5kIGxldCB0aGUgaW1wcmVzc2lvbiB0aGF0IHRoZSBsb3VkZXN0IHZvaWNlIGlzIHByZXZh aWxpbmcKClNlbnQgd2l0aCBbUHJvdG9uTWFpbF0oaHR0cHM6Ly9wcm90b25tYWlsLmNvbSkgU2Vj dXJlIEVtYWlsLgoK4oCQ4oCQ4oCQ4oCQ4oCQ4oCQ4oCQIE9yaWdpbmFsIE1lc3NhZ2Ug4oCQ4oCQ 4oCQ4oCQ4oCQ4oCQ4oCQCk9uIFR1ZXNkYXkgMjMgSnVseSAyMDE5IDE3OjUyLCBCcmV0IEpvcmRh biA8am9yZGFuLmlldGZAZ21haWwuY29tPiB3cm90ZToKCj4gVGhhbmtzIFNlYW4uCj4KPiBJdCBp cyBjcml0aWNhbCB0aGF0IHdlIHVuZGVyc3RhbmQgYW5kIGRpc2N1c3MgYWxsIHNpZGVzIG9mIGFu IGlzc3VlIGFuZCBhZGRyZXNzIGFsbCB1c2UgY2FzZXMgdGhhdCBtYXJrZXQgaGFzLiBCZWF0aW5n IHBlb3BsZSBkb3duIGFuZCB0cnlpbmcgdG8gYXR0YWNrIHBlb3BsZSBvciB0aGVpciB1c2UgY2Fz ZXMgaXMgbm90IHNvbWV0aGluZyB3ZSBzaG91bGQgYmUgZG9pbmcgaW4gZm9ybWFsIHN0YW5kYXJk cywgZXNwZWNpYWxseSBoZXJlIGF0IHRoZSBJRVRGLgo+Cj4gVGhhbmtzLAo+IEJyZXQKPiBQR1Ag RmluZ2VycHJpbnQ6IDYzQjQgRkM1MyA2ODBBIDZCN0QgMTQ0NyAgRjJDMCA3NEY4IEFDQUUgNzQx NSAwMDUwCj4gIldpdGhvdXQgY3J5cHRvZ3JhcGh5IHZpaHYgdml2YyBjZSB4aHJucncsIGhvd2V2 ZXIsIHRoZSBvbmx5IHRoaW5nIHRoYXQgY2FuIG5vdCBiZSB1bnNjcmFtYmxlZCBpcyBhbiBlZ2cu Igo+Cj4+IE9uIEp1bCAyMywgMjAxOSwgYXQgNDo1MSBQTSwgU2VhbiBUdXJuZXIgPHNlYW5Ac24z cmQuY29tPiB3cm90ZToKPj4KPj4gVG9ueSwKPj4KPj4gV2hpbGUgeW91IG1heSBoYXZlIGNvbmNl cm5zIG9yIG90aGVyd2lzZSBkaXNhZ3JlZSB3aXRoIHRoZSBjb250ZW50cyBvZiB0aGlzIGRyYWZ0 LCBsZXTigJlzIHBsZWFzZSBrZWVwIGRpc2N1c3Npb24gb24gdGhpcyBsaXN0LCBvbiBhbGwgaXNz dWVzLCBwb2xpdGUgYW5kIHByb2Zlc3Npb25hbC4KPj4KPj4gc3B0Cj4+IChhcyBjby1jaGFpcikK Pj4KPj4+IE9uIEp1bCAyMywgMjAxOSwgYXQgMTY6MDUsIFRvbnkgQXJjaWVyaSA8YmFzY3VsZUBn bWFpbC5jb20+IHdyb3RlOgo+Pj4KPj4+IE9uIFN1biwgSnVsIDIxLCAyMDE5IGF0IDY6NTEgQU0g TmFuY3kgQ2FtLVdpbmdldCAobmNhbXdpbmcpIDxuY2Ftd2luZ0BjaXNjby4uY29tPiB3cm90ZToK Pj4+IEhpLAo+Pj4KPj4+IFRoYW5rcyB0byBhbGwgdGhlIGZlZWRiYWNrIHByb3ZpZGVkLCB3ZSBo YXZlIHVwZGF0ZWQgdGhlIGh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1jYW13aW5n ZXQtdGxzLXVzZS1jYXNlcy0wNAo+Pj4KPj4+IGRyYWZ0LiAgQXQgdGhpcyBwb2ludCwgd2UgYmVs aWV2ZSB0aGUgZHJhZnQgaXMgc3RhYmxlIGFuZCB3b3VsZCBsaWtlIHRvIHJlcXVlc3QgaXRzIHB1 YmxpY2F0aW9uIGFzIGFuIGluZm9ybWF0aW9uYWwgZHJhZnQuCj4+Pgo+Pj4gSSByZWFkIHRoaXMg ZHJhZnQgYXMgdGhlIGxhdGVzdCBhdHRlbXB0IGluIGEgZGlzaW5mb3JtYXRpb24gY2FtcGFpZ24g YnkgbWFudWZhY3R1cmVycyBhbmQgdXNlcnMgb2YgbWlkZGxlYm94ZXMgdGhhdCBwYXNzaXZlbHkg ZGVjcnlwdCBUTFMgY29ubmVjdGlvbnMgdG8gcG9saXRpY2l6ZSBhbmQgcmVmcmFtZSB0aGUgYXJn dW1lbnQgYXJvdW5kIHdoYXQgaXMsIGF0IGl0cyBjb3JlLCBhIGZ1bmRhbWVudGFsbHkgaW5zZWN1 cmUgcHJhY3RpY2Ugd2hpY2ggaXMgaW5jb21wYXRpYmxlIHdpdGggdGVjaG5pY2FsbHkgc291bmQg YW5kIGhpZ2hseSBkZXNpcmFibGUgcHJvdG9jb2wgaW1wcm92ZW1lbnRzIHRvIFRMUy4KPj4+Cj4+ PiBJIGltcGxvcmUgeW91IHN0b3AgdXNpbmcgb3Zlcmx5IGJyb2FkIHRlcm1pbm9sb2d5LCBldXBo ZW1pc21zLCB3ZWFzZWwgd29yZHMsIGFuZCBvdGhlciBkZWNlcHRpdmUgbGFuZ3VhZ2UgdG8gYXJn dWUgeW91ciBwb2ludHMuCj4+Pgo+Pj4gVGhpcyBkcmFmdCBpcyB0aXRsZWQgIlRMUyAxLjMgSW1w YWN0IG9uIE5ldHdvcmstQmFzZWQgU2VjdXJpdHkiLCBidXQgdGhlIHN1YnRleHQgaXMgcXVpdGUg Y2xlYXJseSB0aGUgbXVjaCBuYXJyb3dlciBzdWJmaWVsZCBvZiBtaWRkbGVib3ggVExTIGRlY3J5 cHRpb24uIEJ5IHVzaW5nIHN1Y2ggYSBncmFuZGlvc2UgdGl0bGUgd2hpY2ggaXMgZGVjZXB0aXZl bHkgaGlkaW5nIHRoZSB0cnVlIHN1YmplY3QgbWF0dGVyLCB5b3UgYXJlIGltcGx5aW5nIHRoYXQg bWlkZGxlYm94ZXMgYXJlIHRoZSBzdW0gdG90YWwgb2YgbmV0d29yayBzZWN1cml0eS4KPj4+Cj4+ PiBUaGUgZHJhZnQgYmVnaW5zICJFbnRlcnByaXNlcyBbLi4uXSBuZWVkIHRvIGRlZmVuZCB0aGVp ciBpbmZvcm1hdGlvbiBzeXN0ZW1zIGZyb20gYXR0YWNrcyBvcmlnaW5hdGluZyBmcm9tIGJvdGgg aW5zaWRlIGFuZCBvdXRzaWRlIHRoZWlyIG5ldHdvcmtzLiIgSSBhbSBjby1vd25lciBvZiBhIGNv bXBhbnkgd2hpY2ggaGVhdmlseSBsZXZlcmFnZXMgZmlyZXdhbGxzIGZvciBsYXllciAzLzQgbmV0 d29yayBzZWN1cml0eSBpbiBjb25qdW5jdGlvbiB3aXRoIFRMUy4gV2UgY2FyZSBkZWVwbHkgYWJv dXQgbmV0d29yayBzZWN1cml0eSwgYW5kIGJlbGlldmUgdGhhdCBvdXIgbmV0d29yayBpcyAqbW9y ZSBzZWN1cmUqIHNwZWNpZmljYWxseSBiZWNhdXNlIHdlICpkb24ndCogcGVyZm9ybSBtaWRkbGVi b3ggaW50ZXJjZXB0aW9uIG9mIFRMUy4KPj4+Cj4+PiBJIGNvbnNpZGVyIG91ciBjb21wYW55IHRv IGJlIGluIHRoZSBjYXRlZ29yeSBvZiBlbnRlcnByaXNlIFRMUyB1c2VycywgYW5kIGFzIGFuIGVu dGVycHJpc2UgVExTIHVzZXIgd2hvIGNhcmVzIGRlZXBseSBhYm91dCBuZXR3b3JrIHNlY3VyaXR5 LCBJIGRvIG5vdCBpZGVudGlmeSB3aGF0c29ldmVyIHdpdGggdGhlIGNsYWltcyB0aGlzIGRyYWZ0 IGlzIG1ha2luZyBhYm91dCB0aGUgbmVlZHMgb2YgZW50ZXJwcmlzZSBUTFMgdXNlcnMgYXMgYSB3 aG9sZS4gSW4gYXMgbXVjaCBhcyB3aGF0IGl0IGRlc2NyaWJlcyB0byAibmV0d29yayBzZWN1cml0 eSIsIGl0IGlzIGJ1dCBvbmUgbmljaGUgY29uc2lkZXJhdGlvbiB3aXRoaW4gYSB2YXN0bHkgYnJv YWRlciBmaWVsZCwgYW5kIG9uZSB3aGljaCBpcyBpbmNyZWFzaW5nbHkgY29udHJvdmVyc2lhbC4K Pj4+Cj4+PiBJIHdpbGwgcG9pbnQgb3V0LCBzaW5jZSB5b3UgYXBwZWFyIHRvIHdvcmsgYXQgQ2lz Y28sIHRoYXQgeW91ciBjb21wYW55IHdvcmtzIG9uIGFwcHJvYWNoZXMgdG8gbmV0d29yayBzZWN1 cml0eSAoZS5nLiBtYWx3YXJlIGRldGVjdGlvbikgd2hpY2ggYXZvaWQgZGVjcnlwdGluZyBUTFM6 Cj4+Pgo+Pj4gaHR0cHM6Ly9ibG9ncy5jaXNjby5jb20vc2VjdXJpdHkvZGV0ZWN0aW5nLWVuY3J5 cHRlZC1tYWx3YXJlLXRyYWZmaWMtd2l0aG91dC1kZWNyeXB0aW9uCj4+Pgo+Pj4gVGhlcmUgaXMg YW4gZW50aXJlIHdvcmxkIG9mIG5ldHdvcmsgSURTIHN5c3RlbXMgYmV5b25kIG1pZGRsZWJveGVz IHdoaWNoIHBhc3NpdmVseSBkZWNyeXB0IFRMUy4KPj4+Cj4+PiBJdCBpcyBmYWN0dWFsbHkgaW5h Y2N1cmF0ZSBmb3IgdGhpcyBkcmFmdCB0byBiZSBkZXNjcmliZWQgYXMgIlRMUyAxLjMgSW1wYWN0 IG9uIE5ldHdvcmstQmFzZWQgU2VjdXJpdHkiLiBJZiB5b3UgYXJlIGdvaW5nIHRvIHdyaXRlIGEg ZHJhZnQgYWJvdXQgdGhlIGltcGFjdCBvZiBUTFMgMS4zIG9uIG1pZGRsZWJveGVzIGZvciBwYXNz aXZlIFRMUyBkZWNyeXB0aW9uLCBwbGVhc2UgY2FsbCBhIHNwYWRlIGEgc3BhZGUgYW5kIGRvbid0 IHRyeSB0byBoaWRlIHlvdXIgdHJ1ZSBpbnRlbnRpb25zIHVuZGVyIGEgYnVuY2ggb2Ygd2Vhc2Vs IHdvcmRzIGFuZCBvdmVybHkgYnJvYWQgY2xhaW1zIHRoYXQgbWFrZSBpdCBzb3VuZCBsaWtlIG1p ZGRsZWJveC1yZWxhdGVkIFRMUyBkZWNyeXB0aW9uIHByb2JsZW1zIGFyZSB0aGUgZW5kIG9mIG5l dHdvcmsgc2VjdXJpdHkgYXMgd2Uga25vdyBpdC4KPj4+Cj4+PiBNeSAyYywgb24gYmVoYWxmIG9m IG5vbi1taWRkbGVib3gtdXNpbmcgZW50ZXJwcmlzZSBUTFMgdXNlcnMgd2hvIGZlZWwgdGhhdCBh dHRlbXB0cyBieSBtaWRkbGVib3gtdXNpbmcgZW50ZXJwcmlzZSBUTFMgdXNlcnMgdG8gd2Vha2Vu IFRMUyBpbiBvcmRlciB0byByZXRhaW4gY29tcGF0aWJpbGl0eSB3aXRoIHRoZWlyIHRyYWZmaWMg ZGVjcnlwdGlvbiBhcHBsaWFuY2VzIGlzIGEgdGhyZWF0IHRvIHRoZSBzZWN1cml0eSBvZiBvdXIg ZW50ZXJwcmlzZSBUTFMgZGVwbG95bWVudHMuCj4+PiBfX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fXwo+Pj4gVExTIG1haWxpbmcgbGlzdAo+Pj4gVExTQGlldGYu b3JnCj4+PiBodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3Rscwo+Pgo+PiBf X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwo+PiBUTFMgbWFp bGluZyBsaXN0Cj4+IFRMU0BpZXRmLm9yZwo+PiBodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFu L2xpc3RpbmZvL3Rscw== --b1_8156179df14d6be93e71654e0ba9d934 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: base64 PGRpdj4rMSwgbmV1dHJhbGl0eSBpcyBhcHByZWNpYXRlZCwgdGhhbmsgeW91IFNlYW48YnI+PC9k aXY+PGRpdj48YnI+PC9kaXY+PGRpdj5Db2xsZWN0aW5nIGV4cHJlc3NlZCB2aWV3cyBzaG91bGQg cHJldmFpbCBpbiBhIG5ldXRyYWwgd2F5LCB0aGVyZSBpcyBubyByZWFzb24gd2h5IGluYXBwcm9w cmlhdGUgYmVoYXZpb3VyIHNob3VsZCBiZSB0b2xlcmF0ZWQgYW5kIGxldCB0aGUgaW1wcmVzc2lv biB0aGF0IHRoZSBsb3VkZXN0IHZvaWNlIGlzIHByZXZhaWxpbmc8L2Rpdj48ZGl2Pjxicj48L2Rp dj48ZGl2IGNsYXNzPSJwcm90b25tYWlsX3NpZ25hdHVyZV9ibG9jayI+PGRpdiBjbGFzcz0icHJv dG9ubWFpbF9zaWduYXR1cmVfYmxvY2stdXNlciBwcm90b25tYWlsX3NpZ25hdHVyZV9ibG9jay1l bXB0eSI+PGJyPjwvZGl2PjxkaXYgY2xhc3M9InByb3Rvbm1haWxfc2lnbmF0dXJlX2Jsb2NrLXBy b3RvbiI+U2VudCB3aXRoIDxhIGhyZWY9Imh0dHBzOi8vcHJvdG9ubWFpbC5jb20iIHRhcmdldD0i X2JsYW5rIj5Qcm90b25NYWlsPC9hPiBTZWN1cmUgRW1haWwuPGJyPjwvZGl2PjwvZGl2PjxkaXY+ PGJyPjwvZGl2PjxkaXY+4oCQ4oCQ4oCQ4oCQ4oCQ4oCQ4oCQIE9yaWdpbmFsIE1lc3NhZ2Ug4oCQ 4oCQ4oCQ4oCQ4oCQ4oCQ4oCQPGJyPjwvZGl2PjxkaXY+IE9uIFR1ZXNkYXkgMjMgSnVseSAyMDE5 IDE3OjUyLCBCcmV0IEpvcmRhbiAmbHQ7am9yZGFuLmlldGZAZ21haWwuY29tJmd0OyB3cm90ZTo8 YnI+PC9kaXY+PGRpdj4gPGJyPjwvZGl2PjxibG9ja3F1b3RlIGNsYXNzPSJwcm90b25tYWlsX3F1 b3RlIiB0eXBlPSJjaXRlIj48ZGl2PlRoYW5rcyBTZWFuLiAmbmJzcDs8YnI+PC9kaXY+PGRpdiBj bGFzcz48YnI+PC9kaXY+PGRpdiBjbGFzcz48ZGl2Pkl0IGlzIGNyaXRpY2FsIHRoYXQgd2UgdW5k ZXJzdGFuZCBhbmQgZGlzY3VzcyBhbGwgc2lkZXMgb2YgYW4gaXNzdWUgYW5kIGFkZHJlc3MgYWxs IHVzZSBjYXNlcyB0aGF0IG1hcmtldCBoYXMuIEJlYXRpbmcgcGVvcGxlIGRvd24gYW5kIHRyeWlu ZyB0byBhdHRhY2sgcGVvcGxlIG9yIHRoZWlyIHVzZSBjYXNlcyBpcyBub3Qgc29tZXRoaW5nIHdl IHNob3VsZCBiZSBkb2luZyBpbiBmb3JtYWwgc3RhbmRhcmRzLCBlc3BlY2lhbGx5IGhlcmUgYXQg dGhlIElFVEYuPGJyPjwvZGl2PjxkaXYgY2xhc3M+PGJyPjwvZGl2PjxkaXYgY2xhc3M+PGRpdj48 YnI+PC9kaXY+PGRpdiBjbGFzcz48ZGl2IHN0eWxlPSJjYXJldC1jb2xvcjogcmdiKDAsIDAsIDAp OyBjb2xvcjogcmdiKDAsIDAsIDApOyBmb250LWZhbWlseTogSGVsdmV0aWNhOyBmb250LXNpemU6 IDE0cHg7IGZvbnQtc3R5bGU6IG5vcm1hbDsgZm9udC12YXJpYW50LWNhcHM6IG5vcm1hbDsgZm9u dC13ZWlnaHQ6IG5vcm1hbDsgbGV0dGVyLXNwYWNpbmc6IG5vcm1hbDsgb3JwaGFuczogYXV0bzsg dGV4dC1hbGlnbjogc3RhcnQ7IHRleHQtaW5kZW50OiAwcHg7IHRleHQtdHJhbnNmb3JtOiBub25l OyB3aGl0ZS1zcGFjZTogbm9ybWFsOyB3aWRvd3M6IGF1dG87IHdvcmQtc3BhY2luZzogMHB4OyAt d2Via2l0LXRleHQtc2l6ZS1hZGp1c3Q6IGF1dG87IC13ZWJraXQtdGV4dC1zdHJva2Utd2lkdGg6 IDBweDsgdGV4dC1kZWNvcmF0aW9uOiBub25lOyI+PGRpdiBjbGFzcyBzdHlsZT0ib3JwaGFuczog Mjsgd2lkb3dzOiAyOyBmb250LXZhcmlhbnQtbGlnYXR1cmVzOiBub3JtYWw7IGZvbnQtdmFyaWFu dC1lYXN0LWFzaWFuOiBub3JtYWw7IGZvbnQtdmFyaWFudC1wb3NpdGlvbjogbm9ybWFsOyBsaW5l LWhlaWdodDogbm9ybWFsOyAtd2Via2l0LXRleHQtZGVjb3JhdGlvbnMtaW4tZWZmZWN0OiBub25l OyI+PHNwYW4gc3R5bGU9ImJvcmRlci1jb2xsYXBzZTogc2VwYXJhdGU7IGZvbnQtdmFyaWFudC1s aWdhdHVyZXM6IG5vcm1hbDsgZm9udC12YXJpYW50LWVhc3QtYXNpYW46IG5vcm1hbDsgZm9udC12 YXJpYW50LXBvc2l0aW9uOiBub3JtYWw7IGxpbmUtaGVpZ2h0OiBub3JtYWw7IGJvcmRlci1zcGFj aW5nOiAwcHg7IC13ZWJraXQtdGV4dC1kZWNvcmF0aW9ucy1pbi1lZmZlY3Q6IG5vbmU7Ij5UaGFu a3MsPC9zcGFuPjxicj48L2Rpdj48ZGl2IGNsYXNzIHN0eWxlPSJvcnBoYW5zOiAyOyB3aWRvd3M6 IDI7IGZvbnQtdmFyaWFudC1saWdhdHVyZXM6IG5vcm1hbDsgZm9udC12YXJpYW50LWVhc3QtYXNp YW46IG5vcm1hbDsgZm9udC12YXJpYW50LXBvc2l0aW9uOiBub3JtYWw7IGxpbmUtaGVpZ2h0OiBu b3JtYWw7IC13ZWJraXQtdGV4dC1kZWNvcmF0aW9ucy1pbi1lZmZlY3Q6IG5vbmU7Ij48c3BhbiBz dHlsZT0iYm9yZGVyLWNvbGxhcHNlOiBzZXBhcmF0ZTsgZm9udC12YXJpYW50LWxpZ2F0dXJlczog bm9ybWFsOyBmb250LXZhcmlhbnQtZWFzdC1hc2lhbjogbm9ybWFsOyBmb250LXZhcmlhbnQtcG9z aXRpb246IG5vcm1hbDsgbGluZS1oZWlnaHQ6IG5vcm1hbDsgdGV4dC1hbGlnbjogLXdlYmtpdC1h dXRvOyBib3JkZXItc3BhY2luZzogMHB4OyAtd2Via2l0LXRleHQtZGVjb3JhdGlvbnMtaW4tZWZm ZWN0OiBub25lOyI+QnJldDwvc3Bhbj48YnI+PC9kaXY+PGRpdiBjbGFzcyBzdHlsZT0ib3JwaGFu czogMjsgd2lkb3dzOiAyOyI+PHNwYW4gc3R5bGU9ImJvcmRlci1jb2xsYXBzZTogc2VwYXJhdGU7 IHRleHQtYWxpZ246IC13ZWJraXQtYXV0bzsgYm9yZGVyLXNwYWNpbmc6IDBweDsiPjxzcGFuIHN0 eWxlPSJib3JkZXItY29sbGFwc2U6IHNlcGFyYXRlOyB0ZXh0LWFsaWduOiAtd2Via2l0LWF1dG87 IGJvcmRlci1zcGFjaW5nOiAwcHg7Ij48ZGl2IGNsYXNzIHN0eWxlPSJ3b3JkLXdyYXA6IGJyZWFr LXdvcmQ7IC13ZWJraXQtbmJzcC1tb2RlOiBzcGFjZTsgbGluZS1icmVhazogYWZ0ZXItd2hpdGUt c3BhY2U7Ij48c3BhbiBzdHlsZT0iYm9yZGVyLWNvbGxhcHNlOiBzZXBhcmF0ZTsgdGV4dC1hbGln bjogLXdlYmtpdC1hdXRvOyBib3JkZXItc3BhY2luZzogMHB4OyI+PGRpdiBjbGFzcyBzdHlsZT0i d29yZC13cmFwOiBicmVhay13b3JkOyAtd2Via2l0LW5ic3AtbW9kZTogc3BhY2U7IGxpbmUtYnJl YWs6IGFmdGVyLXdoaXRlLXNwYWNlOyI+PHNwYW4gc3R5bGU9ImJvcmRlci1jb2xsYXBzZTogc2Vw YXJhdGU7IHRleHQtYWxpZ246IC13ZWJraXQtYXV0bzsgYm9yZGVyLXNwYWNpbmc6IDBweDsiPjxk aXYgY2xhc3Mgc3R5bGU9IndvcmQtd3JhcDogYnJlYWstd29yZDsgLXdlYmtpdC1uYnNwLW1vZGU6 IHNwYWNlOyBsaW5lLWJyZWFrOiBhZnRlci13aGl0ZS1zcGFjZTsiPjxzcGFuIHN0eWxlPSJib3Jk ZXItY29sbGFwc2U6IHNlcGFyYXRlOyB0ZXh0LWFsaWduOiAtd2Via2l0LWF1dG87IGJvcmRlci1z cGFjaW5nOiAwcHg7Ij48ZGl2IGNsYXNzPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpDYWxpYnJl LCBWZXJkYW5hIj48c3BhbiBzdHlsZT0iY29sb3I6IzdjN2M3YyI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMXB4Ij5QR1AgRmluZ2VycHJpbnQ6Jm5ic3A7PC9zcGFuPjwvc3Bhbj48L3NwYW4+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMXB4Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6Q2FsaWJy ZSwgVmVyZGFuYSI+PHNwYW4gc3R5bGU9ImNvbG9yOiM3YzdjN2MiPjYzQjQgRkM1MyA2ODBBIDZC N0QgMTQ0NyAmbmJzcDtGMkMwIDc0RjggQUNBRSA3NDE1IDAwNTA8L3NwYW4+PC9zcGFuPjwvc3Bh bj48YnI+PC9kaXY+PGRpdiBjbGFzcyBzdHlsZT0iZm9udC12YXJpYW50LWxpZ2F0dXJlczogbm9y bWFsOyBmb250LXZhcmlhbnQtZWFzdC1hc2lhbjogbm9ybWFsOyBmb250LXZhcmlhbnQtcG9zaXRp b246IG5vcm1hbDsgbGluZS1oZWlnaHQ6IG5vcm1hbDsgLXdlYmtpdC10ZXh0LWRlY29yYXRpb25z LWluLWVmZmVjdDogbm9uZTsiPjxzcGFuIHN0eWxlPSJjb2xvcjpyZ2IoMTI0LCAxMjQsIDEyNCki PjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpDYWxpYnJlLCBWZXJkYW5hIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjhwdCI+IldpdGhvdXQgY3J5cHRvZ3JhcGh5IHZpaHYgdml2YyBjZSB4aHJucncs IGhvd2V2ZXIsIHRoZSBvbmx5IHRoaW5nIHRoYXQgY2FuIG5vdCBiZSB1bnNjcmFtYmxlZCBpcyBh biBlZ2cuIjwvc3Bhbj48L3NwYW4+PC9zcGFuPjxicj48L2Rpdj48L3NwYW4+PC9kaXY+PC9zcGFu PjwvZGl2Pjwvc3Bhbj48L2Rpdj48L3NwYW4+PC9zcGFuPjwvZGl2PjwvZGl2PjwvZGl2PjxkaXY+ PGRpdj48YnI+PC9kaXY+PGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSIgY2xhc3M+PGRpdiBjbGFzcz5P biBKdWwgMjMsIDIwMTksIGF0IDQ6NTEgUE0sIFNlYW4gVHVybmVyICZsdDs8YSBocmVmPSJtYWls dG86c2VhbkBzbjNyZC5jb20iIGNsYXNzPnNlYW5Ac24zcmQuY29tPC9hPiZndDsgd3JvdGU6PGJy PjwvZGl2PjxkaXY+PGJyPjwvZGl2PjxkaXYgY2xhc3M+PGRpdiBjbGFzcz48ZGl2PlRvbnksPGJy PjwvZGl2PjxkaXY+PGJyPjwvZGl2PjxkaXY+V2hpbGUgeW91IG1heSBoYXZlIGNvbmNlcm5zIG9y IG90aGVyd2lzZSBkaXNhZ3JlZSB3aXRoIHRoZSBjb250ZW50cyBvZiB0aGlzIGRyYWZ0LCBsZXTi gJlzIHBsZWFzZSBrZWVwIGRpc2N1c3Npb24gb24gdGhpcyBsaXN0LCBvbiBhbGwgaXNzdWVzLCBw b2xpdGUgYW5kIHByb2Zlc3Npb25hbC48YnI+PC9kaXY+PGRpdj48YnI+PC9kaXY+PGRpdj5zcHQ8 YnI+PC9kaXY+PGRpdj4oYXMgY28tY2hhaXIpPGJyPjwvZGl2PjxkaXY+PGJyPjwvZGl2PjxibG9j a3F1b3RlIHR5cGU9ImNpdGUiIGNsYXNzPjxkaXY+T24gSnVsIDIzLCAyMDE5LCBhdCAxNjowNSwg VG9ueSBBcmNpZXJpICZsdDs8YSBocmVmPSJtYWlsdG86YmFzY3VsZUBnbWFpbC5jb20iIGNsYXNz PmJhc2N1bGVAZ21haWwuY29tPC9hPiZndDsgd3JvdGU6PGJyPjwvZGl2PjxkaXY+PGJyPjwvZGl2 PjxkaXY+T24gU3VuLCBKdWwgMjEsIDIwMTkgYXQgNjo1MSBBTSBOYW5jeSBDYW0tV2luZ2V0IChu Y2Ftd2luZykgJmx0O25jYW13aW5nQGNpc2NvLi5jb20mZ3Q7IHdyb3RlOjxicj48L2Rpdj48ZGl2 PkhpLDxicj48L2Rpdj48ZGl2Pjxicj48L2Rpdj48ZGl2PlRoYW5rcyB0byBhbGwgdGhlIGZlZWRi YWNrIHByb3ZpZGVkLCB3ZSBoYXZlIHVwZGF0ZWQgdGhlIDxhIGhyZWY9Imh0dHBzOi8vdG9vbHMu aWV0Zi5vcmcvaHRtbC9kcmFmdC1jYW13aW5nZXQtdGxzLXVzZS1jYXNlcy0wNCIgY2xhc3M+aHR0 cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LWNhbXdpbmdldC10bHMtdXNlLWNhc2VzLTA0 PC9hPjxicj48L2Rpdj48ZGl2Pjxicj48L2Rpdj48ZGl2PmRyYWZ0LiAmbmJzcDtBdCB0aGlzIHBv aW50LCB3ZSBiZWxpZXZlIHRoZSBkcmFmdCBpcyBzdGFibGUgYW5kIHdvdWxkIGxpa2UgdG8gcmVx dWVzdCBpdHMgcHVibGljYXRpb24gYXMgYW4gaW5mb3JtYXRpb25hbCBkcmFmdC48YnI+PC9kaXY+ PGRpdj48YnI+PC9kaXY+PGRpdj48YnI+PC9kaXY+PGRpdj5JIHJlYWQgdGhpcyBkcmFmdCBhcyB0 aGUgbGF0ZXN0IGF0dGVtcHQgaW4gYSBkaXNpbmZvcm1hdGlvbiBjYW1wYWlnbiBieSBtYW51ZmFj dHVyZXJzIGFuZCB1c2VycyBvZiBtaWRkbGVib3hlcyB0aGF0IHBhc3NpdmVseSBkZWNyeXB0IFRM UyBjb25uZWN0aW9ucyB0byBwb2xpdGljaXplIGFuZCByZWZyYW1lIHRoZSBhcmd1bWVudCBhcm91 bmQgd2hhdCBpcywgYXQgaXRzIGNvcmUsIGEgZnVuZGFtZW50YWxseSBpbnNlY3VyZSBwcmFjdGlj ZSB3aGljaCBpcyBpbmNvbXBhdGlibGUgd2l0aCB0ZWNobmljYWxseSBzb3VuZCBhbmQgaGlnaGx5 IGRlc2lyYWJsZSBwcm90b2NvbCBpbXByb3ZlbWVudHMgdG8gVExTLjxicj48L2Rpdj48ZGl2Pjxi cj48L2Rpdj48ZGl2PkkgaW1wbG9yZSB5b3Ugc3RvcCB1c2luZyBvdmVybHkgYnJvYWQgdGVybWlu b2xvZ3ksIGV1cGhlbWlzbXMsIHdlYXNlbCB3b3JkcywgYW5kIG90aGVyIGRlY2VwdGl2ZSBsYW5n dWFnZSB0byBhcmd1ZSB5b3VyIHBvaW50cy48YnI+PC9kaXY+PGRpdj48YnI+PC9kaXY+PGRpdj5U aGlzIGRyYWZ0IGlzIHRpdGxlZCAiVExTIDEuMyBJbXBhY3Qgb24gTmV0d29yay1CYXNlZCBTZWN1 cml0eSIsIGJ1dCB0aGUgc3VidGV4dCBpcyBxdWl0ZSBjbGVhcmx5IHRoZSBtdWNoIG5hcnJvd2Vy IHN1YmZpZWxkIG9mIG1pZGRsZWJveCBUTFMgZGVjcnlwdGlvbi4gQnkgdXNpbmcgc3VjaCBhIGdy YW5kaW9zZSB0aXRsZSB3aGljaCBpcyBkZWNlcHRpdmVseSBoaWRpbmcgdGhlIHRydWUgc3ViamVj dCBtYXR0ZXIsIHlvdSBhcmUgaW1wbHlpbmcgdGhhdCBtaWRkbGVib3hlcyBhcmUgdGhlIHN1bSB0 b3RhbCBvZiBuZXR3b3JrIHNlY3VyaXR5Ljxicj48L2Rpdj48ZGl2Pjxicj48L2Rpdj48ZGl2PlRo ZSBkcmFmdCBiZWdpbnMgIkVudGVycHJpc2VzIFsuLi5dIG5lZWQgdG8gZGVmZW5kIHRoZWlyIGlu Zm9ybWF0aW9uIHN5c3RlbXMgZnJvbSBhdHRhY2tzIG9yaWdpbmF0aW5nIGZyb20gYm90aCBpbnNp ZGUgYW5kIG91dHNpZGUgdGhlaXIgbmV0d29ya3MuIiBJIGFtIGNvLW93bmVyIG9mIGEgY29tcGFu eSB3aGljaCBoZWF2aWx5IGxldmVyYWdlcyBmaXJld2FsbHMgZm9yIGxheWVyIDMvNCBuZXR3b3Jr IHNlY3VyaXR5IGluIGNvbmp1bmN0aW9uIHdpdGggVExTLiBXZSBjYXJlIGRlZXBseSBhYm91dCBu ZXR3b3JrIHNlY3VyaXR5LCBhbmQgYmVsaWV2ZSB0aGF0IG91ciBuZXR3b3JrIGlzICptb3JlIHNl Y3VyZSogc3BlY2lmaWNhbGx5IGJlY2F1c2Ugd2UgKmRvbid0KiBwZXJmb3JtIG1pZGRsZWJveCBp bnRlcmNlcHRpb24gb2YgVExTLjxicj48L2Rpdj48ZGl2Pjxicj48L2Rpdj48ZGl2PkkgY29uc2lk ZXIgb3VyIGNvbXBhbnkgdG8gYmUgaW4gdGhlIGNhdGVnb3J5IG9mIGVudGVycHJpc2UgVExTIHVz ZXJzLCBhbmQgYXMgYW4gZW50ZXJwcmlzZSBUTFMgdXNlciB3aG8gY2FyZXMgZGVlcGx5IGFib3V0 IG5ldHdvcmsgc2VjdXJpdHksIEkgZG8gbm90IGlkZW50aWZ5IHdoYXRzb2V2ZXIgd2l0aCB0aGUg Y2xhaW1zIHRoaXMgZHJhZnQgaXMgbWFraW5nIGFib3V0IHRoZSBuZWVkcyBvZiBlbnRlcnByaXNl IFRMUyB1c2VycyBhcyBhIHdob2xlLiBJbiBhcyBtdWNoIGFzIHdoYXQgaXQgZGVzY3JpYmVzIHRv ICJuZXR3b3JrIHNlY3VyaXR5IiwgaXQgaXMgYnV0IG9uZSBuaWNoZSBjb25zaWRlcmF0aW9uIHdp dGhpbiBhIHZhc3RseSBicm9hZGVyIGZpZWxkLCBhbmQgb25lIHdoaWNoIGlzIGluY3JlYXNpbmds eSBjb250cm92ZXJzaWFsLjxicj48L2Rpdj48ZGl2Pjxicj48L2Rpdj48ZGl2Pkkgd2lsbCBwb2lu dCBvdXQsIHNpbmNlIHlvdSBhcHBlYXIgdG8gd29yayBhdCBDaXNjbywgdGhhdCB5b3VyIGNvbXBh bnkgd29ya3Mgb24gYXBwcm9hY2hlcyB0byBuZXR3b3JrIHNlY3VyaXR5IChlLmcuIG1hbHdhcmUg ZGV0ZWN0aW9uKSB3aGljaCBhdm9pZCBkZWNyeXB0aW5nIFRMUzo8YnI+PC9kaXY+PGRpdj48YnI+ PC9kaXY+PGRpdj48YSBocmVmPSJodHRwczovL2Jsb2dzLmNpc2NvLmNvbS9zZWN1cml0eS9kZXRl Y3RpbmctZW5jcnlwdGVkLW1hbHdhcmUtdHJhZmZpYy13aXRob3V0LWRlY3J5cHRpb24iIGNsYXNz Pmh0dHBzOi8vYmxvZ3MuY2lzY28uY29tL3NlY3VyaXR5L2RldGVjdGluZy1lbmNyeXB0ZWQtbWFs d2FyZS10cmFmZmljLXdpdGhvdXQtZGVjcnlwdGlvbjwvYT48YnI+PC9kaXY+PGRpdj48YnI+PC9k aXY+PGRpdj5UaGVyZSBpcyBhbiBlbnRpcmUgd29ybGQgb2YgbmV0d29yayBJRFMgc3lzdGVtcyBi ZXlvbmQgbWlkZGxlYm94ZXMgd2hpY2ggcGFzc2l2ZWx5IGRlY3J5cHQgVExTLjxicj48L2Rpdj48 ZGl2Pjxicj48L2Rpdj48ZGl2Pkl0IGlzIGZhY3R1YWxseSBpbmFjY3VyYXRlIGZvciB0aGlzIGRy YWZ0IHRvIGJlIGRlc2NyaWJlZCBhcyAiVExTIDEuMyBJbXBhY3Qgb24gTmV0d29yay1CYXNlZCBT ZWN1cml0eSIuIElmIHlvdSBhcmUgZ29pbmcgdG8gd3JpdGUgYSBkcmFmdCBhYm91dCB0aGUgaW1w YWN0IG9mIFRMUyAxLjMgb24gbWlkZGxlYm94ZXMgZm9yIHBhc3NpdmUgVExTIGRlY3J5cHRpb24s IHBsZWFzZSBjYWxsIGEgc3BhZGUgYSBzcGFkZSBhbmQgZG9uJ3QgdHJ5IHRvIGhpZGUgeW91ciB0 cnVlIGludGVudGlvbnMgdW5kZXIgYSBidW5jaCBvZiB3ZWFzZWwgd29yZHMgYW5kIG92ZXJseSBi cm9hZCBjbGFpbXMgdGhhdCBtYWtlIGl0IHNvdW5kIGxpa2UgbWlkZGxlYm94LXJlbGF0ZWQgVExT IGRlY3J5cHRpb24gcHJvYmxlbXMgYXJlIHRoZSBlbmQgb2YgbmV0d29yayBzZWN1cml0eSBhcyB3 ZSBrbm93IGl0Ljxicj48L2Rpdj48ZGl2Pjxicj48L2Rpdj48ZGl2Pk15IDJjLCBvbiBiZWhhbGYg b2Ygbm9uLW1pZGRsZWJveC11c2luZyBlbnRlcnByaXNlIFRMUyB1c2VycyB3aG8gZmVlbCB0aGF0 IGF0dGVtcHRzIGJ5IG1pZGRsZWJveC11c2luZyBlbnRlcnByaXNlIFRMUyB1c2VycyB0byB3ZWFr ZW4gVExTIGluIG9yZGVyIHRvIHJldGFpbiBjb21wYXRpYmlsaXR5IHdpdGggdGhlaXIgdHJhZmZp YyBkZWNyeXB0aW9uIGFwcGxpYW5jZXMgaXMgYSB0aHJlYXQgdG8gdGhlIHNlY3VyaXR5IG9mIG91 ciBlbnRlcnByaXNlIFRMUyBkZXBsb3ltZW50cy48YnI+PC9kaXY+PGRpdj5fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXzxicj48L2Rpdj48ZGl2PlRMUyBtYWls aW5nIGxpc3Q8YnI+PC9kaXY+PGRpdj5UTFNAaWV0Zi5vcmc8YnI+PC9kaXY+PGRpdj5odHRwczov L3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3Rsczxicj48L2Rpdj48L2Jsb2NrcXVvdGU+ PGRpdj48YnI+PC9kaXY+PGRpdj5fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fXzxicj48L2Rpdj48ZGl2PlRMUyBtYWlsaW5nIGxpc3Q8YnI+PC9kaXY+PGRpdj48 YSBocmVmPSJtYWlsdG86VExTQGlldGYub3JnIiBjbGFzcz5UTFNAaWV0Zi5vcmc8L2E+PGJyPjwv ZGl2PjxkaXY+aHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby90bHM8YnI+PC9k aXY+PC9kaXY+PC9kaXY+PC9ibG9ja3F1b3RlPjwvZGl2PjwvZGl2PjwvZGl2PjwvYmxvY2txdW90 ZT48ZGl2Pjxicj48L2Rpdj4= --b1_8156179df14d6be93e71654e0ba9d934-- From nobody Tue Jul 23 14:56:11 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id ADCB0120995 for ; Tue, 23 Jul 2019 14:55:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.299 X-Spam-Level: X-Spam-Status: No, score=-4.299 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); domainkeys=pass (1024-bit key) header.from=MAckermann@bcbsm.com header.d=bcbsm.com; dkim=pass (1024-bit key) header.d=bcbsm.com header.b=SmPzZxgX; dkim=fail (1024-bit key) reason="fail (body has been altered)" header.d=bcbsm.onmicrosoft.com header.b=GoBeYEz2 Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BP8e0dnYoYtd for ; Tue, 23 Jul 2019 14:55:55 -0700 (PDT) Received: from mx.z120.zixworks.com (bcbsm.zixworks.com [199.30.235.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 33782120352 for ; Tue, 23 Jul 2019 14:55:55 -0700 (PDT) Received: from 127.0.0.1 (ZixVPM [127.0.0.1]) by Outbound.z120.zixworks.com (Proprietary) with SMTP id 814C2C0D72 for ; Tue, 23 Jul 2019 16:55:54 -0500 (CDT) DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=ZIXVPM1670e2ded26; d=bcbsm.com; h=From:To:Subject:Date; b=bmPssYkGQn8BYZNesOgrMHvPXnSUJAhiG1D7Y6HXZ87OBiwro3Av5Jc0ICiooqKR vq6gD39Uxdupdq9QD5QjabuT3TalLN+X2ifIHLWMJ0n/Cgz4Hhjuib6q8RIRzr WaxPhBbhbkaN1+AzAYdS1CAvSwJykiCJ1dJAIY1MIozQI=; DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bcbsm.com; s=ZIXVPM1670e2ded26; t=1563918954; bh=ctcEu8jpfEEziQ4hit90oIHqO+cWUMlpMJb1Nh+mgoU=; h=From:To:Subject:Date; b=SmPzZxgXW2EA4opbh9ZcCwSvqp7sP/8kmeqlFqpqk25asdqYF2UYIoQm0eeei4hqB 34qGIdA6PWnZ/IVwjVrw2LLAwXTsa4UW0xvhl6H9w1UOjTX3E/qrk5XbnLCgEZ1JRj bS/u5UeVfONMqmhYC6uk86m1aehTit6yGYWLuydU= Received: from imsva1.bcbsm.com (inetmta03.bcbsm.com [12.107.172.80]) by mx.z120.zixworks.com (Proprietary) with SMTP id EE43EC0C99; Tue, 23 Jul 2019 16:55:52 -0500 (CDT) Received: from imsva1.bcbsm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id ADCD492057; Tue, 23 Jul 2019 17:55:52 -0400 (EDT) Received: from imsva1.bcbsm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 7633992053; Tue, 23 Jul 2019 17:55:52 -0400 (EDT) Received: from NAM05-DM3-obe.outbound.protection.outlook.com (unknown [104.47.49.55]) by imsva1.bcbsm.com (Postfix) with ESMTPS; Tue, 23 Jul 2019 17:55:52 -0400 (EDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=UGKfJ4yIhWmNygCYww/85FmOPpn4dIPV5B92yFWiHIrHGijUz0c/CWF7Osw8KjBOYlQc/3VCUfKvdKVhd6y2NVmf2FQqr/4p6uWBd8CnqU4JNNGamqlxEwhMsTfsbxhJ9gVyvSfzegK6D8tTcThl7Hep4IZQELLLwUpvxfW0FtncmaVkDvk9gjoghinjgQupiHqriedQ5rQoLX/H0NIHP4geZuFag6ZWzyss6f6JlUqydee5ENVm8G8AVX/7LHaQfDf+Yo6Blk9akQvOwIX15xPMMCHU/oJCczDs7sWs72MsRtZx/HiRuPp7adbRZycWULzHNY4PmeBUlSinD+pvkw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=bx8lJz+n3TfmvwhbZhGV0dM1XySOlaw0c/DxemZLzQk=; b=T4KNZ99CY1B1+qQMY4fnWW0LdRDtopWERuvkyZu98ZcuDUMVV+bDsOUB7IT1VdjyBLYYy+jfIa3IaQuL/JhxUzdvOuFbo90KLxVVhrGGCdRyggWZYT0fxqeK3hS75bP+T9SY9InobuVvRlKoKpuxPQyG80SANL0dt0/JKsxh6qmd2ViwCvj1aU+vnbKy6kgE1c+s2aOHEiavP3LHOnhuF6CA/gN74HaflbKY0msQ2gVYaIbN1akyBwdtTiq95iqV0GtnBG7MNs/TOBfw6aH1xJObActlMmaq/de3XExEDlCQhz/0A+O1apnC3qlqOccnk9y40iG/0EgE4nepcUiBdQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1;spf=pass smtp.mailfrom=bcbsm.com;dmarc=pass action=none header.from=bcbsm.com;dkim=pass header.d=bcbsm.com;arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bcbsm.onmicrosoft.com; s=selector1-bcbsm-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=bx8lJz+n3TfmvwhbZhGV0dM1XySOlaw0c/DxemZLzQk=; b=GoBeYEz21a4DeFU2WzWGgZVo2cqt+Tn4TQFJkR4lyjcaHsKgHts6Jd7hCoHbaEygS8R+O21uqU4i2oNzqdW2qdXquC9HocWAKZtJDRJHUHhQpzVGBLRZw462N6zVpGwVqFGYMoM8gonrjytPIIlylY5RqDIUVFj8KRk5xWTpCFU= Received: from DM6PR14MB2474.namprd14.prod.outlook.com (20.177.221.205) by DM6PR14MB2620.namprd14.prod.outlook.com (20.178.31.26) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2115.10; Tue, 23 Jul 2019 21:55:50 +0000 Received: from DM6PR14MB2474.namprd14.prod.outlook.com ([fe80::168:5560:a095:93e3]) by DM6PR14MB2474.namprd14.prod.outlook.com ([fe80::168:5560:a095:93e3%7]) with mapi id 15.20.2094.013; Tue, 23 Jul 2019 21:55:50 +0000 From: "Ackermann, Michael" To: Bret Jordan , Sean Turner CC: Tony Arcieri , "tls@ietf.org" Thread-Topic: [TLS] TLS Impact on Network Security draft updated Thread-Index: AQHVP8tnovYBmAyQbUu5TybMCHUv66bYpD2AgAANEgCAABDogIAAANCQ Date: Tue, 23 Jul 2019 21:55:50 +0000 Message-ID: References: <6AF48228-19C2-41C7-BA86-BA16940C3CFF@cisco.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=MAckermann@bcbsm.com; x-originating-ip: [165.225.39.74] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 78b5017c-caf8-43b8-185f-08d70fb886d0 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(7168020)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(2017052603328)(7167020)(7193020); SRVR:DM6PR14MB2620; x-ms-traffictypediagnostic: DM6PR14MB2620: x-ms-exchange-purlcount: 5 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:5797; x-forefront-prvs: 0107098B6C x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(376002)(396003)(39860400002)(366004)(136003)(346002)(54164003)(189003)(199004)(6306002)(55016002)(316002)(3846002)(6116002)(26005)(71190400001)(486006)(476003)(6506007)(71200400001)(55236004)(54906003)(110136005)(11346002)(446003)(9686003)(236005)(790700001)(478600001)(25786009)(53936002)(53546011)(14454004)(6246003)(54896002)(4326008)(966005)(66066001)(66574012)(81156014)(8936002)(80792005)(7110500001)(33656002)(5024004)(86362001)(74316002)(606006)(256004)(14444005)(7736002)(6436002)(66946007)(99286004)(2906002)(66476007)(64756008)(2420400007)(68736007)(66556008)(66446008)(76116006)(186003)(7696005)(102836004)(76176011)(15650500001)(8676002)(5660300002)(229853002)(52536014)(81166006); DIR:OUT; SFP:1102; SCL:1; SRVR:DM6PR14MB2620; H:DM6PR14MB2474.namprd14.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: bcbsm.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: AtLoiQtlKiqjDurOCGsNXFzjOPszj4RFYAfkAAlCJpVPwmAvKT8B0LZGSKK8U2WUkIPAjgSEVUMpPybupREKXbmD0U4O9asp+ZUFjmsw7l4COFuIt4w1uHyD7INZXa4CiEqnI0QQ9q3JHxsMDqhLcNabXbrZuyheCtgSubhCijKElwmhVJdjxQFII/uxxNbW2qtrzPZG2kjZWYt4EoZF/JcuRsf38RyXOL7GxQsU6W4zniYbo5ZiAseu3GidKy6HTGSI4qhFkRO1lW9wGfF2b2Ad7/x7lQbThL34SwAxV+Fu5XytogJPlmEXwbFwzuDvrr+pakJPMIhy2R+HV4U2rctFRHptXJJYxbbo2nrpiOkNoK1HLcAMruEgr7QZM3EufRIzZzVHhis8GYKDCUevUygD6EWZ1BFMlHTWJt0Zns8= Content-Type: multipart/alternative; boundary="_000_DM6PR14MB2474B49DAFBBDC3158F67CC5D7C70DM6PR14MB2474namp_" MIME-Version: 1.0 X-OriginatorOrg: bcbsm.com X-MS-Exchange-CrossTenant-Network-Message-Id: 78b5017c-caf8-43b8-185f-08d70fb886d0 X-MS-Exchange-CrossTenant-originalarrivaltime: 23 Jul 2019 21:55:50.5328 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 6f56d3fa-5682-4261-b169-bc0d615da17c X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: MAckermann@bcbsm.com X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR14MB2620 X-TM-AS-GCONF: 00 X-VPM-HOST: vmvpm02.z120.zixworks.com X-VPM-GROUP-ID: b14c11d8-e56a-4a0a-a4a3-b1bf5f484777 X-VPM-MSG-ID: 66454bdb-abed-4376-8908-d36958a7bb01 X-VPM-ENC-REGIME: Plaintext X-VPM-IS-HYBRID: 0 Archived-At: Subject: Re: [TLS] TLS Impact on Network Security draft updated X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 Jul 2019 21:56:06 -0000 --_000_DM6PR14MB2474B49DAFBBDC3158F67CC5D7C70DM6PR14MB2474namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 KzENCg0KRnJvbTogVExTIDx0bHMtYm91bmNlc0BpZXRmLm9yZz4gT24gQmVoYWxmIE9mIEJy ZXQgSm9yZGFuDQpTZW50OiBUdWVzZGF5LCBKdWx5IDIzLCAyMDE5IDU6NTIgUE0NClRvOiBT ZWFuIFR1cm5lciA8c2VhbkBzbjNyZC5jb20+DQpDYzogVG9ueSBBcmNpZXJpIDxiYXNjdWxl QGdtYWlsLmNvbT47IHRsc0BpZXRmLm9yZw0KU3ViamVjdDogUmU6IFtUTFNdIFRMUyBJbXBh Y3Qgb24gTmV0d29yayBTZWN1cml0eSBkcmFmdCB1cGRhdGVkDQoNCiBBTEVSVCBUaGlzIGVt YWlsIHdhcyBzZW50IGZyb20gYSBzb3VyY2UgZXh0ZXJuYWwgdG8gQkNCU00vQkNOLg0KIERP IE5PVCBDTElDSyBsaW5rcyBvciBhdHRhY2htZW50cyB1bmxlc3MgeW91IHJlY29nbml6ZSB0 aGUgc2VuZGVyIGFuZCB0cnVzdCB0aGUgY29udGVudC4NCg0KVGhhbmtzIFNlYW4uDQoNCkl0 IGlzIGNyaXRpY2FsIHRoYXQgd2UgdW5kZXJzdGFuZCBhbmQgZGlzY3VzcyBhbGwgc2lkZXMg b2YgYW4gaXNzdWUgYW5kIGFkZHJlc3MgYWxsIHVzZSBjYXNlcyB0aGF0IG1hcmtldCBoYXMu IEJlYXRpbmcgcGVvcGxlIGRvd24gYW5kIHRyeWluZyB0byBhdHRhY2sgcGVvcGxlIG9yIHRo ZWlyIHVzZSBjYXNlcyBpcyBub3Qgc29tZXRoaW5nIHdlIHNob3VsZCBiZSBkb2luZyBpbiBm b3JtYWwgc3RhbmRhcmRzLCBlc3BlY2lhbGx5IGhlcmUgYXQgdGhlIElFVEYuDQoNCg0KVGhh bmtzLA0KQnJldA0KUEdQIEZpbmdlcnByaW50OiA2M0I0IEZDNTMgNjgwQSA2QjdEIDE0NDcg IEYyQzAgNzRGOCBBQ0FFIDc0MTUgMDA1MA0KIldpdGhvdXQgY3J5cHRvZ3JhcGh5IHZpaHYg dml2YyBjZSB4aHJucncsIGhvd2V2ZXIsIHRoZSBvbmx5IHRoaW5nIHRoYXQgY2FuIG5vdCBi ZSB1bnNjcmFtYmxlZCBpcyBhbiBlZ2cuIg0KDQoNCk9uIEp1bCAyMywgMjAxOSwgYXQgNDo1 MSBQTSwgU2VhbiBUdXJuZXIgPHNlYW5Ac24zcmQuY29tPG1haWx0bzpzZWFuQHNuM3JkLmNv bT4+IHdyb3RlOg0KDQpUb255LA0KDQpXaGlsZSB5b3UgbWF5IGhhdmUgY29uY2VybnMgb3Ig b3RoZXJ3aXNlIGRpc2FncmVlIHdpdGggdGhlIGNvbnRlbnRzIG9mIHRoaXMgZHJhZnQsIGxl dOKAmXMgcGxlYXNlIGtlZXAgZGlzY3Vzc2lvbiBvbiB0aGlzIGxpc3QsIG9uIGFsbCBpc3N1 ZXMsIHBvbGl0ZSBhbmQgcHJvZmVzc2lvbmFsLg0KDQpzcHQNCihhcyBjby1jaGFpcikNCg0K DQpPbiBKdWwgMjMsIDIwMTksIGF0IDE2OjA1LCBUb255IEFyY2llcmkgPGJhc2N1bGVAZ21h aWwuY29tPG1haWx0bzpiYXNjdWxlQGdtYWlsLmNvbT4+IHdyb3RlOg0KDQpPbiBTdW4sIEp1 bCAyMSwgMjAxOSBhdCA2OjUxIEFNIE5hbmN5IENhbS1XaW5nZXQgKG5jYW13aW5nKSA8bmNh bXdpbmdAY2lzY28uLmNvbTxtYWlsdG86bmNhbXdpbmdAY2lzY28uLmNvbT4+IHdyb3RlOg0K SGksDQoNClRoYW5rcyB0byBhbGwgdGhlIGZlZWRiYWNrIHByb3ZpZGVkLCB3ZSBoYXZlIHVw ZGF0ZWQgdGhlIGh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1jYW13aW5nZXQt dGxzLXVzZS1jYXNlcy0wNA0KDQpkcmFmdC4gIEF0IHRoaXMgcG9pbnQsIHdlIGJlbGlldmUg dGhlIGRyYWZ0IGlzIHN0YWJsZSBhbmQgd291bGQgbGlrZSB0byByZXF1ZXN0IGl0cyBwdWJs aWNhdGlvbiBhcyBhbiBpbmZvcm1hdGlvbmFsIGRyYWZ0Lg0KDQoNCkkgcmVhZCB0aGlzIGRy YWZ0IGFzIHRoZSBsYXRlc3QgYXR0ZW1wdCBpbiBhIGRpc2luZm9ybWF0aW9uIGNhbXBhaWdu IGJ5IG1hbnVmYWN0dXJlcnMgYW5kIHVzZXJzIG9mIG1pZGRsZWJveGVzIHRoYXQgcGFzc2l2 ZWx5IGRlY3J5cHQgVExTIGNvbm5lY3Rpb25zIHRvIHBvbGl0aWNpemUgYW5kIHJlZnJhbWUg dGhlIGFyZ3VtZW50IGFyb3VuZCB3aGF0IGlzLCBhdCBpdHMgY29yZSwgYSBmdW5kYW1lbnRh bGx5IGluc2VjdXJlIHByYWN0aWNlIHdoaWNoIGlzIGluY29tcGF0aWJsZSB3aXRoIHRlY2hu aWNhbGx5IHNvdW5kIGFuZCBoaWdobHkgZGVzaXJhYmxlIHByb3RvY29sIGltcHJvdmVtZW50 cyB0byBUTFMuDQoNCkkgaW1wbG9yZSB5b3Ugc3RvcCB1c2luZyBvdmVybHkgYnJvYWQgdGVy bWlub2xvZ3ksIGV1cGhlbWlzbXMsIHdlYXNlbCB3b3JkcywgYW5kIG90aGVyIGRlY2VwdGl2 ZSBsYW5ndWFnZSB0byBhcmd1ZSB5b3VyIHBvaW50cy4NCg0KVGhpcyBkcmFmdCBpcyB0aXRs ZWQgIlRMUyAxLjMgSW1wYWN0IG9uIE5ldHdvcmstQmFzZWQgU2VjdXJpdHkiLCBidXQgdGhl IHN1YnRleHQgaXMgcXVpdGUgY2xlYXJseSB0aGUgbXVjaCBuYXJyb3dlciBzdWJmaWVsZCBv ZiBtaWRkbGVib3ggVExTIGRlY3J5cHRpb24uIEJ5IHVzaW5nIHN1Y2ggYSBncmFuZGlvc2Ug dGl0bGUgd2hpY2ggaXMgZGVjZXB0aXZlbHkgaGlkaW5nIHRoZSB0cnVlIHN1YmplY3QgbWF0 dGVyLCB5b3UgYXJlIGltcGx5aW5nIHRoYXQgbWlkZGxlYm94ZXMgYXJlIHRoZSBzdW0gdG90 YWwgb2YgbmV0d29yayBzZWN1cml0eS4NCg0KVGhlIGRyYWZ0IGJlZ2lucyAiRW50ZXJwcmlz ZXMgWy4uLl0gbmVlZCB0byBkZWZlbmQgdGhlaXIgaW5mb3JtYXRpb24gc3lzdGVtcyBmcm9t IGF0dGFja3Mgb3JpZ2luYXRpbmcgZnJvbSBib3RoIGluc2lkZSBhbmQgb3V0c2lkZSB0aGVp ciBuZXR3b3Jrcy4iIEkgYW0gY28tb3duZXIgb2YgYSBjb21wYW55IHdoaWNoIGhlYXZpbHkg bGV2ZXJhZ2VzIGZpcmV3YWxscyBmb3IgbGF5ZXIgMy80IG5ldHdvcmsgc2VjdXJpdHkgaW4g Y29uanVuY3Rpb24gd2l0aCBUTFMuIFdlIGNhcmUgZGVlcGx5IGFib3V0IG5ldHdvcmsgc2Vj dXJpdHksIGFuZCBiZWxpZXZlIHRoYXQgb3VyIG5ldHdvcmsgaXMgKm1vcmUgc2VjdXJlKiBz cGVjaWZpY2FsbHkgYmVjYXVzZSB3ZSAqZG9uJ3QqIHBlcmZvcm0gbWlkZGxlYm94IGludGVy Y2VwdGlvbiBvZiBUTFMuDQoNCkkgY29uc2lkZXIgb3VyIGNvbXBhbnkgdG8gYmUgaW4gdGhl IGNhdGVnb3J5IG9mIGVudGVycHJpc2UgVExTIHVzZXJzLCBhbmQgYXMgYW4gZW50ZXJwcmlz ZSBUTFMgdXNlciB3aG8gY2FyZXMgZGVlcGx5IGFib3V0IG5ldHdvcmsgc2VjdXJpdHksIEkg ZG8gbm90IGlkZW50aWZ5IHdoYXRzb2V2ZXIgd2l0aCB0aGUgY2xhaW1zIHRoaXMgZHJhZnQg aXMgbWFraW5nIGFib3V0IHRoZSBuZWVkcyBvZiBlbnRlcnByaXNlIFRMUyB1c2VycyBhcyBh IHdob2xlLiBJbiBhcyBtdWNoIGFzIHdoYXQgaXQgZGVzY3JpYmVzIHRvICJuZXR3b3JrIHNl Y3VyaXR5IiwgaXQgaXMgYnV0IG9uZSBuaWNoZSBjb25zaWRlcmF0aW9uIHdpdGhpbiBhIHZh c3RseSBicm9hZGVyIGZpZWxkLCBhbmQgb25lIHdoaWNoIGlzIGluY3JlYXNpbmdseSBjb250 cm92ZXJzaWFsLg0KDQpJIHdpbGwgcG9pbnQgb3V0LCBzaW5jZSB5b3UgYXBwZWFyIHRvIHdv cmsgYXQgQ2lzY28sIHRoYXQgeW91ciBjb21wYW55IHdvcmtzIG9uIGFwcHJvYWNoZXMgdG8g bmV0d29yayBzZWN1cml0eSAoZS5nLiBtYWx3YXJlIGRldGVjdGlvbikgd2hpY2ggYXZvaWQg ZGVjcnlwdGluZyBUTFM6DQoNCmh0dHBzOi8vYmxvZ3MuY2lzY28uY29tL3NlY3VyaXR5L2Rl dGVjdGluZy1lbmNyeXB0ZWQtbWFsd2FyZS10cmFmZmljLXdpdGhvdXQtZGVjcnlwdGlvbg0K DQpUaGVyZSBpcyBhbiBlbnRpcmUgd29ybGQgb2YgbmV0d29yayBJRFMgc3lzdGVtcyBiZXlv bmQgbWlkZGxlYm94ZXMgd2hpY2ggcGFzc2l2ZWx5IGRlY3J5cHQgVExTLg0KDQpJdCBpcyBm YWN0dWFsbHkgaW5hY2N1cmF0ZSBmb3IgdGhpcyBkcmFmdCB0byBiZSBkZXNjcmliZWQgYXMg IlRMUyAxLjMgSW1wYWN0IG9uIE5ldHdvcmstQmFzZWQgU2VjdXJpdHkiLiBJZiB5b3UgYXJl IGdvaW5nIHRvIHdyaXRlIGEgZHJhZnQgYWJvdXQgdGhlIGltcGFjdCBvZiBUTFMgMS4zIG9u IG1pZGRsZWJveGVzIGZvciBwYXNzaXZlIFRMUyBkZWNyeXB0aW9uLCBwbGVhc2UgY2FsbCBh IHNwYWRlIGEgc3BhZGUgYW5kIGRvbid0IHRyeSB0byBoaWRlIHlvdXIgdHJ1ZSBpbnRlbnRp b25zIHVuZGVyIGEgYnVuY2ggb2Ygd2Vhc2VsIHdvcmRzIGFuZCBvdmVybHkgYnJvYWQgY2xh aW1zIHRoYXQgbWFrZSBpdCBzb3VuZCBsaWtlIG1pZGRsZWJveC1yZWxhdGVkIFRMUyBkZWNy eXB0aW9uIHByb2JsZW1zIGFyZSB0aGUgZW5kIG9mIG5ldHdvcmsgc2VjdXJpdHkgYXMgd2Ug a25vdyBpdC4NCg0KTXkgMmMsIG9uIGJlaGFsZiBvZiBub24tbWlkZGxlYm94LXVzaW5nIGVu dGVycHJpc2UgVExTIHVzZXJzIHdobyBmZWVsIHRoYXQgYXR0ZW1wdHMgYnkgbWlkZGxlYm94 LXVzaW5nIGVudGVycHJpc2UgVExTIHVzZXJzIHRvIHdlYWtlbiBUTFMgaW4gb3JkZXIgdG8g cmV0YWluIGNvbXBhdGliaWxpdHkgd2l0aCB0aGVpciB0cmFmZmljIGRlY3J5cHRpb24gYXBw bGlhbmNlcyBpcyBhIHRocmVhdCB0byB0aGUgc2VjdXJpdHkgb2Ygb3VyIGVudGVycHJpc2Ug VExTIGRlcGxveW1lbnRzLg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX18NClRMUyBtYWlsaW5nIGxpc3QNClRMU0BpZXRmLm9yZzxtYWlsdG86VExT QGlldGYub3JnPg0KaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby90bHMN Cg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NClRM UyBtYWlsaW5nIGxpc3QNClRMU0BpZXRmLm9yZzxtYWlsdG86VExTQGlldGYub3JnPg0KaHR0 cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby90bHMNCg0KCgpUaGUgaW5mb3Jt YXRpb24gY29udGFpbmVkIGluIHRoaXMgY29tbXVuaWNhdGlvbiBpcyBoaWdobHkgY29uZmlk ZW50aWFsIGFuZCBpcyBpbnRlbmRlZCBzb2xlbHkgZm9yIHRoZSB1c2Ugb2YgdGhlIGluZGl2 aWR1YWwocykgdG8gd2hvbSB0aGlzIGNvbW11bmljYXRpb24gaXMgZGlyZWN0ZWQuIElmIHlv dSBhcmUgbm90IHRoZSBpbnRlbmRlZCByZWNpcGllbnQsIHlvdSBhcmUgaGVyZWJ5IG5vdGlm aWVkIHRoYXQgYW55IHZpZXdpbmcsIGNvcHlpbmcsIGRpc2Nsb3N1cmUgb3IgZGlzdHJpYnV0 aW9uIG9mIHRoaXMgaW5mb3JtYXRpb24gaXMgcHJvaGliaXRlZC4gUGxlYXNlIG5vdGlmeSB0 aGUgc2VuZGVyLCBieSBlbGVjdHJvbmljIG1haWwgb3IgdGVsZXBob25lLCBvZiBhbnkgdW5p bnRlbmRlZCByZWNlaXB0IGFuZCBkZWxldGUgdGhlIG9yaWdpbmFsIG1lc3NhZ2Ugd2l0aG91 dCBtYWtpbmcgYW55IGNvcGllcy4KIAogQmx1ZSBDcm9zcyBCbHVlIFNoaWVsZCBvZiBNaWNo aWdhbiBhbmQgQmx1ZSBDYXJlIE5ldHdvcmsgb2YgTWljaGlnYW4gYXJlIG5vbnByb2ZpdCBj b3Jwb3JhdGlvbnMgYW5kIGluZGVwZW5kZW50IGxpY2Vuc2VlcyBvZiB0aGUgQmx1ZSBDcm9z cyBhbmQgQmx1ZSBTaGllbGQgQXNzb2NpYXRpb24uCg== --_000_DM6PR14MB2474B49DAFBBDC3158F67CC5D7C70DM6PR14MB2474namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89 InVybjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJu OnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3Nj aGVtYXMubWljcm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDov L3d3dy53My5vcmcvVFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9 IkNvbnRlbnQtVHlwZSIgY29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxt ZXRhIG5hbWU9IkdlbmVyYXRvciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRl cmVkIG1lZGl1bSkiPg0KPHN0eWxlPjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBm b250LWZhY2UNCgl7Zm9udC1mYW1pbHk6SGVsdmV0aWNhOw0KCXBhbm9zZS0xOjIgMTEgNiA0 IDIgMiAyIDIgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6IkNhbWJyaWEgTWF0 aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2Zv bnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAyIDQ7fQ0K QGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpWZXJkYW5hOw0KCXBhbm9zZS0xOjIgMTEgNiA0 IDMgNSA0IDQgMiA0O30NCi8qIFN0eWxlIERlZmluaXRpb25zICovDQpwLk1zb05vcm1hbCwg bGkuTXNvTm9ybWFsLCBkaXYuTXNvTm9ybWFsDQoJe21hcmdpbi10b3A6MGluOw0KCW1hcmdp bi1yaWdodDowaW47DQoJbWFyZ2luLWJvdHRvbTo4LjBwdDsNCgltYXJnaW4tbGVmdDowaW47 DQoJbGluZS1oZWlnaHQ6MTIwJTsNCglmb250LXNpemU6MTIuNXB0Ow0KCWZvbnQtZmFtaWx5 OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7 bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9u OnVuZGVybGluZTt9DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7 bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRp b246dW5kZXJsaW5lO30NCnAubXNvbm9ybWFsMCwgbGkubXNvbm9ybWFsMCwgZGl2Lm1zb25v cm1hbDANCgl7bXNvLXN0eWxlLW5hbWU6bXNvbm9ybWFsOw0KCW1zby1tYXJnaW4tdG9wLWFs dDphdXRvOw0KCW1hcmdpbi1yaWdodDowaW47DQoJbXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1 dG87DQoJbWFyZ2luLWxlZnQ6MGluOw0KCWZvbnQtc2l6ZToxMS4wcHQ7DQoJZm9udC1mYW1p bHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0Kc3Bhbi5hcHBsZS1zdHlsZS1zcGFuDQoJe21z by1zdHlsZS1uYW1lOmFwcGxlLXN0eWxlLXNwYW47fQ0Kc3Bhbi5FbWFpbFN0eWxlMjANCgl7 bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwtcmVwbHk7DQoJZm9udC1mYW1pbHk6IkNhbGlicmki LHNhbnMtc2VyaWY7DQoJY29sb3I6d2luZG93dGV4dDt9DQouTXNvQ2hwRGVmYXVsdA0KCXtt c28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LXNpemU6MTAuMHB0O30NCkBwYWdl IFdvcmRTZWN0aW9uMQ0KCXtzaXplOjguNWluIDExLjBpbjsNCgltYXJnaW46MS4waW4gMS4w aW4gMS4waW4gMS4waW47fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9u MTt9DQotLT48L3N0eWxlPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVkZWZh dWx0cyB2OmV4dD0iZWRpdCIgc3BpZG1heD0iMTAyNiIgLz4NCjwveG1sPjwhW2VuZGlmXS0t PjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVsYXlvdXQgdjpleHQ9ImVkaXQi Pg0KPG86aWRtYXAgdjpleHQ9ImVkaXQiIGRhdGE9IjEiIC8+DQo8L286c2hhcGVsYXlvdXQ+ PC94bWw+PCFbZW5kaWZdLS0+DQo8L2hlYWQ+DQo8Ym9keSBsYW5nPSJFTi1VUyIgbGluaz0i Ymx1ZSIgdmxpbms9InB1cnBsZSI+DQo8ZGl2IGNsYXNzPSJXb3JkU2VjdGlvbjEiPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7bGluZS1o ZWlnaHQ6MTIwJSI+JiM0MzsxIDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2xpbmUtaGVpZ2h0OjEy MCUiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJi b3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNFMUUxRTEgMS4wcHQ7cGFkZGluZzozLjBw dCAwaW4gMGluIDBpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWJv dHRvbTowaW47bWFyZ2luLWJvdHRvbTouMDAwMXB0O2xpbmUtaGVpZ2h0Om5vcm1hbCI+DQo8 Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+RnJvbTo8L3NwYW4+PC9iPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij4gVExTICZsdDt0bHMtYm91bmNlc0BpZXRmLm9y ZyZndDsNCjxiPk9uIEJlaGFsZiBPZiA8L2I+QnJldCBKb3JkYW48YnI+DQo8Yj5TZW50Ojwv Yj4gVHVlc2RheSwgSnVseSAyMywgMjAxOSA1OjUyIFBNPGJyPg0KPGI+VG86PC9iPiBTZWFu IFR1cm5lciAmbHQ7c2VhbkBzbjNyZC5jb20mZ3Q7PGJyPg0KPGI+Q2M6PC9iPiBUb255IEFy Y2llcmkgJmx0O2Jhc2N1bGVAZ21haWwuY29tJmd0OzsgdGxzQGlldGYub3JnPGJyPg0KPGI+ U3ViamVjdDo8L2I+IFJlOiBbVExTXSBUTFMgSW1wYWN0IG9uIE5ldHdvcmsgU2VjdXJpdHkg ZHJhZnQgdXBkYXRlZDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIGFsaWduPSJjZW50ZXIiIHN0eWxlPSJtYXJnaW4tYm90dG9tOjBpbjttYXJn aW4tYm90dG9tOi4wMDAxcHQ7dGV4dC1hbGlnbjpjZW50ZXIiPg0KPGI+PHNwYW4gc3R5bGU9 ImNvbG9yOnJlZDtiYWNrZ3JvdW5kOnllbGxvdzttc28taGlnaGxpZ2h0OnllbGxvdyI+Jm5i c3A7QUxFUlQ8L3NwYW4+PC9iPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjaztiYWNrZ3JvdW5k OnllbGxvdzttc28taGlnaGxpZ2h0OnllbGxvdyI+IFRoaXMgZW1haWwgd2FzIHNlbnQgZnJv bSBhIHNvdXJjZSBleHRlcm5hbCB0byBCQ0JTTS9CQ04uDQo8L3NwYW4+PG86cD48L286cD48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBhbGlnbj0iY2VudGVyIiBzdHlsZT0ibWFyZ2lu LWJvdHRvbTowaW47bWFyZ2luLWJvdHRvbTouMDAwMXB0O3RleHQtYWxpZ246Y2VudGVyIj4N CjxiPjxzcGFuIHN0eWxlPSJjb2xvcjpyZWQ7YmFja2dyb3VuZDp5ZWxsb3c7bXNvLWhpZ2hs aWdodDp5ZWxsb3ciPiZuYnNwO0RPIE5PVCBDTElDSzwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9 ImNvbG9yOnJlZDtiYWNrZ3JvdW5kOnllbGxvdzttc28taGlnaGxpZ2h0OnllbGxvdyI+DQo8 L3NwYW4+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrO2JhY2tncm91bmQ6eWVsbG93O21zby1o aWdobGlnaHQ6eWVsbG93Ij5saW5rcyBvciBhdHRhY2htZW50cyB1bmxlc3MgeW91IHJlY29n bml6ZSB0aGUgc2VuZGVyIGFuZCB0cnVzdCB0aGUgY29udGVudC4NCjwvc3Bhbj48bzpwPjwv bzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIGFsaWduPSJjZW50ZXIiIHN0eWxlPSJt YXJnaW4tYm90dG9tOjBpbjttYXJnaW4tYm90dG9tOi4wMDAxcHQ7dGV4dC1hbGlnbjpjZW50 ZXI7bGluZS1oZWlnaHQ6bm9ybWFsIj4NCjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1hcmdpbi1ib3R0b206MGluO21hcmdpbi1ib3R0b206LjAwMDFwdDts aW5lLWhlaWdodDpub3JtYWwiPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPlRo YW5rcyBTZWFuLiAmbmJzcDsgPG86cD48L286cD48L3NwYW4+PC9wPg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tYm90dG9tOjBpbjttYXJnaW4tYm90dG9t Oi4wMDAxcHQ7bGluZS1oZWlnaHQ6bm9ybWFsIj4NCjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWJvdHRvbTowaW47bWFyZ2luLWJv dHRvbTouMDAwMXB0O2xpbmUtaGVpZ2h0Om5vcm1hbCI+DQo8c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdCI+SXQgaXMgY3JpdGljYWwgdGhhdCB3ZSB1bmRlcnN0YW5kIGFuZCBkaXNj dXNzIGFsbCBzaWRlcyBvZiBhbiBpc3N1ZSBhbmQgYWRkcmVzcyBhbGwgdXNlIGNhc2VzIHRo YXQgbWFya2V0IGhhcy4gQmVhdGluZyBwZW9wbGUgZG93biBhbmQgdHJ5aW5nIHRvIGF0dGFj ayBwZW9wbGUgb3IgdGhlaXIgdXNlIGNhc2VzIGlzIG5vdCBzb21ldGhpbmcgd2Ugc2hvdWxk IGJlIGRvaW5nIGluIGZvcm1hbCBzdGFuZGFyZHMsDQogZXNwZWNpYWxseSBoZXJlIGF0IHRo ZSBJRVRGLiA8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1hcmdpbi1ib3R0b206MGluO21hcmdpbi1ib3R0b206LjAwMDFwdDts aW5lLWhlaWdodDpub3JtYWwiPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxv OnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tYm90dG9tOjBpbjttYXJnaW4tYm90dG9tOi4wMDAx cHQ7bGluZS1oZWlnaHQ6bm9ybWFsIj4NCjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWJvdHRvbTowaW47bWFyZ2luLWJv dHRvbTouMDAwMXB0O2xpbmUtaGVpZ2h0Om5vcm1hbCI+DQo8c3BhbiBjbGFzcz0iYXBwbGUt c3R5bGUtc3BhbiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC41cHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2siPlRoYW5rcyw8 L3NwYW4+PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuNXB0O2ZvbnQtZmFtaWx5 OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOmJsYWNrIj48bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibWFyZ2luLWJvdHRvbTowaW47bWFyZ2luLWJvdHRvbTouMDAwMXB0O2xpbmUtaGVp Z2h0Om5vcm1hbCI+DQo8c3BhbiBjbGFzcz0iYXBwbGUtc3R5bGUtc3BhbiI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMC41cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7 LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2siPkJyZXQ8L3NwYW4+PC9zcGFuPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTAuNXB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90Oyxz YW5zLXNlcmlmO2NvbG9yOmJsYWNrIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1hcmdpbi1ib3R0b206MGluO21hcmdpbi1ib3R0b206LjAwMDFwdDtsaW5l LWhlaWdodDpub3JtYWwiPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo4LjVwdDtmb250LWZh bWlseTomcXVvdDtWZXJkYW5hJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzdDN0M3QyI+UEdQ IEZpbmdlcnByaW50OiZuYnNwOzYzQjQgRkM1MyA2ODBBIDZCN0QgMTQ0NyAmbmJzcDtGMkMw IDc0RjggQUNBRSA3NDE1IDAwNTA8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC41 cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6 YmxhY2siPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tYm90dG9tOjBpbjttYXJnaW4tYm90dG9tOi4w MDAxcHQ7bGluZS1oZWlnaHQ6bm9ybWFsIj4NCjxzcGFuIHN0eWxlPSJmb250LXNpemU6OC4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VmVyZGFuYSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiM3 QzdDN0MiPiZxdW90O1dpdGhvdXQgY3J5cHRvZ3JhcGh5IHZpaHYgdml2YyBjZSB4aHJucncs IGhvd2V2ZXIsIHRoZSBvbmx5IHRoaW5nIHRoYXQgY2FuIG5vdCBiZSB1bnNjcmFtYmxlZCBp cyBhbiBlZ2cuJnF1b3Q7PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuNXB0O2Zv bnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOmJsYWNr Ij48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rp dj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibWFyZ2luLWJvdHRvbTowaW47bWFyZ2luLWJvdHRvbTouMDAwMXB0O2xpbmUt aGVpZ2h0Om5vcm1hbCI+DQo8c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+PGJyPg0K PGJyPg0KPG86cD48L286cD48L3NwYW4+PC9wPg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdp bi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1hcmdpbi1ib3R0b206MGluO21hcmdpbi1ib3R0b206LjAwMDFw dDtsaW5lLWhlaWdodDpub3JtYWwiPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQi Pk9uIEp1bCAyMywgMjAxOSwgYXQgNDo1MSBQTSwgU2VhbiBUdXJuZXIgJmx0OzxhIGhyZWY9 Im1haWx0bzpzZWFuQHNuM3JkLmNvbSI+c2VhbkBzbjNyZC5jb208L2E+Jmd0OyB3cm90ZTo8 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtYXJnaW4tYm90dG9tOjBpbjttYXJnaW4tYm90dG9tOi4wMDAxcHQ7bGluZS1oZWln aHQ6bm9ybWFsIj4NCjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij48bzpwPiZuYnNw OzwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtYXJnaW4tYm90dG9tOjBpbjttYXJnaW4tYm90dG9tOi4wMDAxcHQ7bGluZS1o ZWlnaHQ6bm9ybWFsIj4NCjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij5Ub255LDxi cj4NCjxicj4NCldoaWxlIHlvdSBtYXkgaGF2ZSBjb25jZXJucyBvciBvdGhlcndpc2UgZGlz YWdyZWUgd2l0aCB0aGUgY29udGVudHMgb2YgdGhpcyBkcmFmdCwgbGV04oCZcyBwbGVhc2Ug a2VlcCBkaXNjdXNzaW9uIG9uIHRoaXMgbGlzdCwgb24gYWxsIGlzc3VlcywgcG9saXRlIGFu ZCBwcm9mZXNzaW9uYWwuPGJyPg0KPGJyPg0Kc3B0PGJyPg0KKGFzIGNvLWNoYWlyKTxicj4N Cjxicj4NCjxicj4NCjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxibG9ja3F1b3RlIHN0eWxl PSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1hcmdpbi1ib3R0b206MGluO21hcmdpbi1ib3R0b206LjAwMDFw dDtsaW5lLWhlaWdodDpub3JtYWwiPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQi Pk9uIEp1bCAyMywgMjAxOSwgYXQgMTY6MDUsIFRvbnkgQXJjaWVyaSAmbHQ7PGEgaHJlZj0i bWFpbHRvOmJhc2N1bGVAZ21haWwuY29tIj5iYXNjdWxlQGdtYWlsLmNvbTwvYT4mZ3Q7IHdy b3RlOjxicj4NCjxicj4NCk9uIFN1biwgSnVsIDIxLCAyMDE5IGF0IDY6NTEgQU0gTmFuY3kg Q2FtLVdpbmdldCAobmNhbXdpbmcpICZsdDs8YSBocmVmPSJtYWlsdG86bmNhbXdpbmdAY2lz Y28uLmNvbSI+bmNhbXdpbmdAY2lzY28uLmNvbTwvYT4mZ3Q7IHdyb3RlOjxicj4NCkhpLDxi cj4NCjxicj4NClRoYW5rcyB0byBhbGwgdGhlIGZlZWRiYWNrIHByb3ZpZGVkLCB3ZSBoYXZl IHVwZGF0ZWQgdGhlIDxhIGhyZWY9Imh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFm dC1jYW13aW5nZXQtdGxzLXVzZS1jYXNlcy0wNCI+DQpodHRwczovL3Rvb2xzLmlldGYub3Jn L2h0bWwvZHJhZnQtY2Ftd2luZ2V0LXRscy11c2UtY2FzZXMtMDQ8L2E+PGJyPg0KPGJyPg0K ZHJhZnQuICZuYnNwO0F0IHRoaXMgcG9pbnQsIHdlIGJlbGlldmUgdGhlIGRyYWZ0IGlzIHN0 YWJsZSBhbmQgd291bGQgbGlrZSB0byByZXF1ZXN0IGl0cyBwdWJsaWNhdGlvbiBhcyBhbiBp bmZvcm1hdGlvbmFsIGRyYWZ0Ljxicj4NCjxicj4NCjxicj4NCkkgcmVhZCB0aGlzIGRyYWZ0 IGFzIHRoZSBsYXRlc3QgYXR0ZW1wdCBpbiBhIGRpc2luZm9ybWF0aW9uIGNhbXBhaWduIGJ5 IG1hbnVmYWN0dXJlcnMgYW5kIHVzZXJzIG9mIG1pZGRsZWJveGVzIHRoYXQgcGFzc2l2ZWx5 IGRlY3J5cHQgVExTIGNvbm5lY3Rpb25zIHRvIHBvbGl0aWNpemUgYW5kIHJlZnJhbWUgdGhl IGFyZ3VtZW50IGFyb3VuZCB3aGF0IGlzLCBhdCBpdHMgY29yZSwgYSBmdW5kYW1lbnRhbGx5 IGluc2VjdXJlIHByYWN0aWNlIHdoaWNoDQogaXMgaW5jb21wYXRpYmxlIHdpdGggdGVjaG5p Y2FsbHkgc291bmQgYW5kIGhpZ2hseSBkZXNpcmFibGUgcHJvdG9jb2wgaW1wcm92ZW1lbnRz IHRvIFRMUy48YnI+DQo8YnI+DQpJIGltcGxvcmUgeW91IHN0b3AgdXNpbmcgb3Zlcmx5IGJy b2FkIHRlcm1pbm9sb2d5LCBldXBoZW1pc21zLCB3ZWFzZWwgd29yZHMsIGFuZCBvdGhlciBk ZWNlcHRpdmUgbGFuZ3VhZ2UgdG8gYXJndWUgeW91ciBwb2ludHMuPGJyPg0KPGJyPg0KVGhp cyBkcmFmdCBpcyB0aXRsZWQgJnF1b3Q7VExTIDEuMyBJbXBhY3Qgb24gTmV0d29yay1CYXNl ZCBTZWN1cml0eSZxdW90OywgYnV0IHRoZSBzdWJ0ZXh0IGlzIHF1aXRlIGNsZWFybHkgdGhl IG11Y2ggbmFycm93ZXIgc3ViZmllbGQgb2YgbWlkZGxlYm94IFRMUyBkZWNyeXB0aW9uLiBC eSB1c2luZyBzdWNoIGEgZ3JhbmRpb3NlIHRpdGxlIHdoaWNoIGlzIGRlY2VwdGl2ZWx5IGhp ZGluZyB0aGUgdHJ1ZSBzdWJqZWN0IG1hdHRlciwgeW91IGFyZSBpbXBseWluZyB0aGF0DQog bWlkZGxlYm94ZXMgYXJlIHRoZSBzdW0gdG90YWwgb2YgbmV0d29yayBzZWN1cml0eS48YnI+ DQo8YnI+DQpUaGUgZHJhZnQgYmVnaW5zICZxdW90O0VudGVycHJpc2VzIFsuLi5dIG5lZWQg dG8gZGVmZW5kIHRoZWlyIGluZm9ybWF0aW9uIHN5c3RlbXMgZnJvbSBhdHRhY2tzIG9yaWdp bmF0aW5nIGZyb20gYm90aCBpbnNpZGUgYW5kIG91dHNpZGUgdGhlaXIgbmV0d29ya3MuJnF1 b3Q7IEkgYW0gY28tb3duZXIgb2YgYSBjb21wYW55IHdoaWNoIGhlYXZpbHkgbGV2ZXJhZ2Vz IGZpcmV3YWxscyBmb3IgbGF5ZXIgMy80IG5ldHdvcmsgc2VjdXJpdHkgaW4gY29uanVuY3Rp b24gd2l0aA0KIFRMUy4gV2UgY2FyZSBkZWVwbHkgYWJvdXQgbmV0d29yayBzZWN1cml0eSwg YW5kIGJlbGlldmUgdGhhdCBvdXIgbmV0d29yayBpcyAqbW9yZSBzZWN1cmUqIHNwZWNpZmlj YWxseSBiZWNhdXNlIHdlICpkb24ndCogcGVyZm9ybSBtaWRkbGVib3ggaW50ZXJjZXB0aW9u IG9mIFRMUy48YnI+DQo8YnI+DQpJIGNvbnNpZGVyIG91ciBjb21wYW55IHRvIGJlIGluIHRo ZSBjYXRlZ29yeSBvZiBlbnRlcnByaXNlIFRMUyB1c2VycywgYW5kIGFzIGFuIGVudGVycHJp c2UgVExTIHVzZXIgd2hvIGNhcmVzIGRlZXBseSBhYm91dCBuZXR3b3JrIHNlY3VyaXR5LCBJ IGRvIG5vdCBpZGVudGlmeSB3aGF0c29ldmVyIHdpdGggdGhlIGNsYWltcyB0aGlzIGRyYWZ0 IGlzIG1ha2luZyBhYm91dCB0aGUgbmVlZHMgb2YgZW50ZXJwcmlzZSBUTFMgdXNlcnMgYXMg YSB3aG9sZS4NCiBJbiBhcyBtdWNoIGFzIHdoYXQgaXQgZGVzY3JpYmVzIHRvICZxdW90O25l dHdvcmsgc2VjdXJpdHkmcXVvdDssIGl0IGlzIGJ1dCBvbmUgbmljaGUgY29uc2lkZXJhdGlv biB3aXRoaW4gYSB2YXN0bHkgYnJvYWRlciBmaWVsZCwgYW5kIG9uZSB3aGljaCBpcyBpbmNy ZWFzaW5nbHkgY29udHJvdmVyc2lhbC48YnI+DQo8YnI+DQpJIHdpbGwgcG9pbnQgb3V0LCBz aW5jZSB5b3UgYXBwZWFyIHRvIHdvcmsgYXQgQ2lzY28sIHRoYXQgeW91ciBjb21wYW55IHdv cmtzIG9uIGFwcHJvYWNoZXMgdG8gbmV0d29yayBzZWN1cml0eSAoZS5nLiBtYWx3YXJlIGRl dGVjdGlvbikgd2hpY2ggYXZvaWQgZGVjcnlwdGluZyBUTFM6PGJyPg0KPGJyPg0KPGEgaHJl Zj0iaHR0cHM6Ly9ibG9ncy5jaXNjby5jb20vc2VjdXJpdHkvZGV0ZWN0aW5nLWVuY3J5cHRl ZC1tYWx3YXJlLXRyYWZmaWMtd2l0aG91dC1kZWNyeXB0aW9uIj5odHRwczovL2Jsb2dzLmNp c2NvLmNvbS9zZWN1cml0eS9kZXRlY3RpbmctZW5jcnlwdGVkLW1hbHdhcmUtdHJhZmZpYy13 aXRob3V0LWRlY3J5cHRpb248L2E+PGJyPg0KPGJyPg0KVGhlcmUgaXMgYW4gZW50aXJlIHdv cmxkIG9mIG5ldHdvcmsgSURTIHN5c3RlbXMgYmV5b25kIG1pZGRsZWJveGVzIHdoaWNoIHBh c3NpdmVseSBkZWNyeXB0IFRMUy48YnI+DQo8YnI+DQpJdCBpcyBmYWN0dWFsbHkgaW5hY2N1 cmF0ZSBmb3IgdGhpcyBkcmFmdCB0byBiZSBkZXNjcmliZWQgYXMgJnF1b3Q7VExTIDEuMyBJ bXBhY3Qgb24gTmV0d29yay1CYXNlZCBTZWN1cml0eSZxdW90Oy4gSWYgeW91IGFyZSBnb2lu ZyB0byB3cml0ZSBhIGRyYWZ0IGFib3V0IHRoZSBpbXBhY3Qgb2YgVExTIDEuMyBvbiBtaWRk bGVib3hlcyBmb3IgcGFzc2l2ZSBUTFMgZGVjcnlwdGlvbiwgcGxlYXNlIGNhbGwgYSBzcGFk ZSBhIHNwYWRlIGFuZCBkb24ndCB0cnkgdG8gaGlkZQ0KIHlvdXIgdHJ1ZSBpbnRlbnRpb25z IHVuZGVyIGEgYnVuY2ggb2Ygd2Vhc2VsIHdvcmRzIGFuZCBvdmVybHkgYnJvYWQgY2xhaW1z IHRoYXQgbWFrZSBpdCBzb3VuZCBsaWtlIG1pZGRsZWJveC1yZWxhdGVkIFRMUyBkZWNyeXB0 aW9uIHByb2JsZW1zIGFyZSB0aGUgZW5kIG9mIG5ldHdvcmsgc2VjdXJpdHkgYXMgd2Uga25v dyBpdC48YnI+DQo8YnI+DQpNeSAyYywgb24gYmVoYWxmIG9mIG5vbi1taWRkbGVib3gtdXNp bmcgZW50ZXJwcmlzZSBUTFMgdXNlcnMgd2hvIGZlZWwgdGhhdCBhdHRlbXB0cyBieSBtaWRk bGVib3gtdXNpbmcgZW50ZXJwcmlzZSBUTFMgdXNlcnMgdG8gd2Vha2VuIFRMUyBpbiBvcmRl ciB0byByZXRhaW4gY29tcGF0aWJpbGl0eSB3aXRoIHRoZWlyIHRyYWZmaWMgZGVjcnlwdGlv biBhcHBsaWFuY2VzIGlzIGEgdGhyZWF0IHRvIHRoZSBzZWN1cml0eSBvZiBvdXIgZW50ZXJw cmlzZQ0KIFRMUyBkZXBsb3ltZW50cy48YnI+DQpfX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fXzxicj4NClRMUyBtYWlsaW5nIGxpc3Q8YnI+DQo8YSBo cmVmPSJtYWlsdG86VExTQGlldGYub3JnIj5UTFNAaWV0Zi5vcmc8L2E+PGJyPg0KPGEgaHJl Zj0iaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby90bHMiPmh0dHBzOi8v d3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vdGxzPC9hPjxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjwvYmxvY2txdW90ZT4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJn aW4tYm90dG9tOjBpbjttYXJnaW4tYm90dG9tOi4wMDAxcHQ7bGluZS1oZWlnaHQ6bm9ybWFs Ij4NCjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij48YnI+DQpfX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXzxicj4NClRMUyBtYWlsaW5nIGxp c3Q8YnI+DQo8YSBocmVmPSJtYWlsdG86VExTQGlldGYub3JnIj5UTFNAaWV0Zi5vcmc8L2E+ PGJyPg0KPGEgaHJlZj0iaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby90 bHMiPmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vdGxzPC9hPjxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tYm90dG9tOjBpbjttYXJn aW4tYm90dG9tOi4wMDAxcHQ7bGluZS1oZWlnaHQ6bm9ybWFsIj4NCjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4N CjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCgoKPEJSPgo8aHRt bD4KIDxwPlRoZSBpbmZvcm1hdGlvbiBjb250YWluZWQgaW4gdGhpcyBjb21tdW5pY2F0aW9u IGlzIGhpZ2hseSBjb25maWRlbnRpYWwgYW5kIGlzIGludGVuZGVkIHNvbGVseSBmb3IgdGhl IHVzZSBvZiB0aGUgaW5kaXZpZHVhbChzKSB0byB3aG9tIHRoaXMgY29tbXVuaWNhdGlvbiBp cyBkaXJlY3RlZC4gSWYgeW91IGFyZSBub3QgdGhlIGludGVuZGVkIHJlY2lwaWVudCwgeW91 IGFyZSBoZXJlYnkgbm90aWZpZWQgdGhhdCBhbnkgdmlld2luZywgY29weWluZywgZGlzY2xv c3VyZSBvciBkaXN0cmlidXRpb24gb2YgdGhpcyBpbmZvcm1hdGlvbiBpcyBwcm9oaWJpdGVk LiBQbGVhc2Ugbm90aWZ5IHRoZSBzZW5kZXIsIGJ5IGVsZWN0cm9uaWMgbWFpbCBvciB0ZWxl cGhvbmUsIG9mIGFueSB1bmludGVuZGVkIHJlY2VpcHQgYW5kIGRlbGV0ZSB0aGUgb3JpZ2lu YWwgbWVzc2FnZSB3aXRob3V0IG1ha2luZyBhbnkgY29waWVzLjwvcD4KIDxwPkJsdWUgQ3Jv c3MgQmx1ZSBTaGllbGQgb2YgTWljaGlnYW4gYW5kIEJsdWUgQ2FyZSBOZXR3b3JrIG9mIE1p Y2hpZ2FuIGFyZSBub25wcm9maXQgY29ycG9yYXRpb25zIGFuZCBpbmRlcGVuZGVudCBsaWNl bnNlZXMgb2YgdGhlIEJsdWUgQ3Jvc3MgYW5kIEJsdWUgU2hpZWxkIEFzc29jaWF0aW9uLjwv cD4KICA8L2h0bWw+Cgo= --_000_DM6PR14MB2474B49DAFBBDC3158F67CC5D7C70DM6PR14MB2474namp_-- From nobody Tue Jul 23 15:09:36 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B2BD8120120 for ; Tue, 23 Jul 2019 15:09:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cert.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id V9ffDHMQfqKv for ; Tue, 23 Jul 2019 15:09:33 -0700 (PDT) Received: from veto.sei.cmu.edu (veto.sei.cmu.edu [147.72.252.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E839512001B for ; Tue, 23 Jul 2019 15:09:32 -0700 (PDT) Received: from korb.sei.cmu.edu (korb.sei.cmu.edu [10.64.21.30]) by veto.sei.cmu.edu (8.14.7/8.14.7) with ESMTP id x6NM9VZS046030 for ; Tue, 23 Jul 2019 18:09:32 -0400 DKIM-Filter: OpenDKIM Filter v2.11.0 veto.sei.cmu.edu x6NM9VZS046030 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cert.org; s=yc2bmwvrj62m; t=1563919772; bh=A2+nydhAfdSIJytmErsKlTegtI0NKKCA9IAOfou7+fA=; h=From:To:Subject:Date:From; b=PAyhs/OmTmHExy6s1wNS4z+ck38ZwW8QpkNIsmcIRcf5SJx+yyuZv9dJryRm703cQ EO+tnuqJH90wTW/fpvKB3ULD5p2JsKDhQ90ppPJz6OpV1pkhGpHg4JydxZReCIV8QJ YeD708liE/e7KQE1W/OWkNwvOmoskwJvIZvJ1CZ4= Received: from CASCADE.ad.sei.cmu.edu (cascade.ad.sei.cmu.edu [10.64.28.248]) by korb.sei.cmu.edu (8.14.7/8.14.7) with ESMTP id x6NM9U3A025030 for ; Tue, 23 Jul 2019 18:09:30 -0400 Received: from MARCHAND.ad.sei.cmu.edu ([10.64.28.251]) by CASCADE.ad.sei.cmu.edu ([10.64.28.248]) with mapi id 14.03.0439.000; Tue, 23 Jul 2019 18:09:30 -0400 From: Chris Inacio To: "tls@ietf.org" Thread-Topic: TLS Flags extension - not sure it makes sense Thread-Index: AQHVQaNMBP6W9C0Sz0y+95gPqlOPiw== Date: Tue, 23 Jul 2019 22:09:29 +0000 Message-ID: <9257D2C3-05A2-498C-AA2A-04F5EA793ACC@cert.org> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.1b.0.190715 x-originating-ip: [10.64.201.37] Content-Type: multipart/alternative; boundary="_000_9257D2C305A2498CAA2A04F5EA793ACCcertorg_" MIME-Version: 1.0 Archived-At: Subject: [TLS] TLS Flags extension - not sure it makes sense X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 Jul 2019 22:09:35 -0000 --_000_9257D2C305A2498CAA2A04F5EA793ACCcertorg_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SSByZWFsbHkgd2FudCB0aGUgc2F2aW5ncyBvbiB0aGUgd2lyZSB0aGF0IFRMUyBmbGFncyBleHRl bnNpb24gcHJvdmlkZXMg4oCTIGFuZCBzbyBJIHRoaW5rIGl04oCZcyByZWFsbHkgZ29vZCBmb3Ig dGhlIGZ1dHVyZSBjVExTIGJ1dCBJ4oCZbSBub3Qgc3VyZSB3aGVuIEkgZ2V0IHRvIHVzZSBpdCBp biBUTFMgMS4zIG5lZ290aWF0aW9uLiAgSXQgZ29lcyBpbiB0aGUgY2xpZW50SGVsbG8gbWVzc2Fn ZSwgYnV0IGhvdyB3aWxsIEkga25vdyB0aGF0IHRoZSBzZXJ2ZXIgdXNlcyB0aGlzIGV4dGVuc2lv bj8gIEkgZW52aXNpb24gYSBmdXR1cmUgd2hlcmUgd2Ugd2lsbCBhZGQgdGhlIGZsYWdzIGV4dGVu c2lvbiBhbG9uZyB3aXRoIHRoZSBtb3JlIGV4cGVuc2l2ZSA0LWJ5dGVzIHZlcnNpb24gZm9yIGEg UkVBTExZIGxvbmcgdGltZS4NCg0KSXMgdGhlcmUgYSBwbGFuIC8gYWJpbGl0eSB0byB0dXJuIG9m ZiB0aGUgNC1ieXRlIHZlcnNpb24/DQoNCihCVFc6IEnigJltIGhhcHB5IGlmIHBlb3BsZSB3aG8g cmVhbGx5IHdvcmsgdGhlIGRldGFpbHMgb2YgVExTIHRlbGwgbWUgSSBtaXMtdW5kZXJzdGFuZC4g IEkgaG9wZSBJIGRvLikNCg0KDQo= --_000_9257D2C305A2498CAA2A04F5EA793ACCcertorg_ Content-Type: text/html; charset="utf-8" Content-ID: <127996519140E2428F950E1D8BA59011@sei.cmu.edu> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2 IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToy IDE1IDUgMiAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3Jt YWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1i b3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJp IixzYW5zLXNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXBy aW9yaXR5Ojk5Ow0KCWNvbG9yOiMwNTYzQzE7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9 DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9y aXR5Ojk5Ow0KCWNvbG9yOiM5NTRGNzI7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpz cGFuLkVtYWlsU3R5bGUxNw0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1jb21wb3NlOw0KCWZv bnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0KLk1z b0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1mYW1pbHk6 IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6OC41aW4g MTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBpbiAxLjBpbiAxLjBpbjt9DQpkaXYuV29yZFNlY3Rp b24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi0tPjwvc3R5bGU+DQo8L2hlYWQ+DQo8Ym9keSBs YW5nPSJFTi1VUyIgbGluaz0iIzA1NjNDMSIgdmxpbms9IiM5NTRGNzIiPg0KPGRpdiBjbGFzcz0i V29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0Ij5JIHJlYWxseSB3YW50IHRoZSBzYXZpbmdzIG9uIHRoZSB3aXJlIHRoYXQgVExT IGZsYWdzIGV4dGVuc2lvbiBwcm92aWRlcyDigJMgYW5kIHNvIEkgdGhpbmsgaXTigJlzIHJlYWxs eSBnb29kIGZvciB0aGUgZnV0dXJlIGNUTFMgYnV0IEnigJltIG5vdCBzdXJlIHdoZW4gSSBnZXQg dG8gdXNlIGl0IGluIFRMUyAxLjMgbmVnb3RpYXRpb24uJm5ic3A7IEl0IGdvZXMgaW4gdGhlIGNs aWVudEhlbGxvDQogbWVzc2FnZSwgYnV0IGhvdyB3aWxsIEkga25vdyB0aGF0IHRoZSBzZXJ2ZXIg dXNlcyB0aGlzIGV4dGVuc2lvbj8mbmJzcDsgSSBlbnZpc2lvbiBhIGZ1dHVyZSB3aGVyZSB3ZSB3 aWxsIGFkZCB0aGUgZmxhZ3MgZXh0ZW5zaW9uIGFsb25nIHdpdGggdGhlIG1vcmUgZXhwZW5zaXZl IDQtYnl0ZXMgdmVyc2lvbiBmb3IgYSBSRUFMTFkgbG9uZyB0aW1lLjxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+SXMgdGhlcmUgYSBwbGFuIC8gYWJpbGl0eSB0byB0 dXJuIG9mZiB0aGUgNC1ieXRlIHZlcnNpb24/PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxvOnA+Jm5ic3A7 PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0Ij4oQlRXOiBJ4oCZbSBoYXBweSBpZiBwZW9wbGUgd2hvIHJlYWxseSB3b3Jr IHRoZSBkZXRhaWxzIG9mIFRMUyB0ZWxsIG1lIEkgbWlzLXVuZGVyc3RhbmQuJm5ic3A7IEkgaG9w ZSBJIGRvLik8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9ib2R5Pg0KPC9odG1sPg0K --_000_9257D2C305A2498CAA2A04F5EA793ACCcertorg_-- From nobody Tue Jul 23 15:12:12 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 091F012001B for ; Tue, 23 Jul 2019 15:12:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=akamai.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ky5biNTa4evk for ; Tue, 23 Jul 2019 15:11:58 -0700 (PDT) Received: from mx0a-00190b01.pphosted.com (mx0a-00190b01.pphosted.com [IPv6:2620:100:9001:583::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 624C1120996 for ; Tue, 23 Jul 2019 15:11:58 -0700 (PDT) Received: from pps.filterd (m0050093.ppops.net [127.0.0.1]) by m0050093.ppops.net-00190b01. (8.16.0.42/8.16.0.42) with SMTP id x6NM6l4R014312 for ; Tue, 23 Jul 2019 23:11:58 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=akamai.com; h=from : to : subject : date : message-id : content-type : mime-version; s=jan2016.eng; bh=gOFvRJV8O2X7Ot6plumaXEg538ceZ5KroHpEG9y3AT4=; b=SU/h4Hu/BxRkMDXoPRFIbs/h6JruX+GkBEZrR5470wGBIEL0Ghv40bnTHQl5GbhwM30t Y00kQPMX9DGrnzGCc3+tA1M/ADxcGq8aovVkgd8IulHV90e9zmwP2BKSY4QYKfy0Qn4b je8eKeAv1TVkTUNvbeTKaMq4022/KKX0J67d//e4U/42TkBpRKZYRmoVAA4gh4EWQkZz +uKT0l8FiqIVn0+3jJQMLj6E4Lve98zyFJRzMzcDzqn+eOIAw0h8Tl7rQLELho9Cw+E9 KqyyLzDtAjrsAUd97l2oQdep8LwqzZX6suGwdOjO4VVzaXxhY+jV6jYHpRrRdJeg8C2y 1w== Received: from prod-mail-ppoint8 (prod-mail-ppoint8.akamai.com [96.6.114.122] (may be forged)) by m0050093.ppops.net-00190b01. with ESMTP id 2tx60s9296-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Tue, 23 Jul 2019 23:11:57 +0100 Received: from pps.filterd (prod-mail-ppoint8.akamai.com [127.0.0.1]) by prod-mail-ppoint8.akamai.com (8.16.0.27/8.16.0.27) with SMTP id x6NM24U5018145 for ; Tue, 23 Jul 2019 18:11:57 -0400 Received: from email.msg.corp.akamai.com ([172.27.123.57]) by prod-mail-ppoint8.akamai.com with ESMTP id 2tx62xsjhu-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT) for ; Tue, 23 Jul 2019 18:11:56 -0400 Received: from USMA1EX-DAG1MB1.msg.corp.akamai.com (172.27.123.101) by usma1ex-dag1mb1.msg.corp.akamai.com (172.27.123.101) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Tue, 23 Jul 2019 18:11:54 -0400 Received: from USMA1EX-DAG1MB1.msg.corp.akamai.com ([172.27.123.101]) by usma1ex-dag1mb1.msg.corp.akamai.com ([172.27.123.101]) with mapi id 15.00.1473.005; Tue, 23 Jul 2019 18:11:54 -0400 From: "Salz, Rich" To: "tls@ietf.org" Thread-Topic: Draft minutes for Tuesday Thread-Index: AQHVQaOiOnYooVK1akiP0x470c1W2Q== Date: Tue, 23 Jul 2019 22:11:54 +0000 Message-ID: <63A3AC36-E5DB-49F2-AD42-7B6672538A2F@akamai.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.1b.0.190715 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [172.19.36.156] Content-Type: multipart/alternative; boundary="_000_63A3AC36E5DB49F2AD427B6672538A2Fakamaicom_" MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-07-23_09:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 mlxscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1906280000 definitions=main-1907230223 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:5.22.84,1.0.8 definitions=2019-07-23_09:2019-07-23,2019-07-23 signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 lowpriorityscore=0 bulkscore=0 malwarescore=0 suspectscore=0 spamscore=0 mlxscore=0 impostorscore=0 mlxlogscore=999 clxscore=1015 phishscore=0 priorityscore=1501 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-1906280000 definitions=main-1907230224 Archived-At: Subject: [TLS] Draft minutes for Tuesday X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 Jul 2019 22:12:11 -0000 --_000_63A3AC36E5DB49F2AD427B6672538A2Fakamaicom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 QXJlIG9uIGV0aGVycGFkIGF0IGh0dHBzOi8vZXRoZXJwYWQuaWV0Zi5vcmcvcC9ub3Rlcy1pZXRm LTEwNS10bHMNCg0KQ3V0L3Bhc3RlZCBoZXJlIChidXQgbW9yZSByZWFkYWJsZSB0aGVyZSk6DQpU TFMgYXQgSUVURiAxMDUNCg0KVHVlc2RheQ0KDQpTdGF0dXMgdXBkYXRlIChkcmFmdHMsIGNvZGUg cG9pbnRzLCBldGMpIC0tIHNlZSB0aGUgc2xpZGVzDQoNCkNGUkcgd29ya2luZyBvbiBQQUtFIHNl bGVjdGlvbjsgIGludGVncmF0aW9uIHdpdGggVExTIGlzIG9idmlvdXNseSBpbXBvcnRhbnQsIGNv bWUgdG8gQ0ZSRyBtZWV0aW5nLg0KDQpEZWxlZ2F0ZWQgY3JlZGVudGlhbHMNCg0KICAqICAgU2Vy dmVyIHNpZGUgcGF0Y2ggaW4gYm9yaW5nU1NMOyBOU1MgY2xpZW50IHNpZGUgc29vbiB0byBiZSBp biBGRiBuaWdodGx5OyBGQiB3b3JrIGluIHByb2dyZXNzDQoNCiAgKiAgIFBsYW4gdG8gZHJvcCBM VVJLIG1lbnRpb24sIHJlbW92ZSBQS0NTIzEgdjEuNSAoUlNBIFBTUyBvbmx5KSBbTWFydGluIHNh eXMgbmVlZHMgbW9yZSB0ZXh0IGZvciBjbGFyaXR5XQ0KDQogICogICBQbGFuIHdhcyB0byBub3Qg Z28gZm9yd2FyZCB3aXRob3V0IHByb29mIHRoYXQgdGhpcyBkb2Vzbid0IHdlYWtlbiBQS0kgc2Vj dXJpdHk7IGEgYnktaGFuZCBvbmUgaXMgaW4gcHJvZ3Jlc3MNCg0KICAqICAgUmVmaW5lICJEZWxl Z2F0ZWQgY3JlZGVudGlhbHMiIHRlcm0gdG8gIkRlbGVnYXRlZCBhdXRoZW50aWNhdGlvbiBrZXlz Ig0KDQogICogICBQbGFuIGlzIHRvIHN0YXJ0IFdHTEMsIGJ1dCBtYWtlIHN1cmUgaXQgaXNuJ3Qg ZmluaXNoZWQgdW50aWwgdGhlIGFuYWx5c2lzIGlzIGRvbmUgYW5kIHJldmlld2VkIGJ5IHRoZSBX Rw0KDQogICoNCkRlcHJlY2F0ZSBNRDUgYW5kIFNIQTEgaW4gVExTIDEuMg0KDQogICogICBNYWtl IHNpZ25hdHVyZV9hbGdvcml0aG1zIG1hbmRhdG9yeSBpbiBoYW5kc2hha2U7IGZvcmJpZyBNRDUg YW5kIFNIQTEgYWxncyBpbiB0aGF0IGV4dGVuc2lvbg0KDQogICogICBBbmRyZWkgc2F5cyBNU0ZU IGNhbid0IGVuZm9yY2Ugbm93IGJ1dCB3aWxsaW5nIHRvIGRvIHNvIGluIHRoZSBmdXR1cmUNCg0K ICAqICAgQ29uc2Vuc3VzIGluIHJvb20gaXMgdG8gYWRvcHQgYXMgYSBXRyBpdGVtOyB0byBiZSBj b25maXJtZWQgb24gdGhlIGxpc3QNCg0KICAqDQpUTFMgRmxhZ3MgRXh0ZW5zaW9uDQoNCiAgKiAg IFRMUyAxLjIgaGFzIDQ2IGV4dGVuc2lvbnM7IFRMUyAxLjMgaGFzIDI4OyBtb3JlIGNvbWluZw0K DQogICogICBNYW55IGV4dGVuc2lvbnMgaGF2ZSBubyBkYXRhLCBqdXN0IDEgYml0IG9mIGRhdGEg KHRoZWlyIHByZXNlbmNlKSAtLSBjYWxsIHRoZW0gImZsYWcgZXh0ZW5zaW9ucyINCg0KICAqICAg VmFyaW91cyBtZXRob2RzIChmaXhlZC1zaXplIGJpdG1hc2ssIHZhcnlpbmctc2l6ZSBiaXRtYXNr LCBhcnJheSBvZiBieXRlcywgZXRjKQ0KDQogICogICBDYW4ndCByZS1kbyBleGlzdGluZyBleHRl bnNpb25zIChhdCBsZWFzdCBpbiBjbGllbnRIZWxsbyksIGJ1dCBzZXJ2ZXIgcmVzcG9uc2UgYW5k IG90aGVyIG1lc3NhZ2VzIGNvdWxkIGRvIHNvDQoNCiAgKiAgIENvbnNlbnN1cyBpbiByb29tIGlz IHRvIGFkb3B0IGFzIGEgV0cgaXRlbTsgdG8gYmUgY29uZmlybWVkIG9uIHRoZSBsaXN0DQoNCiAg Kg0KU3VwcHJlc3MgSW50ZXJtZWRpYXRlcw0KDQogICogICBBIG5ldyBmbGFnIGluIGNsaWVudEhl bGxvIHNheXMgImRvbid0IHNlbmQgaW50ZXJtZWRpYXRlcyINCg0KICAqICAgTm90IGNsZWFyIHdo YXQgdG8gZG8gaWYgaW50ZXJtZWRpYXRlIGVuZHMgdXAgbm90IGJlaW5nIGF2YWlsYWJsZTsgb3B0 aW9ucyBhcmUgdGhlbiB1Z2x5DQoNCiAgKiAgIFNlcnZlciB3b3VsZCBpZ25vcmUgZXh0ZW5zaW9u IGlmIGl0ICJrbm93cyIgaXRzIGNoYWluIGlzICJ1bnVzdWFsIiAoIndlaXJkIiBldGMpDQoNCiAg KiAgIFRoZXJlIGlzIGludGVyZXN0LCBidXQgbm90IHJlYWR5IHRvIGFzayBmb3IgYWRvcHRpb24g eWV0DQoNCiAgKg0KVExTIDEuMyBJbXBhY3Qgb24gTmV0d29yayBCYXNlZCBTZWN1cml0eSBTb2x1 dGlvbnMNCg0KICAqICAgTmV0d29yayBzb2x1dGlvbnMgc29tZXRpbWVzIGluc2VydCBhIG1pZGRs ZWJveCBwcm94eSBiZXR3ZWVuIHRoZSBjbGllbnQgYW5kIHRoZSBzZXJ2ZXIsIG9ic2VydmVycyBU TFMgbWV0YWRhdGEgdG8gZG8gcG9saWN5IGFuZCBhY2Nlc3MgY29udHJvbC4gVExTIDEuMyBoYW5k c2hha2UgY2hhbmdlcyBhZmZlY3QgdGhlc2Ugc29sdXRpb25zLg0KDQogICogICBJbmNvcnBvcmF0 ZWQgZmVlZGJhY2ssIGhhcyBiZWVuIHN0YWJsZSBzaW5jZSBJRVRGIDEwNC4gTmV3IGNvbW1lbnRh cnkgc3RhcnRlZCB0b2RheS4NCg0KICAqICAgT3JpZ2luYWwgcGxhbiB3YXMgdG8gYXNrIGZvciBw dWJsaWNhdGlvbiBhcyBpbmZvcm1hdGlvbmFsIGV2ZW4gdGhvdWdoIGl0J3Mgbm90IGluIGNoYXJ0 ZXIuDQoNCiAgKiAgIE1vcmUgcGVvcGxlIHJlYWQgdGhpcyBkcmFmdCB0aGFuIGFueSBvdGhlciBk cmFmdDsgaW50ZXJlc3RpbmcgYW5kIHN1cnByaXNpbmcgZmFjdG9pZC4NCg0KICAqICAgQWRqb3Vy biB3aXRob3V0IGFjdGlvbi4NCg0KICAqDQoNCg== --_000_63A3AC36E5DB49F2AD427B6672538A2Fakamaicom_ Content-Type: text/html; charset="utf-8" Content-ID: <1E101A0DEC9A8648A1E13551F2FB5BD1@akamai.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseTpXaW5nZGluZ3M7DQoJcGFub3NlLTE6NSAwIDAgMCAwIDAgMCAwIDAg MDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJDYW1icmlhIE1hdGgiOw0KCXBhbm9zZS0x OjIgNCA1IDMgNSA0IDYgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDYWxpYnJp Ow0KCXBhbm9zZS0xOjIgMTUgNSAyIDIgMiA0IDMgMiA0O30NCi8qIFN0eWxlIERlZmluaXRpb25z ICovDQpwLk1zb05vcm1hbCwgbGkuTXNvTm9ybWFsLCBkaXYuTXNvTm9ybWFsDQoJe21hcmdpbjow aW47DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMi4wcHQ7DQoJZm9udC1m YW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0KYTpsaW5rLCBzcGFuLk1zb0h5cGVybGluaw0K CXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6IzA1NjNDMTsNCgl0ZXh0LWRlY29yYXRp b246dW5kZXJsaW5lO30NCmE6dmlzaXRlZCwgc3Bhbi5Nc29IeXBlcmxpbmtGb2xsb3dlZA0KCXtt c28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6Izk1NEY3MjsNCgl0ZXh0LWRlY29yYXRpb246 dW5kZXJsaW5lO30NCnNwYW4uRW1haWxTdHlsZTE3DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFs LWNvbXBvc2U7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6d2lu ZG93dGV4dDt9DQpzcGFuLmF1dGhvci1hLWV6ODB6ejc2ejA0ejY2ejR6NzZ6dDh6ODd6ejg4eno3 NHo2ejY4eno2NXoNCgl7bXNvLXN0eWxlLW5hbWU6YXV0aG9yLWEtZXo4MHp6NzZ6MDR6NjZ6NHo3 Nnp0OHo4N3p6ODh6ejc0ejZ6Njh6ejY1ejt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5bGUt dHlwZTpleHBvcnQtb25seTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQpA cGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo4LjVpbiAxMS4waW47DQoJbWFyZ2luOjEuMGluIDEu MGluIDEuMGluIDEuMGluO30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7cGFnZTpXb3JkU2VjdGlvbjE7 fQ0KLyogTGlzdCBEZWZpbml0aW9ucyAqLw0KQGxpc3QgbDANCgl7bXNvLWxpc3QtaWQ6MTQ5NjI4 NDc7DQoJbXNvLWxpc3QtdGVtcGxhdGUtaWRzOjE1OTg4NDY3NTA7fQ0KQGxpc3QgbDA6bGV2ZWwx DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7 DQoJbXNvLWxldmVsLXRhYi1zdG9wOi41aW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjps ZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0K CWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMDpsZXZlbDINCgl7bXNvLWxldmVsLW51bWJl ci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Om87DQoJbXNvLWxldmVsLXRhYi1zdG9w OjEuMGluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDot LjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseToiQ291cmll ciBOZXciOw0KCW1zby1iaWRpLWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iO30NCkBsaXN0 IGwwOmxldmVsMw0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVs LXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDoxLjVpbjsNCgltc28tbGV2ZWwtbnVtYmVy LXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6 ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwwOmxldmVsNA0KCXtt c28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1z by1sZXZlbC10YWItc3RvcDoyLjBpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7 DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9u dC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwwOmxldmVsNQ0KCXttc28tbGV2ZWwtbnVtYmVy LWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3Rv cDoyLjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6 LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2Rp bmdzO30NCkBsaXN0IGwwOmxldmVsNg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7 DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDozLjBpbjsNCgltc28t bGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1h bnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGww OmxldmVsNw0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRl eHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDozLjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBv c2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZTox MC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwwOmxldmVsOA0KCXttc28t bGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1s ZXZlbC10YWItc3RvcDo0LjBpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJ dGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1m YW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwwOmxldmVsOQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZv cm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDo0 LjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4y NWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2Rpbmdz O30NCkBsaXN0IGwxDQoJe21zby1saXN0LWlkOjE5ODE5OTQ1Ow0KCW1zby1saXN0LXRlbXBsYXRl LWlkczoxODc0NTE1MDM0O30NCkBsaXN0IGwxOmxldmVsMQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZv cm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDou NWluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1 aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0K QGxpc3QgbDE6bGV2ZWwyDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28t bGV2ZWwtdGV4dDpvOw0KCW1zby1sZXZlbC10YWItc3RvcDoxLjBpbjsNCgltc28tbGV2ZWwtbnVt YmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQt c2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3IjsNCgltc28tYmlkaS1mb250 LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIjt9DQpAbGlzdCBsMTpsZXZlbDMNCgl7bXNvLWxldmVs LW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwt dGFiLXN0b3A6MS41aW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQt aW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5 OldpbmdkaW5nczt9DQpAbGlzdCBsMTpsZXZlbDQNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6 YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6Mi4waW47 DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsN Cgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpA bGlzdCBsMTpsZXZlbDUNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1s ZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6Mi41aW47DQoJbXNvLWxldmVsLW51 bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250 LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMTpsZXZlbDYN Cgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsN Cgltc28tbGV2ZWwtdGFiLXN0b3A6My4waW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjps ZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0K CWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMTpsZXZlbDcNCgl7bXNvLWxldmVsLW51 bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFi LXN0b3A6My41aW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5k ZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5Oldp bmdkaW5nczt9DQpAbGlzdCBsMTpsZXZlbDgNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVs bGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6NC4waW47DQoJ bXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglt c28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlz dCBsMTpsZXZlbDkNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZl bC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6NC41aW47DQoJbXNvLWxldmVsLW51bWJl ci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNp emU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMg0KCXttc28tbGlz dC1pZDoxNjk3NTQ1MDA7DQoJbXNvLWxpc3QtdGVtcGxhdGUtaWRzOi03NTAxMDUwNDY7fQ0KQGxp c3QgbDI6bGV2ZWwxDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2 ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOi41aW47DQoJbXNvLWxldmVsLW51bWJl ci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNp emU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMjpsZXZlbDINCgl7bXNv LWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Om87DQoJbXNvLWxl dmVsLXRhYi1zdG9wOjEuMGluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0 ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZh bWlseToiQ291cmllciBOZXciOw0KCW1zby1iaWRpLWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9t YW4iO30NCkBsaXN0IGwyOmxldmVsMw0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7 DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDoxLjVpbjsNCgltc28t bGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1h bnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwy OmxldmVsNA0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRl eHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDoyLjBpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBv c2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZTox MC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwyOmxldmVsNQ0KCXttc28t bGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1s ZXZlbC10YWItc3RvcDoyLjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJ dGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1m YW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwyOmxldmVsNg0KCXttc28tbGV2ZWwtbnVtYmVyLWZv cm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDoz LjBpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4y NWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2Rpbmdz O30NCkBsaXN0IGwyOmxldmVsNw0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJ bXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDozLjVpbjsNCgltc28tbGV2 ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNp LWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwyOmxl dmVsOA0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6 74KnOw0KCW1zby1sZXZlbC10YWItc3RvcDo0LjBpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0 aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4w cHQ7DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwyOmxldmVsOQ0KCXttc28tbGV2 ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZl bC10YWItc3RvcDo0LjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4 dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1p bHk6V2luZ2RpbmdzO30NCkBsaXN0IGwzDQoJe21zby1saXN0LWlkOjIxODE3MzEzODsNCgltc28t bGlzdC10ZW1wbGF0ZS1pZHM6LTE5Njk1NzY0NTI7fQ0KQGxpc3QgbDM6bGV2ZWwxDQoJe21zby1s ZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxl dmVsLXRhYi1zdG9wOi41aW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRl eHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFt aWx5OlN5bWJvbDt9DQpAbGlzdCBsMzpsZXZlbDINCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6 YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Om87DQoJbXNvLWxldmVsLXRhYi1zdG9wOjEuMGluOw0K CW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJ bXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseToiQ291cmllciBOZXciOw0K CW1zby1iaWRpLWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iO30NCkBsaXN0IGwzOmxldmVs Mw0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674Kn Ow0KCW1zby1sZXZlbC10YWItc3RvcDoxLjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9u OmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7 DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwzOmxldmVsNA0KCXttc28tbGV2ZWwt bnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10 YWItc3RvcDoyLjBpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1p bmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6 V2luZ2RpbmdzO30NCkBsaXN0IGwzOmxldmVsNQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpi dWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDoyLjVpbjsN Cgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0K CW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBs aXN0IGwzOmxldmVsNg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxl dmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDozLjBpbjsNCgltc28tbGV2ZWwtbnVt YmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQt c2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwzOmxldmVsNw0K CXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0K CW1zby1sZXZlbC10YWItc3RvcDozLjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxl ZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJ Zm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwzOmxldmVsOA0KCXttc28tbGV2ZWwtbnVt YmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWIt c3RvcDo0LjBpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRl bnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6V2lu Z2RpbmdzO30NCkBsaXN0IGwzOmxldmVsOQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxs ZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDo0LjVpbjsNCglt c28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1z by1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0 IGw0DQoJe21zby1saXN0LWlkOjMwMzg0ODgwNDsNCgltc28tbGlzdC10ZW1wbGF0ZS1pZHM6NTg5 ODgwNzQ7fQ0KQGxpc3QgbDQ6bGV2ZWwxDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxl dDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOi41aW47DQoJbXNv LWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28t YW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsNDps ZXZlbDINCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0 Om87DQoJbXNvLWxldmVsLXRhYi1zdG9wOjEuMGluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRp b246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBw dDsNCglmb250LWZhbWlseToiQ291cmllciBOZXciOw0KCW1zby1iaWRpLWZvbnQtZmFtaWx5OiJU aW1lcyBOZXcgUm9tYW4iO30NCkBsaXN0IGw0OmxldmVsMw0KCXttc28tbGV2ZWwtbnVtYmVyLWZv cm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDox LjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4y NWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2Rpbmdz O30NCkBsaXN0IGw0OmxldmVsNA0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJ bXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDoyLjBpbjsNCgltc28tbGV2 ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNp LWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGw0Omxl dmVsNQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6 74KnOw0KCW1zby1sZXZlbC10YWItc3RvcDoyLjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0 aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4w cHQ7DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGw0OmxldmVsNg0KCXttc28tbGV2 ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZl bC10YWItc3RvcDozLjBpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4 dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1p bHk6V2luZ2RpbmdzO30NCkBsaXN0IGw0OmxldmVsNw0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1h dDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDozLjVp bjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWlu Ow0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30N CkBsaXN0IGw0OmxldmVsOA0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNv LWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDo0LjBpbjsNCgltc28tbGV2ZWwt bnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZv bnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGw0OmxldmVs OQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674Kn Ow0KCW1zby1sZXZlbC10YWItc3RvcDo0LjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9u OmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7 DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGw1DQoJe21zby1saXN0LWlkOjM0MjMy MTM1MzsNCgltc28tbGlzdC10ZW1wbGF0ZS1pZHM6MTQ5NTE0OTEyODt9DQpAbGlzdCBsNTpsZXZl bDENCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+C tzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6LjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9u OmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7 DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGw1OmxldmVsMg0KCXttc28tbGV2ZWwtbnVt YmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6bzsNCgltc28tbGV2ZWwtdGFiLXN0 b3A6MS4waW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50 Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDb3Vy aWVyIE5ldyI7DQoJbXNvLWJpZGktZm9udC1mYW1pbHk6IlRpbWVzIE5ldyBSb21hbiI7fQ0KQGxp c3QgbDU6bGV2ZWwzDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2 ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjEuNWluOw0KCW1zby1sZXZlbC1udW1i ZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1z aXplOjEwLjBwdDsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDU6bGV2ZWw0DQoJ e21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJ bXNvLWxldmVsLXRhYi1zdG9wOjIuMGluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVm dDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglm b250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDU6bGV2ZWw1DQoJe21zby1sZXZlbC1udW1i ZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1z dG9wOjIuNWluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVu dDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpXaW5n ZGluZ3M7fQ0KQGxpc3QgbDU6bGV2ZWw2DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxl dDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjMuMGluOw0KCW1z by1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNv LWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3Qg bDU6bGV2ZWw3DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwt dGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjMuNWluOw0KCW1zby1sZXZlbC1udW1iZXIt cG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXpl OjEwLjBwdDsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDU6bGV2ZWw4DQoJe21z by1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNv LWxldmVsLXRhYi1zdG9wOjQuMGluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsN Cgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250 LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDU6bGV2ZWw5DQoJe21zby1sZXZlbC1udW1iZXIt Zm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9w OjQuNWluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDot LjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpXaW5nZGlu Z3M7fQ0KQGxpc3QgbDYNCgl7bXNvLWxpc3QtaWQ6Mzg1ODc2MDE0Ow0KCW1zby1saXN0LXRlbXBs YXRlLWlkczoxMDIyNzU1ODE0O30NCkBsaXN0IGw2OmxldmVsMQ0KCXttc28tbGV2ZWwtbnVtYmVy LWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3Rv cDouNWluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDot LjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpTeW1ib2w7 fQ0KQGxpc3QgbDY6bGV2ZWwyDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCglt c28tbGV2ZWwtdGV4dDpvOw0KCW1zby1sZXZlbC10YWItc3RvcDoxLjBpbjsNCgltc28tbGV2ZWwt bnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZv bnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3IjsNCgltc28tYmlkaS1m b250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIjt9DQpAbGlzdCBsNjpsZXZlbDMNCgl7bXNvLWxl dmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2 ZWwtdGFiLXN0b3A6MS41aW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRl eHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFt aWx5OldpbmdkaW5nczt9DQpAbGlzdCBsNjpsZXZlbDQNCgl7bXNvLWxldmVsLW51bWJlci1mb3Jt YXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6Mi4w aW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVp bjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9 DQpAbGlzdCBsNjpsZXZlbDUNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1z by1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6Mi41aW47DQoJbXNvLWxldmVs LW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1m b250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsNjpsZXZl bDYNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+C pzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6My4waW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlv bjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0 Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsNjpsZXZlbDcNCgl7bXNvLWxldmVs LW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwt dGFiLXN0b3A6My41aW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQt aW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5 OldpbmdkaW5nczt9DQpAbGlzdCBsNjpsZXZlbDgNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6 YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6NC4waW47 DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsN Cgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpA bGlzdCBsNjpsZXZlbDkNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1s ZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6NC41aW47DQoJbXNvLWxldmVsLW51 bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250 LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsNw0KCXttc28t bGlzdC1pZDo0MDY4Nzc2NzQ7DQoJbXNvLWxpc3QtdGVtcGxhdGUtaWRzOi0zNzYxNDI0Mjg7fQ0K QGxpc3QgbDc6bGV2ZWwxDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28t bGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOi41aW47DQoJbXNvLWxldmVsLW51 bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250 LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsNzpsZXZlbDINCgl7 bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Om87DQoJbXNv LWxldmVsLXRhYi1zdG9wOjEuMGluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsN Cgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250 LWZhbWlseToiQ291cmllciBOZXciOw0KCW1zby1iaWRpLWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcg Um9tYW4iO30NCkBsaXN0IGw3OmxldmVsMw0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxs ZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDoxLjVpbjsNCglt c28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1z by1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0 IGw3OmxldmVsNA0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVs LXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDoyLjBpbjsNCgltc28tbGV2ZWwtbnVtYmVy LXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6 ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGw3OmxldmVsNQ0KCXtt c28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1z by1sZXZlbC10YWItc3RvcDoyLjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7 DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9u dC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGw3OmxldmVsNg0KCXttc28tbGV2ZWwtbnVtYmVy LWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3Rv cDozLjBpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6 LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2Rp bmdzO30NCkBsaXN0IGw3OmxldmVsNw0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7 DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDozLjVpbjsNCgltc28t bGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1h bnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGw3 OmxldmVsOA0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRl eHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDo0LjBpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBv c2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZTox MC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGw3OmxldmVsOQ0KCXttc28t bGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1s ZXZlbC10YWItc3RvcDo0LjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJ dGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1m YW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGw4DQoJe21zby1saXN0LWlkOjQ0Njg1NDczMzsNCglt c28tbGlzdC10ZW1wbGF0ZS1pZHM6MTUxNjUwNzc4MDt9DQpAbGlzdCBsODpsZXZlbDENCgl7bXNv LWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28t bGV2ZWwtdGFiLXN0b3A6LjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJ dGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1m YW1pbHk6U3ltYm9sO30NCkBsaXN0IGw4OmxldmVsMg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1h dDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6bzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6MS4waW47 DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsN Cgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyI7 DQoJbXNvLWJpZGktZm9udC1mYW1pbHk6IlRpbWVzIE5ldyBSb21hbiI7fQ0KQGxpc3QgbDg6bGV2 ZWwzDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrv gqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjEuNWluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRp b246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBw dDsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDg6bGV2ZWw0DQoJe21zby1sZXZl bC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVs LXRhYi1zdG9wOjIuMGluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0 LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWls eTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDg6bGV2ZWw1DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0 OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjIuNWlu Ow0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47 DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0K QGxpc3QgbDg6bGV2ZWw2DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28t bGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjMuMGluOw0KCW1zby1sZXZlbC1u dW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9u dC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDg6bGV2ZWw3 DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7 DQoJbXNvLWxldmVsLXRhYi1zdG9wOjMuNWluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246 bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsN Cglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDg6bGV2ZWw4DQoJe21zby1sZXZlbC1u dW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRh Yi1zdG9wOjQuMGluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWlu ZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpX aW5nZGluZ3M7fQ0KQGxpc3QgbDg6bGV2ZWw5DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1 bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjQuNWluOw0K CW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJ bXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxp c3QgbDkNCgl7bXNvLWxpc3QtaWQ6NDcwNjM5NjI2Ow0KCW1zby1saXN0LXRlbXBsYXRlLWlkczo5 NjAyOTg1MzA7fQ0KQGxpc3QgbDk6bGV2ZWwxDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1 bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOi41aW47DQoJ bXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglt c28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBs OTpsZXZlbDINCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10 ZXh0Om87DQoJbXNvLWxldmVsLXRhYi1zdG9wOjEuMGluOw0KCW1zby1sZXZlbC1udW1iZXItcG9z aXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEw LjBwdDsNCglmb250LWZhbWlseToiQ291cmllciBOZXciOw0KCW1zby1iaWRpLWZvbnQtZmFtaWx5 OiJUaW1lcyBOZXcgUm9tYW4iO30NCkBsaXN0IGw5OmxldmVsMw0KCXttc28tbGV2ZWwtbnVtYmVy LWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3Rv cDoxLjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6 LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2Rp bmdzO30NCkBsaXN0IGw5OmxldmVsNA0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7 DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDoyLjBpbjsNCgltc28t bGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1h bnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGw5 OmxldmVsNQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRl eHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDoyLjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBv c2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZTox MC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGw5OmxldmVsNg0KCXttc28t bGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1s ZXZlbC10YWItc3RvcDozLjBpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJ dGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1m YW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGw5OmxldmVsNw0KCXttc28tbGV2ZWwtbnVtYmVyLWZv cm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDoz LjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4y NWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2Rpbmdz O30NCkBsaXN0IGw5OmxldmVsOA0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJ bXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDo0LjBpbjsNCgltc28tbGV2 ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNp LWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGw5Omxl dmVsOQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6 74KnOw0KCW1zby1sZXZlbC10YWItc3RvcDo0LjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0 aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4w cHQ7DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwxMA0KCXttc28tbGlzdC1pZDo0 NzMwNjYzMjI7DQoJbXNvLWxpc3QtdGVtcGxhdGUtaWRzOi02OTg0NjAyNjA7fQ0KQGxpc3QgbDEw OmxldmVsMQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRl eHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDouNWluOw0KCW1zby1sZXZlbC1udW1iZXItcG9z aXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEw LjBwdDsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDEwOmxldmVsMg0KCXttc28tbGV2 ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6bzsNCgltc28tbGV2ZWwt dGFiLXN0b3A6MS4waW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQt aW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5 OiJDb3VyaWVyIE5ldyI7DQoJbXNvLWJpZGktZm9udC1mYW1pbHk6IlRpbWVzIE5ldyBSb21hbiI7 fQ0KQGxpc3QgbDEwOmxldmVsMw0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJ bXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDoxLjVpbjsNCgltc28tbGV2 ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNp LWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwxMDps ZXZlbDQNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0 Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6Mi4waW47DQoJbXNvLWxldmVsLW51bWJlci1wb3Np dGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAu MHB0Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMTA6bGV2ZWw1DQoJe21zby1s ZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxl dmVsLXRhYi1zdG9wOjIuNWluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0 ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZh bWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDEwOmxldmVsNg0KCXttc28tbGV2ZWwtbnVtYmVyLWZv cm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDoz LjBpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4y NWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2Rpbmdz O30NCkBsaXN0IGwxMDpsZXZlbDcNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0K CW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6My41aW47DQoJbXNvLWxl dmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5z aS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMTA6 bGV2ZWw4DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4 dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjQuMGluOw0KCW1zby1sZXZlbC1udW1iZXItcG9z aXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEw LjBwdDsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDEwOmxldmVsOQ0KCXttc28t bGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1s ZXZlbC10YWItc3RvcDo0LjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJ dGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1m YW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwxMQ0KCXttc28tbGlzdC1pZDo1MzM2MTkxNjQ7DQoJ bXNvLWxpc3QtdGVtcGxhdGUtaWRzOjE5NDgxOTA5NDt9DQpAbGlzdCBsMTE6bGV2ZWwxDQoJe21z by1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNv LWxldmVsLXRhYi1zdG9wOi41aW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0K CXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQt ZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMTE6bGV2ZWwyDQoJe21zby1sZXZlbC1udW1iZXItZm9y bWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDpvOw0KCW1zby1sZXZlbC10YWItc3RvcDoxLjBp bjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWlu Ow0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3 IjsNCgltc28tYmlkaS1mb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIjt9DQpAbGlzdCBsMTE6 bGV2ZWwzDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4 dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjEuNWluOw0KCW1zby1sZXZlbC1udW1iZXItcG9z aXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEw LjBwdDsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDExOmxldmVsNA0KCXttc28t bGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1s ZXZlbC10YWItc3RvcDoyLjBpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJ dGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1m YW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwxMTpsZXZlbDUNCgl7bXNvLWxldmVsLW51bWJlci1m b3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6 Mi41aW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0u MjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5n czt9DQpAbGlzdCBsMTE6bGV2ZWw2DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsN Cgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjMuMGluOw0KCW1zby1s ZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFu c2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDEx OmxldmVsNw0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRl eHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDozLjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBv c2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZTox MC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwxMTpsZXZlbDgNCgl7bXNv LWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28t bGV2ZWwtdGFiLXN0b3A6NC4waW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0K CXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQt ZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMTE6bGV2ZWw5DQoJe21zby1sZXZlbC1udW1iZXIt Zm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9w OjQuNWluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDot LjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpXaW5nZGlu Z3M7fQ0KQGxpc3QgbDEyDQoJe21zby1saXN0LWlkOjU2MTg2NjM2MTsNCgltc28tbGlzdC10ZW1w bGF0ZS1pZHM6MzQ1MTU0OTkwO30NCkBsaXN0IGwxMjpsZXZlbDENCgl7bXNvLWxldmVsLW51bWJl ci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0 b3A6LjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6 LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9s O30NCkBsaXN0IGwxMjpsZXZlbDINCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0K CW1zby1sZXZlbC10ZXh0Om87DQoJbXNvLWxldmVsLXRhYi1zdG9wOjEuMGluOw0KCW1zby1sZXZl bC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2kt Zm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseToiQ291cmllciBOZXciOw0KCW1zby1iaWRp LWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iO30NCkBsaXN0IGwxMjpsZXZlbDMNCgl7bXNv LWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28t bGV2ZWwtdGFiLXN0b3A6MS41aW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0K CXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQt ZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMTI6bGV2ZWw0DQoJe21zby1sZXZlbC1udW1iZXIt Zm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9w OjIuMGluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDot LjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpXaW5nZGlu Z3M7fQ0KQGxpc3QgbDEyOmxldmVsNQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7 DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDoyLjVpbjsNCgltc28t bGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1h bnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwx MjpsZXZlbDYNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10 ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6My4waW47DQoJbXNvLWxldmVsLW51bWJlci1w b3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6 MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMTI6bGV2ZWw3DQoJe21z by1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNv LWxldmVsLXRhYi1zdG9wOjMuNWluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsN Cgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250 LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDEyOmxldmVsOA0KCXttc28tbGV2ZWwtbnVtYmVy LWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3Rv cDo0LjBpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6 LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2Rp bmdzO30NCkBsaXN0IGwxMjpsZXZlbDkNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0 Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6NC41aW47DQoJbXNv LWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28t YW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBs MTMNCgl7bXNvLWxpc3QtaWQ6NTg3MzUxNzMwOw0KCW1zby1saXN0LXRlbXBsYXRlLWlkczotNzM1 OTI5Nzg0O30NCkBsaXN0IGwxMzpsZXZlbDENCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVs bGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6LjVpbjsNCglt c28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1z by1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwx MzpsZXZlbDINCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10 ZXh0Om87DQoJbXNvLWxldmVsLXRhYi1zdG9wOjEuMGluOw0KCW1zby1sZXZlbC1udW1iZXItcG9z aXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEw LjBwdDsNCglmb250LWZhbWlseToiQ291cmllciBOZXciOw0KCW1zby1iaWRpLWZvbnQtZmFtaWx5 OiJUaW1lcyBOZXcgUm9tYW4iO30NCkBsaXN0IGwxMzpsZXZlbDMNCgl7bXNvLWxldmVsLW51bWJl ci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0 b3A6MS41aW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50 Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5Oldpbmdk aW5nczt9DQpAbGlzdCBsMTM6bGV2ZWw0DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxl dDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjIuMGluOw0KCW1z by1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNv LWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3Qg bDEzOmxldmVsNQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVs LXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDoyLjVpbjsNCgltc28tbGV2ZWwtbnVtYmVy LXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6 ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwxMzpsZXZlbDYNCgl7 bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCglt c28tbGV2ZWwtdGFiLXN0b3A6My4waW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0 Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZv bnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMTM6bGV2ZWw3DQoJe21zby1sZXZlbC1udW1i ZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1z dG9wOjMuNWluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVu dDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpXaW5n ZGluZ3M7fQ0KQGxpc3QgbDEzOmxldmVsOA0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxs ZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDo0LjBpbjsNCglt c28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1z by1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0 IGwxMzpsZXZlbDkNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZl bC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6NC41aW47DQoJbXNvLWxldmVsLW51bWJl ci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNp emU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMTQNCgl7bXNvLWxp c3QtaWQ6NjU0Nzk3MzUyOw0KCW1zby1saXN0LXRlbXBsYXRlLWlkczotMjA5NjMwNzU4Njt9DQpA bGlzdCBsMTQ6bGV2ZWwxDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28t bGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOi41aW47DQoJbXNvLWxldmVsLW51 bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250 LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMTQ6bGV2ZWwyDQoJ e21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDpvOw0KCW1z by1sZXZlbC10YWItc3RvcDoxLjBpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7 DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9u dC1mYW1pbHk6IkNvdXJpZXIgTmV3IjsNCgltc28tYmlkaS1mb250LWZhbWlseToiVGltZXMgTmV3 IFJvbWFuIjt9DQpAbGlzdCBsMTQ6bGV2ZWwzDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1 bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjEuNWluOw0K CW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJ bXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxp c3QgbDE0OmxldmVsNA0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxl dmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDoyLjBpbjsNCgltc28tbGV2ZWwtbnVt YmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQt c2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwxNDpsZXZlbDUN Cgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsN Cgltc28tbGV2ZWwtdGFiLXN0b3A6Mi41aW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjps ZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0K CWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMTQ6bGV2ZWw2DQoJe21zby1sZXZlbC1u dW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRh Yi1zdG9wOjMuMGluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWlu ZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpX aW5nZGluZ3M7fQ0KQGxpc3QgbDE0OmxldmVsNw0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpi dWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDozLjVpbjsN Cgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0K CW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBs aXN0IGwxNDpsZXZlbDgNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1s ZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6NC4waW47DQoJbXNvLWxldmVsLW51 bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250 LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMTQ6bGV2ZWw5 DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7 DQoJbXNvLWxldmVsLXRhYi1zdG9wOjQuNWluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246 bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsN Cglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDE1DQoJe21zby1saXN0LWlkOjY2Mzgy MDIzODsNCgltc28tbGlzdC10ZW1wbGF0ZS1pZHM6LTUwMzQyMzc1NDt9DQpAbGlzdCBsMTU6bGV2 ZWwxDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrv grc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOi41aW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlv bjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0 Ow0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMTU6bGV2ZWwyDQoJe21zby1sZXZlbC1u dW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDpvOw0KCW1zby1sZXZlbC10YWIt c3RvcDoxLjBpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRl bnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6IkNv dXJpZXIgTmV3IjsNCgltc28tYmlkaS1mb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIjt9DQpA bGlzdCBsMTU6bGV2ZWwzDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28t bGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjEuNWluOw0KCW1zby1sZXZlbC1u dW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9u dC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDE1OmxldmVs NA0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674Kn Ow0KCW1zby1sZXZlbC10YWItc3RvcDoyLjBpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9u OmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7 DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwxNTpsZXZlbDUNCgl7bXNvLWxldmVs LW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwt dGFiLXN0b3A6Mi41aW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQt aW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5 OldpbmdkaW5nczt9DQpAbGlzdCBsMTU6bGV2ZWw2DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0 OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjMuMGlu Ow0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47 DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0K QGxpc3QgbDE1OmxldmVsNw0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNv LWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDozLjVpbjsNCgltc28tbGV2ZWwt bnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZv bnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwxNTpsZXZl bDgNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+C pzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6NC4waW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlv bjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0 Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMTU6bGV2ZWw5DQoJe21zby1sZXZl bC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVs LXRhYi1zdG9wOjQuNWluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0 LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWls eTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDE2DQoJe21zby1saXN0LWlkOjkzMTM1NjkwNzsNCgltc28t bGlzdC10ZW1wbGF0ZS1pZHM6LTEwOTA5ODUzOTQ7fQ0KQGxpc3QgbDE2OmxldmVsMQ0KCXttc28t bGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1s ZXZlbC10YWItc3RvcDouNWluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0 ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZh bWlseTpTeW1ib2w7fQ0KQGxpc3QgbDE2OmxldmVsMg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1h dDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6bzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6MS4waW47 DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsN Cgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyI7 DQoJbXNvLWJpZGktZm9udC1mYW1pbHk6IlRpbWVzIE5ldyBSb21hbiI7fQ0KQGxpc3QgbDE2Omxl dmVsMw0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6 74KnOw0KCW1zby1sZXZlbC10YWItc3RvcDoxLjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0 aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4w cHQ7DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwxNjpsZXZlbDQNCgl7bXNvLWxl dmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2 ZWwtdGFiLXN0b3A6Mi4waW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRl eHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFt aWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMTY6bGV2ZWw1DQoJe21zby1sZXZlbC1udW1iZXItZm9y bWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjIu NWluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1 aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7 fQ0KQGxpc3QgbDE2OmxldmVsNg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJ bXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDozLjBpbjsNCgltc28tbGV2 ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNp LWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwxNjps ZXZlbDcNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0 Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6My41aW47DQoJbXNvLWxldmVsLW51bWJlci1wb3Np dGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAu MHB0Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMTY6bGV2ZWw4DQoJe21zby1s ZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxl dmVsLXRhYi1zdG9wOjQuMGluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0 ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZh bWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDE2OmxldmVsOQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZv cm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDo0 LjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4y NWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2Rpbmdz O30NCkBsaXN0IGwxNw0KCXttc28tbGlzdC1pZDo5NDAyNjI0NDc7DQoJbXNvLWxpc3QtdGVtcGxh dGUtaWRzOi0xOTYwNzQ0MjA7fQ0KQGxpc3QgbDE3OmxldmVsMQ0KCXttc28tbGV2ZWwtbnVtYmVy LWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3Rv cDouNWluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDot LjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpTeW1ib2w7 fQ0KQGxpc3QgbDE3OmxldmVsMg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJ bXNvLWxldmVsLXRleHQ6bzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6MS4waW47DQoJbXNvLWxldmVs LW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1m b250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyI7DQoJbXNvLWJpZGkt Zm9udC1mYW1pbHk6IlRpbWVzIE5ldyBSb21hbiI7fQ0KQGxpc3QgbDE3OmxldmVsMw0KCXttc28t bGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1s ZXZlbC10YWItc3RvcDoxLjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJ dGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1m YW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwxNzpsZXZlbDQNCgl7bXNvLWxldmVsLW51bWJlci1m b3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6 Mi4waW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0u MjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5n czt9DQpAbGlzdCBsMTc6bGV2ZWw1DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsN Cgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjIuNWluOw0KCW1zby1s ZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFu c2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDE3 OmxldmVsNg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRl eHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDozLjBpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBv c2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZTox MC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwxNzpsZXZlbDcNCgl7bXNv LWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28t bGV2ZWwtdGFiLXN0b3A6My41aW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0K CXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQt ZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMTc6bGV2ZWw4DQoJe21zby1sZXZlbC1udW1iZXIt Zm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9w OjQuMGluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDot LjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpXaW5nZGlu Z3M7fQ0KQGxpc3QgbDE3OmxldmVsOQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7 DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDo0LjVpbjsNCgltc28t bGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1h bnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwx OA0KCXttc28tbGlzdC1pZDoxMDk0NjYzODEwOw0KCW1zby1saXN0LXRlbXBsYXRlLWlkczotMTc3 MDEyNDAxODt9DQpAbGlzdCBsMTg6bGV2ZWwxDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1 bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOi41aW47DQoJ bXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglt c28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBs MTg6bGV2ZWwyDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwt dGV4dDpvOw0KCW1zby1sZXZlbC10YWItc3RvcDoxLjBpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBv c2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZTox MC4wcHQ7DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3IjsNCgltc28tYmlkaS1mb250LWZhbWls eToiVGltZXMgTmV3IFJvbWFuIjt9DQpAbGlzdCBsMTg6bGV2ZWwzDQoJe21zby1sZXZlbC1udW1i ZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1z dG9wOjEuNWluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVu dDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpXaW5n ZGluZ3M7fQ0KQGxpc3QgbDE4OmxldmVsNA0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxs ZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDoyLjBpbjsNCglt c28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1z by1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0 IGwxODpsZXZlbDUNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZl bC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6Mi41aW47DQoJbXNvLWxldmVsLW51bWJl ci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNp emU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMTg6bGV2ZWw2DQoJ e21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJ bXNvLWxldmVsLXRhYi1zdG9wOjMuMGluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVm dDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglm b250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDE4OmxldmVsNw0KCXttc28tbGV2ZWwtbnVt YmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWIt c3RvcDozLjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRl bnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6V2lu Z2RpbmdzO30NCkBsaXN0IGwxODpsZXZlbDgNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVs bGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6NC4waW47DQoJ bXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglt c28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlz dCBsMTg6bGV2ZWw5DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2 ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjQuNWluOw0KCW1zby1sZXZlbC1udW1i ZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1z aXplOjEwLjBwdDsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDE5DQoJe21zby1s aXN0LWlkOjE3MzE3MzMwOTI7DQoJbXNvLWxpc3QtdGVtcGxhdGUtaWRzOjYzNzg1MTM3Mjt9DQpA bGlzdCBsMTk6bGV2ZWwxDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28t bGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOi41aW47DQoJbXNvLWxldmVsLW51 bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250 LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMTk6bGV2ZWwyDQoJ e21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDpvOw0KCW1z by1sZXZlbC10YWItc3RvcDoxLjBpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7 DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9u dC1mYW1pbHk6IkNvdXJpZXIgTmV3IjsNCgltc28tYmlkaS1mb250LWZhbWlseToiVGltZXMgTmV3 IFJvbWFuIjt9DQpAbGlzdCBsMTk6bGV2ZWwzDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1 bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjEuNWluOw0K CW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJ bXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxp c3QgbDE5OmxldmVsNA0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxl dmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDoyLjBpbjsNCgltc28tbGV2ZWwtbnVt YmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQt c2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwxOTpsZXZlbDUN Cgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsN Cgltc28tbGV2ZWwtdGFiLXN0b3A6Mi41aW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjps ZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0K CWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMTk6bGV2ZWw2DQoJe21zby1sZXZlbC1u dW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRh Yi1zdG9wOjMuMGluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWlu ZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpX aW5nZGluZ3M7fQ0KQGxpc3QgbDE5OmxldmVsNw0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpi dWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDozLjVpbjsN Cgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0K CW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBs aXN0IGwxOTpsZXZlbDgNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1s ZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6NC4waW47DQoJbXNvLWxldmVsLW51 bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250 LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMTk6bGV2ZWw5 DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7 DQoJbXNvLWxldmVsLXRhYi1zdG9wOjQuNWluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246 bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsN Cglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDIwDQoJe21zby1saXN0LWlkOjE3ODky NzgyNTA7DQoJbXNvLWxpc3QtdGVtcGxhdGUtaWRzOi03MDYxNjgwOTg7fQ0KQGxpc3QgbDIwOmxl dmVsMQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6 74K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDouNWluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRp b246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBw dDsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDIwOmxldmVsMg0KCXttc28tbGV2ZWwt bnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6bzsNCgltc28tbGV2ZWwtdGFi LXN0b3A6MS4waW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5k ZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OiJD b3VyaWVyIE5ldyI7DQoJbXNvLWJpZGktZm9udC1mYW1pbHk6IlRpbWVzIE5ldyBSb21hbiI7fQ0K QGxpc3QgbDIwOmxldmVsMw0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNv LWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDoxLjVpbjsNCgltc28tbGV2ZWwt bnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZv bnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwyMDpsZXZl bDQNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+C pzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6Mi4waW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlv bjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0 Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMjA6bGV2ZWw1DQoJe21zby1sZXZl bC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVs LXRhYi1zdG9wOjIuNWluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0 LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWls eTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDIwOmxldmVsNg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1h dDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDozLjBp bjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWlu Ow0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30N CkBsaXN0IGwyMDpsZXZlbDcNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1z by1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6My41aW47DQoJbXNvLWxldmVs LW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1m b250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMjA6bGV2 ZWw4DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrv gqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjQuMGluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRp b246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBw dDsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDIwOmxldmVsOQ0KCXttc28tbGV2 ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZl bC10YWItc3RvcDo0LjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4 dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1p bHk6V2luZ2RpbmdzO30NCkBsaXN0IGwyMQ0KCXttc28tbGlzdC1pZDoxODAwMTA3MTA3Ow0KCW1z by1saXN0LXRlbXBsYXRlLWlkczoyMTI5MTM5MTQyO30NCkBsaXN0IGwyMTpsZXZlbDENCgl7bXNv LWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28t bGV2ZWwtdGFiLXN0b3A6LjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJ dGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1m YW1pbHk6U3ltYm9sO30NCkBsaXN0IGwyMTpsZXZlbDINCgl7bXNvLWxldmVsLW51bWJlci1mb3Jt YXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Om87DQoJbXNvLWxldmVsLXRhYi1zdG9wOjEuMGlu Ow0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47 DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseToiQ291cmllciBOZXci Ow0KCW1zby1iaWRpLWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iO30NCkBsaXN0IGwyMTps ZXZlbDMNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0 Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6MS41aW47DQoJbXNvLWxldmVsLW51bWJlci1wb3Np dGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAu MHB0Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMjE6bGV2ZWw0DQoJe21zby1s ZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxl dmVsLXRhYi1zdG9wOjIuMGluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0 ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZh bWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDIxOmxldmVsNQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZv cm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDoy LjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4y NWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2Rpbmdz O30NCkBsaXN0IGwyMTpsZXZlbDYNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0K CW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6My4waW47DQoJbXNvLWxl dmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5z aS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMjE6 bGV2ZWw3DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4 dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjMuNWluOw0KCW1zby1sZXZlbC1udW1iZXItcG9z aXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEw LjBwdDsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDIxOmxldmVsOA0KCXttc28t bGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1s ZXZlbC10YWItc3RvcDo0LjBpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJ dGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1m YW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwyMTpsZXZlbDkNCgl7bXNvLWxldmVsLW51bWJlci1m b3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6 NC41aW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0u MjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5n czt9DQpAbGlzdCBsMjINCgl7bXNvLWxpc3QtaWQ6MTg0MzYyNDI4NjsNCgltc28tbGlzdC10ZW1w bGF0ZS1pZHM6LTg5OTM1OTgwNDt9DQpAbGlzdCBsMjI6bGV2ZWwxDQoJe21zby1sZXZlbC1udW1i ZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1z dG9wOi41aW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50 Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OlN5bWJv bDt9DQpAbGlzdCBsMjI6bGV2ZWwyDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsN Cgltc28tbGV2ZWwtdGV4dDpvOw0KCW1zby1sZXZlbC10YWItc3RvcDoxLjBpbjsNCgltc28tbGV2 ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNp LWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3IjsNCgltc28tYmlk aS1mb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIjt9DQpAbGlzdCBsMjI6bGV2ZWwzDQoJe21z by1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNv LWxldmVsLXRhYi1zdG9wOjEuNWluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsN Cgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250 LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDIyOmxldmVsNA0KCXttc28tbGV2ZWwtbnVtYmVy LWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3Rv cDoyLjBpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6 LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2Rp bmdzO30NCkBsaXN0IGwyMjpsZXZlbDUNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0 Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6Mi41aW47DQoJbXNv LWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28t YW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBs MjI6bGV2ZWw2DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwt dGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjMuMGluOw0KCW1zby1sZXZlbC1udW1iZXIt cG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXpl OjEwLjBwdDsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDIyOmxldmVsNw0KCXtt c28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1z by1sZXZlbC10YWItc3RvcDozLjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7 DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9u dC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwyMjpsZXZlbDgNCgl7bXNvLWxldmVsLW51bWJl ci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0 b3A6NC4waW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50 Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5Oldpbmdk aW5nczt9DQpAbGlzdCBsMjI6bGV2ZWw5DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxl dDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjQuNWluOw0KCW1z by1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNv LWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3Qg bDIzDQoJe21zby1saXN0LWlkOjE4OTY4MTY5NTI7DQoJbXNvLWxpc3QtdGVtcGxhdGUtaWRzOjEx MTUwNDExNTQ7fQ0KQGxpc3QgbDIzOmxldmVsMQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpi dWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDouNWluOw0K CW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJ bXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3Qg bDIzOmxldmVsMg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVs LXRleHQ6bzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6MS4waW47DQoJbXNvLWxldmVsLW51bWJlci1w b3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6 MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyI7DQoJbXNvLWJpZGktZm9udC1mYW1p bHk6IlRpbWVzIE5ldyBSb21hbiI7fQ0KQGxpc3QgbDIzOmxldmVsMw0KCXttc28tbGV2ZWwtbnVt YmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWIt c3RvcDoxLjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRl bnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6V2lu Z2RpbmdzO30NCkBsaXN0IGwyMzpsZXZlbDQNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVs bGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6Mi4waW47DQoJ bXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglt c28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlz dCBsMjM6bGV2ZWw1DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2 ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjIuNWluOw0KCW1zby1sZXZlbC1udW1i ZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1z aXplOjEwLjBwdDsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDIzOmxldmVsNg0K CXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0K CW1zby1sZXZlbC10YWItc3RvcDozLjBpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxl ZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJ Zm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwyMzpsZXZlbDcNCgl7bXNvLWxldmVsLW51 bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFi LXN0b3A6My41aW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5k ZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5Oldp bmdkaW5nczt9DQpAbGlzdCBsMjM6bGV2ZWw4DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1 bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjQuMGluOw0K CW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJ bXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxp c3QgbDIzOmxldmVsOQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxl dmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDo0LjVpbjsNCgltc28tbGV2ZWwtbnVt YmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQt c2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwyNA0KCXttc28t bGlzdC1pZDoxOTUzNTEyODgxOw0KCW1zby1saXN0LXRlbXBsYXRlLWlkczotMTEzOTQ4OTA3Mjt9 DQpAbGlzdCBsMjQ6bGV2ZWwxDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCglt c28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOi41aW47DQoJbXNvLWxldmVs LW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1m b250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMjQ6bGV2ZWwy DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDpvOw0K CW1zby1sZXZlbC10YWItc3RvcDoxLjBpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxl ZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJ Zm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3IjsNCgltc28tYmlkaS1mb250LWZhbWlseToiVGltZXMg TmV3IFJvbWFuIjt9DQpAbGlzdCBsMjQ6bGV2ZWwzDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0 OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjEuNWlu Ow0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47 DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0K QGxpc3QgbDI0OmxldmVsNA0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNv LWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDoyLjBpbjsNCgltc28tbGV2ZWwt bnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZv bnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwyNDpsZXZl bDUNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+C pzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6Mi41aW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlv bjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0 Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMjQ6bGV2ZWw2DQoJe21zby1sZXZl bC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVs LXRhYi1zdG9wOjMuMGluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0 LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWls eTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDI0OmxldmVsNw0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1h dDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDozLjVp bjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWlu Ow0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30N CkBsaXN0IGwyNDpsZXZlbDgNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1z by1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6NC4waW47DQoJbXNvLWxldmVs LW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1m b250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMjQ6bGV2 ZWw5DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrv gqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjQuNWluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRp b246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBw dDsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDI1DQoJe21zby1saXN0LWlkOjE5 Njg5NzQ1NTQ7DQoJbXNvLWxpc3QtdGVtcGxhdGUtaWRzOjc2MDM0OTY5NDt9DQpAbGlzdCBsMjU6 bGV2ZWwxDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4 dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOi41aW47DQoJbXNvLWxldmVsLW51bWJlci1wb3Np dGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAu MHB0Ow0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMjU6bGV2ZWwyDQoJe21zby1sZXZl bC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDpvOw0KCW1zby1sZXZlbC10 YWItc3RvcDoxLjBpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1p bmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6 IkNvdXJpZXIgTmV3IjsNCgltc28tYmlkaS1mb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIjt9 DQpAbGlzdCBsMjU6bGV2ZWwzDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCglt c28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjEuNWluOw0KCW1zby1sZXZl bC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2kt Zm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDI1Omxl dmVsNA0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6 74KnOw0KCW1zby1sZXZlbC10YWItc3RvcDoyLjBpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0 aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4w cHQ7DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwyNTpsZXZlbDUNCgl7bXNvLWxl dmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2 ZWwtdGFiLXN0b3A6Mi41aW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRl eHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFt aWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMjU6bGV2ZWw2DQoJe21zby1sZXZlbC1udW1iZXItZm9y bWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjMu MGluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1 aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7 fQ0KQGxpc3QgbDI1OmxldmVsNw0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJ bXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDozLjVpbjsNCgltc28tbGV2 ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNp LWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwyNTps ZXZlbDgNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0 Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6NC4waW47DQoJbXNvLWxldmVsLW51bWJlci1wb3Np dGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAu MHB0Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMjU6bGV2ZWw5DQoJe21zby1s ZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxl dmVsLXRhYi1zdG9wOjQuNWluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0 ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZh bWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDI2DQoJe21zby1saXN0LWlkOjIxMTA3MzAyMDk7DQoJ bXNvLWxpc3QtdGVtcGxhdGUtaWRzOjMxMDI5MTgxMjt9DQpAbGlzdCBsMjY6bGV2ZWwxDQoJe21z by1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNv LWxldmVsLXRhYi1zdG9wOi41aW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0K CXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQt ZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMjY6bGV2ZWwyDQoJe21zby1sZXZlbC1udW1iZXItZm9y bWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDpvOw0KCW1zby1sZXZlbC10YWItc3RvcDoxLjBp bjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWlu Ow0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3 IjsNCgltc28tYmlkaS1mb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIjt9DQpAbGlzdCBsMjY6 bGV2ZWwzDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4 dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjEuNWluOw0KCW1zby1sZXZlbC1udW1iZXItcG9z aXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEw LjBwdDsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDI2OmxldmVsNA0KCXttc28t bGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1s ZXZlbC10YWItc3RvcDoyLjBpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJ dGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1m YW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwyNjpsZXZlbDUNCgl7bXNvLWxldmVsLW51bWJlci1m b3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6 Mi41aW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0u MjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5n czt9DQpAbGlzdCBsMjY6bGV2ZWw2DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsN Cgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjMuMGluOw0KCW1zby1s ZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFu c2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDI2 OmxldmVsNw0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRl eHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDozLjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBv c2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZTox MC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwyNjpsZXZlbDgNCgl7bXNv LWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28t bGV2ZWwtdGFiLXN0b3A6NC4waW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0K CXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQt ZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMjY6bGV2ZWw5DQoJe21zby1sZXZlbC1udW1iZXIt Zm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9w OjQuNWluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDot LjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpXaW5nZGlu Z3M7fQ0KQGxpc3QgbDI3DQoJe21zby1saXN0LWlkOjIxMzM3Mzk4OTA7DQoJbXNvLWxpc3QtdGVt cGxhdGUtaWRzOi02MDM5NDU3NTQ7fQ0KQGxpc3QgbDI3OmxldmVsMQ0KCXttc28tbGV2ZWwtbnVt YmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWIt c3RvcDouNWluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVu dDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpTeW1i b2w7fQ0KQGxpc3QgbDI3OmxldmVsMg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7 DQoJbXNvLWxldmVsLXRleHQ6bzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6MS4waW47DQoJbXNvLWxl dmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5z aS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyI7DQoJbXNvLWJp ZGktZm9udC1mYW1pbHk6IlRpbWVzIE5ldyBSb21hbiI7fQ0KQGxpc3QgbDI3OmxldmVsMw0KCXtt c28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1z by1sZXZlbC10YWItc3RvcDoxLjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7 DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9u dC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwyNzpsZXZlbDQNCgl7bXNvLWxldmVsLW51bWJl ci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0 b3A6Mi4waW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50 Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5Oldpbmdk aW5nczt9DQpAbGlzdCBsMjc6bGV2ZWw1DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxl dDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjIuNWluOw0KCW1z by1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNv LWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3Qg bDI3OmxldmVsNg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVs LXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDozLjBpbjsNCgltc28tbGV2ZWwtbnVtYmVy LXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6 ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwyNzpsZXZlbDcNCgl7 bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCglt c28tbGV2ZWwtdGFiLXN0b3A6My41aW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0 Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZv bnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMjc6bGV2ZWw4DQoJe21zby1sZXZlbC1udW1i ZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1z dG9wOjQuMGluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVu dDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpXaW5n ZGluZ3M7fQ0KQGxpc3QgbDI3OmxldmVsOQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxs ZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDo0LjVpbjsNCglt c28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1z by1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCm9sDQoJ e21hcmdpbi1ib3R0b206MGluO30NCnVsDQoJe21hcmdpbi1ib3R0b206MGluO30NCi0tPjwvc3R5 bGU+DQo8L2hlYWQ+DQo8Ym9keSBsYW5nPSJFTi1VUyIgbGluaz0iIzA1NjNDMSIgdmxpbms9IiM5 NTRGNzIiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij5BcmUgb24gZXRoZXJwYWQgYXQgPGEgaHJl Zj0iaHR0cHM6Ly9ldGhlcnBhZC5pZXRmLm9yZy9wL25vdGVzLWlldGYtMTA1LXRscyI+DQpodHRw czovL2V0aGVycGFkLmlldGYub3JnL3Avbm90ZXMtaWV0Zi0xMDUtdGxzPC9hPjxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+Q3V0L3Bhc3RlZCBoZXJlIChidXQgbW9y ZSByZWFkYWJsZSB0aGVyZSk6PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPlRMUyBhdCBJRVRGIDEwNTxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+VHVlc2RheTxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+U3RhdHVzIHVwZGF0ZSAoZHJhZnRzLCBj b2RlIHBvaW50cywgZXRjKSAtLSBzZWUgdGhlIHNsaWRlczxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij48bzpw PiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdCI+Q0ZSRyB3b3JraW5nIG9uIFBBS0Ugc2VsZWN0aW9uOyZuYnNw OyBpbnRlZ3JhdGlvbiB3aXRoIFRMUyBpcyBvYnZpb3VzbHkgaW1wb3J0YW50LCBjb21lIHRvIENG UkcgbWVldGluZy48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPkRl bGVnYXRlZCBjcmVkZW50aWFsczxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjx1bCB0eXBlPSJkaXNj Ij4NCjxsaSBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87 bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bXNvLWxpc3Q6bDkgbGV2ZWwxIGxmbzEiPg0KPHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPlNlcnZlciBzaWRlIHBhdGNoIGluIGJvcmluZ1NT TDsgTlNTIGNsaWVudCBzaWRlIHNvb24gdG8gYmUgaW4gRkYgbmlnaHRseTsgRkIgd29yayBpbiBw cm9ncmVzczxvOnA+PC9vOnA+PC9zcGFuPjwvbGk+PC91bD4NCjx1bCB0eXBlPSJkaXNjIj4NCjxs aSBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1h cmdpbi1ib3R0b20tYWx0OmF1dG87bXNvLWxpc3Q6bDIxIGxldmVsMSBsZm8yIj4NCjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0Ij5QbGFuIHRvIGRyb3AgTFVSSyBtZW50aW9uLCByZW1vdmUg UEtDUyMxIHYxLjUgKFJTQSBQU1Mgb25seSkgW01hcnRpbiBzYXlzIG5lZWRzIG1vcmUgdGV4dCBm b3IgY2xhcml0eV08bzpwPjwvbzpwPjwvc3Bhbj48L2xpPjwvdWw+DQo8dWwgdHlwZT0iZGlzYyI+ DQo8bGkgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21z by1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21zby1saXN0OmwxMSBsZXZlbDEgbGZvMyI+DQo8c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+UGxhbiB3YXMgdG8gbm90IGdvIGZvcndhcmQgd2l0 aG91dCBwcm9vZiB0aGF0IHRoaXMgZG9lc24ndCB3ZWFrZW4gUEtJIHNlY3VyaXR5OyBhIGJ5LWhh bmQgb25lIGlzIGluIHByb2dyZXNzPG86cD48L286cD48L3NwYW4+PC9saT48L3VsPg0KPHVsIHR5 cGU9ImRpc2MiPg0KPGxpIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1h bHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttc28tbGlzdDpsMTcgbGV2ZWwxIGxm bzQiPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPlJlZmluZSAmcXVvdDtEZWxlZ2F0 ZWQgY3JlZGVudGlhbHMmcXVvdDsgdGVybSB0byAmcXVvdDtEZWxlZ2F0ZWQgYXV0aGVudGljYXRp b24ga2V5cyZxdW90OzxvOnA+PC9vOnA+PC9zcGFuPjwvbGk+PC91bD4NCjx1bCB0eXBlPSJkaXNj Ij4NCjxsaSBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87 bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bXNvLWxpc3Q6bDEzIGxldmVsMSBsZm81Ij4NCjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij5QbGFuIGlzIHRvIHN0YXJ0IFdHTEMsIGJ1dCBt YWtlIHN1cmUgaXQgaXNuJ3QgZmluaXNoZWQgdW50aWwgdGhlIGFuYWx5c2lzIGlzIGRvbmUgYW5k IHJldmlld2VkIGJ5IHRoZSBXRzxvOnA+PC9vOnA+PC9zcGFuPjwvbGk+PC91bD4NCjx1bCB0eXBl PSJkaXNjIj4NCjxsaSBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0 OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bXNvLWxpc3Q6bDYgbGV2ZWwxIGxmbzYi Pg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFu PjwvbGk+PC91bD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0Ij5EZXByZWNhdGUgTUQ1IGFuZCBTSEExIGluIFRMUyAxLjI8bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8dWwgdHlwZT0iZGlzYyI+DQo8bGkgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1z by1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21zby1saXN0 OmwyMyBsZXZlbDEgbGZvNyI+DQo8c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+TWFrZSBz aWduYXR1cmVfYWxnb3JpdGhtcyBtYW5kYXRvcnkgaW4gaGFuZHNoYWtlOyBmb3JiaWcgTUQ1IGFu ZCBTSEExIGFsZ3MgaW4gdGhhdCBleHRlbnNpb248bzpwPjwvbzpwPjwvc3Bhbj48L2xpPjwvdWw+ DQo8dWwgdHlwZT0iZGlzYyI+DQo8bGkgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJn aW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21zby1saXN0OmwxIGxl dmVsMSBsZm84Ij4NCjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij5BbmRyZWkgc2F5cyBN U0ZUIGNhbid0IGVuZm9yY2Ugbm93IGJ1dCB3aWxsaW5nIHRvIGRvIHNvIGluIHRoZSBmdXR1cmU8 bzpwPjwvbzpwPjwvc3Bhbj48L2xpPjwvdWw+DQo8dWwgdHlwZT0iZGlzYyI+DQo8bGkgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90 dG9tLWFsdDphdXRvO21zby1saXN0OmwyMCBsZXZlbDEgbGZvOSI+DQo8c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdCI+Q29uc2Vuc3VzIGluIHJvb20gaXMgdG8gYWRvcHQgYXMgYSBXRyBpdGVt OyB0byBiZSBjb25maXJtZWQgb24gdGhlIGxpc3Q8bzpwPjwvbzpwPjwvc3Bhbj48L2xpPjwvdWw+ DQo8dWwgdHlwZT0iZGlzYyI+DQo8bGkgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJn aW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21zby1saXN0OmwyNSBs ZXZlbDEgbGZvMTAiPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxvOnA+Jm5ic3A7 PC9vOnA+PC9zcGFuPjwvbGk+PC91bD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuMHB0Ij5UTFMgRmxhZ3MgRXh0ZW5zaW9uPG86cD48L286cD48L3NwYW4+ PC9wPg0KPHVsIHR5cGU9ImRpc2MiPg0KPGxpIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttc28tbGlzdDps MjYgbGV2ZWwxIGxmbzExIj4NCjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij5UTFMgMS4y IGhhcyA0NiBleHRlbnNpb25zOyBUTFMgMS4zIGhhcyAyODsgbW9yZSBjb21pbmc8bzpwPjwvbzpw Pjwvc3Bhbj48L2xpPjwvdWw+DQo8dWwgdHlwZT0iZGlzYyI+DQo8bGkgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDph dXRvO21zby1saXN0OmwyMiBsZXZlbDEgbGZvMTIiPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQiPk1hbnkgZXh0ZW5zaW9ucyBoYXZlIG5vIGRhdGEsIGp1c3QgMSBiaXQgb2YgZGF0YSAo dGhlaXIgcHJlc2VuY2UpIC0tIGNhbGwgdGhlbSAmcXVvdDtmbGFnIGV4dGVuc2lvbnMmcXVvdDs8 bzpwPjwvbzpwPjwvc3Bhbj48L2xpPjwvdWw+DQo8dWwgdHlwZT0iZGlzYyI+DQo8bGkgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90 dG9tLWFsdDphdXRvO21zby1saXN0OmwyNyBsZXZlbDEgbGZvMTMiPg0KPHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQiPlZhcmlvdXMgbWV0aG9kcyAoZml4ZWQtc2l6ZSBiaXRtYXNrLCB2YXJ5 aW5nLXNpemUgYml0bWFzaywgYXJyYXkgb2YgYnl0ZXMsIGV0Yyk8bzpwPjwvbzpwPjwvc3Bhbj48 L2xpPjwvdWw+DQo8dWwgdHlwZT0iZGlzYyI+DQo8bGkgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21zby1s aXN0OmwxOCBsZXZlbDEgbGZvMTQiPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPkNh bid0IHJlLWRvIGV4aXN0aW5nIGV4dGVuc2lvbnMgKGF0IGxlYXN0IGluIGNsaWVudEhlbGxvKSwg YnV0IHNlcnZlciByZXNwb25zZSBhbmQgb3RoZXIgbWVzc2FnZXMgY291bGQgZG8gc288bzpwPjwv bzpwPjwvc3Bhbj48L2xpPjwvdWw+DQo8dWwgdHlwZT0iZGlzYyI+DQo8bGkgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFs dDphdXRvO21zby1saXN0Omw0IGxldmVsMSBsZm8xNSI+DQo8c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdCI+Q29uc2Vuc3VzIGluIHJvb20gaXMgdG8gYWRvcHQgYXMgYSBXRyBpdGVtOyB0byBi ZSBjb25maXJtZWQgb24gdGhlIGxpc3Q8bzpwPjwvbzpwPjwvc3Bhbj48L2xpPjwvdWw+DQo8dWwg dHlwZT0iZGlzYyI+DQo8bGkgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9w LWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21zby1saXN0OmwxMiBsZXZlbDEg bGZvMTYiPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9zcGFuPjwvbGk+PC91bD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0Ij5TdXBwcmVzcyBJbnRlcm1lZGlhdGVzPG86cD48L286cD48L3NwYW4+PC9w Pg0KPHVsIHR5cGU9ImRpc2MiPg0KPGxpIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFy Z2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttc28tbGlzdDpsMjQg bGV2ZWwxIGxmbzE3Ij4NCjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij5BIG5ldyBmbGFn IGluIGNsaWVudEhlbGxvIHNheXMgJnF1b3Q7ZG9uJ3Qgc2VuZCBpbnRlcm1lZGlhdGVzJnF1b3Q7 PG86cD48L286cD48L3NwYW4+PC9saT48L3VsPg0KPHVsIHR5cGU9ImRpc2MiPg0KPGxpIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJv dHRvbS1hbHQ6YXV0bzttc28tbGlzdDpsMTYgbGV2ZWwxIGxmbzE4Ij4NCjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0Ij5Ob3QgY2xlYXIgd2hhdCB0byBkbyBpZiBpbnRlcm1lZGlhdGUgZW5k cyB1cCBub3QgYmVpbmcgYXZhaWxhYmxlOyBvcHRpb25zIGFyZSB0aGVuIHVnbHk8bzpwPjwvbzpw Pjwvc3Bhbj48L2xpPjwvdWw+DQo8dWwgdHlwZT0iZGlzYyI+DQo8bGkgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDph dXRvO21zby1saXN0OmwxOSBsZXZlbDEgbGZvMTkiPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQiPlNlcnZlciB3b3VsZCBpZ25vcmUgZXh0ZW5zaW9uIGlmIGl0ICZxdW90O2tub3dzJnF1 b3Q7IGl0cyBjaGFpbiBpcyAmcXVvdDt1bnVzdWFsJnF1b3Q7ICgmcXVvdDt3ZWlyZCZxdW90OyBl dGMpPG86cD48L286cD48L3NwYW4+PC9saT48L3VsPg0KPHVsIHR5cGU9ImRpc2MiPg0KPGxpIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2lu LWJvdHRvbS1hbHQ6YXV0bzttc28tbGlzdDpsNSBsZXZlbDEgbGZvMjAiPg0KPHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQiPlRoZXJlIGlzIGludGVyZXN0LCBidXQgbm90IHJlYWR5IHRvIGFz ayBmb3IgYWRvcHRpb24geWV0PG86cD48L286cD48L3NwYW4+PC9saT48L3VsPg0KPHVsIHR5cGU9 ImRpc2MiPg0KPGxpIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6 YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttc28tbGlzdDpsMyBsZXZlbDEgbGZvMjEi Pg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFu PjwvbGk+PC91bD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0Ij5UTFMgMS4zIEltcGFjdCBvbiBOZXR3b3JrIEJhc2VkIFNlY3VyaXR5IFNvbHV0aW9u czxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjx1bCB0eXBlPSJkaXNjIj4NCjxsaSBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20t YWx0OmF1dG87bXNvLWxpc3Q6bDE1IGxldmVsMSBsZm8yMiI+DQo8c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdCI+TmV0d29yayBzb2x1dGlvbnMgc29tZXRpbWVzIGluc2VydCBhIG1pZGRsZWJv eCBwcm94eSBiZXR3ZWVuIHRoZSBjbGllbnQgYW5kIHRoZSBzZXJ2ZXIsIG9ic2VydmVycyBUTFMg bWV0YWRhdGEgdG8gZG8gcG9saWN5IGFuZCBhY2Nlc3MgY29udHJvbC4gVExTIDEuMyBoYW5kc2hh a2UgY2hhbmdlcyBhZmZlY3QgdGhlc2Ugc29sdXRpb25zLjxvOnA+PC9vOnA+PC9zcGFuPjwvbGk+ PC91bD4NCjx1bCB0eXBlPSJkaXNjIj4NCjxsaSBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNv LW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bXNvLWxpc3Q6 bDcgbGV2ZWwxIGxmbzIzIj4NCjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij5JbmNvcnBv cmF0ZWQgZmVlZGJhY2ssIGhhcyBiZWVuIHN0YWJsZSBzaW5jZSBJRVRGIDEwNC4gTmV3IGNvbW1l bnRhcnkgc3RhcnRlZCB0b2RheS48bzpwPjwvbzpwPjwvc3Bhbj48L2xpPjwvdWw+DQo8dWwgdHlw ZT0iZGlzYyI+DQo8bGkgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFs dDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21zby1saXN0Omw4IGxldmVsMSBsZm8y NCI+DQo8c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+T3JpZ2luYWwgcGxhbiB3YXMgdG8g YXNrIGZvciBwdWJsaWNhdGlvbiBhcyBpbmZvcm1hdGlvbmFsIGV2ZW4gdGhvdWdoIGl0J3Mgbm90 IGluIGNoYXJ0ZXIuPG86cD48L286cD48L3NwYW4+PC9saT48L3VsPg0KPHVsIHR5cGU9ImRpc2Mi Pg0KPGxpIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bztt c28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttc28tbGlzdDpsMiBsZXZlbDEgbGZvMjUiPg0KPHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPk1vcmUgcGVvcGxlIHJlYWQgdGhpcyBkcmFmdCB0 aGFuIGFueSBvdGhlciBkcmFmdDsgaW50ZXJlc3RpbmcgYW5kIHN1cnByaXNpbmcgZmFjdG9pZC48 bzpwPjwvbzpwPjwvc3Bhbj48L2xpPjwvdWw+DQo8dWwgdHlwZT0iZGlzYyI+DQo8bGkgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90 dG9tLWFsdDphdXRvO21zby1saXN0OmwwIGxldmVsMSBsZm8yNiI+DQo8c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdCI+QWRqb3VybiB3aXRob3V0IGFjdGlvbi48bzpwPjwvbzpwPjwvc3Bhbj48 L2xpPjwvdWw+DQo8dWwgdHlwZT0iZGlzYyI+DQo8bGkgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21zby1s aXN0OmwxNCBsZXZlbDEgbGZvMjciPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxv OnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvbGk+PC91bD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwv cD4NCjwvZGl2Pg0KPC9ib2R5Pg0KPC9odG1sPg0K --_000_63A3AC36E5DB49F2AD427B6672538A2Fakamaicom_-- From nobody Tue Jul 23 15:12:50 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1676A1209CA for ; Tue, 23 Jul 2019 15:12:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IiMNB33_1UYb for ; Tue, 23 Jul 2019 15:12:36 -0700 (PDT) Received: from mail-lj1-x22f.google.com (mail-lj1-x22f.google.com [IPv6:2a00:1450:4864:20::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1F75B1209AA for ; Tue, 23 Jul 2019 15:12:36 -0700 (PDT) Received: by mail-lj1-x22f.google.com with SMTP id m23so42476503lje.12 for ; Tue, 23 Jul 2019 15:12:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=4SYcA7fyl3TTz/ykUJqMvDHwiySpFlaO3LtZWGrx9xw=; b=IOfmCCSBsPkgr4Nhps0f5pwbaSD0PthBrzGvwZ5hbsWisQlZ6klwUFxrUIawKBXQhL KqUUYOX7c9XkLSWQ+k7E0baZwJy9kr5nS4Puh4WEh6RDt6Pvs+J5jc3FHdCpzU3mmbDv EwcnUwpP8qmnK9W1kL+6Lj1EQ6By1OE3sFaq1xB7qVrTbY8uC2meFljA4m8WAzuf5sl/ 7DB6HFusFqU1+Z3QJbmehYkgyAB+9bDBoIrXBlV/KGoZlRLbCcAiBbAG/UTzCnKxA/KL OTecZs3F6scLa8CqUQjO10t1VAbmpinqDFAyeTTXK6SfdQYfeChEoHd9GitLrZpPbQ9l 7B/w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=4SYcA7fyl3TTz/ykUJqMvDHwiySpFlaO3LtZWGrx9xw=; b=QDnps0kjeGZ09bu6YSnxxdaEiDZyS8A5zzMMwmzsW3B2z4AbAGAwRe1+G8LQMaqPU+ MvHRkQKWXX15gUP473yjDXXMg/fPE9jg2oTkTzDNTuSSxpIsDv3AWJ9BZUHZcvck7NJg B2x3oY6Vy4M4WlchN4zoaIXoActOiNiOF4LfSf8k6ynONAr3ZSC0AGrQBbPXGU83Wpaw TiuRdxtyL/DHHDfaBWAWYinWSZ7ZvrvMkQXkpmM/ObjO3tTDObSVsv+yi0PqWFp2lEX0 1r7aSRtV+eh7cQ3kRgo1x9LOUOFiXkXgKxX6A9EGhSb2htO2m6MUB2TO1KUI22s+HEje MlLQ== X-Gm-Message-State: APjAAAUqUC7B9juigA2r7JQjj2Z3e/E3+xAlJTQO3AWHzi/hII8HUYXf K1OC2E7hV1VGIMV0NnutMUB7pmVXEZI8s5LJNfM= X-Google-Smtp-Source: APXvYqwH4glxKGmDYB/icIexxXT6DTtZW7rdLfqju2P2KkxSk0ijTmrXo9eddZVwrwsYy3732Je5lH8EBZ71FETY4Kk= X-Received: by 2002:a2e:8892:: with SMTP id k18mr41471571lji.239.1563919954386; Tue, 23 Jul 2019 15:12:34 -0700 (PDT) MIME-Version: 1.0 References: <6AF48228-19C2-41C7-BA86-BA16940C3CFF@cisco.com> In-Reply-To: <6AF48228-19C2-41C7-BA86-BA16940C3CFF@cisco.com> From: Eric Rescorla Date: Tue, 23 Jul 2019 15:11:57 -0700 Message-ID: To: "Nancy Cam-Winget (ncamwing)" Cc: "tls@ietf.org" Content-Type: multipart/alternative; boundary="00000000000056b57e058e607dba" Archived-At: Subject: Re: [TLS] TLS Impact on Network Security draft updated X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 Jul 2019 22:12:49 -0000 --00000000000056b57e058e607dba Content-Type: text/plain; charset="UTF-8" Document: draft-camwinget-tls-use-cases-05.txt I have some technical comments on the current draft. S 2.2.1. Note that even _if_ the SNI is provided by the client, there is no guarantee that the actual server responding is the one indicated in the SNI from the client. SNI alone, without comparison of the server certificate, does not provide reliable information about the server that the client attempts to reach. Where a client has been compromised by malware and connects to a command and control server, but presents an innocuous SNI to bypass protective filters, it is undetectable under TLS 1.3. This actually applies to TLS 1.2 as well, because nothing requires that a nonconformant client use the key supplied in the server certificate (for instance, it might just just encrypt with a fixed key or tunnel a key exchange in the TLS handshake somehow). This cannot be detected by a passive observer. S 2.2.2. I don't understand the point of this section. TLS 1.3 resumption PSK and TLS 1.2 resumption (with tickets, for instance) are largely isomorphic. In both cases, the client can decline resumption, but that is true in 1.2 as well (though there's no formal way to do it in 1.2). As a practical matter, there's no real chance that a standard client will not let you fall back to a full handshake. In earlier versions of this document, it didn't recognize this point and so this section (while misleading) made some sense, but at this point I would just remove it. S 2.2.3. I don't get what this section is trying to say. Previous TLS versions included anti-downgrade mechanisms, so you could never silently downgrade versions. The TLS 1.3 anti-downgrade mechanisms are designed to be stronger than TLS 1.2, but they don't fundamentally change this situation. S 2.2.4. Yes, ESNI causes you problems, but if you are a selective MITM proxy, you should just disable ESNI on clients using the same mechanisms that you use to add your own trust anchor. -Ekr On Sun, Jul 21, 2019 at 6:51 AM Nancy Cam-Winget (ncamwing) < ncamwing@cisco.com> wrote: > Hi, > > Thanks to all the feedback provided, we have updated the > https://tools.ietf.org/html/draft-camwinget-tls-use-cases-04 > > draft. At this point, we believe the draft is stable and would like to > request its publication as an informational draft. > > > > Warm regards, > > Nancy > > > > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > --00000000000056b57e058e607dba Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Document: draft-camwinget-tls-use-cases-05.txt
I have some technical comments on the current draft.


S 2.2.1.<= br>=C2=A0 =C2=A0Note that even _if_ the SNI is provided by the client, ther= e is no
=C2=A0 =C2=A0guarantee that the actual server responding is the = one indicated in
=C2=A0 =C2=A0the SNI from the client.=C2=A0 SNI alone, = without comparison of the server
=C2=A0 =C2=A0certificate, does not prov= ide reliable information about the server
=C2=A0 =C2=A0that the client a= ttempts to reach.=C2=A0 Where a client has been
=C2=A0 =C2=A0compromised= by malware and connects to a command and control server,
=C2=A0 =C2=A0b= ut presents an innocuous SNI to bypass protective filters, it is
=C2=A0 = =C2=A0undetectable under TLS 1.3.

This actually applies to TLS 1.2 a= s well, because nothing requires
that a nonconformant client use the key= supplied in the server certificate
(for instance, it might just just en= crypt with a fixed key or tunnel
a key exchange in the TLS handshake som= ehow). This cannot be detected
by a passive observer.


S 2.2.2= .
I don't understand the point of this section. TLS 1.3 resumption P= SK
and TLS 1.2 resumption (with tickets, for instance) are largely
is= omorphic. In both cases, the client can decline resumption, but that
is = true in 1.2 as well (though there's no formal way to do it in 1.2).
= As a practical matter, there's no real chance that a standard clientwill not let you fall back to a full handshake.

In earlier versions= of this document, it didn't recognize this point
and so this sectio= n (while misleading) made some sense, but at this
point I would just rem= ove it.


S 2.2.3.
I don't get what this section is trying = to say. Previous TLS versions
included anti-downgrade mechanisms, so you= could never silently
downgrade versions. The TLS 1.3 anti-downgrade mec= hanisms are
designed to be stronger than TLS 1.2, but they don't fun= damentally
change this situation.


S 2.2.4.
Yes, ESNI cause= s you problems, but if you are a selective MITM proxy,
you should just d= isable ESNI on clients using the same mechanisms
that you use to add you= r own trust anchor.


-Ekr







On Sun, Jul 21, 2019 at 6:51 AM Nancy Cam-Winget= (ncamwing) <ncamwing@cisco.com> wrote:

Hi,

Thanks to all the fee= dback provided, we have updated the https://tools.ietf.org/html/draft-camwinget-tls-use-= cases-04

draft.=C2=A0 At this = point, we believe the draft is stable and would like to request its publica= tion as an informational draft.

=C2=A0<= /span>

Warm regards, =

=C2=A0=C2=A0=C2=A0=C2= =A0Nancy

=C2=A0<= /span>

=C2=A0<= /span>

_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls
--00000000000056b57e058e607dba-- From nobody Tue Jul 23 15:47:36 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 197A4120956 for ; Tue, 23 Jul 2019 15:47:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.601 X-Spam-Level: X-Spam-Status: No, score=-2.601 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=filippo.io header.b=MdPljiNi; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=DlXXt+w8 Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MW21QlkEG_Gn for ; Tue, 23 Jul 2019 15:47:32 -0700 (PDT) Received: from out1-smtp.messagingengine.com (out1-smtp.messagingengine.com [66.111.4.25]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 927721203C2 for ; Tue, 23 Jul 2019 15:47:32 -0700 (PDT) Received: from compute3.internal (compute3.nyi.internal [10.202.2.43]) by mailout.nyi.internal (Postfix) with ESMTP id CDC8F22028 for ; Tue, 23 Jul 2019 18:47:31 -0400 (EDT) Received: from imap1 ([10.202.2.51]) by compute3.internal (MEProxy); Tue, 23 Jul 2019 18:47:31 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=filippo.io; h= mime-version:message-id:in-reply-to:references:date:from:to :subject:content-type; s=fm1; bh=s+9vyBQq8yUeoWXWSGoeLW3PtzAhmBb m8h9dxkaXLmk=; b=MdPljiNilJXUlkThsry56zN72wPjnu2nQ5XY17OSR88ye4B IdqeMMOUDVbK/FwoEFMKxPap6fqB0MFe7H+CscjlAsWIIhxdAIAVaWshrZuKm+W0 mnWPvEZvZf8HeMBobbDI1oPDjyYolonNYbr1vwuxl4dGPKHPsrAQEFnbzYZtpZmR hnTWUY7VDwNtY4X5Np4xUBDuV1cvOuvWWsFVb3h05r1nl79QpX8EU7Sz9O7Urhbv lqEepRPeY9VbqZHn9VhOPfeBvJVFUfPawocxSMgOuabMXmKIZWLMxsfjB6azyCly Z/z7xIG6NEGa6bL/A2KvzNpNGPFXDDexERjRtsQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-proxy :x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm3; bh=s+9vyB Qq8yUeoWXWSGoeLW3PtzAhmBbm8h9dxkaXLmk=; b=DlXXt+w80w/RYsgplfgQeO 7IIcrqN+O4WYoiHiJAHqo+5EniUa+yPaYgMEWPeSU9R6+C1Shl+N4GxhZK+weMXD CTFIWZtNIgzXQ8K0/39czijVyfgOAMYXFNARFp+zWZZTRvsixCNVCVOVC+Ah6O6q XzWUCyLumpU0Pl3QSPJfsEz4mE/LmdFqJlq8MM0QEEzr0QxKh22mxU4RVL8kA0qF 5QUC25SCSoywpx5UPUJHP6nLl+/9E4uGPhLaka4gu/+xDhC64t1i3jdOGCPua6vK Rrjikgl0e7o2Q4PAQpZ+qabVTPLhS1hgxT90lOicxRVlMcC8CzRTjmpxCYk/eamw == X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeduvddrjeelgddugecutefuodetggdotefrodftvf curfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfghnecu uegrihhlohhuthemuceftddtnecunecujfgurhepofgfggfkjghffffhvffutgesthdtre dtreertdenucfhrhhomhepfdfhihhlihhpphhoucggrghlshhorhgurgdfuceofhhilhhi phhpohesmhhlrdhfihhlihhpphhordhioheqnecurfgrrhgrmhepmhgrihhlfhhrohhmpe hfihhlihhpphhosehmlhdrfhhilhhiphhpohdrihhonecuvehluhhsthgvrhfuihiivgep td X-ME-Proxy: Received: by mailuser.nyi.internal (Postfix, from userid 501) id 6CB0AC200A4; Tue, 23 Jul 2019 18:47:31 -0400 (EDT) X-Mailer: MessagingEngine.com Webmail Interface User-Agent: Cyrus-JMAP/3.1.6-736-gdfb8e44-fmstable-20190718v2 Mime-Version: 1.0 Message-Id: <77d58a41-7a6b-4886-a4d4-22dcb229100b@www.fastmail.com> In-Reply-To: <6AF48228-19C2-41C7-BA86-BA16940C3CFF@cisco.com> References: <6AF48228-19C2-41C7-BA86-BA16940C3CFF@cisco.com> Date: Wed, 24 Jul 2019 00:46:43 +0200 From: "Filippo Valsorda" To: tls@ietf.org Content-Type: text/plain Archived-At: Subject: Re: [TLS] TLS Impact on Network Security draft updated X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 Jul 2019 22:47:34 -0000 Before any technical or wording feedback, I am confused as to the nature of this document. It does not seem to specify any protocol change or mechanism, and it does not even focus on solutions to move the web further. Instead, it looks like a well edited blog post, presenting the perspective of one segment of the industry. (The perspective seems to also lack consensus, but I believe even that is secondary.) Note how as of draft-camwinget-tls-use-cases-05 there are no IANA considerations, no security considerations, and no occurrences of any of the BCP 14 key words (MUST, SHOULD, etc.). Is there precedent for publishing such a document as an RFC? From nobody Tue Jul 23 15:56:57 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 252D8120154 for ; Tue, 23 Jul 2019 15:56:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id D5bmWkaNWpNp for ; Tue, 23 Jul 2019 15:56:53 -0700 (PDT) Received: from mail-qt1-x832.google.com (mail-qt1-x832.google.com [IPv6:2607:f8b0:4864:20::832]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0D4F31200B8 for ; Tue, 23 Jul 2019 15:56:52 -0700 (PDT) Received: by mail-qt1-x832.google.com with SMTP id y26so43584161qto.4 for ; Tue, 23 Jul 2019 15:56:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=P5WTBFHbfymROss2dVbwMZTQCP9CS7nsEWy4EDRCApk=; b=OxXHAPeZnDg6M4Ps6Av/v0LYaMFfYy4+E4Bmf3J2v+UBA6mESmyr8//KWqIA0tIIvg FtQGCh4GTEe476UCwBsq9iebP4ZjJguW9pQQ+lAeSMNoL3zphbau77C3UmCs1yIcK4d2 K/BHJT95R4QIeCJvAA8nVcwyye6j3R7RwVUZTSXIYi2oujEmSgWbvazPOf2oIDX3hJF4 sd9cjxXqWpi/SWzIBLQux6n56do9Db3Fbtj/9XfYHodim9n3s2JNJbVMJEy2yx63x5BV zcu/H3dK4U5pgXj7pWs55eXkDKtst02hjYFOT37fFWd2tq37IFhDheFwLeXZO7TOM+V0 cvaQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=P5WTBFHbfymROss2dVbwMZTQCP9CS7nsEWy4EDRCApk=; b=T9A56Zg4JHqyIdxRSyDoVdClbiKdahGU3S6/YAKzh8Kv432X+3gOFI8k5FTH8S3YyH K2sL6JEY9gHBMVWURHZGiexnmakz6PEN7w3KwZK//cuwZm6Irwcwn2GUmL7OgjTUVJHl ZVixnDyDrQkOo94ti1slsEyq0RhamG/KNcBIhRLDQM785ep8cigOnJS3Cevl1wi4TEN6 Oh9S5avWUC09gf5dEO6cO7sZoEaRz5B1cEkjEUme/zuY7uh2n4MT7F3xnvaOaTkTbP6l VROJYaXp6nipLt5XNY+RJojmT9PANt5xRJA/heKnnHEEi98WNfhjkJjJk9vb/Mj3bjXw u4yA== X-Gm-Message-State: APjAAAUyScjMlCydDSk2jkzwr/qiUN6fOsdbJRMgEnKdSqWWzNfVHYXK YeIaRcIIeBXDcO0g7Gz77bk= X-Google-Smtp-Source: APXvYqx9BM7Taz6iaAJWPmB8+lsEpMSUIOkD/ahjiHF1mmr9UMaaZEWtNISuFxMBynKgKeEP9OU4+Q== X-Received: by 2002:ac8:7b99:: with SMTP id p25mr55409609qtu.243.1563922612034; Tue, 23 Jul 2019 15:56:52 -0700 (PDT) Received: from [172.20.3.66] ([216.113.24.76]) by smtp.gmail.com with ESMTPSA id x206sm20885438qkb.127.2019.07.23.15.56.51 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 23 Jul 2019 15:56:51 -0700 (PDT) From: Bret Jordan Message-Id: <70D6B48B-D155-4EB6-A825-809BFB8BEE0F@gmail.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_4A541DF7-C525-4EE2-8D60-57F506FE71B6" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Tue, 23 Jul 2019 18:56:47 -0400 In-Reply-To: <77d58a41-7a6b-4886-a4d4-22dcb229100b@www.fastmail.com> Cc: tls@ietf.org To: Filippo Valsorda References: <6AF48228-19C2-41C7-BA86-BA16940C3CFF@cisco.com> <77d58a41-7a6b-4886-a4d4-22dcb229100b@www.fastmail.com> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [TLS] TLS Impact on Network Security draft updated X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 Jul 2019 22:56:55 -0000 --Apple-Mail=_4A541DF7-C525-4EE2-8D60-57F506FE71B6 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Informational documents do not (usually) have normative statements. If = they had normative language, they would be standards track document.=20 Thanks, Bret PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 "Without cryptography vihv vivc ce xhrnrw, however, the only thing that = can not be unscrambled is an egg." > On Jul 23, 2019, at 6:46 PM, Filippo Valsorda = wrote: >=20 > Before any technical or wording feedback, I am confused as to the = nature of this document. It does not seem to specify any protocol change = or mechanism, and it does not even focus on solutions to move the web = further. >=20 > Instead, it looks like a well edited blog post, presenting the = perspective of one segment of the industry. (The perspective seems to = also lack consensus, but I believe even that is secondary.) Note how as = of draft-camwinget-tls-use-cases-05 there are no IANA considerations, no = security considerations, and no occurrences of any of the BCP 14 key = words (MUST, SHOULD, etc.). >=20 > Is there precedent for publishing such a document as an RFC? >=20 > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls --Apple-Mail=_4A541DF7-C525-4EE2-8D60-57F506FE71B6 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii Informational documents do not (usually) have normative = statements.  If they had normative language, they would be = standards track document. 


Thanks,
Bret
PGP = Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 = 0050
"Without = cryptography vihv vivc ce xhrnrw, however, the only thing that can not = be unscrambled is an = egg."

On Jul 23, 2019, at 6:46 PM, Filippo Valsorda <filippo@ml.filippo.io> wrote:

Before= any technical or wording feedback, I am confused as to the nature of = this document. It does not seem to specify any protocol change or = mechanism, and it does not even focus on solutions to move the web = further.

Instead, it looks like a well = edited blog post, presenting the perspective of one segment of the = industry. (The perspective seems to also lack consensus, but I believe = even that is secondary.) Note how as of draft-camwinget-tls-use-cases-05 = there are no IANA considerations, no security considerations, and no = occurrences of any of the BCP 14 key words (MUST, SHOULD, etc.).

Is there precedent for publishing such a = document as an RFC?

_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls

= --Apple-Mail=_4A541DF7-C525-4EE2-8D60-57F506FE71B6-- From nobody Tue Jul 23 15:58:25 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CD91C1200B8 for ; Tue, 23 Jul 2019 15:58:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fIDnFKlx2ZJD for ; Tue, 23 Jul 2019 15:58:20 -0700 (PDT) Received: from mail-lj1-x22f.google.com (mail-lj1-x22f.google.com [IPv6:2a00:1450:4864:20::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 765D01200B1 for ; Tue, 23 Jul 2019 15:58:20 -0700 (PDT) Received: by mail-lj1-x22f.google.com with SMTP id m23so42557329lje.12 for ; Tue, 23 Jul 2019 15:58:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=YIxqV+2yJEO102CyPkEwlnSO2tbCEgm3llSBaCwQYQ4=; b=ofyfS1IllB9Ovcb5pPM5BpH/tuvYg4H/vANLblxqxY97Kxqzj+Uktg21eIe5wt5Lu+ H1Pj7l/dk0E8Hk9dA3MEyP63mG6GPH3GdPlJf718GlknKFBhRbLmDZEIUxw9pmnoLEqQ 7Ml5AQAfBMqL74b6dg4A5DO872m343ZNzLOgToHMczoL5UxT5rtElXhhuJSMrEk90m9r GJN11Jlk6Ndi9yUYPUNFoEnYPUI8t8pv+6cmFQVYDFEsyJtfNoVxXsAHBKkIYbGIAoPY QBZgdFxwZU/1pKB2vCg+ASWoQGKh2BsQOmeaO6IZSKp4P+r9yBfzU9Qq9CJqcm7N0N5j qApA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=YIxqV+2yJEO102CyPkEwlnSO2tbCEgm3llSBaCwQYQ4=; b=UIJ7oUELG6qVz2LEwWbQ1HogWiWvOKLU477A6/wREE28KJ9A4AE1vpFdRnxvxnmKXW lMPQ6p2IJZAAZ3wDPCGx/6DuMv7gCH/epCXEFaDXuBoW3DSCySXN13SojbjY0fOpQhJq Fdl1onAq1ejQzI6DznZ5D5l8+I5DNt7iY764aSRdXpOBF+wgXDc17w0Hy2j+YszOkPTu pJi965kLLDvwT7+LHP+5q+u359k796l/qe/jnUXfkNdZ5a1UYRHGffxGtDHRHFln2g/Y mUrXvtwI3Q5j8ebgtzA2JH52H311qg1T4UUlZaRoB8BqSygPmBsCIz8a4hiGB4WOxQUv vyew== X-Gm-Message-State: APjAAAWnD578RVDVcQxdQ8tr/pVYbcxBGi7nlqp7BRm0yHQc44bMJ74Q PZEbFZ7JIWv5Mx6Urj5cEPpqDbm6nBzWz55dXqrUF2+h X-Google-Smtp-Source: APXvYqzIkV9eGT/ej4L7XNupdQll/CH5NYmUeuZjcZQcD5sSDaNQdMvBryVlMmlXzHsC56wxmgXKRY1wCL5tr0ML/TE= X-Received: by 2002:a2e:8602:: with SMTP id a2mr38983377lji.206.1563922698613; Tue, 23 Jul 2019 15:58:18 -0700 (PDT) MIME-Version: 1.0 References: <6AF48228-19C2-41C7-BA86-BA16940C3CFF@cisco.com> <77d58a41-7a6b-4886-a4d4-22dcb229100b@www.fastmail.com> In-Reply-To: <77d58a41-7a6b-4886-a4d4-22dcb229100b@www.fastmail.com> From: Watson Ladd Date: Tue, 23 Jul 2019 15:58:06 -0700 Message-ID: To: Filippo Valsorda Cc: TLS List Content-Type: multipart/alternative; boundary="000000000000e83794058e612077" Archived-At: Subject: Re: [TLS] TLS Impact on Network Security draft updated X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 Jul 2019 22:58:23 -0000 --000000000000e83794058e612077 Content-Type: text/plain; charset="UTF-8" On Tue, Jul 23, 2019, 3:47 PM Filippo Valsorda wrote: > Before any technical or wording feedback, I am confused as to the nature > of this document. It does not seem to specify any protocol change or > mechanism, and it does not even focus on solutions to move the web further. > > Instead, it looks like a well edited blog post, presenting the perspective > of one segment of the industry. (The perspective seems to also lack > consensus, but I believe even that is secondary.) Note how as of > draft-camwinget-tls-use-cases-05 there are no IANA considerations, no > security considerations, and no occurrences of any of the BCP 14 key words > (MUST, SHOULD, etc.). > > Is there precedent for publishing such a document as an RFC? > I was going to say RFC 691 but no, it recommends changes to the protocol (as well as being quite amusing). RFC 4074 comes close describing bad behavior without an explicit plea to stop doing it, but has a security considerations section. RFC 7021 describes the impact of a particular networking technique on applications. So there is precedent. Sincerely, Watson --000000000000e83794058e612077 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


On Tue, Jul 23, 2019, 3:47 PM Filippo Valsorda <filippo@ml.filippo.io> wrote:<= br>
Before any technical or wording fee= dback, I am confused as to the nature of this document. It does not seem to= specify any protocol change or mechanism, and it does not even focus on so= lutions to move the web further.

Instead, it looks like a well edited blog post, presenting the perspective = of one segment of the industry. (The perspective seems to also lack consens= us, but I believe even that is secondary.) Note how as of draft-camwinget-t= ls-use-cases-05 there are no IANA considerations, no security consideration= s, and no occurrences of any of the BCP 14 key words (MUST, SHOULD, etc.).<= br>
Is there precedent for publishing such a document as an RFC?

I was going to = say RFC 691 but no, it recommends changes to the protocol (as well as being= quite amusing). RFC 4074 comes close describing bad behavior without an ex= plicit plea to stop doing it, but has a security considerations section. RF= C 7021 describes the impact of a particular networking technique on applica= tions.

So there is prece= dent.

Sincerely,
Watson
--000000000000e83794058e612077-- From nobody Tue Jul 23 16:44:31 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 42458120996 for ; Tue, 23 Jul 2019 16:44:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.999 X-Spam-Level: X-Spam-Status: No, score=-0.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FAKE_REPLY_A1=3.199, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zSgCeh8so_lf for ; Tue, 23 Jul 2019 16:44:27 -0700 (PDT) Received: from relay12.mail.ox.ac.uk (relay12.mail.ox.ac.uk [129.67.1.163]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3EE5A120995 for ; Tue, 23 Jul 2019 16:44:27 -0700 (PDT) Received: from smtp4.mail.ox.ac.uk ([129.67.1.207]) by relay12.mail.ox.ac.uk with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.89) (envelope-from ) id 1hq4SH-0009AR-et; Wed, 24 Jul 2019 00:44:25 +0100 Received: from 61.ip-51-38-113.eu ([51.38.113.61] helo=[192.168.2.2]) by smtp4.mail.ox.ac.uk with esmtpsa (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.89) (envelope-from ) id 1hq4SH-0003B7-Cv; Wed, 24 Jul 2019 00:44:25 +0100 To: watsonbladd@gmail.com Cc: tls@ietf.org From: Dennis Jackson Openpgp: preference=signencrypt Autocrypt: addr=dennis.jackson@cs.ox.ac.uk; prefer-encrypt=mutual; keydata= mQINBFbAmb8BEADCLixsrAJyvknI95ZIZNVeDJbYvldeXpw7iyhrdUdRK69USU5S9EESulYh k1KlxDB5VfG8CCA/WzG1IonONdXmgLFa1NcmdVvkFjbXf5mbGYG+9pTkieM+UHikniAizIOi ibdTWEEc2opOAvpVypek4SSsfCoXfXqj0j5AXSapHiVzhhWuaXhKVuFdLtYwJDU/x0FXgStm erFMIOeZ5FLFnjkkNyEa1t3XCcf7bfgw8J86UmWzgkVLmtBYbDK0ZAFjtFep5Kps11iTDIa3 xYXzuqgkWwkg7b1mhn5gQUl/kKZqQbuG+Sk+BydjH8e1PJkO6p2eAprO0AoucRuuBl1pmg/F bf/WJC6/XD3AV87ERAdXbb9cH+vrRT8GpiNX5r+7OuXavc3/LNU9stqsdshXwdZlDyPyDIG2 Llj6hB4eS0tEpat3otcPDkXUjXjyOUQ6jKTNSZ+xTBtVTXznflDCGdn9GV0q+4ZbdRZ5tfXM DXM+uMqVxjvh2IjCrka7zf1rRWg1WZu+NrzAUrvPMPddDJfd8JNrIcvV+DIBxPVsUTJLEGt9 PW8LkQb5FrG7T6a813JYNoAtL4w7296UYmUpV1Kvv8otO+uH860x5Ci83ZCXb7gKr9Rankn5 Jcg+shWnDFgSq6uM/u3MmyRV2iw7aCSgcgfy4EPTojJdy3KjzQARAQABtCtEZW5uaXMgSmFj a3NvbiA8ZGVubmlzLmphY2tzb25AY3Mub3guYWMudWs+iQIwBBMBCgAaBAsJCAcCFQoCFgEC GQAFglsIFtUCngECmwMACgkQYQWndYzSRqzvkA//djyyIydK5jhxNFqmMvJTkTZwawKWV7Tc cEntsIwYsHw8ec9Edo/M6fwp8aFmddPnzRo0EBmh6KNm887VxgH0FXmcR7k8bD3qUzIhfq11 4ezWtTk0nWjpieEsFb20lCMZjK9dsfXVRgFrfe00x2lhjPWQ5G5mTkfX8KYcDs5nmc+13qHK Ux6e6aSdEa4mnxrT0NsEg2H2xKgwrGkNIxJO6snrh3A3mT6+2F8ZCiRWwmOhcHBzNCFp1enR bMJpNRhcmGBDNJ9TpnQHDRVE67ds3PC/vKDkYQ3tEIkdgc/KVGOo7+kZxSU/n1gARDZ4PYUw IGOM81aEhmrbXoF33Jbic2jnuLfqsC8uXeP6wGgGpEdGThQ+7zslOPDradgDZBlUmYenuwOb JwJEj+JbbZPcND17VrgVDzcM1rh1w9wcKrRDMIw/zLCpEDOfLRe2ad/V380q/Eh3qa4QrZE7 tnXcOTIZfxd1zZ6TcpOvMVYQPN5Zfrlazmw9bTsdkm3WVrzvxc9DJ/D5Ws+aMu+JfSD+C5Nd n5w2fW7OOiDudeFXj88CL7oBehPJ2ajCDmHd/vc1W7CSoPte6aHBgSGER9cWm5hpEOXacQt+ pEz/uMvq+zkDIydy9YL/8hDo5TsVA4Yo8wNdKOuyaStk/oh3WNda05N0jr8VhRMdxnLN/hWY Ely5Ag0EVsCZvwEQAOBD1BmNy7FWbpg9Tm3OfMNC/yLs6G7rk3OFw7BhpjHXHSsEge48HbvP lfdR9abA1cmbgYR7EyaOav1s9ugU7EtDCcK8zHZcaUg3gC+FdjsnkIQCkf/3HK2sxcbBSrkX 2Uu2jjufvZu10g/aavkCuTHIUiYAHhQU5kCkRI7NYvXIKmaPY2Km3YIVJ50x+4GlE/WVZk8w HpvisxDInBioziUjAIqTt0at5tE1ObZksl2eNHNCwlo15WE2hKIYCuJKb57wCBKaOKo/gSw/ yN2DX3HaU/PF+8rCikkKDhHDrefFwGkqBf3zHlrLiHIr+ONVZ8i9dxMyg5TERxjd3vZ4ha+7 8cr8G83HC8lSBEpPYmoeU4J8vWf8kjBlai0UmzyZRF3SeZlqldxo7zJhYq3xIsDGKVuSCn68 2TcoEsR5WS/Zjc0ZoH/YIpdVy8FRu45dJ2IUzHVyszMfNWKob7ZsQ9JCXiXypmIF6ut5mwv8 ddCMdG6Jdpvg1fr0coABNbJSrUM8uFEldmRFpBdbNx5xSCJjNo+QuTHOXWuO3/GFRmux8/kW TlfF3+dvff2Pw3CKENoysgcOflYShcjOv/03sQ6AfxTm2Jnh5dqJSoVnPWpcDyPqn3k4zoZW 0ISqorI8yehJbfT3C0J5iEX75c8vJWfUUjIhyO0CpHxATNW3j3QxABEBAAGJAh8EGAEIABMF AlbAmccJEGEFp3WM0kasAhsMAAD8JhAAtkUWMLjr1RYTSMPrmTp3NGZfNSblv0GGHtL7TvT1 kFwdT/hs29Gjrj0FffZE6RKDEGls9AL6LY/g3wA5WQsXaK0wqwb8MBeIPWvFPvVQbqrifN3A bpukTl4OCBOwJbHS/GO1V3AwaLl4l3U/+kzR7UsnszWs4kizE9lBJ0AYFbxB0xbPF6iI32Cm K3nrLPfkXBXw2xX01nOLxTx9E7YdVpP3Re1c96aBTflm4CAGUfTZ5xgQMW6rgJ8FBc3oLckt 9MT0qB5XkmKGI1kkRypN7hIFRBcPxegeO8S3fpBUOop5F0el24TVx6KJTktpLmlIfUsEQ0Lx CqNtUk1v3eMCoKmeky8WbFcUArRV4DKXDAK1e3C8poMaehRgfl8sjz6SuH1VXpCMLNPpNMtZ EK4FU+C0jGgJyHS9N1UZjq8Qa8FnYKruyPgTpKEAsqlo5vB6J8phiaKXxnren8HqIfzQdrt8 3M+raXc7+Fqis4pYS49vfIpxUzcqvKUiSgDGKemqMw9w9U5dBEQeLNW08uOKSjyENU4e1Ob/ IiimIpEPA5LEIhSfOP9CN9TculGqvo0g12XnB+g5AAtm1ohMkb33T17IR3rKkhlvIITuY1qi fZz7OgGbXh4G5oUHXNBOhXHaqRIzQCCRbBUFA09OyJBLWAGH6HcM/DeM0I7Ng55uMl8= Message-ID: <51f39225-1953-b603-bd15-bbc7d4bf2222@cs.ox.ac.uk> Date: Wed, 24 Jul 2019 00:44:20 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.7.1 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="------------4614E9E8247E2E0519DBDA4B" Content-Language: en-US X-Oxford-Username: exet4027 Archived-At: Subject: Re: [TLS] TLS Impact on Network Security draft updated X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 Jul 2019 23:44:29 -0000 This is a multi-part message in MIME format. --------------4614E9E8247E2E0519DBDA4B Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable RFC 791 is nearly 40 years old. RFC 4074 lists 5 forms of deviations from RFC 1034 and explains=20 the correct behavior.=20 RFC 7021 describes a series of objective tests of RFC 6333 and=20 the results.=20 The above RFCs describe objective test results and how they=20 relate to earlier RFCs. In contrast, this document offers a=20 speculative and subjective discussion of possible future impact. I do not believe there is any precedent supporting publication. Best, Dennis > On Tue, Jul 23, 2019, 3:47 PM Filippo Valsorda = ; > wrote: > > > Before any technical or wording feedback, I am confused as to the nat= ure > > of this document. It does not seem to specify any protocol change or > > mechanism, and it does not even focus on solutions to move the web fu= rther. > > > > Instead, it looks like a well edited blog post, presenting the perspe= ctive > > of one segment of the industry. (The perspective seems to also lack > > consensus, but I believe even that is secondary.) Note how as of > > draft-camwinget-tls-use-cases-05 there are no IANA considerations, no= > > security considerations, and no occurrences of any of the BCP 14 key = words > > (MUST, SHOULD, etc.). > > > > Is there precedent for publishing such a document as an RFC? > > > > I was going to say RFC 691 but no, it recommends changes to the protoco= l > (as well as being quite amusing). RFC 4074 comes close describing bad > behavior without an explicit plea to stop doing it, but has a security > considerations section. RFC 7021 describes the impact of a particular > networking technique on applications. > > So there is precedent. > > Sincerely, > Watson --------------4614E9E8247E2E0519DBDA4B Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 8bit 
RFC 791  is nearly 40 years old.
RFC 4074 lists 5 forms of deviations from RFC 1034 and explains 
the correct behavior. 
RFC 7021 describes a series of objective tests of RFC 6333 and 
the results. 


The above RFCs describe objective test results and how they 
relate to earlier RFCs. In contrast, this document offers a 
speculative and subjective discussion of possible future impact.


I do not believe there is any precedent supporting publication.


Best,
Dennis


On Tue, Jul 23, 2019, 3:47 PM Filippo Valsorda <filippo@ml.filippo.io>;
wrote:

> Before any technical or wording feedback, I am confused as to the nature
> of this document. It does not seem to specify any protocol change or
> mechanism, and it does not even focus on solutions to move the web further.
>
> Instead, it looks like a well edited blog post, presenting the perspective
> of one segment of the industry. (The perspective seems to also lack
> consensus, but I believe even that is secondary.) Note how as of
> draft-camwinget-tls-use-cases-05 there are no IANA considerations, no
> security considerations, and no occurrences of any of the BCP 14 key words
> (MUST, SHOULD, etc.).
>
> Is there precedent for publishing such a document as an RFC?
>

I was going to say RFC 691 but no, it recommends changes to the protocol
(as well as being quite amusing). RFC 4074 comes close describing bad
behavior without an explicit plea to stop doing it, but has a security
considerations section. RFC 7021 describes the impact of a particular
networking technique on applications.

So there is precedent.

Sincerely,
Watson
--------------4614E9E8247E2E0519DBDA4B-- From nobody Tue Jul 23 17:22:56 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7A85412098D for ; Tue, 23 Jul 2019 17:22:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cloudflare.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7n_e0soeFBZ6 for ; Tue, 23 Jul 2019 17:22:53 -0700 (PDT) Received: from mail-qt1-x82e.google.com (mail-qt1-x82e.google.com [IPv6:2607:f8b0:4864:20::82e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 86673120995 for ; Tue, 23 Jul 2019 17:22:53 -0700 (PDT) Received: by mail-qt1-x82e.google.com with SMTP id x22so38841683qtp.12 for ; Tue, 23 Jul 2019 17:22:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cloudflare.com; s=google; h=mime-version:from:date:message-id:subject:to; bh=OuhccSSe2aO9ZwoBwmnLLMl3qh4HmECyV3oiUP1use0=; b=eNq0+rYD6w0cfjbACn6YhIvkptOH01sZZmmMmjt7mQHofIeWTgfQufV4NCEaI2tMsi uMwkHMbyFmu6sdSHsNUcGtNWYgxIx55KjvadSXmauhbfDGlwe7/UianOP2YVsoNxRS8L lkmyBxB3GWPTr4UxrO2j5BqN8gOeNnl7by8rM= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=OuhccSSe2aO9ZwoBwmnLLMl3qh4HmECyV3oiUP1use0=; b=SFOoL7v47Hf7cl9+zJX7qrw/gvlUHtuGWRuMsNyDvtejIqly0aQ7z/dIoec0u6M0uz axHBlW1i4Ekv/ihS5X2tHVGJ3xfXA6TxgDsXrCJ9feDBiC+kz+KKMHm0F7PJ6hZUQA1m 2f26E1DpN0atNTDtpjO9Ggi2QkAvYH6SZOnvE7rbVqbMFc5LZ4C+Z0u+XXoKOfh9+QWB sfYnr0J0HdGURSMGe/qwooOxEkU7WinILE6Ks26qThc8VL9QalmGFqQHgMqUysu5C+O/ NVjxhmKKsIpcZ/FzgCCV1Ww1j9hx5WjwQ0vd5T8jOPsRaG7vV77qfVzvMjH23dHtcVfb NBLg== X-Gm-Message-State: APjAAAUoKdC1VmaiNfHjT+iDPtV7YAHkULe0fSZK3B81pEzLtoxq7yoq 0jNXBLxNac2GNWMZXgPMtxrpAtLKeVdG3SsCm+nNEghDRdw2mA== X-Google-Smtp-Source: APXvYqzPRsDfmn4JMcQOIaboB9Snt4pHqHcuGeq7loxk1n7ZrKSEvAVOHZMfqcXviqgL7Wzd++7FqbahzRbmxWd4F9k= X-Received: by 2002:a0c:c382:: with SMTP id o2mr18918234qvi.75.1563927772511; Tue, 23 Jul 2019 17:22:52 -0700 (PDT) MIME-Version: 1.0 From: Watson Ladd Date: Tue, 23 Jul 2019 17:22:41 -0700 Message-ID: To: tls@ietf.org Content-Type: multipart/alternative; boundary="00000000000056003c058e624f8f" Archived-At: Subject: [TLS] Question about draft-thomson-tls-sic X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 00:22:55 -0000 --00000000000056003c058e624f8f Content-Type: text/plain; charset="UTF-8" Suppose the following sequence of events happen: 1: A CA uses a new intermediate for reasons (no longer cross-signing, etc.) 2: A site gets a certificate from the new intermediate. 3: An older firefox version connects and thinks it knows all the certificates in the world. This would seem to break and it wasn't clear to me how this would be handled. Though as Martin points out this extension is merely codification of an occasional practice, so maybe this case does actually work out. Sincerely, Watson Ladd --00000000000056003c058e624f8f Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Suppose the following sequence of events happen:

<= div>1: A CA uses a new intermediate for reasons (no longer cross-signing, e= tc.)
2: A site gets a certificate from the new intermediate.
3: An older firefox version connects and thinks it knows all the cert= ificates in the world.

This would seem to break an= d it wasn't clear to me how this would be handled. Though as Martin poi= nts out this extension is merely codification of an occasional practice, so= maybe this case does actually work out.

Sin= cerely,
Watson Ladd
--00000000000056003c058e624f8f-- From nobody Tue Jul 23 18:09:02 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2E97C1209B4 for ; Tue, 23 Jul 2019 18:09:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fTXRfDtGdvmR for ; Tue, 23 Jul 2019 18:08:58 -0700 (PDT) Received: from mail-lj1-x235.google.com (mail-lj1-x235.google.com [IPv6:2a00:1450:4864:20::235]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 84AFA12034B for ; Tue, 23 Jul 2019 18:08:58 -0700 (PDT) Received: by mail-lj1-x235.google.com with SMTP id v24so42906855ljg.13 for ; Tue, 23 Jul 2019 18:08:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=WuuPR/LTUx+cFm+qb2NLp7UujQFDUZCVmL0VgKJ/AXU=; b=b5OlBIVNGW0Wq3xQ/8swSA4LZ/I4WhWVbL2NSaSqUBGDP/syLTtPs8c3zurQRE5SpH Nfmz9H5Pd8X1rnEvGkYoK5AN64M6ND+P1vLZtJ/tn4x68+NeHAAb5OJajF9Q/j5855B1 5Z43mNd13ghDTz0U2ueDziQOypWlkr5cJgjT4U/7gp/sWfr35OPsU8ywrutp/KqS/JAn 2uZZUWnffCcDaG1ZfmQK347CZzhuX8+c3gGVDZCdIlbCix8tZXDP82uOOMIz+VUSCy6U fpjNVAayGju2p2y51uK47M4Ll1K83LMphYOx5XmzaaDibLVnV67TYms6jtWurxKs2ZzM kpXw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=WuuPR/LTUx+cFm+qb2NLp7UujQFDUZCVmL0VgKJ/AXU=; b=nkOSk7ywfT9UoFLXTfYHz8iePzudisFGzyb/v1wT1WAG/G4UYquc8Oik8mnNQfHhHW GZ5WBg0uO8XUWqB/ymmHfxl7/rR9MpP0i0cMSR5GPffDdowopm6t9TkDh0Co9M3/hiAd kBW1ekDOfs8yoXkwtZtpWm5+od8cNITJlfmSTMDwu5+U6YCCHlKp1JZK4tQNiSxOEWUK 8TI2cnK+QlGM6E5669gHiNjSwnwp3wpJN12Ap6KlRfZ7OQVN41IE27Pg/8WExtUH5abC 1rvehvXsvvh6c4sR8zdRmPVPuO4v2eX/PAhr1oF5/1hxD/msJUqOxodXlWnGHLv619+l NiCw== X-Gm-Message-State: APjAAAWGyMqDcJ8oSS6+4H+m6YJhtSV2/rIkED/ee9aQFEpyPVboHC3+ stF5QEj+GhwzO3XzoiseNJDPbrCe6aVK4+ZBWwHgLVC+ X-Google-Smtp-Source: APXvYqzIyMDE/V4WjVDvdLSwYpSykfzwru16Rp4THY3tAMpqDZ0mC6nVBlnOvE7GH3TIxF5JQli/nBrDfo9PR/bbXLE= X-Received: by 2002:a2e:824f:: with SMTP id j15mr42061243ljh.117.1563930536607; Tue, 23 Jul 2019 18:08:56 -0700 (PDT) MIME-Version: 1.0 References: <63A3AC36-E5DB-49F2-AD42-7B6672538A2F@akamai.com> In-Reply-To: <63A3AC36-E5DB-49F2-AD42-7B6672538A2F@akamai.com> From: Watson Ladd Date: Tue, 23 Jul 2019 18:08:38 -0700 Message-ID: To: "Salz, Rich" Cc: TLS List Content-Type: multipart/alternative; boundary="0000000000001684bb058e62f4c9" Archived-At: Subject: Re: [TLS] Draft minutes for Tuesday X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 01:09:01 -0000 --0000000000001684bb058e62f4c9 Content-Type: text/plain; charset="UTF-8" Thank you! On Tue, Jul 23, 2019, 3:14 PM Salz, Rich wrote: > Are on etherpad at https://etherpad.ietf.org/p/notes-ietf-105-tls > > > > Cut/pasted here (but more readable there): > > TLS at IETF 105 > > > > Tuesday > > > > Status update (drafts, code points, etc) -- see the slides > > > > CFRG working on PAKE selection; integration with TLS is obviously > important, come to CFRG meeting. > > > > Delegated credentials > > - Server side patch in boringSSL; NSS client side soon to be in FF > nightly; FB work in progress > > > - Plan to drop LURK mention, remove PKCS#1 v1.5 (RSA PSS only) [Martin > says needs more text for clarity] > > > - Plan was to not go forward without proof that this doesn't weaken > PKI security; a by-hand one is in progress > > > - Refine "Delegated credentials" term to "Delegated authentication > keys" > > > - Plan is to start WGLC, but make sure it isn't finished until the > analysis is done and reviewed by the WG > > > - > > One note: kc2kdm.com is up and working with NSS clients. Please hit it! --0000000000001684bb058e62f4c9 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Thank you!=C2=A0

<= div dir=3D"ltr" class=3D"gmail_attr">On Tue, Jul 23, 2019, 3:14 PM Salz, Ri= ch <rsalz@akamai.com> wrote:<= br>

Are on etherpad at = https://etherpad.ietf.org/p/notes-ietf-105-tls

=C2=A0

Cut/pasted here (bu= t more readable there):

TLS at IETF 105<= /u>

=C2=A0

Tuesday

=C2=A0

Status update (draf= ts, code points, etc) -- see the slides

=C2=A0

CFRG working on PAK= E selection;=C2=A0 integration with TLS is obviously important, come to CFR= G meeting.

=C2=A0

Delegated credentia= ls

  • Server side patch in boringSSL; NSS client= side soon to be in FF nightly; FB work in progress
  • Plan to drop LURK mention, remove PKCS#1 v= 1.5 (RSA PSS only) [Martin says needs more text for clarity]<= /span>
  • Plan was to not go forward without proof t= hat this doesn't weaken PKI security; a by-hand one is in progress
  • Refine "Delegated credentials" t= erm to "Delegated authentication keys"
    • <= /ul>
    • Plan is to start WGLC, but make sure it is= n't finished until the analysis is done and reviewed by the WG
    • =C2=A0
=

One = note: kc2kdm.com is up and working with N= SS clients. Please hit it!
--0000000000001684bb058e62f4c9-- From nobody Tue Jul 23 18:15:27 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 375951209B0 for ; Tue, 23 Jul 2019 18:15:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.558 X-Spam-Level: X-Spam-Status: No, score=-1.558 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FORGED_FROMDOMAIN=0.091, FREEMAIL_FROM=0.001, HEADER_FROM_DIFFERENT_DOMAINS=0.249, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1LDVxLmc40zj for ; Tue, 23 Jul 2019 18:15:23 -0700 (PDT) Received: from mail-qt1-f170.google.com (mail-qt1-f170.google.com [209.85.160.170]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9643B12034B for ; Tue, 23 Jul 2019 18:15:23 -0700 (PDT) Received: by mail-qt1-f170.google.com with SMTP id r6so39651055qtt.0 for ; Tue, 23 Jul 2019 18:15:23 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=aoLQn1OFsdtQ4Kt7yv7j1+qR0OMnT/1hVzR9QtY1kvM=; b=qchHl/hF+PBAUm1gjbAXPJpdk2of1tmXFQIpnrLAnPD5VUddUstHK8lr/m7KS+ZW4o bp8VcW3wNiOPCe+CtWGgQluVakwxTHKso0GQxKFuLbnrj+uu4HVZOMRN3+4FeJpyXz52 yXnNa/HVnZWwQmDqL899E+tj+cHlPmq8W0OSoGtdOGG95uqtxJe1eIlL85W4DwDh7jpZ jg1zZhoy2c86yTZN24jmx+Py+rF8W0mC4fiazJ+kw5EYbRCuzqw9r+f1jbMbLyDuXZMK 42TwQR1YIXwcIWZyqR0GVKswQhUEJLzbSaRgJY7LDJjdqt9xRKPYniNjAZ/iVpvIQy/m TDOg== X-Gm-Message-State: APjAAAXSMsMnMIfT+24fMGsiK2sp0PrLBoMes2V9JxXqUc79EGMZpfVD 5rxN/OkX8sJLzGn/2AF3U6KvNUWOhYGdiZ5kCFeZTZVfx3A= X-Google-Smtp-Source: APXvYqx4fNeSHzhceKVDbxf5QHC0OI3NazPz5Q9fL+jZb6L683rvIAnuWtT2mPoQEXg281p31CXThL8d8QazihNY97o= X-Received: by 2002:a0c:d14e:: with SMTP id c14mr56511900qvh.206.1563930922483; Tue, 23 Jul 2019 18:15:22 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Adam Langley Date: Tue, 23 Jul 2019 18:15:10 -0700 Message-ID: To: Watson Ladd Cc: "" Content-Type: multipart/alternative; boundary="0000000000001685ab058e630bef" Archived-At: Subject: Re: [TLS] Question about draft-thomson-tls-sic X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 01:15:25 -0000 --0000000000001685ab058e630bef Content-Type: text/plain; charset="UTF-8" On Tue, Jul 23, 2019 at 5:23 PM Watson Ladd wrote: > Suppose the following sequence of events happen: > > 1: A CA uses a new intermediate for reasons (no longer cross-signing, etc.) > 2: A site gets a certificate from the new intermediate. > 3: An older firefox version connects and thinks it knows all the > certificates in the world. > > This would seem to break and it wasn't clear to me how this would be > handled. Though as Martin points out this extension is merely codification > of an occasional practice, so maybe this case does actually work out. > I think the client would have to fall back and retry the TLS connection without requesting that intermediates be omitted. In general, I think this is the only reliable answer as AIA-chasing doesn't always work. (Either the AIA server can be down, or the chain can be from a private CA that doesn't support AIA.) Cheers AGL --0000000000001685ab058e630bef Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Tue, Jul 23, 2019 at 5:23 PM Watson La= dd <watson=3D40cloudf= lare.com@dmarc.ietf.org> wrote:
=
Suppose = the following sequence of events happen:

1: A CA uses a new in= termediate for reasons (no longer cross-signing, etc.)
2: A site = gets a certificate from the new intermediate.
3: An older firefox= version connects and thinks it knows all the certificates in the world.

This would seem to break and it wasn't clear to = me how this would be handled. Though as Martin points out this extension is= merely codification of an occasional practice, so maybe this case does act= ually work out.

I think t= he client would have to fall back and retry the TLS connection without requ= esting that intermediates be omitted. In general, I think this is the only = reliable answer as AIA-chasing doesn't always work. (Either the AIA ser= ver can be down, or the chain can be from a private CA that doesn't sup= port AIA.)


Cheers

AGL
--0000000000001685ab058e630bef-- From nobody Tue Jul 23 18:18:16 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BA43E1209B9 for ; Tue, 23 Jul 2019 18:18:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.56 X-Spam-Level: X-Spam-Status: No, score=-1.56 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FORGED_FROMDOMAIN=0.091, FREEMAIL_FROM=0.001, HEADER_FROM_DIFFERENT_DOMAINS=0.249, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nbNJ_Z-5anwG for ; Tue, 23 Jul 2019 18:18:13 -0700 (PDT) Received: from mail-qk1-f170.google.com (mail-qk1-f170.google.com [209.85.222.170]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B168112034B for ; Tue, 23 Jul 2019 18:18:13 -0700 (PDT) Received: by mail-qk1-f170.google.com with SMTP id r6so32638911qkc.0 for ; Tue, 23 Jul 2019 18:18:13 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc:content-transfer-encoding; bh=NnMSAR5bFSCmr7aSovBWykCMJS/76G9LyfftZHwGuYw=; b=c0CshmxCn+1g2usPMvXPBM5PflkCoDC2PgTtkK7AFwIhRC6cH/t99CtvASeDafpOo+ 1M1KXqDmXHgQ0JouEbOUiWyKw0Nf8MWNivXyibClBAbCQ4zWHHeMQsoQToo0KadxV+RW 62yCmXScMujulO241/XNWBOd2HYTH22tHjgx1eu2IbEfRtdlbYgqclLZP5k/wYPorQFM 7XLEUjjGd51SUHui+wMANQmX9/2Ku8FofC+puB7XpokR3cK5iWV95rP2CKW+a7cRc86V wqoFMvIUH5o1kdElTdlYKYPRaYb2y/OAqB82nMOuGeqbO8zeBO1pvs6fxUeRDgNlgDl9 knBQ== X-Gm-Message-State: APjAAAUZjhWaCZslCnr72Ct8/dhEgoWTY/ceKEYvC3iPbxWmulMbOhx3 fL0pHCPtNwiAnlzTIbRdM4E1ZLVqo4E/zfdv5GutAMS1djw= X-Google-Smtp-Source: APXvYqxClhmGiKOXoXtM+9XXP87r7Hl0fn/rT2v7TmRalVc1+7IP3Fxmzn5uvTyZRULtOq7FMq1eQ1708IV8Bz5HY/o= X-Received: by 2002:a37:a7d2:: with SMTP id q201mr51438210qke.150.1563931092609; Tue, 23 Jul 2019 18:18:12 -0700 (PDT) MIME-Version: 1.0 References: <9257D2C3-05A2-498C-AA2A-04F5EA793ACC@cert.org> In-Reply-To: <9257D2C3-05A2-498C-AA2A-04F5EA793ACC@cert.org> From: Adam Langley Date: Tue, 23 Jul 2019 18:18:00 -0700 Message-ID: To: Chris Inacio Cc: "tls@ietf.org" Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Archived-At: Subject: Re: [TLS] TLS Flags extension - not sure it makes sense X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 01:18:15 -0000 On Tue, Jul 23, 2019 at 3:09 PM Chris Inacio wrote: > I really want the savings on the wire that TLS flags extension provides = =E2=80=93 and so I think it=E2=80=99s really good for the future cTLS but I= =E2=80=99m not sure when I get to use it in TLS 1.3 negotiation. It goes i= n the clientHello message, but how will I know that the server uses this ex= tension? I envision a future where we will add the flags extension along w= ith the more expensive 4-bytes version for a REALLY long time. The expectation is that applicable future extensions will be defined as flags. Therefore, if the server supports the extension that you're interested in then it'll also have to support the flags extension. If it doesn't, then the extension will be ignored as normal. Cheers AGL From nobody Tue Jul 23 18:55:13 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5DD631209BF for ; Tue, 23 Jul 2019 18:55:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QihXU0vfniXZ for ; Tue, 23 Jul 2019 18:55:09 -0700 (PDT) Received: from mail-qk1-x729.google.com (mail-qk1-x729.google.com [IPv6:2607:f8b0:4864:20::729]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6387412008C for ; Tue, 23 Jul 2019 18:55:09 -0700 (PDT) Received: by mail-qk1-x729.google.com with SMTP id s22so32669790qkj.12 for ; Tue, 23 Jul 2019 18:55:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:mime-version:subject:date:references:to:in-reply-to:message-id; bh=xYd3HN8KDFNGxPGFrMkc9H5I25d3lHJQ+qYOAK8ymg0=; b=Ut8XgmjUkspSjGiuMmLq/hkuyp/N3A1V/YJSaHiHC6q867OsWlUCXRG/XEcvkgHPUg ZaYigaNty6L0HwyoHfnPvx2f+aT0iv4l80vVQg6meuEInNr4T6I3ZIdHWsersgL9OF5e ErJUNqvp8PNxflGZHPQApBZSMctakLjL3ksJxZZhlCfP9B/HLcQ78qeezDlVF5UgDP2Q xaYvj2w35uJFBu4ARaNWzmxF5+V9pWLelvGqmmvKmTHprSSgVms7AIDcG3SlpbZusTAa mtrjhK0ewS6k2FtqDZnOkPavSY2M50mQzdl/SOukf4JvJXhWod26eiGHacsJLOB/D6dJ H+5w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:mime-version:subject:date:references:to :in-reply-to:message-id; bh=xYd3HN8KDFNGxPGFrMkc9H5I25d3lHJQ+qYOAK8ymg0=; b=hppxSZWLWfRxA1M0eps6uTM3xOi7MavqrmWTIGdSjOB8PiRJh0ptuh1tlQo1RlaEpE A5WsQYHk9LNNqYXOsr8V8pe1E5mSIZAwM01qwZtPQe6piJTpdCsQb04ZCxyWM9VZGf1A /gYfDRb+yEtXnpgMChEA8E9gjf9uKwIqo/9dj4dkIdqZACAAlCdK4hXOb/re0S66Calg g0LnxDBsUmyBZiil5UKQzoA0f49RDzS85A7149OMi582/8xVTOId17Vn6zypRaVYpfEo Cj+Gqgvc4C9+Uy5rrHq87YVHqLp+mMoroO9V04BFOFuxrWKncasfwh9XTnLga9g5+GBi frmQ== X-Gm-Message-State: APjAAAWqPvFauAseGNOaJTd/Rqd1bcAUicqHKXLcPd/ficZbcTyK6V4Z Z8pagpArSBeVLn0gPFB+HSHE1rF0 X-Google-Smtp-Source: APXvYqyBazjrDEka+s5x4EsvpaeRpLjdRmrzUkW5VDJulOZx+D8hR/oZqlAyiTa2EWx/+XHYxlNfLw== X-Received: by 2002:a05:620a:1661:: with SMTP id d1mr53349910qko.192.1563933308281; Tue, 23 Jul 2019 18:55:08 -0700 (PDT) Received: from [172.20.3.66] ([216.113.24.76]) by smtp.gmail.com with ESMTPSA id z19sm21057532qkg.28.2019.07.23.18.55.07 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 23 Jul 2019 18:55:07 -0700 (PDT) From: Bret Jordan Content-Type: multipart/alternative; boundary="Apple-Mail=_2E0D6E08-4B31-497F-92AB-E6CBDE8F451F" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Tue, 23 Jul 2019 21:55:04 -0400 References: <51f39225-1953-b603-bd15-bbc7d4bf2222@cs.ox.ac.uk> To: "" In-Reply-To: <51f39225-1953-b603-bd15-bbc7d4bf2222@cs.ox.ac.uk> Message-Id: <1300C2AB-ACCD-4F29-96CF-D27A6737A799@gmail.com> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [TLS] TLS Impact on Network Security draft updated X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 01:55:12 -0000 --Apple-Mail=_2E0D6E08-4B31-497F-92AB-E6CBDE8F451F Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii As a professional organization and part of due diligence, we need to try = and understand the risks and ramifications on the deployments of our = solutions. This means, understanding exactly how the market uses and = needs to use the solutions we create. When we remove or change some = technology, we should try hard to provide a work around. If a work = around is not possible, we need to cleanly document how these changes = are going to impact the market so it can prepare. This is the = responsible and prudent thing to do in a professional organization like = the IETF.=20 The draft that Nancy and others have worked on is a great start to = documenting how these new solutions are going to impact organizational = networks. Regardless of whether you like the use-cases or regulations = that some organizations have, they are valid and our new solutions are = going to impact them.=20 Thanks, Bret PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 "Without cryptography vihv vivc ce xhrnrw, however, the only thing that = can not be unscrambled is an egg." > On Jul 23, 2019, at 7:44 PM, Dennis Jackson = wrote: >=20 > RFC 791 is nearly 40 years old. > RFC 4074 lists 5 forms of deviations from RFC 1034 and explains=20 > the correct behavior.=20 > RFC 7021 describes a series of objective tests of RFC 6333 and=20 > the results.=20 >=20 >=20 > The above RFCs describe objective test results and how they=20 > relate to earlier RFCs. In contrast, this document offers a=20 > speculative and subjective discussion of possible future impact. >=20 >=20 > I do not believe there is any precedent supporting publication. >=20 >=20 > Best, > Dennis --Apple-Mail=_2E0D6E08-4B31-497F-92AB-E6CBDE8F451F Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii As = a professional organization and part of due diligence, we need to try = and understand the risks and ramifications on the deployments of our = solutions. This means, understanding exactly how the market uses and = needs to use the solutions we create. When we remove or change some = technology, we should try hard to provide a work around. If a work = around is not possible, we need to cleanly document how these changes = are going to impact the market so it can prepare. This is the = responsible and prudent thing to do in a professional organization like = the IETF. 

The = draft that Nancy and others have worked on is a great start to = documenting how these new solutions are going to impact organizational = networks. Regardless of whether you like the use-cases or regulations = that some organizations have, they are valid and our new solutions are = going to impact them. 

Thanks,
Bret
PGP = Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 = 0050
"Without = cryptography vihv vivc ce xhrnrw, however, the only thing that can not = be unscrambled is an = egg."

On Jul 23, 2019, at 7:44 PM, Dennis Jackson <dennis.jackson@cs.ox.ac.uk> wrote:

=20 =20 
RFC 791  is nearly 40 years old.
RFC 4074 lists 5 forms of deviations from RFC 1034 and explains=20
the correct behavior.=20
RFC 7021 describes a series of objective tests of RFC 6333 and=20
the results.=20


The above RFCs describe objective test results and how they=20
relate to earlier RFCs. In contrast, this document offers a=20
speculative and subjective discussion of possible future impact.


I do not believe there is any precedent supporting publication.


Best,
Dennis

= --Apple-Mail=_2E0D6E08-4B31-497F-92AB-E6CBDE8F451F-- From nobody Tue Jul 23 19:03:48 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3C3F41209C1 for ; Tue, 23 Jul 2019 19:03:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=akamai.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id syBmWM0NlVFF for ; Tue, 23 Jul 2019 19:03:44 -0700 (PDT) Received: from mx0a-00190b01.pphosted.com (mx0a-00190b01.pphosted.com [IPv6:2620:100:9001:583::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CCC1512008C for ; Tue, 23 Jul 2019 19:03:44 -0700 (PDT) Received: from pps.filterd (m0050095.ppops.net [127.0.0.1]) by m0050095.ppops.net-00190b01. (8.16.0.42/8.16.0.42) with SMTP id x6O21kER030516; Wed, 24 Jul 2019 03:03:44 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=akamai.com; h=from : to : subject : date : message-id : references : in-reply-to : content-type : mime-version; s=jan2016.eng; bh=m3GXt/nlA5DC7wTDpfAkYFxbduxjPxbSoXLV6CyUGrw=; b=D9NUHagEsEZ/krIx547JOLWVWeplYLzWVXmC0ic9MnkWbl77IGA6ylKJJ5BbwY/QdWOL GwbNnLOu7c2snGSECTOeL5dnK3D3Yop6yCx2A87/2zn4JD9bcgUJ3sAjRWaA5QXpEllp Hjx2DQeyFiAKqq8Ou3fRuTpAcuLS0YBsDKTQw1gEtsGnMHHT7/wGndz+5kt+1fl+dQXh PtKvF9ovM35vWkJhAQe9JQFDgmVYpZeSFupi4bxhjSc9WNPkjOdJwAXiLn0wEndVAN8g JqLiFoadlJW+E4uiNLFT5Qxf+JG5wEELsGHez5Y8ygEKy4ZdwbqkJBENSryZTwtUwewj rw== Received: from prod-mail-ppoint1 (prod-mail-ppoint1.akamai.com [184.51.33.18] (may be forged)) by m0050095.ppops.net-00190b01. with ESMTP id 2tx60t1t9g-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 24 Jul 2019 03:03:43 +0100 Received: from pps.filterd (prod-mail-ppoint1.akamai.com [127.0.0.1]) by prod-mail-ppoint1.akamai.com (8.16.0.27/8.16.0.27) with SMTP id x6O22cWU002290; Tue, 23 Jul 2019 22:03:42 -0400 Received: from email.msg.corp.akamai.com ([172.27.123.34]) by prod-mail-ppoint1.akamai.com with ESMTP id 2tx62xt338-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Tue, 23 Jul 2019 22:03:42 -0400 Received: from USMA1EX-DAG1MB1.msg.corp.akamai.com (172.27.123.101) by usma1ex-dag1mb6.msg.corp.akamai.com (172.27.123.65) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Tue, 23 Jul 2019 22:03:41 -0400 Received: from USMA1EX-DAG1MB1.msg.corp.akamai.com ([172.27.123.101]) by usma1ex-dag1mb1.msg.corp.akamai.com ([172.27.123.101]) with mapi id 15.00.1473.005; Tue, 23 Jul 2019 22:03:41 -0400 From: "Salz, Rich" To: Bret Jordan , "" Thread-Topic: [TLS] TLS Impact on Network Security draft updated Thread-Index: AQHVQbCMovYBmAyQbUu5TybMCHUv66bZRUwA//+/WoA= Date: Wed, 24 Jul 2019 02:03:41 +0000 Message-ID: References: <51f39225-1953-b603-bd15-bbc7d4bf2222@cs.ox.ac.uk> <1300C2AB-ACCD-4F29-96CF-D27A6737A799@gmail.com> In-Reply-To: <1300C2AB-ACCD-4F29-96CF-D27A6737A799@gmail.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.1b.0.190715 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [172.19.36.156] Content-Type: multipart/alternative; boundary="_000_A746078F21254E558998A80A537086A0akamaicom_" MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-07-24_01:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 mlxscore=0 mlxlogscore=745 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1906280000 definitions=main-1907240021 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:5.22.84,1.0.8 definitions=2019-07-24_01:2019-07-23,2019-07-24 signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 phishscore=0 spamscore=0 adultscore=0 lowpriorityscore=0 impostorscore=0 priorityscore=1501 mlxlogscore=723 bulkscore=0 clxscore=1015 mlxscore=0 malwarescore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-1906280000 definitions=main-1907240021 Archived-At: Subject: Re: [TLS] TLS Impact on Network Security draft updated X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 02:03:46 -0000 --_000_A746078F21254E558998A80A537086A0akamaicom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SSByZXBlYXQgbXkgcXVlc3Rpb246IFdoYXQgZG9lcyBpdCBzYXkgdGhhdCBSRkMgODQwNCBkb2Vz buKAmXQ/DQoNCg== --_000_A746078F21254E558998A80A537086A0akamaicom_ Content-Type: text/html; charset="utf-8" Content-ID: <035A9EF29D0A1C499043DF4921B09E5D@akamai.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2 IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToy IDE1IDUgMiAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNvbnNvbGFz Ow0KCXBhbm9zZS0xOjIgMTEgNiA5IDIgMiA0IDMgMiA0O30NCi8qIFN0eWxlIERlZmluaXRpb25z ICovDQpwLk1zb05vcm1hbCwgbGkuTXNvTm9ybWFsLCBkaXYuTXNvTm9ybWFsDQoJe21hcmdpbjow aW47DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMS4wcHQ7DQoJZm9udC1m YW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0KYTpsaW5rLCBzcGFuLk1zb0h5cGVybGluaw0K CXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6Ymx1ZTsNCgl0ZXh0LWRlY29yYXRpb246 dW5kZXJsaW5lO30NCmE6dmlzaXRlZCwgc3Bhbi5Nc29IeXBlcmxpbmtGb2xsb3dlZA0KCXttc28t c3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6cHVycGxlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRl cmxpbmU7fQ0KcHJlDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgltc28tc3R5bGUtbGluazoi SFRNTCBQcmVmb3JtYXR0ZWQgQ2hhciI7DQoJbWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4w MDAxcHQ7DQoJZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseToiQ291cmllciBOZXciO30N CnAubXNvbm9ybWFsMCwgbGkubXNvbm9ybWFsMCwgZGl2Lm1zb25vcm1hbDANCgl7bXNvLXN0eWxl LW5hbWU6bXNvbm9ybWFsOw0KCW1zby1tYXJnaW4tdG9wLWFsdDphdXRvOw0KCW1hcmdpbi1yaWdo dDowaW47DQoJbXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87DQoJbWFyZ2luLWxlZnQ6MGluOw0K CWZvbnQtc2l6ZToxMS4wcHQ7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0K c3Bhbi5hcHBsZS1zdHlsZS1zcGFuDQoJe21zby1zdHlsZS1uYW1lOmFwcGxlLXN0eWxlLXNwYW47 fQ0Kc3Bhbi5IVE1MUHJlZm9ybWF0dGVkQ2hhcg0KCXttc28tc3R5bGUtbmFtZToiSFRNTCBQcmVm b3JtYXR0ZWQgQ2hhciI7DQoJbXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCW1zby1zdHlsZS1saW5r OiJIVE1MIFByZWZvcm1hdHRlZCI7DQoJZm9udC1mYW1pbHk6Q29uc29sYXM7fQ0Kc3Bhbi5FbWFp bFN0eWxlMjENCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwtcmVwbHk7DQoJZm9udC1mYW1pbHk6 IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6d2luZG93dGV4dDt9DQouTXNvQ2hwRGVmYXVs dA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LXNpemU6MTAuMHB0O30NCkBw YWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjguNWluIDExLjBpbjsNCgltYXJnaW46MS4waW4gMS4w aW4gMS4waW4gMS4waW47fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9 DQotLT48L3N0eWxlPg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0iRU4tVVMiIGxpbms9ImJsdWUiIHZs aW5rPSJwdXJwbGUiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPkkgcmVwZWF0IG15IHF1ZXN0aW9uOiA8c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPldo YXQgZG9lcyBpdCBzYXkgdGhhdCBSRkMgODQwNCBkb2VzbuKAmXQ/PC9zcGFuPjxvOnA+PC9vOnA+ PC9wPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpw PjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_A746078F21254E558998A80A537086A0akamaicom_-- From nobody Tue Jul 23 19:35:54 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C4620120823 for ; Tue, 23 Jul 2019 19:35:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pPErD29564x5 for ; Tue, 23 Jul 2019 19:35:50 -0700 (PDT) Received: from relay11.mail.ox.ac.uk (relay11.mail.ox.ac.uk [129.67.1.162]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 014B7120074 for ; Tue, 23 Jul 2019 19:35:49 -0700 (PDT) Received: from smtp6.mail.ox.ac.uk ([163.1.2.206]) by relay11.mail.ox.ac.uk with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.89) (envelope-from ) id 1hq787-0006Gt-bL; Wed, 24 Jul 2019 03:35:47 +0100 Received: from 61.ip-51-38-113.eu ([51.38.113.61] helo=[192.168.2.2]) by smtp6.mail.ox.ac.uk with esmtpsa (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.89) (envelope-from ) id 1hq786-0000nJ-LZ; Wed, 24 Jul 2019 03:35:46 +0100 From: Dennis Jackson To: Bret Jordan References: <51f39225-1953-b603-bd15-bbc7d4bf2222@cs.ox.ac.uk> <1300C2AB-ACCD-4F29-96CF-D27A6737A799@gmail.com> Cc: "tls@ietf.org" Openpgp: preference=signencrypt Autocrypt: addr=dennis.jackson@cs.ox.ac.uk; prefer-encrypt=mutual; keydata= mQINBFbAmb8BEADCLixsrAJyvknI95ZIZNVeDJbYvldeXpw7iyhrdUdRK69USU5S9EESulYh k1KlxDB5VfG8CCA/WzG1IonONdXmgLFa1NcmdVvkFjbXf5mbGYG+9pTkieM+UHikniAizIOi ibdTWEEc2opOAvpVypek4SSsfCoXfXqj0j5AXSapHiVzhhWuaXhKVuFdLtYwJDU/x0FXgStm erFMIOeZ5FLFnjkkNyEa1t3XCcf7bfgw8J86UmWzgkVLmtBYbDK0ZAFjtFep5Kps11iTDIa3 xYXzuqgkWwkg7b1mhn5gQUl/kKZqQbuG+Sk+BydjH8e1PJkO6p2eAprO0AoucRuuBl1pmg/F bf/WJC6/XD3AV87ERAdXbb9cH+vrRT8GpiNX5r+7OuXavc3/LNU9stqsdshXwdZlDyPyDIG2 Llj6hB4eS0tEpat3otcPDkXUjXjyOUQ6jKTNSZ+xTBtVTXznflDCGdn9GV0q+4ZbdRZ5tfXM DXM+uMqVxjvh2IjCrka7zf1rRWg1WZu+NrzAUrvPMPddDJfd8JNrIcvV+DIBxPVsUTJLEGt9 PW8LkQb5FrG7T6a813JYNoAtL4w7296UYmUpV1Kvv8otO+uH860x5Ci83ZCXb7gKr9Rankn5 Jcg+shWnDFgSq6uM/u3MmyRV2iw7aCSgcgfy4EPTojJdy3KjzQARAQABtCtEZW5uaXMgSmFj a3NvbiA8ZGVubmlzLmphY2tzb25AY3Mub3guYWMudWs+iQIwBBMBCgAaBAsJCAcCFQoCFgEC GQAFglsIFtUCngECmwMACgkQYQWndYzSRqzvkA//djyyIydK5jhxNFqmMvJTkTZwawKWV7Tc cEntsIwYsHw8ec9Edo/M6fwp8aFmddPnzRo0EBmh6KNm887VxgH0FXmcR7k8bD3qUzIhfq11 4ezWtTk0nWjpieEsFb20lCMZjK9dsfXVRgFrfe00x2lhjPWQ5G5mTkfX8KYcDs5nmc+13qHK Ux6e6aSdEa4mnxrT0NsEg2H2xKgwrGkNIxJO6snrh3A3mT6+2F8ZCiRWwmOhcHBzNCFp1enR bMJpNRhcmGBDNJ9TpnQHDRVE67ds3PC/vKDkYQ3tEIkdgc/KVGOo7+kZxSU/n1gARDZ4PYUw IGOM81aEhmrbXoF33Jbic2jnuLfqsC8uXeP6wGgGpEdGThQ+7zslOPDradgDZBlUmYenuwOb JwJEj+JbbZPcND17VrgVDzcM1rh1w9wcKrRDMIw/zLCpEDOfLRe2ad/V380q/Eh3qa4QrZE7 tnXcOTIZfxd1zZ6TcpOvMVYQPN5Zfrlazmw9bTsdkm3WVrzvxc9DJ/D5Ws+aMu+JfSD+C5Nd n5w2fW7OOiDudeFXj88CL7oBehPJ2ajCDmHd/vc1W7CSoPte6aHBgSGER9cWm5hpEOXacQt+ pEz/uMvq+zkDIydy9YL/8hDo5TsVA4Yo8wNdKOuyaStk/oh3WNda05N0jr8VhRMdxnLN/hWY Ely5Ag0EVsCZvwEQAOBD1BmNy7FWbpg9Tm3OfMNC/yLs6G7rk3OFw7BhpjHXHSsEge48HbvP lfdR9abA1cmbgYR7EyaOav1s9ugU7EtDCcK8zHZcaUg3gC+FdjsnkIQCkf/3HK2sxcbBSrkX 2Uu2jjufvZu10g/aavkCuTHIUiYAHhQU5kCkRI7NYvXIKmaPY2Km3YIVJ50x+4GlE/WVZk8w HpvisxDInBioziUjAIqTt0at5tE1ObZksl2eNHNCwlo15WE2hKIYCuJKb57wCBKaOKo/gSw/ yN2DX3HaU/PF+8rCikkKDhHDrefFwGkqBf3zHlrLiHIr+ONVZ8i9dxMyg5TERxjd3vZ4ha+7 8cr8G83HC8lSBEpPYmoeU4J8vWf8kjBlai0UmzyZRF3SeZlqldxo7zJhYq3xIsDGKVuSCn68 2TcoEsR5WS/Zjc0ZoH/YIpdVy8FRu45dJ2IUzHVyszMfNWKob7ZsQ9JCXiXypmIF6ut5mwv8 ddCMdG6Jdpvg1fr0coABNbJSrUM8uFEldmRFpBdbNx5xSCJjNo+QuTHOXWuO3/GFRmux8/kW TlfF3+dvff2Pw3CKENoysgcOflYShcjOv/03sQ6AfxTm2Jnh5dqJSoVnPWpcDyPqn3k4zoZW 0ISqorI8yehJbfT3C0J5iEX75c8vJWfUUjIhyO0CpHxATNW3j3QxABEBAAGJAh8EGAEIABMF AlbAmccJEGEFp3WM0kasAhsMAAD8JhAAtkUWMLjr1RYTSMPrmTp3NGZfNSblv0GGHtL7TvT1 kFwdT/hs29Gjrj0FffZE6RKDEGls9AL6LY/g3wA5WQsXaK0wqwb8MBeIPWvFPvVQbqrifN3A bpukTl4OCBOwJbHS/GO1V3AwaLl4l3U/+kzR7UsnszWs4kizE9lBJ0AYFbxB0xbPF6iI32Cm K3nrLPfkXBXw2xX01nOLxTx9E7YdVpP3Re1c96aBTflm4CAGUfTZ5xgQMW6rgJ8FBc3oLckt 9MT0qB5XkmKGI1kkRypN7hIFRBcPxegeO8S3fpBUOop5F0el24TVx6KJTktpLmlIfUsEQ0Lx CqNtUk1v3eMCoKmeky8WbFcUArRV4DKXDAK1e3C8poMaehRgfl8sjz6SuH1VXpCMLNPpNMtZ EK4FU+C0jGgJyHS9N1UZjq8Qa8FnYKruyPgTpKEAsqlo5vB6J8phiaKXxnren8HqIfzQdrt8 3M+raXc7+Fqis4pYS49vfIpxUzcqvKUiSgDGKemqMw9w9U5dBEQeLNW08uOKSjyENU4e1Ob/ IiimIpEPA5LEIhSfOP9CN9TculGqvo0g12XnB+g5AAtm1ohMkb33T17IR3rKkhlvIITuY1qi fZz7OgGbXh4G5oUHXNBOhXHaqRIzQCCRbBUFA09OyJBLWAGH6HcM/DeM0I7Ng55uMl8= Message-ID: <8f95317e-880d-f064-49a1-e51945b06b29@cs.ox.ac.uk> Date: Wed, 24 Jul 2019 03:35:43 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.7.1 MIME-Version: 1.0 In-Reply-To: <1300C2AB-ACCD-4F29-96CF-D27A6737A799@gmail.com> Content-Type: text/plain; charset=windows-1252 Content-Language: en-US Content-Transfer-Encoding: 8bit X-Oxford-Username: exet4027 Archived-At: Subject: Re: [TLS] TLS Impact on Network Security draft updated X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 02:35:53 -0000 On 24/07/2019 02:55, Bret Jordan wrote: > As a professional organization and part of due diligence, we need to try > and understand the risks and ramifications on the deployments of our > solutions. This means, understanding exactly how the market uses and > needs to use the solutions we create. When we remove or change some > technology, we should try hard to provide a work around. If a work > around is not possible, we need to cleanly document how these changes > are going to impact the market so it can prepare. This is the > responsible and prudent thing to do in a professional organization like > the IETF. > The IETF is for development of Internet Standards. If you want to publish your (subjective) analysis of how a particular standard is going to impact your market segment, there are any number of better venues: trade magazines, industry associations, your company website, etc. > The draft that Nancy and others have worked on is a great start to > documenting how these new solutions are going to impact organizational > networks. Regardless of whether you like the use-cases or regulations > that some organizations have, they are valid and our new solutions are > going to impact them. This isn't a question of quality. The IETF simply doesn't publish documents of this nature (to my knowledge). > Thanks, > Bret > PGP Fingerprint:63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 > "Without cryptography vihv vivc ce xhrnrw, however, the only thing that > can not be unscrambled is an egg." Best, Dennis >> On Jul 23, 2019, at 7:44 PM, Dennis Jackson >> > wrote: >> >> RFC 791 is nearly 40 years old. >> RFC 4074 lists 5 forms of deviations from RFC 1034 and explains >> the correct behavior. >> RFC 7021 describes a series of objective tests of RFC 6333 and >> the results. >> >> >> The above RFCs describe objective test results and how they >> relate to earlier RFCs. In contrast, this document offers a >> speculative and subjective discussion of possible future impact. >> >> >> I do not believe there is any precedent supporting publication. >> >> >> Best, >> Dennis > > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > From nobody Tue Jul 23 20:13:54 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3339012008F for ; Tue, 23 Jul 2019 20:13:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=akamai.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Kca5B3oPIp8V for ; Tue, 23 Jul 2019 20:13:49 -0700 (PDT) Received: from mx0a-00190b01.pphosted.com (mx0a-00190b01.pphosted.com [IPv6:2620:100:9001:583::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A9246120046 for ; Tue, 23 Jul 2019 20:13:49 -0700 (PDT) Received: from pps.filterd (m0122332.ppops.net [127.0.0.1]) by mx0a-00190b01.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id x6O373ZL013489; Wed, 24 Jul 2019 04:13:47 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=akamai.com; h=date : from : to : cc : subject : message-id : references : mime-version : content-type : content-transfer-encoding : in-reply-to; s=jan2016.eng; bh=MC+Q59qqMJGJweHaT7hr+w9iCjuOa+Qb7N/u1hkEa2M=; b=QKsGPfsvICNRsMgJmJ9OCQLgksePNa4AzKxU6zu0P4596oIktpFsv6eYmiaFnHDwevl3 TqwjMPJ0sPb3b4Eyzh4Cu4kthNznFYqgdQOh3N01Yhih7K3AzMNtVOu1iJwN84zGISVb 4/9x6vZLtfRauTDNoLimfC1DxAxswtD/mHI+R1txF/4Ejq9O0gJTvkJlRqGCa6L7m7Yn digtCOHW+fGfzJfikX2JW0ERWf8WSCGqBV6Hmam9ZifzQ6FlUAy8IpdvJUYzvz8Y4bJv 2uCi+uzJJ6bJsYLSsgUlCRp09IS7oXcdhM1wT7UwT6weS/O3FQ4+NYmtWtK6TxXYT9fQ 9g== Received: from prod-mail-ppoint6 (prod-mail-ppoint6.akamai.com [184.51.33.61] (may be forged)) by mx0a-00190b01.pphosted.com with ESMTP id 2tx60rsx1c-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 24 Jul 2019 04:13:47 +0100 Received: from pps.filterd (prod-mail-ppoint6.akamai.com [127.0.0.1]) by prod-mail-ppoint6.akamai.com (8.16.0.27/8.16.0.27) with SMTP id x6O325Dg008159; Tue, 23 Jul 2019 23:13:45 -0400 Received: from prod-mail-relay10.akamai.com ([172.27.118.251]) by prod-mail-ppoint6.akamai.com with ESMTP id 2tx62y0fmd-1; Tue, 23 Jul 2019 23:13:45 -0400 Received: from bos-lpczi.kendall.corp.akamai.com (bos-lpczi.kendall.corp.akamai.com [172.19.17.86]) by prod-mail-relay10.akamai.com (Postfix) with ESMTP id A42511FCDD; Wed, 24 Jul 2019 03:13:45 +0000 (GMT) Received: from bkaduk by bos-lpczi.kendall.corp.akamai.com with local (Exim 4.86_2) (envelope-from ) id 1hq7iq-00010Z-GV; Tue, 23 Jul 2019 22:13:44 -0500 Date: Tue, 23 Jul 2019 22:13:44 -0500 From: Benjamin Kaduk To: Dennis Jackson Cc: "tls@ietf.org" Message-ID: <20190724031343.GD27936@akamai.com> References: <51f39225-1953-b603-bd15-bbc7d4bf2222@cs.ox.ac.uk> <1300C2AB-ACCD-4F29-96CF-D27A6737A799@gmail.com> <8f95317e-880d-f064-49a1-e51945b06b29@cs.ox.ac.uk> MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <8f95317e-880d-f064-49a1-e51945b06b29@cs.ox.ac.uk> User-Agent: Mutt/1.5.24 (2015-08-30) X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-07-24_01:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 mlxscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1906280000 definitions=main-1907240034 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:5.22.84,1.0.8 definitions=2019-07-24_01:2019-07-23,2019-07-24 signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 adultscore=0 mlxlogscore=999 mlxscore=0 priorityscore=1501 impostorscore=0 bulkscore=0 clxscore=1011 spamscore=0 lowpriorityscore=0 malwarescore=0 phishscore=0 suspectscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-1906280000 definitions=main-1907240035 Archived-At: Subject: Re: [TLS] TLS Impact on Network Security draft updated X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 03:13:51 -0000 On Wed, Jul 24, 2019 at 03:35:43AM +0100, Dennis Jackson wrote: > On 24/07/2019 02:55, Bret Jordan wrote: > > As a professional organization and part of due diligence, we need to try > > and understand the risks and ramifications on the deployments of our > > solutions. This means, understanding exactly how the market uses and > > needs to use the solutions we create. When we remove or change some > > technology, we should try hard to provide a work around. If a work > > around is not possible, we need to cleanly document how these changes > > are going to impact the market so it can prepare. This is the > > responsible and prudent thing to do in a professional organization like > > the IETF. > > > > The IETF is for development of Internet Standards. If you want to > publish your (subjective) analysis of how a particular standard is going > to impact your market segment, there are any number of better venues: > trade magazines, industry associations, your company website, etc. Actually, the Independent stream of the RFC series is purpose-built for individual commentary on the consequences of a particular standard [including in a particular segment], and would be superior (at least in my opinion) to any of the venues you list. (See RFC 4846.) But I believe the current ISE asks authors to try fairly hard to publish their work in the IETF before accepting it to the Indepndent stream. > > The draft that Nancy and others have worked on is a great start to > > documenting how these new solutions are going to impact organizational > > networks. Regardless of whether you like the use-cases or regulations > > that some organizations have, they are valid and our new solutions are > > going to impact them. > > This isn't a question of quality. The IETF simply doesn't publish > documents of this nature (to my knowledge). The IETF can publish whatever there is IETF consensus to publish. (And a little bit more, besides, though that is probably not relevant to the current discussion.) I don't have a great sense of what you mean by "documents of this nature". If you were to say "the IETF does not publish speculative and subjective discussion of possible future impact", I'd be fairly likely to agree with you (but I have also seen a fair bit of speculation get published). I'd feel rather differently about "the IETF does not publish objective analysis of the consequences of protocol changes on previously deployed configurations", and would ask if you think a document in the latter category is impossible for the TLS 1.2->1.3 transition. (My understanding is that the latter category of document is the desired proposal, regardless of the current state of the draft in question.) -Ben From nobody Tue Jul 23 20:17:51 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 82CA912008A for ; Tue, 23 Jul 2019 20:17:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); domainkeys=pass (1024-bit key) header.from=MAckermann@bcbsm.com header.d=bcbsm.com; dkim=pass (1024-bit key) header.d=bcbsm.com header.b=bWZukGZ3; dkim=fail (1024-bit key) reason="fail (body has been altered)" header.d=bcbsm.onmicrosoft.com header.b=URs884EH Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id E2ETkNIteFki for ; Tue, 23 Jul 2019 20:17:48 -0700 (PDT) Received: from mx.z120.zixworks.com (bcbsm.zixworks.com [199.30.235.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2B90E120046 for ; Tue, 23 Jul 2019 20:17:48 -0700 (PDT) Received: from 127.0.0.1 (ZixVPM [127.0.0.1]) by Outbound.z120.zixworks.com (Proprietary) with SMTP id 62EB41C464A for ; Tue, 23 Jul 2019 22:17:47 -0500 (CDT) DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=ZIXVPM1670e2ded26; d=bcbsm.com; h=From:To:Subject:Date; b=ZpS6Pgb9Yx0ueK5Xu7XTzXQklxCLitaXTJhl+5mA4Bd9yJKpAUw9foZfuizv/kSz 8fC2G3c/E0JgGnjVCidlbxS3CCZu571KuxqoGCTQd0Zixj7A/w+0pxyl1mww0H jCV04cTyAn1DiUtIy1tR58lC7FPQVMs6NIQPQcg9mZL2Q=; DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bcbsm.com; s=ZIXVPM1670e2ded26; t=1563938267; bh=Ri4ok9iUxxuE5vc2i26r+mvGny1cdJHPVeftmU6bZYw=; h=From:To:Subject:Date; b=bWZukGZ32UUVVWgjMdVOAbtivCW1ZSfEvVPh8Rkm5VZ1WAzU9AAgdzjloLS+a2uqY GIOSRus8jhFrWDXwAmy6JWpkveXndGRlVEoTpsHOALaEOgWvJC5LE4Q1d2JeErmiCA pWpPHI6RV3nyV/uha3IyCtLuZeJ/ALmEV8WoRQhw= Received: from imsva2.bcbsm.com (inetmta04.bcbsm.com [12.107.172.81]) by mx.z120.zixworks.com (Proprietary) with SMTP id 171FC1C4646; Tue, 23 Jul 2019 22:17:46 -0500 (CDT) Received: from imsva2.bcbsm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id D0E2EFE04E; Tue, 23 Jul 2019 23:17:45 -0400 (EDT) Received: from imsva2.bcbsm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 866D9FE055; Tue, 23 Jul 2019 23:17:45 -0400 (EDT) Received: from NAM05-BY2-obe.outbound.protection.outlook.com (unknown [104.47.50.57]) by imsva2.bcbsm.com (Postfix) with ESMTPS; Tue, 23 Jul 2019 23:17:45 -0400 (EDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=nYWRFMxVDWhRe4n+JFmQX5GaUnObH5lC+el3ffkhfN9tyQADw4oJ0sdzcZRUdx+p1fRN1MjfnTKDU3hwTZtTQ2qrjbmKApPKTZ47ye4f9ZNVrrIUZOoUpCeOQjPNY8uifZXsiOHaZcZZsffx5BN029TJNEWRC7gz609I3Q/OA3W+UnzxzYu6seEdC0dQc2b/1mA10iIPp/lMSC5W4vDj5//1XJ59E/G6f03pl1NCy7AfFAHQVDngH5xTxP5B9GbEsORuKk3GgIpwWqSwINqxcdvWXmbhYdRbtv9s8IM033u5UvBk/JJPW2b8cNiv5GA0B6CqNXMpEzRaz1ITtC5GMg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=pQu2QjY3HSYh5Oyvrj6ibrb0EmBo03nCsFHZc+FsbX0=; b=IV3omwzt/Nt/vSooxo/JGEnW2837clVLCk7isCn8YTFFi5FmJY+441wZ5CdvIK2GI+qTkvU7nvxcTQK0gbiB4Zl5iflGWL9KkagTYNWY1d2LUlIXw/DViqSt3gxdB5Apm2QR5wWPpLBnReNRERGVHOVsAFapIUdzvjy9TP2wPpD3G+3T9Uza68Ksb8hYIFuGejJSZFu0s8rjWN84WCbLfNa5KQsoqzwQaX1X8xVaZx10U3Ch7HKtvBBreZgqDF118dRHcEp794GHTq+JBWjH7NpBbTGju7lT6HBhzHJCFySTEadozHM2MbDn4F7N+MXVYOnL+ahefxW2PUNOBYHCJA== ARC-Authentication-Results: i=1; mx.microsoft.com 1;spf=pass smtp.mailfrom=bcbsm.com;dmarc=pass action=none header.from=bcbsm.com;dkim=pass header.d=bcbsm.com;arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bcbsm.onmicrosoft.com; s=selector1-bcbsm-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=pQu2QjY3HSYh5Oyvrj6ibrb0EmBo03nCsFHZc+FsbX0=; b=URs884EHnS7cdgaif2kBU17agz2OzsFvx4TIFhs+8LuOYLMj5xY3fN9dv4qguoJ5EibR+V+a7+PvSxQfScxubmlF1RMoJvunOdPtctpap2pnHynkKI8dvZkoYAT9u6joP5C2p0uismPnXotS2GPN280FoKVoQOQGwB4d7qRx/SY= Received: from DM6PR14MB2474.namprd14.prod.outlook.com (20.177.221.205) by DM6PR14MB2540.namprd14.prod.outlook.com (20.178.30.21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2115.10; Wed, 24 Jul 2019 03:17:38 +0000 Received: from DM6PR14MB2474.namprd14.prod.outlook.com ([fe80::168:5560:a095:93e3]) by DM6PR14MB2474.namprd14.prod.outlook.com ([fe80::168:5560:a095:93e3%7]) with mapi id 15.20.2094.013; Wed, 24 Jul 2019 03:17:38 +0000 From: "Ackermann, Michael" To: Watson Ladd , Filippo Valsorda CC: TLS List Thread-Topic: [TLS] TLS Impact on Network Security draft updated Thread-Index: AQHVP8tnovYBmAyQbUu5TybMCHUv66bY0WiAgAADLgCAAEc1gA== Date: Wed, 24 Jul 2019 03:17:37 +0000 Message-ID: References: <6AF48228-19C2-41C7-BA86-BA16940C3CFF@cisco.com> <77d58a41-7a6b-4886-a4d4-22dcb229100b@www.fastmail.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=MAckermann@bcbsm.com; x-originating-ip: [165.225.39.74] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 11cb08c5-9582-4f08-76a7-08d70fe57b2f x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(5600148)(711020)(4605104)(1401327)(4534185)(7168020)(4627221)(201703031133081)(201702281549075)(8990200)(2017052603328)(7167020)(7193020); SRVR:DM6PR14MB2540; x-ms-traffictypediagnostic: DM6PR14MB2540: x-ms-exchange-purlcount: 2 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-forefront-prvs: 0108A997B2 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(396003)(376002)(366004)(136003)(346002)(39860400002)(199004)(189003)(478600001)(11346002)(7696005)(446003)(52536014)(26005)(256004)(110136005)(790700001)(74316002)(14444005)(476003)(6116002)(4326008)(486006)(5024004)(3846002)(66066001)(316002)(186003)(8676002)(33656002)(81166006)(81156014)(2420400007)(55236004)(99286004)(6306002)(71200400001)(53546011)(66946007)(71190400001)(76116006)(86362001)(9686003)(54896002)(8936002)(6506007)(66446008)(66476007)(64756008)(66556008)(53936002)(6436002)(55016002)(6246003)(68736007)(25786009)(7110500001)(15650500001)(5660300002)(236005)(80792005)(14454004)(2906002)(7736002)(76176011)(229853002)(102836004); DIR:OUT; SFP:1102; SCL:1; SRVR:DM6PR14MB2540; H:DM6PR14MB2474.namprd14.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: bcbsm.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: nSi6mRDGdULU6hlhimXwd/bgTtaUxtfPRrHt/lfG/vN6O1NykPwLnrIvLPBkH76at9rjrOcvi5mTKOmRfK1pqtqBPQ2hMFm5HUgdPeu4WrCjLB7Q9PWm8V/51FI894bkCXu56CKsLnHwo3Pe8p+qI3v9l4Eb3KGpgIcrdjymBvEBx1v3tFr0q/5z981qIrfnB53QUDWl48kDuw/JdUvX34P/GsO+ewZcg4MI1o0vPcTC/My1mKoRlgNrjcbmXjbx/L2ohaM8FPLaG4ea0nU7fbwFWyddAySRkA35R8gFX5Nv+QslEov6JRSZNV4ZRQwsQPCVG8eaVzeg/A8U+6ZxAh26Rsg11V5zDssBJWcckej/+/V2DJjpP1qaxc6M96TzVRBaOTt5TE3uAVCbKd2nSZe4f6rFq+m/3Ne32UcmUSo= Content-Type: multipart/alternative; boundary="_000_DM6PR14MB24745D7DDD5F1503387A7694D7C60DM6PR14MB2474namp_" MIME-Version: 1.0 X-OriginatorOrg: bcbsm.com X-MS-Exchange-CrossTenant-Network-Message-Id: 11cb08c5-9582-4f08-76a7-08d70fe57b2f X-MS-Exchange-CrossTenant-originalarrivaltime: 24 Jul 2019 03:17:38.0362 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 6f56d3fa-5682-4261-b169-bc0d615da17c X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: MAckermann@bcbsm.com X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR14MB2540 X-TM-AS-GCONF: 00 X-VPM-HOST: vmvpm01.z120.zixworks.com X-VPM-GROUP-ID: 71daa57b-8dd6-4262-8f05-019fdb0a8c8e X-VPM-MSG-ID: 1adc64d9-629f-480b-af97-3be8aad34729 X-VPM-ENC-REGIME: Plaintext X-VPM-IS-HYBRID: 0 Archived-At: Subject: Re: [TLS] TLS Impact on Network Security draft updated X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 03:17:51 -0000 --_000_DM6PR14MB24745D7DDD5F1503387A7694D7C60DM6PR14MB2474namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 VGhpcyBzaG91bGQgbm90IGJlIGRpc21pc3NlZCBhcyBzbWFsbCBzZWdtZW50cyBvZiBpbmR1 c3RyaWVzLiAgICBUaGlzIHJlcHJlc2VudHMgdWJpcXVpdG91cyB1c2UgY2FzZXMgYXQgYWxs IGxhcmdlIG9yZ2FuaXphdGlvbnMgaW4gSW5zdXJhbmNlLCBIZWFsdGggQ2FyZSwgQmFua2lu ZywgQXV0b21vdGl2ZSBhbmQgbWFueSBvdGhlcnMuDQpXZSBhcyB0aGUgSUVURiBzaG91bGQg bm90IGxpZ2h0bHkgZGlzbWlzcyBzdWNoIHNpZ25pZmljYW50IG51bWJlcnMgYW5kIHZvbHVt ZSwgZXZlbiAob3IgZXNwZWNpYWxseSksICBpZiB0aGUgYW5zd2VycyBhcmUgbm90IGVhc3kg b25lcy4gICAgRG8gd2UgcmVhbGx5IHdhbnQgcmVsYXRlZCBzb2x1dGlvbnMgdG8gYmUgZGV2 ZWxvcGVkIGVsc2V3aGVyZT8NCg0KRnJvbTogVExTIDx0bHMtYm91bmNlc0BpZXRmLm9yZz4g T24gQmVoYWxmIE9mIFdhdHNvbiBMYWRkDQpTZW50OiBUdWVzZGF5LCBKdWx5IDIzLCAyMDE5 IDY6NTggUE0NClRvOiBGaWxpcHBvIFZhbHNvcmRhIDxmaWxpcHBvQG1sLmZpbGlwcG8uaW8+ DQpDYzogVExTIExpc3QgPHRsc0BpZXRmLm9yZz4NClN1YmplY3Q6IFJlOiBbVExTXSBUTFMg SW1wYWN0IG9uIE5ldHdvcmsgU2VjdXJpdHkgZHJhZnQgdXBkYXRlZA0KDQogQUxFUlQgVGhp cyBlbWFpbCB3YXMgc2VudCBmcm9tIGEgc291cmNlIGV4dGVybmFsIHRvIEJDQlNNL0JDTi4N CiBETyBOT1QgQ0xJQ0sgbGlua3Mgb3IgYXR0YWNobWVudHMgdW5sZXNzIHlvdSByZWNvZ25p emUgdGhlIHNlbmRlciBhbmQgdHJ1c3QgdGhlIGNvbnRlbnQuDQoNCg0KT24gVHVlLCBKdWwg MjMsIDIwMTksIDM6NDcgUE0gRmlsaXBwbyBWYWxzb3JkYSA8ZmlsaXBwb0BtbC5maWxpcHBv LmlvPG1haWx0bzpmaWxpcHBvQG1sLmZpbGlwcG8uaW8+PiB3cm90ZToNCkJlZm9yZSBhbnkg dGVjaG5pY2FsIG9yIHdvcmRpbmcgZmVlZGJhY2ssIEkgYW0gY29uZnVzZWQgYXMgdG8gdGhl IG5hdHVyZSBvZiB0aGlzIGRvY3VtZW50LiBJdCBkb2VzIG5vdCBzZWVtIHRvIHNwZWNpZnkg YW55IHByb3RvY29sIGNoYW5nZSBvciBtZWNoYW5pc20sIGFuZCBpdCBkb2VzIG5vdCBldmVu IGZvY3VzIG9uIHNvbHV0aW9ucyB0byBtb3ZlIHRoZSB3ZWIgZnVydGhlci4NCg0KSW5zdGVh ZCwgaXQgbG9va3MgbGlrZSBhIHdlbGwgZWRpdGVkIGJsb2cgcG9zdCwgcHJlc2VudGluZyB0 aGUgcGVyc3BlY3RpdmUgb2Ygb25lIHNlZ21lbnQgb2YgdGhlIGluZHVzdHJ5LiAoVGhlIHBl cnNwZWN0aXZlIHNlZW1zIHRvIGFsc28gbGFjayBjb25zZW5zdXMsIGJ1dCBJIGJlbGlldmUg ZXZlbiB0aGF0IGlzIHNlY29uZGFyeS4pIE5vdGUgaG93IGFzIG9mIGRyYWZ0LWNhbXdpbmdl dC10bHMtdXNlLWNhc2VzLTA1IHRoZXJlIGFyZSBubyBJQU5BIGNvbnNpZGVyYXRpb25zLCBu byBzZWN1cml0eSBjb25zaWRlcmF0aW9ucywgYW5kIG5vIG9jY3VycmVuY2VzIG9mIGFueSBv ZiB0aGUgQkNQIDE0IGtleSB3b3JkcyAoTVVTVCwgU0hPVUxELCBldGMuKS4NCg0KSXMgdGhl cmUgcHJlY2VkZW50IGZvciBwdWJsaXNoaW5nIHN1Y2ggYSBkb2N1bWVudCBhcyBhbiBSRkM/ DQoNCkkgd2FzIGdvaW5nIHRvIHNheSBSRkMgNjkxIGJ1dCBubywgaXQgcmVjb21tZW5kcyBj aGFuZ2VzIHRvIHRoZSBwcm90b2NvbCAoYXMgd2VsbCBhcyBiZWluZyBxdWl0ZSBhbXVzaW5n KS4gUkZDIDQwNzQgY29tZXMgY2xvc2UgZGVzY3JpYmluZyBiYWQgYmVoYXZpb3Igd2l0aG91 dCBhbiBleHBsaWNpdCBwbGVhIHRvIHN0b3AgZG9pbmcgaXQsIGJ1dCBoYXMgYSBzZWN1cml0 eSBjb25zaWRlcmF0aW9ucyBzZWN0aW9uLiBSRkMgNzAyMSBkZXNjcmliZXMgdGhlIGltcGFj dCBvZiBhIHBhcnRpY3VsYXIgbmV0d29ya2luZyB0ZWNobmlxdWUgb24gYXBwbGljYXRpb25z Lg0KDQpTbyB0aGVyZSBpcyBwcmVjZWRlbnQuDQoNClNpbmNlcmVseSwNCldhdHNvbg0KCgpU aGUgaW5mb3JtYXRpb24gY29udGFpbmVkIGluIHRoaXMgY29tbXVuaWNhdGlvbiBpcyBoaWdo bHkgY29uZmlkZW50aWFsIGFuZCBpcyBpbnRlbmRlZCBzb2xlbHkgZm9yIHRoZSB1c2Ugb2Yg dGhlIGluZGl2aWR1YWwocykgdG8gd2hvbSB0aGlzIGNvbW11bmljYXRpb24gaXMgZGlyZWN0 ZWQuIElmIHlvdSBhcmUgbm90IHRoZSBpbnRlbmRlZCByZWNpcGllbnQsIHlvdSBhcmUgaGVy ZWJ5IG5vdGlmaWVkIHRoYXQgYW55IHZpZXdpbmcsIGNvcHlpbmcsIGRpc2Nsb3N1cmUgb3Ig ZGlzdHJpYnV0aW9uIG9mIHRoaXMgaW5mb3JtYXRpb24gaXMgcHJvaGliaXRlZC4gUGxlYXNl IG5vdGlmeSB0aGUgc2VuZGVyLCBieSBlbGVjdHJvbmljIG1haWwgb3IgdGVsZXBob25lLCBv ZiBhbnkgdW5pbnRlbmRlZCByZWNlaXB0IGFuZCBkZWxldGUgdGhlIG9yaWdpbmFsIG1lc3Nh Z2Ugd2l0aG91dCBtYWtpbmcgYW55IGNvcGllcy4KIAogQmx1ZSBDcm9zcyBCbHVlIFNoaWVs ZCBvZiBNaWNoaWdhbiBhbmQgQmx1ZSBDYXJlIE5ldHdvcmsgb2YgTWljaGlnYW4gYXJlIG5v bnByb2ZpdCBjb3Jwb3JhdGlvbnMgYW5kIGluZGVwZW5kZW50IGxpY2Vuc2VlcyBvZiB0aGUg Qmx1ZSBDcm9zcyBhbmQgQmx1ZSBTaGllbGQgQXNzb2NpYXRpb24uCg== --_000_DM6PR14MB24745D7DDD5F1503387A7694D7C60DM6PR14MB2474namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89 InVybjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJu OnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3Nj aGVtYXMubWljcm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDov L3d3dy53My5vcmcvVFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9 IkNvbnRlbnQtVHlwZSIgY29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxt ZXRhIG5hbWU9IkdlbmVyYXRvciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRl cmVkIG1lZGl1bSkiPg0KPHN0eWxlPjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBm b250LWZhY2UNCgl7Zm9udC1mYW1pbHk6IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0 IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7 DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAyIDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlv bnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWwsIGRpdi5Nc29Ob3JtYWwNCgl7bWFy Z2luLXRvcDowaW47DQoJbWFyZ2luLXJpZ2h0OjBpbjsNCgltYXJnaW4tYm90dG9tOjguMHB0 Ow0KCW1hcmdpbi1sZWZ0OjBpbjsNCglsaW5lLWhlaWdodDoxMjAlOw0KCWZvbnQtc2l6ZTox Mi41cHQ7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0KYTpsaW5rLCBz cGFuLk1zb0h5cGVybGluaw0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6Ymx1 ZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCmE6dmlzaXRlZCwgc3Bhbi5Nc29I eXBlcmxpbmtGb2xsb3dlZA0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6cHVy cGxlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KcC5tc29ub3JtYWwwLCBsaS5t c29ub3JtYWwwLCBkaXYubXNvbm9ybWFsMA0KCXttc28tc3R5bGUtbmFtZTptc29ub3JtYWw7 DQoJbXNvLW1hcmdpbi10b3AtYWx0OmF1dG87DQoJbWFyZ2luLXJpZ2h0OjBpbjsNCgltc28t bWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzsNCgltYXJnaW4tbGVmdDowaW47DQoJZm9udC1zaXpl OjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQpzcGFuLkVt YWlsU3R5bGUxOA0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1yZXBseTsNCglmb250LWZh bWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjp3aW5kb3d0ZXh0O30NCi5Nc29D aHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0KCWZvbnQtc2l6ZTox MC4wcHQ7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6OC41aW4gMTEuMGluOw0KCW1h cmdpbjoxLjBpbiAxLjBpbiAxLjBpbiAxLjBpbjt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3Bh Z2U6V29yZFNlY3Rpb24xO30NCi0tPjwvc3R5bGU+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+ DQo8bzpzaGFwZWRlZmF1bHRzIHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2IiAvPg0KPC94 bWw+PCFbZW5kaWZdLS0+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWxheW91 dCB2OmV4dD0iZWRpdCI+DQo8bzppZG1hcCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4NCjwv bzpzaGFwZWxheW91dD48L3htbD48IVtlbmRpZl0tLT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9 IkVOLVVTIiBsaW5rPSJibHVlIiB2bGluaz0icHVycGxlIj4NCjxkaXYgY2xhc3M9IldvcmRT ZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtsaW5lLWhlaWdodDoxMjAlIj5UaGlzIHNob3VsZCBub3QgYmUgZGlzbWlzc2Vk IGFzIHNtYWxsIHNlZ21lbnRzIG9mIGluZHVzdHJpZXMuJm5ic3A7Jm5ic3A7Jm5ic3A7IFRo aXMgcmVwcmVzZW50cyB1YmlxdWl0b3VzIHVzZSBjYXNlcyBhdCBhbGwgbGFyZ2Ugb3JnYW5p emF0aW9ucyBpbiBJbnN1cmFuY2UsIEhlYWx0aCBDYXJlLCBCYW5raW5nLCBBdXRvbW90aXZl IGFuZCBtYW55IG90aGVycy4mbmJzcDsNCjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2xpbmUtaGVp Z2h0OjEyMCUiPldlIGFzIHRoZSBJRVRGIHNob3VsZCBub3QgbGlnaHRseSBkaXNtaXNzIHN1 Y2ggc2lnbmlmaWNhbnQgbnVtYmVycyBhbmQgdm9sdW1lLCBldmVuIChvciBlc3BlY2lhbGx5 KSwmbmJzcDsgaWYgdGhlIGFuc3dlcnMgYXJlIG5vdCBlYXN5IG9uZXMuJm5ic3A7Jm5ic3A7 Jm5ic3A7IERvIHdlIHJlYWxseSB3YW50IHJlbGF0ZWQgc29sdXRpb25zIHRvIGJlIGRldmVs b3BlZA0KIGVsc2V3aGVyZT8mbmJzcDsmbmJzcDsgPG86cD48L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7bGlu ZS1oZWlnaHQ6MTIwJSI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPGRpdj4NCjxk aXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0UxRTFFMSAxLjBwdDtw YWRkaW5nOjMuMHB0IDBpbiAwaW4gMGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtYXJnaW4tYm90dG9tOjBpbjttYXJnaW4tYm90dG9tOi4wMDAxcHQ7bGluZS1oZWlnaHQ6 bm9ybWFsIj4NCjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij5Gcm9tOjwvc3Bh bj48L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPiBUTFMgJmx0O3Rscy1ib3Vu Y2VzQGlldGYub3JnJmd0Ow0KPGI+T24gQmVoYWxmIE9mIDwvYj5XYXRzb24gTGFkZDxicj4N CjxiPlNlbnQ6PC9iPiBUdWVzZGF5LCBKdWx5IDIzLCAyMDE5IDY6NTggUE08YnI+DQo8Yj5U bzo8L2I+IEZpbGlwcG8gVmFsc29yZGEgJmx0O2ZpbGlwcG9AbWwuZmlsaXBwby5pbyZndDs8 YnI+DQo8Yj5DYzo8L2I+IFRMUyBMaXN0ICZsdDt0bHNAaWV0Zi5vcmcmZ3Q7PGJyPg0KPGI+ U3ViamVjdDo8L2I+IFJlOiBbVExTXSBUTFMgSW1wYWN0IG9uIE5ldHdvcmsgU2VjdXJpdHkg ZHJhZnQgdXBkYXRlZDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIGFsaWduPSJjZW50ZXIiIHN0eWxlPSJtYXJnaW4tYm90dG9tOjBpbjttYXJn aW4tYm90dG9tOi4wMDAxcHQ7dGV4dC1hbGlnbjpjZW50ZXIiPg0KPGI+PHNwYW4gc3R5bGU9 ImNvbG9yOnJlZDtiYWNrZ3JvdW5kOnllbGxvdzttc28taGlnaGxpZ2h0OnllbGxvdyI+Jm5i c3A7QUxFUlQ8L3NwYW4+PC9iPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjaztiYWNrZ3JvdW5k OnllbGxvdzttc28taGlnaGxpZ2h0OnllbGxvdyI+IFRoaXMgZW1haWwgd2FzIHNlbnQgZnJv bSBhIHNvdXJjZSBleHRlcm5hbCB0byBCQ0JTTS9CQ04uDQo8L3NwYW4+PG86cD48L286cD48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBhbGlnbj0iY2VudGVyIiBzdHlsZT0ibWFyZ2lu LWJvdHRvbTowaW47bWFyZ2luLWJvdHRvbTouMDAwMXB0O3RleHQtYWxpZ246Y2VudGVyIj4N CjxiPjxzcGFuIHN0eWxlPSJjb2xvcjpyZWQ7YmFja2dyb3VuZDp5ZWxsb3c7bXNvLWhpZ2hs aWdodDp5ZWxsb3ciPiZuYnNwO0RPIE5PVCBDTElDSzwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9 ImNvbG9yOnJlZDtiYWNrZ3JvdW5kOnllbGxvdzttc28taGlnaGxpZ2h0OnllbGxvdyI+DQo8 L3NwYW4+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrO2JhY2tncm91bmQ6eWVsbG93O21zby1o aWdobGlnaHQ6eWVsbG93Ij5saW5rcyBvciBhdHRhY2htZW50cyB1bmxlc3MgeW91IHJlY29n bml6ZSB0aGUgc2VuZGVyIGFuZCB0cnVzdCB0aGUgY29udGVudC4NCjwvc3Bhbj48bzpwPjwv bzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIGFsaWduPSJjZW50ZXIiIHN0eWxlPSJt YXJnaW4tYm90dG9tOjBpbjttYXJnaW4tYm90dG9tOi4wMDAxcHQ7dGV4dC1hbGlnbjpjZW50 ZXI7bGluZS1oZWlnaHQ6bm9ybWFsIj4NCjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWJvdHRvbToxMi4wcHQ7bGluZS1o ZWlnaHQ6bm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+PG86cD4mbmJz cDs8L286cD48L3NwYW4+PC9wPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibWFyZ2luLWJvdHRvbTowaW47bWFyZ2luLWJvdHRvbTouMDAwMXB0O2xpbmUt aGVpZ2h0Om5vcm1hbCI+DQo8c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+T24gVHVl LCBKdWwgMjMsIDIwMTksIDM6NDcgUE0gRmlsaXBwbyBWYWxzb3JkYSAmbHQ7PGEgaHJlZj0i bWFpbHRvOmZpbGlwcG9AbWwuZmlsaXBwby5pbyI+ZmlsaXBwb0BtbC5maWxpcHBvLmlvPC9h PiZndDsgd3JvdGU6PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8YmxvY2txdW90 ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtw YWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi1yaWdo dDowaW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1ib3R0b206MGlu O21hcmdpbi1ib3R0b206LjAwMDFwdDtsaW5lLWhlaWdodDpub3JtYWwiPg0KPHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQiPkJlZm9yZSBhbnkgdGVjaG5pY2FsIG9yIHdvcmRpbmcg ZmVlZGJhY2ssIEkgYW0gY29uZnVzZWQgYXMgdG8gdGhlIG5hdHVyZSBvZiB0aGlzIGRvY3Vt ZW50LiBJdCBkb2VzIG5vdCBzZWVtIHRvIHNwZWNpZnkgYW55IHByb3RvY29sIGNoYW5nZSBv ciBtZWNoYW5pc20sIGFuZCBpdCBkb2VzIG5vdCBldmVuIGZvY3VzIG9uIHNvbHV0aW9ucyB0 byBtb3ZlIHRoZSB3ZWIgZnVydGhlci48YnI+DQo8YnI+DQpJbnN0ZWFkLCBpdCBsb29rcyBs aWtlIGEgd2VsbCBlZGl0ZWQgYmxvZyBwb3N0LCBwcmVzZW50aW5nIHRoZSBwZXJzcGVjdGl2 ZSBvZiBvbmUgc2VnbWVudCBvZiB0aGUgaW5kdXN0cnkuIChUaGUgcGVyc3BlY3RpdmUgc2Vl bXMgdG8gYWxzbyBsYWNrIGNvbnNlbnN1cywgYnV0IEkgYmVsaWV2ZSBldmVuIHRoYXQgaXMg c2Vjb25kYXJ5LikgTm90ZSBob3cgYXMgb2YgZHJhZnQtY2Ftd2luZ2V0LXRscy11c2UtY2Fz ZXMtMDUgdGhlcmUgYXJlIG5vIElBTkENCiBjb25zaWRlcmF0aW9ucywgbm8gc2VjdXJpdHkg Y29uc2lkZXJhdGlvbnMsIGFuZCBubyBvY2N1cnJlbmNlcyBvZiBhbnkgb2YgdGhlIEJDUCAx NCBrZXkgd29yZHMgKE1VU1QsIFNIT1VMRCwgZXRjLikuPGJyPg0KPGJyPg0KSXMgdGhlcmUg cHJlY2VkZW50IGZvciBwdWJsaXNoaW5nIHN1Y2ggYSBkb2N1bWVudCBhcyBhbiBSRkM/PG86 cD48L286cD48L3NwYW4+PC9wPg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWJvdHRvbTowaW47bWFy Z2luLWJvdHRvbTouMDAwMXB0O2xpbmUtaGVpZ2h0Om5vcm1hbCI+DQo8c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1ib3R0b206MGlu O21hcmdpbi1ib3R0b206LjAwMDFwdDtsaW5lLWhlaWdodDpub3JtYWwiPg0KPHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQiPkkgd2FzIGdvaW5nIHRvIHNheSBSRkMgNjkxIGJ1dCBu bywgaXQgcmVjb21tZW5kcyBjaGFuZ2VzIHRvIHRoZSBwcm90b2NvbCAoYXMgd2VsbCBhcyBi ZWluZyBxdWl0ZSBhbXVzaW5nKS4gUkZDIDQwNzQgY29tZXMgY2xvc2UgZGVzY3JpYmluZyBi YWQgYmVoYXZpb3Igd2l0aG91dCBhbiBleHBsaWNpdCBwbGVhIHRvIHN0b3AgZG9pbmcgaXQs IGJ1dCBoYXMgYSBzZWN1cml0eSBjb25zaWRlcmF0aW9ucw0KIHNlY3Rpb24uIFJGQyA3MDIx IGRlc2NyaWJlcyB0aGUgaW1wYWN0IG9mIGEgcGFydGljdWxhciBuZXR3b3JraW5nIHRlY2hu aXF1ZSBvbiBhcHBsaWNhdGlvbnMuPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1ib3R0b206MGluO21h cmdpbi1ib3R0b206LjAwMDFwdDtsaW5lLWhlaWdodDpub3JtYWwiPg0KPHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tYm90dG9tOjBp bjttYXJnaW4tYm90dG9tOi4wMDAxcHQ7bGluZS1oZWlnaHQ6bm9ybWFsIj4NCjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0Ij5TbyB0aGVyZSBpcyBwcmVjZWRlbnQuPG86cD48L286 cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1hcmdpbi1ib3R0b206MGluO21hcmdpbi1ib3R0b206LjAwMDFwdDtsaW5lLWhlaWdo dDpub3JtYWwiPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxvOnA+Jm5ic3A7 PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtYXJnaW4tYm90dG9tOjBpbjttYXJnaW4tYm90dG9tOi4wMDAxcHQ7bGluZS1o ZWlnaHQ6bm9ybWFsIj4NCjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij5TaW5jZXJl bHksPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1hcmdpbi1ib3R0b206MGluO21hcmdpbi1ib3R0b206LjAwMDFw dDtsaW5lLWhlaWdodDpub3JtYWwiPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQi PldhdHNvbjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4N CjwvZGl2Pg0KPC9ib2R5Pg0KPC9odG1sPg0KCgo8QlI+CjxodG1sPgogPHA+VGhlIGluZm9y bWF0aW9uIGNvbnRhaW5lZCBpbiB0aGlzIGNvbW11bmljYXRpb24gaXMgaGlnaGx5IGNvbmZp ZGVudGlhbCBhbmQgaXMgaW50ZW5kZWQgc29sZWx5IGZvciB0aGUgdXNlIG9mIHRoZSBpbmRp dmlkdWFsKHMpIHRvIHdob20gdGhpcyBjb21tdW5pY2F0aW9uIGlzIGRpcmVjdGVkLiBJZiB5 b3UgYXJlIG5vdCB0aGUgaW50ZW5kZWQgcmVjaXBpZW50LCB5b3UgYXJlIGhlcmVieSBub3Rp ZmllZCB0aGF0IGFueSB2aWV3aW5nLCBjb3B5aW5nLCBkaXNjbG9zdXJlIG9yIGRpc3RyaWJ1 dGlvbiBvZiB0aGlzIGluZm9ybWF0aW9uIGlzIHByb2hpYml0ZWQuIFBsZWFzZSBub3RpZnkg dGhlIHNlbmRlciwgYnkgZWxlY3Ryb25pYyBtYWlsIG9yIHRlbGVwaG9uZSwgb2YgYW55IHVu aW50ZW5kZWQgcmVjZWlwdCBhbmQgZGVsZXRlIHRoZSBvcmlnaW5hbCBtZXNzYWdlIHdpdGhv dXQgbWFraW5nIGFueSBjb3BpZXMuPC9wPgogPHA+Qmx1ZSBDcm9zcyBCbHVlIFNoaWVsZCBv ZiBNaWNoaWdhbiBhbmQgQmx1ZSBDYXJlIE5ldHdvcmsgb2YgTWljaGlnYW4gYXJlIG5vbnBy b2ZpdCBjb3Jwb3JhdGlvbnMgYW5kIGluZGVwZW5kZW50IGxpY2Vuc2VlcyBvZiB0aGUgQmx1 ZSBDcm9zcyBhbmQgQmx1ZSBTaGllbGQgQXNzb2NpYXRpb24uPC9wPgogIDwvaHRtbD4KCg== --_000_DM6PR14MB24745D7DDD5F1503387A7694D7C60DM6PR14MB2474namp_-- From nobody Tue Jul 23 20:18:46 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3521212008F for ; Tue, 23 Jul 2019 20:18:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DHsQNaC3Zflo for ; Tue, 23 Jul 2019 20:18:41 -0700 (PDT) Received: from mail-lj1-x22e.google.com (mail-lj1-x22e.google.com [IPv6:2a00:1450:4864:20::22e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 57FE412008A for ; Tue, 23 Jul 2019 20:18:41 -0700 (PDT) Received: by mail-lj1-x22e.google.com with SMTP id z28so43114034ljn.4 for ; Tue, 23 Jul 2019 20:18:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=scv9SlUJN8zU+ZPxX6Bq3JQ9bWszPWe+S4t1G7fFhMY=; b=pgCPrAqenJkKUPnzZf9qGdVZurxo7vDCaQXUcY/ewfY5fQfiRFoi+fORuzME3p3no5 PAIsB+1wXpZTU8B1lzrX+1E8pe+JRhnMA6XAGwqHu6+D4FOmoFWzRm2JulBmtLHzDTTU DIW0RQfWEpM4byQv9HCnC9LpI3jyf4wb7raBW7b/4MeJLZ2SFB7YkNseKPqoRI9TcMRg ll3m5elvSoZxFtuC/wOzAN19ae2qtn/PI2Cf/zwPX1ClSYll6PK7D/Hq9LDUIZbViQy+ YRlndPXUHICtdG8C7EQlHDMqXitv2jAcjNyYf8tLFdap7mdeIrjm1h6jX/LtStMwfJae TujQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=scv9SlUJN8zU+ZPxX6Bq3JQ9bWszPWe+S4t1G7fFhMY=; b=I12IaEUdJTdx7xr5utDz/X1F0sJyk+8/CchQll8kyTVO9g/W03tnQGKrfxpbNMLwme niaYJ8IEIjsiFeF2c0CelanFzvOBn180/Ee0u6kd3tblTDsS6q0t2MpDOYUhVca0lRek 3ljBUjtORgXBPrC1uhSGsoU192KcKz0RvuAk/dA/IMNaq7aSLY3jmJPGr0BtBarHray3 0dolz+U3QY++/c0ohAL1bdE8tGhICqbbYXdo7tbvS2rntnO4U6/CcODoJDemY9GaRre7 nr5rJD/caleikI2wkodE631wSPZkMWTI6gk3lRcDX9aRkgOWiKC8bDXNt7lTYRtWJIDZ DSfQ== X-Gm-Message-State: APjAAAVmpJ8nX+ibK44S+va7Mgf7YH3y6Re33no+Hfxt2PjQt3BJ65QK n5k3UyDNXmFajq9R/mA4crGAIdbHeec2jn4JViI= X-Google-Smtp-Source: APXvYqxF4ZtMk1M2veFTY50SU2l5LQpU8jLQVSr7NciqHSNNZXI9cI+4xIhx6z/EMFr0r/JZDVQraDZHc5HgVlMQQNc= X-Received: by 2002:a2e:6348:: with SMTP id x69mr41881641ljb.186.1563938319572; Tue, 23 Jul 2019 20:18:39 -0700 (PDT) MIME-Version: 1.0 References: <51f39225-1953-b603-bd15-bbc7d4bf2222@cs.ox.ac.uk> <1300C2AB-ACCD-4F29-96CF-D27A6737A799@gmail.com> In-Reply-To: <1300C2AB-ACCD-4F29-96CF-D27A6737A799@gmail.com> From: Watson Ladd Date: Tue, 23 Jul 2019 20:18:27 -0700 Message-ID: To: Bret Jordan Cc: TLS List Content-Type: multipart/alternative; boundary="000000000000fd26e1058e64c360" Archived-At: Subject: Re: [TLS] TLS Impact on Network Security draft updated X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 03:18:44 -0000 --000000000000fd26e1058e64c360 Content-Type: text/plain; charset="UTF-8" On Tue, Jul 23, 2019, 6:55 PM Bret Jordan wrote: > As a professional organization and part of due diligence, we need to try > and understand the risks and ramifications on the deployments of our > solutions. This means, understanding exactly how the market uses and needs > to use the solutions we create. When we remove or change some technology, > we should try hard to provide a work around. If a work around is not > possible, we need to cleanly document how these changes are going to impact > the market so it can prepare. This is the responsible and prudent thing to > do in a professional organization like the IETF. > What technology was removed? Was it TLS proxies equipped with the private key? No, those still work. Interception devices with a root? No, still work. So what broke? > The draft that Nancy and others have worked on is a great start to > documenting how these new solutions are going to impact organizational > networks. Regardless of whether you like the use-cases or regulations that > some organizations have, they are valid and our new solutions are going to > impact them. > It continually conflates some methods of achieving a goal with all of them. As shown by some of the exchanges the draft substantially overstates the issues. > Thanks, > Bret > PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 > "Without cryptography vihv vivc ce xhrnrw, however, the only thing that > can not be unscrambled is an egg." > > On Jul 23, 2019, at 7:44 PM, Dennis Jackson > wrote: > > RFC 791 is nearly 40 years old. > RFC 4074 lists 5 forms of deviations from RFC 1034 and explains > the correct behavior. > RFC 7021 describes a series of objective tests of RFC 6333 and > the results. > > > The above RFCs describe objective test results and how they > relate to earlier RFCs. In contrast, this document offers a > speculative and subjective discussion of possible future impact. > > > I do not believe there is any precedent supporting publication. > > > Best, > Dennis > > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > --000000000000fd26e1058e64c360 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


On Tue, Jul 23, 2019, 6:55 PM Bret Jordan <jordan.ietf@gmail.com> wrote:
<= /div>
As a professional organization and part of due di= ligence, we need to try and understand the risks and ramifications on the d= eployments of our solutions. This means, understanding exactly how the mark= et uses and needs to use the solutions we create. When we remove or change = some technology, we should try hard to provide a work around. If a work aro= und is not possible, we need to cleanly document how these changes are goin= g to impact the market so it can prepare. This is the responsible and prude= nt thing to do in a professional organization like the IETF.=C2=A0

What te= chnology was removed?

Wa= s it TLS proxies equipped with the private key? No, those still work. Inter= ception devices with a root? No, still work. So what broke?


The draft that Nancy and others have worked = on is a great start to documenting how these new solutions are going to imp= act organizational networks. Regardless of whether you like the use-cases o= r regulations that some organizations have, they are valid and our new solu= tions are going to impact them.=C2=A0
<= div dir=3D"auto">
It continually conflates some = methods of achieving a goal with all of them. As shown by some of the excha= nges the draft substantially overstates the issues.=C2=A0


Thanks,
Bret
<= span class=3D"m_-2201006279209328931Apple-style-span" style=3D"border-colla= pse:separate;text-align:-webkit-auto;border-spacing:0px">
PGP Fingerprint= :=C2=A063B4 FC53 680A 6B7D 1447= =C2=A0F2C0 74F8 ACAE 7415 0050
"Without cryptography vihv vivc ce xhrnrw, h= owever, the only thing that can not be unscrambled is an egg."<= /div>

On Jul 23, 2019, at 7:44 PM, Dennis= Jackson <dennis.jackson@cs.ox.ac.uk> wrote:

=20 =20 =20 
RFC 791  is nearly 40 yea=
rs old.
RFC 4074 lists 5 forms of deviations from RFC 1034 and explains=20
the correct behavior.=20
RFC 7021 describes a series of objective tests of RFC 6333 and=20
the results.=20


The above RFCs describe objective test results and how they=20
relate to earlier RFCs. In contrast, this document offers a=20
speculative and subjective discussion of possible future impact.


I do not believe there is any precedent supporting publication.


Best,
Dennis

________________= _______________________________
TLS mailing list
TLS@ie= tf.org
https://www.ietf.org/mailman/listinfo/tls
--000000000000fd26e1058e64c360-- From nobody Tue Jul 23 21:20:00 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7C74112001E for ; Tue, 23 Jul 2019 21:19:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KAiXPAKxyPPn for ; Tue, 23 Jul 2019 21:19:56 -0700 (PDT) Received: from relay13.mail.ox.ac.uk (relay13.mail.ox.ac.uk [129.67.1.166]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3652F120119 for ; Tue, 23 Jul 2019 21:19:56 -0700 (PDT) Received: from smtp5.mail.ox.ac.uk ([163.1.2.207]) by relay13.mail.ox.ac.uk with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.89) (envelope-from ) id 1hq8kr-0007rQ-it; Wed, 24 Jul 2019 05:19:53 +0100 Received: from 61.ip-51-38-113.eu ([51.38.113.61] helo=[192.168.2.2]) by smtp5.mail.ox.ac.uk with esmtpsa (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.89) (envelope-from ) id 1hq8kp-00046I-Ic; Wed, 24 Jul 2019 05:19:53 +0100 To: Benjamin Kaduk Cc: "tls@ietf.org" References: <51f39225-1953-b603-bd15-bbc7d4bf2222@cs.ox.ac.uk> <1300C2AB-ACCD-4F29-96CF-D27A6737A799@gmail.com> <8f95317e-880d-f064-49a1-e51945b06b29@cs.ox.ac.uk> <20190724031343.GD27936@akamai.com> From: Dennis Jackson Openpgp: preference=signencrypt Autocrypt: addr=dennis.jackson@cs.ox.ac.uk; prefer-encrypt=mutual; keydata= mQINBFbAmb8BEADCLixsrAJyvknI95ZIZNVeDJbYvldeXpw7iyhrdUdRK69USU5S9EESulYh k1KlxDB5VfG8CCA/WzG1IonONdXmgLFa1NcmdVvkFjbXf5mbGYG+9pTkieM+UHikniAizIOi ibdTWEEc2opOAvpVypek4SSsfCoXfXqj0j5AXSapHiVzhhWuaXhKVuFdLtYwJDU/x0FXgStm erFMIOeZ5FLFnjkkNyEa1t3XCcf7bfgw8J86UmWzgkVLmtBYbDK0ZAFjtFep5Kps11iTDIa3 xYXzuqgkWwkg7b1mhn5gQUl/kKZqQbuG+Sk+BydjH8e1PJkO6p2eAprO0AoucRuuBl1pmg/F bf/WJC6/XD3AV87ERAdXbb9cH+vrRT8GpiNX5r+7OuXavc3/LNU9stqsdshXwdZlDyPyDIG2 Llj6hB4eS0tEpat3otcPDkXUjXjyOUQ6jKTNSZ+xTBtVTXznflDCGdn9GV0q+4ZbdRZ5tfXM DXM+uMqVxjvh2IjCrka7zf1rRWg1WZu+NrzAUrvPMPddDJfd8JNrIcvV+DIBxPVsUTJLEGt9 PW8LkQb5FrG7T6a813JYNoAtL4w7296UYmUpV1Kvv8otO+uH860x5Ci83ZCXb7gKr9Rankn5 Jcg+shWnDFgSq6uM/u3MmyRV2iw7aCSgcgfy4EPTojJdy3KjzQARAQABtCtEZW5uaXMgSmFj a3NvbiA8ZGVubmlzLmphY2tzb25AY3Mub3guYWMudWs+iQIwBBMBCgAaBAsJCAcCFQoCFgEC GQAFglsIFtUCngECmwMACgkQYQWndYzSRqzvkA//djyyIydK5jhxNFqmMvJTkTZwawKWV7Tc cEntsIwYsHw8ec9Edo/M6fwp8aFmddPnzRo0EBmh6KNm887VxgH0FXmcR7k8bD3qUzIhfq11 4ezWtTk0nWjpieEsFb20lCMZjK9dsfXVRgFrfe00x2lhjPWQ5G5mTkfX8KYcDs5nmc+13qHK Ux6e6aSdEa4mnxrT0NsEg2H2xKgwrGkNIxJO6snrh3A3mT6+2F8ZCiRWwmOhcHBzNCFp1enR bMJpNRhcmGBDNJ9TpnQHDRVE67ds3PC/vKDkYQ3tEIkdgc/KVGOo7+kZxSU/n1gARDZ4PYUw IGOM81aEhmrbXoF33Jbic2jnuLfqsC8uXeP6wGgGpEdGThQ+7zslOPDradgDZBlUmYenuwOb JwJEj+JbbZPcND17VrgVDzcM1rh1w9wcKrRDMIw/zLCpEDOfLRe2ad/V380q/Eh3qa4QrZE7 tnXcOTIZfxd1zZ6TcpOvMVYQPN5Zfrlazmw9bTsdkm3WVrzvxc9DJ/D5Ws+aMu+JfSD+C5Nd n5w2fW7OOiDudeFXj88CL7oBehPJ2ajCDmHd/vc1W7CSoPte6aHBgSGER9cWm5hpEOXacQt+ pEz/uMvq+zkDIydy9YL/8hDo5TsVA4Yo8wNdKOuyaStk/oh3WNda05N0jr8VhRMdxnLN/hWY Ely5Ag0EVsCZvwEQAOBD1BmNy7FWbpg9Tm3OfMNC/yLs6G7rk3OFw7BhpjHXHSsEge48HbvP lfdR9abA1cmbgYR7EyaOav1s9ugU7EtDCcK8zHZcaUg3gC+FdjsnkIQCkf/3HK2sxcbBSrkX 2Uu2jjufvZu10g/aavkCuTHIUiYAHhQU5kCkRI7NYvXIKmaPY2Km3YIVJ50x+4GlE/WVZk8w HpvisxDInBioziUjAIqTt0at5tE1ObZksl2eNHNCwlo15WE2hKIYCuJKb57wCBKaOKo/gSw/ yN2DX3HaU/PF+8rCikkKDhHDrefFwGkqBf3zHlrLiHIr+ONVZ8i9dxMyg5TERxjd3vZ4ha+7 8cr8G83HC8lSBEpPYmoeU4J8vWf8kjBlai0UmzyZRF3SeZlqldxo7zJhYq3xIsDGKVuSCn68 2TcoEsR5WS/Zjc0ZoH/YIpdVy8FRu45dJ2IUzHVyszMfNWKob7ZsQ9JCXiXypmIF6ut5mwv8 ddCMdG6Jdpvg1fr0coABNbJSrUM8uFEldmRFpBdbNx5xSCJjNo+QuTHOXWuO3/GFRmux8/kW TlfF3+dvff2Pw3CKENoysgcOflYShcjOv/03sQ6AfxTm2Jnh5dqJSoVnPWpcDyPqn3k4zoZW 0ISqorI8yehJbfT3C0J5iEX75c8vJWfUUjIhyO0CpHxATNW3j3QxABEBAAGJAh8EGAEIABMF AlbAmccJEGEFp3WM0kasAhsMAAD8JhAAtkUWMLjr1RYTSMPrmTp3NGZfNSblv0GGHtL7TvT1 kFwdT/hs29Gjrj0FffZE6RKDEGls9AL6LY/g3wA5WQsXaK0wqwb8MBeIPWvFPvVQbqrifN3A bpukTl4OCBOwJbHS/GO1V3AwaLl4l3U/+kzR7UsnszWs4kizE9lBJ0AYFbxB0xbPF6iI32Cm K3nrLPfkXBXw2xX01nOLxTx9E7YdVpP3Re1c96aBTflm4CAGUfTZ5xgQMW6rgJ8FBc3oLckt 9MT0qB5XkmKGI1kkRypN7hIFRBcPxegeO8S3fpBUOop5F0el24TVx6KJTktpLmlIfUsEQ0Lx CqNtUk1v3eMCoKmeky8WbFcUArRV4DKXDAK1e3C8poMaehRgfl8sjz6SuH1VXpCMLNPpNMtZ EK4FU+C0jGgJyHS9N1UZjq8Qa8FnYKruyPgTpKEAsqlo5vB6J8phiaKXxnren8HqIfzQdrt8 3M+raXc7+Fqis4pYS49vfIpxUzcqvKUiSgDGKemqMw9w9U5dBEQeLNW08uOKSjyENU4e1Ob/ IiimIpEPA5LEIhSfOP9CN9TculGqvo0g12XnB+g5AAtm1ohMkb33T17IR3rKkhlvIITuY1qi fZz7OgGbXh4G5oUHXNBOhXHaqRIzQCCRbBUFA09OyJBLWAGH6HcM/DeM0I7Ng55uMl8= Message-ID: <78479d60-6b30-4a8f-9605-648eaad8624c@cs.ox.ac.uk> Date: Wed, 24 Jul 2019 05:19:46 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.7.1 MIME-Version: 1.0 In-Reply-To: <20190724031343.GD27936@akamai.com> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 8bit X-Oxford-Username: exet4027 Archived-At: Subject: Re: [TLS] TLS Impact on Network Security draft updated X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 04:19:59 -0000 On 24/07/2019 04:13, Benjamin Kaduk wrote: > On Wed, Jul 24, 2019 at 03:35:43AM +0100, Dennis Jackson wrote: >> On 24/07/2019 02:55, Bret Jordan wrote: >>> As a professional organization and part of due diligence, we need to try >>> and understand the risks and ramifications on the deployments of our >>> solutions. This means, understanding exactly how the market uses and >>> needs to use the solutions we create. When we remove or change some >>> technology, we should try hard to provide a work around. If a work >>> around is not possible, we need to cleanly document how these changes >>> are going to impact the market so it can prepare. This is the >>> responsible and prudent thing to do in a professional organization like >>> the IETF.  >>> >> >> The IETF is for development of Internet Standards. If you want to >> publish your (subjective) analysis of how a particular standard is going >> to impact your market segment, there are any number of better venues: >> trade magazines, industry associations, your company website, etc. > > Actually, the Independent stream of the RFC series is purpose-built for > individual commentary on the consequences of a particular standard > [including in a particular segment], and would be superior (at least in > my opinion) to any of the venues you list. (See RFC 4846.) But I > believe the current ISE asks authors to try fairly hard to publish their > work in the IETF before accepting it to the Indepndent stream. I was thinking of 'published by the IETF' to mean the IETF stream. Publishing in the Independent stream, without any proper review, consensus or claim of fitness is a different matter altogether. >>> The draft that Nancy and others have worked on is a great start to >>> documenting how these new solutions are going to impact organizational >>> networks. Regardless of whether you like the use-cases or regulations >>> that some organizations have, they are valid and our new solutions are >>> going to impact them.  >> >> This isn't a question of quality. The IETF simply doesn't publish >> documents of this nature (to my knowledge). > > The IETF can publish whatever there is IETF consensus to publish. (And > a little bit more, besides, though that is probably not relevant to the > current discussion.) > > I don't have a great sense of what you mean by "documents of this > nature". If you were to say "the IETF does not publish speculative and > subjective discussion of possible future impact", I'd be fairly likely > to agree with you (but I have also seen a fair bit of speculation get > published). This was my intended meaning. I'd feel rather differently about "the IETF does not > publish objective analysis of the consequences of protocol changes on > previously deployed configurations", and would ask if you think a > document in the latter category is impossible for the TLS 1.2->1.3 > transition. (My understanding is that the latter category of document > is the desired proposal, regardless of the current state of the draft in > question.) The authors initiated this discussion by stating their draft was stable and requesting publication. Consequently, I think it must be judged on the current state, rather than the desired outcome. Even considering your more generous interpretation... the objective discussion is only 3 out of 15 pages and none of the 5 claims appears to be correct. (As others have pointed out). Best, Dennis > -Ben > > From nobody Tue Jul 23 21:32:22 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A1CE0120119 for ; Tue, 23 Jul 2019 21:32:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EyHyim9hs-EO for ; Tue, 23 Jul 2019 21:32:18 -0700 (PDT) Received: from mail-qt1-x831.google.com (mail-qt1-x831.google.com [IPv6:2607:f8b0:4864:20::831]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 14A3E12001E for ; Tue, 23 Jul 2019 21:32:18 -0700 (PDT) Received: by mail-qt1-x831.google.com with SMTP id d23so44237408qto.2 for ; Tue, 23 Jul 2019 21:32:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:mime-version:subject:message-id:references:to:date; bh=GK+fpYAiVbN0R2oQssjrQH2KWUwYZtHJeknN+nj7ZoU=; b=tbc2Tap+SmRCi4jrHS/FRXWtd5IF1DK4u5CCOtR/zB26QheZ3hJktOsLxoHn14oYbD EAFDBjEhQ8cBwW1HLGKtkPIwkNLqIRdIueWQSz9ja+2gEYWlhRIVZbPNQJX3nmOduT95 Cj3k0HkPrwfLc4SxsgmymAcsOa9lCu97Gn12Jdogh9PDvdBV+VHjPm9GbuwNUKo1G4fj xrjEkeTI5Pz5QOJtfcclgFBsml/aLvC06uGEIEG1WKKOxhK9bBuPLalBHDmaAN5vjxX1 KxfUjh5D7uOCv6cqFNEgfC2kAMutJmVzKRSbmMXAACaZgYL8nc6nmm+kDv+L7PFhtGin V0wA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:mime-version:subject:message-id:references :to:date; bh=GK+fpYAiVbN0R2oQssjrQH2KWUwYZtHJeknN+nj7ZoU=; b=O5JC9Yo1Pr3f/y8xHRQVT6BG70z9ID7scZIEWpI9HeqDbU69nWK3GOGSbed/vNm3jy pMOzAbWfUFrXxqbX0h8hdhqrBKn8+HYkF2n/ZB4ttulMwYtQF4XsUC7fOJk8n0nzxx7N DXCBD0YI6nyY8xY+EzOyAdxeDjAVUFj4XxBTABHzzOaSWEWef7DtjO99NJnxRQL89AxW NWZ/0WT2kDqX7/WKz9Qq18vJtIPUIc9dGGMD2O3YzuHWGTAqhdc+LJ75nLDg3DOOHP7D /m9IAB50D1bdLAfCOOaRd7YqORRDvrmjngFF5JKtBU5J7BeEcKvy1BHlZMYxm4t68eXl lgIw== X-Gm-Message-State: APjAAAUDo01ZkRpRnBpP1CZuVymhLBu9XJSfW5hz7iDOLN12f2XgnThm dzylJo7AIfmbn228cwb2DcYjW0C+ZuI= X-Google-Smtp-Source: APXvYqwjlvkxFAzzM40YoEwTl7Vr0uVIdzNXXM0lHp4tz41DWIv9f0k7ef/lhSxynOpKwVVCMHSzJA== X-Received: by 2002:a0c:efc1:: with SMTP id a1mr57579434qvt.137.1563942736818; Tue, 23 Jul 2019 21:32:16 -0700 (PDT) Received: from ?IPv6:2001:67c:1232:144:9028:46f7:6f4:6ab0? ([2001:67c:1232:144:9028:46f7:6f4:6ab0]) by smtp.gmail.com with ESMTPSA id 5sm21558310qkr.68.2019.07.23.21.32.16 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 23 Jul 2019 21:32:16 -0700 (PDT) From: Yoav Nir Content-Type: multipart/alternative; boundary="Apple-Mail=_7EBA8B03-A99D-4B62-BC38-79A5BE54EF24" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Message-Id: <92584B5E-5234-4C5D-ABBC-A312BB59C14F@gmail.com> References: <156393857098.27882.16925086682562389655.idtracker@ietfa.amsl.com> To: "" Date: Wed, 24 Jul 2019 00:32:15 -0400 X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: [TLS] Fwd: New Version Notification for draft-nir-tls-tlsflags-02.txt X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 04:32:21 -0000 --Apple-Mail=_7EBA8B03-A99D-4B62-BC38-79A5BE54EF24 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hi. Following today=E2=80=99s session, I=E2=80=99ve updated and submitted = the draft. It contains the proposal from slide #5 in my presentation. It does not contain any fancy way of reserving bits for future popular = extensions. It uses a single numbering of the flags, not the more efficient separate = numbering per context (CH, SH, EE, CH-in-CTLS) I believe such bikeshedding can be done after adoption. Just so long as = we don=E2=80=99t make it of asbestos. [1] Yoav [1] It was never about the color of the bike shed, but about the = material: https://en.wikipedia.org/wiki/Law_of_triviality#Examples = > Begin forwarded message: >=20 > From: internet-drafts@ietf.org > Subject: New Version Notification for draft-nir-tls-tlsflags-02.txt > Date: 23 July 2019 at 23:22:50 GMT-4 > To: "Yoav Nir" >=20 >=20 > A new version of I-D, draft-nir-tls-tlsflags-02.txt > has been successfully submitted by Yoav Nir and posted to the > IETF repository. >=20 > Name: draft-nir-tls-tlsflags > Revision: 02 > Title: A Flags Extension for TLS 1.3 > Document date: 2019-07-22 > Group: Individual Submission > Pages: 6 > URL: = https://www.ietf.org/internet-drafts/draft-nir-tls-tlsflags-02.txt > Status: = https://datatracker.ietf.org/doc/draft-nir-tls-tlsflags/ > Htmlized: https://tools.ietf.org/html/draft-nir-tls-tlsflags-02 > Htmlized: = https://datatracker.ietf.org/doc/html/draft-nir-tls-tlsflags > Diff: = https://www.ietf.org/rfcdiff?url2=3Ddraft-nir-tls-tlsflags-02 >=20 > Abstract: > A number of extensions are proposed in the TLS working group that > carry no interesting information except the 1-bit indication that a > certain optional feature is supported. Such extensions take 4 = octets > each. This document defines a flags extension that can provide such > indications at an average marginal cost of 1 bit each. More > precisely, it provides as many flag extensions as needed at 4 + the > order of the last set bit divided by 8. >=20 >=20 >=20 >=20 > Please note that it may take a couple of minutes from the time of = submission > until the htmlized version and diff are available at tools.ietf.org. >=20 > The IETF Secretariat >=20 --Apple-Mail=_7EBA8B03-A99D-4B62-BC38-79A5BE54EF24 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Hi.

Following today=E2=80=99s session, I=E2=80=99ve updated and = submitted the draft.

It contains the proposal from slide #5 in my = presentation.

It= does not contain any fancy way of reserving bits for future popular = extensions.

It = uses a single numbering of the flags, not the more efficient separate = numbering per context (CH, SH, EE, CH-in-CTLS)

I believe such bikeshedding can be done = after adoption. Just so long as we don=E2=80=99t make it of asbestos. = [1]

Yoav

[1] It was never about the color of the bike shed, but about = the material: https://en.wikipedia.org/wiki/Law_of_triviality#Examples


Begin forwarded = message:

From: = internet-drafts@ietf.org
Subject: = New Version = Notification for draft-nir-tls-tlsflags-02.txt
Date: = 23 July 2019 at 23:22:50 = GMT-4
To: = "Yoav Nir" <ynir.ietf@gmail.com>


A new version = of I-D, draft-nir-tls-tlsflags-02.txt
has been = successfully submitted by Yoav Nir and posted to the
IETF = repository.

Name: = draft-nir-tls-tlsflags
Revision: 02
Title:= = A Flags Extension for TLS 1.3
Document date: = 2019-07-22
Group: Individual Submission
Pages:= = 6
URL: =            https://www.ietf.org/internet-drafts/draft-nir-tls-tlsflags-02.= txt
Status: =         https://datatracker.ietf.org/doc/draft-nir-tls-tlsflags/Htmlized:       https://tools.ietf.org/html/draft-nir-tls-tlsflags-02
Htmlized:       https://datatracker.ietf.org/doc/html/draft-nir-tls-tlsflags
Diff: =           https://www.ietf.org/rfcdiff?url2=3Ddraft-nir-tls-tlsflags-02

Abstract:
  A = number of extensions are proposed in the TLS working group that
  carry no interesting information except the = 1-bit indication that a
  certain optional = feature is supported.  Such extensions take 4 octets
=   each.  This document defines a flags extension that can = provide such
  indications at an average = marginal cost of 1 bit each.  More
=   precisely, it provides as many flag extensions as needed at = 4 + the
  order of the last set bit divided by = 8.




Please note that it may take a couple of minutes from the = time of submission
until the htmlized version and diff are = available at tools.ietf.org.

The IETF = Secretariat


= --Apple-Mail=_7EBA8B03-A99D-4B62-BC38-79A5BE54EF24-- From nobody Tue Jul 23 23:51:59 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D34EC12030C for ; Tue, 23 Jul 2019 23:51:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id K9ByHJYfsunl for ; Tue, 23 Jul 2019 23:51:55 -0700 (PDT) Received: from mail-wr1-x434.google.com (mail-wr1-x434.google.com [IPv6:2a00:1450:4864:20::434]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 603BF120309 for ; Tue, 23 Jul 2019 23:51:55 -0700 (PDT) Received: by mail-wr1-x434.google.com with SMTP id r1so45614234wrl.7 for ; Tue, 23 Jul 2019 23:51:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=hcwjB2CH8LigyWIEMn/6Vx80hqeeTTSrV+Lt3Cc5vAs=; b=tEIF1kSQCQEW0TR7qvBmD+LIRY71BGEs09Kai5prmVGcKf+hBWbaGemGUL4e7buZUk 8cJVKoVjTMZAI0qThccaTn4+XSoNGXvOibJlcBtGpLmSB4urNmxX/11rxyWpSKld/Qro Z8ncU91pTUrrr5cw49ZYZNUQSbmHEL1zhuu86UbWnqfsL9xX5rja/7y3MeLCfpMnsZIv dQJK5RWwN1ln5slMth3ge4qRf5ztqG2TWD+J3Vwq7ULzPqu0cyjjDpz0fXfd6w3pggez /SQM/sy5D+pAOXsDiEm/JH8KO84gRyePBcHh7sbhw1JqPXmEuEeGfdzSWFSf/A926GXh 3B1g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=hcwjB2CH8LigyWIEMn/6Vx80hqeeTTSrV+Lt3Cc5vAs=; b=YG19NzbvN5cJZOh1cLDSML+kbrPKOCxQA5M13xfB6ivmC5Xy/yM5LfsU/nTXjMnl5Y WY60avtIiuktNvNgyQNfz+crsl7h2Bo/Pa8Zz20NB1zJuvRYDEr+QTDEWKVZGV9iyZ3H 5i5n8qf43bbMfMDOi+E0syzGXVz95nFpjLPZsLd73WN1uRa6RszwqaVIKwOcy6Trg+r9 cZaEKdiyJJLNgd4BzpdWJGTvHeLvF0ESaX6ove4Y+TC9mqnhTvr4+LIMxUwFhL+U4Ktk GYbvUzIwWzopxi6UApz5Nc2UZW3BrmPsi3MKMw5+O9qLlTamXz0p+CMSr8jlZeaQWnJa 8T9Q== X-Gm-Message-State: APjAAAX4HelaIyI4RjQbopzE2MK7Wz5Cii6M9V2li9GDHO1BvaAKfnIQ wuQKr06VdqCd+M1BjTDuSSJd0EkwIvLZrhteqkE= X-Google-Smtp-Source: APXvYqxJscaijqOqJrwP9S0ryhx6kuTeFAOQHHl/kEDfZKlXI4BF4B3cB6uIb4qDmPOy0gRxg2Zz2uYH4vS9zy/Jj6k= X-Received: by 2002:a5d:518f:: with SMTP id k15mr27844153wrv.321.1563951113803; Tue, 23 Jul 2019 23:51:53 -0700 (PDT) MIME-Version: 1.0 References: <6AF48228-19C2-41C7-BA86-BA16940C3CFF@cisco.com> In-Reply-To: <6AF48228-19C2-41C7-BA86-BA16940C3CFF@cisco.com> From: Joseph Birr-Pixton Date: Wed, 24 Jul 2019 07:51:42 +0100 Message-ID: To: "Nancy Cam-Winget (ncamwing)" Cc: "" Content-Type: multipart/alternative; boundary="000000000000959f4f058e67be85" Archived-At: Subject: Re: [TLS] TLS Impact on Network Security draft updated X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 06:51:58 -0000 --000000000000959f4f058e67be85 Content-Type: text/plain; charset="UTF-8" Hello, I would like to suggest that this draft is expanded to cover the use cases of governments, such as those recently seen in Kazakhstan. This will ideally leave the reader with a fuller impression of the risks inherent in the technology being described here. - section 1: add a sentence to the introduction, eg. "Governments may wish to intercept their citizen's traffic for the purpose of identifying and combating political dissent." - section 4: add subsection "09 - Suppression of Dissent" covering this use case of the technology. Thanks, Joe On Sun, 21 Jul 2019 at 14:51, Nancy Cam-Winget (ncamwing) < ncamwing@cisco.com> wrote: > > Hi, > > Thanks to all the feedback provided, we have updated the https://tools.ietf.org/html/draft-camwinget-tls-use-cases-04 > > draft. At this point, we believe the draft is stable and would like to request its publication as an informational draft. > > > > Warm regards, > > Nancy > > > > > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls --000000000000959f4f058e67be85 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hello,

I would like to suggest that this draft is expanded to cover the use cases = of governments, such as those recently seen in Kazakhstan. This will ideall= y leave the reader with a fuller impression of the risks inherent in the te= chnology being described here.

- section 1: add a sentence to the introduction, eg. "Governments may = wish to intercept their citizen's traffic for the purpose of identifyin= g and combating political dissent."
- section 4: add subsection "09 - Suppression of Dissent" coverin= g this use case of the technology.

Thanks,
Joe




On Sun, 21 Jul 2019 at 14:51, Nancy Cam-Winget (ncamwing) <ncamwing@cisc= o.com> wrote:
>
> Hi,
>
> Thanks to all the feedback provided, we have updated the https://tools.ietf.org/html/draft-camwinge= t-tls-use-cases-04
>
> draft.=C2=A0 At this point, we believe the draft is stable and would l= ike to request its publication as an informational draft.
>
>
>
> Warm regards,
>
>=C2=A0 =C2=A0 =C2=A0Nancy
>
>
>
>
>
> _______________________________________________
> TLS mailing list
> T= LS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
--000000000000959f4f058e67be85-- From nobody Wed Jul 24 04:27:50 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DF3021201EF for ; Wed, 24 Jul 2019 04:27:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=akamai.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qeqDDIblK8Nj for ; Wed, 24 Jul 2019 04:27:39 -0700 (PDT) Received: from mx0b-00190b01.pphosted.com (mx0b-00190b01.pphosted.com [IPv6:2620:100:9005:57f::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A230012060E for ; Wed, 24 Jul 2019 04:27:39 -0700 (PDT) Received: from pps.filterd (m0050096.ppops.net [127.0.0.1]) by m0050096.ppops.net-00190b01. (8.16.0.42/8.16.0.42) with SMTP id x6OBHNkE010111; Wed, 24 Jul 2019 12:27:36 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=akamai.com; h=date : from : to : cc : subject : message-id : references : mime-version : content-type : content-transfer-encoding : in-reply-to; s=jan2016.eng; bh=V4E1iWqEnq1JzWTtoLugTH8uKniTvxyBYS2/uEh8Rfg=; b=LcdYq4/ylxlkkWv+Cr0328oQF0kDEbJwXlGZYjLtx9eV8Hi5yICo8wZMygMvyZ2sjlbG fgtlzbhyBaWHoe0kPtsoA6d9bKH3/8Xxes/SgE11J+W/wxXY+XImntwKzDl98JC7njne Vkpx98zhp0PP0ZjZy6DXBxP+QeL06pebXQgCG3GT+ebZ2IGm3DnkL2tkCNwpGrM9PqqO Xox3xS9tXzRmb51JNV78dxlWBiwHrVWcmrmzCh7cJ+ZHJcPyY9ca6Nl2S7jL4TLEs6F0 JPcjXw8V8e1MAg5rdaBBKw0G3i+oxWuFpWrk9cJVn3ItGqOq1Tlx4XTJUcZ6HOKuOl7F tA== Received: from prod-mail-ppoint4 (prod-mail-ppoint4.akamai.com [96.6.114.87] (may be forged)) by m0050096.ppops.net-00190b01. with ESMTP id 2tx60uk875-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 24 Jul 2019 12:27:36 +0100 Received: from pps.filterd (prod-mail-ppoint4.akamai.com [127.0.0.1]) by prod-mail-ppoint4.akamai.com (8.16.0.27/8.16.0.27) with SMTP id x6OBGtwS004864; Wed, 24 Jul 2019 07:27:35 -0400 Received: from prod-mail-relay15.akamai.com ([172.27.17.40]) by prod-mail-ppoint4.akamai.com with ESMTP id 2tx631b5wx-1; Wed, 24 Jul 2019 07:27:35 -0400 Received: from bos-lpczi.kendall.corp.akamai.com (bos-lpczi.kendall.corp.akamai.com [172.19.17.86]) by prod-mail-relay15.akamai.com (Postfix) with ESMTP id 2640120064; Wed, 24 Jul 2019 11:27:35 +0000 (GMT) Received: from bkaduk by bos-lpczi.kendall.corp.akamai.com with local (Exim 4.86_2) (envelope-from ) id 1hqFQj-0002qB-QO; Wed, 24 Jul 2019 06:27:33 -0500 Date: Wed, 24 Jul 2019 06:27:33 -0500 From: Benjamin Kaduk To: Dennis Jackson Cc: "tls@ietf.org" Message-ID: <20190724112733.GG27936@akamai.com> References: <51f39225-1953-b603-bd15-bbc7d4bf2222@cs.ox.ac.uk> <1300C2AB-ACCD-4F29-96CF-D27A6737A799@gmail.com> <8f95317e-880d-f064-49a1-e51945b06b29@cs.ox.ac.uk> <20190724031343.GD27936@akamai.com> <78479d60-6b30-4a8f-9605-648eaad8624c@cs.ox.ac.uk> MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <78479d60-6b30-4a8f-9605-648eaad8624c@cs.ox.ac.uk> User-Agent: Mutt/1.5.24 (2015-08-30) X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-07-24_04:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 mlxscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1906280000 definitions=main-1907240127 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:5.22.84,1.0.8 definitions=2019-07-24_04:2019-07-24,2019-07-24 signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 lowpriorityscore=0 bulkscore=0 clxscore=1015 mlxlogscore=999 impostorscore=0 priorityscore=1501 phishscore=0 malwarescore=0 adultscore=0 mlxscore=0 spamscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-1906280000 definitions=main-1907240128 Archived-At: Subject: Re: [TLS] TLS Impact on Network Security draft updated X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 11:27:49 -0000 On Wed, Jul 24, 2019 at 05:19:46AM +0100, Dennis Jackson wrote: > > > On 24/07/2019 04:13, Benjamin Kaduk wrote: > > On Wed, Jul 24, 2019 at 03:35:43AM +0100, Dennis Jackson wrote: > >> On 24/07/2019 02:55, Bret Jordan wrote: > >>> As a professional organization and part of due diligence, we need to try > >>> and understand the risks and ramifications on the deployments of our > >>> solutions. This means, understanding exactly how the market uses and > >>> needs to use the solutions we create. When we remove or change some > >>> technology, we should try hard to provide a work around. If a work > >>> around is not possible, we need to cleanly document how these changes > >>> are going to impact the market so it can prepare. This is the > >>> responsible and prudent thing to do in a professional organization like > >>> the IETF. > >>> > >> > >> The IETF is for development of Internet Standards. If you want to > >> publish your (subjective) analysis of how a particular standard is going > >> to impact your market segment, there are any number of better venues: > >> trade magazines, industry associations, your company website, etc. > > > > Actually, the Independent stream of the RFC series is purpose-built for > > individual commentary on the consequences of a particular standard > > [including in a particular segment], and would be superior (at least in > > my opinion) to any of the venues you list. (See RFC 4846.) But I > > believe the current ISE asks authors to try fairly hard to publish their > > work in the IETF before accepting it to the Indepndent stream. > > I was thinking of 'published by the IETF' to mean the IETF stream. Thanks for clarifying (more below). > Publishing in the Independent stream, without any proper review, > consensus or claim of fitness is a different matter altogether. My understanding is that the ISE insists on getting at least three reviews from knowledgable people in the field as a condition of publication. I don't know what constitutes "proper review" to you, but I do believe that the ISE takes the job seriously. > >>> The draft that Nancy and others have worked on is a great start to > >>> documenting how these new solutions are going to impact organizational > >>> networks. Regardless of whether you like the use-cases or regulations > >>> that some organizations have, they are valid and our new solutions are > >>> going to impact them. > >> > >> This isn't a question of quality. The IETF simply doesn't publish > >> documents of this nature (to my knowledge). > > > > The IETF can publish whatever there is IETF consensus to publish. (And > > a little bit more, besides, though that is probably not relevant to the > > current discussion.) > > > > I don't have a great sense of what you mean by "documents of this > > nature". If you were to say "the IETF does not publish speculative and > > subjective discussion of possible future impact", I'd be fairly likely > > to agree with you (but I have also seen a fair bit of speculation get > > published). > > This was my intended meaning. Thanks (again) for clarifying. > I'd feel rather differently about "the IETF does not > > publish objective analysis of the consequences of protocol changes on > > previously deployed configurations", and would ask if you think a > > document in the latter category is impossible for the TLS 1.2->1.3 > > transition. (My understanding is that the latter category of document > > is the desired proposal, regardless of the current state of the draft in > > question.) > > The authors initiated this discussion by stating their draft was stable > and requesting publication. Consequently, I think it must be judged on > the current state, rather than the desired outcome. Sure, and I appreciate the frank comments; I hope the authors do as well. However, my and the chairs' job is to tell them something like "make these changes and come back" or "make these changes and go to the ISE", so I have to seek feedback on a broader question than just "is it ready to go right now". > Even considering your more generous interpretation... the objective > discussion is only 3 out of 15 pages and none of the 5 claims appears to > be correct. (As others have pointed out). In light of my previous remark, I'll try to summarize that it sounds like you think that it's not worth trying to make all the changes that would be needed to meet your expectations for the output of the TLS WG. Thanks, Ben From nobody Wed Jul 24 05:30:31 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BB2EB1200EC for ; Wed, 24 Jul 2019 05:30:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.9 X-Spam-Level: X-Spam-Status: No, score=-6.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qMOMr266n-YR for ; Wed, 24 Jul 2019 05:30:27 -0700 (PDT) Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2CE251200C4 for ; Wed, 24 Jul 2019 05:30:27 -0700 (PDT) Received: from smtp.corp.redhat.com (int-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 98CA13DE0F; Wed, 24 Jul 2019 12:30:26 +0000 (UTC) Received: from pintsize.usersys.redhat.com (ovpn-200-50.brq.redhat.com [10.40.200.50]) by smtp.corp.redhat.com (Postfix) with ESMTP id 46193601B7; Wed, 24 Jul 2019 12:30:25 +0000 (UTC) From: Hubert Kario To: tls@ietf.org Date: Wed, 24 Jul 2019 14:30:19 +0200 Message-ID: <5650096.7ke3dDvEqm@pintsize.usersys.redhat.com> In-Reply-To: References: <6AF48228-19C2-41C7-BA86-BA16940C3CFF@cisco.com> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="nextPart2108931.upD5VemBPa"; micalg="pgp-sha512"; protocol="application/pgp-signature" X-Scanned-By: MIMEDefang 2.79 on 10.5.11.11 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.29]); Wed, 24 Jul 2019 12:30:26 +0000 (UTC) Archived-At: Subject: Re: [TLS] TLS Impact on Network Security draft updated X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 12:30:30 -0000 --nextPart2108931.upD5VemBPa Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="UTF-8" On Wednesday, 24 July 2019 05:17:37 CEST Ackermann, Michael wrote: > This should not be dismissed as small segments of industries. This > represents ubiquitous use cases at all large organizations in Insurance, > Health Care, Banking, Automotive and many others. Not "all" and not "ubiquitous", the word you're looking for is "some". As i= t=20 was pointed out many times already on this mailing list. > We as the IETF should > not lightly dismiss such significant numbers and volume, even (or > especially), if the answers are not easy ones.=20 Also, the people that are pushing against the IETF consens should not light= ly=20 dismiss it, even (or especially), if the answers are not the ones that they= =20 would like to hear. > From: TLS On Behalf Of Watson Ladd > Sent: Tuesday, July 23, 2019 6:58 PM > To: Filippo Valsorda > Cc: TLS List > Subject: Re: [TLS] TLS Impact on Network Security draft updated >=20 > ALERT This email was sent from a source external to BCBSM/BCN. > DO NOT CLICK links or attachments unless you recognize the sender and tr= ust > the content. =20 >=20 > On Tue, Jul 23, 2019, 3:47 PM Filippo Valsorda > > wrote: > Before any > technical or wording feedback, I am confused as to the nature of this > document. It does not seem to specify any protocol change or mechanism, a= nd > it does not even focus on solutions to move the web further.=20 > Instead, it looks like a well edited blog post, presenting the perspective > of one segment of the industry. (The perspective seems to also lack > consensus, but I believe even that is secondary.) Note how as of > draft-camwinget-tls-use-cases-05 there are no IANA considerations, no > security considerations, and no occurrences of any of the BCP 14 key words > (MUST, SHOULD, etc.). =20 > Is there precedent for publishing such a document as an RFC? >=20 > I was going to say RFC 691 but no, it recommends changes to the protocol = (as > well as being quite amusing). RFC 4074 comes close describing bad behavior > without an explicit plea to stop doing it, but has a security > considerations section. RFC 7021 describes the impact of a particular > networking technique on applications. =20 > So there is precedent. >=20 > Sincerely, > Watson >=20 >=20 > The information contained in this communication is highly confidential and > is intended solely for the use of the individual(s) to whom this > communication is directed. If you are not the intended recipient, you are > hereby notified that any viewing, copying, disclosure or distribution of > this information is prohibited. Please notify the sender, by electronic > mail or telephone, of any unintended receipt and delete the original > message without making any copies. >=20 > Blue Cross Blue Shield of Michigan and Blue Care Network of Michigan are > nonprofit corporations and independent licensees of the Blue Cross and Bl= ue > Shield Association. =2D-=20 Regards, Hubert Kario Senior Quality Engineer, QE BaseOS Security team Web: www.cz.redhat.com Red Hat Czech s.r.o., Purky=C5=88ova 115, 612 00 Brno, Czech Republic --nextPart2108931.upD5VemBPa Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part. Content-Transfer-Encoding: 7Bit -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEYeeuxEU+3unL/K+dkqjRuAHS9fUFAl04T1sACgkQkqjRuAHS 9fXE4Q/9HQTFH3qnRjTC/n5mra9Q3XbrIo2fLjAqrkPoM9weNnpO1p90FsQtsSQt oFOrkuPpzl4Yq+d2GfnysHex3q1GOZ4zflEWScyyZM7EmlxWZ2WXEh92OyPHc91/ YORZL7PcPkXas2+dLBCXfgQOZJNlN28m5oOhdQQ6wGwN2QDbJ4AXZcgbTdbH3qd2 6YnQMeaVc2Ae4Tq6xRMs6CNtAtczF8/YsWLjBgIb5a2McBiBZ1dRhdPby8YQEdQV K4TCODovsfo5TWAmL/zabSX7EBasaIcoBK+aqnPidEBIVhuwEBviOSVrQ9Yg/FbC rYgIdYVlOgST2OkrbxNpdSAoF3Wzv1E3RvSYQMRa2mAhXn8IMvbCkm4UDUslw9zk CS0MjZ6VmYrbJGP65XJt4TVEGSOsVpCAlbTry9ouwxG3mrSnCxn6h1R+yVG65xsq Wulc+ypHoKu2iFRPTLYAvhP/ehaNK+x03e0h0eKWs9qcudZEKezKt0mTrlJovRiw lU0zoiIZA3dRcXkZC4rmgorD73pffSCOnY0mgoifEMp3FXVTCW/iWCRlftLZ5Eal nYxSRyZCNo2n/PG4mQGEKhtprcmEFZj4JpVsuvmE6w8XwpB48zpOL06NCAt1lMYS enk12tc2t52cdGTEg9t/A1J4c5V9m7FeAz3PszEC3a9c3GVwyjI= =R9FF -----END PGP SIGNATURE----- --nextPart2108931.upD5VemBPa-- From nobody Wed Jul 24 05:46:58 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 033071200C4 for ; Wed, 24 Jul 2019 05:46:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=heapingbits.net header.b=j3mnxJmi; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=grDxWD+x Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id b9IclQK7Sklp for ; Wed, 24 Jul 2019 05:46:55 -0700 (PDT) Received: from wout1-smtp.messagingengine.com (wout1-smtp.messagingengine.com [64.147.123.24]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6AD2F12000F for ; Wed, 24 Jul 2019 05:46:55 -0700 (PDT) Received: from compute6.internal (compute6.nyi.internal [10.202.2.46]) by mailout.west.internal (Postfix) with ESMTP id 8F07940C for ; Wed, 24 Jul 2019 08:46:54 -0400 (EDT) Received: from imap4 ([10.202.2.54]) by compute6.internal (MEProxy); Wed, 24 Jul 2019 08:46:54 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=heapingbits.net; h=mime-version:message-id:date:from:to:subject:content-type; s= fm1; bh=WuP+VatuLRT0PHCSnAAGLVJ+LbmUTespWSuAiXINcZY=; b=j3mnxJmi AoItVttU5KogK7ahyDTd7smZrGBjdFffFVT6VChmvoxMT0pFHrLNy1Qht9AHcCqt SU2GiE8GFdShYKBpWMnYjDl4xv+EFG/JD/3Il6JSVHJnHZU724bmaARJ3penunq9 zqBtMNEmEuboaFjJD/BfFqV5xR6PvYlwBeQvyyKZrt6SOJ5ERpUwybuFl43/e3H1 pDWdS0bqH1KmPQDOYlEJZYRaa24NymDCN9Yz6em2NtLf61OCVY5LltWqLx9gj4WM bgHrtHBvHQitRuXU8S54OCeiSKrfqmRde4z8ldXPsoWTRVIxch2BmhTMpld5blVx ww+oOfRVNlDJmQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-type:date:from:message-id :mime-version:subject:to:x-me-proxy:x-me-proxy:x-me-sender :x-me-sender:x-sasl-enc; s=fm3; bh=WuP+VatuLRT0PHCSnAAGLVJ+LbmUT espWSuAiXINcZY=; b=grDxWD+xpOhW72WxHOrLyDExn2Bxr8YvJmRfe//w0VOTG KJgdKhh1rq40exzVRCPWR2kAQ0heNy1bYSe6wztdc92OQYwuTig0Uf7zb1LP48yV +jkwf+s4i4kSKHYLTc/Pnhh04uEf0b2ExFo15SCII430M8hcUGXMIJh2sDIisw8M AgjQEKjQcu+TfI5VVHm6kCFrlcUwRNWZnJnWW6++wKeVEabtEqEPlauvdZYtjusv Zna8Y5ukntfO851aENPelQp88tWqdppjK6MM0UTH/guzg0GG3N79JANOBk23gKm9 bX7GldJO0GzWWBgStGdF9MK5VCsMmYL//YZzvi0yg== X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeduvddrkedtgdehvdcutefuodetggdotefrodftvf curfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfghnecu uegrihhlohhuthemuceftddtnecunecujfgurhepofgfggfkfffhvffutgesthdtredtre ertdenucfhrhhomhepfdevhhhrihhsthhophhhvghrucghohhougdfuceotggrfieshhgv rghpihhnghgsihhtshdrnhgvtheqnecuffhomhgrihhnpehivghtfhdrohhrghenucfrrg hrrghmpehmrghilhhfrhhomheptggrfieshhgvrghpihhnghgsihhtshdrnhgvthenucev lhhushhtvghrufhiiigvpedt X-ME-Proxy: Received: by mailuser.nyi.internal (Postfix, from userid 501) id D2D7D3C00A1; Wed, 24 Jul 2019 08:46:53 -0400 (EDT) X-Mailer: MessagingEngine.com Webmail Interface User-Agent: Cyrus-JMAP/3.1.6-736-gdfb8e44-fmstable-20190718v2 Mime-Version: 1.0 Message-Id: <01a21cca-c0b1-4b40-9add-0ea303d0083c@www.fastmail.com> Date: Wed, 24 Jul 2019 08:46:24 -0400 From: "Christopher Wood" To: "TLS@ietf.org" Content-Type: text/plain Archived-At: Subject: [TLS] Adoption call for draft-nir-tls-tlsflags X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 12:46:57 -0000 At TLS@IETF105, there was interest in the room to adopt draft-nir-tls-tlsflags as a WG item. The draft can be found here: https://datatracker.ietf.org/doc/draft-nir-tls-tlsflags/ This email starts the call for adoption. It will run until August 7, 2019. Please indicate whether or not you would like to see this draft adopted. Best, Chris, on behalf of the chairs From nobody Wed Jul 24 05:48:33 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 077F61200C4 for ; Wed, 24 Jul 2019 05:48:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=heapingbits.net header.b=roxSSxIo; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=JfmbQaMM Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1I-YXlllPpDc for ; Wed, 24 Jul 2019 05:48:23 -0700 (PDT) Received: from wout1-smtp.messagingengine.com (wout1-smtp.messagingengine.com [64.147.123.24]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D557212000F for ; Wed, 24 Jul 2019 05:48:23 -0700 (PDT) Received: from compute6.internal (compute6.nyi.internal [10.202.2.46]) by mailout.west.internal (Postfix) with ESMTP id 0BA7D40E for ; Wed, 24 Jul 2019 08:48:22 -0400 (EDT) Received: from imap4 ([10.202.2.54]) by compute6.internal (MEProxy); Wed, 24 Jul 2019 08:48:23 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=heapingbits.net; h=mime-version:message-id:date:from:to:subject:content-type; s= fm1; bh=AyasO4FvilklmAzAGsC7amc5JAJzQ6M8SMUBP+9I8hM=; b=roxSSxIo dMHR5+AzS+hZigqjOo7uxMYFcRBXy2nUz1jiweTMup/BaxZcQDiTtZ9SLHTp1ui3 FPkonBKt+jIJH/EOJapX1r4DXg9hN6LWU1NX1uJfZONKGCp8PADGadap288hRPSO ze4kI1Ft+A1Lej0jJZIQmcWhUla8/O8OjRC6OGvThD0SYkJT0r1QUITdDBjiOC7g 1X501tH39QrhKT91NQgiDOicDIx/tIfAjshWvZBXhQbttIXRPinOUqZTrX9zKCfH liuis8ChoqUfz22RiM43d0bxHHd5sqAEVW3wQZ+XjwFjaPdH+BJop9tcDnOrnIhJ UnEyt9nzr+67qw== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-type:date:from:message-id :mime-version:subject:to:x-me-proxy:x-me-proxy:x-me-sender :x-me-sender:x-sasl-enc; s=fm3; bh=AyasO4FvilklmAzAGsC7amc5JAJzQ 6M8SMUBP+9I8hM=; b=JfmbQaMMrVk+3/qKvqwcUXP8NfL40yl8u14GKCEu/ZUiR z5BjDzPmrOerB4rG3NAXO3vx72Kwuii9hG++GYzE2+O643guhm87borRGLeJyUuL 2ipysyveo8zo3GcnL6rhyh2t/PGbZ3KydY0DgwIxxuzNE540GpkjeaWg24bBLWbU 9nJqWz2FHJi47ZZdvYXs+eJLwlSc++Ja5ELyfd2FT9YasGSV6mNCUvk+8yWlf0om tPl79pWtySwZwwNy28Be7y+J3knSVE2931tYTIh44qRcNMogdRtE0mmxVGkfkE5K lDJC34UC3x82KfySnVCGr+4/r9fJncqVPXZ+mxSuw== X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeduvddrkedtgdehvdcutefuodetggdotefrodftvf curfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfghnecu uegrihhlohhuthemuceftddtnecunecujfgurhepofgfggfkfffhvffutgesthdtredtre ertdenucfhrhhomhepfdevhhhrihhsthhophhhvghrucghohhougdfuceotggrfieshhgv rghpihhnghgsihhtshdrnhgvtheqnecuffhomhgrihhnpehivghtfhdrohhrghenucfrrg hrrghmpehmrghilhhfrhhomheptggrfieshhgvrghpihhnghgsihhtshdrnhgvthenucev lhhushhtvghrufhiiigvpedu X-ME-Proxy: Received: by mailuser.nyi.internal (Postfix, from userid 501) id 3080D3C00A1; Wed, 24 Jul 2019 08:48:22 -0400 (EDT) X-Mailer: MessagingEngine.com Webmail Interface User-Agent: Cyrus-JMAP/3.1.6-736-gdfb8e44-fmstable-20190718v2 Mime-Version: 1.0 Message-Id: Date: Wed, 24 Jul 2019 08:48:21 -0400 From: "Christopher Wood" To: "TLS@ietf.org" Content-Type: text/plain Archived-At: Subject: [TLS] Adoption call for draft-lvelvindron-tls-md5-sha1-deprecate X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 12:48:25 -0000 At TLS@IETF105, there was interest in the room to adopt draft-lvelvindron-tls-md5-sha1-deprecate as a WG item. The draft can be found here: https://datatracker.ietf.org/doc/draft-lvelvindron-tls-md5-sha1-deprecate/ This email starts the call for adoption. It will run until August 7, 2019. Please indicate whether or not you would like to see this draft adopted. Best, Chris, on behalf of the chairs From nobody Wed Jul 24 05:55:25 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AF3C7120071 for ; Wed, 24 Jul 2019 05:55:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=lowentropy.net header.b=O9aKnr7i; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=0LbwS4bq Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TP8NnxbRRa0r for ; Wed, 24 Jul 2019 05:55:21 -0700 (PDT) Received: from new2-smtp.messagingengine.com (new2-smtp.messagingengine.com [66.111.4.224]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E9E88120148 for ; Wed, 24 Jul 2019 05:55:17 -0700 (PDT) Received: from compute1.internal (compute1.nyi.internal [10.202.2.41]) by mailnew.nyi.internal (Postfix) with ESMTP id 086C41D62 for ; Wed, 24 Jul 2019 08:55:17 -0400 (EDT) Received: from imap2 ([10.202.2.52]) by compute1.internal (MEProxy); Wed, 24 Jul 2019 08:55:17 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lowentropy.net; h=mime-version:message-id:in-reply-to:references:date:from:to :subject:content-type; s=fm2; bh=HB8AqJaQmg9jjW2cecaEsjDjHgARmJH aLHMbvmn8HH8=; b=O9aKnr7iEQawfGv9dICQAo/ZnUqpwDl+btsYmXCb3wt6ZD8 zVvY2KCgJk7hZ6E0YQfti7dU6354FXLaRHCsU7M+KJmnaIPYtq8sG+xMWmhcjr5K nL2I6XPOclkXW2idvJjOdIIeRi+3/gXq5Vq0kZGfbdTe1aETkNhGIDsnt8LYjPtG aycwkPyM3N19F1cJfIraHXN8PeDVal4BQ077KJzP3+wAoaCj2IPnDfGunBDv89GZ 3o+3eoelXuXFhEJh6JWKsSRgN2SQqy69+XapAzBL5b+0sIJo2N3cMkr6eXDAIlqZ YBZXh0gjUeLeA6jFwBvLtKo9OrTXK+FVhYtYQEg== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-proxy :x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm3; bh=HB8AqJ aQmg9jjW2cecaEsjDjHgARmJHaLHMbvmn8HH8=; b=0LbwS4bq83cnQV6Vdk32JL PhpZCs0o08SQvTiWgk2URWUCna+vyvq89q5M/s7xbKDZyyrcUb3m2nMaiRStPHSX a+/gl5Bcg8/O6QU0wgikOp1NM5ckNwAQgBTg0IC4eFVi6R/jROTnH0Yl+kcudTy7 OKAum/FU7EM3ChkNgkwUQ/SB/DB47Aj0hrfeXdZMWIqEDp+rcOj5mQKcuKeaG31l Fb9vaeYrpOCHdapPXqAWCPiXCjjWNtJINPCjpwDOb8f8shHpW8ccs912MxCQQDMi t9SUeO4qnTXGZ6aTvd+FRUxRFLFrdqpPGLAq07cmpgs1rE4VRYJzEhg1JbBrKYKQ == X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeduvddrkedtgdehfecutefuodetggdotefrodftvf curfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfghnecu uegrihhlohhuthemuceftddtnecunecujfgurhepofgfggfkjghffffhvffutgesthdtre dtreertdenucfhrhhomhepfdforghrthhinhcuvfhhohhmshhonhdfuceomhhtsehlohif vghnthhrohhphidrnhgvtheqnecuffhomhgrihhnpehktgdvkhgumhdrtghomhenucfrrg hrrghmpehmrghilhhfrhhomhepmhhtsehlohifvghnthhrohhphidrnhgvthenucevlhhu shhtvghrufhiiigvpedt X-ME-Proxy: Received: by mailuser.nyi.internal (Postfix, from userid 501) id BB2D9E0129; Wed, 24 Jul 2019 08:55:16 -0400 (EDT) X-Mailer: MessagingEngine.com Webmail Interface User-Agent: Cyrus-JMAP/3.1.6-736-gdfb8e44-fmstable-20190718v2 Mime-Version: 1.0 Message-Id: <5c67d344-f1a9-4311-a1b7-1f1af49f5546@www.fastmail.com> In-Reply-To: References: <63A3AC36-E5DB-49F2-AD42-7B6672538A2F@akamai.com> Date: Wed, 24 Jul 2019 08:55:16 -0400 From: "Martin Thomson" To: tls@ietf.org Content-Type: text/plain Archived-At: Subject: Re: [TLS] Draft minutes for Tuesday X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 12:55:23 -0000 On Tue, Jul 23, 2019, at 21:09, Watson Ladd wrote: > One note: kc2kdm.com is up and working with NSS clients. Please hit it! Firefox nightly now has the preference "security.tls.enable_delegated_credentials" in about:config. I wouldn't recommend turning that on on a permanent basis, but you can now use a browser to drive this. From nobody Wed Jul 24 06:11:38 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4634F1201D0 for ; Wed, 24 Jul 2019 06:11:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=akamai.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pGFD2Nzq_4BY for ; Wed, 24 Jul 2019 06:11:34 -0700 (PDT) Received: from mx0a-00190b01.pphosted.com (mx0a-00190b01.pphosted.com [IPv6:2620:100:9001:583::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C48441200EC for ; Wed, 24 Jul 2019 06:11:34 -0700 (PDT) Received: from pps.filterd (m0122333.ppops.net [127.0.0.1]) by mx0a-00190b01.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id x6OD6iZx015387; Wed, 24 Jul 2019 14:11:32 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=akamai.com; h=from : to : cc : subject : date : message-id : references : in-reply-to : content-type : mime-version; s=jan2016.eng; bh=pMAazZAV3eCaR+cUVWvJt5EJyquh018s2uU6pxZB6bY=; b=M0crzpI9nufwc3Gb0gwnOc/NDyrk5FJcgWPPaVHjzQ1eecSwLM0nUfxcK0SSCYnFC9Sc wL1Rxo58genfdYLK0eNSncxGDHe5cu5gqgVJo3/5XgnpoZ8V4jcWE9/e0vWe9Z9fL6XA W/xKs3eaUeb8c3aqTe/W6380YCSApV9YR7fmlc91e89ROIQFI5+djLdCCaEG1hTqNydd 1J3tZhbrbQfuhFOXGjGq+k/ThO56tjwk+tkq98eWcMi2URvkbWtF3UGOq2a64WLZwHj4 LkA0nVa9xOGO5xburxgmNMERVYim12NZNgEA0tnZgQ8DuFdxqo9MxJeNWIvg8kxTnYmE dA== Received: from prod-mail-ppoint2 (prod-mail-ppoint2.akamai.com [184.51.33.19] (may be forged)) by mx0a-00190b01.pphosted.com with ESMTP id 2tx60rukq2-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 24 Jul 2019 14:11:32 +0100 Received: from pps.filterd (prod-mail-ppoint2.akamai.com [127.0.0.1]) by prod-mail-ppoint2.akamai.com (8.16.0.27/8.16.0.27) with SMTP id x6OD25Dw024136; Wed, 24 Jul 2019 09:11:31 -0400 Received: from email.msg.corp.akamai.com ([172.27.123.32]) by prod-mail-ppoint2.akamai.com with ESMTP id 2tx62ycesa-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Wed, 24 Jul 2019 09:11:29 -0400 Received: from USMA1EX-DAG1MB1.msg.corp.akamai.com (172.27.123.101) by usma1ex-dag1mb1.msg.corp.akamai.com (172.27.123.101) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Wed, 24 Jul 2019 09:11:29 -0400 Received: from USMA1EX-DAG1MB1.msg.corp.akamai.com ([172.27.123.101]) by usma1ex-dag1mb1.msg.corp.akamai.com ([172.27.123.101]) with mapi id 15.00.1473.005; Wed, 24 Jul 2019 09:11:29 -0400 From: "Salz, Rich" To: "Ackermann, Michael" , Watson Ladd , Filippo Valsorda CC: TLS List Thread-Topic: [TLS] TLS Impact on Network Security draft updated Thread-Index: AQHVP8tnovYBmAyQbUu5TybMCHUv66bZFHaAgAADLgCAAEiDgIAAYt0A Date: Wed, 24 Jul 2019 13:11:28 +0000 Message-ID: References: <6AF48228-19C2-41C7-BA86-BA16940C3CFF@cisco.com> <77d58a41-7a6b-4886-a4d4-22dcb229100b@www.fastmail.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.1b.0.190715 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [172.19.35.184] Content-Type: multipart/alternative; boundary="_000_F47FF706325D4D1D8788EED294D121B3akamaicom_" MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-07-24_05:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 mlxscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1906280000 definitions=main-1907240147 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:5.22.84,1.0.8 definitions=2019-07-24_05:2019-07-24,2019-07-24 signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 adultscore=0 lowpriorityscore=0 spamscore=0 phishscore=0 mlxlogscore=987 impostorscore=0 mlxscore=0 malwarescore=0 priorityscore=1501 clxscore=1011 bulkscore=0 suspectscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-1906280000 definitions=main-1907240148 Archived-At: Subject: Re: [TLS] TLS Impact on Network Security draft updated X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 13:11:36 -0000 --_000_F47FF706325D4D1D8788EED294D121B3akamaicom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 ICAqICAgVGhpcyBzaG91bGQgbm90IGJlIGRpc21pc3NlZCBhcyBzbWFsbCBzZWdtZW50cyBvZiBp bmR1c3RyaWVzLiAgICBUaGlzIHJlcHJlc2VudHMgdWJpcXVpdG91cyB1c2UgY2FzZXMgYXQgYWxs IGxhcmdlIG9yZ2FuaXphdGlvbnMgaW4gSW5zdXJhbmNlLCBIZWFsdGggQ2FyZSwgQmFua2luZywg QXV0b21vdGl2ZSBhbmQgbWFueSBvdGhlcnMuDQoNCkFsbCBnZW5lcmFsaXphdGlvbiBhcmUgZmFs c2UsIGluY2x1ZGluZyB0aGUgY2xhaW0gdGhhdCB0aGVzZSBhcmUgdWJpcXVpdG91cyB1c2VzIGF0 IGFsbCBsYXJnZSBvcmdhbml6YXRpb25zIGluIHRoZSBuYW1lZCBpbmR1c3RyaWVzLiAgSSBrbm93 IGNvdW50ZXJmYWN0dWFscy4NCg== --_000_F47FF706325D4D1D8788EED294D121B3akamaicom_ Content-Type: text/html; charset="utf-8" Content-ID: <1C3DD320093D3F4AB3A4B8D5EF07BD67@akamai.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseTpXaW5nZGluZ3M7DQoJcGFub3NlLTE6NSAwIDAgMCAwIDAgMCAwIDAg MDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJDYW1icmlhIE1hdGgiOw0KCXBhbm9zZS0x OjIgNCA1IDMgNSA0IDYgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDYWxpYnJp Ow0KCXBhbm9zZS0xOjIgMTUgNSAyIDIgMiA0IDMgMiA0O30NCi8qIFN0eWxlIERlZmluaXRpb25z ICovDQpwLk1zb05vcm1hbCwgbGkuTXNvTm9ybWFsLCBkaXYuTXNvTm9ybWFsDQoJe21hcmdpbi10 b3A6MGluOw0KCW1hcmdpbi1yaWdodDowaW47DQoJbWFyZ2luLWJvdHRvbTo4LjBwdDsNCgltYXJn aW4tbGVmdDowaW47DQoJbGluZS1oZWlnaHQ6MTIwJTsNCglmb250LXNpemU6MTIuNXB0Ow0KCWZv bnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxp bmsNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0 aW9uOnVuZGVybGluZTt9DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7 bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246 dW5kZXJsaW5lO30NCnAuTXNvTGlzdFBhcmFncmFwaCwgbGkuTXNvTGlzdFBhcmFncmFwaCwgZGl2 Lk1zb0xpc3RQYXJhZ3JhcGgNCgl7bXNvLXN0eWxlLXByaW9yaXR5OjM0Ow0KCW1hcmdpbi10b3A6 MGluOw0KCW1hcmdpbi1yaWdodDowaW47DQoJbWFyZ2luLWJvdHRvbTo4LjBwdDsNCgltYXJnaW4t bGVmdDouNWluOw0KCWxpbmUtaGVpZ2h0OjEyMCU7DQoJZm9udC1zaXplOjEyLjVwdDsNCglmb250 LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQpwLm1zb25vcm1hbDAsIGxpLm1zb25vcm1h bDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCgltc28tbWFy Z2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4tYm90dG9t LWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQt ZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnNwYW4uRW1haWxTdHlsZTE4DQoJe21zby1z dHlsZS10eXBlOnBlcnNvbmFsOw0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0K CWNvbG9yOndpbmRvd3RleHQ7fQ0Kc3Bhbi5FbWFpbFN0eWxlMjANCgl7bXNvLXN0eWxlLXR5cGU6 cGVyc29uYWwtcmVwbHk7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29s b3I6d2luZG93dGV4dDt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQt b25seTsNCglmb250LXNpemU6MTAuMHB0O30NCkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjgu NWluIDExLjBpbjsNCgltYXJnaW46MS4waW4gMS4waW4gMS4waW4gMS4waW47fQ0KZGl2LldvcmRT ZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQovKiBMaXN0IERlZmluaXRpb25zICovDQpA bGlzdCBsMA0KCXttc28tbGlzdC1pZDoxODY3Mjg0MDg4Ow0KCW1zby1saXN0LXR5cGU6aHlicmlk Ow0KCW1zby1saXN0LXRlbXBsYXRlLWlkczotMTY0MDMyODA4NiAtMTY1NDUwMDUwMiA2NzY5ODY5 MSA2NzY5ODY5MyA2NzY5ODY4OSA2NzY5ODY5MSA2NzY5ODY5MyA2NzY5ODY4OSA2NzY5ODY5MSA2 NzY5ODY5Mzt9DQpAbGlzdCBsMDpsZXZlbDENCgl7bXNvLWxldmVsLXN0YXJ0LWF0OjM7DQoJbXNv LWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+DmDsNCgltc28t bGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJ dGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczsNCgltc28tZmFyZWFz dC1mb250LWZhbWlseTpDYWxpYnJpOw0KCW1zby1iaWRpLWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcg Um9tYW4iO30NCkBsaXN0IGwwOmxldmVsMg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxs ZXQ7DQoJbXNvLWxldmVsLXRleHQ6bzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28t bGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQt ZmFtaWx5OiJDb3VyaWVyIE5ldyI7fQ0KQGxpc3QgbDA6bGV2ZWwzDQoJe21zby1sZXZlbC1udW1i ZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1z dG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50 Oi0uMjVpbjsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDA6bGV2ZWw0DQoJe21z by1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNv LWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0K CXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDA6bGV2 ZWw1DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDpv Ow0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246 bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3Ijt9 DQpAbGlzdCBsMDpsZXZlbDYNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1z by1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwt bnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5 OldpbmdkaW5nczt9DQpAbGlzdCBsMDpsZXZlbDcNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6 YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsN Cgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0K CWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMDpsZXZlbDgNCgl7bXNvLWxldmVsLW51bWJl ci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Om87DQoJbXNvLWxldmVsLXRhYi1zdG9w Om5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0u MjVpbjsNCglmb250LWZhbWlseToiQ291cmllciBOZXciO30NCkBsaXN0IGwwOmxldmVsOQ0KCXtt c28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1z by1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsN Cgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCm9sDQoJe21h cmdpbi1ib3R0b206MGluO30NCnVsDQoJe21hcmdpbi1ib3R0b206MGluO30NCi0tPjwvc3R5bGU+ DQo8L2hlYWQ+DQo8Ym9keSBsYW5nPSJFTi1VUyIgbGluaz0iYmx1ZSIgdmxpbms9InB1cnBsZSI+ DQo8ZGl2IGNsYXNzPSJXb3JkU2VjdGlvbjEiPg0KPHVsIHN0eWxlPSJtYXJnaW4tdG9wOjBpbiIg dHlwZT0iZGlzYyI+DQo8bGkgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJtYXJnaW4t bGVmdDowaW47bXNvLWxpc3Q6bDAgbGV2ZWwxIGxmbzEiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2xpbmUtaGVpZ2h0OjEyMCUiPlRoaXMgc2hvdWxkIG5vdCBiZSBkaXNtaXNzZWQgYXMg c21hbGwgc2VnbWVudHMgb2YgaW5kdXN0cmllcy4mbmJzcDsmbmJzcDsmbmJzcDsgVGhpcyByZXBy ZXNlbnRzIHViaXF1aXRvdXMgdXNlIGNhc2VzIGF0IGFsbCBsYXJnZSBvcmdhbml6YXRpb25zIGlu DQogSW5zdXJhbmNlLCBIZWFsdGggQ2FyZSwgQmFua2luZywgQXV0b21vdGl2ZSBhbmQgbWFueSBv dGhlcnMuJm5ic3A7IDwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtsaW5lLWhl aWdodDoxMjAlIj48bzpwPjwvbzpwPjwvc3Bhbj48L2xpPjwvdWw+DQo8cD5BbGwgZ2VuZXJhbGl6 YXRpb24gYXJlIGZhbHNlLCBpbmNsdWRpbmcgdGhlIGNsYWltIHRoYXQgdGhlc2UgYXJlIHViaXF1 aXRvdXMgdXNlcyBhdCBhbGwgbGFyZ2Ugb3JnYW5pemF0aW9ucyBpbiB0aGUgbmFtZWQgaW5kdXN0 cmllcy4mbmJzcDsgSSBrbm93IGNvdW50ZXJmYWN0dWFscy48bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPC9ib2R5Pg0KPC9odG1sPg0K --_000_F47FF706325D4D1D8788EED294D121B3akamaicom_-- From nobody Wed Jul 24 06:16:36 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4CE281201EA for ; Wed, 24 Jul 2019 06:16:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PNzCIDwyKEh6 for ; Wed, 24 Jul 2019 06:16:33 -0700 (PDT) Received: from mail-lf1-x131.google.com (mail-lf1-x131.google.com [IPv6:2a00:1450:4864:20::131]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7C9A71201E6 for ; Wed, 24 Jul 2019 06:16:33 -0700 (PDT) Received: by mail-lf1-x131.google.com with SMTP id c9so31885849lfh.4 for ; Wed, 24 Jul 2019 06:16:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=LG7WRev3WvNfTG19c4qP4xvLU/Zii+2hHAXprE7NBbs=; b=xaI/IN5YpHc8OFcU7rsgJRUCsdPiMLyobZzVy1M5fVW7U7IyoFGfsDG5nSoZNnjQNP JkNR4Ecw70MhdfAnhLBFCFQsTcJ5aLMLar2HGoDKp/KoSnkqycZze6mnM3bpgQmfo/29 FK0AbVjZf7yINYqqPkkJ4hFnIKpNpXOxwVRnnPm6DuigUJl+I4Vr6ramx3AFb74JWCMu rjmpcIqT7tD+WVzZJrYk4LMsyiTKKaU2UgvPUeFPBRD23NTIoHJfDKhTDXdLnRkrPjeG M/J/4remWEI8AhhGpySsobIHCUBnASUM6KsmQLuCDtN45hlM8yv7f676b68yXFIior62 3IOg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=LG7WRev3WvNfTG19c4qP4xvLU/Zii+2hHAXprE7NBbs=; b=ARLB932iYdbIXACrbd9zUSCu+msjD9YLOag1TRVymcKrEIwSzZQL57XFRzqETA9sr/ FTFKJujc3iByroCgT2R48ieebsJGINIQZqhghxl01N5/VoSVh5qhYvsWbZwg8JlvyvEW CSMoh2oInLhG0dGIiW1Q5jNxjf/jJx4ggStNP4xC+459o5FZ1UfJFAiUEPxVslacw7j8 VkQBKONW3DKUCaz93fJwXznFz85jbtjoKy5Hv7j9xTPEzaxSQToak623pU62zP5/hSbh qIErJDlvvdVtSh2jiozNbmOk/dei4PcBTYGUW1+aYNv7kufmx9JObcFuXA0JJqzrXMO1 UnMg== X-Gm-Message-State: APjAAAV1opOWHZq5lmmwofs9iqonLtdV6rmtyPTXzuGAgEtd7cgiyjui ustLb8RYn4FON1fYnFcMqNWjcRaQ8cpN/0QbcKHxfw== X-Google-Smtp-Source: APXvYqwus+hvFvwVe7LskmtH04UXOHnnWFi0rcq4uitEGuq0MbPqh6v4ZjVo2dgbDDAJe9TeOo9ZfCte1IFBr2+hsDw= X-Received: by 2002:a19:f24e:: with SMTP id d14mr39825093lfk.184.1563974191760; Wed, 24 Jul 2019 06:16:31 -0700 (PDT) MIME-Version: 1.0 References: <01a21cca-c0b1-4b40-9add-0ea303d0083c@www.fastmail.com> In-Reply-To: <01a21cca-c0b1-4b40-9add-0ea303d0083c@www.fastmail.com> From: Eric Rescorla Date: Wed, 24 Jul 2019 06:15:55 -0700 Message-ID: To: Christopher Wood Cc: "TLS@ietf.org" Content-Type: multipart/alternative; boundary="000000000000235ba9058e6d1e0c" Archived-At: Subject: Re: [TLS] Adoption call for draft-nir-tls-tlsflags X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 13:16:35 -0000 --000000000000235ba9058e6d1e0c Content-Type: text/plain; charset="UTF-8" I am in favor of adopting this. On Wed, Jul 24, 2019 at 5:47 AM Christopher Wood wrote: > At TLS@IETF105, there was interest in the room to adopt > draft-nir-tls-tlsflags as a WG item. The draft can be found here: > > https://datatracker.ietf.org/doc/draft-nir-tls-tlsflags/ > > This email starts the call for adoption. It will run until August 7, 2019. > Please indicate whether or not you would like to see this draft adopted. > > Best, > Chris, on behalf of the chairs > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > --000000000000235ba9058e6d1e0c Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
I am in favor of adopting this.

On Wed, Jul 24, 2019 at= 5:47 AM Christopher Wood <caw@he= apingbits.net> wrote:
At TLS@IETF105, there was interest in the room to adopt draft-= nir-tls-tlsflags as a WG item. The draft can be found here:

=C2=A0 =C2=A0https://datatracker.ietf.org/do= c/draft-nir-tls-tlsflags/

This email starts the call for adoption. It will run until August 7, 2019. = Please indicate whether or not you would like to see this draft adopted.
Best,
Chris, on behalf of the chairs

_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls
--000000000000235ba9058e6d1e0c-- From nobody Wed Jul 24 06:16:58 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0634A1203B0 for ; Wed, 24 Jul 2019 06:16:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VE1Moo7-07jm for ; Wed, 24 Jul 2019 06:16:49 -0700 (PDT) Received: from mail-lf1-x134.google.com (mail-lf1-x134.google.com [IPv6:2a00:1450:4864:20::134]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0D2361203B9 for ; Wed, 24 Jul 2019 06:16:49 -0700 (PDT) Received: by mail-lf1-x134.google.com with SMTP id h28so31912371lfj.5 for ; Wed, 24 Jul 2019 06:16:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=gisNfXdwm0JGA8K50nhIQKgmFQIAm8Yqf/uFZfrdUEs=; b=xgwkqqvG8jhXeUynIueSus2UtK4lT7foYkex9Xu7wUM6cZW8780de9KxvB9qoFFDsi WmoWPpfLu5aZ0vocST+Do8DlqGK1t5GBKiSGcqkAsBtn5GwlSsywXP52AV1aC1np9rxr fjoNgaIhiZg2FzAeaYKo+jQdaFixJUxEPPXGYvcAsBe4yk1fO9ZeHNniqiWwn17fCl1R B1QL9qK3d6num7r5bdjKmtNjNux7aYFXmtpQcObRPeuiS6MObmkS9NrdlNt1O9p1n1O9 ZVdWt0q4WjmsIV4HoZG8wVnTVjmWtS/YNJdLKr8aFlrukNewXu2srPjptqitdmX2WnOh rStQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=gisNfXdwm0JGA8K50nhIQKgmFQIAm8Yqf/uFZfrdUEs=; b=MbpbbWXikpWwnEamwjNe5/Af0WggMJAzX7FgnknuYTwd3QvwKfDAg1iYDnd9nZ8Q6s /qVbXlyEz5a4FzWyoEXZ8mY3nsfHS2qA6mCpwyKBIr5v8RCXw34yQDsd89EtUzDKERH9 oDbbY1QGQQRI2k6mMA/1IPbxhBDuSVw9wDL0PJvsH5XGrWRa+bFxPd9CR0KzT2z77esw QKS+26QkdElzuj9ZCQTt4VET3AC9+LCg8Dl30TYCqgrYcwCWfzgG9v+CQvwXcTOlV81o M2vnwaA/MNf9m6C275zoi57dOL+W4zJT67cILQ7kV/yabBci6zJ2rrcy9TPV7UYcRVRL dQwQ== X-Gm-Message-State: APjAAAUWBZsH0Rt7nxkLj3byA3f6t2l6WeaXHMlBQApAbSLagqWMfFLG 8E3OguY+ccEyZSWNytceD4XbdUfFGVYaxbA30oM= X-Google-Smtp-Source: APXvYqxka/t/Iea91TVnsZNSvF3DytwrFXgb89Y5IHDWxc8GwL2KGTeAK1sswFeVLrptWM+T3Q1dh77fGGeX1lXmQe0= X-Received: by 2002:a19:4a50:: with SMTP id x77mr37566318lfa.91.1563974207351; Wed, 24 Jul 2019 06:16:47 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Eric Rescorla Date: Wed, 24 Jul 2019 06:16:10 -0700 Message-ID: To: Christopher Wood Cc: "TLS@ietf.org" Content-Type: multipart/alternative; boundary="00000000000011426d058e6d1faa" Archived-At: Subject: Re: [TLS] Adoption call for draft-lvelvindron-tls-md5-sha1-deprecate X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 13:16:56 -0000 --00000000000011426d058e6d1faa Content-Type: text/plain; charset="UTF-8" I am in favor of adopting this document. On Wed, Jul 24, 2019 at 5:49 AM Christopher Wood wrote: > At TLS@IETF105, there was interest in the room to adopt > draft-lvelvindron-tls-md5-sha1-deprecate as a WG item. The draft can be > found here: > > > https://datatracker.ietf.org/doc/draft-lvelvindron-tls-md5-sha1-deprecate/ > > This email starts the call for adoption. It will run until August 7, 2019. > Please indicate whether or not you would like to see this draft adopted. > > Best, > Chris, on behalf of the chairs > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > --00000000000011426d058e6d1faa Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
I am in favor of adopting this document.

On Wed, Jul 24= , 2019 at 5:49 AM Christopher Wood <caw@heapingbits.net> wrote:
At TLS@IETF105, there was interest in the room to ado= pt draft-lvelvindron-tls-md5-sha1-deprecate as a WG item. The draft can be = found here:

=C2=A0 =C2=A0https://datat= racker.ietf.org/doc/draft-lvelvindron-tls-md5-sha1-deprecate/

This email starts the call for adoption. It will run until August 7, 2019. = Please indicate whether or not you would like to see this draft adopted.
Best,
Chris, on behalf of the chairs

_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls
--00000000000011426d058e6d1faa-- From nobody Wed Jul 24 06:40:43 2019 Return-Path: X-Original-To: tls@ietf.org Delivered-To: tls@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 3A4B1120193; Wed, 24 Jul 2019 06:40:41 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: IETF Secretariat To: , , X-Test-IDTracker: no X-IETF-IDTracker: 6.99.1 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <156397564123.14574.16167969842033515999.idtracker@ietfa.amsl.com> Date: Wed, 24 Jul 2019 06:40:41 -0700 Archived-At: Subject: [TLS] The TLS WG has placed draft-nir-tls-tlsflags in state "Call For Adoption By WG Issued" X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 13:40:41 -0000 The TLS WG has placed draft-nir-tls-tlsflags in state Call For Adoption By WG Issued (entered by Sean Turner) The document is available at https://datatracker.ietf.org/doc/draft-nir-tls-tlsflags/ From nobody Wed Jul 24 06:42:07 2019 Return-Path: X-Original-To: tls@ietf.org Delivered-To: tls@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 4BF57120168; Wed, 24 Jul 2019 06:42:05 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: IETF Secretariat To: , , X-Test-IDTracker: no X-IETF-IDTracker: 6.99.1 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <156397572530.14653.7484421586674971558.idtracker@ietfa.amsl.com> Date: Wed, 24 Jul 2019 06:42:05 -0700 Archived-At: Subject: [TLS] The TLS WG has placed draft-lvelvindron-tls-md5-sha1-deprecate in state "Call For Adoption By WG Issued" X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 13:42:06 -0000 The TLS WG has placed draft-lvelvindron-tls-md5-sha1-deprecate in state Call For Adoption By WG Issued (entered by Sean Turner) The document is available at https://datatracker.ietf.org/doc/draft-lvelvindron-tls-md5-sha1-deprecate/ From nobody Wed Jul 24 06:43:48 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 22E0312004D for ; Wed, 24 Jul 2019 06:43:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=lowentropy.net header.b=rTS83Ix/; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=ANcaoC6W Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 32rbq0EPwRCf for ; Wed, 24 Jul 2019 06:43:45 -0700 (PDT) Received: from new4-smtp.messagingengine.com (new4-smtp.messagingengine.com [66.111.4.230]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BDA9512006D for ; Wed, 24 Jul 2019 06:43:44 -0700 (PDT) Received: from compute1.internal (compute1.nyi.internal [10.202.2.41]) by mailnew.nyi.internal (Postfix) with ESMTP id BB00C1C7E for ; Wed, 24 Jul 2019 09:43:43 -0400 (EDT) Received: from imap2 ([10.202.2.52]) by compute1.internal (MEProxy); Wed, 24 Jul 2019 09:43:43 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lowentropy.net; h=mime-version:message-id:in-reply-to:references:date:from:to :subject:content-type:content-transfer-encoding; s=fm2; bh=9vlox qBkGedaXXemn8pl6zdcSOPhtBtmNXXh5zp6GJY=; b=rTS83Ix/HYN7xQFIVArWL Zb+vpbohohk4epmG2nEgZSVHqkfOxZ2b3R8y/u5o6zh/TDtemJrPjVFNyuK/x+td BSB/a98UGlLu/20K0DW5C7rihGPNVlnKDnIrwgXhc6TN2rbK5CXV2GKQgvogjqxS xYVJE5tzwwhBm6NAOyxQglW5kihSrjqkhHsIUHF4hVL+vi3yuj6LdGTV/TnNK4xV MB48rasx1bTmdOQfXjglm17hjIiuBJqo3Dsxi3JV1lGGmWeolRoY26iFxss817nw F0BQvQzIqdMrCkuod0QxlgOuq6SZ2WnWlx45KE3oy66WOSJUUosxgVTK2LopeoCy A== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-transfer-encoding:content-type :date:from:in-reply-to:message-id:mime-version:references :subject:to:x-me-proxy:x-me-proxy:x-me-sender:x-me-sender :x-sasl-enc; s=fm3; bh=9vloxqBkGedaXXemn8pl6zdcSOPhtBtmNXXh5zp6G JY=; b=ANcaoC6WVLei30Y4/ZW8ZQGb60iewvavi6Svn9yKh8ddRmj1lbiBoS4CH y+xcrm5vqKEvVDNaf3nqvNZ6iUV6juXZmAcI9yKsxmhzIJtVl2WJYdeoZsX4GRna cOtdHH1FrscQrpnkFL+XC+v/+XrzlRIHm696kt83pF9JGtSYAqJXopyubJeuEV3a er08h4nLhV94ociKSIc7xt2xZPDLtuKJ4mU6ykJqf0zNtYhlK0mqZKUsou+5gmjx Mu4ZMDeHe5C+9tdWTbPC+3uhcMAvKAjD7D2tySrFkK0e4B/AmlTQdNaXd6skzXvn xpGWAW0BVveqz5/3o6WlQEFCP0u4w== X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeduvddrkedtgdeifecutefuodetggdotefrodftvf curfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfghnecu uegrihhlohhuthemuceftddtnecunecujfgurhepofgfggfkjghffffhvffutgfgsehtqh ertderreejnecuhfhrohhmpedfofgrrhhtihhnucfvhhhomhhsohhnfdcuoehmtheslhho figvnhhtrhhophihrdhnvghtqeenucffohhmrghinhepfihikhhiphgvughirgdrohhrgh dpihgvthhfrdhorhhgnecurfgrrhgrmhepmhgrihhlfhhrohhmpehmtheslhhofigvnhht rhhophihrdhnvghtnecuvehluhhsthgvrhfuihiivgeptd X-ME-Proxy: Received: by mailuser.nyi.internal (Postfix, from userid 501) id 6E6B9E0129; Wed, 24 Jul 2019 09:43:43 -0400 (EDT) X-Mailer: MessagingEngine.com Webmail Interface User-Agent: Cyrus-JMAP/3.1.6-736-gdfb8e44-fmstable-20190718v2 Mime-Version: 1.0 Message-Id: <293ac9e3-fbaa-44ca-ad0e-cb728e20936b@www.fastmail.com> In-Reply-To: <92584B5E-5234-4C5D-ABBC-A312BB59C14F@gmail.com> References: <156393857098.27882.16925086682562389655.idtracker@ietfa.amsl.com> <92584B5E-5234-4C5D-ABBC-A312BB59C14F@gmail.com> Date: Wed, 24 Jul 2019 09:43:43 -0400 From: "Martin Thomson" To: tls@ietf.org Content-Type: text/plain;charset=utf-8 Content-Transfer-Encoding: quoted-printable Archived-At: Subject: Re: [TLS] =?utf-8?q?Fwd=3A_New_Version_Notification_for_draft-nir-tl?= =?utf-8?q?s-tlsflags-02=2Etxt?= X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 13:43:47 -0000 Hi Yoav, Thanks for doing this. I personally prefer the flag choice you have. I think that you need to move from CH,SH,EE (which has a weird duplicati= on that might be problematic), to CH, EE, CR, C. Critically, I don't th= ink that you want the ServerHello to carry any of these. Flags are gene= rally not used for key exchange, and I think that we can use the old sch= ool approach if that comes up, or define a different flags extension. The requirement for the server (or really the responder) to echo the cli= ent's flags seems like it might have some problems. From an implementer= perspective, I strongly prefer to have this processed in exactly the sa= me way as an empty extension, which is sometimes echoed and sometimes no= t as needs dictate. You can see with the case of a flag sent in ClientH= ello and responded to by the server in either EncryptedExtensions or Cer= tificate. Requiring that flags are echoed in both contexts might be con= fusing. Cheers, Martin On Wed, Jul 24, 2019, at 00:32, Yoav Nir wrote: > Hi. >=20 > Following today=E2=80=99s session, I=E2=80=99ve updated and submitted = the draft. >=20 > It contains the proposal from slide #5 in my presentation. >=20 > It does not contain any fancy way of reserving bits for future popular= =20 > extensions. >=20 > It uses a single numbering of the flags, not the more efficient=20 > separate numbering per context (CH, SH, EE, CH-in-CTLS) >=20 > I believe such bikeshedding can be done after adoption. Just so long a= s=20 > we don=E2=80=99t make it of asbestos. [1] >=20 > Yoav >=20 > [1] It was never about the color of the bike shed, but about the=20 > material: https://en.wikipedia.org/wiki/Law_of_triviality#Examples >=20 >=20 > > Begin forwarded message: > >=20 > > *From: *internet-drafts@ietf.org > > *Subject: **New Version Notification for draft-nir-tls-tlsflags-02.t= xt* > > *Date: *23 July 2019 at 23:22:50 GMT-4 > > *To: *"Yoav Nir" > >=20 > >=20 > > A new version of I-D, draft-nir-tls-tlsflags-02.txt > > has been successfully submitted by Yoav Nir and posted to the > > IETF repository. > >=20 > > Name: draft-nir-tls-tlsflags > > Revision: 02 > > Title: A Flags Extension for TLS 1.3 > > Document date: 2019-07-22 > > Group: Individual Submission > > Pages: 6 > > URL: https://www.ietf.org/internet-drafts/draft-nir-tls-tlsflags-02.= txt > > Status: https://datatracker.ietf.org/doc/draft-nir-tls-tlsflags/ > > Htmlized: https://tools.ietf.org/html/draft-nir-tls-tlsflags-02 > > Htmlized: https://datatracker.ietf.org/doc/html/draft-nir-tls-tlsfla= gs > > Diff: https://www.ietf.org/rfcdiff?url2=3Ddraft-nir-tls-tlsflags-02 > >=20 > > Abstract: > > A number of extensions are proposed in the TLS working group that > > carry no interesting information except the 1-bit indication that a= > > certain optional feature is supported. Such extensions take 4 octet= s > > each. This document defines a flags extension that can provide such= > > indications at an average marginal cost of 1 bit each. More > > precisely, it provides as many flag extensions as needed at 4 + the= > > order of the last set bit divided by 8. > >=20 > >=20 > >=20 > >=20 > > Please note that it may take a couple of minutes from the time of su= bmission > > until the htmlized version and diff are available at tools.ietf.org.= > >=20 > > The IETF Secretariat > >=20 >=20 > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > From nobody Wed Jul 24 06:51:36 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C49E71200BA for ; Wed, 24 Jul 2019 06:51:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nE_4rNjgMBMb for ; Wed, 24 Jul 2019 06:51:26 -0700 (PDT) Received: from mx0a-000b4001.pphosted.com (mx0a-000b4001.pphosted.com [148.163.146.25]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4D59E1202B7 for ; Wed, 24 Jul 2019 06:51:26 -0700 (PDT) Received: from pps.filterd (m0166814.ppops.net [127.0.0.1]) by mx0a-000b4001.pphosted.com (8.16.0.27/8.16.0.27) with SMTP id x6ODlZ0d005415 for ; Wed, 24 Jul 2019 13:51:25 GMT Received: from msa-prod01.osg.ufl.edu (msa-prod01.osg.ufl.edu [128.227.74.83]) by mx0a-000b4001.pphosted.com with ESMTP id 2txra1r4pd-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Wed, 24 Jul 2019 13:51:25 +0000 Received: from exmbxprd12.ad.ufl.edu (unknown [10.36.133.38]) by msa-prod01.osg.ufl.edu (Postfix) with ESMTPS id 47F6E6A for ; Wed, 24 Jul 2019 09:51:24 -0400 (EDT) Received: from exmbxprd23.ad.ufl.edu (128.227.145.167) by exmbxprd12.ad.ufl.edu (10.36.133.38) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Wed, 24 Jul 2019 09:51:24 -0400 Received: from exmbxprd23.ad.ufl.edu (2002:80e3:91a7::80e3:91a7) by exmbxprd23.ad.ufl.edu (2002:80e3:91a7::80e3:91a7) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Wed, 24 Jul 2019 09:51:09 -0400 Received: from NAM02-BL2-obe.outbound.protection.outlook.com (104.47.38.51) by exmbxprd23.ad.ufl.edu (128.227.145.167) with Microsoft SMTP Server (TLS) id 15.0.1395.4 via Frontend Transport; Wed, 24 Jul 2019 09:51:09 -0400 Received: from BN6PR22MB0692.namprd22.prod.outlook.com (10.172.197.10) by BN6PR22MB0978.namprd22.prod.outlook.com (10.171.181.18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2094.16; Wed, 24 Jul 2019 13:51:07 +0000 Received: from BN6PR22MB0692.namprd22.prod.outlook.com ([fe80::a56f:dd01:c0c6:514]) by BN6PR22MB0692.namprd22.prod.outlook.com ([fe80::a56f:dd01:c0c6:514%9]) with mapi id 15.20.2094.017; Wed, 24 Jul 2019 13:51:07 +0000 From: "Patton,Christopher J" To: "tls@ietf.org" Thread-Topic: [TLS] Draft minutes for Tuesday Thread-Index: AQHVQibXN7TO0LsrqUazFBNQAL6h/Q== Date: Wed, 24 Jul 2019 13:51:07 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [128.227.219.172] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 9b2f20ab-5958-49e9-f4bd-08d7103dfa4c x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:BN6PR22MB0978; x-ms-traffictypediagnostic: BN6PR22MB0978: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:7691; x-forefront-prvs: 0108A997B2 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(396003)(346002)(376002)(136003)(366004)(39860400002)(189003)(199004)(19627405001)(2351001)(55016002)(446003)(7696005)(476003)(2906002)(54896002)(25786009)(71200400001)(99286004)(9686003)(6246003)(1730700003)(186003)(71190400001)(53936002)(64756008)(5640700003)(3846002)(66574012)(14444005)(75432002)(8936002)(6506007)(6436002)(81166006)(6116002)(256004)(88552002)(2501003)(229853002)(105004)(102836004)(76116006)(478600001)(316002)(74316002)(66946007)(68736007)(14454004)(6916009)(558084003)(66446008)(66476007)(66556008)(33656002)(81156014)(76176011)(5660300002)(26005)(786003)(11346002)(66066001)(486006)(7736002)(86362001)(52536014)(8676002); DIR:OUT; SFP:1101; SCL:1; SRVR:BN6PR22MB0978; H:BN6PR22MB0692.namprd22.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: ufl.edu does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: cN++YmSe1H6whUnTkVQR3MWcbQZSngm4LiS5rH3KGaQSAuOYT8bPIQiNWZ1eYG6xkCh2BGlWjow/kuIFKIge0E7sCkLhqQYTa6pEBlLbQ5bDEIOOKgVSEjvwrtv03mxnQP6X2UzuuC3UWQgJm9Qn70E4MsY+h/kT9kOEiGPRyqVbr0LxMy+zLkC3eLn9bK82YKDAz4rc8tgDySIU6EX0LY86icBLpv6rZBY6iiLnizxphEugUA2r6U450qZk5irSUpWSgFsq2FAcmpXl+o3j0J3yogw4OudSFSjUnNONXzEWojm8yah+JwYFLsKratgAwy023MWid89ckEMmwrGp9oJ7K1MihkuKJvHIOkG0lhaBRzzhcqdqbyT+GL3DIUDycYQCxAPzpIXOKyk4TshP99woj6SEOqm71/X+684ns4I= arc-seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=V3dMIV4O1yBeK/rY6kwhkvrpj9f018C4TgBMg0f5euhYxjIqE6sY/JsngDuhD+mVFUxJnlcf0isSR/VPy3furxrv6zHez0pvW5ncZgSoilGU/FTFWpoXADCMtWn564NNcTs2RmGNHr5OUYn89nqC0MmgWG7XZqVbM94DOcmzp0BaW6yggKjpQZMuOLlpF46AI5UVh87dWcJbgMDVykpaHoXtq7xVowCqxAJo6q+eWfHR7uuJQWx0bGFp+7295B8hkJ9xCYbKlD/SJhpxo2BZ6T5HqER0XDZJCekRiMwU6xsYsnCvAKLvaUdHhwNzIVy6RpC1iWHKquVoWl4rv6yy1g== arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=HForf4u+qFGpq26ZAFwK1RWd7bM2/J3j2Uk7FMQxWqA=; b=Tp41MMbqkDKDMwEq9K/a7MFpFjpAoNdLP/ur/pmZF8Jr/XQMra1jK7SnBWkj39YfW4aXHxykYwezVSOnKEzCXqS0nJHSfinWRRIZ0CsLABAaX4lpSyRHfhw4uTLWVPYL0Sui100aN8L4o47t0+wIh6gulXu1NpKCeKFDI5XuP1Gl6uEw3IeGiiPIJdsFZ8SLfW5XtmeTiM/+VBqp8PR2YK6am0lufTz4zY56moFroV7hGBUrIWhZ1lV2nlsslT2fbNpDrVWCQ/WLf/jcwbm+7l/MwLoPHLrxpL342hZRPEkZpzzD8Xirku2k9b9l/cCiHzxuzYuVY6PaYqk9HqmMJA== arc-authentication-results: i=1; mx.microsoft.com 1;spf=pass smtp.mailfrom=ufl.edu;dmarc=pass action=none header.from=ufl.edu;dkim=pass header.d=ufl.edu;arc=none x-ms-exchange-crosstenant-network-message-id: 9b2f20ab-5958-49e9-f4bd-08d7103dfa4c x-ms-exchange-crosstenant-originalarrivaltime: 24 Jul 2019 13:51:07.4191 (UTC) x-ms-exchange-crosstenant-fromentityheader: Hosted x-ms-exchange-crosstenant-id: 0d4da0f8-4a31-4d76-ace6-0a62331e1b84 x-ms-exchange-crosstenant-mailboxtype: HOSTED x-ms-exchange-crosstenant-userprincipalname: cjpatton@UFL.EDU x-ms-exchange-transport-crosstenantheadersstamped: BN6PR22MB0978 Content-Type: multipart/alternative; boundary="_000_BN6PR22MB0692213A44A828D0DC266C72C6C60BN6PR22MB0692namp_" MIME-Version: 1.0 X-OriginatorOrg: ufl.edu X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-07-24_05:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1011 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=717 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1906280000 definitions=main-1907240154 Archived-At: Subject: Re: [TLS] Draft minutes for Tuesday X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 13:51:34 -0000 --_000_BN6PR22MB0692213A44A828D0DC266C72C6C60BN6PR22MB0692namp_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Hey martin, > Firefox nightly now has the preference "security.tls.enable_delegated_cre= dentials" > in about:config. I wouldn't recommend turning that on on a permanent bas= is, but > you can now use a browser to drive this. Is there any indication in the UI that a DC was negotiated? Thanks, Chris --_000_BN6PR22MB0692213A44A828D0DC266C72C6C60BN6PR22MB0692namp_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
Hey martin,=

> Firefox nightly = now has the preference "security.tls.enable_delegated_credentials"= ;
> in about:conf= ig.  I wouldn't recommend turning that on on a permanent basis, but
> you can now u= se a browser to drive this.

Is there any indic= ation in the UI that a DC was negotiated?

Thanks,
Chris

--_000_BN6PR22MB0692213A44A828D0DC266C72C6C60BN6PR22MB0692namp_-- From nobody Wed Jul 24 06:56:02 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2C3E9120273; Wed, 24 Jul 2019 06:55:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.557 X-Spam-Level: X-Spam-Status: No, score=-1.557 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FORGED_FROMDOMAIN=0.091, FREEMAIL_FROM=0.001, HEADER_FROM_DIFFERENT_DOMAINS=0.249, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7VY4skFF3zjM; Wed, 24 Jul 2019 06:55:54 -0700 (PDT) Received: from mail-vs1-f44.google.com (mail-vs1-f44.google.com [209.85.217.44]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 52DCC12028B; Wed, 24 Jul 2019 06:55:54 -0700 (PDT) Received: by mail-vs1-f44.google.com with SMTP id k9so31371851vso.5; Wed, 24 Jul 2019 06:55:54 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=b0iLYQMiF2vjDzJdZHli8aizn5eyw0r+aI5z22gmoUM=; b=fso12L5JhLyWq8YIPEEfM7/LbX8bdc2k9j7rE5IeYNhSB1LQ6T1f8OlJAtEDwZ74WG 0yW2DzUHMh3Ii34fhkf32dE+ZCj9jSTP8LQHr1XOH51ulQQqvzyERqRtMaC06JZRRbzu GG2Lb2bZLi9yYdSPO92FrPp2bz9mc2ly4oBFxkQOYnhdaEfl56qj75mLz8IfRgZA78qx Py24fkNpovzFFWzl9WN0CLID5mO1l1mCGFTG6iUcBUC3oD3vwbiXB/mVVYqjzmS9wmlm fKYKq0QDSAav2bhjDKm1nTRMi0nCq3bnzkmYhDshPMQRm3/brdnNJMMi5UV/rBsTBev6 gMFA== X-Gm-Message-State: APjAAAWjKPDZVen/WFtQi7ihAmqzBbsywstOX8yNiOWa8wzlriZWMlBQ mnxN7BLqByfsaMD1PuyUFQtPzxjPa22ECAWWhLOc5g== X-Google-Smtp-Source: APXvYqyc85rIqA2G1bmqTBWikj8ZfulUd0er2lP+jF9NAZWTeOTS14/Wb2ANZHC+8OByND1K0u+UNMZb37UjbRDsQMI= X-Received: by 2002:a67:33c1:: with SMTP id z184mr54442343vsz.169.1563976553170; Wed, 24 Jul 2019 06:55:53 -0700 (PDT) MIME-Version: 1.0 References: <156397572530.14653.7484421586674971558.idtracker@ietfa.amsl.com> In-Reply-To: <156397572530.14653.7484421586674971558.idtracker@ietfa.amsl.com> From: Daniel Migault Date: Wed, 24 Jul 2019 09:55:42 -0400 Message-ID: To: IETF Secretariat Cc: draft-lvelvindron-tls-md5-sha1-deprecate@ietf.org, tls-chairs , tls Content-Type: multipart/alternative; boundary="000000000000e38a63058e6daac0" Archived-At: Subject: Re: [TLS] The TLS WG has placed draft-lvelvindron-tls-md5-sha1-deprecate in state "Call For Adoption By WG Issued" X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 13:56:01 -0000 --000000000000e38a63058e6daac0 Content-Type: text/plain; charset="UTF-8" I support the adoption of the draft. Yours, Daniel On Wed, Jul 24, 2019 at 9:42 AM IETF Secretariat < ietf-secretariat-reply@ietf.org> wrote: > > The TLS WG has placed draft-lvelvindron-tls-md5-sha1-deprecate in state > Call For Adoption By WG Issued (entered by Sean Turner) > > The document is available at > https://datatracker.ietf.org/doc/draft-lvelvindron-tls-md5-sha1-deprecate/ > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > --000000000000e38a63058e6daac0 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
I support the adoption of the draft.
Yours,=C2=A0
Daniel

On Wed, Jul 24, 2019 at 9:42 AM IETF Secretariat <ietf-secretariat-reply@ietf.= org> wrote:

The TLS WG has placed draft-lvelvindron-tls-md5-sha1-deprecate in state
Call For Adoption By WG Issued (entered by Sean Turner)

The document is available at
https://datatracker.ietf.o= rg/doc/draft-lvelvindron-tls-md5-sha1-deprecate/

_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls
--000000000000e38a63058e6daac0-- From nobody Wed Jul 24 07:04:12 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AEDB012028B for ; Wed, 24 Jul 2019 07:03:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=lowentropy.net header.b=y/PuuzYg; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=WtRrdd1c Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id x20Gqdu2brLf for ; Wed, 24 Jul 2019 07:03:58 -0700 (PDT) Received: from new4-smtp.messagingengine.com (new4-smtp.messagingengine.com [66.111.4.230]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9BBBE120240 for ; Wed, 24 Jul 2019 07:03:51 -0700 (PDT) Received: from compute1.internal (compute1.nyi.internal [10.202.2.41]) by mailnew.nyi.internal (Postfix) with ESMTP id B23B220CE for ; Wed, 24 Jul 2019 10:03:50 -0400 (EDT) Received: from imap2 ([10.202.2.52]) by compute1.internal (MEProxy); Wed, 24 Jul 2019 10:03:50 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lowentropy.net; h=mime-version:message-id:in-reply-to:references:date:from:to :subject:content-type; s=fm2; bh=ii5ZauLLsE1fv93P65QXfLrtWvMYV3j 1aeqBD42U0Cg=; b=y/PuuzYgJAWciUV9ilE1PfwFwXz6OvDRaJ/AJXDhm0QcfIW S+aDRn2DBqo6hhKgluBgJZXCCgPBnTt8OP4WzVVw9/kZcq1huDJFRV25+PKvXM8F 5F7H7SHGpUI5qthPwIcmLzt5e4uXraJTS8vDMDYqD+NlPBTSsK46qcy7dQaCsz8F rm9RjrtrFTDoxcZ8UV7G9XT5WdqDMIWO16+7qaB51nwpjzndItkP1riuL+CQ6IFJ jH/ilWUTgvZraJ5llrz383vgSsJhVXqFoyXghsde8V20y08f3SuNZW6j3a1VVvaT FgHscleJ0uN98+x9YY1h0fo+5+Ahc96b9CwLO0w== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-proxy :x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm3; bh=ii5Zau LLsE1fv93P65QXfLrtWvMYV3j1aeqBD42U0Cg=; b=WtRrdd1ccQo2FZSJ1xlwYY N5zQvKZwsFDOYeTxYJHhW3OVn5m66Fbrklv4QzMbhnaPb5rjOU20S8BeBe8ijV8c CAWkYPNS86wzWKOsU2YTKI0YT+CurixXWCxLslT7U6nSIQTHRhx8R4ZFK424Y5q2 l6lpNQy/cE2bvpwKR1Lyms44oipLnbir6fxmnKF2TMhf4A7WXuIRwHKvYDpMG4Hs q0NbdCeceCwgdD6Mhl/SrEsocrFjo0zfIaNRKF/rWLyIGPrakmKHgdwgasXAz/y2 EG9Gs14xRP8Gu8aPcsjGvhk+gSEeF5kB+5EN9tRHIGuJh61n2h3LY3SKmu1zAuQA == X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeduvddrkedtgdeiiecutefuodetggdotefrodftvf curfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfghnecu uegrihhlohhuthemuceftddtnecunecujfgurhepofgfggfkjghffffhvffutgesthdtre dtreertdenucfhrhhomhepfdforghrthhinhcuvfhhohhmshhonhdfuceomhhtsehlohif vghnthhrohhphidrnhgvtheqnecuffhomhgrihhnpehivghtfhdrohhrghenucfrrghrrg hmpehmrghilhhfrhhomhepmhhtsehlohifvghnthhrohhphidrnhgvthenucevlhhushht vghrufhiiigvpedt X-ME-Proxy: Received: by mailuser.nyi.internal (Postfix, from userid 501) id 36C48E0129; Wed, 24 Jul 2019 10:03:50 -0400 (EDT) X-Mailer: MessagingEngine.com Webmail Interface User-Agent: Cyrus-JMAP/3.1.6-736-gdfb8e44-fmstable-20190718v2 Mime-Version: 1.0 Message-Id: In-Reply-To: References: <01a21cca-c0b1-4b40-9add-0ea303d0083c@www.fastmail.com> Date: Wed, 24 Jul 2019 10:03:49 -0400 From: "Martin Thomson" To: tls@ietf.org Content-Type: text/plain Archived-At: Subject: Re: [TLS] Adoption call for draft-nir-tls-tlsflags X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 14:04:04 -0000 I like this work. It needs work, but I would like to help do that work. On Wed, Jul 24, 2019, at 09:16, Eric Rescorla wrote: > I am in favor of adopting this. > > On Wed, Jul 24, 2019 at 5:47 AM Christopher Wood wrote: > > At TLS@IETF105, there was interest in the room to adopt draft-nir-tls-tlsflags as a WG item. The draft can be found here: > > > > https://datatracker.ietf.org/doc/draft-nir-tls-tlsflags/ > > > > This email starts the call for adoption. It will run until August 7, 2019. Please indicate whether or not you would like to see this draft adopted. > > > > Best, > > Chris, on behalf of the chairs > > > > _______________________________________________ > > TLS mailing list > > TLS@ietf.org > > https://www.ietf.org/mailman/listinfo/tls > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > From nobody Wed Jul 24 07:04:32 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 06B7E120283 for ; Wed, 24 Jul 2019 07:04:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SQdtmkawMqVP for ; Wed, 24 Jul 2019 07:04:09 -0700 (PDT) Received: from mail-lj1-x22a.google.com (mail-lj1-x22a.google.com [IPv6:2a00:1450:4864:20::22a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 60F041202D1 for ; Wed, 24 Jul 2019 07:04:02 -0700 (PDT) Received: by mail-lj1-x22a.google.com with SMTP id t28so44629011lje.9 for ; Wed, 24 Jul 2019 07:04:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=iZn4ZVYVTXt5VVCags+xjOIHvL8F3bs/gZ5lEpCgQBk=; b=PSnTMZXe7VdnJ3AIpKhxkq1ygCBU907I4xujk7XoUAmk+Kt7mrloYyz2l2gHSlDUMD ieGyY7HR861rniDY6zqxJkR3bgyakKba6WJZQyBg0S+MvdbAMVGj3SD/N7Wk8/QUvbqQ 7FzE38usPLreofV8cP78287CYNJlsLG6WBFcvnNFHltq7Lm/c9YeAcQb1iRYPhSXW4f3 7+HemokokT44UtGgJSrzobQ14ocUEBHPKiCt9EYqD4uH7DXeyEFGVr/zGaKBC+tax5ag ItaorAqkP79M5USkEnSuigp2XB6lD1yUCAItz39T7yS6B/aQoKkFwCqZY33FAI7o09Yv QvIg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=iZn4ZVYVTXt5VVCags+xjOIHvL8F3bs/gZ5lEpCgQBk=; b=Mo7Ce26GThb6052RjACE04DD7QxmfBQgy0lsfS8598o3MgogibK7P/hYS1Vm/0wBhu Ccu7UIoqlML5A6dVezR3cg7DI9E766XZJbxS4L8rFk2wV7UIxZKfMT3z4PI2oORUWSlm TH8LVP+ueFaRUCbRIiIkoJcjgCdSBGP0JAZU3HNL4703h6D5if4bvzcGTaOEdoJexuhe DbS9ChlddwS5s5FoX3+dHdHlrF87xix2QYMqLoerrpalUlL4cYZJXDMUd/WcOMCn/vzm KsReHG0hGDOd/aR45LrUHwExUtykC0AEsqEIUVLIV0nTIBR56bampztB/aWy+lAfYCer RnDw== X-Gm-Message-State: APjAAAV46KU5W9AeGnBHvDC9apt1I230zv08psm6ZWVqLqhZfpsJktqK KA4zWgX4ePWBkt0x0yPr66sMVZF/aqRCcqXyfwltKOYt X-Google-Smtp-Source: APXvYqzlyKl4glhtZ8bXgggDLRnKLen+yoUJdXrSANWcX5afi0j5SK3uF+TdCS3gqr9U+pWbcg8tfHMHr8MIh6kS8c8= X-Received: by 2002:a2e:7c15:: with SMTP id x21mr43321464ljc.55.1563977040563; Wed, 24 Jul 2019 07:04:00 -0700 (PDT) MIME-Version: 1.0 References: <01a21cca-c0b1-4b40-9add-0ea303d0083c@www.fastmail.com> In-Reply-To: <01a21cca-c0b1-4b40-9add-0ea303d0083c@www.fastmail.com> From: Watson Ladd Date: Wed, 24 Jul 2019 07:03:48 -0700 Message-ID: To: Christopher Wood Cc: TLS@ietf.org Content-Type: multipart/alternative; boundary="000000000000f092e5058e6dc7fd" Archived-At: Subject: Re: [TLS] Adoption call for draft-nir-tls-tlsflags X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 14:04:16 -0000 --000000000000f092e5058e6dc7fd Content-Type: text/plain; charset="UTF-8" I support adoption. On Wed, Jul 24, 2019, 5:47 AM Christopher Wood wrote: > At TLS@IETF105, there was interest in the room to adopt > draft-nir-tls-tlsflags as a WG item. The draft can be found here: > > https://datatracker.ietf.org/doc/draft-nir-tls-tlsflags/ > > This email starts the call for adoption. It will run until August 7, 2019. > Please indicate whether or not you would like to see this draft adopted. > > Best, > Chris, on behalf of the chairs > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > --000000000000f092e5058e6dc7fd Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
I support adoption.

On Wed, Jul 24, 2019, 5:47 AM Chris= topher Wood <caw@heapingbits.net> wrote:
At TLS@IETF105, there was interest in the room to adopt dr= aft-nir-tls-tlsflags as a WG item. The draft can be found here:

=C2=A0 =C2=A0https://d= atatracker.ietf.org/doc/draft-nir-tls-tlsflags/

This email starts the call for adoption. It will run until August 7, 2019. = Please indicate whether or not you would like to see this draft adopted.
Best,
Chris, on behalf of the chairs

_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo= /tls
--000000000000f092e5058e6dc7fd-- From nobody Wed Jul 24 07:23:04 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B92FE12006D for ; Wed, 24 Jul 2019 07:22:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com header.b=Fk7rlYLZ; dkim=fail (1024-bit key) reason="fail (body has been altered)" header.d=armh.onmicrosoft.com header.b=t7mPvAI5 Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Dj438jhMlM9i for ; Wed, 24 Jul 2019 07:22:50 -0700 (PDT) Received: from EUR01-DB5-obe.outbound.protection.outlook.com (mail-eopbgr150045.outbound.protection.outlook.com [40.107.15.45]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7CE4F120278 for ; Wed, 24 Jul 2019 07:22:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=J6d1pZfnJ4spmGQyzTBx3b+FqGXhkvWYnsVtDTBmrE8=; b=Fk7rlYLZC30pV6URwUAEzEQqTd0AzdaiGZIZv6LMCrMMgJcDrsmfqZy7uuk6rp8sHVQgB4cGhFmO9zRWHrZv2/vQCjw3nV93B3NOy9U86SZJo9uED94IGnD1lHmuy6T82F6GcuyHpGut9dnf53nRBAzr7Otb7H+Ff4NB7VpsBKM= Received: from VI1PR08CA0129.eurprd08.prod.outlook.com (2603:10a6:800:d4::31) by DB6PR0802MB2600.eurprd08.prod.outlook.com (2603:10a6:4:a1::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2115.10; Wed, 24 Jul 2019 14:22:45 +0000 Received: from DB5EUR03FT030.eop-EUR03.prod.protection.outlook.com (2a01:111:f400:7e0a::205) by VI1PR08CA0129.outlook.office365.com (2603:10a6:800:d4::31) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.2094.12 via Frontend Transport; Wed, 24 Jul 2019 14:22:44 +0000 Authentication-Results: spf=temperror (sender IP is 63.35.35.123) smtp.mailfrom=arm.com; ietf.org; dkim=pass (signature was verified) header.d=armh.onmicrosoft.com;ietf.org; dmarc=temperror action=none header.from=arm.com; Received-SPF: TempError (protection.outlook.com: error in processing during lookup of arm.com: DNS Timeout) Received: from 64aa7808-outbound-1.mta.getcheckrecipient.com (63.35.35.123) by DB5EUR03FT030.mail.protection.outlook.com (10.152.20.144) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.2052.18 via Frontend Transport; Wed, 24 Jul 2019 14:22:43 +0000 Received: ("Tessian outbound 578a71fe5eaa:v26"); Wed, 24 Jul 2019 14:22:41 +0000 X-CheckRecipientChecked: true X-CR-MTA-CID: c5b36bc94ce535f6 X-CR-MTA-TID: 64aa7808 Received: from 0b32bfd9a7c5.1 (ip-172-16-0-2.eu-west-1.compute.internal [104.47.13.54]) by 64aa7808-outbound-1.mta.getcheckrecipient.com id E5EDBD83-2211-4317-82B8-0F60B4EE8959.1; Wed, 24 Jul 2019 14:22:36 +0000 Received: from EUR04-HE1-obe.outbound.protection.outlook.com (mail-he1eur04lp2054.outbound.protection.outlook.com [104.47.13.54]) by 64aa7808-outbound-1.mta.getcheckrecipient.com with ESMTPS id 0b32bfd9a7c5.1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384); Wed, 24 Jul 2019 14:22:36 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=LDr9hW7Oc+ztDfKYwTXEmyiPkEcKfX1Ovh+t40H9TpHvpOh+CfQq+aMbAB4+GQg1U7T2FIMd/jvdjQ2xOpAFX3/Qc03DyyzyBHxthf3lQJ44B/gPsp0ywhEhnueLCAFYbLDS+Dbm0/xrydlXgMUw96Q7dJ8puuSxmiDY7DgFrOGFXu/TdOmvfFbgb886oIVse2s5RquBAbpR5YptxaHXpVygv8m+TcN/KPO1pafey2kgOJdTdXADgVPVazwcPJj4e0YKFMLmLe6hfNWN1hJttZsQnz2OwlOOWFiYqMe40UwTGU84Dm3w6ix4QNym5hL5VsPiRHE1il5fDhTEMcEWsw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=22XJHflho0xZTauEQ6fiFNQTwO3KWPb3poi10iMwQ0U=; b=JYMTO8SjwXuJ+WpQLRtlPfolEzFMM7UoSqvYmC3ikX6Jakz1FyWvtqYxlpAy50eaDecTpa3BYKSdC4ZBDU37IguguLPMyKa0hxNEm9Vim7VX5xx0gHJ60gCgF3q9JL4eAENvfeGs22L4x0MpRpR5dZRotq280mzcMbuyV0/uD8q234j+J6nZNO5FR7vr3mE5mfJ/XV8iFEtPbvePu/OT6g5a6nC4YLzIloyjeoUmWO6ljqBgiO1tkEJp6F3hdTWrACb7sjbcVi9dIp5TQLPMlin3QS1Oy/KrA95foaCUIXV05fHcgS4SG6o04750rx/vFOZTP2HwxJCQ3qc42pI7sA== ARC-Authentication-Results: i=1; mx.microsoft.com 1;spf=pass smtp.mailfrom=arm.com;dmarc=pass action=none header.from=arm.com;dkim=pass header.d=arm.com;arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=22XJHflho0xZTauEQ6fiFNQTwO3KWPb3poi10iMwQ0U=; b=t7mPvAI58szaT4BsD7ISb7UP8udJDmVCDWF43UYCsklR2jAqKaeaR1eDtwtq0sBfvNBAAO6GkFvVXqRmijKVvNbVqpAr6bI04Fv2dkU1Pq6C1dfLyVSEIRLwAHzETu/9s33Brk5FIZmDsi2KWoEgfiSYKk22QOvEKm5/x0i4lUI= Received: from AM6PR08MB4231.eurprd08.prod.outlook.com (20.179.4.202) by AM6PR08MB4933.eurprd08.prod.outlook.com (10.255.34.23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2094.16; Wed, 24 Jul 2019 14:22:34 +0000 Received: from AM6PR08MB4231.eurprd08.prod.outlook.com ([fe80::a0cb:7d43:97aa:b4fa]) by AM6PR08MB4231.eurprd08.prod.outlook.com ([fe80::a0cb:7d43:97aa:b4fa%7]) with mapi id 15.20.2094.017; Wed, 24 Jul 2019 14:22:34 +0000 From: Thomas Fossati To: Christopher Wood , "TLS@ietf.org" Thread-Topic: [TLS] Adoption call for draft-nir-tls-tlsflags Thread-Index: AQHVQh3rzJ81E7LeH0yb8JXaZTINDKbZ4wAA Date: Wed, 24 Jul 2019 14:22:34 +0000 Message-ID: <8BAD5B77-3365-4C7D-B9A0-6155A6594EDF@arm.com> References: <01a21cca-c0b1-4b40-9add-0ea303d0083c@www.fastmail.com> In-Reply-To: <01a21cca-c0b1-4b40-9add-0ea303d0083c@www.fastmail.com> Accept-Language: en-GB, en-US Content-Language: en-GB X-MS-Has-Attach: X-MS-TNEF-Correlator: Authentication-Results-Original: spf=none (sender IP is ) smtp.mailfrom=Thomas.Fossati@arm.com; x-originating-ip: [217.140.96.140] x-ms-publictraffictype: Email X-MS-Office365-Filtering-Correlation-Id: 29ef8738-d352-4fe3-5466-08d71042646d X-MS-Office365-Filtering-HT: Tenant X-Microsoft-Antispam-Untrusted: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(4618075)(2017052603328)(7193020); SRVR:AM6PR08MB4933; X-MS-TrafficTypeDiagnostic: AM6PR08MB4933:|DB6PR0802MB2600: X-MS-Exchange-PUrlCount: 1 X-Microsoft-Antispam-PRVS: x-checkrecipientrouted: true x-ms-oob-tlc-oobclassifiers: OLM:9508;OLM:9508; x-forefront-prvs: 0108A997B2 X-Forefront-Antispam-Report-Untrusted: SFV:NSPM; SFS:(10009020)(4636009)(39860400002)(396003)(346002)(376002)(136003)(366004)(199004)(189003)(6486002)(99286004)(6436002)(8676002)(446003)(229853002)(186003)(478600001)(8936002)(476003)(486006)(305945005)(4326008)(66066001)(4744005)(6306002)(26005)(7736002)(2616005)(33656002)(11346002)(256004)(68736007)(81156014)(81166006)(966005)(14454004)(25786009)(6246003)(316002)(6116002)(91956017)(110136005)(66556008)(66476007)(76116006)(66446008)(71200400001)(53936002)(36756003)(2501003)(64756008)(53546011)(2906002)(86362001)(3846002)(5660300002)(66946007)(6506007)(71190400001)(102836004)(76176011)(6512007); DIR:OUT; SFP:1101; SCL:1; SRVR:AM6PR08MB4933; H:AM6PR08MB4231.eurprd08.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: arm.com does not designate permitted sender hosts) X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam-Message-Info-Original: noX1+9ve6V0+ZH9W2AVsQDo9u2Brfj/HJ7He6fFoUHF5x/5R+cSU4sEUqJNO3qU2H4K3Jb91Fdhr7ZEK0m8+MX/jFCopW/xLWhpcD+5FLInjxp6c8LBwOv+JLnRiTFTwpc7jgkhxaviXAB80w4Mq9qH8ZgyzQkQPWThtrlNLjP1lTGZjIfmItkxHTtSYMZDW/biuWmxOJ5OIn7OG2hFE76uJGk2o1091ZRceNLKtKzYlEZFnSLln2JMdxtSjwXoRW/SF/elInLVj5rQCTBTnIhqutY8GGwpb6ESxuCfeLQ68o5kx2RW6PicQQc94Sw/pCeVRQ5myXzrY5zLFZd47qlwN5zDIw8t9tEjGDhWsjmXt+8m7twPViPqh/P3QNxLW3EALHL0mgpF6FL26V4KWWgALg9pRHGID9QY6r1NbmSk= Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM6PR08MB4933 Original-Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=Thomas.Fossati@arm.com; X-EOPAttributedMessage: 0 X-MS-Exchange-Transport-CrossTenantHeadersStripped: DB5EUR03FT030.eop-EUR03.prod.protection.outlook.com X-Forefront-Antispam-Report: CIP:63.35.35.123; IPV:CAL; SCL:-1; CTRY:IE; EFV:NLI; SFV:NSPM; SFS:(10009020)(4636009)(376002)(396003)(346002)(136003)(39860400002)(2980300002)(40434004)(189003)(199004)(966005)(186003)(5024004)(2616005)(6116002)(3846002)(11346002)(14444005)(336012)(305945005)(436003)(229853002)(8676002)(478600001)(446003)(476003)(47776003)(5660300002)(110136005)(63350400001)(81156014)(4744005)(81166006)(8936002)(316002)(7736002)(66066001)(22756006)(126002)(6306002)(2906002)(6512007)(76176011)(2486003)(70206006)(76130400001)(70586007)(486006)(25786009)(6486002)(6246003)(86362001)(2501003)(23676004)(14454004)(33656002)(102836004)(53546011)(6506007)(26005)(4326008)(356004)(26826003)(50466002)(36756003)(63370400001)(99286004); DIR:OUT; SFP:1101; SCL:1; SRVR:DB6PR0802MB2600; H:64aa7808-outbound-1.mta.getcheckrecipient.com; FPR:; SPF:TempError; LANG:en; PTR:ec2-63-35-35-123.eu-west-1.compute.amazonaws.com; MX:1; A:1; X-MS-Office365-Filtering-Correlation-Id-Prvs: 18ca427b-ce3e-4b79-d9c9-08d710425f39 X-Microsoft-Antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(710020)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:DB6PR0802MB2600; X-Forefront-PRVS: 0108A997B2 X-Microsoft-Antispam-Message-Info: WUB94tV61wKLwBpIOYWB7xjt7HlaQ6mMipZ3BnuZWxXhibHQomfZi2FMgAmtjn+AZq2umdbD9MWGpVmtaO+Gn3z0QW9Gc/mdeQaUyYLoasNUeYxejSSrAX9Q/pzW6+0NLWc5QNkhXr7GGnTSStJ+pYer6NjPKksMnlugqh34qAdoQpRZwh0pI9V0S6XGmHQ3IEpf7C1Fq0uf+O8YQlPDypDxWomtKdMf2JjAAbrI9vTbA3qoqY9g2Rk6Lh2+/kkylW3Aw2Xev1QNxZI4FUfiJXgklGzDInHsUSuPq4UoMrqT48C7+Y35pdvGT26EcIsqOwHKy2nezWv5OoUymXs3VwXsdILdE+1V44lLUp5jGJ1V50vSlyv4y8YfQYAHgxQsqteipWATRxityviZZkNx5KmF9HKWYAP0Tv2XKaAabEQ= X-OriginatorOrg: arm.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 24 Jul 2019 14:22:43.4436 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 29ef8738-d352-4fe3-5466-08d71042646d X-MS-Exchange-CrossTenant-Id: f34e5979-57d9-4aaa-ad4d-b122a662184d X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=f34e5979-57d9-4aaa-ad4d-b122a662184d; Ip=[63.35.35.123]; Helo=[64aa7808-outbound-1.mta.getcheckrecipient.com] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB6PR0802MB2600 Archived-At: Subject: Re: [TLS] Adoption call for draft-nir-tls-tlsflags X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 14:23:03 -0000 T24gMjQvMDcvMjAxOSwgMTM6NDcsICJUTFMgb24gYmVoYWxmIG9mIENocmlzdG9waGVyIFdvb2Qi IDx0bHMtYm91bmNlc0BpZXRmLm9yZyBvbiBiZWhhbGYgb2YgY2F3QGhlYXBpbmdiaXRzLm5ldD4g d3JvdGU6DQo+DQo+IEF0IFRMU0BJRVRGMTA1LCB0aGVyZSB3YXMgaW50ZXJlc3QgaW4gdGhlIHJv b20gdG8gYWRvcHQNCj4gZHJhZnQtbmlyLXRscy10bHNmbGFncyBhcyBhIFdHIGl0ZW0uIFRoZSBk cmFmdCBjYW4gYmUgZm91bmQgaGVyZToNCj4NCj4gICAgaHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRm Lm9yZy9kb2MvZHJhZnQtbmlyLXRscy10bHNmbGFncy8NCj4NCj4gVGhpcyBlbWFpbCBzdGFydHMg dGhlIGNhbGwgZm9yIGFkb3B0aW9uLiBJdCB3aWxsIHJ1biB1bnRpbCBBdWd1c3QgNywNCj4gMjAx OS4gUGxlYXNlIGluZGljYXRlIHdoZXRoZXIgb3Igbm90IHlvdSB3b3VsZCBsaWtlIHRvIHNlZSB0 aGlzIGRyYWZ0DQo+IGFkb3B0ZWQuDQoNCmFkb3B0ICs9IDENCg0KSU1QT1JUQU5UIE5PVElDRTog VGhlIGNvbnRlbnRzIG9mIHRoaXMgZW1haWwgYW5kIGFueSBhdHRhY2htZW50cyBhcmUgY29uZmlk ZW50aWFsIGFuZCBtYXkgYWxzbyBiZSBwcml2aWxlZ2VkLiBJZiB5b3UgYXJlIG5vdCB0aGUgaW50 ZW5kZWQgcmVjaXBpZW50LCBwbGVhc2Ugbm90aWZ5IHRoZSBzZW5kZXIgaW1tZWRpYXRlbHkgYW5k IGRvIG5vdCBkaXNjbG9zZSB0aGUgY29udGVudHMgdG8gYW55IG90aGVyIHBlcnNvbiwgdXNlIGl0 IGZvciBhbnkgcHVycG9zZSwgb3Igc3RvcmUgb3IgY29weSB0aGUgaW5mb3JtYXRpb24gaW4gYW55 IG1lZGl1bS4gVGhhbmsgeW91Lg0K From nobody Wed Jul 24 07:30:52 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D1C6312006D; Wed, 24 Jul 2019 07:30:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dx-IKgWuaB2y; Wed, 24 Jul 2019 07:30:49 -0700 (PDT) Received: from mail-yb1-xb43.google.com (mail-yb1-xb43.google.com [IPv6:2607:f8b0:4864:20::b43]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2C91112008B; Wed, 24 Jul 2019 07:30:49 -0700 (PDT) Received: by mail-yb1-xb43.google.com with SMTP id c202so16031541ybf.0; Wed, 24 Jul 2019 07:30:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc:content-transfer-encoding; bh=ZeYwNRPlFonu6mAVIzwGNld6AwLEITNm/HjzQ7/rXdw=; b=Ds3SXS7iebs2LYpCn5W4Mzyt6fK4pXqIQssnP61z1ivsUKiU7RiFMmqj1hmRCvrZqs 7LUOLwMoN8Z4eBFfq6hDBPtnoxzO1qQgfugqzoaTfQFVxkQMbzkUfOiFhkBLHJ9IXRE+ fddTuqgsMEINFesco6OqS4sAltluctBcctuVdVBju+mjSItfqHj+xOO2VAvz8tXoE6yG rIQDzXFQV8k0sqNTCbiNWdhp0HwxTSteuGZ1WBH1Upsvl6sraZD3Zrxba0gKmsr7e52G /QBTzBLMFBE2bwFMQuBpk8Ph3OH7yUNOrGMSs85ld/Um2LAEygLVdteIrycdVBGKjX0M PPew== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc:content-transfer-encoding; bh=ZeYwNRPlFonu6mAVIzwGNld6AwLEITNm/HjzQ7/rXdw=; b=gYssQ3cva/e5Oy1YxCgI+VdQ8nPGqdyQRI7tDTz/TcIHeQrHV4R65ieohcipqqcf+w lK02kH2iwQp1fSKoDIvFBEWSvARmLsgJvC4BCnbE6lYQwiaPOIh/Khb4H8ZN+4fWkGur aCXUeAwD0luWTbX6AjDKCJMC0I82OkpZuMkJV67DJYg0vIlBt4drHUN/muwJrqsS3UFX tPDmIBZEfeklldmFt0AgvQcOpstFoVZJEyK4cDwU5C3YmfvzIBwz4aOWR7k0pVbW9lWN r79FKrwdya0/GTIwUCWGpHn4MPY5MR9X63LIlU9F/LIHYF4WxqI2+7gB3VurE5qS+/tw n7Cw== X-Gm-Message-State: APjAAAUVRgPZEnbV7IfuRUzbf9+GgUy9yc1IoQkZpgYQvmJtzLGZXumL Xu0BL+ANJ3gHfk87mTs3PcoaUgeicQf+2lw1RTRWJHFu X-Google-Smtp-Source: APXvYqz5ySu3rHLnowjHOWRfVoytXKqmhTcbC8ayB7Rd2Bfgfzi7ihXRbMyrpcapxCkbo9uqpnPDyiHxbIs8hJzCDUw= X-Received: by 2002:a25:209:: with SMTP id 9mr40465925ybc.497.1563978647909; Wed, 24 Jul 2019 07:30:47 -0700 (PDT) MIME-Version: 1.0 References: <156397572530.14653.7484421586674971558.idtracker@ietfa.amsl.com> In-Reply-To: <156397572530.14653.7484421586674971558.idtracker@ietfa.amsl.com> From: =?UTF-8?Q?T=C3=B6ma_Gavrichenkov?= Date: Wed, 24 Jul 2019 17:30:31 +0300 Message-ID: To: IETF Secretariat Cc: draft-lvelvindron-tls-md5-sha1-deprecate@ietf.org, tls-chairs@ietf.org, "" Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Archived-At: Subject: Re: [TLS] The TLS WG has placed draft-lvelvindron-tls-md5-sha1-deprecate in state "Call For Adoption By WG Issued" X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 14:30:51 -0000 On Wed, Jul 24, 2019 at 4:42 PM IETF Secretariat wrote: > The TLS WG has placed draft-lvelvindron-tls-md5-sha1-deprecate in state > Call For Adoption By WG Issued (entered by Sean Turner) I support the adoption. -- T=C3=B6ma From nobody Wed Jul 24 08:03:24 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 862C6120123 for ; Wed, 24 Jul 2019 08:03:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cloudflare.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dt7UM1Lk9FM7 for ; Wed, 24 Jul 2019 08:03:18 -0700 (PDT) Received: from mail-vs1-xe32.google.com (mail-vs1-xe32.google.com [IPv6:2607:f8b0:4864:20::e32]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 83AF9120073 for ; Wed, 24 Jul 2019 08:03:18 -0700 (PDT) Received: by mail-vs1-xe32.google.com with SMTP id k9so31534475vso.5 for ; Wed, 24 Jul 2019 08:03:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cloudflare.com; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to; bh=HnDRx/eH9E7fbhUCeei0l6QWZ6XLjOnZ/06yfeJ3LOc=; b=VbJ0IY0AfgVctkpbXcPTXLSBso2ZpyY1YhVeNuqVtstHzleevUBhenfJLqrYUZmMz4 XwL79cVZ1Qxuhrbh7+omzYlXVIMjPyxL6LwrhQkO5vPC6OLPk5P+MmwLBRum8MXLsM6n 4o9nGYLySjoU3izE8P27Mr2pQrxzpv4nf++xM= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to; bh=HnDRx/eH9E7fbhUCeei0l6QWZ6XLjOnZ/06yfeJ3LOc=; b=iGNE/bOFX6jCsqQHd7/H9dWH/32JfbnV64cf4Gr77Fb17TTOqeHne9XcirUJdL339F /omXKU5jAMRDYuSec378A8ThFeTR+jhsomGfaSl/iKo03ENS27HIIDcOxyZt6kOpMJT+ LwKxaTAvzhWq+9OHtRmHys+4rqKRfInX4rtdGLbehhjfFtG+vkeG/fQKFT6xojT98DK+ zb2oiM/o3nw99RKvAIiyIVDiKh0VTlAgV2ukrccmvgR7Q6I7MXTB8LMTY3K62G8FxNZ9 u3i0tZaP4kAeX0lY2bnaeRgl643fO/uJuj/IY6FsKS8WwPEzgrw+y+J+KEvhZ9rNDtA2 eFuw== X-Gm-Message-State: APjAAAXJ/DT2er/glP7hawDiZL1CY0Pvt/oKoK/DqgTLWUsR8Pmag/5r RwTC5/Yy3VCGLZg7Acm8tDU6fJeNueXZvwsPVTUiKAU0vXM= X-Google-Smtp-Source: APXvYqzZmZ/j5OSXN7IAE6ohoSS7yNhwD+QOhAHNnrJuaHfePXGOtZyYo3s7cEy8RM7mVvbbvd7sXUiL3uxVobA/nrk= X-Received: by 2002:a05:6102:252:: with SMTP id a18mr49296243vsq.53.1563980597090; Wed, 24 Jul 2019 08:03:17 -0700 (PDT) MIME-Version: 1.0 References: <01a21cca-c0b1-4b40-9add-0ea303d0083c@www.fastmail.com> In-Reply-To: <01a21cca-c0b1-4b40-9add-0ea303d0083c@www.fastmail.com> From: Nick Sullivan Date: Wed, 24 Jul 2019 11:02:59 -0400 Message-ID: To: "TLS@ietf.org" Content-Type: multipart/alternative; boundary="000000000000ed1108058e6e9b30" Archived-At: Subject: Re: [TLS] Adoption call for draft-nir-tls-tlsflags X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 15:03:21 -0000 --000000000000ed1108058e6e9b30 Content-Type: text/plain; charset="UTF-8" I am in favor of adoption. On Wed, Jul 24, 2019 at 8:47 AM Christopher Wood wrote: > At TLS@IETF105, there was interest in the room to adopt > draft-nir-tls-tlsflags as a WG item. The draft can be found here: > > https://datatracker.ietf.org/doc/draft-nir-tls-tlsflags/ > > This email starts the call for adoption. It will run until August 7, 2019. > Please indicate whether or not you would like to see this draft adopted. > > Best, > Chris, on behalf of the chairs > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > --000000000000ed1108058e6e9b30 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
I am in favor of adoption.

On Wed, Jul 24, 2019 at 8:47 AM = Christopher Wood <caw@heapingbits= .net> wrote:
At TLS@IETF105, there was interest in the room to adopt draft-nir-tls-t= lsflags as a WG item. The draft can be found here:

=C2=A0 =C2=A0https://datatracker.ietf.org/do= c/draft-nir-tls-tlsflags/

This email starts the call for adoption. It will run until August 7, 2019. = Please indicate whether or not you would like to see this draft adopted.
Best,
Chris, on behalf of the chairs

_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls
--000000000000ed1108058e6e9b30-- From nobody Wed Jul 24 08:28:19 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A57E4120457 for ; Wed, 24 Jul 2019 08:28:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cert.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jDJ_h19IDQEj for ; Wed, 24 Jul 2019 08:28:15 -0700 (PDT) Received: from taper.sei.cmu.edu (taper.sei.cmu.edu [147.72.252.16]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4166A12044B for ; Wed, 24 Jul 2019 08:28:15 -0700 (PDT) Received: from delp.sei.cmu.edu (delp.sei.cmu.edu [10.64.21.31]) by taper.sei.cmu.edu (8.14.7/8.14.7) with ESMTP id x6OFSE0t005970 for ; Wed, 24 Jul 2019 11:28:14 -0400 DKIM-Filter: OpenDKIM Filter v2.11.0 taper.sei.cmu.edu x6OFSE0t005970 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cert.org; s=yc2bmwvrj62m; t=1563982094; bh=25wqtZEbDxuOszUDAEAZMxn3n33J9YglkKFqs+BNbfk=; h=From:To:Subject:Date:References:In-Reply-To:From; b=kRFYrXRGm5LdTlRfIp5xAAQl3QCYZ3uF6ZFRQOhS2vTJYsyXKdu1yOtxw9IqrvHQ4 eRwXFmkaRpCFZQRHnTSwE+v295vfVaRK/UROTu4WbXoCd7l2sIT/1+tnW/JEOrUiB7 3pABlfO6TA3LR9LKIPW4pXDg2/lyjee9Cm40sGkM= Received: from CASSINA.ad.sei.cmu.edu (cassina.ad.sei.cmu.edu [10.64.28.249]) by delp.sei.cmu.edu (8.14.7/8.14.7) with ESMTP id x6OFS9QR026460 for ; Wed, 24 Jul 2019 11:28:09 -0400 Received: from MARCHAND.ad.sei.cmu.edu ([10.64.28.251]) by CASSINA.ad.sei.cmu.edu ([10.64.28.249]) with mapi id 14.03.0439.000; Wed, 24 Jul 2019 11:28:09 -0400 From: Chris Inacio To: "TLS@ietf.org" Thread-Topic: [TLS] Adoption call for draft-lvelvindron-tls-md5-sha1-deprecate Thread-Index: AQHVQh43tT0TaxX4yEqEfCWOs3sR0KbaJ52A Date: Wed, 24 Jul 2019 15:28:08 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.64.201.127] Content-Type: multipart/alternative; boundary="_000_etPan5d3879094fe90320520dcertorg_" MIME-Version: 1.0 Archived-At: Subject: Re: [TLS] Adoption call for draft-lvelvindron-tls-md5-sha1-deprecate X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 15:28:18 -0000 --_000_etPan5d3879094fe90320520dcertorg_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 RmF2b3Igb2YgYWRvcHRpb24uDQoNCg0KDQoNCk9uIEp1bHkgMjQsIDIwMTkgYXQgODo0OToyMiBB TSwgQ2hyaXN0b3BoZXIgV29vZCAoY2F3QGhlYXBpbmdiaXRzLm5ldDxtYWlsdG86Y2F3QGhlYXBp bmdiaXRzLm5ldD4pIHdyb3RlOg0KDQpBdCBUTFNASUVURjEwNSwgdGhlcmUgd2FzIGludGVyZXN0 IGluIHRoZSByb29tIHRvIGFkb3B0IGRyYWZ0LWx2ZWx2aW5kcm9uLXRscy1tZDUtc2hhMS1kZXBy ZWNhdGUgYXMgYSBXRyBpdGVtLiBUaGUgZHJhZnQgY2FuIGJlIGZvdW5kIGhlcmU6DQoNCmh0dHBz Oi8vZGF0YXRyYWNrZXIuaWV0Zi5vcmcvZG9jL2RyYWZ0LWx2ZWx2aW5kcm9uLXRscy1tZDUtc2hh MS1kZXByZWNhdGUvDQoNClRoaXMgZW1haWwgc3RhcnRzIHRoZSBjYWxsIGZvciBhZG9wdGlvbi4g SXQgd2lsbCBydW4gdW50aWwgQXVndXN0IDcsIDIwMTkuIFBsZWFzZSBpbmRpY2F0ZSB3aGV0aGVy IG9yIG5vdCB5b3Ugd291bGQgbGlrZSB0byBzZWUgdGhpcyBkcmFmdCBhZG9wdGVkLg0KDQpCZXN0 LA0KQ2hyaXMsIG9uIGJlaGFsZiBvZiB0aGUgY2hhaXJzDQoNCl9fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fDQpUTFMgbWFpbGluZyBsaXN0DQpUTFNAaWV0Zi5v cmcNCmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vdGxzDQo= --_000_etPan5d3879094fe90320520dcertorg_ Content-Type: text/html; charset="utf-8" Content-ID: <199894D6F8D63447B632F6027E25F614@sei.cmu.edu> Content-Transfer-Encoding: base64 PGh0bWw+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIgY29udGVudD0i dGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxzdHlsZT5ib2R5e2ZvbnQtZmFtaWx5OkhlbHZl dGljYSxBcmlhbDtmb250LXNpemU6MTNweH08L3N0eWxlPg0KPC9oZWFkPg0KPGJvZHk+DQo8ZGl2 IHN0eWxlPSJmb250LWZhbWlseTpIZWx2ZXRpY2EsQXJpYWw7Zm9udC1zaXplOjEzcHg7IDsgIj5G YXZvciBvZiBhZG9wdGlvbi48L2Rpdj4NCjxkaXYgc3R5bGU9ImZvbnQtZmFtaWx5OkhlbHZldGlj YSxBcmlhbDtmb250LXNpemU6MTNweDsgOyAiPjxicj4NCjwvZGl2Pg0KPGJyPg0KPGRpdiBjbGFz cz0iZ21haWxfc2lnbmF0dXJlIj48L2Rpdj4NCjxicj4NCjxwIGNsYXNzPSJhaXJtYWlsX29uIj5P biBKdWx5IDI0LCAyMDE5IGF0IDg6NDk6MjIgQU0sIENocmlzdG9waGVyIFdvb2QgKDxhIGhyZWY9 Im1haWx0bzpjYXdAaGVhcGluZ2JpdHMubmV0Ij5jYXdAaGVhcGluZ2JpdHMubmV0PC9hPikgd3Jv dGU6PC9wPg0KPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSIgY2xhc3M9ImNsZWFuX2JxIj48c3Bhbj4N CjxkaXY+DQo8ZGl2PjwvZGl2Pg0KPGRpdj5BdCBUTFNASUVURjEwNSwgdGhlcmUgd2FzIGludGVy ZXN0IGluIHRoZSByb29tIHRvIGFkb3B0IGRyYWZ0LWx2ZWx2aW5kcm9uLXRscy1tZDUtc2hhMS1k ZXByZWNhdGUgYXMgYSBXRyBpdGVtLiBUaGUgZHJhZnQgY2FuIGJlIGZvdW5kIGhlcmU6DQo8YnI+ DQo8YnI+DQpodHRwczovL2RhdGF0cmFja2VyLmlldGYub3JnL2RvYy9kcmFmdC1sdmVsdmluZHJv bi10bHMtbWQ1LXNoYTEtZGVwcmVjYXRlLyA8YnI+DQo8YnI+DQpUaGlzIGVtYWlsIHN0YXJ0cyB0 aGUgY2FsbCBmb3IgYWRvcHRpb24uIEl0IHdpbGwgcnVuIHVudGlsIEF1Z3VzdCA3LCAyMDE5LiBQ bGVhc2UgaW5kaWNhdGUgd2hldGhlciBvciBub3QgeW91IHdvdWxkIGxpa2UgdG8gc2VlIHRoaXMg ZHJhZnQgYWRvcHRlZC4NCjxicj4NCjxicj4NCkJlc3QsIDxicj4NCkNocmlzLCBvbiBiZWhhbGYg b2YgdGhlIGNoYWlycyA8YnI+DQo8YnI+DQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fXyA8YnI+DQpUTFMgbWFpbGluZyBsaXN0IDxicj4NClRMU0BpZXRmLm9y ZyA8YnI+DQpodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3RscyA8YnI+DQo8 L2Rpdj4NCjwvZGl2Pg0KPC9zcGFuPjwvYmxvY2txdW90ZT4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_etPan5d3879094fe90320520dcertorg_-- From nobody Wed Jul 24 08:49:35 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C5A6E12038A for ; Wed, 24 Jul 2019 08:49:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bSKXu4_Fxw-l for ; Wed, 24 Jul 2019 08:49:31 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0838B120374 for ; Wed, 24 Jul 2019 08:49:30 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 5BCF4BE77; Wed, 24 Jul 2019 16:49:28 +0100 (IST) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gpCA4hjZsznI; Wed, 24 Jul 2019 16:49:27 +0100 (IST) Received: from [31.133.133.0] (dhcp-8500.meeting.ietf.org [31.133.133.0]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 9E7FBBE56; Wed, 24 Jul 2019 16:49:26 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1563983367; bh=Y4CS7lp08/Rx/XHVDf4yaPN9MG22vqaCKlWvmZlj4v0=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=pp+VOrfWF1IcZNojxDe7e/AykEuZnMIVxzqyL0IHOb0SnjHDC9PDRb/qSSmDnGG/H Dedqc7uYmY5InxOHIeSQPXybp5c26HTiDqfQWW5DPTcHgnH4gynuGdQI6S/PjCmxeP YMk5iVQT1/6MmstiYwNOzJ+ZAu6OS6FUCzLH8UW4= To: Benjamin Kaduk , Dennis Jackson Cc: "tls@ietf.org" References: <51f39225-1953-b603-bd15-bbc7d4bf2222@cs.ox.ac.uk> <1300C2AB-ACCD-4F29-96CF-D27A6737A799@gmail.com> <8f95317e-880d-f064-49a1-e51945b06b29@cs.ox.ac.uk> <20190724031343.GD27936@akamai.com> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <28bf5ea0-79a0-9c6c-a555-8006481cee4f@cs.tcd.ie> Date: Wed, 24 Jul 2019 16:49:25 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: <20190724031343.GD27936@akamai.com> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="LHqbEZYLs3InyB3mE9MzdmyOLc4xofZ4L" Archived-At: Subject: Re: [TLS] TLS Impact on Network Security draft updated X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 15:49:34 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --LHqbEZYLs3InyB3mE9MzdmyOLc4xofZ4L Content-Type: multipart/mixed; boundary="UW4StdYiKgmKFk9DN2NsXheFJhvfLh9aA"; protected-headers="v1" From: Stephen Farrell To: Benjamin Kaduk , Dennis Jackson Cc: "tls@ietf.org" Message-ID: <28bf5ea0-79a0-9c6c-a555-8006481cee4f@cs.tcd.ie> Subject: Re: [TLS] TLS Impact on Network Security draft updated References: <51f39225-1953-b603-bd15-bbc7d4bf2222@cs.ox.ac.uk> <1300C2AB-ACCD-4F29-96CF-D27A6737A799@gmail.com> <8f95317e-880d-f064-49a1-e51945b06b29@cs.ox.ac.uk> <20190724031343.GD27936@akamai.com> In-Reply-To: <20190724031343.GD27936@akamai.com> --UW4StdYiKgmKFk9DN2NsXheFJhvfLh9aA Content-Type: multipart/mixed; boundary="------------3DC39D444B5C636C744ECEEF" Content-Language: en-GB This is a multi-part message in MIME format. --------------3DC39D444B5C636C744ECEEF Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable I'm not in favour of adoption or discussion of this draft on the WG list. I'm also against publishing it in the IETF stream. It's a waste of everyone's time. I hope the chairs take the opportunity to close this thread soon. On 24/07/2019 04:13, Benjamin Kaduk wrote: > the Independent stream of the RFC series is purpose-built for > individual commentary on the consequences of a particular standard Yes. If the authors want an RFC for this text they ought contact the ISE. Cheers, S. --------------3DC39D444B5C636C744ECEEF Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------3DC39D444B5C636C744ECEEF-- --UW4StdYiKgmKFk9DN2NsXheFJhvfLh9aA-- --LHqbEZYLs3InyB3mE9MzdmyOLc4xofZ4L Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAl04fgUACgkQWrL68XsX K+p86hAAmLSzZmh4MEGeimnhmFlUH53NqvwWXbeGNgpo71jDHvSiaBxpA8FuaIA4 dILoXbt2AUI03PdM8OWKgvqi4v27vSBLzkHwSmeFwos/UiEKJZp4AhX+4g4ATWlT OF+tnvJLl6v655xt5Fx5OyxzMoOlK2szIGOEpcGTi6vmsSHwqwiJV9UqxYSCIjOP 4Zu37D+nxXUhiPEpyEwKCrUb9xreL3v7XjnMliPldGpzfdDsdM/mm8zjHh0GYVY7 2SkzvB2QEIPOJDSVV+uOO7eR1okvUmyVSIvo5xXY/ggoE8zwzBIN6wFq+w3K9wUk QJoisAnP6BHK4XMaAm2fal9DEVfZzB7eGujrbHP784f1Ters7I4DU2lr+V3UufAu hemHe3VAcJqbcdI8FAHSgXn/o4Fj2W280pUXnWX1aLzs5sE1X1YL9g4/id9L2aWJ G3Eh/YDoowz9MR8O0zSmPXPwvYmE4eQrar9uUKFoHPROShmrWDhqSrghirbUVx+w 4FRYqZ3/77cSeWPrXxJOz+wrY9EiPt+g9ni0i0Z2PjARApEBI6v5AAXLGYYX3qtR Pgl4mrqh+zH5QJxzBIckgiVOO8DTeJrZ9ylLZ75C+AjZdQT7hO/+UfZnlYSQGfV5 LeTUvYrfqnnlfXae/pdc+TxZiUI5KbUL18nqEOwlUlsV/nGSApc= =BSDR -----END PGP SIGNATURE----- --LHqbEZYLs3InyB3mE9MzdmyOLc4xofZ4L-- From nobody Thu Jul 25 04:36:28 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CD693120151 for ; Thu, 25 Jul 2019 04:36:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=lowentropy.net header.b=PM1AkJyw; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=stEko1xA Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lc_gLsVgx12l for ; Thu, 25 Jul 2019 04:36:19 -0700 (PDT) Received: from new2-smtp.messagingengine.com (new2-smtp.messagingengine.com [66.111.4.224]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A309F120019 for ; Thu, 25 Jul 2019 04:36:19 -0700 (PDT) Received: from compute1.internal (compute1.nyi.internal [10.202.2.41]) by mailnew.nyi.internal (Postfix) with ESMTP id 9060A2EF7 for ; Thu, 25 Jul 2019 07:36:18 -0400 (EDT) Received: from imap2 ([10.202.2.52]) by compute1.internal (MEProxy); Thu, 25 Jul 2019 07:36:18 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lowentropy.net; h=mime-version:message-id:in-reply-to:references:date:from:to :subject:content-type; s=fm2; bh=avn80GFxsegr1jvWNe5m8+7A3BuMwwM t11NkVGHEp4s=; b=PM1AkJyw+H0B4++z7JjOsMXyZ1iGfOjgxt3dQsfW+O4xJGs qz5cBVUcMmr9aLjPBi4sEKjMx6i+6Io3nNq+JkelSM9GkBpsSqOQiEuVZOsyccwp gzQRKIECUO4kUh2ynTTE8AbD3nMdLzehp80RuIjDJY7tkezoIJKWn/XAO5AAKwU/ 1G9ZdVQNWIskIFta5UL0CUaA+NPOuIXsL8TVUDEylGne5yR3kdObRuLhb4YeYet7 Byvmevzortysy8nRL3jubP2Ydz2mWzVj0UA47smj7+pGEmE5CQzcXaTh9vsszeK3 RC7zKD8sOnk2qfwvGEWZONdc6duSO5T5Yj4nO2w== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-proxy :x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm3; bh=avn80G Fxsegr1jvWNe5m8+7A3BuMwwMt11NkVGHEp4s=; b=stEko1xAJJcehHuzYwQDQg gh/fj5kZPzQlv2JM3TraCNulawCdjvmGuyjwsN0i+bwBSdwJwdPPaiQZn5jJOWMC kpni4tv/tXjGK7zwBNXcYk/Hw1j20XMhGvAQvHoPwSTtKSFZUhTfd5w0DPalPE64 MojMVt9t341orUU5aZJmzpEen+sKkHX2UYueB4CdUGlEJFLkKSxbCg7mHXlf9oS7 Y1UWrgcrd86w/Uz6U8aEd58hjtGnUbXUoRp7TmMgGTcxkZRHXnBg3CaDHLwmqc9T uYUt3m+x8Ziol+6ZU3kCgxni6dDs5sMP01zgHbcIV7Nssm984qd6DXp9C37At/QA == X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeduvddrkedvgdegudcutefuodetggdotefrodftvf curfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfghnecu uegrihhlohhuthemuceftddtnecunecujfgurhepofgfggfkjghffffhvffutgesthdtre dtreertdenucfhrhhomhepfdforghrthhinhcuvfhhohhmshhonhdfuceomhhtsehlohif vghnthhrohhphidrnhgvtheqnecurfgrrhgrmhepmhgrihhlfhhrohhmpehmtheslhhofi gvnhhtrhhophihrdhnvghtnecuvehluhhsthgvrhfuihiivgeptd X-ME-Proxy: Received: by mailuser.nyi.internal (Postfix, from userid 501) id 4692CE00CC; Thu, 25 Jul 2019 07:36:18 -0400 (EDT) X-Mailer: MessagingEngine.com Webmail Interface User-Agent: Cyrus-JMAP/3.1.6-736-gdfb8e44-fmstable-20190718v2 Mime-Version: 1.0 Message-Id: <935614ee-3e92-41de-84e9-b87c3fde367a@www.fastmail.com> In-Reply-To: References: Date: Thu, 25 Jul 2019 07:36:17 -0400 From: "Martin Thomson" To: tls@ietf.org Content-Type: text/plain Archived-At: Subject: Re: [TLS] Draft minutes for Tuesday X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 25 Jul 2019 11:36:23 -0000 On Wed, Jul 24, 2019, at 09:52, Patton,Christopher J wrote: > Is there any indication in the UI that a DC was negotiated? There is not. We don't have any other machinery built yet, which is part of why I don't recommend that people use this just yet. From nobody Thu Jul 25 07:52:20 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B192B12016D for ; Thu, 25 Jul 2019 07:52:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=lowentropy.net header.b=G8j1Go3Z; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=wlhoPXWT Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id htXBNLKg3Ow6 for ; Thu, 25 Jul 2019 07:52:16 -0700 (PDT) Received: from out5-smtp.messagingengine.com (out5-smtp.messagingengine.com [66.111.4.29]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A8D081202CB for ; Thu, 25 Jul 2019 07:52:07 -0700 (PDT) Received: from compute1.internal (compute1.nyi.internal [10.202.2.41]) by mailout.nyi.internal (Postfix) with ESMTP id BBD3922212 for ; Thu, 25 Jul 2019 10:52:06 -0400 (EDT) Received: from imap2 ([10.202.2.52]) by compute1.internal (MEProxy); Thu, 25 Jul 2019 10:52:06 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lowentropy.net; h=mime-version:message-id:date:from:to:subject:content-type; s= fm2; bh=fKdIre+KehjQIG8XE8p3F1XCowdkrOYH81tSNgbMfPI=; b=G8j1Go3Z QU1E9ZLf+czuIY7oVVRUOXu2D0Hhy/8J4y9QoX+g/RPXppCqz3KMyx1u8jkhJfxr PcwzvnIBAtQbEzeIa6rta6ej+ChoeuZqNANWiqh360q0q/XqRHmNml/doXAr4bLA x3LU/QkvAjkuBSRl/OUSM0Ot2uH402wcSjv1aTSh/d5a/bGDwlq2cVbzubGnkqlh nO7gFf2Mlk6Ycl2hT6GqlxS6N2MpzGfD059Nu2DVtdk8AqwKwU2eh2PnoRIjBEF8 sad6DGgnc4EO5KEZnCFs5hS1L6xArmR4kgY6kNVMK7NvTSe9jEtlIm1VVn413JuA sB8MiDntpWZEsg== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-type:date:from:message-id :mime-version:subject:to:x-me-proxy:x-me-proxy:x-me-sender :x-me-sender:x-sasl-enc; s=fm3; bh=fKdIre+KehjQIG8XE8p3F1XCowdkr OYH81tSNgbMfPI=; b=wlhoPXWTOY7jaLdWGHlUfCCAJ5Y8VtkLdDNocq4epWVZd J+RDis8Z2KUajmWpsCo+lrs7mNDqWLse0cJtnK2kB8wcNPbahUMDbBKxbrj4Agnj qPycamwqKY4EpzfQeIY1J3c4Nit02574dGDZosRhLO0gXwg8ffhbY2iFDvZKIXyo XmacamUiy0i458ByUeOoJYypg5QGd4dpb9M9FclYO/f0nYMm+S9Fw94traLlYMIT a2CyU/cRkcBFgwPiWrRFmDDPc/J1/dVBYuN3IJ2FDRsOCCfJ9tBWM79JZ2LFDjmM oZHpqz87eBWfOn2mVXR8spX+hEpj5hyIO5O6SH++w== X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeduvddrkedvgdektdcutefuodetggdotefrodftvf curfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfghnecu uegrihhlohhuthemuceftddtnecunecujfgurhepofgfggfkfffhvffutgesthdtredtre ertdenucfhrhhomhepfdforghrthhinhcuvfhhohhmshhonhdfuceomhhtsehlohifvghn thhrohhphidrnhgvtheqnecuffhomhgrihhnpehgihhthhhusgdrtghomhdpqhhuihgtfi hgrdhorhhgnecurfgrrhgrmhepmhgrihhlfhhrohhmpehmtheslhhofigvnhhtrhhophih rdhnvghtnecuvehluhhsthgvrhfuihiivgeptd X-ME-Proxy: Received: by mailuser.nyi.internal (Postfix, from userid 501) id 5F07AE0129; Thu, 25 Jul 2019 10:52:06 -0400 (EDT) X-Mailer: MessagingEngine.com Webmail Interface User-Agent: Cyrus-JMAP/3.1.6-736-gdfb8e44-fmstable-20190718v2 Mime-Version: 1.0 Message-Id: <5e96f734-167d-4611-96d1-0dcb96f8f393@www.fastmail.com> Date: Thu, 25 Jul 2019 10:52:05 -0400 From: "Martin Thomson" To: tls@ietf.org Content-Type: text/plain Archived-At: Subject: [TLS] QUIC work on return route?ability X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 25 Jul 2019 14:52:18 -0000 https://github.com/quicwg/base-drafts/pull/2925 includes the (incomplete) analysis done by Eric Kinnear. See also https://quicwg.org/base-drafts/draft-ietf-quic-transport.html#rfc.section.8 and subsequent sections From nobody Thu Jul 25 09:04:33 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4429D1202C6 for ; Thu, 25 Jul 2019 09:04:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com header.b=9dvK+vSY; dkim=fail (1024-bit key) reason="fail (body has been altered)" header.d=armh.onmicrosoft.com header.b=k7jXN3iX Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FWlIdtTqkI8W for ; Thu, 25 Jul 2019 09:04:18 -0700 (PDT) Received: from EUR01-DB5-obe.outbound.protection.outlook.com (mail-db5eur01on060d.outbound.protection.outlook.com [IPv6:2a01:111:f400:fe02::60d]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E24B21202B7 for ; Thu, 25 Jul 2019 09:04:17 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=GqSeWja71ebdX57tnB8kbFZc5trkrgCPUQpc8Sffegs=; b=9dvK+vSYNM/wkLxetStsrfIzEgQNJLOxuXtTAA9a7oKE+OG0CKz8xla5Idaxblblik7KuiTqRvdVQTUrZe5LqgIb/+FLoEvjltQs5DqBA6G3qMhLy2n7RkM4jC3abSR90Pte1l7XcAI0DAfiDgjm8V8YUmcHdAZ2ZQOkcBFNZvE= Received: from VI1PR08CA0124.eurprd08.prod.outlook.com (2603:10a6:800:d4::26) by DB6PR0802MB2598.eurprd08.prod.outlook.com (2603:10a6:4:97::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2094.17; Thu, 25 Jul 2019 16:04:14 +0000 Received: from AM5EUR03FT045.eop-EUR03.prod.protection.outlook.com (2a01:111:f400:7e08::204) by VI1PR08CA0124.outlook.office365.com (2603:10a6:800:d4::26) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.2115.13 via Frontend Transport; Thu, 25 Jul 2019 16:04:14 +0000 Authentication-Results: spf=temperror (sender IP is 63.35.35.123) smtp.mailfrom=arm.com; ietf.org; dkim=pass (signature was verified) header.d=armh.onmicrosoft.com;ietf.org; dmarc=temperror action=none header.from=arm.com; Received-SPF: TempError (protection.outlook.com: error in processing during lookup of arm.com: DNS Timeout) Received: from 64aa7808-outbound-1.mta.getcheckrecipient.com (63.35.35.123) by AM5EUR03FT045.mail.protection.outlook.com (10.152.17.105) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.2052.18 via Frontend Transport; Thu, 25 Jul 2019 16:04:11 +0000 Received: ("Tessian outbound cc8a947d4660:v26"); Thu, 25 Jul 2019 16:04:11 +0000 X-CheckRecipientChecked: true X-CR-MTA-CID: b519fe6783ac7672 X-CR-MTA-TID: 64aa7808 Received: from 7a79f0058187.1 (ip-172-16-0-2.eu-west-1.compute.internal [104.47.2.54]) by 64aa7808-outbound-1.mta.getcheckrecipient.com id 3549B274-8932-4A20-B9E1-88FA3E5B374C.1; Thu, 25 Jul 2019 16:04:06 +0000 Received: from EUR01-DB5-obe.outbound.protection.outlook.com (mail-db5eur01lp2054.outbound.protection.outlook.com [104.47.2.54]) by 64aa7808-outbound-1.mta.getcheckrecipient.com with ESMTPS id 7a79f0058187.1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384); Thu, 25 Jul 2019 16:04:06 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=S0wWhAPzwFNBnHCPgtGt74FOaiyYuenzVa0WyZm9UPP3MvNYusifKudy2SQuXB8gOimGWeDU8q7Sli6jygijtr8UFX6g7+++Z3HAymU2pHAKJVUrsMcmzVqmuhC8o1tr8O1cpTTrhW4sru77X8tyvKTHepzIAoHtQGS8tOs6I+XLnIQ1U9Coeq8VMhBlXUg+6oKFeHVftaNS5m8q5xuVm0AIdR6yVF57tr5+RmuhFR6GeCEOVc3QsMUhd0tnguvinsJKocpY9H5IkqH8LHpNeSiXRGbP/xjs3A03htCWYvMHz3ol0zOTPgH2N5K2dKJaePQTGo+98USLcksNhwOMww== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=fwnBGbj+qyGC6zb9/XEN3h7vGkKWSpq/oPCnyv0rBgE=; b=EC+x/abv0YgUsqICqgdU0KvFCLp9gU7942PyqXumySyqBw0kWkTgXhg6mkINesKSGBJVIHTSo+NntI4y7GMlSVEC7shg2OMZ1uST3h4G+6ZIcBCZDzhO0J3NK0IARv5uPkLqVfajdYuaAg93IoGQm6Vallq4Ope99ISE0dbMj38BpOQapbH8DBggXCAdQALNAoOMCGipFBqdSW3KChjwAbJlQv5TVocOBCQvsoNRkXtvtHNVIOZayTWhm9DGds8FCN+lPRbdQZmvM8/a7a/wT+N8zQcTmDd341DU3bgrpw7hK6lAI9QJstAEyx0Bbtkr/myOl8rpeVy5drkI+z1EKg== ARC-Authentication-Results: i=1; mx.microsoft.com 1;spf=pass smtp.mailfrom=arm.com;dmarc=pass action=none header.from=arm.com;dkim=pass header.d=arm.com;arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=fwnBGbj+qyGC6zb9/XEN3h7vGkKWSpq/oPCnyv0rBgE=; b=k7jXN3iXizWT9/IfMqE1C93S016oYgjVLG9WG6mf/qxv6ADK07kBUuThV98Ejse5Xa25x9ugx1iEGFjCaUIGHRzq/sUylAyo5eultspthEqzntxxTDoBjbevvw+sMjhRuEHP+w2NqIBJRdWTeocz5/gQ2nQbRaalqNu+DRXJcbk= Received: from AM6PR08MB4231.eurprd08.prod.outlook.com (20.179.4.202) by AM6PR08MB4769.eurprd08.prod.outlook.com (10.255.97.150) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2094.17; Thu, 25 Jul 2019 16:04:05 +0000 Received: from AM6PR08MB4231.eurprd08.prod.outlook.com ([fe80::a0cb:7d43:97aa:b4fa]) by AM6PR08MB4231.eurprd08.prod.outlook.com ([fe80::a0cb:7d43:97aa:b4fa%7]) with mapi id 15.20.2094.017; Thu, 25 Jul 2019 16:04:05 +0000 From: Thomas Fossati To: "TLS@ietf.org" Thread-Topic: cTLS transport question Thread-Index: AQHVQwKV/PVIdyCZAkGkRT5l9UavdA== Date: Thu, 25 Jul 2019 16:04:05 +0000 Message-ID: <1772330A-AEE4-4510-A261-F2D5AF9762DD@arm.com> Accept-Language: en-GB, en-US Content-Language: en-GB X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.1b.0.190715 Authentication-Results-Original: spf=none (sender IP is ) smtp.mailfrom=Thomas.Fossati@arm.com; x-originating-ip: [217.140.96.140] x-ms-publictraffictype: Email X-MS-Office365-Filtering-Correlation-Id: f2adbc57-bcd3-4d86-23b7-08d71119bbe2 X-MS-Office365-Filtering-HT: Tenant X-Microsoft-Antispam-Untrusted: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(4618075)(2017052603328)(7193020); SRVR:AM6PR08MB4769; X-MS-TrafficTypeDiagnostic: AM6PR08MB4769:|DB6PR0802MB2598: X-MS-Exchange-PUrlCount: 1 X-Microsoft-Antispam-PRVS: x-checkrecipientrouted: true x-ms-oob-tlc-oobclassifiers: OLM:10000;OLM:10000; x-forefront-prvs: 0109D382B0 X-Forefront-Antispam-Report-Untrusted: SFV:NSPM; SFS:(10009020)(4636009)(396003)(39860400002)(136003)(346002)(366004)(376002)(199004)(189003)(68736007)(966005)(8936002)(478600001)(26005)(6512007)(186003)(2351001)(25786009)(53936002)(2906002)(2501003)(6506007)(66556008)(5660300002)(2616005)(256004)(7116003)(76116006)(66946007)(102836004)(91956017)(66446008)(66476007)(36756003)(64756008)(606006)(4326008)(81166006)(81156014)(66066001)(8676002)(71200400001)(99286004)(71190400001)(486006)(33656002)(14444005)(3846002)(790700001)(86362001)(5640700003)(236005)(6306002)(6436002)(316002)(6486002)(7736002)(476003)(54896002)(6916009)(6116002)(58126008)(3480700005)(14454004); DIR:OUT; SFP:1101; SCL:1; SRVR:AM6PR08MB4769; H:AM6PR08MB4231.eurprd08.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: arm.com does not designate permitted sender hosts) X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam-Message-Info-Original: YofqBQvtBnjVXgFhxSTrNmI/Mf/ChnARhhVeWBJRL3362D/KT/LeB2ALwgluNwOVJg85mh7dy+L0hdTOU5g5KxKSDaDu32PLoR4RueavpQa4ObN2piFgmUQWa998gcQJ3iX/We4sAk7DM5dyA7DKzhmhIzH9JNeAznwUeY/lcn3Q19yvQHI1ClpnN4pXX+WAVjeCIKU0o2GEdUAaZKxv7LjUVEMgqx/E4oz6XpQXT7Ahi86f38RS4n1n7YOkAeae2CznrKeU5XK/fTvkWAjQNIlrpvwyfEw5otn6qEa6d4gCbV5t/nn9wanFN/4Upi96/25Z+bD47IqeBTvlpt/nSzLA4RiLdzDAtRPNEeidjYNfA79q2SK9mLMiO8J+z76LWOwxupyrqpEtNXx9iiAOE+mO1IGi9U74vcVHPI1f3VA= Content-Type: multipart/alternative; boundary="_000_1772330AAEE44510A261F2D5AF9762DDarmcom_" MIME-Version: 1.0 X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM6PR08MB4769 Original-Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=Thomas.Fossati@arm.com; X-EOPAttributedMessage: 0 X-MS-Exchange-Transport-CrossTenantHeadersStripped: AM5EUR03FT045.eop-EUR03.prod.protection.outlook.com X-Forefront-Antispam-Report: CIP:63.35.35.123; IPV:CAL; SCL:-1; CTRY:IE; EFV:NLI; SFV:NSPM; SFS:(10009020)(4636009)(396003)(39860400002)(346002)(136003)(376002)(2980300002)(40434004)(199004)(189003)(63370400001)(606006)(2351001)(45080400002)(7116003)(478600001)(76130400001)(2501003)(5640700003)(236005)(6306002)(25786009)(2616005)(6486002)(6916009)(30436002)(58126008)(26826003)(36906005)(6512007)(66066001)(54896002)(14454004)(86362001)(70206006)(5660300002)(316002)(2906002)(7736002)(8936002)(966005)(8676002)(790700001)(126002)(4326008)(70586007)(356004)(14444005)(71190400001)(81166006)(36756003)(3846002)(336012)(476003)(186003)(33656002)(63350400001)(3480700005)(22756006)(6506007)(5024004)(33964004)(81156014)(99286004)(486006)(26005)(102836004)(6116002)(4546004)(16586007); DIR:OUT; SFP:1101; SCL:1; SRVR:DB6PR0802MB2598; H:64aa7808-outbound-1.mta.getcheckrecipient.com; FPR:; SPF:TempError; LANG:en; PTR:ec2-63-35-35-123.eu-west-1.compute.amazonaws.com; A:1; MX:1; X-MS-Office365-Filtering-Correlation-Id-Prvs: 2b25a341-11df-4696-a806-08d71119b7ef X-Microsoft-Antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(710020)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:DB6PR0802MB2598; X-Forefront-PRVS: 0109D382B0 X-Microsoft-Antispam-Message-Info: 3+RFIiE3EEiR/NZOifoi/kZqEATF1EMCHuL7w+YTF5DTj2ou0vBOEMLTIJUQmRFkvuUPsPFnfC8frDQmw+QOH/FEqMExiszeTM2Px8BTvSNLn+1wFCoohNgRdroA2eq9uav6ybdEddzxciCs8DlAQtEwMIu9XJPj5YYLKhLQy+zIZr5NQekdC4c0WPPedYZJjWb2fV9I8SuOOuU/8u0HWEpZGY/gSZPZfc1o3kythNWZMbrNJMRCHMreKjt1QSODw9Bzhpdoy2zk9eTWQeg4BztaisdEtxxDhnipSymkIijdZkBq1xGgLb6WVlVxy/9UKjAE8cvLNiJ/YWqdU0AgMxQKnOWCqCh9nkiVfnCk6AyhaU/tj0dJCm040qg0hHAdyjGjLzj0eAiJOVOyoh4I/rcOn2UTvUwWUaAs3ULgero= X-OriginatorOrg: arm.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 25 Jul 2019 16:04:11.9258 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: f2adbc57-bcd3-4d86-23b7-08d71119bbe2 X-MS-Exchange-CrossTenant-Id: f34e5979-57d9-4aaa-ad4d-b122a662184d X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=f34e5979-57d9-4aaa-ad4d-b122a662184d; Ip=[63.35.35.123]; Helo=[64aa7808-outbound-1.mta.getcheckrecipient.com] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB6PR0802MB2598 Archived-At: Subject: [TLS] cTLS transport question X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 25 Jul 2019 16:04:21 -0000 --_000_1772330AAEE44510A261F2D5AF9762DDarmcom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 VGhhbmtzIGZvciBwcmVzZW50aW5nIHRoaXMgd29yay4gIEkgcmVhbGx5IGxpa2UgdGhpcyBhbmQg SSB0aGluaw0KaXQnZCBiZSByZWFsbHkgdXNlZnVsIGZvciB0aGUgdXNlIGNhc2VzIHdlIGhhdmUg KElvVCwgTTJNKS4NCg0KT25lIGNvbW1lbnQ6IGZyb20gYSBxdWljayBza2ltbWluZyBvZiB0aGUg ZHJhZnQsIEknbSBub3Qgc3VyZSBJDQp1bmRlcnN0YW5kIHdoYXQgdGhlIHN0YXRlZCBleHBlY3Rh dGlvbnMgb24gdGhlIHRyYW5zcG9ydCBsYXllciBhcmU/DQoNClNpbmNlIGl0J3MgY1RMUyBhbmQg bm90IGNEVExTIEknZCBoYXZlIHRob3VnaHQgaXQncyB0aGUgc2FtZSBhcyBUTFMNCihpbi1vcmRl ciAmIHJlbGlhYmxlKSBidXQgdGhlbiBJIGdvdCBjb25mdXNlZCByZWFkaW5nIHNlY3Rpb24gMy4y IFsxXToNCg0KICAiVGhlIENUTFMgUmVjb3JkIExheWVyIGFzc3VtZXMgdGhhdCByZWNvcmRzIGFy ZSBleHRlcm5hbGx5IGZyYW1lZA0KICAgKGkuZS4sIHRoYXQgdGhlIGxlbmd0aCBpcyBhbHJlYWR5 IGtub3duIGJlY2F1c2UgaXQgaXMgY2FycmllZCBpbg0KICAgYSBVRFAgZGF0YWdyYW0gb3IgdGhl IGxpa2UpIg0KDQpPbiBKYWJiZXIgQmVuIHN1Z2dlc3RlZCB0aGF0IG9uZSBjb3VsZCBwdXQgQ29B UCBiZXR3ZWVuIFVEUCBhbmQgY1RMUyB0bw0KZ2V0IGluLW9yZGVyICYgcmVsaWFibGUgZGVsaXZl cnkgd2l0aCBhIGRhdGFncmFtIHRyYW5zcG9ydCwgYnV0IHRoZW4gSSdtDQpub3Qgc3VyZSB3aGF0 IHRoZSBhZHZhbnRhZ2Ugd291bGQgYmUgc2luY2Ugd2UnZCBiZSB0cmFkaW5nIDIgYnl0ZXMgb2YN ClRMU1BsYWludGV4dC5sZW5ndGggd2l0aCA0IGJ5dGVzIChtaW5pbXVtKSBvZiBDb0FQIGhlYWRl cj8NCg0KRnJvbSB0aGUgSmFiYmVyIGRpc2N1c3Npb24sIG15IGN1cnJlbnQgdW5kZXJzdGFuZGlu ZyBpcyB0aGF0IHRoZXJlIGFyZSAyDQphc3N1bXB0aW9uczogYSkgdGhlIHRyYW5zcG9ydCBpcyBp bi1vcmRlciAmIHJlbGlhYmxlLCBhbmQgMikgdGhlcmUgaXMNCm9uZSBUTFMgcmVjb3JkIHBlciB0 cmFuc3BvcnQgbGF5ZXIgcGFja2V0Lg0KDQpJcyB0aGF0IHRoZSBjb3JyZWN0IGludGVycHJldGF0 aW9uPyAgSWYgaXQgaXMsIGlzIGl0IG5vdCB0b28gcmVzdHJpY3RpdmUNCmEgcmVxdWlyZW1lbnQ/ DQoNCkNoZWVycywgdGhhbmtzDQoNClsxXSBodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJh ZnQtcmVzY29ybGEtdGxzLWN0bHMtMDIjc2VjdGlvbi0zLjINCg0KDQpJTVBPUlRBTlQgTk9USUNF OiBUaGUgY29udGVudHMgb2YgdGhpcyBlbWFpbCBhbmQgYW55IGF0dGFjaG1lbnRzIGFyZSBjb25m aWRlbnRpYWwgYW5kIG1heSBhbHNvIGJlIHByaXZpbGVnZWQuIElmIHlvdSBhcmUgbm90IHRoZSBp bnRlbmRlZCByZWNpcGllbnQsIHBsZWFzZSBub3RpZnkgdGhlIHNlbmRlciBpbW1lZGlhdGVseSBh bmQgZG8gbm90IGRpc2Nsb3NlIHRoZSBjb250ZW50cyB0byBhbnkgb3RoZXIgcGVyc29uLCB1c2Ug aXQgZm9yIGFueSBwdXJwb3NlLCBvciBzdG9yZSBvciBjb3B5IHRoZSBpbmZvcm1hdGlvbiBpbiBh bnkgbWVkaXVtLiBUaGFuayB5b3UuDQo= --_000_1772330AAEE44510A261F2D5AF9762DDarmcom_ Content-Type: text/html; charset="utf-8" Content-ID: <6D9A24572995734B894EB79A6C4CF98B@eurprd08.prod.outlook.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBjbTsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCglt c28tZmFyZWFzdC1sYW5ndWFnZTpFTi1VUzt9DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJ e21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjojMDU2M0MxOw0KCXRleHQtZGVjb3JhdGlv bjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21z by1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjojOTU0RjcyOw0KCXRleHQtZGVjb3JhdGlvbjp1 bmRlcmxpbmU7fQ0Kc3Bhbi5FbWFpbFN0eWxlMTcNCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwt Y29tcG9zZTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjp3aW5k b3d0ZXh0O30NCi5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0K CWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCW1zby1mYXJlYXN0LWxhbmd1YWdl OkVOLVVTO30NCkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjYxMi4wcHQgNzkyLjBwdDsNCglt YXJnaW46NzIuMHB0IDcyLjBwdCA3Mi4wcHQgNzIuMHB0O30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7 cGFnZTpXb3JkU2VjdGlvbjE7fQ0KLS0+PC9zdHlsZT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4N CjxvOnNoYXBlZGVmYXVsdHMgdjpleHQ9ImVkaXQiIHNwaWRtYXg9IjEwMjYiIC8+DQo8L3htbD48 IVtlbmRpZl0tLT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlbGF5b3V0IHY6ZXh0 PSJlZGl0Ij4NCjxvOmlkbWFwIHY6ZXh0PSJlZGl0IiBkYXRhPSIxIiAvPg0KPC9vOnNoYXBlbGF5 b3V0PjwveG1sPjwhW2VuZGlmXS0tPg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0iRU4tR0IiIGxpbms9 IiMwNTYzQzEiIHZsaW5rPSIjOTU0RjcyIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+VGhhbmtz IGZvciBwcmVzZW50aW5nIHRoaXMgd29yay4mbmJzcDsgSSByZWFsbHkgbGlrZSB0aGlzIGFuZCBJ IHRoaW5rPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPml0J2QgYmUgcmVhbGx5IHVzZWZ1bCBmb3IgdGhlIHVz ZSBjYXNlcyB3ZSBoYXZlIChJb1QsIE0yTSkuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxvOnA+Jm5ic3A7 PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0Ij5PbmUgY29tbWVudDogZnJvbSBhIHF1aWNrIHNraW1taW5nIG9mIHRoZSBk cmFmdCwgSSdtIG5vdCBzdXJlIEk8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+dW5kZXJzdGFuZCB3aGF0IHRo ZSBzdGF0ZWQgZXhwZWN0YXRpb25zIG9uIHRoZSB0cmFuc3BvcnQgbGF5ZXIgYXJlPzxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+U2luY2UgaXQncyBjVExTIGFuZCBu b3QgY0RUTFMgSSdkIGhhdmUgdGhvdWdodCBpdCdzIHRoZSBzYW1lIGFzIFRMUzxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0Ij4oaW4tb3JkZXIgJmFtcDsgcmVsaWFibGUpIGJ1dCB0aGVuIEkgZ290IGNvbmZ1c2Vk IHJlYWRpbmcgc2VjdGlvbiAzLjIgWzFdOjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij48bzpwPiZuYnNwOzwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdCI+Jm5ic3A7ICZxdW90O1RoZSBDVExTIFJlY29yZCBMYXllciBhc3N1bWVzIHRo YXQgcmVjb3JkcyBhcmUgZXh0ZXJuYWxseSBmcmFtZWQ8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+Jm5ic3A7 Jm5ic3A7IChpLmUuLCB0aGF0IHRoZSBsZW5ndGggaXMgYWxyZWFkeSBrbm93biBiZWNhdXNlIGl0 IGlzIGNhcnJpZWQgaW48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+Jm5ic3A7Jm5ic3A7IGEgVURQIGRhdGFn cmFtIG9yIHRoZSBsaWtlKSZxdW90OzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij48bzpwPiZuYnNwOzwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdCI+T24gSmFiYmVyIEJlbiBzdWdnZXN0ZWQgdGhhdCBvbmUgY291bGQgcHV0IENvQVAg YmV0d2VlbiBVRFAgYW5kIGNUTFMgdG88bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+Z2V0IGluLW9yZGVyICZh bXA7IHJlbGlhYmxlIGRlbGl2ZXJ5IHdpdGggYSBkYXRhZ3JhbSB0cmFuc3BvcnQsIGJ1dCB0aGVu IEknbTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0Ij5ub3Qgc3VyZSB3aGF0IHRoZSBhZHZhbnRhZ2Ugd291bGQg YmUgc2luY2Ugd2UnZCBiZSB0cmFkaW5nIDIgYnl0ZXMgb2Y8bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+VExT UGxhaW50ZXh0Lmxlbmd0aCB3aXRoIDQgYnl0ZXMgKG1pbmltdW0pIG9mIENvQVAgaGVhZGVyPzxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+RnJvbSB0aGUgSmFiYmVy IGRpc2N1c3Npb24sIG15IGN1cnJlbnQgdW5kZXJzdGFuZGluZyBpcyB0aGF0IHRoZXJlIGFyZSAy PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQiPmFzc3VtcHRpb25zOiBhKSB0aGUgdHJhbnNwb3J0IGlzIGluLW9y ZGVyICZhbXA7IHJlbGlhYmxlLCBhbmQgMikgdGhlcmUgaXM8bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+b25l IFRMUyByZWNvcmQgcGVyIHRyYW5zcG9ydCBsYXllciBwYWNrZXQuPG86cD48L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQi PjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij5JcyB0aGF0IHRoZSBjb3JyZWN0IGludGVycHJldGF0 aW9uPyZuYnNwOyBJZiBpdCBpcywgaXMgaXQgbm90IHRvbyByZXN0cmljdGl2ZTxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0Ij5hIHJlcXVpcmVtZW50PzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij48bzpwPiZuYnNwOzwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdCI+Q2hlZXJzLCB0aGFua3M8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+PG86cD4mbmJzcDs8L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQiPlsxXSA8YSBocmVmPSJodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQt cmVzY29ybGEtdGxzLWN0bHMtMDIjc2VjdGlvbi0zLjIiPg0KaHR0cHM6Ly90b29scy5pZXRmLm9y Zy9odG1sL2RyYWZ0LXJlc2NvcmxhLXRscy1jdGxzLTAyI3NlY3Rpb24tMy4yPC9hPjxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+PG86cD4mbmJzcDs8L286cD48L3Nw YW4+PC9wPg0KPC9kaXY+DQpJTVBPUlRBTlQgTk9USUNFOiBUaGUgY29udGVudHMgb2YgdGhpcyBl bWFpbCBhbmQgYW55IGF0dGFjaG1lbnRzIGFyZSBjb25maWRlbnRpYWwgYW5kIG1heSBhbHNvIGJl IHByaXZpbGVnZWQuIElmIHlvdSBhcmUgbm90IHRoZSBpbnRlbmRlZCByZWNpcGllbnQsIHBsZWFz ZSBub3RpZnkgdGhlIHNlbmRlciBpbW1lZGlhdGVseSBhbmQgZG8gbm90IGRpc2Nsb3NlIHRoZSBj b250ZW50cyB0byBhbnkgb3RoZXIgcGVyc29uLCB1c2UgaXQgZm9yIGFueSBwdXJwb3NlLA0KIG9y IHN0b3JlIG9yIGNvcHkgdGhlIGluZm9ybWF0aW9uIGluIGFueSBtZWRpdW0uIFRoYW5rIHlvdS4N CjwvYm9keT4NCjwvaHRtbD4NCg== --_000_1772330AAEE44510A261F2D5AF9762DDarmcom_-- From nobody Thu Jul 25 10:14:52 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4264F1201CC for ; Thu, 25 Jul 2019 10:14:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=heapingbits.net header.b=LjSDaHIP; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=m+XxruHy Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YrVuo97-HRGa for ; Thu, 25 Jul 2019 10:14:48 -0700 (PDT) Received: from out4-smtp.messagingengine.com (out4-smtp.messagingengine.com [66.111.4.28]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C9B191201C9 for ; Thu, 25 Jul 2019 10:14:48 -0700 (PDT) Received: from compute6.internal (compute6.nyi.internal [10.202.2.46]) by mailout.nyi.internal (Postfix) with ESMTP id A13FE222BD for ; Thu, 25 Jul 2019 13:14:47 -0400 (EDT) Received: from imap4 ([10.202.2.54]) by compute6.internal (MEProxy); Thu, 25 Jul 2019 13:14:47 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=heapingbits.net; h=mime-version:message-id:date:from:to:subject:content-type; s= fm1; bh=gktiNq8BpyJn2RaQ0vc5Pq3UBhYJmBHzw+dd00Iv9WQ=; b=LjSDaHIP kejZrqOPbDJQtrDO9QrlCK0Yvln5mIzcW+AjOZdAWiblu5XpDjLQvcwAKdVz0DJV eAN8KF20Dgv8VjDh3dDGsiqMgMl74/c/4cCj6x2FGeQgRAJllSeu1GdrmzssXE4N mn9i4bJYLtMm66tgGhp2xPq0rZWXwUgIG/MEXIOowK8enRWDpwUVLH+NpES/1G84 pg6qV1c8Yk7Wdkyd8Z+DrkQOoXHJWbO7u/aIn7m0QtuD1Zew5nY2e3OR+ia2gE5H YlUFmFzRHLXiYPT1WZC3pz+YRE6WSa4tcJ8uS7DsS+kw5KJiX/nImfvJXR39DLQb YIGWAbplS97+ig== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-type:date:from:message-id :mime-version:subject:to:x-me-proxy:x-me-proxy:x-me-sender :x-me-sender:x-sasl-enc; s=fm3; bh=gktiNq8BpyJn2RaQ0vc5Pq3UBhYJm BHzw+dd00Iv9WQ=; b=m+XxruHyAPEv2YeCcU+fHuUkaRs4/rXT71sitQGypbvtl yBAhRlV59s5qa/sFIbRdNBFi1KKXq8pdx8NkzHYTH46naayzli5Tih2EAFkVGIOp KQ4guUV8MyPUF+Tg9AvX4Ls8HWa1R8Hv5mNpgX0BHkYxphGP4R8bO+lX5vGz9vnJ YM+MVWfHSeZH4t65taYEDeilOoVEdGuNaXA16Q8AAHJcAihDDmLgn5WbEy58RkPR zkheW05he3dty/vz+kie4Qugs7OTMf4d0BjLkrr4Xhwx2eNSkN9xnSW1FdWSFdOk o2Qw7YoKB85E14NmftqMa91n26Kjhbqiv2L6KFBRw== X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeduvddrkedvgddutdekucetufdoteggodetrfdotf fvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdfqfgfvpdfurfetoffkrfgpnffqhgen uceurghilhhouhhtmecufedttdenucenucfjughrpefofgggkfffhffvufgtsehttdertd erredtnecuhfhrohhmpedfvehhrhhishhtohhphhgvrhcuhghoohgufdcuoegtrgifsehh vggrphhinhhgsghithhsrdhnvghtqeenucffohhmrghinhepghhithhhuhgsrdgtohhmne curfgrrhgrmhepmhgrihhlfhhrohhmpegtrgifsehhvggrphhinhhgsghithhsrdhnvght necuvehluhhsthgvrhfuihiivgeptd X-ME-Proxy: Received: by mailuser.nyi.internal (Postfix, from userid 501) id 5DAF83C00A1; Thu, 25 Jul 2019 13:14:47 -0400 (EDT) X-Mailer: MessagingEngine.com Webmail Interface User-Agent: Cyrus-JMAP/3.1.6-736-gdfb8e44-fmstable-20190718v2 Mime-Version: 1.0 Message-Id: <7942b0ff-58bb-4d06-9dd2-840740682633@www.fastmail.com> Date: Thu, 25 Jul 2019 13:14:46 -0400 From: "Christopher Wood" To: "TLS@ietf.org" Content-Type: text/plain Archived-At: Subject: [TLS] Draft minutes available X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 25 Jul 2019 17:14:50 -0000 Draft minutes from today's and Tuesday's sessions are available at [1]. Please take a look and provide edits and corrections as needed. We'll submit the final version next week. Many thanks to Rich and Patrick for taking notes! Best, Chris [1] https://github.com/tlswg/wg-materials/blob/master/ietf105/minutes.md From nobody Fri Jul 26 00:51:38 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9CDEC1202C3 for ; Fri, 26 Jul 2019 00:51:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pyoNr6iyHrXv for ; Fri, 26 Jul 2019 00:51:33 -0700 (PDT) Received: from smtpout11.ifi.lmu.de (smtpout11.ifi.lmu.de [IPv6:2001:4ca0:4000:0:141:84:214:246]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CD0121202C4 for ; Fri, 26 Jul 2019 00:51:32 -0700 (PDT) Received: from webmail.cip.ifi.lmu.de (mailserv1.ifi.lmu.de [IPv6:2001:4ca0:4000:0:141:84:220:222]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) (Authenticated sender: heidert) by smtpin1.ifi.lmu.de (Postfix) with ESMTPSA id 96AEE26B4DA; Fri, 26 Jul 2019 09:51:30 +0200 (CEST) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII; format=flowed Content-Transfer-Encoding: 7bit Date: Fri, 26 Jul 2019 09:51:30 +0200 From: heidert To: Christopher Wood Cc: TLS@ietf.org, sfluhrer@cisco.com In-Reply-To: <7942b0ff-58bb-4d06-9dd2-840740682633@www.fastmail.com> References: <7942b0ff-58bb-4d06-9dd2-840740682633@www.fastmail.com> Message-ID: X-Sender: heidert@nm.ifi.lmu.de User-Agent: Roundcube Webmail/1.3.6 Archived-At: Subject: Re: [TLS] Draft minutes available X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 Jul 2019 07:51:37 -0000 > ???? - each algorithm has a parameter set which will increase the > combinations This was said by Scott Fluhrer if I remember correctly. Regards, Tobias From nobody Fri Jul 26 08:42:38 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D432F12007A; Fri, 26 Jul 2019 08:11:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=verimatrix.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4eEx-ke_ZN5S; Fri, 26 Jul 2019 08:11:35 -0700 (PDT) Received: from NAM01-BY2-obe.outbound.protection.outlook.com (mail-eopbgr810085.outbound.protection.outlook.com [40.107.81.85]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6F8C5120108; Fri, 26 Jul 2019 08:11:27 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=XiDQp6oGzOlJgZcG47s6CH66KMgg2McJbOi1YoFhbcWUs+JueZwmSzekjFyXQetKut4wP45y3uFWX+8tJnZElKjfG4NogRGNmwSyNs4ejHcXwe7BATN7azK2tVMfriMW/DQjs+DbyjTWtjySzyEkpTLBlsU8ryKEALO2up2vuzYDAwIg0W5MqDj3bSR+f8mNax5cWRziaADSnzsR3iX3nZshKupd4M9BVsqMZI6iawNCoo38p+Aj7HWwZKZFSQwlLMCD1XCsrXmFB3H1327+zdj17AizmSYZCXojrWFHhV1qLTgLZdeJPHTcu5aEYOstpqv6QwkMuK8E1VDWj14AXA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=xxjxptuILPp0j4CttPyAYa6YUqNRY16WYCCoFuXG2hw=; b=Pg19qDt9WmQaGtIgpRThh5D6Pq0Nygw3NQxlV+Tm1l7ynnLdMStbjPIioGHgUF4gw5WLv+SSkyBmYD/nO2InukR5+VaQi/48asMJVTIfiApPuAOEIJ1OO9hO7kWT/fy365/1G/kYYXYFcFl3z1V5q1KjJlv7jWZi8SYbA6HUCNTaEOEedvXJoWzycy5GQUWJiOcLZGBQcwYj8rMk6rVq1MiDs80zYw2lAunlGxo7I7+UbV1kWbI0ZWlYzOi8nYcanCSdXVXACmBFdIEPhi2kQT9dXfy5buo7KvAfVLTtZqslXDmM9T1nEqMwUs3PxCsJcEEJCVWtXinb8AnFiWqs7Q== ARC-Authentication-Results: i=1; mx.microsoft.com 1;spf=pass smtp.mailfrom=verimatrix.com;dmarc=pass action=none header.from=verimatrix.com;dkim=pass header.d=verimatrix.com;arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=verimatrix.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=xxjxptuILPp0j4CttPyAYa6YUqNRY16WYCCoFuXG2hw=; b=DmQ4ychV/7+ir+yFmJ2boqMIf1/pTXKKRPo8KrS7BqejqTjopUatWlQjnS4a3NujaO9z42cIZuARtEjQLpRDpy5dwNBqKIqjXv2W9r/DNi6NeW2HW5MsYHSNCWG0BKCNoQwXrPiulXHPfnT69v8PbU5/+xzunQKQCd/M8iNFyyY= Received: from MN2PR20MB2973.namprd20.prod.outlook.com (52.132.172.146) by MN2PR20MB3053.namprd20.prod.outlook.com (52.132.173.158) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2115.10; Fri, 26 Jul 2019 15:11:24 +0000 Received: from MN2PR20MB2973.namprd20.prod.outlook.com ([fe80::68d7:2bbb:af61:2e69]) by MN2PR20MB2973.namprd20.prod.outlook.com ([fe80::68d7:2bbb:af61:2e69%6]) with mapi id 15.20.2094.017; Fri, 26 Jul 2019 15:11:24 +0000 From: Pascal Van Leeuwen To: Eric Rescorla CC: "draft-ietf-tls-dtls13@ietf.org" , "tls@ietf.org" Thread-Topic: draft-ietf-tls-dtls13 - sequence number encryption Thread-Index: AQHVQ701vwAluI2xUUC+WEoQohWEn6bc+GCg Date: Fri, 26 Jul 2019 15:11:24 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=pvanleeuwen@verimatrix.com; x-originating-ip: [188.204.2.113] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 0e1e1994-b8ae-4e1c-7a2e-08d711db864f x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:MN2PR20MB3053; x-ms-traffictypediagnostic: MN2PR20MB3053: x-ms-exchange-purlcount: 1 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-forefront-prvs: 01106E96F6 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(4636009)(396003)(39840400004)(376002)(346002)(136003)(366004)(199004)(189003)(51914003)(476003)(186003)(71200400001)(71190400001)(8676002)(9686003)(446003)(11346002)(7736002)(26005)(486006)(5660300002)(66476007)(66556008)(64756008)(66446008)(76176011)(81156014)(229853002)(76116006)(66066001)(86362001)(305945005)(14454004)(81166006)(6246003)(102836004)(66946007)(256004)(14444005)(6506007)(99286004)(7696005)(53546011)(3846002)(6116002)(966005)(53936002)(478600001)(68736007)(6436002)(74316002)(2906002)(52536014)(6306002)(8936002)(25786009)(55016002)(54906003)(316002)(4326008)(33656002)(6916009)(18886065003); DIR:OUT; SFP:1101; SCL:1; SRVR:MN2PR20MB3053; H:MN2PR20MB2973.namprd20.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: verimatrix.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: obyeejDs7bfv3a8CtNOkbRj/WfdIqJ/CVcsfbHAF/8l/6r3xFSMtG6Z/iiT9Y1VAD9RAxJZBbkaYADtVRgA0D30E7qYabDCUSTBa8bIdcrz4Woip6LfGPWYwLlMot0flyzHAlWTrOcksPPYc6WM+hkaUiCUI2mOaT3CXrvOMEsBGaRiZgcMfTs5JTZfI0TkBIW2xNEBcJRztyBGG34Iy3Ei3x83IJoLG8GcSEWoyijNB4XwQpjeeMsyQU9WJaCd8lbLxJLbeB+uVVwjh6MrD7FHYkMnZacz4gYjzcwQJAnvvJXFSTRHSSj4dhJ7maOtZJRdTmqBWrpNRDbubtfAe1uTKw3wBott3/v9ywwvrUWaGXoUsqmq33uCKBERKk3Fee1Cmx1D4FXnm1Zf2nK4AgQYhNZr7kVYDMRqQL/lTrVw= Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: verimatrix.com X-MS-Exchange-CrossTenant-Network-Message-Id: 0e1e1994-b8ae-4e1c-7a2e-08d711db864f X-MS-Exchange-CrossTenant-originalarrivaltime: 26 Jul 2019 15:11:24.3850 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: dcb260f9-022d-4495-8602-eae51035a0d0 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: pvanleeuwen@verimatrix.com X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN2PR20MB3053 Archived-At: X-Mailman-Approved-At: Fri, 26 Jul 2019 08:42:38 -0700 Subject: Re: [TLS] draft-ietf-tls-dtls13 - sequence number encryption X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 Jul 2019 15:11:39 -0000 SGkgRXJpYywNCg0KVGhhbmtzIGZvciB0aGUgcmVzcG9uc2UhDQoNCj4gRnJvbTogRXJpYyBSZXNj b3JsYSA8ZWtyQHJ0Zm0uY29tPiANCj4gU2VudDogRnJpZGF5LCBKdWx5IDI2LCAyMDE5IDQ6MTkg UE0NCj4gVG86IFBhc2NhbCBWYW4gTGVldXdlbiA8cHZhbmxlZXV3ZW5AdmVyaW1hdHJpeC5jb20+ DQo+IENjOiBkcmFmdC1pZXRmLXRscy1kdGxzMTNAaWV0Zi5vcmcNCj4gU3ViamVjdDogUmU6IGRy YWZ0LWlldGYtdGxzLWR0bHMxMyAtIHNlcXVlbmNlIG51bWJlciBlbmNyeXB0aW9uDQo+DQo+IEhp IFBhc2NhbCwNCj4NCj4gVGhhbmtzIGZvciB5b3VyIG5vdGUuIEkgd291bGQgZW5jb3VyYWdlIHlv dSB0byBzZW5kIGl0IHRvIHRoZSBUTFMgV0cgKHRoaXMgYWxpYXMganVzdCBnb2VzIHRvIHRoZSBh dXRob3JzKS4gV2l0aCB0aGF0IHNhaWQsIHNvbWUgY29tbWVudHMgYmVsb3cNCj4NCkkgZ3Vlc3Mg SSBjbGlja2VkIHRoZSB3cm9uZyBlbWFpIGJ1dHRvbiAtIHNvcnJ5IGFib3V0IHRoYXQuIEkgYWRk ZWQgdGhlIFdHIGVtYWlsIHRvIHRoZSBjYyBsaXN0Lg0KDQo+PiBPbiBGcmksIEp1bCAyNiwgMjAx OSBhdCAxOjUzIEFNIFBhc2NhbCBWYW4gTGVldXdlbiA8bWFpbHRvOnB2YW5sZWV1d2VuQHZlcmlt YXRyaXguY29tPiB3cm90ZToNCj4+IEluIGRyYWZ0IDI5LCBzZXF1ZW5jZSBudW1iZXIgZW5jcnlw dGlvbiB3YXMgYWRkZWQuIE5vdyBJIGNhbid0IGZpbmQgYW55IHJhdGlvbmFsZSBmb3IgDQo+PiBk b2luZyBzbyBpbiB0aGUgZHJhZnQgKHRhbXBlcmluZyB3aXRoIGl0IHdhcyBhbHJlYWR5IGRldGVj dGFibGUgYXMgaXQncyBhdXRoZW50aWNhdGVkKSwgDQo+PiBhbmQgSSBkb24ndCBrbm93IG9mIGFu eSBvdGhlciBwcm90b2NvbCBlbmNyeXB0aW5nIHRoZSBzZXF1ZW5jZSBudW1iZXIsIGJ1dCB0aGUg d2F5IA0KPj4gdGhhdCB0aGF0J3MgY3VycmVudGx5IHNwZWNpZmllZCBtYWtlcyBIVyBpbXBsZW1l bnRhdGlvbiB2ZXJ5IGRpZmZpY3VsdCBhbmQgY29zdGx5LCANCj4+IHNvIHNvbWUgcHJvcGVyIGNv c3QtYmVuZWZpdCBhbmFseXNpcyB3b3VsZCBiZSBhcHByb3ByaWF0ZSBJTUhPLg0KPj4NCj4+IFRo ZSBjdXJyZW50IHNwZWNpZmljYXRpb24gY2FsbHMgZm9yIGVuY3J5cHRpbmcgdGhlIHNlcXVlbmNl IG51bWJlciBieSBYT1ItaW4gaXQgd2l0aA0KPj4gdGhlIG91dHB1dCBvZiBlbmNyeXB0aW5nIHBh cnQgb2YgdGhlIGNpcGhlcnRleHQuIEZyb20gYSBoYXJkd2FyZSBwZXJzcGVjdGl2ZSwgdGhpcyAN Cj4+IG1lYW5zIGVpdGhlciB0YWtpbmcgdGhlIG91dHB1dCBvZiB5b3VyIGVuY3J5cHRpb24gcGlw ZWxpbmUgYW5kIGZlZWRpbmcgaXQgYmFjayBpbnRvDQo+PiAgdGhlIGlucHV0IChraWxsaW5nIHBl cmZvcm1hbmNlISkgLW9yLSBhZGRpbmcgYW5vdGhlciBmdWxsIGVuY3J5cHRpb24gcGlwZWxpbmUg YmVoaW5kDQo+PiB0aGUgYWxyZWFkeSBleGlzdGluZyBvbmUsIHdoaWNoIGlzIHZlcnkgY29zdGx5 IChhbmQgbm90IHVzZWZ1bCBmb3IgYW55dGhpbmcgZWxzZSkuDQo+DQo+IFllYWgsIHdlJ3JlIGF3 YXJlIG9mIHRoYXQuIEl0J3Mga2luZCBvZiB1bmZvcnR1bmF0ZSwgYnV0IHdlIGRpZG4ndCByZWFs bHkgaGF2ZSBhbm90aGVyIG9wdGlvbi4NCj4NClNvdW5kcyBsaWtlIHRoYXQsIGZyb20gdGhlIHJl c3Qgb2YgdGhlIHJlc3BvbnNlLiBBbHRob3VnaCBJIHN0aWxsIHdvbmRlciB3aHkgdGhpcyBpcyBz byANCmltcG9ydGFudC4gVGhlIFJGQyBkb2VzIG5vdCBzYXkgbXVjaCBhYm91dCB0aGUgd2h5IGF0 IHRoZSBtb21lbnQuDQoNCj4+IEkgd291bGQgcHJvcG9zZSB0aGUgZm9sbG93aW5nIG9wdGlvbnMg dG8gYmUgY29uc2lkZXJlZCAoaW4gdGhlIG9yZGVyIGZyb20gbW9zdA0KPj4gZGVzaXJhYmxlIHRv IGxlYXN0IGRlc2lyYWJsZSwgZnJvbSBhIEhXIGltcGxlbWVudGF0aW9uIHBvaW50IG9mIHZpZXcp Og0KPj4NCj4+IDEpIE1ha2luZyB0aGUgc2VxdWVuY2UgbnVtYmVyIGVuY3J5cHRpb24gb3B0aW9u YWwsIHRvIGJlIG5lZ290aWF0ZWQsIHRvDQo+PiBhbGxvdyB0cmFkaW5nIG9mZiBiZXR3ZWVuIHBl cmZvcm1hbmNlL2Nvc3QgYW5kIHRoZSBhZGRlZCBzZWN1cml0eSB3aGljaA0KPj4gaXMgYWxzbyBu b3QgcHJvdmlkZWQgYnkgYW55IGV4aXN0aW5nIGFsdGVybmF0aXZlcyBlaXRoZXINCj4+DQo+IFRo aXMgd2FzIGRpc2N1c3NlZCBhbmQgcmVqZWN0ZWQsIGJ1dCBpdCdzIGNlcnRhaW5seSBzb21ldGhp Z24geW91IGNvdWxkIHJhaXNlIGFnYWluDQo+DQpXb3VsZCB0aGF0IGhlbHA/IEkgc3VwcG9zZSBp dCB3YXMgcmVqZWN0ZWQgZm9yIGEgZ29vZCByZWFzb24gLi4uDQoNCj4+IG9yDQo+Pg0KPj4gMikg RW5jcnlwdCB0aGUgc2VxdWVuY2UgbnVtYmVyIGFzIHBhcnQgb2YgdGhlIG5vcm1hbCBkYXRhIHN0 cmVhbQ0KPj4gKE9yIGFtIEkgbWlzc2luZyBzb21lIHNlY3VyaXR5IGltcGxpY2F0aW9ucyBmb3Ig ZG9pbmcgaXQgdGhhdCB3YXk/IEkgZ3Vlc3MgDQo+PiBpdCB3b3VsZCBhZGQgc29tZSBrbm93biBh bmQvb3IgZWFzeSB0byBndWVzcyBwbGFpbnRleHQgYnV0IHRoZSBlbmNyeXB0aW9uDQo+PiBhbGdv cml0aG0gdXNlZCAoQUVTIG9yIENoYWNoYTIwKSBzaG91bGQgYmUgc3Ryb25nIGVub3VnaCB0byBy ZXNpc3QgdGhhdC4NCj4+IEkgdW5kZXJzdGFuZCB5b3UgZG9uJ3Qgd2FudCB0byBkZWNyeXB0IHRo ZSBmdWxsIHBhY2tldCBiZWZvcmUgeW91IGRvIHRoZSANCj4+IGFudGktcmVwbGF5IGNoZWNrLCBi dXQgdGhhdCBjYW4gc3RpbGwgYmUgZG9uZSBldmVuIGlmIHlvdSBkbyBpdCB0aGlzIHdheSBieQ0K Pj4ganVzdCBkb2luZyB0aGUgc2VxdWVuY2UgbnVtYmVyIGNoZWNrIGFmdGVyIGRlY3J5cHRpbmcg c3VmZmljaWVudCBkYXRhDQo+PiB0byBhY2Nlc3MgaXQsIGJ1dCBiZWZvcmUgZGVjcnlwdGluZyB0 aGUgcmVzdCBvZiB0aGUgcGF5bG9hZCkNCj4+DQo+IEkgZG9uJ3QgYmVsaWV2ZSB0aGF0IHRoaXMg d2lsbCB3b3JrLCBiZWNhdXNlIHRoZSBzZXF1ZW5jZSBudW1iZXIgaXMgdXNlZCB0bw0KPiBnZW5l cmF0ZSB0aGUgQUVBRCBub25jZSwgc28geW91IHdpbGwgbm90IGJlIGFibGUgdG8gZGVjcnlwdC4N Cj4NCkFoIHllcywgZm9yIFRMUyAxLjMgdGhlIElWIGlzIG5vdyBpbXBsaWNpdCBhbmQgdGFrZW4g ZnJvbSB0aGUgc2VxdWVuY2UgbnVtYmVyLg0KSSBkaWRuJ3QgcmVhbGlzZSB0aGF0IGZvciBhIHNl Y29uZCwgbXkgYmFkIC4gSSBndWVzcyB0aGF0J3MgYSBnb29kIHJlYXNvbiBhbmQgaGF2aW5nIA0K dGhlIG5vbmNlIGVuY3J5cHRlZCBjb21wbGljYXRlcyB0aGUgSFcgZGVzaWduIGV2ZW4gZnVydGhl ciwgdW5mb3J0dW5hdGVseSA6LSgNCg0KPj4gMykgVXNlIHNvbWUgb3RoZXIgYWx0ZXJuYXRpdmUg d2F5IHRvIG9idGFpbiB0aGUgc2VxdWVuY2UgbnVtYmVyIA0KPj4gZW5jcnlwdGlvbiBrZXlzdHJl YW0gdGhhdCBkb2Vzbid0IGRlcGVuZCBvbiB0aGUgY2lwaGVydGV4dCBvdXRwdXQsDQo+PiBlLmcu IGJ5IGVuY3J5cHRpbmcgdGhlL3NvbWUgbm9uY2Ugd2l0aCBzb21lIG90aGVyIHNlY3JldCBrZXku DQo+Pg0KPiBXZSB3ZXJlIHVuYWJsZSB0byBmaW5kIGEgd2F5IHRvIGRvIHRoaXMgdGhhdCBkaWRu J3QgaGF2ZSBhIGxvdCBvZiBkYXRhIGV4cGFuc2lvbi4NCj4NClVzaW5nIGlucHV0IHRoYXQncyBO T1QgdGhlIGlucHV0IG9yIG91dHB1dCB0byB0aGUgbWFpbiBjaXBoZXIgd291bGQgYWxyZWFkeSBo ZWxwIGEgbG90IC4uLg0KYnV0IHdpdGggdGhlIG5vbmNlIGl0c2VsZiBvdXQgb2YgdGhlIHBpY3R1 cmUgdGhlcmUncyBpbmRlZWQgbm90IGEgd2hvbGUgbG90IHlvdSBjYW4gdXNlDQp3aXRob3V0IGhh dmluZyB0byBhZGQgaXQgdG8gdGhlIGVuY2Fwc3VsYXRlZCBwYWNrZXQuIE5vdCBoYXZpbmcgYW55 IGJyaWdodCBpZGVhcyBhdA0KdGhlIG1vbWVudC4NCg0KPiBJbmNpZGVudGFsbHksIFFVSUMgaGFz IGV4YWN0bHkgdGhlIHNhbWUgZGVzaWduLCBzbyB5b3UgbWF5IHdhbnQgdG8gcmFpc2UgdGhpcw0K PiBpc3N1ZSB0aGVyZSBhcyB3ZWxsLg0KPg0KT2ssIGdvb2QgdG8ga25vdywgIGFsdGhvdWdoIHdl IGRvbid0IGRvIGFueXRoaW5nIHdpdGggUVVJQyBhdCB0aGUgbW9tZW50Lg0KDQo+DQo+IC1Fa3IN Cj4NCj4+IG9yDQo+Pg0KPj4gNCkgQXQgdGhlIHZlcnkgbGVhc3QsIGRvbid0IG1ha2UgdGhlIHNl cXVlbmNlIG51bWJlciBlbmNyeXB0aW9uIGRlcGVuZA0KPj4gb24gdGhlIG1haW4gY2lwaGVyc3Vp dGUgYnV0IGUuZy4gYWx3YXlzIG1ha2UgaXQgdXNlIEFFUy1FQ0IuIE9yIC4uLg0KPj4gbWFrZSBp dCBzZXBlcmF0ZWx5IG5lZ290aWF0YWJsZSBzbyB5b3UgY2FuIGF0IGxlYXN0IGFsd2F5cyBzZWxl Y3QgQUVTLUVDQi4NCj4+IFdoeT8gQmVjYXVzZSB0aGVuIGF0IGxlYXN0IHRoYXQgMm5kIGVuY3J5 cHRpb24gZW5naW5lIG9ubHkgbmVlZHMgYSANCj4+IHNpbmdsZSBhbGdvcml0aG0gaW5zdGVhZCBv ZiAyIChvciBtb3JlKSwgc2F2aW5nIHByZWNpb3VzIGNoaXAgYXJlYSAuLi4NCg0KUmVnYXJkcywN ClBhc2NhbCB2YW4gTGVldXdlbg0KU2lsaWNvbiBJUCBBcmNoaXRlY3QsIE11bHRpLVByb3RvY29s IEVuZ2luZXMgQCBWZXJpbWF0cml4DQpodHRwOi8vd3d3Lmluc2lkZXNlY3VyZS5jb20NCg== From nobody Fri Jul 26 10:32:18 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9D9FE12008C for ; Fri, 26 Jul 2019 10:32:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jRnN8ck1xCTl for ; Fri, 26 Jul 2019 10:32:14 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 048F4120047 for ; Fri, 26 Jul 2019 10:32:04 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 30BD1BE3E for ; Fri, 26 Jul 2019 18:32:02 +0100 (IST) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fxm-K36qV0GN for ; Fri, 26 Jul 2019 18:32:00 +0100 (IST) Received: from [31.133.133.0] (dhcp-8500.meeting.ietf.org [31.133.133.0]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 75CB1BE53 for ; Fri, 26 Jul 2019 18:31:59 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1564162320; bh=dZlEI8o77NqiDFAOeay8ZyEaCTpVhjjYvGNaXhpk+XM=; h=To:From:Subject:Date:From; b=g5D3lQP8ra23OKoANl/m1If1Ax9v2//cNlQ70s0skmeZHmkGOZMAyFBeGaliXnR5W /6T4eh2tgkNL5l2RdbjkIBfNqUGPmO8fcC3Tpzg1P145kLpDE1vInTAHcXLFvnIACP EKsEC5TdnoyShX2QL0Shku7HhYF7QWLez5YuyYnw= To: "tls@ietf.org" From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <8c903f04-7605-be98-5813-688d1ef88c55@cs.tcd.ie> Date: Fri, 26 Jul 2019 18:31:53 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="LkayJOtnRzg6TvhI2SPFHoKPaCO4FbbgJ" Archived-At: Subject: [TLS] ESNI GREASE - answer needed? X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 Jul 2019 17:32:17 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --LkayJOtnRzg6TvhI2SPFHoKPaCO4FbbgJ Content-Type: multipart/mixed; boundary="lR1fsCAOM635hzZ4yrH8fGS0FG5PW5dJ6"; protected-headers="v1" From: Stephen Farrell To: "tls@ietf.org" Message-ID: <8c903f04-7605-be98-5813-688d1ef88c55@cs.tcd.ie> Subject: ESNI GREASE - answer needed? --lR1fsCAOM635hzZ4yrH8fGS0FG5PW5dJ6 Content-Type: multipart/mixed; boundary="------------56DABB4F481E239A1E61EEFB" Content-Language: en-GB This is a multi-part message in MIME format. --------------56DABB4F481E239A1E61EEFB Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hiya, I've started coding up the GREASE stuff from draft -04. Aren't we missing some answering octets in EncryptedExtensions to make it harder to tell if the CH had a real or GREASEd ESNI? Maybe something like: enum { esni_accept(0), esni_retry_request(1), esni_grease(2), } ServerESNIResponseType; struct { ServerESNIResponseType response_type; select (response_type) { case esni_accept: uint8 nonce[16]; case esni_retry_request: ESNIKeys retry_keys<1..2^16-1>; case esni_grease: uint8 grease[16]; } } ServerEncryptedSNI; Cheers, S. --------------56DABB4F481E239A1E61EEFB Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------56DABB4F481E239A1E61EEFB-- --lR1fsCAOM635hzZ4yrH8fGS0FG5PW5dJ6-- --LkayJOtnRzg6TvhI2SPFHoKPaCO4FbbgJ Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAl07OQoACgkQWrL68XsX K+qI+w/+JWmH37feQxbH9xYGRSfQEwz0cSAlQYVglXQkX0wQ7fgOpI2p3Vcj/wc1 kmJkP23nZmVKEmdpbRmOJ/nn4YvSXz+mbCPRWpLIfFXwDi3tFHhXqtGw1o/PSUBb fAn9whRrnNyRvRbLSEQXFD1laM2uYTAAXWrsKJ7bTf5xpOYCpatLBslN6dsAdZlV ZLO/+ANzbcQfdfiRIylEfJuQCIFN3fXYFeU5YIhfYvPU73aA7ihh9p+wSN0u2hGq HvvqcYOC6DeOf4qEEB/El5JLbBAaPXi97XSdffv5kTgtzTDjypj6606Z18Kcv3Gy SBzf4CULN7chpaQbE1opWKkmL2W5ADuFVvBq2kwKvQ11jFs9WKKu3qqX7nvaubwj sZD085wApstBmdVueSbiGqqFwVzAoHSRP+JfbOTThW/K2nvvJ8Kq+6gEfCdjBj2K x7aEmudqrOsW7FS20My81KgCXpdruWfYpfLYLVZ3i0UHTVEyRO6IEGHDPfVaf/Zz /WUKTX5ZZknULZbRpYT4MXIArnW+i6wsBijUp6RTvErY5cYiwsdpMYNfcl7RzW/A I9g9fbsgBCPhg0l5xfoLE2UlBEZeeWDY+qbEu6+10S7A+JUGWjg+VYRUdIZZeNte fBG/eVjnGGEhKy8AtM5Qi+nYhcyjB1tERP+OwiHA9Ue4z5bYIMY= =13t+ -----END PGP SIGNATURE----- --LkayJOtnRzg6TvhI2SPFHoKPaCO4FbbgJ-- From nobody Sat Jul 27 06:15:29 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9DD10120141 for ; Wed, 24 Jul 2019 14:53:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=tlrmx.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id h_mFpaXsGSP6 for ; Wed, 24 Jul 2019 14:53:46 -0700 (PDT) Received: from chocolate.birch.relay.mailchannels.net (chocolate.birch.relay.mailchannels.net [23.83.209.35]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C831A1200CE for ; Wed, 24 Jul 2019 14:53:45 -0700 (PDT) X-Sender-Id: dreamhost|x-authsender|njl@tlrmx.org Received: from relay.mailchannels.net (localhost [127.0.0.1]) by relay.mailchannels.net (Postfix) with ESMTP id 0B2166A1923 for ; Wed, 24 Jul 2019 21:53:45 +0000 (UTC) Received: from pdx1-sub0-mail-a70.g.dreamhost.com (100-96-83-224.trex.outbound.svc.cluster.local [100.96.83.224]) (Authenticated sender: dreamhost) by relay.mailchannels.net (Postfix) with ESMTPA id 8C0F66A1832 for ; Wed, 24 Jul 2019 21:53:44 +0000 (UTC) X-Sender-Id: dreamhost|x-authsender|njl@tlrmx.org Received: from pdx1-sub0-mail-a70.g.dreamhost.com ([TEMPUNAVAIL]. [64.90.62.162]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384) by 0.0.0.0:2500 (trex/5.17.3); Wed, 24 Jul 2019 21:53:44 +0000 X-MC-Relay: Neutral X-MailChannels-SenderId: dreamhost|x-authsender|njl@tlrmx.org X-MailChannels-Auth-Id: dreamhost X-Stretch-Robust: 6a2387b17eacd63b_1564005224823_3328596093 X-MC-Loop-Signature: 1564005224823:921360160 X-MC-Ingress-Time: 1564005224822 Received: from pdx1-sub0-mail-a70.g.dreamhost.com (localhost [127.0.0.1]) by pdx1-sub0-mail-a70.g.dreamhost.com (Postfix) with ESMTP id 5426C8193D for ; Wed, 24 Jul 2019 14:53:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=tlrmx.org; h=date:from:to :subject:message-id:mime-version:content-type :content-transfer-encoding; s=tlrmx.org; bh=vn0B35752Sf0pfXt5sPC tC32O5Y=; b=FD7UezdTEmJpkaZ9UtgZWyKKsa9pZve/pakXpVrp5CPks6FTLdXh mePA4/7yigufkL0M+qVH+CU5xwqaJ4zSxhBB6j6dnJkY44cEz36rhuGzFBuJAWGF po9i3e2YIh3K2lmr/mnpj9d1xJrTtFvoqe0KId1nNLm0OJ36wTyuZpQ= Received: from totoro.tlrmx.org (115.89.2.81.in-addr.arpa [81.2.89.115]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) (Authenticated sender: njl@tlrmx.org) by pdx1-sub0-mail-a70.g.dreamhost.com (Postfix) with ESMTPSA id AAE1181D1B for ; Wed, 24 Jul 2019 14:53:38 -0700 (PDT) Date: Wed, 24 Jul 2019 22:53:34 +0100 X-DH-BACKEND: pdx1-sub0-mail-a70 From: Nick Lamb To: tls@ietf.org Message-ID: <20190724225334.226e31ba@totoro.tlrmx.org> X-Mailer: Claws Mail 3.17.3 (GTK+ 2.24.32; x86_64-redhat-linux-gnu) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Archived-At: X-Mailman-Approved-At: Sat, 27 Jul 2019 06:15:28 -0700 Subject: [TLS] =?utf-8?q?draft-camwinget-tls-use-cases-05__fix/remove_?= =?utf-8?b?wqcyLjIuMQ==?= X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jul 2019 21:53:48 -0000 Hi, My impression from watching Tuesday's session is that this probably can't end up as a Working Group document, but nevertheless people seem to keep looking at it and so it's worth fixing errors. Eric Rescorla touched on this I think briefly, but I want to be more forthright: Section 2.2.1 of the draft-camwinget-tls-use-cases-05 document says: In TLS 1.2, the ClientHello, ServerHello and Certificate messages are all sent in clear-text, however in TLS 1.3, the Certificate message is encrypted thereby hiding the server identity from any intermediary. But the contents of Certificate are merely public data, an adversary can arrange for a server under their control to present any certificate of their choosing, thereby in fact hiding the server identity from any intermediary under prior versions of TLS too. If this document is to continue in any form, even as an individual submission, it should be updated to either erase 2.2.1 altogether and any "use cases" that rely on it, or make clear that this technique couldn't actually work in TLS anyway and is mentioned only because some products erroneously rely on it. Nick. From nobody Sat Jul 27 06:27:49 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DDFAE12027A for ; Sat, 27 Jul 2019 06:27:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sn3rd.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lphqGoxYa-vZ for ; Sat, 27 Jul 2019 06:27:45 -0700 (PDT) Received: from mail-io1-xd2a.google.com (mail-io1-xd2a.google.com [IPv6:2607:f8b0:4864:20::d2a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6182512012A for ; Sat, 27 Jul 2019 06:27:45 -0700 (PDT) Received: by mail-io1-xd2a.google.com with SMTP id m24so110608792ioo.2 for ; Sat, 27 Jul 2019 06:27:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sn3rd.com; s=google; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=4EIlglWGSQ+TBXyrxEi38O9FXWLm26eIJO4qCWzK53I=; b=HzRBVmBh6CFgC6dzWKrr04nPdZA+TAVypjjrL+e3lrrWgvepKuCjzR0dAxY3GAChiC FJtxpqbO4vo3/+5KTWFJFGL3pd+qNKDCori+Im1o9SG060vh31mKE9LU83XutVWd4IIf Xxce0k6fVbBl8cIcGj5c1dLuLlmUjNs1YVweY= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=4EIlglWGSQ+TBXyrxEi38O9FXWLm26eIJO4qCWzK53I=; b=XagpAEpCwhZGEdwEc0WsTuWbQEo3K64VeIeHEgoXMYUOoq/1g9WBUSjvkjKnC2orKv ybnMP6SuCL0a3ZGs2R9yjcNzDc4bfhIW/ta36Cg6rBiErIxU0dWaejsU17sC2PLE8s46 YOYVWKvCZ8vy4qFj5GiUfNWdSWkIHKCSLFzO/XgbcVsXQ4Pe0zLqApO1Xw+vXy8FXNKz 0w/8NisxyahmqCYjQDEW65ZsB4QUvfbHCYwIHupdAfE0yxpdRAHxyt7z4qXZCbedXMdp JoY/f4d7j321H4ivufT/AOdHf6CoRFqPcj0xwrBu264PridFQzYyoaABZLZGdchRwqfV QThQ== X-Gm-Message-State: APjAAAX6oky4Eewvb1tciYdQ7TH3MCecH7GDr7RgQyt85OpziwxvwUmA MlMOPFpjghk+33Z2R8BTfLhHutILWrM= X-Google-Smtp-Source: APXvYqzPtLFDanUhX1+tbJ8kYGNslcsmk7Dp2AobgWQa618uggV4lUzo0QATz9siHS25OvJTV83stQ== X-Received: by 2002:a6b:730f:: with SMTP id e15mr90707517ioh.74.1564234064596; Sat, 27 Jul 2019 06:27:44 -0700 (PDT) Received: from ?IPv6:2001:67c:1232:144:c5a2:8e36:f361:8afe? ([2001:67c:1232:144:c5a2:8e36:f361:8afe]) by smtp.gmail.com with ESMTPSA id p3sm86867324iom.7.2019.07.27.06.27.43 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sat, 27 Jul 2019 06:27:43 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) From: Sean Turner In-Reply-To: <6AF48228-19C2-41C7-BA86-BA16940C3CFF@cisco.com> Date: Sat, 27 Jul 2019 09:27:42 -0400 Cc: draft-camwinget-tls-use-cases@ietf.org Content-Transfer-Encoding: quoted-printable Message-Id: <44772A15-9F10-4E03-A898-BFAB275043C3@sn3rd.com> References: <6AF48228-19C2-41C7-BA86-BA16940C3CFF@cisco.com> To: "tls@ietf.org" X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: [TLS] redirecting discussion (was Re: TLS Impact on Network Security draft updated) X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 27 Jul 2019 13:27:47 -0000 As draft-camwinget-tls-use-cases is not going to be considered within = the TLS WG, we need to move the discussions off of the TLS list. After = consultation with our AD, we are going to ask that further discussion be = directed to the authors either directly to the authors or through the = draft=E2=80=99s authors alias draft-camwinget-tls-use-cases@ietf.org. spt= From nobody Sun Jul 28 05:25:24 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 96CDB1200FB for ; Sun, 28 Jul 2019 05:25:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2cT_X__5Y3Nl for ; Sun, 28 Jul 2019 05:25:20 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 44D96120077 for ; Sun, 28 Jul 2019 05:25:19 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 9A374BE55 for ; Sun, 28 Jul 2019 13:25:17 +0100 (IST) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DYgRtuhAFAeW for ; Sun, 28 Jul 2019 13:25:16 +0100 (IST) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 18C72BE50 for ; Sun, 28 Jul 2019 13:25:16 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1564316716; bh=lDmAHD3mrIEG393PMF8/QPckxhBGy+scvp/FaHu7oA4=; h=To:From:Subject:Date:From; b=1qSDAxTbd3LYP1aRl4sdylxdqItnzZA4df9D0vEVTfmhBShx/A3/fcygvZ1VSGy8U O2WdIdyHd/NmTvbUXI6t9/6KsKTHlakmTidm2Elg1zoxUhIwHy84V79mMzhOExjm7l vHZVHI17RWliNtV37NwOzKwHwqHdjF2t6OvPbWdQ= To: "tls@ietf.org" From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <84f41a5a-b543-2fdb-8af0-b923dccd7693@cs.tcd.ie> Date: Sun, 28 Jul 2019 13:25:14 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="b1VBv8vHUQDnZ0FUHVFxOT2iFSb11CmZB" Archived-At: Subject: [TLS] ESNIKeys.public_name vs. cleartext SNI X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 28 Jul 2019 12:25:23 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --b1VBv8vHUQDnZ0FUHVFxOT2iFSb11CmZB Content-Type: multipart/mixed; boundary="mJNz3LbRWlhaGpnIoSbK7aqIv4qDgZMQP"; protected-headers="v1" From: Stephen Farrell To: "tls@ietf.org" Message-ID: <84f41a5a-b543-2fdb-8af0-b923dccd7693@cs.tcd.ie> Subject: ESNIKeys.public_name vs. cleartext SNI --mJNz3LbRWlhaGpnIoSbK7aqIv4qDgZMQP Content-Type: multipart/mixed; boundary="------------FB2C8388C43005CA33223D25" Content-Language: en-GB This is a multi-part message in MIME format. --------------FB2C8388C43005CA33223D25 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hiya, ESNI drafts -03 and -04 envisage that the ESNIKeys.public_name and the TLS h/s cleartext SNI are the same. I'd expect that they mostly will be. But they don't have to be. A client could provide a way to use a client-chosen cleartext SNI when using ESNI to encrypt the real SNI. For example, my openssl build allows this for s_client. I've a colleague who's got a first build of curl using that that also allows such a local over-ride. I think other command-line clients might be likely to also support that kind of thing, if for no other reason than the existence of the draft-02 version that's deployed and has no public_name. But I guess being able to do a local over-ride may also be generally useful, while not being so useful for web browsers. For example, if a given public_name value is being censored, clients might at that point want to use something else. On the server side, my code also make no checks that the cleartext SNI used was the same as the public_name. And I don't think that causes any problems, so maybe ought be allowed too. I don't think allowing this (if the WG decide to) requires any major change to the spec, but there are a couple of language changes needed in section 5.1.3 and I guess we should add a sentence to the effect that using the public_name value from ESNIKeys in the cleartext SNI is recommended if you've no other value but is not required. Cheers, S. --------------FB2C8388C43005CA33223D25 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------FB2C8388C43005CA33223D25-- --mJNz3LbRWlhaGpnIoSbK7aqIv4qDgZMQP-- --b1VBv8vHUQDnZ0FUHVFxOT2iFSb11CmZB Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAl09lCoACgkQWrL68XsX K+rboxAAoOB8IbzcF3eYS0SHdlB7KzKsQ0saKM9k6Zs1qq3Q/g2sP42HKDFyO1/+ haxiJDo3t5MMs8/E5E+vV7v+1nJhhQAX588sPPi3o/jVJETntJkYM1fQz1OM+8HX U7hbxE9VkSu16tpE/eaXMaIdA3WRPv7asgAfxqiOj2AbzL983GdkkqeY/TXCXvzS sTcole+lehyK/1EyXTX0qykeV6LdlYq65aXlLqS3k6F0VOWY/ciIwR7ZD3z6AVCI x5aFuGv2n066pvQgePTobVZzzsbGmvdfk7xJI5VDNTxdp0ozJi6vxhlNRwwvkEhe XlwwleCrD+YyNJ/pQlPff7VlJtxeUtHm0wjiOP70YrQmPtW9733fWHJ1tFaXvhIC XDaprb+O1n0SYJ47dUmJW8kQGGdVfRKdQHXp1gzksOMkjLVzew3p1YL3/6goLMsB d6PwADcDuseMQDXC6T6eQ97ZSMcNK0eWAd+fO/XIeEmIqQ9iP0FMzT1eKtyCuKnP SvvZxDeKlwNvjwuLPceYf1x18cHPVCwD/5NNB5NNtx9xfC0aTXdepi4ofs7csfIu H1dBR22IdE/tsr/N1KSNAAJtmmeUhuwv1ykFWhfZ7THf1HsrFO+QFn4krdnOiVNN Yqynyy5NMzdQT42AtO39R6ZWzc9Ni1fuOecNfjnA8SU5oj+5Y2g= =g8KU -----END PGP SIGNATURE----- --b1VBv8vHUQDnZ0FUHVFxOT2iFSb11CmZB-- From nobody Sun Jul 28 11:07:44 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AB6BE120094 for ; Sun, 28 Jul 2019 11:07:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 69pEUvzbXNAb for ; Sun, 28 Jul 2019 11:07:39 -0700 (PDT) Received: from mail-vs1-xe2c.google.com (mail-vs1-xe2c.google.com [IPv6:2607:f8b0:4864:20::e2c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 960CB12003E for ; Sun, 28 Jul 2019 11:07:39 -0700 (PDT) Received: by mail-vs1-xe2c.google.com with SMTP id 2so39281414vso.8 for ; Sun, 28 Jul 2019 11:07:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=GZLJTyuXINMPcRSwSsF3HfDa0PyENbWVhcWwLaB+Ds8=; b=UFtBoUl4eabuChTVrJ1UijGegSQ8Dnk8lgxlsreTgIrsixz8hHc+DpQDG1r/PFnAp4 LUyz+gHBBuKugAqJjwJ5T4Dwhr6l55RXzlHZsOvE1mcGTFtvR9FBQLrxaKGGm6xlLUnj Tl7GvYq42aT5thRHxs/VmUfK0C5mOIWBkZuIKq48qG0HpsaJHqXnDXFW2zqI6Fv4WK/P /9+dA9ZIuR1ddMESSm6/tIeNoiMYEY1kM6Fgr4/de6u+tqFwPhtI0AywG8PJg4dxAyK2 Csc0gAtnuPgiJpPXx/UeBwt4h7EtfVtD4hg9R803tGWq6QRac9nPNR0Daze8bD27XmFy TqjA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=GZLJTyuXINMPcRSwSsF3HfDa0PyENbWVhcWwLaB+Ds8=; b=Lq84xBzQ4cQJZK9rUNtLL7ui5aq0vm2H4KDJX5KSRcJ1467LwSMz68DvX5OW4nx+4c OE441K47thK5iTAqaO3TkMIE1sJ5f9ejWR7m2q/fIa2osxwO+j2GY1YMkhQ7pK3685bT 2tnatbZAiiqa/JJEsKoeicaC5TJtSYEhkyyCc26WWEC0fnvd/zwT6Hy2+CcQGSK35YE2 Rm8IS3VqDNefKkDueFgR20htD0+Onu2RY6gJ0+Lzr6gZ/7uRR2plPzHXwkKECBPwzWZA I1/NsGCZZM2MXadZOfqtBKp5pb2yZE6v76gNSD2GGClvxJ5kDxOMpIoBSdtAxKLGGrdF lx1Q== X-Gm-Message-State: APjAAAVz39qJ+eVR/5Y2xx46H3vAc+RY2gYc3SzNDxzwp/4CCmr/z2v2 ta0zl8YiNKMOeDlYiAGYENLHrxinaDKGC+bQRua2Wn30 X-Google-Smtp-Source: APXvYqyhUka7wcd6w4ZNOv+jvM/mIqYuF6y709BEOdLObgAiU5yAZFeuUY7MO6vX2bkcBrIeh9mpv2qVrypLvkhcyb4= X-Received: by 2002:a67:f618:: with SMTP id k24mr65965866vso.66.1564337258555; Sun, 28 Jul 2019 11:07:38 -0700 (PDT) MIME-Version: 1.0 References: <84f41a5a-b543-2fdb-8af0-b923dccd7693@cs.tcd.ie> In-Reply-To: <84f41a5a-b543-2fdb-8af0-b923dccd7693@cs.tcd.ie> From: Dmitry Belyavsky Date: Sun, 28 Jul 2019 21:07:26 +0300 Message-ID: To: Stephen Farrell Cc: TLS Mailing List Content-Type: multipart/alternative; boundary="0000000000009aedd0058ec1a677" Archived-At: Subject: Re: [TLS] ESNIKeys.public_name vs. cleartext SNI X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 28 Jul 2019 18:07:42 -0000 --0000000000009aedd0058ec1a677 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Dear Stephen, I published a draft describing "Fake SNI" designed for the same purpose. It allows (at least in theory) to cheat those who blocks all the handshakes containing ESNI. =D0=B2=D1=81, 28 =D0=B8=D1=8E=D0=BB=D1=8F 2019 =D0=B3., 15:25 Stephen Farre= ll : > > Hiya, > > ESNI drafts -03 and -04 envisage that the ESNIKeys.public_name > and the TLS h/s cleartext SNI are the same. I'd expect that > they mostly will be. > > But they don't have to be. A client could provide a way to > use a client-chosen cleartext SNI when using ESNI to encrypt > the real SNI. > > For example, my openssl build allows this for s_client. I've > a colleague who's got a first build of curl using that that > also allows such a local over-ride. I think other command-line > clients might be likely to also support that kind of thing, if > for no other reason than the existence of the draft-02 version > that's deployed and has no public_name. But I guess being able > to do a local over-ride may also be generally useful, while > not being so useful for web browsers. For example, if a given > public_name value is being censored, clients might at that > point want to use something else. > > On the server side, my code also make no checks that the > cleartext SNI used was the same as the public_name. And I > don't think that causes any problems, so maybe ought be > allowed too. > > I don't think allowing this (if the WG decide to) requires > any major change to the spec, but there are a couple of > language changes needed in section 5.1.3 and I guess we > should add a sentence to the effect that using the public_name > value from ESNIKeys in the cleartext SNI is recommended > if you've no other value but is not required. > > Cheers, > S. > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > --0000000000009aedd0058ec1a677 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Dear Stephen,

I published a draft describing "Fake SNI" designed for the same= purpose. It allows (at least in theory) to cheat those who blocks all the = handshakes containing ESNI.=C2=A0

=D0=B2=D1=81, 28 =D0=B8=D1=8E=D0=BB= =D1=8F 2019 =D0=B3., 15:25 Stephen Farrell <stephen.farrell@cs.tcd.ie>:

Hiya,

ESNI drafts -03 and -04 envisage that the ESNIKeys.public_name
and the TLS h/s cleartext SNI are the same. I'd expect that
they mostly will be.

But they don't have to be. A client could provide a way to
use a client-chosen cleartext SNI when using ESNI to encrypt
the real SNI.

For example, my openssl build allows this for s_client. I've
a colleague who's got a first build of curl using that that
also allows such a local over-ride. I think other command-line
clients might be likely to also support that kind of thing, if
for no other reason than the existence of the draft-02 version
that's deployed and has no public_name. But I guess being able
to do a local over-ride may also be generally useful, while
not being so useful for web browsers. For example, if a given
public_name value is being censored, clients might at that
point want to use something else.

On the server side, my code also make no checks that the
cleartext SNI used was the same as the public_name. And I
don't think that causes any problems, so maybe ought be
allowed too.

I don't think allowing this (if the WG decide to) requires
any major change to the spec, but there are a couple of
language changes needed in section 5.1.3 and I guess we
should add a sentence to the effect that using the public_name
value from ESNIKeys in the cleartext SNI is recommended
if you've no other value but is not required.

Cheers,
S.
_______________________________________________
TLS mailing list
TLS@ie= tf.org
https://www.ietf.org/mailman/listinfo/tls
--0000000000009aedd0058ec1a677-- From nobody Sun Jul 28 12:05:35 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 485D6120045 for ; Sun, 28 Jul 2019 12:05:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.299 X-Spam-Level: X-Spam-Status: No, score=-4.299 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rVK_bIEoQV-Y for ; Sun, 28 Jul 2019 12:05:29 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7DCF2120041 for ; Sun, 28 Jul 2019 12:05:29 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 08491BE47; Sun, 28 Jul 2019 20:05:28 +0100 (IST) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hSIk0KLSj1Fj; Sun, 28 Jul 2019 20:05:26 +0100 (IST) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 2DCAEBE39; Sun, 28 Jul 2019 20:05:26 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1564340726; bh=ZPf7cfnDH/b0NY4EYVoarsPgeG6D4K/YanjMbsazO7U=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=lZT1z2fEJLL89SNoBoBx1N/yBeOSOCGRW6IqP9vf9htGkKOhuFvf7oZExNO4C7vhQ rH/KoBRvoWTmkKx6mi47sh6rz+wI+pgO/IHGFlBGYkSIMYvvF5XjuKDjqX5fJcFE7j bP7UcLX/sLmDg0WUWSZq+mAL4PfqqIXUk9eX50Qo= To: Dmitry Belyavsky Cc: TLS Mailing List References: <84f41a5a-b543-2fdb-8af0-b923dccd7693@cs.tcd.ie> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <318921b4-4838-49e9-01f0-60e733360046@cs.tcd.ie> Date: Sun, 28 Jul 2019 20:05:25 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="KkFQKI2DIFUDZZTQ7RSEXhQyyhcdARZt0" Archived-At: Subject: Re: [TLS] ESNIKeys.public_name vs. cleartext SNI X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 28 Jul 2019 19:05:32 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --KkFQKI2DIFUDZZTQ7RSEXhQyyhcdARZt0 Content-Type: multipart/mixed; boundary="c0kgTiBfJYdErjYGTfTni8l8PEY0Efeqh"; protected-headers="v1" From: Stephen Farrell To: Dmitry Belyavsky Cc: TLS Mailing List Message-ID: <318921b4-4838-49e9-01f0-60e733360046@cs.tcd.ie> Subject: Re: [TLS] ESNIKeys.public_name vs. cleartext SNI References: <84f41a5a-b543-2fdb-8af0-b923dccd7693@cs.tcd.ie> In-Reply-To: --c0kgTiBfJYdErjYGTfTni8l8PEY0Efeqh Content-Type: multipart/mixed; boundary="------------8556E8EC9B9C33E0B8872CAC" Content-Language: en-GB This is a multi-part message in MIME format. --------------8556E8EC9B9C33E0B8872CAC Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hiya, On 28/07/2019 19:07, Dmitry Belyavsky wrote: > Dear Stephen, >=20 > I published a draft describing "Fake SNI" designed for the same purpose= =2E It > allows (at least in theory) to cheat those who blocks all the handshake= s > containing ESNI. Yes, I recall that. The question below was only really about draft-ietf-tls-esni-04 though. Cheers, S. >=20 > =D0=B2=D1=81, 28 =D0=B8=D1=8E=D0=BB=D1=8F 2019 =D0=B3., 15:25 Stephen F= arrell : >=20 >> >> Hiya, >> >> ESNI drafts -03 and -04 envisage that the ESNIKeyublic_name >> and the TLS h/s cleartext SNI are the same. I'd expect that >> they mostly will be. >> >> But they don't have to be. A client could provide a way to >> use a client-chosen cleartext SNI when using ESNI to encrypt >> the real SNI. >> >> For example, my openssl build allows this for s_client. I've >> a colleague who's got a first build of curl using that that >> also allows such a local over-ride. I think other command-line >> clients might be likely to also support that kind of thing, if >> for no other reason than the existence of the draft-02 version >> that's deployed and has no public_name. But I guess being able >> to do a local over-ride may also be generally useful, while >> not being so useful for web browsers. For example, if a given >> public_name value is being censored, clients might at that >> point want to use something else. >> >> On the server side, my code also make no checks that the >> cleartext SNI used was the same as the public_name. And I >> don't think that causes any problems, so maybe ought be >> allowed too. >> >> I don't think allowing this (if the WG decide to) requires >> any major change to the spec, but there are a couple of >> language changes needed in section 5.1.3 and I guess we >> should add a sentence to the effect that using the public_name >> value from ESNIKeys in the cleartext SNI is recommended >> if you've no other value but is not required. >> >> Cheers, >> S. >> _______________________________________________ >> TLS mailing list >> TLS@ietf.org >> https://www.ietf.org/mailman/listinfo/tls >> >=20 --------------8556E8EC9B9C33E0B8872CAC Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------8556E8EC9B9C33E0B8872CAC-- --c0kgTiBfJYdErjYGTfTni8l8PEY0Efeqh-- --KkFQKI2DIFUDZZTQ7RSEXhQyyhcdARZt0 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAl098fUACgkQWrL68XsX K+pbOg//RpknuB6ynocNjXlT8ncw9SAaxPq+tnovtSgisVxLrZ5rJvmdZsdZo70Q oy3e/dxl8p1GGmusaqWseoyWFY4XmIcvzzwtLPIwQQlGLYBo5hjFfM432Eo1/g+b 3LMzdpOkdoT8k1ocoNscFffUmm9foOCYLEDwfmX365si+jcKRfwnFU3Q77soXApU qar5RBbaTMcxMUfi17am7FxfHsmh9EKJsGzK/RlH1A7WKKbkMZk4F/5VFol/e87z RirmglNg66vLTkMoNFXe2J8bUnwXrV3Rg1dhcbn/YTRr4pkm27poYIqaZ94NVcHx SzpXmuSoJnxul7CTc7pInR3rcQPpEvD02NCvphugVZCivlh6Lpn6PbWR08V63a6s uyC/6GCqF+EcAC3h6rqkddW4Ak/2sKQwFhi5Dy3moOhAaThnNsA/VRufYEMk8jbk WdlFpiu5gbVLJ2oeXdsurXexwcSos+7V/L7YGdAUxmBGjunagFzU2xgb+K/3hJX+ B4RyLAKn9tYYt12TrdItm3C7D4dqtmZIoe0WUwTrEoLqXQX32tAgu1mUeNc9s7H6 MqXGyh5T9Z95jI6b6o/m0t4tTNPAaE2jFifKJVrIQMwcrhdoCLfrpp7F1owZrZ3p lkLJlTDfptxKOpRmIrUV+j4nuGmNFmJ1uF8ZyKDeoxDrhaTi1Us= =T4u4 -----END PGP SIGNATURE----- --KkFQKI2DIFUDZZTQ7RSEXhQyyhcdARZt0-- From nobody Sun Jul 28 17:44:00 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9A3E912004F for ; Sun, 28 Jul 2019 17:43:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.601 X-Spam-Level: X-Spam-Status: No, score=-2.601 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mV74kd2szjtS for ; Sun, 28 Jul 2019 17:43:57 -0700 (PDT) Received: from mx43-out1.antispamcloud.com (mx43-out1.antispamcloud.com [138.201.61.189]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D90B212003E for ; Sun, 28 Jul 2019 17:43:56 -0700 (PDT) Received: from xse156.mail2web.com ([66.113.196.156] helo=xse.mail2web.com) by mx62.antispamcloud.com with esmtp (Exim 4.89) (envelope-from ) id 1hrtla-0003Vb-L1 for tls@ietf.org; Mon, 29 Jul 2019 02:43:55 +0200 Received: from xsmtp21.mail2web.com (unknown [10.100.68.60]) by xse.mail2web.com (Postfix) with ESMTPS id 45xgcZ2Ch5z32Xk for ; Sun, 28 Jul 2019 17:32:14 -0700 (PDT) Received: from [10.5.2.16] (helo=xmail06.myhosting.com) by xsmtp21.mail2web.com with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.92) (envelope-from ) id 1hrtaI-0006VU-6S for tls@ietf.org; Sun, 28 Jul 2019 17:32:14 -0700 Received: (qmail 6268 invoked from network); 29 Jul 2019 00:32:13 -0000 Received: from unknown (HELO [192.168.1.103]) (Authenticated-user:_huitema@huitema.net@[172.56.38.95]) (envelope-sender ) by xmail06.myhosting.com (qmail-ldap-1.03) with ESMTPA for ; 29 Jul 2019 00:32:13 -0000 To: Stephen Farrell , "tls@ietf.org" References: <84f41a5a-b543-2fdb-8af0-b923dccd7693@cs.tcd.ie> From: Christian Huitema Openpgp: preference=signencrypt Autocrypt: addr=huitema@huitema.net; prefer-encrypt=mutual; keydata= mQENBFIRX8gBCAC26usy/Ya38IqaLBSu33vKD6hP5Yw390XsWLaAZTeQR64OJEkoOdXpvcOS HWfMIlD5s5+oHfLe8jjmErFAXYJ8yytPj1fD2OdSKAe1TccUBiOXT8wdVxSr5d0alExVv/LO I/vA2aU1TwOkVHKSapD7j8/HZBrqIWRrXUSj2f5n9tY2nJzG9KRzSG0giaJWBfUFiGb4lvsy IaCaIU0YpfkDDk6PtK5YYzuCeF0B+O7N9LhDu/foUUc4MNq4K3EKDPb2FL1Hrv0XHpkXeMRZ olpH8SUFUJbmi+zYRuUgcXgMZRmZFL1tu6z9h6gY4/KPyF9aYot6zG28Qk/BFQRtj7V1ABEB AAG0J0NocmlzdGlhbiBIdWl0ZW1hIDxodWl0ZW1hQGh1aXRlbWEubmV0PokBOQQTAQIAIwUC UhFfyAIbLwcLCQgHAwIBBhUIAgkKCwQWAgMBAh4BAheAAAoJEJNDCbJVyA1yhbYH/1ud6x6m VqGIp0JcZUfSQO8w+TjugqxCyGNn+w/6Qb5O/xENxNQ4HaMQ5uSRK9n8WKKDDRSzwZ4syKKf wbkfj05vgFxrjCynVbm1zs2X2aGXh+PxPL/WHUaxzEP7KjYbLtCUZDRzOOrm+0LMktngT/k3 6+EZoLEM52hwwpIAzJoscyEz7QfqMOZtFm6xQnlvDQeIrHx0KUvwo/vgDLK3SuruG1CSHcR0 D24kEEUa044AIUKBS3b0b8AR7f6mP2NcnLpdsibtpabi9BzqAidcY/EjTaoea46HXALk/eJd 6OLkLE6UQe1PPzQC4jB7rErX2BxnSkHDw50xMgLRcl5/b1a5AQ0EUhFfyAEIAKp7Cp8lqKTV CC9QiAf6QTIjW+lie5J44Ad++0k8gRgANZVWubQuCQ71gxDWLtxYfFkEXjG4TXV/MUtnOliG 5rc2E+ih6Dg61Y5PQakm9OwPIsOx+2R+iSW325ngln2UQrVPgloO83QiUoi7mBJPbcHlxkhZ bd3+EjFxSLIQogt29sTcg2oSh4oljUpz5niTt69IOfZx21kf29NfDE+Iw56gfrxI2ywZbu5o G+d0ZSp0lsovygpk4jK04fDTq0vxjEU5HjPcsXC4CSZdq5E2DrF4nOh1UHkHzeaXdYR2Bn1Y wTePfaHBFlvQzI+Li/Q6AD/uxbTM0vIcsUxrv3MNHCUAEQEAAYkCPgQYAQIACQUCUhFfyAIb LgEpCRCTQwmyVcgNcsBdIAQZAQIABgUCUhFfyAAKCRC22tOSFDh1UOlBB/94RsCJepNvmi/c YiNmMnm0mKb6vjv43OsHkqrrCqJSfo95KHyl5Up4JEp8tiJMyYT2mp4IsirZHxz/5lqkw9Az tcGAF3GlFsj++xTyD07DXlNeddwTKlqPRi/b8sppjtWur6Pm+wnAHp0mQ7GidhxHccFCl65w uT7S/ocb1MjrTgnAMiz+x87d48n1UJ7yIdI41Wpg2XFZiA9xPBiDuuoPwFj14/nK0elV5Dvq 4/HVgfurb4+fd74PV/CC/dmd7hg0ZRlgnB5rFUcFO7ywb7/TvICIIaLWcI42OJDSZjZ/MAzz BeXm263lHh+kFxkh2LxEHnQGHCHGpTYyi4Z3dv03HtkH/1SI8joQMQq00Bv+RdEbJXfEExrT u4gtdZAihwvy97OPA2nCdTAHm/phkzryMeOaOztI4PS8u2Ce5lUB6P/HcGtK/038KdX5MYST Fn8KUDt4o29bkv0CUXwDzS3oTzPNtGdryBkRMc9b+yn9+AdwFEH4auhiTQXPMnl0+G3nhKr7 jvzVFJCRif3OAhEm4vmBNDE3uuaXFQnbK56GJrnqVN+KX5Z3M7X3fA8UcVCGOEHXRP/aubiw Ngawj0V9x+43kUapFp+nF69R53UI65YtJ95ec4PTO/Edvap8h1UbdEOc4+TiYwY1TBuIKltY 1cnrjgAWUh/Ucvr++/KbD9tD6C8= Message-ID: <05501e58-6d97-c2b6-6e76-bc4c3b2f4579@huitema.net> Date: Sun, 28 Jul 2019 17:32:00 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: <84f41a5a-b543-2fdb-8af0-b923dccd7693@cs.tcd.ie> Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="SEsL8MPCqC1HRgvTrmH6isBS38Qh6EuA2" X-Originating-IP: 66.113.196.156 X-Spampanel-Domain: xsmtpout.mail2web.com X-Spampanel-Username: 66.113.196.156/32 Authentication-Results: antispamcloud.com; auth=pass smtp.auth=66.113.196.156/32@xsmtpout.mail2web.com X-Spampanel-Outgoing-Class: unsure X-Spampanel-Outgoing-Evidence: Combined (0.15) X-Recommended-Action: accept X-Filter-ID: Mvzo4OR0dZXEDF/gcnlw0STiPCilqAig5bem4hJMKBmpSDasLI4SayDByyq9LIhVUZbR67CQ7/vm /hHDJU4RXkTNWdUk1Ol2OGx3IfrIJKywOmJyM1qr8uRnWBrbSAGDoOWO0i/H75teRGzF9TgV+efH zJ6mVE7ewsipSVIfs4biXaF3EpvjDGrTTQzQdj36gyWFxOA5dILPypvKxNVhWQwOVcNrdpWfEYrY fLBY3+e8hb1lxHddBtWcfnl7xl+wmdySlZou9qHIGOZDEEo7O2nS6C1mWTD2n8BB0gTSSfDtw+Ut ziY+nbU7qa50sEXj8hEv6ylbrSataIASdByf+qyWDcKgIew/Pqmv8CiR0A+Ffy7fEg460Hn2xYnW avStyzAiWbbj13U46jbWFIz21cHX/YzWyFk7762whX3QQ+5uhkPm88V7ziklAaTl19sU919xeAvO xjeQEcL5lNmXdGd9U9Oojh2QY0MMPWjRsTVhMmX9VvKuj6psZloQqgYBwH0r+197ykuYmDR9wbL2 DBEuqNMl4E+tMKMsv/A3u4xFRxF9LSHNsZFl22lrRRn/H0knlMgOQTVp+x1fo2EPmz5tsQu9R3vp aAMkTA7gTKoJngF7rJQgeWTjF5V/EGvRxRajR0YsmQLbkjh+XPtp2xO8u0ag4+i9kLOW9cRnakej RNBr7jDwr0sAl4gUSJEki/jsU5ildGCaI63SvQizCpq7xqDoiTjjGpNS1XGXbXKoKVG8QfD0FbAY dB+AJQ4DAztqzrCt4TZ/wLtujY/tpcO3rEhC6hy6qW9LXGyYHMwU/75QBEhYYdlOvzV2F8hHPAlb DjazCbhs7qBpykynMha5/rijjcguRYfyvX/qs6Br1HXtUZgvqUTL5xpxMJrF83g9ueTJOU6a76yp yxjdeg8YhWenlMfuvb1mNY5/IPiuedK/Z3MvnAyDmuOaA5CGZRWsGw8ac2InzcAP/gmxwNpms+rB 6wJM+NNhN3aT35NSU/fjw6KbqLw80r1gDO3m6U0LjBzYuQztdAThgtWSU3qCINKqlAdh+ePAcEwD s/8= X-Report-Abuse-To: spam@quarantine9.antispamcloud.com Archived-At: Subject: Re: [TLS] ESNIKeys.public_name vs. cleartext SNI X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 29 Jul 2019 00:43:59 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --SEsL8MPCqC1HRgvTrmH6isBS38Qh6EuA2 Content-Type: multipart/mixed; boundary="UYKfXy6916dTeI1LqEueci4zz1XTM1qff"; protected-headers="v1" From: Christian Huitema To: Stephen Farrell , "tls@ietf.org" Message-ID: <05501e58-6d97-c2b6-6e76-bc4c3b2f4579@huitema.net> Subject: Re: ESNIKeys.public_name vs. cleartext SNI References: <84f41a5a-b543-2fdb-8af0-b923dccd7693@cs.tcd.ie> In-Reply-To: <84f41a5a-b543-2fdb-8af0-b923dccd7693@cs.tcd.ie> --UYKfXy6916dTeI1LqEueci4zz1XTM1qff Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Content-Language: en-US On 7/28/2019 5:25 AM, Stephen Farrell wrote: > For example, my openssl build allows this for s_client. I've > a colleague who's got a first build of curl using that that > also allows such a local over-ride. I think other command-line > clients might be likely to also support that kind of thing, if > for no other reason than the existence of the draft-02 version > that's deployed and has no public_name. But I guess being able > to do a local over-ride may also be generally useful, while > not being so useful for web browsers. For example, if a given > public_name value is being censored, clients might at that > point want to use something else. I see the intent, but I am not sure it is practical. A lot of the HTTP connection establishment is automated. Given a server name, the client will do a lookup for the ESNI record or a cached value. If there is one, the simple solution is to put the public name in the SNI extension and the actual name in the ESNI extension. If the public name is censored, the solution is probably to look for a different ESNI record for the server, one that would mention a different public name. By the way, I think that the current ESNI record is maybe a little too complicated. The ESNI key is really a property of the public server, yet the ESNI record is defined as a property of the hidden server. If the public server rolls a new key, all the ESNI records of all the hidden servers that mentioned the old key need to be updated. I think it would be simpler to have the ESNI record as a property of the public server, and to just have a pointer to the public server in the context of the hidden server. May an SRV record. The chain would be something like: 1) Look up whether the SRV record for _esni._tcp.hidden.example.com 2) If there are such records, select the appropriate public server, say public.example.net 3) Look up ESNI, A, AAAA for public.example.net In that architecture, there is no need to encode the public server name in the ESNI record. I think there will be several advantages. The ESNI record's TTL can be set to the lifetime of the key. The SRV record's TTL can be set to the expected lifetime of the relation between 'hidden" and "public". If the SRV lifetime is long enough, the value can be efficiently cached by the client. If multiple clients share the same hidden server, the ESNI record is fetched only once, and can be cached. At connection time, the client would only need to query the A/AAAA records of the public server, i.e. exactly the same DNS transaction as an access to the public server. -- Christian Huitema --UYKfXy6916dTeI1LqEueci4zz1XTM1qff-- --SEsL8MPCqC1HRgvTrmH6isBS38Qh6EuA2 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQEcBAEBCAAGBQJdPj6PAAoJELba05IUOHVQcrsH/3eaFqrcvyfHUNvcIjeqHsl/ EGQKaZj+06hWQWcF2+OgIyK6z4oUUFD+z6Bep+yQAIfnIfunx2NEH3d6g++LXqFT H4/uzsX0ugK32ELGFCVwboDfdfSLx/Hd8ewzH5V1bjTYP1fcfOYus9Ue0S30J9R8 HUatvhHmQIv7+anIxx9GdbWw59qUWHi01O+3KRBSPl9TLR4+bQnxR5/vznucucDd RlgjNXY3xkYw/UMXHmRmn9JQ0EiVZFbl55/uEODfFQT2DBB/BWfYXFwKedvU4GOS 1G5XW0JR/vhC6OKK1MZPa5zl2BOKOg85ByX8aRalJomeM2HfbFHRq1iSuB0bESw= =QQcg -----END PGP SIGNATURE----- --SEsL8MPCqC1HRgvTrmH6isBS38Qh6EuA2-- From nobody Mon Jul 29 04:12:26 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 68B15120120 for ; Mon, 29 Jul 2019 04:12:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id s_XxS-FDLBzu for ; Mon, 29 Jul 2019 04:12:21 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 81FE11200FF for ; Mon, 29 Jul 2019 04:12:21 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 334AEBE2E; Mon, 29 Jul 2019 12:12:19 +0100 (IST) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1TBlAgdz4gtn; Mon, 29 Jul 2019 12:12:17 +0100 (IST) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 75716BE24; Mon, 29 Jul 2019 12:12:17 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1564398737; bh=0UCQeEmc5NeDNek4o7nACZWabqdz6yBaQp3gawzAz4E=; h=Subject:To:References:From:Date:In-Reply-To:From; b=vVk7jlGgWub1Ekh4ST2S4IzgBMAZHqKIv51KE53NSLeImxiym6XlFztqONR18u6Pb kLFu8tZCt+f/qcHts44vqkxb3Xs9npQMNzggxMAIVh73D2eE8KJ8UGBefrtAPe7N/b KDeLoSS+NbLX0JkiVA6Au4tYM4kZWpNgz0ye7tH0= To: Christian Huitema , "tls@ietf.org" References: <84f41a5a-b543-2fdb-8af0-b923dccd7693@cs.tcd.ie> <05501e58-6d97-c2b6-6e76-bc4c3b2f4579@huitema.net> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <2997ba60-6d01-5440-cd3d-66651443253d@cs.tcd.ie> Date: Mon, 29 Jul 2019 12:12:16 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: <05501e58-6d97-c2b6-6e76-bc4c3b2f4579@huitema.net> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="ngT9GBlM2dLxq4Zqgd3LV5AMgWZpFXrZi" Archived-At: Subject: Re: [TLS] ESNIKeys.public_name vs. cleartext SNI X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 29 Jul 2019 11:12:25 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --ngT9GBlM2dLxq4Zqgd3LV5AMgWZpFXrZi Content-Type: multipart/mixed; boundary="HiispgYbkPu0MOBuebiOGzlCBomxT8fSm"; protected-headers="v1" From: Stephen Farrell To: Christian Huitema , "tls@ietf.org" Message-ID: <2997ba60-6d01-5440-cd3d-66651443253d@cs.tcd.ie> Subject: Re: ESNIKeys.public_name vs. cleartext SNI References: <84f41a5a-b543-2fdb-8af0-b923dccd7693@cs.tcd.ie> <05501e58-6d97-c2b6-6e76-bc4c3b2f4579@huitema.net> In-Reply-To: <05501e58-6d97-c2b6-6e76-bc4c3b2f4579@huitema.net> --HiispgYbkPu0MOBuebiOGzlCBomxT8fSm Content-Type: multipart/mixed; boundary="------------F423044975D789CD5C5FFEE0" Content-Language: en-GB This is a multi-part message in MIME format. --------------F423044975D789CD5C5FFEE0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hiya, On 29/07/2019 01:32, Christian Huitema wrote: >=20 > On 7/28/2019 5:25 AM, Stephen Farrell wrote: >> For example, my openssl build allows this for s_client. I've >> a colleague who's got a first build of curl using that that >> also allows such a local over-ride. I think other command-line >> clients might be likely to also support that kind of thing, if >> for no other reason than the existence of the draft-02 version >> that's deployed and has no public_name. But I guess being able >> to do a local over-ride may also be generally useful, while >> not being so useful for web browsers. For example, if a given >> public_name value is being censored, clients might at that >> point want to use something else. >=20 > I see the intent, but I am not sure it is practical.=20 In which case I must've explained it badly, because it's entirely practical:-) Let me try again... What I'm asking is that we not insist that the cleartext SNI is the ESNIKeys.public_name even though those will be the same value in almost all cases. I don't think there's any major security benefit to insisting that they be the same and there are cases where e.g. a command line tool like curl or wget can easily supply a different cleartext SNI value as an override, should that ever be needed or useful. > A lot of the HTTP > connection establishment is automated. Given a server name, the client > will do a lookup for the ESNI record or a cached value. If there is one= , > the simple solution is to put the public name in the SNI extension and > the actual name in the ESNI extension.=20 Sure, I know that and am fine with it being the default. > If the public name is censored, > the solution is probably to look for a different ESNI record for the > server, one that would mention a different public name. If the public_name is censored, then there may be >1 solution needed, so allowing for more than one seems better than assuming there is one and only one solution in that circumstance. >=20 > By the way, I think that the current ESNI record is maybe a little too > complicated. The ESNI key is really a property of the public server, ye= t > the ESNI record is defined as a property of the hidden server. If the > public server rolls a new key, all the ESNI records of all the hidden > servers that mentioned the old key need to be updated. I think it would= > be simpler to have the ESNI record as a property of the public server, > and to just have a pointer to the public server in the context of the > hidden server. May an SRV record. The chain would be something like: >=20 > 1) Look up whether the SRV record for _esni._tcp.hidden.example.com >=20 > 2) If there are such records, select the appropriate public server, say= > public.example.net >=20 > 3) Look up ESNI, A, AAAA for public.example.net >=20 > In that architecture, there is no need to encode the public server name= > in the ESNI record. I think there will be several advantages. The ESNI > record's TTL can be set to the lifetime of the key. The SRV record's TT= L > can be set to the expected lifetime of the relation between 'hidden" an= d > "public". If the SRV lifetime is long enough, the value can be > efficiently cached by the client. If multiple clients share the same > hidden server, the ESNI record is fetched only once, and can be cached.= > At connection time, the client would only need to query the A/AAAA > records of the public server, i.e. exactly the same DNS transaction as > an access to the public server. That seems a bit like the HTTPSSRV proposal and maybe better in a different thread? S. >=20 > -- Christian Huitema >=20 >=20 >=20 >=20 --------------F423044975D789CD5C5FFEE0 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------F423044975D789CD5C5FFEE0-- --HiispgYbkPu0MOBuebiOGzlCBomxT8fSm-- --ngT9GBlM2dLxq4Zqgd3LV5AMgWZpFXrZi Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAl0+1JAACgkQWrL68XsX K+rlXQ//c1X4oAsAlgzUgCRt0MipH5Xpb1I94msS3qzIZaJ4K09hyk+OJXucic+D 5mBXcd3mNa0GO6nYHkWL0VbEZxSXlOrFZgV0nXfIfplCUDBhXON8WPzQFZWaFoVO 6HyIjaUOXT7psiATf7/WcxSIX/WjqjbVU/uKNgWFgCOb9pmMdNirz0osX3DrOL2z ie1KLmExecv1Jiux+rmL8BKjN7TI7anpF9Y9EKEQ+vAoPESfrijATyC7tzGrnObk CEWjbA/h0NxSx0r5FiWIgGP3+Bvac3+cMfzvvculZf5VfpIpqNecpICYeaVHRnWF SyqkGkkXbhf7HcZaA1Y46kXi+JOgUeDaIdlEDNV4fZCxFBxmjcyMU5rFvlZEldpW MrpSjh/Veyzk+9CHYiiPi4ueYBfoCgm66N0xL7cgaAswtPKQ2VwoGBubqGIMGDmh SQJ9WZRXcRTmd+4yBsT0Wuiblg71D/RayIM1WLVxGggX4i26uIwTVmbRqEy6s8Rq cHDYUKON4bXnIn5tHAaeH0sp/QNNpRpvLnKzVsVkwa31u8RbN8bxI0NuEj/K4DKk OI577IFmHX6bsB9Wv0BgU2OBiEClkV5jIJEJPukrzIT9xVEFi7yJKfDmgqYaKv+f 1QzpPRmyGulCvipMUfo13octqxws66wufeYvR7ddzxeeO796jok= =XXy3 -----END PGP SIGNATURE----- --ngT9GBlM2dLxq4Zqgd3LV5AMgWZpFXrZi-- From nobody Mon Jul 29 05:10:41 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5646212019C for ; Mon, 29 Jul 2019 05:10:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1NXXDj6vearL for ; Mon, 29 Jul 2019 05:10:37 -0700 (PDT) Received: from mail-lf1-x135.google.com (mail-lf1-x135.google.com [IPv6:2a00:1450:4864:20::135]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C1EE71200F8 for ; Mon, 29 Jul 2019 05:10:36 -0700 (PDT) Received: by mail-lf1-x135.google.com with SMTP id z15so37601973lfh.13 for ; Mon, 29 Jul 2019 05:10:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=Ec6mgJZmBPTPgayy1M/t9zsdGaTtTjffJUEmWMTxnlg=; b=udcO1hQgb1APsb2lfhU83UX92ZNaV2chlNjxa7eYrPUVVYbD5ba5fDxmWZt725AlKC m1Pt0aGjz5CoQ+X/qvJptdv0E32ZSB5jVqClTwaOQVhE3BNlYrcOwd5pSKGLSkiKI8R5 0omDoT3hVw8xFpmQcdGwalaxaj5q0r3XJOHyEqIRSmYOOb5DVYx5YfaFQRh0xsjkdFOr JIFFfNBgiNmaoRzOYKjkuxstv8hUGBDbThiXT5P/27XZJh/wiGYfKHGgYwNjU349tFdK 8f4n+Q54Pn6uKHFnCD6t7XdIE/HAogEgnCBYDm0vA/RSqDQ6tmo+3KT9uDf7Y6z/ECfJ dNTQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=Ec6mgJZmBPTPgayy1M/t9zsdGaTtTjffJUEmWMTxnlg=; b=ZkclpqnQuMD+HuVdpFdHlQZAnFFtU24WBsd5moSR6lBrbLF4+k3inTfaF7ne0lOLxR R92TNuWOxe42OMyYPdNwc7j/9oJP1A8WW8ZylYE87GXWaBjML63N89AgqElGBHZEdm/e vKf99aJlCnRaVp7b1a2jItTzw1J7KzPa49HyeNdojVJLcpDFtrjHAW4iUNfFJqW7FVC9 voMAkcryUdMkCADZG74uHGMOcOrHMiDECQ/bM+cKybhAOrUNOyMXOvt5tiwuIUf/My/U snWOqFaRdLSZnlZwjGK8RUvWT2+M1PaVGDl8Ovu644eqn9wsHbIXbhOIGmiBmrBze+US EL/w== X-Gm-Message-State: APjAAAU2CO8Pp8n6WgoJDeVIY1eTA+ZWrHrU/LKUaOJnugk5O/rT1+Z3 vJbOi0E96oynSCT/BXe+K3q3S3+bsGSPJ5OPcuvzOQ== X-Google-Smtp-Source: APXvYqylEV3AfUb6xLxngRbNx/YP/8UJY8vfOsC/KR8uWYHLwQ99TR2Iw/0D66YxEGXX/NvfB62LOYeP9SAl7fhcyAQ= X-Received: by 2002:ac2:528e:: with SMTP id q14mr6637797lfm.17.1564402235015; Mon, 29 Jul 2019 05:10:35 -0700 (PDT) MIME-Version: 1.0 References: <1772330A-AEE4-4510-A261-F2D5AF9762DD@arm.com> In-Reply-To: <1772330A-AEE4-4510-A261-F2D5AF9762DD@arm.com> From: Eric Rescorla Date: Mon, 29 Jul 2019 05:09:43 -0700 Message-ID: To: Thomas Fossati Cc: "TLS@ietf.org" Content-Type: multipart/alternative; boundary="0000000000008114f1058ed0c756" Archived-At: Subject: Re: [TLS] cTLS transport question X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 29 Jul 2019 12:10:39 -0000 --0000000000008114f1058ed0c756 Content-Type: text/plain; charset="UTF-8" On Thu, Jul 25, 2019 at 9:04 AM Thomas Fossati wrote: > Thanks for presenting this work. I really like this and I think > > it'd be really useful for the use cases we have (IoT, M2M). > > > > One comment: from a quick skimming of the draft, I'm not sure I > > understand what the stated expectations on the transport layer are? > > > > Since it's cTLS and not cDTLS I'd have thought it's the same as TLS > > (in-order & reliable) but then I got confused reading section 3.2 [1]: > > > > "The CTLS Record Layer assumes that records are externally framed > > (i.e., that the length is already known because it is carried in > > a UDP datagram or the like)" > > > > On Jabber Ben suggested that one could put CoAP between UDP and cTLS to > > get in-order & reliable delivery with a datagram transport, but then I'm > > not sure what the advantage would be since we'd be trading 2 bytes of > > TLSPlaintext.length with 4 bytes (minimum) of CoAP header? > The idea here was that you might be in a situation where you had external framing anyway. I'm sure we can figure out some way to make that optional. -Ekr > > From the Jabber discussion, my current understanding is that there are 2 > > assumptions: a) the transport is in-order & reliable, and 2) there is > > one TLS record per transport layer packet. > > > > Is that the correct interpretation? If it is, is it not too restrictive > > a requirement? > > > > Cheers, thanks > > > > [1] https://tools.ietf.org/html/draft-rescorla-tls-ctls-02#section-3.2 > > > > > IMPORTANT NOTICE: The contents of this email and any attachments are > confidential and may also be privileged. If you are not the intended > recipient, please notify the sender immediately and do not disclose the > contents to any other person, use it for any purpose, or store or copy the > information in any medium. Thank you. > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > --0000000000008114f1058ed0c756 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Thu, Jul 25, 2019 at 9:04 AM Thoma= s Fossati <Thomas.Fossati@arm.= com> wrote:

Thanks for presenting= this work.=C2=A0 I really like this and I think

it'd be really us= eful for the use cases we have (IoT, M2M).

=C2=A0<= /span>

One comment: from a q= uick skimming of the draft, I'm not sure I

understand what the s= tated expectations on the transport layer are?

=C2=A0<= /span>

Since it's cTLS a= nd not cDTLS I'd have thought it's the same as TLS

(in-order & relia= ble) but then I got confused reading section 3.2 [1]:<= /p>

=C2=A0<= /span>

=C2=A0 "The CTLS= Record Layer assumes that records are externally framed

=C2=A0=C2=A0 (i.e., t= hat the length is already known because it is carried in

=C2=A0=C2=A0 a UDP da= tagram or the like)"

=C2=A0<= /span>

On Jabber Ben suggest= ed that one could put CoAP between UDP and cTLS to

get in-order & re= liable delivery with a datagram transport, but then I'm

not sure what the adv= antage would be since we'd be trading 2 bytes of

TLSPlaintext.length w= ith 4 bytes (minimum) of CoAP header?


The idea here was that you might be in a situation where = you had external framing
anyway. I'm sure we can figure out s= ome way to make that optional.

-Ekr

=

=C2=A0

From the Jabber discu= ssion, my current understanding is that there are 2

assumptions: a) the t= ransport is in-order & reliable, and 2) there is

one TLS record per tr= ansport layer packet.

=C2=A0<= /span>

Is that the correct i= nterpretation?=C2=A0 If it is, is it not too restrictive

a requirement?=


=C2=A0

=C2=A0<= /span>

Cheers, thanks=

=C2=A0<= /span>

[1] https://tools.ietf.org/html/draft-rescorla-tls-ctls-02#section-3.2

=C2=A0<= /span>

=C2=A0<= /span>

IMPORTANT NOTICE: The contents of this email and any attachments are confid= ential and may also be privileged. If you are not the intended recipient, p= lease notify the sender immediately and do not disclose the contents to any= other person, use it for any purpose, or store or copy the information in any medium. Thank you.
_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls
--0000000000008114f1058ed0c756-- From nobody Mon Jul 29 06:35:37 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 670A7120124 for ; Mon, 29 Jul 2019 06:35:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.5 X-Spam-Level: X-Spam-Status: No, score=-17.5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UpYIsFoqSZ4i for ; Mon, 29 Jul 2019 06:35:34 -0700 (PDT) Received: from mail-io1-xd36.google.com (mail-io1-xd36.google.com [IPv6:2607:f8b0:4864:20::d36]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6F8271200F8 for ; Mon, 29 Jul 2019 06:35:34 -0700 (PDT) Received: by mail-io1-xd36.google.com with SMTP id s7so119858019iob.11 for ; Mon, 29 Jul 2019 06:35:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=wwE2c/cEMP1Q1TnWW5bUERC/+sk5tol7F6ZeIhJr2ro=; b=WngTa0TLnXk3CbOEPKlZzwl6pvfBPJFqkNR6f+svwvDRXynik0AuSOzKuVBndteflQ vPctNCZwf2kSQQ9p6nYdf+4yVG04ynuhYyx7gwMLqQd9s6PhteyRygTqrcAcWS2lULdn gTbHNx2U9A4hj3AJGy3HIHmzHMzJWuIFBbv8rDS+WgwV+9GUJKFVe6ORM8V3hu6HW8u3 1C4NR77m9mw90ZzO0q8B7OQSgJ8M3vXHBx4hF6fR0zt3Sqk3X+ZOAA2ZcgcdgSFZiGjk ++lTsOTJ25OYkzXI+dyKlfa+urbD4jJccxuMUZ82qwGTVVFLZJKeInU6i+v7osUnD7Il RR6A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=wwE2c/cEMP1Q1TnWW5bUERC/+sk5tol7F6ZeIhJr2ro=; b=KvEWq+eodnKCJF2BfpcsP9xLzAiu0plugYcLzI5O11kW9IPSYWt9tD351/Hw5Ls06p 7MDjjAudFlQ1rLRF5/NlsH1DItgOeY/J7kzaKJqOQmDIQ3DIKc7T1opXwMiKFsXaNG4f hyO2RzmSgRo1FKQBR8AgzGlzM+9cVpELR2emNMyPMiO1uNveKYzHucO2eOAg4FrQTIa3 0tUpyAajuXUouCN8W1I7Sq1tOBAm41AvfXzgh8a0s7zvwB0YPcWuzv5q5LeurAfW7x3H d+DeypNmH96+Oa+Nxh5wp9J9qyB7pch4X0QwyKwsC+OaC/x/rgMDE+uL1o616N9CaT0u 6VQQ== X-Gm-Message-State: APjAAAW0/ZSExezaLdUJQxqCyckzACjZwWLPXkrdJ4qtJfpf8WcyLUZh BtsUt9+I3Ke50gXJCpObKGnVcmsI1pTxj5HdFVoeE973Ctg= X-Google-Smtp-Source: APXvYqzmo/6QKDx96gU3W5xgcDM6ruB0f3UDEN/OeLM3P2z8X8F+Ryq4y88GHfOn52pD6XMKG9+Jyn8v7CugQsNL4KU= X-Received: by 2002:a6b:ed09:: with SMTP id n9mr30430395iog.153.1564407333327; Mon, 29 Jul 2019 06:35:33 -0700 (PDT) MIME-Version: 1.0 References: <84f41a5a-b543-2fdb-8af0-b923dccd7693@cs.tcd.ie> <05501e58-6d97-c2b6-6e76-bc4c3b2f4579@huitema.net> <2997ba60-6d01-5440-cd3d-66651443253d@cs.tcd.ie> In-Reply-To: <2997ba60-6d01-5440-cd3d-66651443253d@cs.tcd.ie> From: Ben Schwartz Date: Mon, 29 Jul 2019 09:35:21 -0400 Message-ID: To: Stephen Farrell Cc: Christian Huitema , "tls@ietf.org" Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="0000000000006d7350058ed1f798" Archived-At: Subject: Re: [TLS] ESNIKeys.public_name vs. cleartext SNI X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 29 Jul 2019 13:35:36 -0000 --0000000000006d7350058ed1f798 Content-Type: multipart/alternative; boundary="000000000000639dfc058ed1f7f9" --000000000000639dfc058ed1f7f9 Content-Type: text/plain; charset="UTF-8" On Mon, Jul 29, 2019 at 7:12 AM Stephen Farrell wrote: > > Hiya, > > On 29/07/2019 01:32, Christian Huitema wrote: > > > > On 7/28/2019 5:25 AM, Stephen Farrell wrote: > >> For example, my openssl build allows this for s_client. I've > >> a colleague who's got a first build of curl using that that > >> also allows such a local over-ride. I think other command-line > >> clients might be likely to also support that kind of thing, if > >> for no other reason than the existence of the draft-02 version > >> that's deployed and has no public_name. But I guess being able > >> to do a local over-ride may also be generally useful, while > >> not being so useful for web browsers. For example, if a given > >> public_name value is being censored, clients might at that > >> point want to use something else. > > > > I see the intent, but I am not sure it is practical. > > In which case I must've explained it badly, because it's > entirely practical:-) Let me try again... > > What I'm asking is that we not insist that the cleartext > SNI is the ESNIKeys.public_name even though those will be > the same value in almost all cases. > > I don't think there's any major security benefit to insisting > that they be the same and there are cases where e.g. a command > line tool like curl or wget can easily supply a different > cleartext SNI value as an override, should that ever be needed > or useful. > It sounds like you are arguing for replacing a MUST with a SHOULD. I think our best option is probably to clarify who is supposed to do what, and why. For example, we could say that a compliant client MUST set sni = public_name so that fallback can work on servers with multiple public names, but the server MAY accept connections with missing or unrecognized SNI to enable connections from non-compliant clients that prefer not to include the public_name. > A lot of the HTTP > > connection establishment is automated. Given a server name, the client > > will do a lookup for the ESNI record or a cached value. If there is one, > > the simple solution is to put the public name in the SNI extension and > > the actual name in the ESNI extension. > > Sure, I know that and am fine with it being the default. > > > If the public name is censored, > > the solution is probably to look for a different ESNI record for the > > server, one that would mention a different public name. > > If the public_name is censored, then there may be >1 solution > needed, so allowing for more than one seems better than assuming > there is one and only one solution in that circumstance. > > > > > By the way, I think that the current ESNI record is maybe a little too > > complicated. The ESNI key is really a property of the public server, yet > > the ESNI record is defined as a property of the hidden server. If the > > public server rolls a new key, all the ESNI records of all the hidden > > servers that mentioned the old key need to be updated. I think it would > > be simpler to have the ESNI record as a property of the public server, > > and to just have a pointer to the public server in the context of the > > hidden server. May an SRV record. The chain would be something like: > > > > 1) Look up whether the SRV record for _esni._tcp.hidden.example.com > > > > 2) If there are such records, select the appropriate public server, say > > public.example.net > > > > 3) Look up ESNI, A, AAAA for public.example.net > > > > In that architecture, there is no need to encode the public server name > > in the ESNI record. I think there will be several advantages. The ESNI > > record's TTL can be set to the lifetime of the key. The SRV record's TTL > > can be set to the expected lifetime of the relation between 'hidden" and > > "public". If the SRV lifetime is long enough, the value can be > > efficiently cached by the client. If multiple clients share the same > > hidden server, the ESNI record is fetched only once, and can be cached. > > At connection time, the client would only need to query the A/AAAA > > records of the public server, i.e. exactly the same DNS transaction as > > an access to the public server. > > That seems a bit like the HTTPSSRV proposal and maybe better in > a different thread? > > S. > > > > > > -- Christian Huitema > > > > > > > > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > --000000000000639dfc058ed1f7f9 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Mon, Jul 29, 2019 at 7:12 AM Steph= en Farrell <stephen.farrell= @cs.tcd.ie> wrote:

Hiya,

On 29/07/2019 01:32, Christian Huitema wrote:
>
> On 7/28/2019 5:25 AM, Stephen Farrell wrote:
>> For example, my openssl build allows this for s_client. I've >> a colleague who's got a first build of curl using that that >> also allows such a local over-ride. I think other command-line
>> clients might be likely to also support that kind of thing, if
>> for no other reason than the existence of the draft-02 version
>> that's deployed and has no public_name. But I guess being able=
>> to do a local over-ride may also be generally useful, while
>> not being so useful for web browsers. For example, if a given
>> public_name value is being censored, clients might at that
>> point want to use something else.
>
> I see the intent, but I am not sure it is practical.

In which case I must've explained it badly, because it's
entirely practical:-) Let me try again...

What I'm asking is that we not insist that the cleartext
SNI is the ESNIKeys.public_name even though those will be
the same value in almost all cases.

I don't think there's any major security benefit to insisting
that they be the same and there are cases where e.g. a command
line tool like curl or wget can easily supply a different
cleartext SNI value as an override, should that ever be needed
or useful.

It sounds like you are argui= ng for replacing a MUST with a SHOULD.

I think our= best option is probably to clarify who is supposed to do what, and why.=C2= =A0 For example, we could say that a compliant client MUST set sni =3D publ= ic_name so that fallback can work on servers with multiple public names, bu= t the server MAY accept connections with missing or unrecognized SNI to ena= ble connections from non-compliant clients that prefer not to include the p= ublic_name.

> A lot of the HTTP
> connection establishment is automated. Given a server name, the client=
> will do a lookup for the ESNI record or a cached value. If there is on= e,
> the simple solution is to put the public name in the SNI extension and=
> the actual name in the ESNI extension.

Sure, I know that and am fine with it being the default.

> If the public name is censored,
> the solution is probably to look for a different ESNI record for the > server, one that would mention a different public name.

If the public_name is censored, then there may be >1 solution
needed, so allowing for more than one seems better than assuming
there is one and only one solution in that circumstance.

>
> By the way, I think that the current ESNI record is maybe a little too=
> complicated. The ESNI key is really a property of the public server, y= et
> the ESNI record is defined as a property of the hidden server. If the<= br> > public server rolls a new key, all the ESNI records of all the hidden<= br> > servers that mentioned the old key need to be updated. I think it woul= d
> be simpler to have the ESNI record as a property of the public server,=
> and to just have a pointer to the public server in the context of the<= br> > hidden server. May an SRV record. The chain would be something like: >
> 1) Look up whether the SRV record for _esni._tcp.hidden.example.co= m
>
> 2) If there are such records, select the appropriate public server, sa= y
> public.example.net
>
> 3) Look up ESNI, A, AAAA for public.example.net
>
> In that architecture, there is no need to encode the public server nam= e
> in the ESNI record. I think there will be several advantages. The ESNI=
> record's TTL can be set to the lifetime of the key. The SRV record= 's TTL
> can be set to the expected lifetime of the relation between 'hidde= n" and
> "public". If the SRV lifetime is long enough, the value can = be
> efficiently cached by the client. If multiple clients share the same > hidden server, the ESNI record is fetched only once, and can be cached= .
> At connection time, the client would only need to query the A/AAAA
> records of the public server, i.e. exactly the same DNS transaction as=
> an access to the public server.

That seems a bit like the HTTPSSRV proposal and maybe better in
a different thread?

S.


>
> -- Christian Huitema
>
>
>
>
_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls
--000000000000639dfc058ed1f7f9-- --0000000000006d7350058ed1f798 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIIS5wYJKoZIhvcNAQcCoIIS2DCCEtQCAQExDzANBglghkgBZQMEAgEFADALBgkqhkiG9w0BBwGg ghBNMIIEXDCCA0SgAwIBAgIOSBtqDm4P/739RPqw/wcwDQYJKoZIhvcNAQELBQAwZDELMAkGA1UE BhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVy c29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hBMjU2IC0gRzIwHhcNMTYwNjE1MDAwMDAwWhcNMjEw NjE1MDAwMDAwWjBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xvYmFsU2lnbiBudi1zYTEiMCAG A1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC AQoCggEBALR23lKtjlZW/17kthzYcMHHKFgywfc4vLIjfq42NmMWbXkNUabIgS8KX4PnIFsTlD6F GO2fqnsTygvYPFBSMX4OCFtJXoikP2CQlEvO7WooyE94tqmqD+w0YtyP2IB5j4KvOIeNv1Gbnnes BIUWLFxs1ERvYDhmk+OrvW7Vd8ZfpRJj71Rb+QQsUpkyTySaqALXnyztTDp1L5d1bABJN/bJbEU3 Hf5FLrANmognIu+Npty6GrA6p3yKELzTsilOFmYNWg7L838NS2JbFOndl+ce89gM36CW7vyhszi6 6LqqzJL8MsmkP53GGhf11YMP9EkmawYouMDP/PwQYhIiUO0CAwEAAaOCASIwggEeMA4GA1UdDwEB /wQEAwIBBjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwEgYDVR0TAQH/BAgwBgEB/wIB ADAdBgNVHQ4EFgQUyzgSsMeZwHiSjLMhleb0JmLA4D8wHwYDVR0jBBgwFoAUJiSSix/TRK+xsBtt r+500ox4AAMwSwYDVR0fBEQwQjBAoD6gPIY6aHR0cDovL2NybC5nbG9iYWxzaWduLmNvbS9ncy9n c3BlcnNvbmFsc2lnbnB0bnJzc2hhMmcyLmNybDBMBgNVHSAERTBDMEEGCSsGAQQBoDIBKDA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzANBgkqhkiG 9w0BAQsFAAOCAQEACskdySGYIOi63wgeTmljjA5BHHN9uLuAMHotXgbYeGVrz7+DkFNgWRQ/dNse Qa4e+FeHWq2fu73SamhAQyLigNKZF7ZzHPUkSpSTjQqVzbyDaFHtRBAwuACuymaOWOWPePZXOH9x t4HPwRQuur57RKiEm1F6/YJVQ5UTkzAyPoeND/y1GzXS4kjhVuoOQX3GfXDZdwoN8jMYBZTO0H5h isymlIl6aot0E5KIKqosW6mhupdkS1ZZPp4WXR4frybSkLejjmkTYCTUmh9DuvKEQ1Ge7siwsWgA NS1Ln+uvIuObpbNaeAyMZY0U5R/OyIDaq+m9KXPYvrCZ0TCLbcKuRzCCBB4wggMGoAMCAQICCwQA AAAAATGJxkCyMA0GCSqGSIb3DQEBCwUAMEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAt IFIzMRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWduMB4XDTExMDgwMjEw MDAwMFoXDTI5MDMyOTEwMDAwMFowZDELMAkGA1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24g bnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVyc29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hB MjU2IC0gRzIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCg/hRKosYAGP+P7mIdq5NB Kr3J0tg+8lPATlgp+F6W9CeIvnXRGUvdniO+BQnKxnX6RsC3AnE0hUUKRaM9/RDDWldYw35K+sge C8fWXvIbcYLXxWkXz+Hbxh0GXG61Evqux6i2sKeKvMr4s9BaN09cqJ/wF6KuP9jSyWcyY+IgL6u2 52my5UzYhnbf7D7IcC372bfhwM92n6r5hJx3r++rQEMHXlp/G9J3fftgsD1bzS7J/uHMFpr4MXua eoiMLV5gdmo0sQg23j4pihyFlAkkHHn4usPJ3EePw7ewQT6BUTFyvmEB+KDoi7T4RCAZDstgfpzD rR/TNwrK8/FXoqnFAgMBAAGjgegwgeUwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8C AQEwHQYDVR0OBBYEFCYkkosf00SvsbAbba/udNKMeAADMEcGA1UdIARAMD4wPAYEVR0gADA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzA2BgNVHR8E LzAtMCugKaAnhiVodHRwOi8vY3JsLmdsb2JhbHNpZ24ubmV0L3Jvb3QtcjMuY3JsMB8GA1UdIwQY MBaAFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQACAFVjHihZCV/IqJYt 7Nig/xek+9g0dmv1oQNGYI1WWeqHcMAV1h7cheKNr4EOANNvJWtAkoQz+076Sqnq0Puxwymj0/+e oQJ8GRODG9pxlSn3kysh7f+kotX7pYX5moUa0xq3TCjjYsF3G17E27qvn8SJwDsgEImnhXVT5vb7 qBYKadFizPzKPmwsJQDPKX58XmPxMcZ1tG77xCQEXrtABhYC3NBhu8+c5UoinLpBQC1iBnNpNwXT Lmd4nQdf9HCijG1e8myt78VP+QSwsaDT7LVcLT2oDPVggjhVcwljw3ePDwfGP9kNrR+lc8XrfClk WbrdhC2o4Ui28dtIVHd3MIIDXzCCAkegAwIBAgILBAAAAAABIVhTCKIwDQYJKoZIhvcNAQELBQAw TDEgMB4GA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjMxEzARBgNVBAoTCkdsb2JhbFNpZ24x EzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDkwMzE4MTAwMDAwWhcNMjkwMzE4MTAwMDAwWjBMMSAw HgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMzETMBEGA1UEChMKR2xvYmFsU2lnbjETMBEG A1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMwldpB5Bngi FvXAg7aEyiie/QV2EcWtiHL8RgJDx7KKnQRfJMsuS+FggkbhUqsMgUdwbN1k0ev1LKMPgj0MK66X 17YUhhB5uzsTgHeMCOFJ0mpiLx9e+pZo34knlTifBtc+ycsmWQ1z3rDI6SYOgxXG71uL0gRgykmm KPZpO/bLyCiR5Z2KYVc3rHQU3HTgOu5yLy6c+9C7v/U9AOEGM+iCK65TpjoWc4zdQQ4gOsC0p6Hp sk+QLjJg6VfLuQSSaGjlOCZgdbKfd/+RFO+uIEn8rUAVSNECMWEZXriX7613t2Saer9fwRPvm2L7 DWzgVGkWqQPabumDk3F2xmmFghcCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQF MAMBAf8wHQYDVR0OBBYEFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQBL QNvAUKr+yAzv95ZURUm7lgAJQayzE4aGKAczymvmdLm6AC2upArT9fHxD4q/c2dKg8dEe3jgr25s bwMpjjM5RcOO5LlXbKr8EpbsU8Yt5CRsuZRj+9xTaGdWPoO4zzUhw8lo/s7awlOqzJCK6fBdRoyV 3XpYKBovHd7NADdBj+1EbddTKJd+82cEHhXXipa0095MJ6RMG3NzdvQXmcIfeg7jLQitChws/zyr VQ4PkX4268NXSb7hLi18YIvDQVETI53O9zJrlAGomecsMx86OyXShkDOOyyGeMlhLxS67ttVb9+E 7gUJTb0o2HLO02JQZR7rkpeDMdmztcpHWD9fMIIEZDCCA0ygAwIBAgIMB/CJK1MgpV83jiIZMA0G CSqGSIb3DQEBCwUAMEwxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMSIw IAYDVQQDExlHbG9iYWxTaWduIEhWIFMvTUlNRSBDQSAxMB4XDTE5MDMxMzA4MjIxOVoXDTE5MDkw OTA4MjIxOVowIjEgMB4GCSqGSIb3DQEJAQwRYmVtYXNjQGdvb2dsZS5jb20wggEiMA0GCSqGSIb3 DQEBAQUAA4IBDwAwggEKAoIBAQCsphkGEsCh0fF4+6Wsi1u40JxI6W6Izew+dLGK4b93LCRAuJ8y g9wSnwGAtk9/23VmtKwBrMaJD5j9SVZpscvLAjrWwADl/THU22uTW0MsUE2fPOPv2s4hE+vMgRmK P2E+xpI6n0gFvn8qrUHO1dm6PJaP5SWa+zdB/Ja1LgMJTpevQqjK4LKjWmHFPR6CplS4RImjGk7U 0I6invTyQnL5p583t5PI7FcM5UyjAqxGEETdAuc7N4IqjNETvPwL0wLIzxPDA5PMqcWPSzg7sBAB LVUQRYNIAJPlVpUdg1IeAjil5BaaWBjEeCLBSGDFX3WaWfMNzQvRZr4i6oJxzV+1AgMBAAGjggFu MIIBajAcBgNVHREEFTATgRFiZW1hc2NAZ29vZ2xlLmNvbTBQBggrBgEFBQcBAQREMEIwQAYIKwYB BQUHMAKGNGh0dHA6Ly9zZWN1cmUuZ2xvYmFsc2lnbi5jb20vY2FjZXJ0L2dzaHZzbWltZWNhMS5j cnQwHQYDVR0OBBYEFFSy8ovdLNSQc8aqxOgKS7sBOm/UMB8GA1UdIwQYMBaAFMs4ErDHmcB4koyz IZXm9CZiwOA/MEwGA1UdIARFMEMwQQYJKwYBBAGgMgEoMDQwMgYIKwYBBQUHAgEWJmh0dHBzOi8v d3d3Lmdsb2JhbHNpZ24uY29tL3JlcG9zaXRvcnkvMDsGA1UdHwQ0MDIwMKAuoCyGKmh0dHA6Ly9j cmwuZ2xvYmFsc2lnbi5jb20vZ3NodnNtaW1lY2ExLmNybDAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0l BBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMA0GCSqGSIb3DQEBCwUAA4IBAQCbQ++Znz6xh85ZlZEN Y/vAF0vn111O0c2houe4LlLQkoQ1QS4fH5EYcBx/393FTq5n08ezWYVtmeQ6W15e34CqjYNop1Vh mihZ+3J6+LL/6YNi91cp5yMFgxOP9aI/Y8IaIWZJAY2e8yHbYSq0z8kka0H6S4VvFjwtRogkWW95 0SStEwo/8viJ02BwpmVj4YIA6Fva1ZbeN2TnUMCAHJAlKWOGlpHxpcdcWckED0XbSY9w6bllMw1T tsbiUwQxDeO++Y8NfS8rieZgfv3RlobKihE8xbIVGRHIq1gup4nXv6XDwHDYyGhafIfUD4Ix00Wk gnODGb+jPwoQlDX0X64qMYICXjCCAloCAQEwXDBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xv YmFsU2lnbiBudi1zYTEiMCAGA1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMQIMB/CJK1Mg pV83jiIZMA0GCWCGSAFlAwQCAQUAoIHUMC8GCSqGSIb3DQEJBDEiBCC2/gci0ZAUxdlrGfSASOsI ZrS4HKFTrSCaBnCLbsnvCzAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEP Fw0xOTA3MjkxMzM1MzRaMGkGCSqGSIb3DQEJDzFcMFowCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQB FjALBglghkgBZQMEAQIwCgYIKoZIhvcNAwcwCwYJKoZIhvcNAQEKMAsGCSqGSIb3DQEBBzALBglg hkgBZQMEAgEwDQYJKoZIhvcNAQEBBQAEggEABwyHYKC6l2Fcymx/mpVcPpiYBV9MWOnDwmoDRXqS y1DvvO4D6FTlHUg+pEfQEaJvgWFDgty7W3yF4rHZ583W7Q3G4QQJJglun6cS4xkjcoUClh2/ecv0 xPlegh8q5mWU9oQqS1Izv9urL6oz+GqtWHECFMGerB81R9Yr2pkEy5t7Y9mJ+vwnOzJUqK0lyk6+ JtJalerGVFn8yI/aUHkH+pK09VWXcZGvG/Fc4RIebFzOo/5oTtB39cJjgpAn8u4yxoGf8khuwvB5 7LU3CnMk2zcp8wN+NxOM9+XlvWaKkckt0Or44751vYUXs6qKPhAgrUOiWOc4r4DO/Z0yNUX/4A== --0000000000006d7350058ed1f798-- From nobody Mon Jul 29 07:39:22 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1FD33120133 for ; Mon, 29 Jul 2019 07:39:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FMuyNqNfh0Mv for ; Mon, 29 Jul 2019 07:39:17 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A58B5120127 for ; Mon, 29 Jul 2019 07:39:16 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 66C93BE2C; Mon, 29 Jul 2019 15:39:13 +0100 (IST) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Jul1qXYS-d0R; Mon, 29 Jul 2019 15:39:11 +0100 (IST) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id AF97EBE24; Mon, 29 Jul 2019 15:39:11 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1564411151; bh=ic4Ac+1h7PA23Cb0or/5cSFvRhcbhGqYzPaAvjaHk+U=; h=To:Cc:References:From:Subject:Date:In-Reply-To:From; b=PsiSPTWYm65k7tlFRDAsmxj8rhAypVCcKVXBJkZFVrBJs4sJiGOKOFbNMiZ84fVaN +5I1ruZEwdvnaiKXYxwWNoilMHKKaUc93sMaZrXynJrkXhj7lch6vBtnVSgo21H4xx 4zzq1EJeR58A9ov3bV2KJHgWKyfjq31U4UakQp5Y= To: Ben Schwartz Cc: Christian Huitema , "tls@ietf.org" References: <84f41a5a-b543-2fdb-8af0-b923dccd7693@cs.tcd.ie> <05501e58-6d97-c2b6-6e76-bc4c3b2f4579@huitema.net> <2997ba60-6d01-5440-cd3d-66651443253d@cs.tcd.ie> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <9d2d09a6-2435-0f5c-9617-8b3e2a16ff32@cs.tcd.ie> Date: Mon, 29 Jul 2019 15:39:10 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="LGFql8F1U1Kg0tyLMIQjvqcxk35Nk3SdJ" Archived-At: Subject: Re: [TLS] ESNIKeys.public_name vs. cleartext SNI X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 29 Jul 2019 14:39:19 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --LGFql8F1U1Kg0tyLMIQjvqcxk35Nk3SdJ Content-Type: multipart/mixed; boundary="z2Fu5WZrdex37FOZl5skLTQvnEB2F0GEj"; protected-headers="v1" From: Stephen Farrell To: Ben Schwartz Cc: Christian Huitema , "tls@ietf.org" Message-ID: <9d2d09a6-2435-0f5c-9617-8b3e2a16ff32@cs.tcd.ie> Subject: Re: [TLS] ESNIKeys.public_name vs. cleartext SNI References: <84f41a5a-b543-2fdb-8af0-b923dccd7693@cs.tcd.ie> <05501e58-6d97-c2b6-6e76-bc4c3b2f4579@huitema.net> <2997ba60-6d01-5440-cd3d-66651443253d@cs.tcd.ie> In-Reply-To: --z2Fu5WZrdex37FOZl5skLTQvnEB2F0GEj Content-Type: multipart/mixed; boundary="------------9723B886D6F8B599321B014F" Content-Language: en-GB This is a multi-part message in MIME format. --------------9723B886D6F8B599321B014F Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hiya, On 29/07/2019 14:35, Ben Schwartz wrote: >> In which case I must've explained it badly, because it's >> entirely practical:-) Let me try again... >> >> What I'm asking is that we not insist that the cleartext >> SNI is the ESNIKeys.public_name even though those will be >> the same value in almost all cases. >> >> I don't think there's any major security benefit to insisting >> that they be the same and there are cases where e.g. a command >> line tool like curl or wget can easily supply a different >> cleartext SNI value as an override, should that ever be needed >> or useful. >> > It sounds like you are arguing for replacing a MUST with a SHOULD. Sure, that'd be good enough, though I think a MAY is actually all that's needed. I think the way I'd phrase it might be "clients are advised to include the value of ESNIKeys.public_name in the TLS handshake in the cleartext SNI extension; servers need to be aware that some clients might not do so, either omitting cleartext SNI entirely or including some other value that may or may not be meaningful at that server; successful ESNI decryption means ignoring any cleartext SNI value provided" and avoid use of 2119 terminology, but I'm sure various possible wordings would be fine. > I think our best option is probably to clarify who is supposed to do wh= at, > and why. For example, we could say that a compliant client MUST set sn= i =3D > public_name so that fallback can work on servers with multiple public > names, =20 I'm pretty sure I disagree with the above MUST as being necessary. But what do you mean by "so that fallback can work"? ISTM that if ESNI doesn't work, then the right thing is for the server to fail or continue the TLS h/s based on the cleartext SNI as normal, or to default to something if no cleartext SNI is provided, again as normal. A client that's not only greasing MUST of course make it appear to the client application that the TLS h/s failed, as ESNI has failed. > but the server MAY accept connections with missing or unrecognized > SNI to enable connections from non-compliant clients that prefer not to= > include the public_name. Right. I'd expect some variation in all this and would like that we can make ESNI work even for clients with somewhat outdated or incorrect information, if there's no security downside in so doing. Cheers, S. >=20 --------------9723B886D6F8B599321B014F Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------9723B886D6F8B599321B014F-- --z2Fu5WZrdex37FOZl5skLTQvnEB2F0GEj-- --LGFql8F1U1Kg0tyLMIQjvqcxk35Nk3SdJ Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAl0/BQ8ACgkQWrL68XsX K+pLRBAAtXNqU/nx4fv4UNBumYhP7F3vtMi6kVLJHdfdOpDpDtJ0KcnDa0/sgmFm b0wqiYF6NHc18DDSKNE4P+KDNE1zNNUN3gG4RCoMYtT+6fM8Kj0tEgunJ2tra9pq H9fcBHH6L4Y5DfICUuVThS1oX0vKDVgeFa/fb+7qGPlS9245AWD8oMeEMjfHC+q/ dnXcWK5OaJz7y7fzRTysgwx+UM21YR/ZSnB82EKZI41bEhNhkps0oH788xBg5WJx myoBuk9EcmVA6gUgDJUP9jfJDIpfmVcIbeTW6bpmQ+eQqipEtH8rxzqkxC9CGqQG GPNhW4fRM5pmZzq05q5e4M8Iyp1UgeZ4KQqFPbqAKROXfKEpGqcGgJnWsxX2NKi9 AZYEyVDzQlAGZaeT6+LENuOt/uEBS1J3chGgupVbWLvsZgn30YB0V6jgkyqrsVJY g3PURFxVjalAmeqAo27dY2aZNHX8RcK1AnLAfUygIPFTEidN2RZ7UOViC31MJj7Y u3EalkhVHnDRZGaLyZGOnxxu2RDkA7Bl2nRKWNxf9VKY/tn5AnSK6kBc7Cx3kPL1 P0vxQgCaO+N113lzjhFVy/CnN+k5foAQ4xmkSVdv14Lng92HikK1ZRwTgF2DlR2C QJmdt+PzYMjR6yln2BH/UMyhgOgPsIb+FRYwVq534LW7ADtPNYY= =z50+ -----END PGP SIGNATURE----- --LGFql8F1U1Kg0tyLMIQjvqcxk35Nk3SdJ-- From nobody Mon Jul 29 08:07:19 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B547612010D for ; Mon, 29 Jul 2019 08:07:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.5 X-Spam-Level: X-Spam-Status: No, score=-17.5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Kf3XA9kZyalq for ; Mon, 29 Jul 2019 08:07:14 -0700 (PDT) Received: from mail-io1-xd2d.google.com (mail-io1-xd2d.google.com [IPv6:2607:f8b0:4864:20::d2d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 72596120127 for ; Mon, 29 Jul 2019 08:07:14 -0700 (PDT) Received: by mail-io1-xd2d.google.com with SMTP id k20so120698658ios.10 for ; Mon, 29 Jul 2019 08:07:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=y/MjAusGTLoVaYFWn106eDs7t8b6VaaCy2f7oOi56Mk=; b=tYdoH8Ntz2lEWN6Df5KqUg35Vy7ndvRcnLqH+67XKY+wYDOwKG4Zi5mfAatDUY7cgR NJhpFEpX1km0GiY1P4CFGJ+fIHlLlh+v1/h4x4HWxKQEtdjS2GRJ+ejlh788XH0m2yM3 Wi7O7lfkkTtKyiOK1pJNEHBkt0iO3OT1eUj+Nc/YGjnQBIJPvwlOfwUPzzs6ktT3aPET 3zWNxTU4HQj0jDR+PgxOJOn6N0MWYVJys9fLilsn9omQnTYrmxWwfp2naLiFZpJSEEXc Slr3C7ktZ0jrLbA7EbiIHSl8oQC1QKWA2+rcraxEIkMK2PkkfoKMcVYuaXd1H4Ev/kZ8 DaWg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=y/MjAusGTLoVaYFWn106eDs7t8b6VaaCy2f7oOi56Mk=; b=DW5RpmTyWCgm8p0Fbk51Wc/wB/gpoNiVQ4tpAxfAPAqJ7pgh5wBjuXo2885neHxmDv 9+h1DAwCVPMDlGuZQFlPTE2STnji2clxWLiSQMszetIuMLCkBbVjEAfb67C6k1yu8SwI bz8Zrw9BE/gtZA8+t2xaVLw5pXSiJ6trU/077bCpczDR6aqSkpMb+a+tB0p9Pa1g2pEb 5LDb3URf8Jc1DwTdaiVJV+0ZO9ZOVvgtpsf0Qhw2dwDyU03JV5fpxjCZQH91picmlsqG XlQgNvtK5QSSc/Djg+rMaFNfefBRDglFSFEE0T5GMAbmYqXwkXZ7PpjI+1TNPbKwTUHb sYFA== X-Gm-Message-State: APjAAAWI2OZ/aCT6WvRELJQBB3FAOHX/eT9hOI8rxRf7ryn2kBxQYyqQ pRT7LORsAxqbGBY5Zi0PTT07ffpHAuyP6usrz40+nU45r7Oz5w== X-Google-Smtp-Source: APXvYqwua8zkWIir3VAHCJwJlNDyaq4rwZ16L3B9stzbjZHvMS8rPEYIX3xXHHFHB5zTyax87cLKCaRG+7rJSEbbZkg= X-Received: by 2002:a02:7a5c:: with SMTP id z28mr33938747jad.40.1564412833091; Mon, 29 Jul 2019 08:07:13 -0700 (PDT) MIME-Version: 1.0 References: <84f41a5a-b543-2fdb-8af0-b923dccd7693@cs.tcd.ie> <05501e58-6d97-c2b6-6e76-bc4c3b2f4579@huitema.net> <2997ba60-6d01-5440-cd3d-66651443253d@cs.tcd.ie> <9d2d09a6-2435-0f5c-9617-8b3e2a16ff32@cs.tcd.ie> In-Reply-To: <9d2d09a6-2435-0f5c-9617-8b3e2a16ff32@cs.tcd.ie> From: Ben Schwartz Date: Mon, 29 Jul 2019 11:07:00 -0400 Message-ID: To: Stephen Farrell Cc: Christian Huitema , "tls@ietf.org" Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="0000000000003ef162058ed33f2e" Archived-At: Subject: Re: [TLS] ESNIKeys.public_name vs. cleartext SNI X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 29 Jul 2019 15:07:18 -0000 --0000000000003ef162058ed33f2e Content-Type: multipart/alternative; boundary="00000000000033b691058ed33f58" --00000000000033b691058ed33f58 Content-Type: text/plain; charset="UTF-8" On Mon, Jul 29, 2019 at 10:39 AM Stephen Farrell wrote: > > Hiya, > > On 29/07/2019 14:35, Ben Schwartz wrote: > >> In which case I must've explained it badly, because it's > >> entirely practical:-) Let me try again... > >> > >> What I'm asking is that we not insist that the cleartext > >> SNI is the ESNIKeys.public_name even though those will be > >> the same value in almost all cases. > >> > >> I don't think there's any major security benefit to insisting > >> that they be the same and there are cases where e.g. a command > >> line tool like curl or wget can easily supply a different > >> cleartext SNI value as an override, should that ever be needed > >> or useful. > >> > > It sounds like you are arguing for replacing a MUST with a SHOULD. > > Sure, that'd be good enough, though I think a MAY is actually all > that's needed. I think the way I'd phrase it might be "clients > are advised to include the value of ESNIKeys.public_name in the > TLS handshake in the cleartext SNI extension; servers need to be > aware that some clients might not do so, either omitting cleartext > SNI entirely or including some other value that may or may not be > meaningful at that server; successful ESNI decryption means ignoring > any cleartext SNI value provided" and avoid use of 2119 terminology, > but I'm sure various possible wordings would be fine. > > > I think our best option is probably to clarify who is supposed to do > what, > > and why. For example, we could say that a compliant client MUST set sni > = > > public_name so that fallback can work on servers with multiple public > > names, > > I'm pretty sure I disagree with the above MUST as being necessary. > > But what do you mean by "so that fallback can work"? I mean "so that esni_retry_requested can work". This is the ESNI fallback mechanism, where the server delivers a fresh ESNIKeys in-band, and the client closes the socket and tries again. The client will only accept the new ESNIKeys if the server's provided certificate validates for public_name, but if the server has multiple public names, it will not in general know which certificate to serve unless the client sets sni = public_name. Admittedly, having multiple public names in separate certificates may not be a common case, but as long as we view it as in-scope, we have to require sni = public_name for general-purpose clients. Special-purpose clients that have additional out-of-band information (like knowing that the server only has one public name) are of course able to do whatever they want; they're no longer tightly bound by the standard. > ISTM that if > ESNI doesn't work, then the right thing is for the server to fail > or continue the TLS h/s based on the cleartext SNI as normal, or > to default to something if no cleartext SNI is provided, again as > normal. A client that's not only greasing MUST of course make it > appear to the client application that the TLS h/s failed, as ESNI > has failed. > > > but the server MAY accept connections with missing or unrecognized > > SNI to enable connections from non-compliant clients that prefer not to > > include the public_name. > > Right. I'd expect some variation in all this and would like that > we can make ESNI work even for clients with somewhat outdated or > incorrect information, if there's no security downside in so > doing. > > Cheers, > S. > > > > > --00000000000033b691058ed33f58 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Mon, Jul 29, 2019 at 10:39 AM Step= hen Farrell <stephen.farrel= l@cs.tcd.ie> wrote:

Hiya,

On 29/07/2019 14:35, Ben Schwartz wrote:
>> In which case I must've explained it badly, because it's >> entirely practical:-) Let me try again...
>>
>> What I'm asking is that we not insist that the cleartext
>> SNI is the ESNIKeys.public_name even though those will be
>> the same value in almost all cases.
>>
>> I don't think there's any major security benefit to insist= ing
>> that they be the same and there are cases where e.g. a command
>> line tool like curl or wget can easily supply a different
>> cleartext SNI value as an override, should that ever be needed
>> or useful.
>>
> It sounds like you are arguing for replacing a MUST with a SHOULD.

Sure, that'd be good enough, though I think a MAY is actually all
that's needed. I think the way I'd phrase it might be "clients=
are advised to include the value of ESNIKeys.public_name in the
TLS handshake in the cleartext SNI extension; servers need to be
aware that some clients might not do so, either omitting cleartext
SNI entirely or including some other value that may or may not be
meaningful at that server; successful ESNI decryption means ignoring
any cleartext SNI value provided" and avoid use of 2119 terminology, but I'm sure various possible wordings would be fine.

> I think our best option is probably to clarify who is supposed to do w= hat,
> and why.=C2=A0 For example, we could say that a compliant client MUST = set sni =3D
> public_name so that fallback can work on servers with multiple public<= br> > names,=C2=A0

I'm pretty sure I disagree with the above MUST as being necessary.

But what do you mean by "so that fallback can work"?
=

I mean "so that=C2=A0esni_retry_requested can work= ".=C2=A0 This is the ESNI fallback mechanism, where the server deliver= s a fresh ESNIKeys in-band, and the client closes the socket and tries agai= n.=C2=A0 The client will only accept the new ESNIKeys if the server's p= rovided certificate validates for public_name, but if the server has multip= le public names, it will not in general know which certificate to serve unl= ess the client sets sni =3D public_name.

Admittedl= y, having multiple public names in separate certificates may not be a commo= n case, but as long as we view it as in-scope, we have to require sni =3D p= ublic_name for general-purpose clients.=C2=A0 Special-purpose clients that = have additional out-of-band information (like knowing that the server only = has one public name) are of course able to do whatever they want; they'= re no longer tightly bound by the standard.
=C2=A0
ISTM that if
ESNI doesn't work, then the right thing is for the server to fail
or continue the TLS h/s based on the cleartext SNI as normal, or
to default to something if no cleartext SNI is provided, again as
normal. A client that's not only greasing MUST of course make it
appear to the client application that the TLS h/s failed, as ESNI
has failed.

> but the server MAY accept connections with missing or unrecognized
> SNI to enable connections from non-compliant clients that prefer not t= o
> include the public_name.

Right. I'd expect some variation in all this and would like that
we can make ESNI work even for clients with somewhat outdated or
incorrect information, if there's no security downside in so
doing.

Cheers,
S.


>
--00000000000033b691058ed33f58-- --0000000000003ef162058ed33f2e Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIIS5wYJKoZIhvcNAQcCoIIS2DCCEtQCAQExDzANBglghkgBZQMEAgEFADALBgkqhkiG9w0BBwGg ghBNMIIEXDCCA0SgAwIBAgIOSBtqDm4P/739RPqw/wcwDQYJKoZIhvcNAQELBQAwZDELMAkGA1UE BhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVy c29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hBMjU2IC0gRzIwHhcNMTYwNjE1MDAwMDAwWhcNMjEw NjE1MDAwMDAwWjBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xvYmFsU2lnbiBudi1zYTEiMCAG A1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC AQoCggEBALR23lKtjlZW/17kthzYcMHHKFgywfc4vLIjfq42NmMWbXkNUabIgS8KX4PnIFsTlD6F GO2fqnsTygvYPFBSMX4OCFtJXoikP2CQlEvO7WooyE94tqmqD+w0YtyP2IB5j4KvOIeNv1Gbnnes BIUWLFxs1ERvYDhmk+OrvW7Vd8ZfpRJj71Rb+QQsUpkyTySaqALXnyztTDp1L5d1bABJN/bJbEU3 Hf5FLrANmognIu+Npty6GrA6p3yKELzTsilOFmYNWg7L838NS2JbFOndl+ce89gM36CW7vyhszi6 6LqqzJL8MsmkP53GGhf11YMP9EkmawYouMDP/PwQYhIiUO0CAwEAAaOCASIwggEeMA4GA1UdDwEB /wQEAwIBBjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwEgYDVR0TAQH/BAgwBgEB/wIB ADAdBgNVHQ4EFgQUyzgSsMeZwHiSjLMhleb0JmLA4D8wHwYDVR0jBBgwFoAUJiSSix/TRK+xsBtt r+500ox4AAMwSwYDVR0fBEQwQjBAoD6gPIY6aHR0cDovL2NybC5nbG9iYWxzaWduLmNvbS9ncy9n c3BlcnNvbmFsc2lnbnB0bnJzc2hhMmcyLmNybDBMBgNVHSAERTBDMEEGCSsGAQQBoDIBKDA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzANBgkqhkiG 9w0BAQsFAAOCAQEACskdySGYIOi63wgeTmljjA5BHHN9uLuAMHotXgbYeGVrz7+DkFNgWRQ/dNse Qa4e+FeHWq2fu73SamhAQyLigNKZF7ZzHPUkSpSTjQqVzbyDaFHtRBAwuACuymaOWOWPePZXOH9x t4HPwRQuur57RKiEm1F6/YJVQ5UTkzAyPoeND/y1GzXS4kjhVuoOQX3GfXDZdwoN8jMYBZTO0H5h isymlIl6aot0E5KIKqosW6mhupdkS1ZZPp4WXR4frybSkLejjmkTYCTUmh9DuvKEQ1Ge7siwsWgA NS1Ln+uvIuObpbNaeAyMZY0U5R/OyIDaq+m9KXPYvrCZ0TCLbcKuRzCCBB4wggMGoAMCAQICCwQA AAAAATGJxkCyMA0GCSqGSIb3DQEBCwUAMEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAt IFIzMRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWduMB4XDTExMDgwMjEw MDAwMFoXDTI5MDMyOTEwMDAwMFowZDELMAkGA1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24g bnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVyc29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hB MjU2IC0gRzIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCg/hRKosYAGP+P7mIdq5NB Kr3J0tg+8lPATlgp+F6W9CeIvnXRGUvdniO+BQnKxnX6RsC3AnE0hUUKRaM9/RDDWldYw35K+sge C8fWXvIbcYLXxWkXz+Hbxh0GXG61Evqux6i2sKeKvMr4s9BaN09cqJ/wF6KuP9jSyWcyY+IgL6u2 52my5UzYhnbf7D7IcC372bfhwM92n6r5hJx3r++rQEMHXlp/G9J3fftgsD1bzS7J/uHMFpr4MXua eoiMLV5gdmo0sQg23j4pihyFlAkkHHn4usPJ3EePw7ewQT6BUTFyvmEB+KDoi7T4RCAZDstgfpzD rR/TNwrK8/FXoqnFAgMBAAGjgegwgeUwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8C AQEwHQYDVR0OBBYEFCYkkosf00SvsbAbba/udNKMeAADMEcGA1UdIARAMD4wPAYEVR0gADA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzA2BgNVHR8E LzAtMCugKaAnhiVodHRwOi8vY3JsLmdsb2JhbHNpZ24ubmV0L3Jvb3QtcjMuY3JsMB8GA1UdIwQY MBaAFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQACAFVjHihZCV/IqJYt 7Nig/xek+9g0dmv1oQNGYI1WWeqHcMAV1h7cheKNr4EOANNvJWtAkoQz+076Sqnq0Puxwymj0/+e oQJ8GRODG9pxlSn3kysh7f+kotX7pYX5moUa0xq3TCjjYsF3G17E27qvn8SJwDsgEImnhXVT5vb7 qBYKadFizPzKPmwsJQDPKX58XmPxMcZ1tG77xCQEXrtABhYC3NBhu8+c5UoinLpBQC1iBnNpNwXT Lmd4nQdf9HCijG1e8myt78VP+QSwsaDT7LVcLT2oDPVggjhVcwljw3ePDwfGP9kNrR+lc8XrfClk WbrdhC2o4Ui28dtIVHd3MIIDXzCCAkegAwIBAgILBAAAAAABIVhTCKIwDQYJKoZIhvcNAQELBQAw TDEgMB4GA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjMxEzARBgNVBAoTCkdsb2JhbFNpZ24x EzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDkwMzE4MTAwMDAwWhcNMjkwMzE4MTAwMDAwWjBMMSAw HgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMzETMBEGA1UEChMKR2xvYmFsU2lnbjETMBEG A1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMwldpB5Bngi FvXAg7aEyiie/QV2EcWtiHL8RgJDx7KKnQRfJMsuS+FggkbhUqsMgUdwbN1k0ev1LKMPgj0MK66X 17YUhhB5uzsTgHeMCOFJ0mpiLx9e+pZo34knlTifBtc+ycsmWQ1z3rDI6SYOgxXG71uL0gRgykmm KPZpO/bLyCiR5Z2KYVc3rHQU3HTgOu5yLy6c+9C7v/U9AOEGM+iCK65TpjoWc4zdQQ4gOsC0p6Hp sk+QLjJg6VfLuQSSaGjlOCZgdbKfd/+RFO+uIEn8rUAVSNECMWEZXriX7613t2Saer9fwRPvm2L7 DWzgVGkWqQPabumDk3F2xmmFghcCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQF MAMBAf8wHQYDVR0OBBYEFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQBL QNvAUKr+yAzv95ZURUm7lgAJQayzE4aGKAczymvmdLm6AC2upArT9fHxD4q/c2dKg8dEe3jgr25s bwMpjjM5RcOO5LlXbKr8EpbsU8Yt5CRsuZRj+9xTaGdWPoO4zzUhw8lo/s7awlOqzJCK6fBdRoyV 3XpYKBovHd7NADdBj+1EbddTKJd+82cEHhXXipa0095MJ6RMG3NzdvQXmcIfeg7jLQitChws/zyr VQ4PkX4268NXSb7hLi18YIvDQVETI53O9zJrlAGomecsMx86OyXShkDOOyyGeMlhLxS67ttVb9+E 7gUJTb0o2HLO02JQZR7rkpeDMdmztcpHWD9fMIIEZDCCA0ygAwIBAgIMB/CJK1MgpV83jiIZMA0G CSqGSIb3DQEBCwUAMEwxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMSIw IAYDVQQDExlHbG9iYWxTaWduIEhWIFMvTUlNRSBDQSAxMB4XDTE5MDMxMzA4MjIxOVoXDTE5MDkw OTA4MjIxOVowIjEgMB4GCSqGSIb3DQEJAQwRYmVtYXNjQGdvb2dsZS5jb20wggEiMA0GCSqGSIb3 DQEBAQUAA4IBDwAwggEKAoIBAQCsphkGEsCh0fF4+6Wsi1u40JxI6W6Izew+dLGK4b93LCRAuJ8y g9wSnwGAtk9/23VmtKwBrMaJD5j9SVZpscvLAjrWwADl/THU22uTW0MsUE2fPOPv2s4hE+vMgRmK P2E+xpI6n0gFvn8qrUHO1dm6PJaP5SWa+zdB/Ja1LgMJTpevQqjK4LKjWmHFPR6CplS4RImjGk7U 0I6invTyQnL5p583t5PI7FcM5UyjAqxGEETdAuc7N4IqjNETvPwL0wLIzxPDA5PMqcWPSzg7sBAB LVUQRYNIAJPlVpUdg1IeAjil5BaaWBjEeCLBSGDFX3WaWfMNzQvRZr4i6oJxzV+1AgMBAAGjggFu MIIBajAcBgNVHREEFTATgRFiZW1hc2NAZ29vZ2xlLmNvbTBQBggrBgEFBQcBAQREMEIwQAYIKwYB BQUHMAKGNGh0dHA6Ly9zZWN1cmUuZ2xvYmFsc2lnbi5jb20vY2FjZXJ0L2dzaHZzbWltZWNhMS5j cnQwHQYDVR0OBBYEFFSy8ovdLNSQc8aqxOgKS7sBOm/UMB8GA1UdIwQYMBaAFMs4ErDHmcB4koyz IZXm9CZiwOA/MEwGA1UdIARFMEMwQQYJKwYBBAGgMgEoMDQwMgYIKwYBBQUHAgEWJmh0dHBzOi8v d3d3Lmdsb2JhbHNpZ24uY29tL3JlcG9zaXRvcnkvMDsGA1UdHwQ0MDIwMKAuoCyGKmh0dHA6Ly9j cmwuZ2xvYmFsc2lnbi5jb20vZ3NodnNtaW1lY2ExLmNybDAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0l BBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMA0GCSqGSIb3DQEBCwUAA4IBAQCbQ++Znz6xh85ZlZEN Y/vAF0vn111O0c2houe4LlLQkoQ1QS4fH5EYcBx/393FTq5n08ezWYVtmeQ6W15e34CqjYNop1Vh mihZ+3J6+LL/6YNi91cp5yMFgxOP9aI/Y8IaIWZJAY2e8yHbYSq0z8kka0H6S4VvFjwtRogkWW95 0SStEwo/8viJ02BwpmVj4YIA6Fva1ZbeN2TnUMCAHJAlKWOGlpHxpcdcWckED0XbSY9w6bllMw1T tsbiUwQxDeO++Y8NfS8rieZgfv3RlobKihE8xbIVGRHIq1gup4nXv6XDwHDYyGhafIfUD4Ix00Wk gnODGb+jPwoQlDX0X64qMYICXjCCAloCAQEwXDBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xv YmFsU2lnbiBudi1zYTEiMCAGA1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMQIMB/CJK1Mg pV83jiIZMA0GCWCGSAFlAwQCAQUAoIHUMC8GCSqGSIb3DQEJBDEiBCApB1o6H2BUZ/seC/plY6nm UoiMQB+qxus6UukO3vtCKjAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEP Fw0xOTA3MjkxNTA3MTNaMGkGCSqGSIb3DQEJDzFcMFowCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQB FjALBglghkgBZQMEAQIwCgYIKoZIhvcNAwcwCwYJKoZIhvcNAQEKMAsGCSqGSIb3DQEBBzALBglg hkgBZQMEAgEwDQYJKoZIhvcNAQEBBQAEggEADV2ZsJ0m9JpSm2IGL+TQcuZscO1CN/E9WIyWtwmu 9xIa/kvmpT+k0sUyL9FFnBf4QG0CTuSNrGw2Np+Yo8cseOsjg8ti/p7cF1227BkLLNRj0mA0AGj/ KRZZPKmMZRtprAaMdyycZKQZZum9iPRWUESPS4rmuJ10/T3Vol2t52FVmS+f1LWb73yjt3zGrn/9 cTRY97xTMCwUYvwqtt2rwvWmqae3vmG920DyWfRdkk1FFUFCITVhdC7L/dDRxGwjJT5jY++2BDG1 t/cyScHfEByzcT6x1DzTHmY8VuGGifCiuFoab5QtokVc9ytrujMafp7jYz2ULxLgOQb7aE0bSA== --0000000000003ef162058ed33f2e-- From nobody Mon Jul 29 08:19:34 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A18B4120188 for ; Mon, 29 Jul 2019 08:19:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6-__Js-hSDfY for ; Mon, 29 Jul 2019 08:19:07 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6F9E11201B0 for ; Mon, 29 Jul 2019 08:19:07 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id EA31ABE39; Mon, 29 Jul 2019 16:19:05 +0100 (IST) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id y_HGCfFxseMX; Mon, 29 Jul 2019 16:19:04 +0100 (IST) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 786DCBE24; Mon, 29 Jul 2019 16:19:04 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1564413544; bh=gaGmmb3lrK184pmHWHm6yEtkfOsWZNOxOfJf5pGuh8g=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=jJPg+0k/DPxN11ar4bR2BmaeBWLvwmDXpxpHLYctRuWQO1HvjFyzgZKPEoyLJHMFl ixrkojDWfKDNAgAb+sIiOZ4cVXZ1rpgN0a07HmAv67uEasiSCfAPQWXR29VB2HWf+o Q6TXWZCJwbOyA0OR1uYgAYRGqr3ackR8CanqpMJk= To: Ben Schwartz Cc: Christian Huitema , "tls@ietf.org" References: <84f41a5a-b543-2fdb-8af0-b923dccd7693@cs.tcd.ie> <05501e58-6d97-c2b6-6e76-bc4c3b2f4579@huitema.net> <2997ba60-6d01-5440-cd3d-66651443253d@cs.tcd.ie> <9d2d09a6-2435-0f5c-9617-8b3e2a16ff32@cs.tcd.ie> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <2dc17395-c2f4-7a70-5c65-6e2f62c6e6ee@cs.tcd.ie> Date: Mon, 29 Jul 2019 16:19:02 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="5UoEkd8BXk0XZdMhMKdtrQEDnrlaVQY3V" Archived-At: Subject: Re: [TLS] ESNIKeys.public_name vs. cleartext SNI X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 29 Jul 2019 15:19:12 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --5UoEkd8BXk0XZdMhMKdtrQEDnrlaVQY3V Content-Type: multipart/mixed; boundary="Vaa8pGGxkuWjCuBra1pG9fYMO3j4Zi2hy"; protected-headers="v1" From: Stephen Farrell To: Ben Schwartz Cc: Christian Huitema , "tls@ietf.org" Message-ID: <2dc17395-c2f4-7a70-5c65-6e2f62c6e6ee@cs.tcd.ie> Subject: Re: [TLS] ESNIKeys.public_name vs. cleartext SNI References: <84f41a5a-b543-2fdb-8af0-b923dccd7693@cs.tcd.ie> <05501e58-6d97-c2b6-6e76-bc4c3b2f4579@huitema.net> <2997ba60-6d01-5440-cd3d-66651443253d@cs.tcd.ie> <9d2d09a6-2435-0f5c-9617-8b3e2a16ff32@cs.tcd.ie> In-Reply-To: --Vaa8pGGxkuWjCuBra1pG9fYMO3j4Zi2hy Content-Type: multipart/mixed; boundary="------------C69E38A9F4987A7F191138B1" Content-Language: en-GB This is a multi-part message in MIME format. --------------C69E38A9F4987A7F191138B1 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hiya, On 29/07/2019 16:07, Ben Schwartz wrote: >=20 > I mean "so that esni_retry_requested can work".=20 Ah, gotcha. Fair point. Using public_name ought make this much more likely to work if it's needed. Ta, S. > This is the ESNI fallback > mechanism, where the server delivers a fresh ESNIKeys in-band, and the > client closes the socket and tries again. The client will only accept = the > new ESNIKeys if the server's provided certificate validates for > public_name, but if the server has multiple public names, it will not i= n > general know which certificate to serve unless the client sets sni =3D > public_name. >=20 > Admittedly, having multiple public names in separate certificates may n= ot > be a common case, but as long as we view it as in-scope, we have to req= uire > sni =3D public_name for general-purpose clients. Special-purpose clien= ts > that have additional out-of-band information (like knowing that the ser= ver > only has one public name) are of course able to do whatever they want; > they're no longer tightly bound by the standard. --------------C69E38A9F4987A7F191138B1 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------C69E38A9F4987A7F191138B1-- --Vaa8pGGxkuWjCuBra1pG9fYMO3j4Zi2hy-- --5UoEkd8BXk0XZdMhMKdtrQEDnrlaVQY3V Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAl0/DmYACgkQWrL68XsX K+pjSg/6ArqQSVNRbsKRf46sPgTiJ5vn1eJIC8QdefBTPuoPJMv+Icconk+gcKoB O1fYrLytsMFthQGTL+fQI5L8K2ou4tR8D3z/eY4c9jXTuTNSjBZE86zF/581IrFk KP8ImREzfxha15ahWWYwEPPp5qAO+nnSEi5p0OPRZUxwsTLZuMxhKuPb7La86MSW B/Vi5it70DbdAkREVvf8nMOd/QP/3HE37RNkfC9115ZWIow//u4SQ3NWSq3Ym1L/ PDqxTmZ6KNTy1Zot+0XgqTIfcyykxe2jWOTvdG+qlyzlUXQb0btDYNZiNb4F+L67 L+Ogd//DWRLd6YZjC3waLddYDlKhqhlLKvbtV4ycu7OPinQzE9dTSVt0f2CZyWsu GkBKdlyAN9DgPxPl0yXgOT6HIFIAR2TL0uf22Kz+WrqMjwaHo+/d+XqEgd7fBcKy 3h7fI48+anNHLz4cFWZTRnA358DpPEhSU6yGKX/O6gdWJ8gzk8oUe3AY+h2swNOL 1U6Eb1I+4pbxiHSOwg5wA4Gp6rVwUJdG2toTYiAHTPTdyQH2S9RUaI7fMb+QFWIa Z0fFre2pJ+KOVF6OQk4m2rEUYuH8dLL791zdU2utQy/yl+KEEUAegsrucTUm25o8 iMiKfDTPdN3g4Al+GiDusTk0wpcIk+LLLLEjHvHRWqdK7WL6QP8= =v2mz -----END PGP SIGNATURE----- --5UoEkd8BXk0XZdMhMKdtrQEDnrlaVQY3V-- From nobody Mon Jul 29 12:14:42 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7483F12001A for ; Mon, 29 Jul 2019 12:14:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OLPeJ1kOvaPY for ; Mon, 29 Jul 2019 12:14:39 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0077F120019 for ; Mon, 29 Jul 2019 12:14:38 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 2C0A1BE2C for ; Mon, 29 Jul 2019 20:14:36 +0100 (IST) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id h3OgyfJZ7_2h for ; Mon, 29 Jul 2019 20:14:33 +0100 (IST) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 879B5BDCF for ; Mon, 29 Jul 2019 20:14:33 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1564427673; bh=Ah7IprXjDMLeJwfjyOE2HZ89ensAU0T6MyjtYdTWiWY=; h=Subject:To:References:From:Date:In-Reply-To:From; b=SiG0EI9dRIiqlvCqYBzP/9Sc+o0iaRMjUESfvtMIp+PenzJJ5r1H1qATW0088v5nW slXrSIfToEn2WcQtGW7rCnXn1+rdJtc1BFOopGXCK4EYj2bVewt1nfVg8UuY3YWn7Q 4bWVWSt4VazDJMoIsuiZQrVheLq/Ehw9T/J2CAic= To: "tls@ietf.org" References: <8c903f04-7605-be98-5813-688d1ef88c55@cs.tcd.ie> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <4b2de58d-1957-ca48-59ab-521e7a5b510f@cs.tcd.ie> Date: Mon, 29 Jul 2019 20:14:32 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: <8c903f04-7605-be98-5813-688d1ef88c55@cs.tcd.ie> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="kQyGRrqEQLyAIPaY5uRf5tXvMZwrUj3Bb" Archived-At: Subject: Re: [TLS] ESNI GREASE - answer needed? X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 29 Jul 2019 19:14:41 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --kQyGRrqEQLyAIPaY5uRf5tXvMZwrUj3Bb Content-Type: multipart/mixed; boundary="n6Ue66xQsxR3BcuFO8GsI10UwCRaWykup"; protected-headers="v1" From: Stephen Farrell To: "tls@ietf.org" Message-ID: <4b2de58d-1957-ca48-59ab-521e7a5b510f@cs.tcd.ie> Subject: Re: ESNI GREASE - answer needed? References: <8c903f04-7605-be98-5813-688d1ef88c55@cs.tcd.ie> In-Reply-To: <8c903f04-7605-be98-5813-688d1ef88c55@cs.tcd.ie> --n6Ue66xQsxR3BcuFO8GsI10UwCRaWykup Content-Type: multipart/mixed; boundary="------------3EE9D4A4BDE2F40BFA81C7BF" Content-Language: en-GB This is a multi-part message in MIME format. --------------3EE9D4A4BDE2F40BFA81C7BF Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hiya, (Non-stylishly responding to myself, but sometimes you gotta...:-) I think I understand this better now and while I still figure a change is needed I'm not 100% sure exactly what'd be right. The issue I think is that draft-04 doesn't cover the case of a server that implements ESNI but has no ESNIKeys setup, In that case I think the right option in response to GREASE (or what may be a real but misguided attempt at ESNI) is to randomly return either a 16 octet value or a value that is sized to be like a fake ESNIKeys, with e.g. 70-100 octets or so. (That could be encoded into TLS presentation syntax in various ways so I'll not suggest one exact way for now.) (Before I waste time coding that up:-) Do we think the above is correct? Thanks, S. On 26/07/2019 18:31, Stephen Farrell wrote: >=20 > Hiya, >=20 > I've started coding up the GREASE stuff from draft -04. >=20 > Aren't we missing some answering octets in EncryptedExtensions > to make it harder to tell if the CH had a real or GREASEd ESNI? >=20 > Maybe something like: >=20 > enum { > esni_accept(0), > esni_retry_request(1), > esni_grease(2), > } ServerESNIResponseType; >=20 > struct { > ServerESNIResponseType response_type; > select (response_type) { > case esni_accept: uint8 nonce[16]; > case esni_retry_request: ESNIKeys retry_keys<1..2^16-1>; > case esni_grease: uint8 grease[16]; > } > } ServerEncryptedSNI; >=20 > Cheers, > S. >=20 >=20 > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls >=20 --------------3EE9D4A4BDE2F40BFA81C7BF Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------3EE9D4A4BDE2F40BFA81C7BF-- --n6Ue66xQsxR3BcuFO8GsI10UwCRaWykup-- --kQyGRrqEQLyAIPaY5uRf5tXvMZwrUj3Bb Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAl0/RZgACgkQWrL68XsX K+rk6g//QZmZyQLZjVtbSQR+BfDZGMvZRD31HCZih2MSotR7IPsvc1mmtCUuqliQ 97NmGHGZy//fBpzTMxR+jBrUmQq2zo2+hsr8doO1dhtTgklg1BhJoG6jPuRbZhm6 fzP/yy+XlJX6oZuhSHHq0uHMMqv1PnuQEnB9XOQBPzJrKiSL9b0J9TVdQ06dkaUO W5RrTw3dIooy/oyVm3rAswdP8RJ5I5BTOtvqpW20XCU92UlKZxrgRAYiNj2XEmlz w5P8GZUJq3t6iEn7eOnvySqv/PzgGpcI3lVfv/5myaPCU5xTW1d4xbe6vbZ/CQS4 um+hb6zEnzjNL0r8xLn9O/b3WFctm4gDqvQwkziyBpm9QDVbURi8mR74PQauIcSI HSX7yKmt3MqByNLCFh/mMd02EFswmPu/OcbMSBjJ8VeUq3ZwmgVsIsfLsT3t70RG uWyUnk3dV39Ky2nCfZQ2X5I8khRKIHUm0NQRZbyd35iZbMUSrlpfNVZqLztxYabK xJwDPayuzOhZ0sAaDppXqZWLOFLW5SY1uTHP7y4CfmPZVPsY+lRB/TWkXu81+gSK DfiGmDTc//O8YIMv2eUzbiMoEZMg4bT4numgGHZbX77E4Ehvv3Lppr8eFduvImEu GM/t17PbySjFPxZJBdOBabOdocXwjl0uhlTFouFAmxl6pyqfx+c= =7HKw -----END PGP SIGNATURE----- --kQyGRrqEQLyAIPaY5uRf5tXvMZwrUj3Bb-- From nobody Mon Jul 29 13:59:20 2019 Return-Path: X-Original-To: tls@ietf.org Delivered-To: tls@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 0C5B812006B; Mon, 29 Jul 2019 13:58:46 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: tls@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.99.1 Auto-Submitted: auto-generated Precedence: bulk Reply-To: tls@ietf.org Message-ID: <156443392593.28006.14329015667402703120@ietfa.amsl.com> Date: Mon, 29 Jul 2019 13:58:46 -0700 Archived-At: Subject: [TLS] I-D Action: draft-ietf-tls-grease-03.txt X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 29 Jul 2019 20:58:54 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Transport Layer Security WG of the IETF. Title : Applying GREASE to TLS Extensibility Author : David Benjamin Filename : draft-ietf-tls-grease-03.txt Pages : 12 Date : 2019-07-29 Abstract: This document describes GREASE (Generate Random Extensions And Sustain Extensibility), a mechanism to prevent extensibility failures in the TLS ecosystem. It reserves a set of TLS protocol values that may be advertised to ensure peers correctly handle unknown values. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-tls-grease/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-tls-grease-03 https://datatracker.ietf.org/doc/html/draft-ietf-tls-grease-03 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-tls-grease-03 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Mon Jul 29 14:00:37 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B5AF0120162 for ; Mon, 29 Jul 2019 14:00:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.251 X-Spam-Level: X-Spam-Status: No, score=-9.251 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.249, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, USER_IN_DEF_SPF_WL=-7.5] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=chromium.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id O-CRO11O21NW for ; Mon, 29 Jul 2019 14:00:29 -0700 (PDT) Received: from mail-qt1-x830.google.com (mail-qt1-x830.google.com [IPv6:2607:f8b0:4864:20::830]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9D92A1203ED for ; Mon, 29 Jul 2019 14:00:29 -0700 (PDT) Received: by mail-qt1-x830.google.com with SMTP id r6so56675676qtt.0 for ; Mon, 29 Jul 2019 14:00:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=KdCEVVAwoNbHZRp5u8JE5zd8InuI2ipLDalXU3hqiPg=; b=TABi4uEuKBSst1BQz04RKIDnYFrM6MTCu5iZXTB47onFLHCs/7xv0wKD3SPkWCjeLT IDfI95FH2kEj53HCPDv5QMZBlyPvq4afFmLm1YOoR/bS/x065Vob1OCsyqhiIdw9MDP+ ujOAHrXaI++mE462yUmgPkGUI27HRXD2/Cglw= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=KdCEVVAwoNbHZRp5u8JE5zd8InuI2ipLDalXU3hqiPg=; b=Hkar5BhF6FgXT6jFMY6nTSL7N8Ya+cLIDJpg4NBU5kY0EsNrRcSQC5wt1XQkiCYKxh licVzlNxTTOlRtRxKSl5adzEdFykeniL4Rmz6QWMgwgTIFMxvDZ0uxIUhXTCYTlRrkJb keXSR66d41o79WBFINuI/JA24wO8mk/eg2GYP58doyRCa4uoVmlFQm52PhdBCMgmf10P 1btciQ2dnRF4EUnNABt/9EOCIosFLxcYtvElvnuu4tsD9eB6jDEufasbGWBgtyoRvXwS u3lSWTSsHY186e36svjvL7X8CbKM8SvSv96yBfW+/zUM4KmWI5wqju+jt53AYhhmtItL qpvw== X-Gm-Message-State: APjAAAUaVHzmXrMWcRd29q5jbA5wvcR1Fct0xStZMYGE+5EZXCTrE7OW A5Jqo3S1hNnywFzqjr/E51NKOCOd/RwLGpvycVWm X-Google-Smtp-Source: APXvYqzE1gqPZmfocLJ8XwlAGM4jtKPTXsakd3NEilfiC0DMsSGXeVs886bMrH1+72rW7m/DCnc9KdvyFz80XBwfjJo= X-Received: by 2002:a0c:b163:: with SMTP id r32mr81754713qvc.169.1564434028434; Mon, 29 Jul 2019 14:00:28 -0700 (PDT) MIME-Version: 1.0 References: <20190703171111.GK13810@kduck.mit.edu> In-Reply-To: From: David Benjamin Date: Mon, 29 Jul 2019 17:00:12 -0400 Message-ID: To: Benjamin Kaduk Cc: draft-ietf-tls-grease.all@ietf.org, "" Content-Type: multipart/alternative; boundary="0000000000008a7284058ed82e1a" Archived-At: Subject: Re: [TLS] AD review of draft-ietf-tls-grease-02 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 29 Jul 2019 21:00:37 -0000 --0000000000008a7284058ed82e1a Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Changes in draft-ietf-tls-grease-03. On Mon, Jul 8, 2019 at 6:23 PM David Benjamin wrote= : > Thanks for the comments! I've addressed them in > https://github.com/tlswg/draft-ietf-tls-grease/pull/10. > > On Wed, Jul 3, 2019 at 1:11 PM Benjamin Kaduk wrote: > >> Section 1 >> >> The TLS protocol [RFC8446] includes several points of extensibility, >> including the list of cipher suites and the list of extensions. The >> values in these lists identify implementation capabilities. TLS >> >> We could probably make this text a little more precise (for one, there's >> not a single list of extensions since many messages can carry >> extensions). So, maybe "the list of cipher suites and several lists of >> extensions" and "The values transmitted in these lists"? >> > > Done. > > >> Section 2 >> >> Can we add an editorial note that values prefaced with "{TBD}" are >> suggested values but subject to change prior to final allocation by >> IANA? >> > > Done. Also made the other such notes match the style used in the TLS 1.3 > draft. > > >> Future versions of TLS or DTLS [RFC6347] MUST NOT use any of the >> above values as versions. >> >> Process-wise, this feels like an attempt to Update: the (D)TLS core >> specs, which we can't do in an Informational document. So it would >> probably be better to say something "The values thusly allocated are no >> longer available for use as version numbers by (D)TLS implemnetations". >> Things are made somewhat awkward by there not being a registry of >> protocol versions, sadly... >> > > Done. > > >> Section 3.1 >> >> Are there any of these for which we want to say "the client MUST NOT >> advertise a list consisting solely of GREASE values"? It would probably >> be fine to do this for, say, key_share, but not for, say, cipher_suites. >> But perhaps the reader will be smart enough to figure out what works >> without prodding from us... >> > > I dunno, I feel like that's a bit overkill, but I can include something i= n > that vein if others disagree. A cipher suite list full of GREASE is > functionally equivalent to a list containing some weird cipher no one > implements. > > >> Clients MUST reject GREASE values when negotiated by the server. >> Specifically, the client MUST fail the connection if a GREASE value >> appears any in the following: >> >> I did not attempt to audit the (omitted) list for completeness; the >> first sentence should cover any situations that are not specifically >> listed, right? >> > > It should. I replaced "Specifically" with "In particular" so that's > clearer. > > >> Section 3.2 >> >> When processing a ClientHello, servers MUST NOT treat GREASE values >> differently from any unknown value. Servers MUST NOT negotiate any >> GREASE value when offered in a ClientHello. Servers MUST correctly >> ignore unknown values in a ClientHello and attempt to negotiate with >> one of the remaining parameters. >> >> Similarly to the above, we might consider adding a parenthetical noting >> that there may not be any remaining valid parameters, and that's not >> necessarily fatal. >> > > Done. > > >> Note that these requirements are restatements or corollaries of >> existing server requirements in TLS. >> >> (side note) Some future reviewers might complain about using normative >> language to duplicate exisiting requirements from other documents; in >> this case, I don't mind, myself. >> >> Section 4.1 >> >> o A server MAY select one or more GREASE extension values and >> advertise corresponding extensions with varying length and >> contents. >> >> nit: I don't think "corresponding" is quite the right word; maybe >> "advertise those extensions"? >> > > Rephrased this and elsewhere. > > >> o A server MAY select one or more GREASE signature algorithm values >> and advertise them in the "signature_algorithms" extension. >> >> I'm not necessarily expecting any action based on this comment, but I >> note that status_request, signed_certificate_timestamp, >> certificate_authorities, oid_filters, and signature_algorithms_cert are >> also currently defined for CertificateRequest but we do not call out any >> extension-specific greasing for them. Of that list, only >> signature_algorithms_cert seems like it might be calling out for special >> handling, to me... >> > > Added signature_algorithms_cert. > > >> Section 4.2 >> >> When processing a CertificateRequest or NewSessionTicket, clients >> MUST NOT treat GREASE values differently from any unknown value. >> Clients MUST NOT negotiate any GREASE value when offered by the >> server. Clients MUST correctly ignore unknown values offered by the >> server and attempt to negotiate with one of the remaining parameters. >> >> (following the theme) I don't remember any cases where the client can >> succeed if the list becomes empty after pruning unknown values ... if we >> are deciding that we want to say anything on this topic at all. >> > > Added a similar parenthetical. > > >> Section 5 >> >> Implementations advertising GREASE values SHOULD select them at >> random. This is intended to encourage implementations to ignore all >> unknown values rather than any individual value. Implementations >> MUST honor protocol specifications when sending GREASE values. For >> instance, implementations sending multiple GREASE values as >> extensions MUST NOT send the same GREASE value twice. >> >> Feel free to tell me that I'm being internally inconsistent, but in this >> case "MUST NOT send the same GREASE value twice" does not seem like a >> good place to use normative language to restate an existing requirement. >> So I'd rather see lowercase "must not" and possibly a section reference >> to 8446 =C2=A7 4.2 ("[t]here MUST NOT be more than one extension of the = same >> type in a given extension block."). >> > > Rephrased this. > > >> Section 6 >> [[TODO: Update IANA considerations for TLS 1.3 and rebase over draft- >> ietf-tls-iana-registry-updates.]] >> >> Can the shepherd please work with the author to make the needed changes? >> >> IIRC the main change for TLS 1.3 is the "TLS 1.3" column for >> extensiontype values. >> >> Since this document is Informational, we have to be Recommended "N" for >> everything. >> > > Oh oops, I must have missed this when rebasing over TLS 1.3. Added the > relevant columns. > > >> Thanks for the note about the specific values listed being just >> suggestions. >> >> --0000000000008a7284058ed82e1a Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Changes in=C2=A0draft-ietf-tls-grease-03.

On Mon, Jul = 8, 2019 at 6:23 PM David Benjamin <davidben@chromium.org> wrote:
Thanks for the comments! I&#= 39;ve addressed them in=C2=A0https://github.com/tlswg/draft-ietf-= tls-grease/pull/10.

On= Wed, Jul 3, 2019 at 1:11 PM Benjamin Kaduk <kaduk@mit.edu> wrote:
Section 1

=C2=A0 =C2=A0The TLS protocol [RFC8446] includes several points of extensib= ility,
=C2=A0 =C2=A0including the list of cipher suites and the list of extensions= .=C2=A0 The
=C2=A0 =C2=A0values in these lists identify implementation capabilities.=C2= =A0 TLS

We could probably make this text a little more precise (for one, there'= s
not a single list of extensions since many messages can carry
extensions).=C2=A0 So, maybe "the list of cipher suites and several li= sts of
extensions" and "The values transmitted in these lists"?
=

Done.
=C2=A0
Section 2

Can we add an editorial note that values prefaced with "{TBD}" ar= e
suggested values but subject to change prior to final allocation by
IANA?

Done. Also made the other such no= tes match the style used in the TLS 1.3 draft.
=C2=A0
=C2=A0 =C2=A0Future versions of TLS or DTLS [RFC6347] MUST NOT use any of t= he
=C2=A0 =C2=A0above values as versions.

Process-wise, this feels like an attempt to Update: the (D)TLS core
specs, which we can't do in an Informational document.=C2=A0 So it woul= d
probably be better to say something "The values thusly allocated are n= o
longer available for use as version numbers by (D)TLS implemnetations"= .
Things are made somewhat awkward by there not being a registry of
protocol versions, sadly...

Done.
=
=C2=A0
Section 3.1

Are there any of these for which we want to say "the client MUST NOT advertise a list consisting solely of GREASE values"?=C2=A0 It would p= robably
be fine to do this for, say, key_share, but not for, say, cipher_suites. But perhaps the reader will be smart enough to figure out what works
without prodding from us...

I dunno, I = feel like that's a bit overkill, but I can include something in that ve= in if others disagree. A cipher suite list full of GREASE is functionally e= quivalent to a list containing some weird cipher no one implements.
=C2=A0
=C2=A0 =C2=A0Clients MUST reject GREASE values when negotiated by the serve= r.
=C2=A0 =C2=A0Specifically, the client MUST fail the connection if a GREASE = value
=C2=A0 =C2=A0appears any in the following:

I did not attempt to audit the (omitted) list for completeness; the
first sentence should cover any situations that are not specifically
listed, right?

It should. I replaced &q= uot;Specifically" with "In particular" so that's clearer= .
=C2=A0
Section 3.2

=C2=A0 =C2=A0When processing a ClientHello, servers MUST NOT treat GREASE v= alues
=C2=A0 =C2=A0differently from any unknown value.=C2=A0 Servers MUST NOT neg= otiate any
=C2=A0 =C2=A0GREASE value when offered in a ClientHello.=C2=A0 Servers MUST= correctly
=C2=A0 =C2=A0ignore unknown values in a ClientHello and attempt to negotiat= e with
=C2=A0 =C2=A0one of the remaining parameters.

Similarly to the above, we might consider adding a parenthetical noting
that there may not be any remaining valid parameters, and that's not necessarily fatal.

Done.
=C2= =A0
=C2=A0 =C2=A0Note that these requirements are restatements or corollaries o= f
=C2=A0 =C2=A0existing server requirements in TLS.

(side note) Some future reviewers might complain about using normative
language to duplicate exisiting requirements from other documents; in
this case, I don't mind, myself.

Section 4.1

=C2=A0 =C2=A0o=C2=A0 A server MAY select one or more GREASE extension value= s and
=C2=A0 =C2=A0 =C2=A0 advertise corresponding extensions with varying length= and
=C2=A0 =C2=A0 =C2=A0 contents.

nit: I don't think "corresponding" is quite the right word; m= aybe
"advertise those extensions"?

Rephrased this and elsewhere.
=C2=A0
=C2=A0 =C2=A0o=C2=A0 A server MAY select one or more GREASE signature algor= ithm values
=C2=A0 =C2=A0 =C2=A0 and advertise them in the "signature_algorithms&q= uot; extension.

I'm not necessarily expecting any action based on this comment, but I note that status_request, signed_certificate_timestamp,
certificate_authorities, oid_filters, and signature_algorithms_cert are
also currently defined for CertificateRequest but we do not call out any extension-specific greasing for them.=C2=A0 Of that list, only
signature_algorithms_cert seems like it might be calling out for special handling, to me...

Added signature_algo= rithms_cert.
=C2=A0
Section 4.2

=C2=A0 =C2=A0When processing a CertificateRequest or NewSessionTicket, clie= nts
=C2=A0 =C2=A0MUST NOT treat GREASE values differently from any unknown valu= e.
=C2=A0 =C2=A0Clients MUST NOT negotiate any GREASE value when offered by th= e
=C2=A0 =C2=A0server.=C2=A0 Clients MUST correctly ignore unknown values off= ered by the
=C2=A0 =C2=A0server and attempt to negotiate with one of the remaining para= meters.

(following the theme) I don't remember any cases where the client can succeed if the list becomes empty after pruning unknown values ... if we are deciding that we want to say anything on this topic at all.

Added a similar parenthetical.
=C2=A0
Section 5

=C2=A0 =C2=A0Implementations advertising GREASE values SHOULD select them a= t
=C2=A0 =C2=A0random.=C2=A0 This is intended to encourage implementations to= ignore all
=C2=A0 =C2=A0unknown values rather than any individual value.=C2=A0 Impleme= ntations
=C2=A0 =C2=A0MUST honor protocol specifications when sending GREASE values.= =C2=A0 For
=C2=A0 =C2=A0instance, implementations sending multiple GREASE values as =C2=A0 =C2=A0extensions MUST NOT send the same GREASE value twice.

Feel free to tell me that I'm being internally inconsistent, but in thi= s
case "MUST NOT send the same GREASE value twice" does not seem li= ke a
good place to use normative language to restate an existing requirement. So I'd rather see lowercase "must not" and possibly a section= reference
to 8446 =C2=A7 4.2 ("[t]here MUST NOT be more than one extension of th= e same
type in a given extension block.").

Rephrased this.
=C2=A0
Section 6
=C2=A0 =C2=A0[[TODO: Update IANA considerations for TLS 1.3 and rebase over= draft-
=C2=A0 =C2=A0ietf-tls-iana-registry-updates.]]

Can the shepherd please work with the author to make the needed changes?
IIRC the main change for TLS 1.3 is the "TLS 1.3" column for
extensiontype values.

Since this document is Informational, we have to be Recommended "N&quo= t; for
everything.

Oh oops, I must have missed= this when rebasing over TLS 1.3. Added the relevant columns.=C2=A0
=C2=A0
Thanks for the note about the specific values listed being just
suggestions.

--0000000000008a7284058ed82e1a-- From nobody Mon Jul 29 15:32:26 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2BDF21200B9 for ; Mon, 29 Jul 2019 15:32:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.5 X-Spam-Level: X-Spam-Status: No, score=-17.5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id N_DWNMPKypsl for ; Mon, 29 Jul 2019 15:32:21 -0700 (PDT) Received: from mail-ot1-x32d.google.com (mail-ot1-x32d.google.com [IPv6:2607:f8b0:4864:20::32d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9F4B81200B1 for ; Mon, 29 Jul 2019 15:32:21 -0700 (PDT) Received: by mail-ot1-x32d.google.com with SMTP id q20so64171076otl.0 for ; Mon, 29 Jul 2019 15:32:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=JmqsXRNakTsoBrT+BWdf3NDSkzSWHZeHufIvNgYQY58=; b=uRotqM2TsLFXVYv4Gq+RutnXHQARrts2RTwylmA20qqOxG884XBfiHnBIKj7UQvDCw sg4kdzdxAVDY69h4lseHvRAHjXXWDDn6G0qXeYST+Zc3etUOqisvGW2alKhAl4dqKtEr xyJ7IvmCbgXlXObHrJbdzhmN6A9Ho75MwjuPfXW615Amz5zW+P3JZrohrt8o+ZWrF6kf cPdCbqrUwBov8CA9fYT+8dKk0JX3aefCOyyNubypOQFUjibiafehwy41cKdB0uhG+Vd9 cobL5EGL9hqZT4Tb//ID1OpLj/27DGayfdGarcrJLzPlZcKq6naLoOu6RvQXtN28ugiT A+Jg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=JmqsXRNakTsoBrT+BWdf3NDSkzSWHZeHufIvNgYQY58=; b=HchbXiHg8Eet7U19g4FiZbtdl+r4FjMH4305T94WO28MEdOD1UpUU2eey4nfoKlSUh bNdg8onypC4QfQmkM8GOjIRSKIL340ewUCweT2KVhjfZQHMTu+wLnPWjnuZEwllQAbRr X+WFlWoB5FXjgbTJ3BHdX0bzJYqjk9VQi312kSmJWe58tLIk2LflMCsKGgxHaghxoJuR Zf9mm0ar2XGaFGhwvgEUrDNQAIlvmTTdXWNPcYVQc23b/8Nv4XmmoaVaAPFE8Txg5wUt CvnXk9Cbf5LHR0nAz3OrlpKdQ9CNZwFEXgYyz5qz29luQTq400cJdoS0AoaIAiqnbDNb y72A== X-Gm-Message-State: APjAAAXAbvZ61C2FpKF2P8mcTWIzFJhLXkKzZqOf+i5qP8WbA2bxH29C LydHmmAvJasG4Mjd1KDZfhayRg6eodKwxK0I/87Wn25V X-Google-Smtp-Source: APXvYqyfevPdXQNrklJtK/hYkQeJ9f5LbHLFvZZdQ0uuGhHwG5AePcdPL2ua3DSY1DHsLOpFW14MbXF6zehaSaL6n0o= X-Received: by 2002:a9d:744f:: with SMTP id p15mr3201940otk.287.1564439540713; Mon, 29 Jul 2019 15:32:20 -0700 (PDT) MIME-Version: 1.0 References: <8c903f04-7605-be98-5813-688d1ef88c55@cs.tcd.ie> <4b2de58d-1957-ca48-59ab-521e7a5b510f@cs.tcd.ie> In-Reply-To: <4b2de58d-1957-ca48-59ab-521e7a5b510f@cs.tcd.ie> From: Steven Valdez Date: Mon, 29 Jul 2019 15:32:09 -0700 Message-ID: To: Stephen Farrell Cc: "tls@ietf.org" Content-Type: multipart/alternative; boundary="000000000000191c82058ed977ac" Archived-At: Subject: Re: [TLS] ESNI GREASE - answer needed? X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 29 Jul 2019 22:32:24 -0000 --000000000000191c82058ed977ac Content-Type: text/plain; charset="UTF-8" I don't think the server needs any special logic in the GREASE case? If the server doesn't support ESNI, it won't respond with an ESNI extension and the client will continue the handshake as normal. If the server does support ESNI, it will send an esni_retry_requested with the retry keys (since the client's record_digest is bogus) and then the client will continue the handshake as normal. A server that doesn't have ESNI keys configured shouldn't be responding to ESNI and should instead just ignore the ESNI extensions (as if it didn't know what it was). On Mon, Jul 29, 2019 at 12:14 PM Stephen Farrell wrote: > > Hiya, > > (Non-stylishly responding to myself, but sometimes you > gotta...:-) > > I think I understand this better now and while I still > figure a change is needed I'm not 100% sure exactly what'd > be right. > > The issue I think is that draft-04 doesn't cover the case > of a server that implements ESNI but has no ESNIKeys setup, > > In that case I think the right option in response to GREASE > (or what may be a real but misguided attempt at ESNI) is to > randomly return either a 16 octet value or a value that is > sized to be like a fake ESNIKeys, with e.g. 70-100 octets or > so. (That could be encoded into TLS presentation syntax in > various ways so I'll not suggest one exact way for now.) > > (Before I waste time coding that up:-) Do we think the > above is correct? > > Thanks, > S. > > > On 26/07/2019 18:31, Stephen Farrell wrote: > > > > Hiya, > > > > I've started coding up the GREASE stuff from draft -04. > > > > Aren't we missing some answering octets in EncryptedExtensions > > to make it harder to tell if the CH had a real or GREASEd ESNI? > > > > Maybe something like: > > > > enum { > > esni_accept(0), > > esni_retry_request(1), > > esni_grease(2), > > } ServerESNIResponseType; > > > > struct { > > ServerESNIResponseType response_type; > > select (response_type) { > > case esni_accept: uint8 nonce[16]; > > case esni_retry_request: ESNIKeys retry_keys<1..2^16-1>; > > case esni_grease: uint8 grease[16]; > > } > > } ServerEncryptedSNI; > > > > Cheers, > > S. > > > > > > _______________________________________________ > > TLS mailing list > > TLS@ietf.org > > https://www.ietf.org/mailman/listinfo/tls > > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > -- Steven Valdez | Chrome Networking | svaldez@google.com | 210-692-4742 --000000000000191c82058ed977ac Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
I don't think the server needs any special logic = in the GREASE case?

If the server doesn't supp= ort ESNI, it won't respond with an ESNI extension and the client will c= ontinue the handshake as normal.

If the server doe= s support ESNI, it will send an esni_retry_requested with the retry keys (s= ince the client's record_digest is bogus) and then the client will cont= inue the handshake as normal.

A server that doesn&= #39;t have ESNI keys configured shouldn't be responding to ESNI and sho= uld instead just ignore the ESNI extensions (as if it didn't know what = it was).

=C2=A0

On Mon, Jul 29, 2019 at 12:14= PM Stephen Farrell <stephe= n.farrell@cs.tcd.ie> wrote:

Hiya,

(Non-stylishly responding to myself, but sometimes you
gotta...:-)

I think I understand this better now and while I still
figure a change is needed I'm not 100% sure exactly what'd
be right.

The issue I think is that draft-04 doesn't cover the case
of a server that implements ESNI but has no ESNIKeys setup,

In that case I think the right option in response to GREASE
(or what may be a real but misguided attempt at ESNI) is to
randomly return either a 16 octet value or a value that is
sized to be like a fake ESNIKeys, with e.g. 70-100 octets or
so. (That could be encoded into TLS presentation syntax in
various ways so I'll not suggest one exact way for now.)

(Before I waste time coding that up:-) Do we think the
above is correct?

Thanks,
S.


On 26/07/2019 18:31, Stephen Farrell wrote:
>
> Hiya,
>
> I've started coding up the GREASE stuff from draft -04.
>
> Aren't we missing some answering octets in EncryptedExtensions
> to make it harder to tell if the CH had a real or GREASEd ESNI?
>
> Maybe something like:
>
>=C2=A0 =C2=A0 =C2=A0 =C2=A0enum {
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0esni_accept(0),
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0esni_retry_request(1),
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0esni_grease(2),
>=C2=A0 =C2=A0 =C2=A0 =C2=A0} ServerESNIResponseType;
>
>=C2=A0 =C2=A0 =C2=A0 =C2=A0struct {
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0ServerESNIResponseType respons= e_type;
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0select (response_type) {
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0case esni_accept= :=C2=A0 =C2=A0 =C2=A0 =C2=A0 uint8 nonce[16];
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0case esni_retry_= request: ESNIKeys retry_keys<1..2^16-1>;
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0case esni_grease= :=C2=A0 =C2=A0 =C2=A0 =C2=A0 uint8 grease[16];
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0}
>=C2=A0 =C2=A0 =C2=A0 =C2=A0} ServerEncryptedSNI;
>
> Cheers,
> S.
>
>
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
>
_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls


--

= Steven Valdez=C2=A0|=C2=A0Chrome Networking |=C2=A0svaldez@google.com=C2=A0|=C2=A0210-692-4742
--000000000000191c82058ed977ac-- From nobody Mon Jul 29 15:34:18 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5E1921203F0 for ; Mon, 29 Jul 2019 15:34:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9jBmD5gMoVfg for ; Mon, 29 Jul 2019 15:34:06 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4CE9712012A for ; Mon, 29 Jul 2019 15:34:05 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 13B48BE24; Mon, 29 Jul 2019 23:34:03 +0100 (IST) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fyPV80BauErb; Mon, 29 Jul 2019 23:34:01 +0100 (IST) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id AE059BE20; Mon, 29 Jul 2019 23:34:01 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1564439641; bh=J0ooYp9GoIbQKJW0jwU+i98NqAgqMn/57MH+LyALiEY=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=lNwtRpA5NQqUC373+puUXESJWPQxQRRxlGxcwZilzNsm6/qHxR2qMIaADUBdomAtx YVVpDaDBFKEpiWAoRuWLWnxwN3TwKittPDo3O3aOdbxQx/OLl2eqzbBF98+26iF7EB 98SXfJLmq78EZisE3VP2ljDaO35ltdR90p1sF+Qc= To: Steven Valdez Cc: "tls@ietf.org" References: <8c903f04-7605-be98-5813-688d1ef88c55@cs.tcd.ie> <4b2de58d-1957-ca48-59ab-521e7a5b510f@cs.tcd.ie> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <67e69531-69a2-24e3-c2e7-d95054a3382d@cs.tcd.ie> Date: Mon, 29 Jul 2019 23:34:00 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="2OkG5ONTxwyfQL3X7F0gckNWDTdidlyFO" Archived-At: Subject: Re: [TLS] ESNI GREASE - answer needed? X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 29 Jul 2019 22:34:16 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --2OkG5ONTxwyfQL3X7F0gckNWDTdidlyFO Content-Type: multipart/mixed; boundary="PQRwLimVYkWu0KXLAIZAUk4QPS5DoJxNO"; protected-headers="v1" From: Stephen Farrell To: Steven Valdez Cc: "tls@ietf.org" Message-ID: <67e69531-69a2-24e3-c2e7-d95054a3382d@cs.tcd.ie> Subject: Re: [TLS] ESNI GREASE - answer needed? References: <8c903f04-7605-be98-5813-688d1ef88c55@cs.tcd.ie> <4b2de58d-1957-ca48-59ab-521e7a5b510f@cs.tcd.ie> In-Reply-To: --PQRwLimVYkWu0KXLAIZAUk4QPS5DoJxNO Content-Type: multipart/mixed; boundary="------------7B6B323792896776E6DA48D9" Content-Language: en-GB This is a multi-part message in MIME format. --------------7B6B323792896776E6DA48D9 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 29/07/2019 23:32, Steven Valdez wrote: > A server that doesn't have ESNI keys configured shouldn't be responding= to > ESNI and should instead just ignore the ESNI extensions (as if it didn'= t > know what it was). Why? Thanks, S. --------------7B6B323792896776E6DA48D9 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------7B6B323792896776E6DA48D9-- --PQRwLimVYkWu0KXLAIZAUk4QPS5DoJxNO-- --2OkG5ONTxwyfQL3X7F0gckNWDTdidlyFO Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAl0/dFgACgkQWrL68XsX K+og+xAApzymzJTQ1X6b+nyIad3VEGgeZocZ1W9ONkEfUsF8s30Fl2cA3nFghniQ yFjS8CbRyMRRKXOJQztbCwQYFOEIafdHjDgoXCAHHTji2FxktGSnskFGrWNU2HgD Yj36PbOpw1TKYcwKesw+PQ1Pb158HCdSEHM9W9YnXmkDo7tpAxlT2SiuI0YrisCr TavIegGUF84Uif2uBV9E41a9hl8qbJew+EOgHTlou4gVHjoXhDv8aKfCfpa29ktr rP0mCw3RlgoF1ydq9DNdwbsr1wSivAOQxO0aVnJRYFtbsVF7IUtOy/uNfc5VlubN d+7MSqrEzDgpB9I82KxE9c75Mu5+M1cYtfjuCEuD5Ql1DFFFPmCd3kr5cev1aY6x GcjKHaOyCqxOAJc/lEg7bJX72soloqoR/9Xpo2jPegoSzaYs02/3Tc+qr6Oppy8u KYibZerVRvqtd2+JDPqLB4ogUGEbfMn51Jei3dUtzhdz8u2wihASTto09TtvALnA fNsO2kQYvP0vNNNPGC04f2+J9QqYvOyHYKcBmHzx2iHSKEvhgj6joR+xsd18O1bF VkJWKAcLswqtVk7kpSFhgkyZkmLCmFqGDniN4kxZsqMmYE5BNZY7LiIcpvuiEZsV JZ5pTFjEFVgWe94Upa13Hx9nv23QQqGmaO3MSfXkjhuiYSuUSmc= =7/77 -----END PGP SIGNATURE----- --2OkG5ONTxwyfQL3X7F0gckNWDTdidlyFO-- From nobody Mon Jul 29 15:53:05 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 102251200C4 for ; Mon, 29 Jul 2019 15:53:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.5 X-Spam-Level: X-Spam-Status: No, score=-17.5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HJr8Bqs4Jzed for ; Mon, 29 Jul 2019 15:53:01 -0700 (PDT) Received: from mail-oi1-x231.google.com (mail-oi1-x231.google.com [IPv6:2607:f8b0:4864:20::231]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2912812004E for ; Mon, 29 Jul 2019 15:53:01 -0700 (PDT) Received: by mail-oi1-x231.google.com with SMTP id g7so46510552oia.8 for ; Mon, 29 Jul 2019 15:53:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=hEf+bZ/Axcx3p5X65ORbIzAnZrAsm8duuaoqFrjsp8s=; b=PNRlBsS6RKvD0GlYAnOhOBIspMuwRcgIlgyvxnVuJ+nZ4oUq9b/gvn+2S3jSkzhSsl C0vkSZsOYL9mDrqSHirLzECbB0sLW0jrUyFlR5ysQxrHp0eWnt5YE6qyOECpQ5pthlyr wUJLg4ZUDMWjdY6gQymFIZDt4qKTLkNrQFP8bXXXm+woa3agH1NcP0Az25dqR6iWaRyN DyzC/oGWp21L4yo/mfwCodF+HiooXBa/tES/Pn1QQfHFkVuuS3yR6ziiwJxgyqz9QSRV jRXjzASf8sUPMmt1kRXpCBO4cQgRIcCnQ08R8AqrczewHd/7DT1+QXPMfnyuurHAwIpA dk3Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=hEf+bZ/Axcx3p5X65ORbIzAnZrAsm8duuaoqFrjsp8s=; b=od+jiJioTxV0MisZDqNX6VLwt7LYmmrkM5USDt47mwTyg9HjBcNDGaBJCvYCZGf9XI 1UQDCNnihZ+RglUXdHuO8bIRf24vQkwoLv8iyB275NXLt5oM69C8LnC+o7d9xWG7I4KI xrqPNmrG6ZIJ4ix+c7MuQNB1dCsIq9zf4qdv8Ij8NSgcf+bce4xiHsEfd1YnFTK6vVgm QTjKwXXQDnVKCad4cWeE8kTdKwZUJO7B7SGfiYTaVLweuYeM9YQ10fEcg9vI/dRn3s6R HZBgaa32okYnSdKI2VFfAVmerXFhGie0LCLmvoikROPu/Q6yI6ofw6puDrAx6zvlNoGg bIVg== X-Gm-Message-State: APjAAAXBuFjtiHGqRM1kRkG8rgk45Di1AB+bCdo2R//gle+IE2KffJBd m7br4RPSfkvOKXHc2CuCPmAkx0mKtr4FFelA8i2UUhGW X-Google-Smtp-Source: APXvYqyP3DArPL3t0+EajVz1yni3bkEu1lHPc/m4u2U72JCnJzI5KYlT3iplKiEFEqaTMxH6DcKIw1/4K/gXoIC6UwU= X-Received: by 2002:aca:a884:: with SMTP id r126mr57890404oie.11.1564440780043; Mon, 29 Jul 2019 15:53:00 -0700 (PDT) MIME-Version: 1.0 References: <8c903f04-7605-be98-5813-688d1ef88c55@cs.tcd.ie> <4b2de58d-1957-ca48-59ab-521e7a5b510f@cs.tcd.ie> <67e69531-69a2-24e3-c2e7-d95054a3382d@cs.tcd.ie> In-Reply-To: <67e69531-69a2-24e3-c2e7-d95054a3382d@cs.tcd.ie> From: Steven Valdez Date: Mon, 29 Jul 2019 15:52:48 -0700 Message-ID: To: Stephen Farrell Cc: "tls@ietf.org" Content-Type: multipart/alternative; boundary="000000000000f7e9e0058ed9c0d7" Archived-At: Subject: Re: [TLS] ESNI GREASE - answer needed? X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 29 Jul 2019 22:53:03 -0000 --000000000000f7e9e0058ed9c0d7 Content-Type: text/plain; charset="UTF-8" Without GREASE, a server who doesn't have keys can't respond with any of the existing responses (esni_accept is wrong since it can't decode the ESNI, esni_retry_request is wrong since it can't provide keys for the client to use on the retry). The only valid response would be a new record type that says it doesn't support ESNI, which becomes equivalent to just not sending the ESNI extension back in the EncryptedExtensions. With GREASE, I don't know if it's particularly useful to fake the response in the EncryptedExtensions, since network adversaries won't be able to see the contents, I suppose its presence might slightly change the size of the encrypted payload, though record padding could prevent that. On Mon, Jul 29, 2019 at 3:34 PM Stephen Farrell wrote: > > > On 29/07/2019 23:32, Steven Valdez wrote: > > A server that doesn't have ESNI keys configured shouldn't be responding > to > > ESNI and should instead just ignore the ESNI extensions (as if it didn't > > know what it was). > > Why? > > Thanks, > S. > -- Steven Valdez | Chrome Networking | svaldez@google.com | 210-692-4742 --000000000000f7e9e0058ed9c0d7 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Without GREASE, a server who doesn't have keys can'= ;t respond with any of the existing responses (esni_accept is wrong since i= t can't decode the ESNI, esni_retry_request is wrong since it can't= provide keys for the client to use on the retry). The only valid response = would be a new record type that says it doesn't support ESNI, which bec= omes equivalent to just not sending the ESNI extension back in the Encrypte= dExtensions.

With GREASE, I don't know if it's p= articularly useful to fake the response in the EncryptedExtensions, since n= etwork adversaries won't be able to see the contents, I suppose its pre= sence might slightly change the size of the encrypted payload, though recor= d padding could prevent that.


On Mon, Jul 29, 2019 at 3= :34 PM Stephen Farrell <ste= phen.farrell@cs.tcd.ie> wrote:


On 29/07/2019 23:32, Steven Valdez wrote:
> A server that doesn't have ESNI keys configured shouldn't be r= esponding to
> ESNI and should instead just ignore the ESNI extensions (as if it didn= 't
> know what it was).

Why?

Thanks,
S.


--

= Steven Valdez=C2=A0|=C2=A0Chrome Networking |=C2=A0svaldez@google.com=C2=A0|=C2=A0210-692-4742
--000000000000f7e9e0058ed9c0d7-- From nobody Mon Jul 29 15:53:47 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0C03C120125 for ; Mon, 29 Jul 2019 15:53:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.5 X-Spam-Level: X-Spam-Status: No, score=-17.5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8uQXICVWShhF for ; Mon, 29 Jul 2019 15:53:36 -0700 (PDT) Received: from mail-io1-xd2d.google.com (mail-io1-xd2d.google.com [IPv6:2607:f8b0:4864:20::d2d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CDE1E1203CC for ; Mon, 29 Jul 2019 15:53:35 -0700 (PDT) Received: by mail-io1-xd2d.google.com with SMTP id m24so123817263ioo.2 for ; Mon, 29 Jul 2019 15:53:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=4bevU3Ci4NgBOL9Qu0JAaoBoyXk5DM1hUs6uy6/mxIM=; b=OLy47Qc859618XExu6FE8RwiGFNIoUpFN98PFl1ecXiYRWnPfbjjxkIAoubPzLa7on DyR13huo1Mk8u5/P9zowXVAxUlhTq8yBMwnRlLOj8GNBsBp6rzacTP0hOa9sRXhbKYfh 5/t4StfdyVq1FtH2AG7gE7Zjt2pdR5Jr6bsqqoK+ztxekYEwKICA5aHmaLpS/JPNojzo Ayaz4oQ8eONb9WZ2F6lV3Ctsg2+ugAwFE3vFZumooy8rmk9UmOFr9mcoAXn35vUJxZne 0VVAAU5UtW92laPCkWD3dVg7YTMsW0IaDNKHbnmdByE+9o+UVSShQ6Gz+U+E9uIvKo+b WiTA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=4bevU3Ci4NgBOL9Qu0JAaoBoyXk5DM1hUs6uy6/mxIM=; b=m+pfvKK1B5uvcO84x/PaAi9RlMgCc4PO2yizMXG6oG93bDAyhiX03B5Oc6VGNYKSHZ iLXJbal97Za8wmH1lkW1JlaLhHDuDpVgh/rpVMfveitPRs4DvBV3qOZUvW/ytP4CkQon r7eAzGcFDj5GpVRnzeZY6TB8Wrk2qZE0X9zdANXAg9wQtsQyxIbV3amIzQrdz6yxovOt pwV9vZn9HRPtfg4zKw+YNAhbUsY5tCVRTjwUiXZAmw010H0vlQyvGIBjWl0T04WtXQ7R pn14cjNd9/uZRQcRHSZeZsXY5SbSDCajVwsdMHFn2pTWpyEQYiEnDV77jxETEaX57lks 1/Lw== X-Gm-Message-State: APjAAAX1le4qgcmdRMibI3d4p7/7d6HH82Gs5B7v1ZFLLMAjEWCj8D2k t4CrwnrannxReTx2CadHK+RvMnMZBRr+fL4irQEdZA== X-Google-Smtp-Source: APXvYqzL/iQNRqLAJhHusmSekku0zo+bA5XJ3756moodi2b06jZSgyA6s9TGnZEW+MqSwuzjQNXSn1nrH27FfxK9a1c= X-Received: by 2002:a02:528a:: with SMTP id d132mr109860599jab.68.1564440814791; Mon, 29 Jul 2019 15:53:34 -0700 (PDT) MIME-Version: 1.0 References: <8c903f04-7605-be98-5813-688d1ef88c55@cs.tcd.ie> <4b2de58d-1957-ca48-59ab-521e7a5b510f@cs.tcd.ie> <67e69531-69a2-24e3-c2e7-d95054a3382d@cs.tcd.ie> In-Reply-To: <67e69531-69a2-24e3-c2e7-d95054a3382d@cs.tcd.ie> From: Ben Schwartz Date: Mon, 29 Jul 2019 18:53:22 -0400 Message-ID: To: Stephen Farrell Cc: Steven Valdez , "tls@ietf.org" Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="000000000000117d2b058ed9c3eb" Archived-At: Subject: Re: [TLS] ESNI GREASE - answer needed? X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 29 Jul 2019 22:53:46 -0000 --000000000000117d2b058ed9c3eb Content-Type: multipart/alternative; boundary="0000000000000a155c058ed9c352" --0000000000000a155c058ed9c352 Content-Type: text/plain; charset="UTF-8" It sounds like you're asking for a middle ground for servers between "supports ESNI (and has ESNIKeys)" and "doesn't support ESNI". Maybe you could explain the utility of this middle ground? >From my perspective, I'd rather encourage real implementations of ESNI than enable fake ones. On Mon, Jul 29, 2019 at 6:34 PM Stephen Farrell wrote: > > > On 29/07/2019 23:32, Steven Valdez wrote: > > A server that doesn't have ESNI keys configured shouldn't be responding > to > > ESNI and should instead just ignore the ESNI extensions (as if it didn't > > know what it was). > > Why? > > Thanks, > S. > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > --0000000000000a155c058ed9c352 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
It sounds like you're asking for a middle ground for s= ervers between "supports ESNI (and has ESNIKeys)" and "doesn= 't support ESNI".=C2=A0 Maybe you could explain the utility of thi= s middle ground?

From my perspective, I'd rather enc= ourage real implementations of ESNI than enable fake ones.

<= div class=3D"gmail_quote">
On Mon, Jul= 29, 2019 at 6:34 PM Stephen Farrell <stephen.farrell@cs.tcd.ie> wrote:


On 29/07/2019 23:32, Steven Valdez wrote:
> A server that doesn't have ESNI keys configured shouldn't be r= esponding to
> ESNI and should instead just ignore the ESNI extensions (as if it didn= 't
> know what it was).

Why?

Thanks,
S.
_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls
--0000000000000a155c058ed9c352-- --000000000000117d2b058ed9c3eb Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIIS5wYJKoZIhvcNAQcCoIIS2DCCEtQCAQExDzANBglghkgBZQMEAgEFADALBgkqhkiG9w0BBwGg ghBNMIIEXDCCA0SgAwIBAgIOSBtqDm4P/739RPqw/wcwDQYJKoZIhvcNAQELBQAwZDELMAkGA1UE BhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVy c29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hBMjU2IC0gRzIwHhcNMTYwNjE1MDAwMDAwWhcNMjEw NjE1MDAwMDAwWjBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xvYmFsU2lnbiBudi1zYTEiMCAG A1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC AQoCggEBALR23lKtjlZW/17kthzYcMHHKFgywfc4vLIjfq42NmMWbXkNUabIgS8KX4PnIFsTlD6F GO2fqnsTygvYPFBSMX4OCFtJXoikP2CQlEvO7WooyE94tqmqD+w0YtyP2IB5j4KvOIeNv1Gbnnes BIUWLFxs1ERvYDhmk+OrvW7Vd8ZfpRJj71Rb+QQsUpkyTySaqALXnyztTDp1L5d1bABJN/bJbEU3 Hf5FLrANmognIu+Npty6GrA6p3yKELzTsilOFmYNWg7L838NS2JbFOndl+ce89gM36CW7vyhszi6 6LqqzJL8MsmkP53GGhf11YMP9EkmawYouMDP/PwQYhIiUO0CAwEAAaOCASIwggEeMA4GA1UdDwEB /wQEAwIBBjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwEgYDVR0TAQH/BAgwBgEB/wIB ADAdBgNVHQ4EFgQUyzgSsMeZwHiSjLMhleb0JmLA4D8wHwYDVR0jBBgwFoAUJiSSix/TRK+xsBtt r+500ox4AAMwSwYDVR0fBEQwQjBAoD6gPIY6aHR0cDovL2NybC5nbG9iYWxzaWduLmNvbS9ncy9n c3BlcnNvbmFsc2lnbnB0bnJzc2hhMmcyLmNybDBMBgNVHSAERTBDMEEGCSsGAQQBoDIBKDA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzANBgkqhkiG 9w0BAQsFAAOCAQEACskdySGYIOi63wgeTmljjA5BHHN9uLuAMHotXgbYeGVrz7+DkFNgWRQ/dNse Qa4e+FeHWq2fu73SamhAQyLigNKZF7ZzHPUkSpSTjQqVzbyDaFHtRBAwuACuymaOWOWPePZXOH9x t4HPwRQuur57RKiEm1F6/YJVQ5UTkzAyPoeND/y1GzXS4kjhVuoOQX3GfXDZdwoN8jMYBZTO0H5h isymlIl6aot0E5KIKqosW6mhupdkS1ZZPp4WXR4frybSkLejjmkTYCTUmh9DuvKEQ1Ge7siwsWgA NS1Ln+uvIuObpbNaeAyMZY0U5R/OyIDaq+m9KXPYvrCZ0TCLbcKuRzCCBB4wggMGoAMCAQICCwQA AAAAATGJxkCyMA0GCSqGSIb3DQEBCwUAMEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAt IFIzMRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWduMB4XDTExMDgwMjEw MDAwMFoXDTI5MDMyOTEwMDAwMFowZDELMAkGA1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24g bnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVyc29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hB MjU2IC0gRzIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCg/hRKosYAGP+P7mIdq5NB Kr3J0tg+8lPATlgp+F6W9CeIvnXRGUvdniO+BQnKxnX6RsC3AnE0hUUKRaM9/RDDWldYw35K+sge C8fWXvIbcYLXxWkXz+Hbxh0GXG61Evqux6i2sKeKvMr4s9BaN09cqJ/wF6KuP9jSyWcyY+IgL6u2 52my5UzYhnbf7D7IcC372bfhwM92n6r5hJx3r++rQEMHXlp/G9J3fftgsD1bzS7J/uHMFpr4MXua eoiMLV5gdmo0sQg23j4pihyFlAkkHHn4usPJ3EePw7ewQT6BUTFyvmEB+KDoi7T4RCAZDstgfpzD rR/TNwrK8/FXoqnFAgMBAAGjgegwgeUwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8C AQEwHQYDVR0OBBYEFCYkkosf00SvsbAbba/udNKMeAADMEcGA1UdIARAMD4wPAYEVR0gADA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzA2BgNVHR8E LzAtMCugKaAnhiVodHRwOi8vY3JsLmdsb2JhbHNpZ24ubmV0L3Jvb3QtcjMuY3JsMB8GA1UdIwQY MBaAFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQACAFVjHihZCV/IqJYt 7Nig/xek+9g0dmv1oQNGYI1WWeqHcMAV1h7cheKNr4EOANNvJWtAkoQz+076Sqnq0Puxwymj0/+e oQJ8GRODG9pxlSn3kysh7f+kotX7pYX5moUa0xq3TCjjYsF3G17E27qvn8SJwDsgEImnhXVT5vb7 qBYKadFizPzKPmwsJQDPKX58XmPxMcZ1tG77xCQEXrtABhYC3NBhu8+c5UoinLpBQC1iBnNpNwXT Lmd4nQdf9HCijG1e8myt78VP+QSwsaDT7LVcLT2oDPVggjhVcwljw3ePDwfGP9kNrR+lc8XrfClk WbrdhC2o4Ui28dtIVHd3MIIDXzCCAkegAwIBAgILBAAAAAABIVhTCKIwDQYJKoZIhvcNAQELBQAw TDEgMB4GA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjMxEzARBgNVBAoTCkdsb2JhbFNpZ24x EzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDkwMzE4MTAwMDAwWhcNMjkwMzE4MTAwMDAwWjBMMSAw HgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMzETMBEGA1UEChMKR2xvYmFsU2lnbjETMBEG A1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMwldpB5Bngi FvXAg7aEyiie/QV2EcWtiHL8RgJDx7KKnQRfJMsuS+FggkbhUqsMgUdwbN1k0ev1LKMPgj0MK66X 17YUhhB5uzsTgHeMCOFJ0mpiLx9e+pZo34knlTifBtc+ycsmWQ1z3rDI6SYOgxXG71uL0gRgykmm KPZpO/bLyCiR5Z2KYVc3rHQU3HTgOu5yLy6c+9C7v/U9AOEGM+iCK65TpjoWc4zdQQ4gOsC0p6Hp sk+QLjJg6VfLuQSSaGjlOCZgdbKfd/+RFO+uIEn8rUAVSNECMWEZXriX7613t2Saer9fwRPvm2L7 DWzgVGkWqQPabumDk3F2xmmFghcCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQF MAMBAf8wHQYDVR0OBBYEFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQBL QNvAUKr+yAzv95ZURUm7lgAJQayzE4aGKAczymvmdLm6AC2upArT9fHxD4q/c2dKg8dEe3jgr25s bwMpjjM5RcOO5LlXbKr8EpbsU8Yt5CRsuZRj+9xTaGdWPoO4zzUhw8lo/s7awlOqzJCK6fBdRoyV 3XpYKBovHd7NADdBj+1EbddTKJd+82cEHhXXipa0095MJ6RMG3NzdvQXmcIfeg7jLQitChws/zyr VQ4PkX4268NXSb7hLi18YIvDQVETI53O9zJrlAGomecsMx86OyXShkDOOyyGeMlhLxS67ttVb9+E 7gUJTb0o2HLO02JQZR7rkpeDMdmztcpHWD9fMIIEZDCCA0ygAwIBAgIMB/CJK1MgpV83jiIZMA0G CSqGSIb3DQEBCwUAMEwxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMSIw IAYDVQQDExlHbG9iYWxTaWduIEhWIFMvTUlNRSBDQSAxMB4XDTE5MDMxMzA4MjIxOVoXDTE5MDkw OTA4MjIxOVowIjEgMB4GCSqGSIb3DQEJAQwRYmVtYXNjQGdvb2dsZS5jb20wggEiMA0GCSqGSIb3 DQEBAQUAA4IBDwAwggEKAoIBAQCsphkGEsCh0fF4+6Wsi1u40JxI6W6Izew+dLGK4b93LCRAuJ8y g9wSnwGAtk9/23VmtKwBrMaJD5j9SVZpscvLAjrWwADl/THU22uTW0MsUE2fPOPv2s4hE+vMgRmK P2E+xpI6n0gFvn8qrUHO1dm6PJaP5SWa+zdB/Ja1LgMJTpevQqjK4LKjWmHFPR6CplS4RImjGk7U 0I6invTyQnL5p583t5PI7FcM5UyjAqxGEETdAuc7N4IqjNETvPwL0wLIzxPDA5PMqcWPSzg7sBAB LVUQRYNIAJPlVpUdg1IeAjil5BaaWBjEeCLBSGDFX3WaWfMNzQvRZr4i6oJxzV+1AgMBAAGjggFu MIIBajAcBgNVHREEFTATgRFiZW1hc2NAZ29vZ2xlLmNvbTBQBggrBgEFBQcBAQREMEIwQAYIKwYB BQUHMAKGNGh0dHA6Ly9zZWN1cmUuZ2xvYmFsc2lnbi5jb20vY2FjZXJ0L2dzaHZzbWltZWNhMS5j cnQwHQYDVR0OBBYEFFSy8ovdLNSQc8aqxOgKS7sBOm/UMB8GA1UdIwQYMBaAFMs4ErDHmcB4koyz IZXm9CZiwOA/MEwGA1UdIARFMEMwQQYJKwYBBAGgMgEoMDQwMgYIKwYBBQUHAgEWJmh0dHBzOi8v d3d3Lmdsb2JhbHNpZ24uY29tL3JlcG9zaXRvcnkvMDsGA1UdHwQ0MDIwMKAuoCyGKmh0dHA6Ly9j cmwuZ2xvYmFsc2lnbi5jb20vZ3NodnNtaW1lY2ExLmNybDAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0l BBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMA0GCSqGSIb3DQEBCwUAA4IBAQCbQ++Znz6xh85ZlZEN Y/vAF0vn111O0c2houe4LlLQkoQ1QS4fH5EYcBx/393FTq5n08ezWYVtmeQ6W15e34CqjYNop1Vh mihZ+3J6+LL/6YNi91cp5yMFgxOP9aI/Y8IaIWZJAY2e8yHbYSq0z8kka0H6S4VvFjwtRogkWW95 0SStEwo/8viJ02BwpmVj4YIA6Fva1ZbeN2TnUMCAHJAlKWOGlpHxpcdcWckED0XbSY9w6bllMw1T tsbiUwQxDeO++Y8NfS8rieZgfv3RlobKihE8xbIVGRHIq1gup4nXv6XDwHDYyGhafIfUD4Ix00Wk gnODGb+jPwoQlDX0X64qMYICXjCCAloCAQEwXDBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xv YmFsU2lnbiBudi1zYTEiMCAGA1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMQIMB/CJK1Mg pV83jiIZMA0GCWCGSAFlAwQCAQUAoIHUMC8GCSqGSIb3DQEJBDEiBCC44XzER9sI7bl+pqVWgn0M 58RLLc3ZJ8iG3Q1Einh7KzAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEP Fw0xOTA3MjkyMjUzMzVaMGkGCSqGSIb3DQEJDzFcMFowCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQB FjALBglghkgBZQMEAQIwCgYIKoZIhvcNAwcwCwYJKoZIhvcNAQEKMAsGCSqGSIb3DQEBBzALBglg hkgBZQMEAgEwDQYJKoZIhvcNAQEBBQAEggEABf0+657Y1KmO0eNPijxw4j4FENUHlv65vXm7Wgat gu7VXL/5GrkS5JU9jkI62MTJNBdpjexiEYCPEeKtQh+bYcwnWtcQWlA6vRMNwI+1otIPmSpfA3RG MvJktPJJYRY9xVOD2hAOEBwOsTTUilHV23M+2qR4UR4k3SZkqjH+26kJNo7WlnSfsU63OnZnXcd2 F6pRz2HfrsvkdwJG2ZVcH2JTgEvpWQmwEphyt4C/u3fNlxBHWLm7shAmja/obAGlJ+gexdIEGrK7 q9yphed6z8FX0HyvTIJgLZuQXv7twmhUyzXEu2ejyvxbCgaLNF39stAk0RhSygb/TfChRHV3mQ== --000000000000117d2b058ed9c3eb-- From nobody Mon Jul 29 16:03:32 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5C31B120122 for ; Mon, 29 Jul 2019 16:03:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id B6e-K6GIllJ0 for ; Mon, 29 Jul 2019 16:03:28 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 14E2D12011D for ; Mon, 29 Jul 2019 16:03:27 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id AF821BDCF; Tue, 30 Jul 2019 00:03:25 +0100 (IST) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Qs23YvrOdF7g; Tue, 30 Jul 2019 00:03:24 +0100 (IST) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 063CFBE20; Tue, 30 Jul 2019 00:03:24 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1564441404; bh=Yd0RbSGiA3ek/W2wHLekHp7h2hDa4A1gauxbUbJDSR0=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=stmGDkq/fTedSdnT99hqpblnOQMpqmaRLeyDyA9WN5t37dyxHdQQd0qPr9BjnDuhT snr2ZjA46NnF+ArCpcRtpW+KktA8gI7Cb8SaERwL77jU/BeYN/oClSuteebvxag6AR WGcVOyoIfnay5qzSx3nvpPxoxhKLFJbEB74dI9+4= To: Steven Valdez Cc: "tls@ietf.org" References: <8c903f04-7605-be98-5813-688d1ef88c55@cs.tcd.ie> <4b2de58d-1957-ca48-59ab-521e7a5b510f@cs.tcd.ie> <67e69531-69a2-24e3-c2e7-d95054a3382d@cs.tcd.ie> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <6a678b80-6233-552d-4755-db0d194fc49c@cs.tcd.ie> Date: Tue, 30 Jul 2019 00:03:22 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="8acIpTMKoqM5IzxWCQvUCBVTiYeQ1TRGG" Archived-At: Subject: Re: [TLS] ESNI GREASE - answer needed? X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 29 Jul 2019 23:03:30 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --8acIpTMKoqM5IzxWCQvUCBVTiYeQ1TRGG Content-Type: multipart/mixed; boundary="Nsq2WX0baaoHmZX1c6BHc0bYWsc56KEwt"; protected-headers="v1" From: Stephen Farrell To: Steven Valdez Cc: "tls@ietf.org" Message-ID: <6a678b80-6233-552d-4755-db0d194fc49c@cs.tcd.ie> Subject: Re: [TLS] ESNI GREASE - answer needed? References: <8c903f04-7605-be98-5813-688d1ef88c55@cs.tcd.ie> <4b2de58d-1957-ca48-59ab-521e7a5b510f@cs.tcd.ie> <67e69531-69a2-24e3-c2e7-d95054a3382d@cs.tcd.ie> In-Reply-To: --Nsq2WX0baaoHmZX1c6BHc0bYWsc56KEwt Content-Type: multipart/mixed; boundary="------------4D83BFB35311069444899E53" Content-Language: en-GB This is a multi-part message in MIME format. --------------4D83BFB35311069444899E53 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hi both, On 29/07/2019 23:52, Steven Valdez wrote: > Without GREASE, a server who doesn't have keys can't respond with any o= f > the existing responses (esni_accept is wrong since it can't decode the > ESNI, esni_retry_request is wrong since it can't provide keys for the > client to use on the retry). The only valid response would be a new rec= ord > type that says it doesn't support ESNI, which becomes equivalent to jus= t > not sending the ESNI extension back in the EncryptedExtensions. >=20 > With GREASE, I don't know if it's particularly useful to fake the respo= nse > in the EncryptedExtensions, since network adversaries won't be able to = see > the contents, I suppose its presence might slightly change the size of = the > encrypted payload, though record padding could prevent that. Right it's the size that matters;-) I don't care if that's via this extension or not. ISTM that yes, producing a response to greased ESNI that doesn't stand out is an accepted requirement. And for the case in point, I think (but don't claim to be right) that a 50:50 distribution of ~16 payload octets or else ESNIKeys-sized things seems right. On 29/07/2019 23:53, Ben Schwartz wrote:> It sounds like you're asking for a middle ground for servers between > "supports ESNI (and has ESNIKeys)" and "doesn't support ESNI". > Maybe you could explain the utility of this middle ground? > > From my perspective, I'd rather encourage real implementations > of ESNI than enable fake ones. Agreed. Not that documenting a corner case is encouraging the corner case of course:-) That seems more like being as complete as one can. I suspect this is more an issue about what code to write for a server instance that boots but hasn't yet gotten the values for ESNIKeys loaded for whatever reason. Or where disk access fails for a while. Or where... , but the server code still has to do something. Cheers, S. >=20 >=20 > On Mon, Jul 29, 2019 at 3:34 PM Stephen Farrell > wrote: >=20 >> >> >> On 29/07/2019 23:32, Steven Valdez wrote: >>> A server that doesn't have ESNI keys configured shouldn't be respondi= ng >> to >>> ESNI and should instead just ignore the ESNI extensions (as if it did= n't >>> know what it was). >> >> Why? >> >> Thanks, >> S. >> >=20 >=20 --------------4D83BFB35311069444899E53 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------4D83BFB35311069444899E53-- --Nsq2WX0baaoHmZX1c6BHc0bYWsc56KEwt-- --8acIpTMKoqM5IzxWCQvUCBVTiYeQ1TRGG Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAl0/ezoACgkQWrL68XsX K+rCCQ//Ym8eL77JOXrOU4Mtk7hYsVqBg6VZ+mG6kxP4RnMva3YeD9g8yMRulVLE 5woNummp/heAr+r7F/FAselmijfMPXSp20VqMA/1jhjceaMfjZQTc2s5ZNGeKHXk UNe3BQoN2fLrc1A/V0jlJD9AEFr7SeRE1bKNDqaHw//2XDge2pv5B7K9SUiVr/tk ipBMJxcumSYMdQAzwtIPsyXLvrJSkAbUfAc049DUejBysZwZWWr3bgOFYHehCQX5 TaSOthZBKiZrWGzZ/N318/jR8YbIyagfxoem3nPI011aodULlJAAxDSSXGBJIpqW UXvmFiFbYXOgW4BMy//S83PmwrZ3jPX8i3p+hpnEvOxtxrrAenRMbD3CCbVa/gUZ SIYvdumKznWZClMmlNGQfiAb6ClDyOE1mJ1Lq+8Powu7xfRQMhlnhc1FXYq13L7P HhCZky9pwkbwriZA9wjjGKB5q2dCEhgGeyosVgDDqf9CgUo1vK10zVin547bGaSN gLMXfLLQdSih0Wov5ZYsf+fqRYeL3/tNChqc0+SeW7R9RSj38quiv4+lZ62NYOL2 ZQOpvir8s4FncNb0JjaxjANFky5O+kqPx7ikOP1Kqnlmx40FPPY1hBRCxnVf3OzE Ky3EYm0MUYkdvSelNDYwQHEYuKCgXkG80hDs49lJk6lYr23C3Dg= =g6FF -----END PGP SIGNATURE----- --8acIpTMKoqM5IzxWCQvUCBVTiYeQ1TRGG-- From nobody Mon Jul 29 16:58:48 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8E1F6120025 for ; Mon, 29 Jul 2019 16:58:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.251 X-Spam-Level: X-Spam-Status: No, score=-9.251 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.249, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, USER_IN_DEF_SPF_WL=-7.5] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=chromium.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xbfl6Sl6jTD3 for ; Mon, 29 Jul 2019 16:58:45 -0700 (PDT) Received: from mail-qt1-x829.google.com (mail-qt1-x829.google.com [IPv6:2607:f8b0:4864:20::829]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 160CE12002E for ; Mon, 29 Jul 2019 16:58:45 -0700 (PDT) Received: by mail-qt1-x829.google.com with SMTP id a15so61265137qtn.7 for ; Mon, 29 Jul 2019 16:58:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=g3QcG687+7HsCLiHR4YTt0uo3JEitScaaO9b8VKJXNc=; b=KoxBFFoYIYkTZqvPYynlltEZkj0FIsKI2te3R4uORTUFAWHSa5hlYD4gEFA2WGer2h x1bSYaFoR+60EASk8HRbIvc61PFcZYWJfpFWDkowtmTZwVSaprSx8ImRip33Ex75tKga vCN9EcUmlWCq+Jc/hV2QQ63jRT2AwZlKBWkhM= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=g3QcG687+7HsCLiHR4YTt0uo3JEitScaaO9b8VKJXNc=; b=EJ4/BCyFZGGTN38FVg6WOi122s8ZkfDmhH5JEalQfAEh3DKQ2SMQxh2smPMOCPnsmM +v8ZSQuY26qu6TqW4K3FuRq4wC3BIZmHHDPMPWb688NpCmiIb83HNh+Se/rifj/wPB5E PhnL9vnY/7GHSytMpyJlHk26EPKSJ1X3HLI4B22BaVSgu0D1jgsxPjl1ELvyH91TBQ0w lD7LR2Idgvu2hH376mO+FUjT2+fXwMlpg4bhhFwceltUtM2PKlk2Hcl+vT11q5c8cVju Q+i0CEeyQW7575JFT5KvoICGW9EWGs7cu5zj+qc8IuF7ZQXhCMmBhwjYZ1Zjj54U1Ers fkkg== X-Gm-Message-State: APjAAAVtJd1Oa6R019z0snqQJndN5OoyCKNMBVZVui4VR6Hy2sbyOGIv IBvqjJ1dWWQtumxPZ2syrOYOt56vVHD+Z7emUunO X-Google-Smtp-Source: APXvYqwT9bYip/cHBPFx9xPonXKhIg2H42+YDYtCNW59+24DzIYMg9RWjAWf4Ove7v2qNf6vzWd0oPVGwg3VmUis/tk= X-Received: by 2002:ac8:38a8:: with SMTP id f37mr79924671qtc.150.1564444723837; Mon, 29 Jul 2019 16:58:43 -0700 (PDT) MIME-Version: 1.0 References: <8c903f04-7605-be98-5813-688d1ef88c55@cs.tcd.ie> <4b2de58d-1957-ca48-59ab-521e7a5b510f@cs.tcd.ie> <67e69531-69a2-24e3-c2e7-d95054a3382d@cs.tcd.ie> <6a678b80-6233-552d-4755-db0d194fc49c@cs.tcd.ie> In-Reply-To: <6a678b80-6233-552d-4755-db0d194fc49c@cs.tcd.ie> From: David Benjamin Date: Mon, 29 Jul 2019 19:58:27 -0400 Message-ID: To: Stephen Farrell Cc: Steven Valdez , "tls@ietf.org" Content-Type: multipart/alternative; boundary="00000000000009637e058edaaca6" Archived-At: Subject: Re: [TLS] ESNI GREASE - answer needed? X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 29 Jul 2019 23:58:47 -0000 --00000000000009637e058edaaca6 Content-Type: text/plain; charset="UTF-8" I think the GREASE bits still need more work to avoid sticking out[*], but you're right that there's a length leakage. But, rather than 50:50 of 16 bytes and ESNIKeys, I think it's better to pad all three cases up to an ESNIKeys size. Whether this is done via bespoke padding within the ESNI extension or the existing record-level padding, I don't have strong opinions. With the server Certificate message, the draft currently just says to pad at the record layer, so that would be consistent here too. Additionally, the exact sizes of the TLS messages also needn't be so obviously leaked. Servers can and should pack EncryptedExtensions, Certificate, CertificateVerify, and Finished together into fewer records, likely just one. This is worthwhile independent of ESNI. An encrypted record is 22 bytes of overhead, so packing four messages into one record saves 66 bytes. I don't know about other implementations, but BoringSSL already does this. Of course, unpadded, an attacker that knows the expected size of the other messages for a particular server can recover the EncryptedExtensions length, so this isn't perfect. [*] I filed https://github.com/tlswg/draft-ietf-tls-esni/issues/177 last week with a sketch of an idea. Steven or I should hopefully have a more concrete PR later. On Mon, Jul 29, 2019 at 7:03 PM Stephen Farrell wrote: > > Hi both, > > On 29/07/2019 23:52, Steven Valdez wrote: > > Without GREASE, a server who doesn't have keys can't respond with any of > > the existing responses (esni_accept is wrong since it can't decode the > > ESNI, esni_retry_request is wrong since it can't provide keys for the > > client to use on the retry). The only valid response would be a new > record > > type that says it doesn't support ESNI, which becomes equivalent to just > > not sending the ESNI extension back in the EncryptedExtensions. > > > > With GREASE, I don't know if it's particularly useful to fake the > response > > in the EncryptedExtensions, since network adversaries won't be able to > see > > the contents, I suppose its presence might slightly change the size of > the > > encrypted payload, though record padding could prevent that. > > Right it's the size that matters;-) I don't care if that's via > this extension or not. ISTM that yes, producing a response to > greased ESNI that doesn't stand out is an accepted requirement. > And for the case in point, I think (but don't claim to be right) > that a 50:50 distribution of ~16 payload octets or else > ESNIKeys-sized things seems right. > > On 29/07/2019 23:53, Ben Schwartz wrote:> It sounds like you're asking > for a middle ground for servers between > > "supports ESNI (and has ESNIKeys)" and "doesn't support ESNI". > > Maybe you could explain the utility of this middle ground? > > > > From my perspective, I'd rather encourage real implementations > > of ESNI than enable fake ones. > > Agreed. Not that documenting a corner case is encouraging > the corner case of course:-) That seems more like being as > complete as one can. > > I suspect this is more an issue about what code to write for a > server instance that boots but hasn't yet gotten the values for > ESNIKeys loaded for whatever reason. Or where disk access fails > for a while. Or where... , but the server > code still has to do something. > > Cheers, > S. > > > > > > > > On Mon, Jul 29, 2019 at 3:34 PM Stephen Farrell < > stephen.farrell@cs.tcd.ie> > > wrote: > > > >> > >> > >> On 29/07/2019 23:32, Steven Valdez wrote: > >>> A server that doesn't have ESNI keys configured shouldn't be responding > >> to > >>> ESNI and should instead just ignore the ESNI extensions (as if it > didn't > >>> know what it was). > >> > >> Why? > >> > >> Thanks, > >> S. > >> > > > > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > --00000000000009637e058edaaca6 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
I think the GREASE bits still need more work to avoid stic= king out[*], but you're right that there's a length leakage. But, r= ather than 50:50 of 16 bytes and ESNIKeys, I think it's better to pad a= ll three cases up to an ESNIKeys size. Whether this is done via bespoke pad= ding within the ESNI extension or the existing record-level padding, I don&= #39;t have strong opinions. With the server Certificate message, the draft = currently just says to pad at the record layer, so that would be consistent= here too.

Additionally, the exact sizes of the TLS mess= ages also needn't be so obviously leaked. Servers can and should pack E= ncryptedExtensions, Certificate, CertificateVerify, and Finished together i= nto fewer records, likely just one. This is worthwhile independent of ESNI.= An encrypted record is 22 bytes of overhead, so packing four messages into= one record saves 66 bytes. I don't know about other implementations, b= ut BoringSSL already does this. Of course, unpadded, an attacker that knows= the expected size of the other messages for a particular server can recove= r the EncryptedExtensions length, so this isn't perfect.
=

[*] I filed=C2=A0https://github.com/tlswg/draft-ietf-tls-esni/= issues/177 last week with a sketch of an idea. Steven or I should hopef= ully have a more concrete PR later.

On Mon, Jul 29, 2019 at 7:03= PM Stephen Farrell <stephe= n.farrell@cs.tcd.ie> wrote:

Hi both,

On 29/07/2019 23:52, Steven Valdez wrote:
> Without GREASE, a server who doesn't have keys can't respond w= ith any of
> the existing responses (esni_accept is wrong since it can't decode= the
> ESNI, esni_retry_request is wrong since it can't provide keys for = the
> client to use on the retry). The only valid response would be a new re= cord
> type that says it doesn't support ESNI, which becomes equivalent t= o just
> not sending the ESNI extension back in the EncryptedExtensions.
>
> With GREASE, I don't know if it's particularly useful to fake = the response
> in the EncryptedExtensions, since network adversaries won't be abl= e to see
> the contents, I suppose its presence might slightly change the size of= the
> encrypted payload, though record padding could prevent that.

Right it's the size that matters;-) I don't care if that's via<= br> this extension or not. ISTM that yes, producing a response to
greased ESNI that doesn't stand out is an accepted requirement.
And for the case in point, I think (but don't claim to be right)
that a 50:50 distribution of ~16 payload octets or else
ESNIKeys-sized things seems right.

On 29/07/2019 23:53, Ben Schwartz wrote:> It sounds like you're aski= ng
for a middle ground for servers between
> "supports ESNI (and has ESNIKeys)" and "doesn't sup= port ESNI".
> Maybe you=C2=A0 could explain the utility of this middle ground?
>
> From my perspective, I'd rather encourage real implementations
> of ESNI than enable fake ones.

Agreed. Not that documenting a corner case is encouraging
the corner case of course:-) That seems more like being as
complete as one can.

I suspect this is more an issue about what code to write for a
server instance that boots but hasn't yet gotten the values for
ESNIKeys loaded for whatever reason. Or where disk access fails
for a while. Or where... <insert weird case here>, but the server
code still has to do something.

Cheers,
S.


>
>
> On Mon, Jul 29, 2019 at 3:34 PM Stephen Farrell <stephen.farrell@cs.tcd.ie&= gt;
> wrote:
>
>>
>>
>> On 29/07/2019 23:32, Steven Valdez wrote:
>>> A server that doesn't have ESNI keys configured shouldn= 9;t be responding
>> to
>>> ESNI and should instead just ignore the ESNI extensions (as if= it didn't
>>> know what it was).
>>
>> Why?
>>
>> Thanks,
>> S.
>>
>
>
_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls
--00000000000009637e058edaaca6-- From nobody Mon Jul 29 17:05:03 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3695512002E for ; Mon, 29 Jul 2019 17:05:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id I1Aauf5bfU6g for ; Mon, 29 Jul 2019 17:04:59 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0A25A120025 for ; Mon, 29 Jul 2019 17:04:58 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 60CD2BE24; Tue, 30 Jul 2019 01:04:56 +0100 (IST) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aPsGTUkqqznI; Tue, 30 Jul 2019 01:04:54 +0100 (IST) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 7ED05BE20; Tue, 30 Jul 2019 01:04:54 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1564445094; bh=pwIDrUcWFDTeukwTlJG7cTzTiCtOuiAZUDk7SuM3INM=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=bQq3/9zEAotJEOcJcF4Gh7mqSzWWB5TRA50si5OmJT52UcHNUjvWd6jhqn3S/YSgj bg6huNlEKFlaX/PwpadvxZgu18vh4b747LvQbFs1N8yljUtb0CgtNA+jVpc3Smu9/i NAAvlFd+bv/SJm/WlJ268lFoGnMfXCXS6fTNb7EQ= To: David Benjamin Cc: Steven Valdez , "tls@ietf.org" References: <8c903f04-7605-be98-5813-688d1ef88c55@cs.tcd.ie> <4b2de58d-1957-ca48-59ab-521e7a5b510f@cs.tcd.ie> <67e69531-69a2-24e3-c2e7-d95054a3382d@cs.tcd.ie> <6a678b80-6233-552d-4755-db0d194fc49c@cs.tcd.ie> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <8fef8934-f3cb-0afe-df96-3a1d68524f35@cs.tcd.ie> Date: Tue, 30 Jul 2019 01:04:53 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="fNcdBDK7k34qlhtukaAku3kcw4eNaErAE" Archived-At: Subject: Re: [TLS] ESNI GREASE - answer needed? X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 30 Jul 2019 00:05:01 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --fNcdBDK7k34qlhtukaAku3kcw4eNaErAE Content-Type: multipart/mixed; boundary="gpCrnfkD4ug54qnvIVL7131ZqcwDED1v8"; protected-headers="v1" From: Stephen Farrell To: David Benjamin Cc: Steven Valdez , "tls@ietf.org" Message-ID: <8fef8934-f3cb-0afe-df96-3a1d68524f35@cs.tcd.ie> Subject: Re: [TLS] ESNI GREASE - answer needed? References: <8c903f04-7605-be98-5813-688d1ef88c55@cs.tcd.ie> <4b2de58d-1957-ca48-59ab-521e7a5b510f@cs.tcd.ie> <67e69531-69a2-24e3-c2e7-d95054a3382d@cs.tcd.ie> <6a678b80-6233-552d-4755-db0d194fc49c@cs.tcd.ie> In-Reply-To: --gpCrnfkD4ug54qnvIVL7131ZqcwDED1v8 Content-Type: multipart/mixed; boundary="------------18C9C141AF20506C02D231ED" Content-Language: en-GB This is a multi-part message in MIME format. --------------18C9C141AF20506C02D231ED Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hiya, On 30/07/2019 00:58, David Benjamin wrote: >=20 > [*] I filed https://github.com/tlswg/draft-ietf-tls-esni/issues/177 las= t > week with a sketch of an idea. Steven or I should hopefully have a more= > concrete PR later. Working from there seems like a good path. That said I don't see that that says how an ESNI-aware but not ESNI-configured server ought behave. And it seems a bit complicated, although I agree a 50:50 split is as or more arbitrary. S. PS: I'll note that I didn't know that PR existed as it hadn't hit the mailing list and I rarely login to the github web UI and that this isn't the first time I've had that experience. I don't blame anyone but there's clearly a bit of process stuff not quite working well here. I think people raising non-editorial PRs should bring those to the list. --------------18C9C141AF20506C02D231ED Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------18C9C141AF20506C02D231ED-- --gpCrnfkD4ug54qnvIVL7131ZqcwDED1v8-- --fNcdBDK7k34qlhtukaAku3kcw4eNaErAE Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAl0/iaUACgkQWrL68XsX K+qkkg//e3JFkuFvKaJUMhNp2rEJ8NSGQ1SoFcMOGDAgoCAsxNi4dbadBv9aKxjW KOAiCJXATF+75DqRIRuvyblh1sDd5G+O2ZtnbS8e8RzTwFyCS51W68HNJ4V74oOF i9pz7KvHL+NhjKw45PG27REp4c2r3e++edW+eQclzexd6lqkzsXTXdbb/cAw8NP9 ZwJ+xgyUwNHujhLfYvjzx/U0OezK+iPWHKRZ7Iydo5yEYIerxmwrQR22bYX4Aq0h XTTzbFCXuo6c1XwxyazCP1q4BCqKTy7mqOaXBPeNrcHL3A+TCO/zeNabUpnmPU8S dAmEvC0DJv+Fsxc7WzfX8Y/xnmdbQluZULapRz9L56yV1b52o/LMnsJV9OYnc+de OLDKTKNfQ7MvBfhlcEiSmeNos+AZCdNwXIQSjyUn7fhQW6HePEcrnsKKUkn3vAv8 X6w0thPwPWTRJF4MVlEWA8QzecgxRBbEW+Ugni1We1V2qKlubPsVKfiaT0nyiBXq veI98RcqaPXHiMX1aH82j6fG7OtJugKlusHmBSLM/cGXFbio6qWPocJl0FYwRZqm 0W8rLDwwY78SY+en9bncr8JrZzTOkJo9q8Drug5Vj+3tmH0Y5qlCAGAEfIYjMx/M r6RCI3y4i8JNdYNW4vlwqQ1i6ynkU2g7UbHkXWWf6cdCJMIlAHk= =dvNx -----END PGP SIGNATURE----- --fNcdBDK7k34qlhtukaAku3kcw4eNaErAE-- From nobody Mon Jul 29 17:11:48 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A4768120025 for ; Mon, 29 Jul 2019 17:11:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.251 X-Spam-Level: X-Spam-Status: No, score=-9.251 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.249, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, USER_IN_DEF_SPF_WL=-7.5] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=chromium.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xpuNLD92b-0M for ; Mon, 29 Jul 2019 17:11:45 -0700 (PDT) Received: from mail-qt1-x82e.google.com (mail-qt1-x82e.google.com [IPv6:2607:f8b0:4864:20::82e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EF68C120019 for ; Mon, 29 Jul 2019 17:11:44 -0700 (PDT) Received: by mail-qt1-x82e.google.com with SMTP id h21so61266264qtn.13 for ; Mon, 29 Jul 2019 17:11:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=OjI+W8SpCyFjiP67zIzce7jXqXHnyo+YVqrK+IDIKYs=; b=ji3BaiQQApr0wFkMklwZAVDlQKx7x2Yktx3T+fccLtXaENipUDiNWyQtkYoMl/GlHL nx8Jec7s0vwdtLMvS0BYbN1WF5p0W44H4B9rScBsHLjW7oIIujfO3iafOIcjSZ9P5YDX 9jzZTmPZVsy2JBHy2eCC+b2hHpF5XoSN2hKq0= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=OjI+W8SpCyFjiP67zIzce7jXqXHnyo+YVqrK+IDIKYs=; b=tOSOcRiPQYyXCy3kgQ+U/J2AetSr5VvaMQnkSaw3VNppU1GmtzpDG1QADPQHPKR4ps r2hSl5/JIFZYqRjtHIrIBRKeEQwp3ov5rzQG/7HMmonHu8yfxBIMrxuu0UVTNJa4J+yO dGqkak5df7p9tTM7hpX9D9m/d8EVojw1cO3MIZLkV8XcbwO+E4rtULaV6STInxjCFpWD RmtZNzaNfJSsgZyE9YRAPz1QFbEpr/WI2UtxxYANZj2vH/PPtjgWQ2rV9M3/ASWoOk/Y MraNJxBPKMAmAzwp9k69lvs0vNwKj+J1zJ7hELkZqhsZ6YohsbAuV2KgEKfhU4et2ywr GrJA== X-Gm-Message-State: APjAAAXeqCmitDN2abQvGn4fdnlgl3wCuXsmsORfqMxHcNpKZ4b6HKRI m+kW74pd52QxhxHp01B5V9XjZocgPCh2ujiK2JLP X-Google-Smtp-Source: APXvYqzMK+jgKJnqC3ZYlN+ZsvpVnMkFVKwAXi28fmvMluRcrS/0gzWs9uAskDC6z5IilPLBY5TnPa8fUxtYW/JgyAc= X-Received: by 2002:a0c:ffc5:: with SMTP id h5mr81213801qvv.43.1564445503714; Mon, 29 Jul 2019 17:11:43 -0700 (PDT) MIME-Version: 1.0 References: <8c903f04-7605-be98-5813-688d1ef88c55@cs.tcd.ie> <4b2de58d-1957-ca48-59ab-521e7a5b510f@cs.tcd.ie> <67e69531-69a2-24e3-c2e7-d95054a3382d@cs.tcd.ie> <6a678b80-6233-552d-4755-db0d194fc49c@cs.tcd.ie> <8fef8934-f3cb-0afe-df96-3a1d68524f35@cs.tcd.ie> In-Reply-To: <8fef8934-f3cb-0afe-df96-3a1d68524f35@cs.tcd.ie> From: David Benjamin Date: Mon, 29 Jul 2019 20:11:27 -0400 Message-ID: To: Stephen Farrell Cc: Steven Valdez , "tls@ietf.org" Content-Type: multipart/alternative; boundary="00000000000085759d058edada8b" Archived-At: Subject: Re: [TLS] ESNI GREASE - answer needed? X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 30 Jul 2019 00:11:47 -0000 --00000000000085759d058edada8b Content-Type: text/plain; charset="UTF-8" On Mon, Jul 29, 2019 at 8:04 PM Stephen Farrell wrote: > > Hiya, > > On 30/07/2019 00:58, David Benjamin wrote: > > > > [*] I filed https://github.com/tlswg/draft-ietf-tls-esni/issues/177 last > > week with a sketch of an idea. Steven or I should hopefully have a more > > concrete PR later. > > Working from there seems like a good path. That said > I don't see that that says how an ESNI-aware but not > ESNI-configured server ought behave. And it seems a > bit complicated, although I agree a 50:50 split is as > or more arbitrary. > I think either of "do nothing and act like you are ESNI-unaware" or "add some padding to EncryptedExtensions so you have room to be ESNI-configured" is reasonable. Though, yeah, the draft should talk about this a bit. I think the GREASE stuff turned out to have a lot more details to work out than my original attempt anticipated. :-) > PS: I'll note that I didn't know that PR existed as it > hadn't hit the mailing list and I rarely login to the > github web UI and that this isn't the first time I've > had that experience. I don't blame anyone but there's > clearly a bit of process stuff not quite working well > here. I think people raising non-editorial PRs should > bring those to the list. > Apologies. I filed that during the meeting mostly so I wouldn't forget and so Chris would have something to link to in his slides. The intent was to write up an actual PR later which would certainly be sent to the list for discussion. David --00000000000085759d058edada8b Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Mon, Jul 29, 2019 at 8:04 PM Stephen F= arrell <stephen.farrell@cs.= tcd.ie> wrote:

Hiya,

On 30/07/2019 00:58, David Benjamin wrote:
>
> [*] I filed https://github.com/tlswg/dra= ft-ietf-tls-esni/issues/177 last
> week with a sketch of an idea. Steven or I should hopefully have a mor= e
> concrete PR later.

Working from there seems like a good path. That said
I don't see that that says how an ESNI-aware but not
ESNI-configured server ought behave. And it seems a
bit complicated, although I agree a 50:50 split is as
or more arbitrary.

I think either of &q= uot;do nothing and act like you are ESNI-unaware" or "add some pa= dding to EncryptedExtensions so you have room to be ESNI-configured" i= s reasonable. Though, yeah, the draft should talk about this a bit. I think= the GREASE stuff turned out to have a lot more details to work out than my= original attempt anticipated. :-)
=C2=A0
PS: I'll note that I didn't know that PR existed as it
hadn't hit the mailing list and I rarely login to the
github web UI and that this isn't the first time I've
had that experience. I don't blame anyone but there's
clearly a bit of process stuff not quite working well
here. I think people raising non-editorial PRs should
bring those to the list.

Apologies. I f= iled that during the meeting mostly so I wouldn't forget and so Chris w= ould have something to link to in his slides. The intent was to write up an= actual PR later which would certainly be sent to the list for discussion.<= /div>

David
--00000000000085759d058edada8b-- From nobody Mon Jul 29 17:16:05 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 53F0212002E for ; Mon, 29 Jul 2019 17:16:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.25 X-Spam-Level: X-Spam-Status: No, score=-9.25 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.249, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_SPF_WL=-7.5] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=chromium.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eqQ2JoorX6w3 for ; Mon, 29 Jul 2019 17:16:01 -0700 (PDT) Received: from mail-qt1-x831.google.com (mail-qt1-x831.google.com [IPv6:2607:f8b0:4864:20::831]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 733AF120129 for ; Mon, 29 Jul 2019 17:16:01 -0700 (PDT) Received: by mail-qt1-x831.google.com with SMTP id a15so61298623qtn.7 for ; Mon, 29 Jul 2019 17:16:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=mime-version:from:date:message-id:subject:to; bh=d0/LhZgTi17o+WzSh7Ctd2zaZDTsMzHiUYI4s4wUZFc=; b=GI1AtIQZKvMeAsTSk1Zvjg0n/jL19e+nGiLQ3LGfziYDwFKX2j7hDg2E1dDIFc7d8h fdKv1kma+mDAtKniiNAUh3So79glybRjQCLor/fcRm1J+9l8CEC9xDEXR8IZ5HvoTuMr KTHdyLndH71RgyIp0D/W2bp2/d67TorziaWpo= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=d0/LhZgTi17o+WzSh7Ctd2zaZDTsMzHiUYI4s4wUZFc=; b=kjKdi8fEJnj6IV/WD4xnywOehRJvpo7AQQGDpgL+koJ76C9C6+YwAsq3cFzJgLnJjG 9I+sS8wLL55I2BF2Q3LZ1ayDPhYh06cIR14S/GhBhLLTav1V31vg2QdktWN84+p/XKST oldn3TWUDKCKuHwgaPajIX9b/LYWuV6NrgsMp6kitGh3/bX3R9DJsZMzec/rRh1Kybe1 nuyQuS70P1CVNorCN//iFrhubrVg91nKUyTn3ikeZDDiUslSc6PW5XNA64HJEtdYxtlJ IGax3SFhV/20XNcJhS37NiLzDAKagHx2wwn9/x0VFsqO1wuZbWiIZ/DCYUpZ18psLr5i umjQ== X-Gm-Message-State: APjAAAXIJrqeaO6hHOFnYfnrVOJNqBVfDAx+54vPRbo1jrO7xwhand7l e5MPqvtUq3yqdYN8GbZlZpJOaNi8np4NOBstOY7Ddd9t+g== X-Google-Smtp-Source: APXvYqykl3+hJOS/i/T+0WaxqytrsodsbwLw3cyd0v/lLP87nrCuRtORalOYasxw08kEUW5Zqz8vrDqnzF598WbOi3Y= X-Received: by 2002:ac8:2bf1:: with SMTP id n46mr78446737qtn.372.1564445760203; Mon, 29 Jul 2019 17:16:00 -0700 (PDT) MIME-Version: 1.0 From: David Benjamin Date: Mon, 29 Jul 2019 20:15:44 -0400 Message-ID: To: "" Content-Type: multipart/alternative; boundary="000000000000cf007f058edae916" Archived-At: Subject: [TLS] Drafts for batch signing and PKCS#1 v1.5 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 30 Jul 2019 00:16:03 -0000 --000000000000cf007f058edae916 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi all, I=E2=80=99ve just uploaded a pair of drafts relating to signatures in TLS 1= .3. https://tools.ietf.org/html/draft-davidben-tls13-pkcs1-00 https://tools.ietf.org/html/draft-davidben-tls-batch-signing-00 The first introduces optional legacy codepoints for PKCS#1 v1.5 signatures with client certificates. This is unfortunate, but I think we should do it. On the Chrome side, we=E2=80=99ve encountered some headaches with the TLS 1= .3 PSS requirement which are unique to client certificates. The document describes the motivations in detail. The second describes a batch signing mechanism for TLS using Merkle trees. It allows TLS clients and servers to better handle signing load. I think it could be beneficial for a number of DoS and remote key scenarios. Thoughts? David --000000000000cf007f058edae916 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi all,

I=E2=80=99ve just uploaded a pair of drafts= relating to signatures in TLS 1.3.
https://tools.ietf.org/html/draft-davidbe= n-tls13-pkcs1-00
https://tools.ietf.org/html/draft-davidben-tls-bat= ch-signing-00

The first introduces optional legacy codepoints fo= r PKCS#1 v1.5 signatures with client certificates. This is unfortunate, but= I think we should do it. On the Chrome side, we=E2=80=99ve encountered som= e headaches with the TLS 1.3 PSS requirement which are unique to client cer= tificates. The document describes the motivations in detail.

The sec= ond describes a batch signing mechanism for TLS using Merkle trees. It allo= ws TLS clients and servers to better handle signing load. I think it could = be beneficial for a number of DoS and remote key scenarios.

Thoughts= ?

David
--000000000000cf007f058edae916-- From nobody Mon Jul 29 17:20:01 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BA4E012002E for ; Mon, 29 Jul 2019 17:19:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=heapingbits.net header.b=N2scYxcH; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=Zjdu4FaU Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hu3xaqISsOPj for ; Mon, 29 Jul 2019 17:19:58 -0700 (PDT) Received: from out3-smtp.messagingengine.com (out3-smtp.messagingengine.com [66.111.4.27]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DAA5E120019 for ; Mon, 29 Jul 2019 17:19:57 -0700 (PDT) Received: from compute6.internal (compute6.nyi.internal [10.202.2.46]) by mailout.nyi.internal (Postfix) with ESMTP id 2568D21F92 for ; Mon, 29 Jul 2019 20:19:57 -0400 (EDT) Received: from imap4 ([10.202.2.54]) by compute6.internal (MEProxy); Mon, 29 Jul 2019 20:19:57 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=heapingbits.net; h=mime-version:message-id:in-reply-to:references:date:from:to :subject:content-type; s=fm2; bh=wIv2eAlZozV4PC8xYhhQ/wJzPOKClfQ hSvLPBIEVP6o=; b=N2scYxcHVcBaOdDGv9SAo2Xm8N/AUc2QZIf6UNMaEdPSoLr SqZgsUWWRq3zD5WJ9ByrAjrVKFo76Kkkx1937Tklhp8Va/l51QornDx4wI6xVY8T ct08A9WfqaBl6V4LeoJyh6N2ieZtq3UZp2WxXn5taoe1fpAoG92vUb41bQ4ebGjn PL5eRwgkeKNBrGMUaNMoXez1qy8IZqOrHI/5SX7Xp+xOIf97px5bZVNG//yUGrXs a0E4DBJVETFCzHjTv1rTZv7iknlI4qCyK37BEFrE47RekPoT+ap1z8+aiNrL6aCU jgorv7nlppzVyo0PPcXtz1XRjcp4UaGcJ5SVQfQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-proxy :x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm3; bh=wIv2eA lZozV4PC8xYhhQ/wJzPOKClfQhSvLPBIEVP6o=; b=Zjdu4FaUsJM76IexM3Pwoa XmtfCveyuEtyFOLd6Pn0XehCIbEigMGdlc456ZcPj+V25vn5l1YwQ4/uUPaW3QQT ynEc4sXqj4olDAmy1J+ZFsCd78ao4b+Fhg9kqqhOM0fCfLIwxatBsIMoCDQwcCVI ACGAzEMzOFN/IabJ+bGC2fEvUBiylZfYKwvQY4ZJpXbG8xq3+0ePoq972HSl393l kj+jp8tMi5pWwE2+xD++kRD36WdN28BQ87YzeQWkOyzAVp+or5Qi+lsZjznn1n/T SaOkxopYMr4a8muk2V768GzJZNSi9ceDzY0aJZ790vQOGKLZ+DnHtcCr9P8UJvQg == X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeduvddrledvgdefvdcutefuodetggdotefrodftvf curfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfghnecu uegrihhlohhuthemuceftddtnecunecujfgurhepofgfggfkjghffffhvffutgesthdtre dtreertdenucfhrhhomhepfdevhhhrihhsthhophhhvghrucghohhougdfuceotggrfies hhgvrghpihhnghgsihhtshdrnhgvtheqnecuffhomhgrihhnpehhthhtphgsihhsthhhrg hnkhhstghhrhhishgurghvihguthhlshhmrghilhhinhhglhhishhtthhlshhivghtfhdr ohhrghdpghhithhhuhgsrdgtohhmpdhivghtfhdrohhrghenucfrrghrrghmpehmrghilh hfrhhomheptggrfieshhgvrghpihhnghgsihhtshdrnhgvthenucevlhhushhtvghrufhi iigvpedt X-ME-Proxy: Received: by mailuser.nyi.internal (Postfix, from userid 501) id A0CF63C00A1; Mon, 29 Jul 2019 20:19:56 -0400 (EDT) X-Mailer: MessagingEngine.com Webmail Interface User-Agent: Cyrus-JMAP/3.1.6-736-gdfb8e44-fmstable-20190718v2 Mime-Version: 1.0 Message-Id: In-Reply-To: References: <8c903f04-7605-be98-5813-688d1ef88c55@cs.tcd.ie> <4b2de58d-1957-ca48-59ab-521e7a5b510f@cs.tcd.ie> <67e69531-69a2-24e3-c2e7-d95054a3382d@cs.tcd.ie> <6a678b80-6233-552d-4755-db0d194fc49c@cs.tcd.ie> <8fef8934-f3cb-0afe-df96-3a1d68524f35@cs.tcd.ie> Date: Mon, 29 Jul 2019 17:19:56 -0700 From: "Christopher Wood" To: "TLS@ietf.org" Content-Type: text/plain Archived-At: Subject: Re: [TLS] ESNI GREASE - answer needed? X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 30 Jul 2019 00:20:00 -0000 On Mon, Jul 29, 2019, at 5:11 PM, David Benjamin wrote: > On Mon, Jul 29, 2019 at 8:04 PM Stephen Farrell > wrote: > > > > Hiya, > > > > On 30/07/2019 00:58, David Benjamin wrote: > > > > > > [*] I filed https://github.com/tlswg/draft-ietf-tls-esni/issues/177 last > > > week with a sketch of an idea. Steven or I should hopefully have a more > > > concrete PR later. > > > > Working from there seems like a good path. That said > > I don't see that that says how an ESNI-aware but not > > ESNI-configured server ought behave. And it seems a > > bit complicated, although I agree a 50:50 split is as > > or more arbitrary. > > I think either of "do nothing and act like you are ESNI-unaware" or > "add some padding to EncryptedExtensions so you have room to be > ESNI-configured" is reasonable. Though, yeah, the draft should talk > about this a bit. I think the GREASE stuff turned out to have a lot > more details to work out than my original attempt anticipated. :-) > > PS: I'll note that I didn't know that PR existed as it > > hadn't hit the mailing list and I rarely login to the > > github web UI and that this isn't the first time I've > > had that experience. I don't blame anyone but there's > > clearly a bit of process stuff not quite working well > > here. I think people raising non-editorial PRs should > > bring those to the list. > > Apologies. I filed that during the meeting mostly so I wouldn't forget > and so Chris would have something to link to in his slides. The intent > was to write up an actual PR later which would certainly be sent to the > list for discussion. +1 It is our intention to bring non-editorial PRs to the list, though sometimes we fail at doing so. Would it help if we had a script to announce GitHub draft work to the list similar to that of QUIC and HTTPBIS? Thanks, Chris > > David > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > From nobody Mon Jul 29 19:11:12 2019 Return-Path: X-Original-To: tls@ietf.org Delivered-To: tls@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id A10A2120019; Mon, 29 Jul 2019 19:11:11 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: The IESG To: "IETF-Announce" X-Test-IDTracker: no X-IETF-IDTracker: 6.99.1 Auto-Submitted: auto-generated Precedence: bulk Sender: CC: draft-ietf-tls-grease@ietf.org, tls-chairs@ietf.org, Sean Turner , tls@ietf.org, sean@sn3rd.com, kaduk@mit.edu Content-Transfer-Encoding: 7bit Reply-To: ietf@ietf.org Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Message-ID: <156445267162.27972.16768798687426044506.idtracker@ietfa.amsl.com> Date: Mon, 29 Jul 2019 19:11:11 -0700 Archived-At: Subject: [TLS] Last Call: (Applying GREASE to TLS Extensibility) to Informational RFC X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 30 Jul 2019 02:11:12 -0000 The IESG has received a request from the Transport Layer Security WG (tls) to consider the following document: - 'Applying GREASE to TLS Extensibility' as Informational RFC The IESG plans to make a decision in the next few weeks, and solicits final comments on this action. Please send substantive comments to the ietf@ietf.org mailing lists by 2019-08-12. Exceptionally, comments may be sent to iesg@ietf.org instead. In either case, please retain the beginning of the Subject line to allow automated sorting. Abstract This document describes GREASE (Generate Random Extensions And Sustain Extensibility), a mechanism to prevent extensibility failures in the TLS ecosystem. It reserves a set of TLS protocol values that may be advertised to ensure peers correctly handle unknown values. The file can be obtained via https://datatracker.ietf.org/doc/draft-ietf-tls-grease/ IESG discussion can be tracked via https://datatracker.ietf.org/doc/draft-ietf-tls-grease/ballot/ No IPR declarations have been submitted directly on this I-D. From nobody Tue Jul 30 08:21:18 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1DA0E1200FB for ; Tue, 30 Jul 2019 08:21:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.5 X-Spam-Level: X-Spam-Status: No, score=-14.5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=OhtVGWU9; dkim=pass (1024-bit key) header.d=cisco.onmicrosoft.com header.b=VlkQS0Y9 Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tiOHayZ1aFRm for ; Tue, 30 Jul 2019 08:21:13 -0700 (PDT) Received: from rcdn-iport-7.cisco.com (rcdn-iport-7.cisco.com [173.37.86.78]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3F4251200F8 for ; Tue, 30 Jul 2019 08:21:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=19266; q=dns/txt; s=iport; t=1564500073; x=1565709673; h=from:to:subject:date:message-id:mime-version; bh=S6j41DYvnOXzfzeBCJ97eV1560kjThNNBIrIjuFjS40=; b=OhtVGWU9wOA9DYiPOjpy98Np5wNmnqHpwqhihLjMhnWTA3oLcUVGWIar 59F9KUrPl/WGSsw1zePQtMUwp6kJQR3j2f0hwZrJRsRW2KD3NkR2wW/Rw C2Hx8EORWrkBGkIlxAdQK/QHymQ12KN4Sf3aMFDNrXNinO++OpkzOVYqf M=; IronPort-PHdr: =?us-ascii?q?9a23=3A/8tY1B2Jb9G5nqg+smDT+zVfbzU7u7jyIg8e44?= =?us-ascii?q?YmjLQLaKm44pD+JxKGt+51ggrPWoPWo7JfhuzavrqoeFRI4I3J8RVgOIdJSw?= =?us-ascii?q?dDjMwXmwI6B8vQEkP/Mf7wYjYSF8VZX1gj9Ha+YgBY?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0BoBQA4X0Bd/4cNJK1lHAEBAQQBAQc?= =?us-ascii?q?EAQGBZ4EVL1ADbVUgBAsqCodbA40FTIMNgjuUG4JSA1QJAQEBDAEBLQIBAYR?= =?us-ascii?q?AAoJBIzgTAQMBAQQBAQIBBm2FHgyFYxsTAQE4EQGBACYBBBsagwGBHU0DHQG?= =?us-ascii?q?hOAKBOIhggiOCegEBBYULGIITCYE0i2AXgUA/gRFGghcHAQGCPoJaGIM7gia?= =?us-ascii?q?MBYd5lhZtCQKCGgOULpgRjT2XWgIEAgQFAg4BAQWBZyGBWHAVO4JsgkKDcYp?= =?us-ascii?q?TcoEpjC8BgSABAQ?= X-IronPort-AV: E=Sophos;i="5.64,327,1559520000"; d="scan'208,217";a="602556685" Received: from alln-core-2.cisco.com ([173.36.13.135]) by rcdn-iport-7.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 30 Jul 2019 15:21:09 +0000 Received: from XCH-ALN-017.cisco.com (xch-aln-017.cisco.com [173.36.7.27]) by alln-core-2.cisco.com (8.15.2/8.15.2) with ESMTPS id x6UFL9m7024057 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL) for ; Tue, 30 Jul 2019 15:21:09 GMT Received: from xhs-rtp-001.cisco.com (64.101.210.228) by XCH-ALN-017.cisco.com (173.36.7.27) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Tue, 30 Jul 2019 10:21:08 -0500 Received: from xhs-aln-003.cisco.com (173.37.135.120) by xhs-rtp-001.cisco.com (64.101.210.228) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Tue, 30 Jul 2019 11:21:07 -0400 Received: from NAM02-CY1-obe.outbound.protection.outlook.com (173.37.151.57) by xhs-aln-003.cisco.com (173.37.135.120) with Microsoft SMTP Server (TLS) id 15.0.1473.3 via Frontend Transport; Tue, 30 Jul 2019 10:21:07 -0500 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=g8mgd5kolaOQUjQm/6qyCq6H+xfZ2XXQQHIqvW7IRNGFctjjitviOB5j6gSvx2R1ojSCIKDaeb1eMGUfu8I9FTszS86FUEhcocHQnqwJs8woIeJL8XAtiDyYV/xnq/S90Y/eAkmAdg6G1peK/6zgWq8HQK6I8oEwtRSW7ObFdk5h0rfR9H5sxmYVUS4GG5vcb0xpWSw6RViNx9zLu9hi8j+E+18qqvqQS65Wm0Ts6kZzKfSpgv6qDZ01cU5tqEe722sHZST4p3a0aELaPEu/HA8aGmvJItjZ+NDWsfAdAUvbaHlNN9BJVRBvbvNYUnEwpzzZgqnrEQYIlG+/u2aVJw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=uyMOYhrF/yAZcUhefJujPl7sCpkkg0oZmhOgOtjqPG0=; b=Jnn/w4Zx54ItgiH0ZryCxqbte2owk4hI2cjonoIV68qlJXcSMM6g89ThcAhUwRzUw10sdP2wBeJSX49pc2MAXUMQD/cfGrH279YVzXC0RFtw7N2+5w1TYNgCeImDScRo0NvWMOZpVCdDed53lF5qC8cUI/61W6gB1JPruOiDTJ8NdiUl/QIPruHt+61CxOkYQOy+7HoJwmhFcOSYg06YCcFeRvm+ZmCibQ5QgcOns+h6SYCSb8AzQb7c5Lu8pSN9iXZ/g3dcZ1STMZs9D/h2yVPSYr9uBoHFsHZSnbEFVeDW+Gl8P7Yu9bLvdEcqQU80DSWtKVl7ar8RGN3qI9xg4w== ARC-Authentication-Results: i=1; mx.microsoft.com 1;spf=pass smtp.mailfrom=cisco.com;dmarc=pass action=none header.from=cisco.com;dkim=pass header.d=cisco.com;arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector2-cisco-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=uyMOYhrF/yAZcUhefJujPl7sCpkkg0oZmhOgOtjqPG0=; b=VlkQS0Y9NwNLLZrKTZFDVQuFdMIxJeivy4RwxLLAfySGgCWWCE2JI0RdwJK5aP6BTk/kIiI0v7uAAOJoIqLXLZEyJCWxQO97/bvDLZ5310BeJtyYRdp7srgKdq/Ld56WT8LpICC/01XlLzeCDrrRtjPpPJKfaDK9m5dfcWDJzzc= Received: from MN2PR11MB3871.namprd11.prod.outlook.com (10.255.180.204) by MN2PR11MB3582.namprd11.prod.outlook.com (20.178.251.28) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2115.10; Tue, 30 Jul 2019 15:21:06 +0000 Received: from MN2PR11MB3871.namprd11.prod.outlook.com ([fe80::4c5:965:c7b7:387b]) by MN2PR11MB3871.namprd11.prod.outlook.com ([fe80::4c5:965:c7b7:387b%3]) with mapi id 15.20.2115.005; Tue, 30 Jul 2019 15:21:06 +0000 From: "Scott Fluhrer (sfluhrer)" To: "" Thread-Topic: Options for negotiating hybrid key exchanges for postquantum Thread-Index: AdVG1haOE+yO4N1wQQSyYtQ5VKKSwA== Date: Tue, 30 Jul 2019 15:21:05 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=sfluhrer@cisco.com; x-originating-ip: [173.38.117.65] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: b82dc0e5-9560-4568-3361-08d715018ae4 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:MN2PR11MB3582; x-ms-traffictypediagnostic: MN2PR11MB3582: x-ms-exchange-purlcount: 2 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-forefront-prvs: 0114FF88F6 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(4636009)(396003)(346002)(376002)(136003)(366004)(39860400002)(189003)(199004)(15404003)(66476007)(25786009)(53936002)(102836004)(81156014)(81166006)(66066001)(7736002)(8676002)(5660300002)(99286004)(8936002)(7696005)(74316002)(54896002)(6436002)(6306002)(55016002)(186003)(6506007)(2906002)(68736007)(478600001)(26005)(316002)(6116002)(71190400001)(790700001)(476003)(71200400001)(9686003)(3846002)(33656002)(86362001)(66556008)(64756008)(66446008)(66946007)(76116006)(52536014)(486006)(256004)(14444005)(14454004)(491001); DIR:OUT; SFP:1101; SCL:1; SRVR:MN2PR11MB3582; H:MN2PR11MB3871.namprd11.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: cisco.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: Zz1YQoZFeZDAWRD7Z99CqOAGMpOUS432HzXds49OjoQJdd1DeHrw230MwFxOrOjQmpRqi+abErJWgFHkTiu+wd3wOS+i2HMPcuJkjb3GWfquWt1uOvOUSZLIjndfWn44/s1z8lkCtX5XXaQMAc7uOttAcS/rom7KpDfQAgQzE9e/qey2TElzZ+6L8fMfq5BFv+xRaQvGAEYU2rvObtsXS5WP5/HI4m3ELsvEJJlsCG8QR1FrH7pZolcBbnPG65DkVXLdJufgl2ZQn9SYfZQ57EyQHSeqf6sp0OPZ56Os/37yXTm72fJNvUYFbNL1HJbayNrk+T43xmCLQZqCWbZzxHO+OUn8WZru/5FIlV+S5xhOcdwm3mkP0I5x3M21SXrpnJJy04nH8Bxss3nNc6mfIiTH3hSEmtz3Dd8X483wQLY= Content-Type: multipart/alternative; boundary="_000_MN2PR11MB38719A31081434FEF6A84999C1DC0MN2PR11MB3871namp_" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: b82dc0e5-9560-4568-3361-08d715018ae4 X-MS-Exchange-CrossTenant-originalarrivaltime: 30 Jul 2019 15:21:06.1978 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: sfluhrer@cisco.com X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN2PR11MB3582 X-OriginatorOrg: cisco.com X-Outbound-SMTP-Client: 173.36.7.27, xch-aln-017.cisco.com X-Outbound-Node: alln-core-2.cisco.com Archived-At: Subject: [TLS] Options for negotiating hybrid key exchanges for postquantum X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 30 Jul 2019 15:21:16 -0000 --_000_MN2PR11MB38719A31081434FEF6A84999C1DC0MN2PR11MB3871namp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable During the physical meeting in Montreal, we had a discussion about postquan= tum security, and in particular, on how one might want to negotiate several= different 'groups' simultaneously (because there might not be one group th= at is entirely trusted, and I put 'groups' in scarequotes because postquant= um key exchanges are typically not formed from a Diffie-Hellman group). At the meeting, there were two options presented: Option 1: as the supported group, we insert a 'hybrid marker' (and include = an extension that map lists which combination the hybrid marker stands for) For example, the client might list in his supported groups = hybrid_marker_0 and hybrid_marker_1, and there would be a separate extensio= n that lists hybrid_marker_0 =3D X25519 + SIKEp434 and hybrid_marker_1 =3D = X25519 + NTRUPR653. The server would then look up the meanings of hybrid_m= arker_0 and 1 in the extension, and then compare that against his security = policy. In this option, we would ask IANA to allocate code points for the various i= ndividual postquantum key exchanges (in this example, SIKEp434 and NTRUPR65= 3), as well a range of code points for the various hybrid_markers. Option 2: we have code points for all the various combinations that we may = want to support; hence IANA might allocate a code point X25519_SIKEp434 and= another code point for X25519_NTRUPR653. With this option, the client wou= ld list X25519_SIKEp434 and X25519_NTRUPR653 in their supported groups. In this option, we would ask IANA to allocate code points f= or all the various combinations that we want allow to be negotiated. I would like to make an argument in favor of option 1: * It is likely that not everyone will be satisified with "X25519 plus o= ne of a handful of specific postquantum algorithms"; some may prefer anothe= r elliptic curve (for example, x448), or perhaps even a MODP group; I have = talked to people who do not trust ECC); in addition, other people might not= trust a single postquantum algorithm, and may want to rely on both (for ex= ample) SIKE and NewHope (which are based on very different hard problems). = With option 2, we could try to anticipate all the common combintations (su= ch as P384_SIKEp434_NEWHOPE512CCA), however that could very well end up as = a lot of combinations. * There are likely to be several NIST-approved postquantum key exchange= s, and each of those key exchanges are likely to have a number of supported= parameter sets (if we take the specific postquantum key exchange as analog= ous to th ECDH protocool, the "parameter set" could be thought of an analog= ous to the specific elliptuc curve, and it modifies the key share size, the= performance and sometimes the security properties). In fact, one of the N= IST submissoins currently has 30 parameter sets defined. Hence, even if NI= ST doesn't approve all the parameter sets (or some of them do not make sens= e for TLS in any scenario), we might end up with 20 or more different key e= xchange/parameter set combinations that do make sense for some scenario tha= t uses tLS (be it in a tranditional PC client/server, a wireless client, tw= o cloud devices communicating or an IOT device). * In addition, we are likely to support additional primitives in the fu= ture; possibly National curves (e.g. Brainpool), or additional Postquantum = algorithms (or additional parameter sets to existing ones). Of course, onc= e we add that code point, we'll need to add the additional code points for = all the combinations that it'll make sense in (very much like we had to add= a number of ciphersuites whenever we added a new encryption algorithm into= TLS 1.2). It seemds reasonable to me that the combination of these two factors are li= kely to cause us (should we select option 2) to define a very large number = of code points to cover all the various options that people need. Now, this is based on speculation (both of the NIST process, and additional= primitives that will be added to the protocol), and one objection I've hea= rd is "we don't know what's going to happen, and so why would we make decis= ions based on this speculation?" I agree that we have lack of knowledge; h= owever it seems to me that a lack of knowledge is an argument in favor of s= electing the more flexible option (which, in my opinion, is option 1, as it= allows the negotiation of combinations of key exchanges that the WG has no= t anticipated). My plea: lets not repeat the TLS 1.2 ciphersuite mess; lets add an extensio= n that keeps the number of code points we need to a reasonable bound. The costs of option 1? * It does increase the complexity on the server a small amount (I'm not= a TLS implementor, however it would seem to me to be only a fairly small a= mount) * It may increase the size of the client hello a small amount (on the o= ther hand, because it allows us to avoid sending duplicate key shares, it c= an also reduce the size of the client hello as well, depending on what's ac= tually negotiated) IMHO, the small increase in complexity is worth the lack of complexity in t= he code point table, and the additional flexibility it gives. --_000_MN2PR11MB38719A31081434FEF6A84999C1DC0MN2PR11MB3871namp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

During the physical meeting in Montreal, we had a di= scussion about postquantum security, and in particular, on how one might wa= nt to negotiate several different ‘groups’ simultaneously (beca= use there might not be one group that is entirely trusted, and I put ‘groups’ in scarequotes because postquantum= key exchanges are typically not formed from a Diffie-Hellman group).<= /o:p>

 

At the meeting, there were two = options presented:

 

Option 1: as the supported grou= p, we insert a ‘hybrid marker’ (and include an extension that m= ap lists which combination the hybrid marker stands for)<= /p>

     &= nbsp;          For example, th= e client might list in his supported groups hybrid_marker_0 and hybrid_mark= er_1, and there would be a separate extension that lists hybrid_marker_0 = =3D X25519 + SIKEp434 and hybrid_marker_1 =3D X25519 + NTRUPR653.  The server would then look up the meanin= gs of hybrid_marker_0 and 1 in the extension, and then compare that against= his security policy.

In t= his option, we would ask IANA to allocate code points for the various indiv= idual postquantum key exchanges (in this example, SIKEp434 and NTRUPR653), = as well a range of code points for the various hybrid_markers.

 

Option 2: we have code points f= or all the various combinations that we may want to support; hence IANA mig= ht allocate a code point X25519_SIKEp434 and another code point for X25519_= NTRUPR653.  With this option, the client would list X25519_SIKEp434 and X25519_NTRUPR653 in their supported groups.=

     &= nbsp;          In this option,= we would ask IANA to allocate code points for all the various combinations= that we want allow to be negotiated.

 

I would like to make an argumen= t in favor of option 1:

 

  • It is likely that not everyone will be satisifie= d with “X25519 plus one of a handful of specific postquantum algorith= ms”; some may prefer another elliptic curve (for example, x448), or perhaps even a MODP group; I have talked to people= who do not trust ECC); in addition, other people might not trust a single = postquantum algorithm, and may want to rely on both (for example) SIKE and = NewHope (which are based on very different hard problems).  With option 2, we could try to anticipate = all the common combintations (such as P384_SIKEp434_NEWHOPE512CCA), however= that could very well end up as a lot of combinations.
  • There are likely to be several NIST-approved p= ostquantum key exchanges, and each of those key exchanges are likely to hav= e a number of supported parameter sets (if we take the specific postquantum key exchange as analogous to th ECDH prot= ocool, the “parameter set” could be thought of an analogous to = the specific elliptuc curve, and it modifies the key share size, the perfor= mance and sometimes the security properties).  In fact, one of the NIST submissoins currently has 30 parameter sets defin= ed.  Hence, even if NIST doesn’t approve all the parameter sets = (or some of them do not make sense for TLS in any scenario), we might end u= p with 20 or more different key exchange/parameter set combinations that do make sense for some scenario that uses tLS (be it= in a tranditional PC client/server, a wireless client, two cloud devices c= ommunicating or an IOT device).
  • In addition, we are likely to support additional primitives in the fu= ture; possibly National curves (e.g. Brainpool), or additional Postquantum = algorithms (or additional parameter sets to existing ones).  Of course, once we add that code p= oint, we’ll need to add the additional code points for all the combin= ations that it’ll make sense in (very much like we had to add a numbe= r of ciphersuites whenever we added a new encryption algorithm into TLS 1.2).

 

It seemds reasonable to me that= the combination of these two factors are likely to cause us (should we sel= ect option 2) to define a very large number of code points to cover all the= various options that people need.

 

Now, this is based on speculati= on (both of the NIST process, and additional primitives that will be added = to the protocol), and one objection I’ve heard is “we don’= ;t know what’s going to happen, and so why would we make decisions based on this speculation?”  I agree that we have lac= k of knowledge; however it seems to me that a lack of knowledge is an argum= ent in favor of selecting the more flexible option (which, in my opinion, i= s option 1, as it allows the negotiation of combinations of key exchanges that the WG has not anticipated).=

 

My plea: lets not repeat the TLS 1.2 ciphersuite mes= s; lets add an extension that keeps the number of code points we need to a = reasonable bound.

 

The costs of option 1?

  • It does increase the complexity on the server a small amount (I’= ;m not a TLS implementor, however it would seem to me to be only a fairly s= mall amount)
  • It may increase the size of the client he= llo a small amount (on the other hand, because it allows us to avoid sendin= g duplicate key shares, it can also reduce the size of the client hello as well, depending on what’s actually negotiated)

IMHO, the small increase in complexity is worth the = lack of complexity in the code point table, and the additional flexibility = it gives.

--_000_MN2PR11MB38719A31081434FEF6A84999C1DC0MN2PR11MB3871namp_-- From nobody Tue Jul 30 09:18:17 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 836951201C8 for ; Tue, 30 Jul 2019 09:18:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BaG-nGiGGLGC for ; Tue, 30 Jul 2019 09:18:12 -0700 (PDT) Received: from mail-lf1-x136.google.com (mail-lf1-x136.google.com [IPv6:2a00:1450:4864:20::136]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4CFB212016F for ; Tue, 30 Jul 2019 09:18:12 -0700 (PDT) Received: by mail-lf1-x136.google.com with SMTP id p197so45124885lfa.2 for ; Tue, 30 Jul 2019 09:18:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=7T+VOLbk+kxjTFzF1VoW/xdi+lBc66ocvRUfX3acpYI=; b=jNALAzExVFxxzLg2uN0EGS1skqezqL7HAX6mNTj7Nzmg4RIFAtcRcU7+LRShVWO3Le j9YehH+ZdPoxrvpInuqw4Mc3hVG+ooNFMQgnmqET+5X8AzASZizuFeeG8BoSBZIqQDqt IkJ7cX5QMbRweFWnqsZyLFFtEFYhJCr/ZewpJZYjxzUtExHX+ruF4z1hvOlDNv7novVK N9XZzDre12aOhw8mFwAL5RIrP0uTUZmz7I8QKH1Qo+AvTGSSCP1eRlmzse66crNcxx94 lCFEW/M7o0rbYmQflMLIcK3ZMY+Q2QlmnevVoPJiLWIhxY4FnytlCnPYN1rq6VPF4J8S xm+A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=7T+VOLbk+kxjTFzF1VoW/xdi+lBc66ocvRUfX3acpYI=; b=YyddanXRdOEoi+CNLKSEK1GiKNZEeom0JIIdnan5CgewxvK42f+clqE5bhS2Tmp+1w 81pLKbdj4b55OyxUsciofz3NfRr/gUUKDbQSl3R4bc2upWfWxoC4qKLAme1TzNnYs8No QdLqUwc9SP2M+xq6MPwuxIrPb+0KC0dn4fvpQQFJcNafAagLHOVyVPO1IHbRg/E2qqSt jbMIg0CZtbdCKERirR5Ix+BikvUQ59ezVztTsBKCoIlF8HOTPDs0nypMYdQwNST1tgfd fvjn3kk6OZVVDfESVV/9YxR3o8WsQN59XniHchKVOY4kwyG5OX+i1u2HbD7j5vJtbgxC gylQ== X-Gm-Message-State: APjAAAWDjyyia97MpsPiKiPPgWA0IV81YzoRl7Z8bnXOyDP8hO+NNPUv fUCAGiTYIAc3CKi25+SNvpBQB/JjGPFJR84Nafg= X-Google-Smtp-Source: APXvYqwzUqqUk/T50JbnnV16G0NGIKUaYo0WOc+Jg38bn65DkIFBJ0iV4jjBIFYyq16GnfwulQYCCaIobVnNldFlXuQ= X-Received: by 2002:a19:2297:: with SMTP id i145mr54422897lfi.97.1564503490366; Tue, 30 Jul 2019 09:18:10 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Watson Ladd Date: Tue, 30 Jul 2019 09:17:57 -0700 Message-ID: To: "Scott Fluhrer (sfluhrer)" Cc: TLS List Content-Type: multipart/alternative; boundary="000000000000cb135b058ee85af8" Archived-At: Subject: Re: [TLS] Options for negotiating hybrid key exchanges for postquantum X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 30 Jul 2019 16:18:15 -0000 --000000000000cb135b058ee85af8 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Tue, Jul 30, 2019, 8:21 AM Scott Fluhrer (sfluhrer) wrote: > During the physical meeting in Montreal, we had a discussion about > postquantum security, and in particular, on how one might want to negotia= te > several different =E2=80=98groups=E2=80=99 simultaneously (because there = might not be one > group that is entirely trusted, and I put =E2=80=98groups=E2=80=99 in sca= requotes because > postquantum key exchanges are typically not formed from a Diffie-Hellman > group). > > > > At the meeting, there were two options presented: > > > > Option 1: as the supported group, we insert a =E2=80=98hybrid marker=E2= =80=99 (and include > an extension that map lists which combination the hybrid marker stands fo= r) > > For example, the client might list in his supported group= s > hybrid_marker_0 and hybrid_marker_1, and there would be a separate > extension that lists hybrid_marker_0 =3D X25519 + SIKEp434 and > hybrid_marker_1 =3D X25519 + NTRUPR653. The server would then look up th= e > meanings of hybrid_marker_0 and 1 in the extension, and then compare that > against his security policy. > > In this option, we would ask IANA to allocate code points for the various > individual postquantum key exchanges (in this example, SIKEp434 and > NTRUPR653), as well a range of code points for the various hybrid_markers= . > > > Option 2: we have code points for all the various combinations that we ma= y > want to support; hence IANA might allocate a code point X25519_SIKEp434 a= nd > another code point for X25519_NTRUPR653. With this option, the client > would list X25519_SIKEp434 and X25519_NTRUPR653 in their supported groups= . > > In this option, we would ask IANA to allocate code points > for all the various combinations that we want allow to be negotiated. > > > > I would like to make an argument in favor of option 1: > > > > - It is likely that not everyone will be satisified with =E2=80=9CX255= 19 plus > one of a handful of specific postquantum algorithms=E2=80=9D; some may= prefer > another elliptic curve (for example, x448), or perhaps even a MODP gro= up; I > have talked to people who do not trust ECC); in addition, other people > might not trust a single postquantum algorithm, and may want to rely o= n > both (for example) SIKE and NewHope (which are based on very different= hard > problems). With option 2, we could try to anticipate all the common > combintations (such as P384_SIKEp434_NEWHOPE512CCA), however that coul= d > very well end up as a lot of combinations. > - There are likely to be several NIST-approved postquantum key > exchanges, and each of those key exchanges are likely to have a number= of > supported parameter sets (if we take the specific postquantum key exch= ange > as analogous to th ECDH protocool, the =E2=80=9Cparameter set=E2=80=9D= could be thought of > an analogous to the specific elliptuc curve, and it modifies the key s= hare > size, the performance and sometimes the security properties). In fact= , one > of the NIST submissoins currently has 30 parameter sets defined. Henc= e, > even if NIST doesn=E2=80=99t approve all the parameter sets (or some o= f them do not > make sense for TLS in any scenario), we might end up with 20 or more > different key exchange/parameter set combinations that do make sense f= or > some scenario that uses tLS (be it in a tranditional PC client/server,= a > wireless client, two cloud devices communicating or an IOT device). > - In addition, we are likely to support additional primitives in the > future; possibly National curves (e.g. Brainpool), or additional > Postquantum algorithms (or additional parameter sets to existing ones)= . Of > course, once we add that code point, we=E2=80=99ll need to add the add= itional code > points for all the combinations that it=E2=80=99ll make sense in (very= much like we > had to add a number of ciphersuites whenever we added a new encryption > algorithm into TLS 1.2). > > > Are people actually going to use hybrid encryption post NIST? The actual deployments today for experiment have all fit option 2 and hybrids are unlikely in the future. My objection to 1 is it gets very messy. Do we use only the hybrids we both support? What if I throw a bunch of expensive things together? No reason we need a hybrid scheme! It seemds reasonable to me that the combination of these two factors are > likely to cause us (should we select option 2) to define a very large > number of code points to cover all the various options that people need. > > > > Now, this is based on speculation (both of the NIST process, and > additional primitives that will be added to the protocol), and one > objection I=E2=80=99ve heard is =E2=80=9Cwe don=E2=80=99t know what=E2=80= =99s going to happen, and so why > would we make decisions based on this speculation?=E2=80=9D I agree that= we have > lack of knowledge; however it seems to me that a lack of knowledge is an > argument in favor of selecting the more flexible option (which, in my > opinion, is option 1, as it allows the negotiation of combinations of key > exchanges that the WG has not anticipated). > > > > My plea: lets not repeat the TLS 1.2 ciphersuite mess; lets add an > extension that keeps the number of code points we need to a reasonable > bound. > > > > The costs of option 1? > > - It does increase the complexity on the server a small amount (I=E2= =80=99m > not a TLS implementor, however it would seem to me to be only a fairly > small amount) > - It may increase the size of the client hello a small amount (on the > other hand, because it allows us to avoid sending duplicate key shares= , it > can also reduce the size of the client hello as well, depending on wha= t=E2=80=99s > actually negotiated) > > IMHO, the small increase in complexity is worth the lack of complexity in > the code point table, and the additional flexibility it gives. > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > --000000000000cb135b058ee85af8 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


On Tue, Jul 30, 2019, 8:21 AM Scott Fluhrer (sfluhrer)= <sfluhrer@cisco.com> wrote= :

During the physical meeting in Montreal, we had a di= scussion about postquantum security, and in particular, on how one might wa= nt to negotiate several different =E2=80=98groups=E2=80=99 simultaneously (= because there might not be one group that is entirely trusted, and I put =E2=80=98groups=E2=80=99 in scarequotes because postqua= ntum key exchanges are typically not formed from a Diffie-Hellman group).

=C2=A0

At the meeting, there were two = options presented:

=C2=A0

Option 1: as the supported grou= p, we insert a =E2=80=98hybrid marker=E2=80=99 (and include an extension th= at map lists which combination the hybrid marker stands for)<= /span>

=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 For example, t= he client might list in his supported groups hybrid_marker_0 and hybrid_mar= ker_1, and there would be a separate extension that lists hybrid_marker_0 = =3D X25519 + SIKEp434 and hybrid_marker_1 =3D X25519 + NTRUPR653.=C2=A0 The server would then look up the meanings o= f hybrid_marker_0 and 1 in the extension, and then compare that against his= security policy.

In t= his option, we would ask IANA to allocate code points for the various indiv= idual postquantum key exchanges (in this example, SIKEp434 and NTRUPR653), = as well a range of code points for the various hybrid_markers.

=C2=A0

Option 2: we have code points f= or all the various combinations that we may want to support; hence IANA mig= ht allocate a code point X25519_SIKEp434 and another code point for X25519_= NTRUPR653.=C2=A0 With this option, the client would list X25519_SIKEp434 and X25519_NTRUPR653 in their supported groups.=

=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 In this option= , we would ask IANA to allocate code points for all the various combination= s that we want allow to be negotiated.

=C2=A0

I would like to make an argumen= t in favor of option 1:

=C2=A0

  • It is likely that not everyone will be satisified w= ith =E2=80=9CX25519 plus one of a handful of specific postquantum algorithm= s=E2=80=9D; some may prefer another elliptic curve (for example, x448), or perhaps even a MODP group; I have talked to people= who do not trust ECC); in addition, other people might not trust a single = postquantum algorithm, and may want to rely on both (for example) SIKE and = NewHope (which are based on very different hard problems).=C2=A0 With option 2, we could try to anticipate = all the common combintations (such as P384_SIKEp434_NEWHOPE512CCA), however= that could very well end up as a lot of combinations.=
  • There are likely to be several NIST-approved p= ostquantum key exchanges, and each of those key exchanges are likely to hav= e a number of supported parameter sets (if we take the specific postquantum key exchange as analogous to th ECDH prot= ocool, the =E2=80=9Cparameter set=E2=80=9D could be thought of an analogous= to the specific elliptuc curve, and it modifies the key share size, the pe= rformance and sometimes the security properties).=C2=A0 In fact, one of the NIST submissoins currently has 30 parameter sets defin= ed.=C2=A0 Hence, even if NIST doesn=E2=80=99t approve all the parameter set= s (or some of them do not make sense for TLS in any scenario), we might end= up with 20 or more different key exchange/parameter set combinations that do make sense for some scenario that uses tLS (be it= in a tranditional PC client/server, a wireless client, two cloud devices c= ommunicating or an IOT device).
  • In addition, we are likely to support additional primitives in the fu= ture; possibly National curves (e.g. Brainpool), or additional Postquantum = algorithms (or additional parameter sets to existing ones).=C2=A0 Of course, once we add that code p= oint, we=E2=80=99ll need to add the additional code points for all the comb= inations that it=E2=80=99ll make sense in (very much like we had to add a n= umber of ciphersuites whenever we added a new encryption algorithm into TLS 1.2).

=C2=A0

<= /div>

Are people actually going to use hybrid encryption post NIST? The actual d= eployments today=C2=A0 for experiment have all fit option 2 and hybrids are= unlikely in the future.=C2=A0

My objection to 1 is it gets very messy. Do we use only the hybrids = we both support? What if I throw a bunch of expensive things together? No r= eason we need a hybrid scheme!=C2=A0

It seemds reasonable to me that= the combination of these two factors are likely to cause us (should we sel= ect option 2) to define a very large number of code points to cover all the= various options that people need.

=C2=A0

Now, this is based on speculati= on (both of the NIST process, and additional primitives that will be added = to the protocol), and one objection I=E2=80=99ve heard is =E2=80=9Cwe don= =E2=80=99t know what=E2=80=99s going to happen, and so why would we make decisions based on this speculation?=E2=80=9D=C2=A0 I agree that we have l= ack of knowledge; however it seems to me that a lack of knowledge is an arg= ument in favor of selecting the more flexible option (which, in my opinion,= is option 1, as it allows the negotiation of combinations of key exchanges that the WG has not anticipated).<= /u>

=C2=A0

My plea: lets not repeat the TLS 1.2 ciphersuite mes= s; lets add an extension that keeps the number of code points we need to a = reasonable bound.

=C2=A0

The costs of option 1?

  • It does increase the complexity on the server a small amount (I=E2=80=99= m not a TLS implementor, however it would seem to me to be only a fairly sm= all amount)
  • It may increase the size of the client hel= lo a small amount (on the other hand, because it allows us to avoid sending= duplicate key shares, it can also reduce the size of the client hello as well, depending on what=E2=80=99s actually negotiated)<= /u>

IMHO, the small increase in complexity is worth the = lack of complexity in the code point table, and the additional flexibility = it gives.

_______________________________________________
TLS mailing list
TLS@ie= tf.org
https://www.ietf.org/mailman/listinfo/tls
--000000000000cb135b058ee85af8-- From nobody Tue Jul 30 11:24:19 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4BC6F120261 for ; Tue, 30 Jul 2019 11:24:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.25 X-Spam-Level: X-Spam-Status: No, score=-9.25 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.249, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_SPF_WL=-7.5] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=chromium.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id q5-r8pEWDTtB for ; Tue, 30 Jul 2019 11:24:14 -0700 (PDT) Received: from mail-qt1-x841.google.com (mail-qt1-x841.google.com [IPv6:2607:f8b0:4864:20::841]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E1D82120295 for ; Tue, 30 Jul 2019 11:24:01 -0700 (PDT) Received: by mail-qt1-x841.google.com with SMTP id l9so63924933qtu.6 for ; Tue, 30 Jul 2019 11:24:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=x6eL36sHLVNhwIwavv91VoK8WPIi1rAAJVO/lZZ2C2s=; b=eLtleupuqXMp0hPli15Q5yLC8StAjrwIIRYM9cToCLONhKN+TNaj8JAhaA/I7LAI96 cZa9miTMBJS/fcrG8cBndzf3F06zxHy9f4W2FpJ/mN3mYWNgaBlV6Wyq1+uFgkPssEz8 RMPaHBqT4RYHobFwaFv03g8h6+iBn0kMvRVew= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=x6eL36sHLVNhwIwavv91VoK8WPIi1rAAJVO/lZZ2C2s=; b=H6EZpzQoRPsBTgzq10lzANSI6dyeRwvNd+FxYG68UbXTMVy3d2pXW8TQodX8UaZS/v 2d2VdjxdiQb9pkHKjzotwlF06fOhw/5qwhmjRxjKvnAnOVIYALox7gi5uSM6FL4JSimt ZPyIQOuhOAsKrL9sVLnE1pRNVfuXHt5bqD5JJwFF48rJhAaE/F5vC2wWEQTGlcGMJdzA R97DQIQ9BmwZVDo8lZ0iFyqooqMZCCZYJj/PGciuXF5kJRyudUDDaPOND/KAswlo1JU2 1EildXDtTb2/Kx7edatMUFZzJnkGAlzw7Fg2RI0w4Q03zFtSj8/dq1TtDRypBewPicCn iP5w== X-Gm-Message-State: APjAAAVH4xRWCkcZkOSP0Xf6jSE1z/BmmRqM5DcOrk15S5WsOj9nh/lL StJ3zPdNbAl8uZzDwifisTY4NMjDIL2dnuPnPnJ9 X-Google-Smtp-Source: APXvYqz4UmXG2luHr4X1ZOZLsVTL7OIHdyxxbZgMPlqzqw0eAPq7rsuF5w2Ck9j4jnYvqR6TUE2LGF6o89+Rgx6EHuY= X-Received: by 2002:ac8:4687:: with SMTP id g7mr19805360qto.213.1564511040740; Tue, 30 Jul 2019 11:24:00 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: David Benjamin Date: Tue, 30 Jul 2019 14:23:43 -0400 Message-ID: To: Watson Ladd Cc: "Scott Fluhrer (sfluhrer)" , TLS List Content-Type: multipart/alternative; boundary="000000000000d5407d058eea1c55" Archived-At: Subject: Re: [TLS] Options for negotiating hybrid key exchanges for postquantum X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 30 Jul 2019 18:24:18 -0000 --000000000000d5407d058eea1c55 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable I think this underestimates the complexity cost of option 1 to the protocol and implementations. Option 1 means group negotiation includes entire codepoints whose meaning cannot be determined without a parallel extension. This compounds across everything which interacts with named groups, impacting everything from APIs to config file formats to even UI surfaces. Other uses of NamedGroups are impacted too. For instance, option 2 fits into draft-ietf-tls-esni as-is. Option 1 requires injecting hybrid_extension into ESNI somehow. Analysis must further check every use, say, incorporates this parallel lookup table into transcript-like measures. The lesson from TLS 1.2 code points is not combined codepoints vs. split ones. Rather, the lesson is to avoid interdependent decisions: * Signature algorithms in TLS 1.2 were a mess because the ECDSA codepoints required cross-referencing against the supported curves list. The verifier could not express some preferences (signing SHA-512 with P-256 is silly, and mixing hash+curve pairs in ECDSA is slightly off in general). As analogy to option 1's ESNI problem, we even forgot to allow the server to express curve preferences. TLS 1.3 combined signature algorithm considerations into a single codepoint to address all this. * Cipher suites in TLS 1.2 were a mess because they were half-combined and half-split. TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 said to use some ECDHE key exchange, but you need to check if you have a NamedGroup in common first. It said to use ECDSA, but you need to check signature algorithms (which themselves cross-reference curves) first. Early drafts of TLS 1.3 had it even worse, where a TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 full handshake morphed into TLS_ECDHE_PSK_WITH_AES_128_GCM_SHA256 on resumption. Thus, TLS 1.3 cipher suites negotiate solely AEAD + PRF hash. In fairness to TLS 1.2, some of this was a consequence of TLS 1.2's evolution over time as incremental extensions over SSL 3.0. And sometimes we do need to pay costs like these. But hybrid key exchanges fit into the NamedGroup "API" just fine, so option 2 is the clear answer. Code points are cheap. Protocol complexity is much more expensive. It's true that standards are often underspecified. This means the IETF should finish the job, not pass all variations through. RSA-PSS is a clear example of what to avoid. It takes more bytes to merely utter "RSA-PSS with SHA-256 and usual parameters" in X.509 than to encode an entire ECDSA signature! We should not define more than a handful of options, regardless of the encoding. On Tue, Jul 30, 2019 at 12:18 PM Watson Ladd wrote: > > > On Tue, Jul 30, 2019, 8:21 AM Scott Fluhrer (sfluhrer) > wrote: > >> During the physical meeting in Montreal, we had a discussion about >> postquantum security, and in particular, on how one might want to negoti= ate >> several different =E2=80=98groups=E2=80=99 simultaneously (because there= might not be one >> group that is entirely trusted, and I put =E2=80=98groups=E2=80=99 in sc= arequotes because >> postquantum key exchanges are typically not formed from a Diffie-Hellman >> group). >> >> >> >> At the meeting, there were two options presented: >> >> >> >> Option 1: as the supported group, we insert a =E2=80=98hybrid marker=E2= =80=99 (and >> include an extension that map lists which combination the hybrid marker >> stands for) >> >> For example, the client might list in his supported >> groups hybrid_marker_0 and hybrid_marker_1, and there would be a separat= e >> extension that lists hybrid_marker_0 =3D X25519 + SIKEp434 and >> hybrid_marker_1 =3D X25519 + NTRUPR653. The server would then look up t= he >> meanings of hybrid_marker_0 and 1 in the extension, and then compare tha= t >> against his security policy. >> >> In this option, we would ask IANA to allocate code points for the variou= s >> individual postquantum key exchanges (in this example, SIKEp434 and >> NTRUPR653), as well a range of code points for the various hybrid_marker= s. >> > >> >> Option 2: we have code points for all the various combinations that we >> may want to support; hence IANA might allocate a code point X25519_SIKEp= 434 >> and another code point for X25519_NTRUPR653. With this option, the clie= nt >> would list X25519_SIKEp434 and X25519_NTRUPR653 in their supported group= s. >> >> In this option, we would ask IANA to allocate code point= s >> for all the various combinations that we want allow to be negotiated. >> >> >> >> I would like to make an argument in favor of option 1: >> >> >> >> - It is likely that not everyone will be satisified with =E2=80=9CX25= 519 plus >> one of a handful of specific postquantum algorithms=E2=80=9D; some ma= y prefer >> another elliptic curve (for example, x448), or perhaps even a MODP gr= oup; I >> have talked to people who do not trust ECC); in addition, other peopl= e >> might not trust a single postquantum algorithm, and may want to rely = on >> both (for example) SIKE and NewHope (which are based on very differen= t hard >> problems). With option 2, we could try to anticipate all the common >> combintations (such as P384_SIKEp434_NEWHOPE512CCA), however that cou= ld >> very well end up as a lot of combinations. >> - There are likely to be several NIST-approved postquantum key >> exchanges, and each of those key exchanges are likely to have a numbe= r of >> supported parameter sets (if we take the specific postquantum key exc= hange >> as analogous to th ECDH protocool, the =E2=80=9Cparameter set=E2=80= =9D could be thought of >> an analogous to the specific elliptuc curve, and it modifies the key = share >> size, the performance and sometimes the security properties). In fac= t, one >> of the NIST submissoins currently has 30 parameter sets defined. Hen= ce, >> even if NIST doesn=E2=80=99t approve all the parameter sets (or some = of them do not >> make sense for TLS in any scenario), we might end up with 20 or more >> different key exchange/parameter set combinations that do make sense = for >> some scenario that uses tLS (be it in a tranditional PC client/server= , a >> wireless client, two cloud devices communicating or an IOT device). >> - In addition, we are likely to support additional primitives in the >> future; possibly National curves (e.g. Brainpool), or additional >> Postquantum algorithms (or additional parameter sets to existing ones= ). Of >> course, once we add that code point, we=E2=80=99ll need to add the ad= ditional code >> points for all the combinations that it=E2=80=99ll make sense in (ver= y much like we >> had to add a number of ciphersuites whenever we added a new encryptio= n >> algorithm into TLS 1.2). >> >> >> > > Are people actually going to use hybrid encryption post NIST? The actual > deployments today for experiment have all fit option 2 and hybrids are > unlikely in the future. > > My objection to 1 is it gets very messy. Do we use only the hybrids we > both support? What if I throw a bunch of expensive things together? No > reason we need a hybrid scheme! > > It seemds reasonable to me that the combination of these two factors are >> likely to cause us (should we select option 2) to define a very large >> number of code points to cover all the various options that people need. >> >> >> >> Now, this is based on speculation (both of the NIST process, and >> additional primitives that will be added to the protocol), and one >> objection I=E2=80=99ve heard is =E2=80=9Cwe don=E2=80=99t know what=E2= =80=99s going to happen, and so why >> would we make decisions based on this speculation?=E2=80=9D I agree tha= t we have >> lack of knowledge; however it seems to me that a lack of knowledge is an >> argument in favor of selecting the more flexible option (which, in my >> opinion, is option 1, as it allows the negotiation of combinations of ke= y >> exchanges that the WG has not anticipated). >> >> >> >> My plea: lets not repeat the TLS 1.2 ciphersuite mess; lets add an >> extension that keeps the number of code points we need to a reasonable >> bound. >> >> >> >> The costs of option 1? >> >> - It does increase the complexity on the server a small amount (I=E2= =80=99m >> not a TLS implementor, however it would seem to me to be only a fairl= y >> small amount) >> - It may increase the size of the client hello a small amount (on the >> other hand, because it allows us to avoid sending duplicate key share= s, it >> can also reduce the size of the client hello as well, depending on wh= at=E2=80=99s >> actually negotiated) >> >> IMHO, the small increase in complexity is worth the lack of complexity i= n >> the code point table, and the additional flexibility it gives. >> _______________________________________________ >> TLS mailing list >> TLS@ietf.org >> https://www.ietf.org/mailman/listinfo/tls >> > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > --000000000000d5407d058eea1c55 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
I think this underestimates the complexity cost of op= tion 1 to the protocol and implementations. Option 1 means group negotiatio= n includes entire codepoints whose meaning cannot be determined without a p= arallel extension. This compounds across everything which interacts with na= med groups, impacting everything from APIs to config file formats to even U= I surfaces. Other uses of NamedGroups are impacted too. For instance, optio= n 2 fits into draft-ietf-tls-esni as-is. Option 1 requires injecting=C2=A0h= ybrid_extension into ESNI somehow. Analysis must further check every use, s= ay, incorporates this parallel lookup table into transcript-like measures.<= /div>

The lesson from TLS 1.2 code points is not combine= d codepoints vs. split ones. Rather, the lesson is to avoid interdependent = decisions:

* Signature algorithms in TLS 1.2 were = a mess because the ECDSA codepoints required cross-referencing against the = supported curves list. The verifier could not express some preferences (sig= ning SHA-512 with P-256 is silly, and mixing hash+curve pairs in ECDSA is s= lightly off in general). As analogy to option 1's ESNI problem, we even= forgot to allow the server to express curve preferences. TLS 1.3 combined = signature algorithm considerations into a single codepoint to address all t= his.

* Cipher suites in TLS 1.2 were a mess becaus= e they were half-combined and half-split. TLS_ECDHE_ECDSA_WITH_AES_128_GCM_= SHA256 said to use some ECDHE key exchange, but you need to check if you ha= ve a NamedGroup in common first. It said to use ECDSA, but you need to chec= k signature algorithms (which themselves cross-reference curves) first. Ear= ly drafts of TLS 1.3 had it even worse, where a=C2=A0TLS_ECDHE_ECDSA_WITH_A= ES_128_GCM_SHA256 full handshake morphed into=C2=A0TLS_ECDHE_PSK_WITH_AES_1= 28_GCM_SHA256 on resumption. Thus, TLS 1.3 cipher suites negotiate solely A= EAD=C2=A0+ PRF hash.

In fairness to TLS 1.2, some = of this was a consequence of TLS 1.2's evolution over time as increment= al extensions over SSL 3.0. And sometimes we do need to pay costs like thes= e. But hybrid key exchanges fit into the NamedGroup "API" just fi= ne, so option 2 is the clear answer. Code points are cheap. Protocol comple= xity is much more expensive.

It's true that st= andards are often underspecified. This means the IETF should finish the job= , not pass all variations through. RSA-PSS is a clear example of what to av= oid. It takes more bytes to merely utter "RSA-PSS with SHA-256 and usu= al parameters" in X.509 than to encode an entire ECDSA signature! We s= hould not define more than a handful of options, regardless of the encoding= .

On Tue, Jul 30, 2019 at 12:18 PM Watson Ladd <watsonbladd@gmail.com> wrote:


On Tue, Jul 30, 2= 019, 8:21 AM Scott Fluhrer (sfluhrer) <sfluhrer@cisco.com> wrote:

During the physical meeting in Montreal, we had a di= scussion about postquantum security, and in particular, on how one might wa= nt to negotiate several different =E2=80=98groups=E2=80=99 simultaneously (= because there might not be one group that is entirely trusted, and I put =E2=80=98groups=E2=80=99 in scarequotes because postqua= ntum key exchanges are typically not formed from a Diffie-Hellman group).

=C2=A0

At the meeting, there were two = options presented:

=C2=A0

Option 1: as the supported grou= p, we insert a =E2=80=98hybrid marker=E2=80=99 (and include an extension th= at map lists which combination the hybrid marker stands for)<= /span>

=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 For example, t= he client might list in his supported groups hybrid_marker_0 and hybrid_mar= ker_1, and there would be a separate extension that lists hybrid_marker_0 = =3D X25519 + SIKEp434 and hybrid_marker_1 =3D X25519 + NTRUPR653.=C2=A0 The server would then look up the meanings o= f hybrid_marker_0 and 1 in the extension, and then compare that against his= security policy.

In = this option, we would ask IANA to allocate code points for the various indi= vidual postquantum key exchanges (in this example, SIKEp434 and NTRUPR653),= as well a range of code points for the various hybrid_markers.

=C2=A0

Option 2: we have code points f= or all the various combinations that we may want to support; hence IANA mig= ht allocate a code point X25519_SIKEp434 and another code point for X25519_= NTRUPR653.=C2=A0 With this option, the client would list X25519_SIKEp434 and X25519_NTRUPR653 in their supported groups.=

=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 In this option= , we would ask IANA to allocate code points for all the various combination= s that we want allow to be negotiated.

=C2=A0

I would like to make an argumen= t in favor of option 1:

=C2=A0

  • It is likely that not ev= eryone will be satisified with =E2=80=9CX25519 plus one of a handful of spe= cific postquantum algorithms=E2=80=9D; some may prefer another elliptic cur= ve (for example, x448), or perhaps even a MODP group; I have talked to people= who do not trust ECC); in addition, other people might not trust a single = postquantum algorithm, and may want to rely on both (for example) SIKE and = NewHope (which are based on very different hard problems).=C2=A0 With option 2, we could try to anticipate = all the common combintations (such as P384_SIKEp434_NEWHOPE512CCA), however= that could very well end up as a lot of combinations.=
  • There are likely to= be several NIST-approved postquantum key exchanges, and each of those key = exchanges are likely to have a number of supported parameter sets (if we take the specific postquantum key exchange as analogous to th ECDH prot= ocool, the =E2=80=9Cparameter set=E2=80=9D could be thought of an analogous= to the specific elliptuc curve, and it modifies the key share size, the pe= rformance and sometimes the security properties).=C2=A0 In fact, one of the NIST submissoins currently has 30 parameter sets defin= ed.=C2=A0 Hence, even if NIST doesn=E2=80=99t approve all the parameter set= s (or some of them do not make sense for TLS in any scenario), we might end= up with 20 or more different key exchange/parameter set combinations that do make sense for some scenario that uses tLS (be it= in a tranditional PC client/server, a wireless client, two cloud devices c= ommunicating or an IOT device).
  • In addition, we are likely to support addi= tional primitives in the future; possibly National curves (e.g. Brainpool),= or additional Postquantum algorithms (or additional parameter sets to existing ones).=C2=A0 Of course, once we add that code p= oint, we=E2=80=99ll need to add the additional code points for all the comb= inations that it=E2=80=99ll make sense in (very much like we had to add a n= umber of ciphersuites whenever we added a new encryption algorithm into TLS 1.2).

=C2=A0

<= /div>

Are people actually going to use hybrid encryption post NIST? The actual d= eployments today=C2=A0 for experiment have all fit option 2 and hybrids are= unlikely in the future.=C2=A0

My objection to 1 is it gets very messy. Do we use only the hybrids = we both support? What if I throw a bunch of expensive things together? No r= eason we need a hybrid scheme!=C2=A0

It seemds reasonable to me that= the combination of these two factors are likely to cause us (should we sel= ect option 2) to define a very large number of code points to cover all the= various options that people need.

=C2=A0

Now, this is based on speculati= on (both of the NIST process, and additional primitives that will be added = to the protocol), and one objection I=E2=80=99ve heard is =E2=80=9Cwe don= =E2=80=99t know what=E2=80=99s going to happen, and so why would we make decisions based on this speculation?=E2=80=9D=C2=A0 I agree that we have l= ack of knowledge; however it seems to me that a lack of knowledge is an arg= ument in favor of selecting the more flexible option (which, in my opinion,= is option 1, as it allows the negotiation of combinations of key exchanges that the WG has not anticipated).<= /u>

=C2=A0

My plea: lets not repeat the TLS 1.2 ciphersuite mes= s; lets add an extension that keeps the number of code points we need to a = reasonable bound.

=C2=A0

The costs of option 1?

  • It does increase the complexity on the server= a small amount (I=E2=80=99m not a TLS implementor, however it would seem t= o me to be only a fairly small amount)
  • It may increase the size of the client hello a small amount (on= the other hand, because it allows us to avoid sending duplicate key shares= , it can also reduce the size of the client hello as well, depending on what=E2=80=99s actually negotiated)<= /u>

IMHO, the small increase in complexity is worth the = lack of complexity in the code point table, and the additional flexibility = it gives.

_______________________________________________
TLS mailing list
TLS@ie= tf.org
https://www.ietf.org/mailman/listinfo/tls
_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls
--000000000000d5407d058eea1c55-- From nobody Tue Jul 30 11:41:47 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 05490120154 for ; Tue, 30 Jul 2019 11:41:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.501 X-Spam-Level: X-Spam-Status: No, score=-14.501 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=k9v8fWA4; dkim=pass (1024-bit key) header.d=cisco.onmicrosoft.com header.b=SiSC6VVM Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ASr7iGqJYjAR for ; Tue, 30 Jul 2019 11:41:44 -0700 (PDT) Received: from rcdn-iport-3.cisco.com (rcdn-iport-3.cisco.com [173.37.86.74]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D7C9D12008D for ; Tue, 30 Jul 2019 11:41:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=6154; q=dns/txt; s=iport; t=1564512103; x=1565721703; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-transfer-encoding:mime-version; bh=QnG/pkj6RVPYaikB1XDg2rsTJiUCA8qCn1ZYusfK1+w=; b=k9v8fWA4o62Hrs3czMKK5L93e5UPPEc4Qq+ydvnx0x/P1CTLrQqe3kh+ XNLlWuyaZgenYxLFP6b59kmPJwP8aWuDf9R8yjkWoAGdp1Se6Vym/jJEu fUKEKiVty9fbz3IkMp4NCWz9tNg/CzK7mAjWvjDDdSSPv2EkgylaJvyHa c=; IronPort-PHdr: =?us-ascii?q?9a23=3AAzrVzxApsidtL6F8Iz6TUyQJPHJ1sqjoPgMT9p?= =?us-ascii?q?ssgq5PdaLm5Zn5IUjD/qs03kTRU9Dd7PRJw6rNvqbsVHZIwK7JsWtKMfkuHw?= =?us-ascii?q?QAld1QmgUhBMCfDkiuN/DuciwgEd5qX15+9Hb9Ok9QS47z?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0CqAADSjkBd/4cNJK1lGgEBAQEBAgE?= =?us-ascii?q?BAQEHAgEBAQGBZ4FEUAOBQiAECyoKhBSDRwONBYJbiVSOAIJSA1QJAQEBDAE?= =?us-ascii?q?BLQIBAYRAAheCKyM4EwEDAQEEAQECAQZthR4MhUoBAQEBAgESEREMAQE3AQQ?= =?us-ascii?q?LAgEGAhUDAgIjAwICAh8RFAEQAQEEDgUIGoRrAw4PAZEFkGECgTiIYHGBMoJ?= =?us-ascii?q?6AQEFhQ4NC4ITCYEMKItgF4FAP4ERRoIeLj6CGoIUGIMJMoImjFiCJpsWLUA?= =?us-ascii?q?JAoIakB+EEpgRln6OGQIEAgQFAg4BAQWBZyGBWHAVO4JsgkKDcYpTcoEpjCw?= =?us-ascii?q?BgSABAQ?= X-IronPort-AV: E=Sophos;i="5.64,327,1559520000"; d="scan'208";a="595320231" Received: from alln-core-2.cisco.com ([173.36.13.135]) by rcdn-iport-3.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 30 Jul 2019 18:41:42 +0000 Received: from XCH-RCD-015.cisco.com (xch-rcd-015.cisco.com [173.37.102.25]) by alln-core-2.cisco.com (8.15.2/8.15.2) with ESMTPS id x6UIfgVZ012316 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL); Tue, 30 Jul 2019 18:41:42 GMT Received: from xhs-rcd-001.cisco.com (173.37.227.246) by XCH-RCD-015.cisco.com (173.37.102.25) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Tue, 30 Jul 2019 13:41:41 -0500 Received: from xhs-rcd-002.cisco.com (173.37.227.247) by xhs-rcd-001.cisco.com (173.37.227.246) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Tue, 30 Jul 2019 13:41:40 -0500 Received: from NAM04-SN1-obe.outbound.protection.outlook.com (72.163.14.9) by xhs-rcd-002.cisco.com (173.37.227.247) with Microsoft SMTP Server (TLS) id 15.0.1473.3 via Frontend Transport; Tue, 30 Jul 2019 13:41:40 -0500 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=UIG8llnYgigo69AiH6xkpEIxBebKnce3JIDSS0QIMoIZaxmlUVHFXsI99ogVUQVAMc2MgCxXJDPBMy5Z1lHhcIY39l1r+Lfp2gbyrSiiNbnhDqlYjbYnp4NeykS9QZJ1Yc/c36Em2W/Z7RLTMY4WKH2xEdrTfHLaCCiUdck8mOdgxcQf/JmtIg9kNFATMSuQ8I9Ksq82NFURgnLixiof9H0ovV+GpoHHYczAh0ihhYlmetoehzoKFK62rfQgR/foBOgh5Bg1gtMLXBHUa0/V9yg6Q443CfNSFcHr8zv+nC3t2/XVShqt8QkOe+ReeV3/snTBycBvLfdonMOHy8Vi5A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=QnG/pkj6RVPYaikB1XDg2rsTJiUCA8qCn1ZYusfK1+w=; b=iTEvzDJaYpc7IjJq6fUS8g4jrsCcpEQLCOQVR5/03SNNE7gDA+kWYjD1zN6mjeThQuD8fd2rqajO6g1MiHB+ebtdrzo/beA3DENf5nmjsTunwAyOX9KrE4HpS9q+HJd1VwLnsxlqlLS0Ztp2wO1UPjEGQRKh2LsbNS1zM9+lqEelGHMpzc3ubHROJshB36JScyUupAmdq0tmX8BMznpJR+D4pomdOGlax2mpP0829LOQ2d5TUUIYz+gd4bl+Z3jjL/UGiBtQ477DZs4CO45z0G5FCTuURr96O86KAgiIasL/bJj9TCldsiwR8RmGOxNSWUHRu/SLwciuAUt+1qqeNA== ARC-Authentication-Results: i=1; mx.microsoft.com 1;spf=pass smtp.mailfrom=cisco.com;dmarc=pass action=none header.from=cisco.com;dkim=pass header.d=cisco.com;arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector2-cisco-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=QnG/pkj6RVPYaikB1XDg2rsTJiUCA8qCn1ZYusfK1+w=; b=SiSC6VVM02GAlbDXpJ4QQ8EuhmzfXm8wAupZ9ADvacSTyb5L8LwhZ7DdxNFL/5oqTNEJGlzArBd3SFG2eKSFu38+9fz1zujq1cELR3nHdJPv+HwZGtF/g6EStYS+0ia5+I6fz0ShX3wOp89dmiyNt47qZETfEV42PimdHZRkHE4= Received: from MN2PR11MB3871.namprd11.prod.outlook.com (10.255.180.204) by MN2PR11MB3773.namprd11.prod.outlook.com (20.178.253.160) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2115.15; Tue, 30 Jul 2019 18:41:39 +0000 Received: from MN2PR11MB3871.namprd11.prod.outlook.com ([fe80::4c5:965:c7b7:387b]) by MN2PR11MB3871.namprd11.prod.outlook.com ([fe80::4c5:965:c7b7:387b%3]) with mapi id 15.20.2115.005; Tue, 30 Jul 2019 18:41:39 +0000 From: "Scott Fluhrer (sfluhrer)" To: Watson Ladd CC: TLS List Thread-Topic: [TLS] Options for negotiating hybrid key exchanges for postquantum Thread-Index: AdVG1haOE+yO4N1wQQSyYtQ5VKKSwAAHEKmAAAOq4EA= Date: Tue, 30 Jul 2019 18:41:39 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=sfluhrer@cisco.com; x-originating-ip: [173.38.117.65] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 67fff5ea-e90e-47c3-a87c-08d7151d8f17 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:MN2PR11MB3773; x-ms-traffictypediagnostic: MN2PR11MB3773: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:6790; x-forefront-prvs: 0114FF88F6 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(4636009)(366004)(396003)(376002)(136003)(346002)(39860400002)(15404003)(189003)(199004)(68736007)(14444005)(6916009)(316002)(2906002)(14454004)(33656002)(256004)(11346002)(478600001)(8676002)(6436002)(229853002)(4326008)(81166006)(81156014)(476003)(25786009)(52536014)(86362001)(7736002)(8936002)(74316002)(446003)(66446008)(64756008)(6506007)(5660300002)(486006)(66066001)(76116006)(99286004)(102836004)(6116002)(55016002)(1411001)(66476007)(66556008)(71190400001)(71200400001)(3846002)(9686003)(53936002)(76176011)(6246003)(66946007)(305945005)(7696005)(26005)(186003); DIR:OUT; SFP:1101; SCL:1; SRVR:MN2PR11MB3773; H:MN2PR11MB3871.namprd11.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: cisco.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: rwiWEOspSen3szane84ZmS6dZoqtTC91u6jYoaJHZrVVBlBfWFn2ES7Zh55DyxWgLR+oO8+yS8rui3YhGL/BDxKq20i39xQBqtoBcpOsB5cfMUS5wRhIw/lIHMPfAs78OnO7JMGGkFan9Fw8PTo43/tbw9s9UJFttTds6BxSZwZDrhLzItjkcsvWk6mFkcy9v8j5OK3vtZ+8VNWDbsNn3ehoAOsO1IcNnu3fWgW8JTvKgBV6M//kLl/RpHxmBTj9SztqXLom2fGJR3QKqs6wiwDtqdgDyOcP0aFXXI1WcjmcwhoM/QYvTOZHOwvtDOINvJ2nzvn8lPwvIZSAi8sWoMR59PHdYhhGGIy1zTdmuKsH18edPJroLUxuAcHxbJwb/fgtSQjWSNnHEQBSrM5uf+luPmKOstqJ03FMOy3Pmtc= Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: 67fff5ea-e90e-47c3-a87c-08d7151d8f17 X-MS-Exchange-CrossTenant-originalarrivaltime: 30 Jul 2019 18:41:39.2703 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: sfluhrer@cisco.com X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN2PR11MB3773 X-OriginatorOrg: cisco.com X-Outbound-SMTP-Client: 173.37.102.25, xch-rcd-015.cisco.com X-Outbound-Node: alln-core-2.cisco.com Archived-At: Subject: Re: [TLS] Options for negotiating hybrid key exchanges for postquantum X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 30 Jul 2019 18:41:46 -0000 DQoNCkZyb206IFdhdHNvbiBMYWRkIDx3YXRzb25ibGFkZEBnbWFpbC5jb20+IA0KDQo+IE9uIFR1 ZSwgSnVsIDMwLCAyMDE5LCA4OjIxIEFNIFNjb3R0IEZsdWhyZXIgKHNmbHVocmVyKSA8bWFpbHRv OnNmbHVocmVyQGNpc2NvLmNvbT4gd3JvdGU6DQo+PiBEdXJpbmcgdGhlIHBoeXNpY2FsIG1lZXRp bmcgaW4gTW9udHJlYWwsIHdlIGhhZCBhIGRpc2N1c3Npb24gYWJvdXQgcG9zdHF1YW50dW0gc2Vj dXJpdHksIGFuZCBpbiBwYXJ0aWN1bGFyLCBvbiBob3cgb25lIG1pZ2h0IHdhbnQgdG8gbmVnb3Rp YXRlIHNldmVyYWwgZGlmZmVyZW50IOKAmGdyb3Vwc+KAmSBzaW11bHRhbmVvdXNseSAoYmVjYXVz ZSB0aGVyZSBtaWdodCBub3QgYmUgb25lIGdyb3VwIHRoYXQgaXMgZW50aXJlbHkgdHJ1c3RlZCwg YW5kIEkgcHV0IOKAmGdyb3Vwc+KAmSBpbiBzY2FyZXF1b3RlcyBiZWNhdXNlIHBvc3RxdWFudHVt IGtleSBleGNoYW5nZXMgYXJlIHR5cGljYWxseSBub3QgZm9ybWVkIGZyb20gYSBEaWZmaWUtSGVs bG1hbiBncm91cCkuDQo+PsKgDQo+PiBBdCB0aGUgbWVldGluZywgdGhlcmUgd2VyZSB0d28gb3B0 aW9ucyBwcmVzZW50ZWQ6DQrCoD4+IA0KPj4gT3B0aW9uIDE6IGFzIHRoZSBzdXBwb3J0ZWQgZ3Jv dXAsIHdlIGluc2VydCBhIOKAmGh5YnJpZCBtYXJrZXLigJkgKGFuZCBpbmNsdWRlIGFuIGV4dGVu c2lvbiB0aGF0IG1hcCBsaXN0cyB3aGljaCBjb21iaW5hdGlvbiB0aGUgaHlicmlkIG1hcmtlciBz dGFuZHMgZm9yKQ0KPj7CoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqAgRm9yIGV4YW1wbGUs IHRoZSBjbGllbnQgbWlnaHQgbGlzdCBpbiBoaXMgc3VwcG9ydGVkIGdyb3VwcyBoeWJyaWRfbWFy a2VyXzAgYW5kIGh5YnJpZF9tYXJrZXJfMSwgYW5kIHRoZXJlIHdvdWxkIGJlIGEgc2VwYXJhdGUg ZXh0ZW5zaW9uIHRoYXQgbGlzdHMgaHlicmlkX21hcmtlcl8wID0gWDI1NTE5ICsgU0lLRXA0MzQg YW5kIGh5YnJpZF9tYXJrZXJfMSA9IFgyNTUxOSArIE5UUlVQUjY1My7CoCBUaGUgc2VydmVyIHdv dWxkIHRoZW4gbG9vayB1cCB0aGUgbWVhbmluZ3Mgb2YgaHlicmlkX21hcmtlcl8wIGFuZCAxIGlu IHRoZSBleHRlbnNpb24sIGFuZCB0aGVuIGNvbXBhcmUgdGhhdCBhZ2FpbnN0IGhpcyBzZWN1cml0 eSBwb2xpY3kuDQo+PiAgICAgICAgSW4gdGhpcyBvcHRpb24sIHdlIHdvdWxkIGFzayBJQU5BIHRv IGFsbG9jYXRlIGNvZGUgcG9pbnRzIGZvciB0aGUgdmFyaW91cyBpbmRpdmlkdWFsIHBvc3RxdWFu dHVtIGtleSBleGNoYW5nZXMgKGluIHRoaXMgZXhhbXBsZSwgU0lLRXA0MzQgYW5kIE5UUlVQUjY1 MyksIGFzIHdlbGwgYSByYW5nZSBvZiBjb2RlIHBvaW50cyBmb3IgdGhlIHZhcmlvdXMgaHlicmlk X21hcmtlcnMuDQrCoD4+DQo+PiBPcHRpb24gMjogd2UgaGF2ZSBjb2RlIHBvaW50cyBmb3IgYWxs IHRoZSB2YXJpb3VzIGNvbWJpbmF0aW9ucyB0aGF0IHdlIG1heSB3YW50IHRvIHN1cHBvcnQ7IGhl bmNlIElBTkEgbWlnaHQgYWxsb2NhdGUgYSBjb2RlIHBvaW50IFgyNTUxOV9TSUtFcDQzNCBhbmQg YW5vdGhlciBjb2RlIHBvaW50IGZvciBYMjU1MTlfTlRSVVBSNjUzLsKgIFdpdGggdGhpcyBvcHRp b24sIHRoZSBjbGllbnQgd291bGQgbGlzdCBYMjU1MTlfU0lLRXA0MzQgYW5kIFgyNTUxOV9OVFJV UFI2NTMgaW4gdGhlaXIgc3VwcG9ydGVkIGdyb3Vwcy4NCj4+IMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoCBJbiB0aGlzIG9wdGlvbiwgd2Ugd291bGQgYXNrIElBTkEgdG8gYWxsb2NhdGUg Y29kZSBwb2ludHMgZm9yIGFsbCB0aGUgdmFyaW91cyBjb21iaW5hdGlvbnMgdGhhdCB3ZSB3YW50 IGFsbG93IHRvIGJlIG5lZ290aWF0ZWQuwqANCj4+IA0KPg0KPiBBcmUgcGVvcGxlIGFjdHVhbGx5 IGdvaW5nIHRvIHVzZSBoeWJyaWQgZW5jcnlwdGlvbiBwb3N0IE5JU1Q/IFRoZSBhY3R1YWwgZGVw bG95bWVudHMgdG9kYXnCoCBmb3IgZXhwZXJpbWVudCBoYXZlIGFsbCBmaXQgb3B0aW9uIDIgYW5k IGh5YnJpZHMgYXJlIHVubGlrZWx5IGluIHRoZSBmdXR1cmUuwqANCg0KaXQgc291bmRzIGxpa2Ug eW91IGFyZSBxdWVzdGlvbmluZywgbm90IGJldHdlZW4gb3B0aW9uIDEgb3Igb3B0aW9uIDIsIGJ1 dCBpbnN0ZWFkIHdoZXRoZXIgd2UgbmVlZCBlaXRoZXIgb2YgdGhlbSBhdCBhbGwuICBUaG9zZSBh cmUgYm90aCBtZXRob2RzIG9mIG5lZ290aWF0aW5nIG11bHRpcGxlIGtleWdyb3VwczsgaXQgYXBw ZWFycyB0aGF0IHlvdSBkb27igJl0IHNlZSBhbnkgbmVlZCBmb3Igc3VjaCBhbiBvcHRpb24uDQoN ClBlcmhhcHMgd2UgbmVlZCB0byBoYXZlIHN1Y2ggYSBkZWJhdGUuICBIZXJlIGlzIG9uZSBvcGlu aW9uIChtaW5lLCBidXQgSSdtIHByZXR0eSBzdXJlIGl0IGlzIHNoYXJlZCBieSBvdGhlcnMpOiB0 aGUgdmFyaW91cyBOSVNUIGNhbmRpZGF0ZXMgYXJlIGJhc2VkIG9uIGhhcmQgcHJvYmxlbXMgdGhh dCB3ZXJlIG9ubHkgcmVjZW50bHkgc3R1ZGllZCAoZS5nLiBzdXBlcnNpbmd1bGFyIGlzb2dlbmll cywgUXVhc2ljeWNsaWMgY29kZXMpLCBvciBoYXZlIGNyeXB0YW5hbHl0aWMgbWV0aG9kcyB0aGF0 IGFyZSBxdWl0ZSBkaWZmaWN1bHQgdG8gZnVsbHkgYXNzZXNzIChlLmcuIExhdHRpY2VzKS4gIEV2 ZW4gYWZ0ZXIgTklTVCBhbmQgQ0ZSRyBoYXZlIGJsZXNzZWQgb25lIG9yIG1vcmUgb2YgdGhlbSwg aXQgd291bGQgc2VlbSByZWFzb25hYmxlIHRvIG1lIHRoYXQgd2Ugd291bGRuJ3Qgd2FudCB0byBw bGFjZSBhbGwgb3VyIHNlY3VyaXR5IGVnZ3MgaW4gdGhhdCBvbmUgYmFza2V0LiAgV2UgY3VycmVu dGx5IHBsYWNlIGFsbCBvdXIgdHJ1c3QgaW4gREggb3IgRUNESDsgaG93ZXZlciB0aG9zZSBoYXZl IGJlZW4gc3R1ZGllZCBmb3IgMzArIHllYXJzIC0gd2UgYXJlIG5vdCB0aGVyZSB5ZXQgZm9yIG1v c3Qgb2YgdGhlIHBvc3RxdWFudHVtIGFsZ29yaXRobXMuDQoNCkhlbmNlLCBpdCBzZWVtcyByZWFz b25hYmxlIHRvIG1lIHRoYXQgd2UgZ2l2ZSB1c2VycyB0aGUgb3B0aW9uIG9mIGJlaW5nIGFibGUg dG8gcmVseSBvbiBtdWx0aXBsZSBtZXRob2RzLg0KDQo+DQo+IE15IG9iamVjdGlvbiB0byAxIGlz IGl0IGdldHMgdmVyeSBtZXNzeS4gRG8gd2UgdXNlIG9ubHkgdGhlIGh5YnJpZHMgd2UgYm90aCBz dXBwb3J0PyBXaGF0IGlmIEkgdGhyb3cgYSBidW5jaCBvZiBleHBlbnNpdmUgdGhpbmdzIHRvZ2V0 aGVyPyBObyByZWFzb24gd2UgbmVlZCBhIGh5YnJpZCBzY2hlbWUhwqANCg0KQWN0dWFsbHksIEkg cGVyc29uYWxseSBkb24ndCBzZWUgdGhlIG1lc3NpbmVzczsgaWYgdGhlIGNsaWVudCB3YW50cyB0 byBwcm9wb3NlIFgyNTUxOSArIE5UUlVQUjY1MywgaGUgcGxhY2VzIGh5YnJpZF9tYXJrZXJfMSBp biB0aGUgc3VwcG9ydGVkIGdyb3VwcyBsaXN0LCBhbmQgYWRkcyBoeWJyaWRfbWFya2VyXzEgPSBY MjU1MTkgKyBOVFJVUFI2NTMgdG8gaGlzIGh5YnJpZCBncm91cCBleHRlbnNpb24uICBJZiB0aGUg c2VydmVyIHNlZXMgaHlicmlkX21hcmtlcl8xIGluIHRoZSBjbGllbnQncyBzdXBwb3J0ZWQgZ3Jv dXAgbGlzdCwgaGUgbG9va3MgZm9yIHRoZSBkZWZpbml0aW9uIGluIHRoZSBoeWJyaWQgZ3JvdXAg ZXh0ZW5zaW9uLCBhbmQgcHJvY2Vzc2VzIHRoZSBwb2xpY3kgYWNjb3JkaW5nbHkuICBUaGUgbG9n aWMgaW4gYm90aCBkaXJlY3Rpb24gd291bGQgYXBwZWFyIChhdCBsZWFzdCB0byBtZSkgdG8gYmUg cmVhc29uYWJseSBzaW1wbGUgKGFuZCBpdCBkb2VzbuKAmXQgZ2V0IG1vcmUgY29tcGxleCBpZiB3 ZSBmZWVsIHRoZSBuZWVkIHRvIG5lZ290aWF0ZSB0aHJlZSBvciBtb3JlIGtleSBleGNoYW5nZXMp Lg0KDQpBcyBmb3IgdGhlIGV4cGVuc2UsIHRoYXQgaXMgZm9yIHRoZSB1c2VyIHRvIGp1ZGdlLiAg SWYgdGhlIHVzZXIgZGVjaWRlcyB0aGF0IGhlIGlzIHdpbGxpbmcgdG8gcGF5IGZvciBhIHNlcmll cyBvZiBleHBlbnNpdmUga2V5IGV4Y2hhbmdlcywgdGhhdCBzaG91bGQgYmUgaGlzIGRlY2lzaW9u IHRvIG1ha2UuICBPcHRpb24gMSBnaXZlcyB0aGUgdXNlciB0aGUgYWJpbGl0eSB0byBuZWdvdGlh dGUgYSBzZXJpZXMgb2YgZXhwZW5zaXZlIChidXQgcGVyaGFwcyBtb3JlIHRydXN0ZWQpIGFsZ29y aXRobXMsIGl0IGRvZXNuJ3QgbWFuZGF0ZSB0aGF0IHRoZSB1c2VyIGRvIHNvLg0KDQpBbmQsIGFz IGZvciBhIG5lZWQgZm9yIGEgaHlicmlkIHNjaGVtZSAoZWl0aGVyIG9wdGlvbiAxLCBvcHRpb24g MiBvciBzb21ldGhpbmcgZWxzZSksIEkgZG8gYmVsaWV2ZSB0aGF0IHRoZXJlIHdpbGwgYmUgYSBk ZW1hbmQgZm9yIGl0LCBldmVuIGFmdGVyIE5JU1QgYW5kIENGUkcgaGFzIGdpdmVuIHRoZWlyIGJs ZXNzaW5nLCBhcyB0aGVpciB3aWxsIGJlIHVzZXJzIHdobyB3aWxsIG5vdCBmdWxseSB0cnVzdCBh IG5ldyBzY2hlbWUgdGhhdCB3YXMganVzdCBlbmRvcnNlZCAoYnV0IHRoZXkgZG8gd2FudCBzb21l IHByb3RlY3Rpb24gYWdhaW5zdCBmdXR1cmUgcXVhbnR1bSBjb21wdXRlcnMpLg0KDQo= From nobody Tue Jul 30 11:48:20 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D7B2D1202A0 for ; Tue, 30 Jul 2019 11:48:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nlWuFx3VqktQ for ; Tue, 30 Jul 2019 11:48:15 -0700 (PDT) Received: from NAM01-BN3-obe.outbound.protection.outlook.com (mail-eopbgr740131.outbound.protection.outlook.com [40.107.74.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9CC78120292 for ; Tue, 30 Jul 2019 11:48:11 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=E1K1t2XnWWLN4UA48bWq7/Hq7dIy7RnD0an0vuCVEShU4JN09Mwnll3sJIsSPFaO7wqonIsiQMz2EUAp+JK/ulo9sFr2lz8EgpvN8vqw/Dy7kcg6QAobxKQMrzmVs2iKdBI8YTikPaaRmQ+nxw3vnplLqrhNej+a7jJLJCT5ZXMUtkqI3Hxy/S8Srq+qCaygxIdPJVZhwDrAeGIEjQJYYF6U7XU9J91II5rOGuzKHyhoXGPxB2i+G+7aYwDGq//2/twgqo1jjh0j59Ev7x43qyfbODmbrkOJPxpOWR31SfjjnnAbAZ4n9+oFnkQi3BPyX8ZcphkktcQ7/RULQigxPQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=BXWEEhYyJwiRYcmlbR3tf/1r5/hFDTUwjDy0pl3FeLM=; b=YUYKGT5RauCLDLbvgXSAt3bnbLpJAPHT57jY/x+ro0uCf0lHA3Wa/Y+zWxxizWCGGlCxpLtk/AdXjVCpUCK+haWTZkcIs9cunBCnV7mCqVXC6NEQs9yazkkJdinJNhsv0aybkWQAr6jcq0YAFB4xrG/78RcfMdsHHn/Dumg79KaA9F+AGRJfJXUniIpexP7yv900TqPVLowifdGqxvoY85YUPGZ4OTnercouGulaVGpF90wvoEb7/Qk6/8McI+oRJEjGRp1rcxeZyf+/Y3VeMaq9qNzml7Ox5hsk4wngn7IDTzgKTvh611W+DCgT75lxwZ9bL30keqMeHU+bqd44FA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=microsoft.com; dmarc=pass action=none header.from=microsoft.com; dkim=pass header.d=microsoft.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=BXWEEhYyJwiRYcmlbR3tf/1r5/hFDTUwjDy0pl3FeLM=; b=JnNPSVo9Q2hoaNRCZHRw80nLWiATJNVI+tP3mJOVWm9UTPphwT6aFgzX0lweAJ5vV7oNo6pGULOOT/QJx3/FjPuJB7KFI31kfkTg+vt6eMYzJS+FmKAo/gD08D1ptA/5LWfhp8HmyuyptIahC6rYGmuaAcBgnn0WMfqSxZfhQFg= Received: from DM5PR2101MB0917.namprd21.prod.outlook.com (52.132.132.162) by DM5PR2101MB1014.namprd21.prod.outlook.com (52.132.133.36) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2157.2; Tue, 30 Jul 2019 18:48:09 +0000 Received: from DM5PR2101MB0917.namprd21.prod.outlook.com ([fe80::6cee:c549:a46c:9e5c]) by DM5PR2101MB0917.namprd21.prod.outlook.com ([fe80::6cee:c549:a46c:9e5c%7]) with mapi id 15.20.2157.001; Tue, 30 Jul 2019 18:48:09 +0000 From: Andrei Popov To: David Benjamin , Watson Ladd CC: TLS List Thread-Topic: [TLS] Options for negotiating hybrid key exchanges for postquantum Thread-Index: AdVG1haOE+yO4N1wQQSyYtQ5VKKSwAAHEKmAAARkcYAAAMUecA== Date: Tue, 30 Jul 2019 18:48:09 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Andrei.Popov@microsoft.com; x-originating-ip: [2001:4898:80e8:a:28b3:a023:971b:e42c] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 64d593ed-8525-4c36-91d8-08d7151e7796 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(4618075)(2017052603328)(7193020); SRVR:DM5PR2101MB1014; x-ms-traffictypediagnostic: DM5PR2101MB1014: x-ms-exchange-purlcount: 3 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:7691; x-forefront-prvs: 0114FF88F6 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(4636009)(39860400002)(136003)(366004)(396003)(376002)(346002)(189003)(199004)(15404003)(110136005)(2906002)(6246003)(476003)(446003)(86362001)(53936002)(4326008)(25786009)(10090500001)(790700001)(46003)(74316002)(6116002)(64756008)(5660300002)(55016002)(6436002)(236005)(8990500004)(11346002)(76116006)(52536014)(66446008)(54896002)(9686003)(66476007)(71190400001)(6306002)(66556008)(71200400001)(66946007)(7736002)(256004)(33656002)(99286004)(53546011)(6506007)(81156014)(8936002)(10290500003)(5070765005)(186003)(229853002)(102836004)(76176011)(486006)(7696005)(8676002)(81166006)(68736007)(966005)(478600001)(14454004)(316002)(22452003)(606006)(14444005); DIR:OUT; SFP:1102; SCL:1; SRVR:DM5PR2101MB1014; H:DM5PR2101MB0917.namprd21.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: 4XXHn2/6UEvcVajtUngSeMx4hJVZrbh8KCLJYbX817dW2M7YmIG0ZeAjomoLwb+G5GMoTZw1ph++LcX90+UgfvIqnIKoSPa32/9P0FUtU0zQkQ9GtBXGIFWNx2T3Q6j0Sp0ecpbYahha1zDAC2ZsgDIUDgzqKREnUGkypAUfzK7T/bmAHELV/m6yEGxZoGNlk1V43yAWfxH/t/QXYUFOg4Q4Ra1UPAE8HASg2DsWKW1zmtP03tKYnCnMMs4bsIjN8BTDKOCPke1zDAXEKzLc5F0C56ewTk2wOAvVVRTEJ9sZjaW7DXnwSIWXPvD/7TBZ3mlxppI4QmjpY8S76bj+LDfR6UCNJ5t+KZ891XxFvSNIsLm0B6Rhw3p4ENFnem7VnBXd3KTECpksaq4ZBs/GbPS5mwsTdrjdo+HqsKCGGeE= x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_DM5PR2101MB09177EFFFB5C2D64556724848CDC0DM5PR2101MB0917_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: 64d593ed-8525-4c36-91d8-08d7151e7796 X-MS-Exchange-CrossTenant-originalarrivaltime: 30 Jul 2019 18:48:09.3944 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: B+RAMIG8HjTglebVd71PIe7VV7XvDMCHL8JpSw5jVsUNjyU5xTqY5pR5/Kg2c02nxdJFqdgmve3NpkOz2mz+lQ== X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM5PR2101MB1014 Archived-At: Subject: Re: [TLS] Options for negotiating hybrid key exchanges for postquantum X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 30 Jul 2019 18:48:19 -0000 --_000_DM5PR2101MB09177EFFFB5C2D64556724848CDC0DM5PR2101MB0917_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 R2l2ZW4gdGhlc2Ugb3B0aW9ucywgSSBhbHNvIHByZWZlciBvcHRpb24gMiwgZm9yIHNvbWUgb2Yg dGhlIHNhbWUgcmVhc29ucy4NCg0KRm9yIG15IHVuZGVyc3RhbmRpbmcgdGhvdWdoLCB3aHkgbm90 IGhhdmUgdGhlIGNsaWVudCBhZHZlcnRpc2Ugc3VwcG9ydCBmb3IgaHlicmlkLWtleS1leGNoYW5n ZSAoZS5nLiB2aWEgYSDigJxmbGFn4oCdIGV4dGVuc2lvbikgYW5kIHRoZW4gS2V5U2hhcmVTZXJ2 ZXJIZWxsbyBjYW4gY29udGFpbiB0d28gS2V5U2hhcmVFbnRyaWVzIChlc3NlbnRpYWxseSwgdXNp bmcgdGhlIHNhbWUgZm9ybWF0IGFzIEtleVNoYXJlQ2xpZW50SGVsbG8/IFRoaXMgd291bGQgc29s dmUgdGhlIENhcnRlc2lhbiBwcm9kdWN0IGlzc3VlLg0KDQpDaGVlcnMsDQoNCkFuZHJlaQ0KDQpG cm9tOiBUTFMgPHRscy1ib3VuY2VzQGlldGYub3JnPiBPbiBCZWhhbGYgT2YgRGF2aWQgQmVuamFt aW4NClNlbnQ6IFR1ZXNkYXksIEp1bHkgMzAsIDIwMTkgMTE6MjQgQU0NClRvOiBXYXRzb24gTGFk ZCA8d2F0c29uYmxhZGRAZ21haWwuY29tPg0KQ2M6IFRMUyBMaXN0IDx0bHNAaWV0Zi5vcmc+DQpT dWJqZWN0OiBSZTogW1RMU10gT3B0aW9ucyBmb3IgbmVnb3RpYXRpbmcgaHlicmlkIGtleSBleGNo YW5nZXMgZm9yIHBvc3RxdWFudHVtDQoNCkkgdGhpbmsgdGhpcyB1bmRlcmVzdGltYXRlcyB0aGUg Y29tcGxleGl0eSBjb3N0IG9mIG9wdGlvbiAxIHRvIHRoZSBwcm90b2NvbCBhbmQgaW1wbGVtZW50 YXRpb25zLiBPcHRpb24gMSBtZWFucyBncm91cCBuZWdvdGlhdGlvbiBpbmNsdWRlcyBlbnRpcmUg Y29kZXBvaW50cyB3aG9zZSBtZWFuaW5nIGNhbm5vdCBiZSBkZXRlcm1pbmVkIHdpdGhvdXQgYSBw YXJhbGxlbCBleHRlbnNpb24uIFRoaXMgY29tcG91bmRzIGFjcm9zcyBldmVyeXRoaW5nIHdoaWNo IGludGVyYWN0cyB3aXRoIG5hbWVkIGdyb3VwcywgaW1wYWN0aW5nIGV2ZXJ5dGhpbmcgZnJvbSBB UElzIHRvIGNvbmZpZyBmaWxlIGZvcm1hdHMgdG8gZXZlbiBVSSBzdXJmYWNlcy4gT3RoZXIgdXNl cyBvZiBOYW1lZEdyb3VwcyBhcmUgaW1wYWN0ZWQgdG9vLiBGb3IgaW5zdGFuY2UsIG9wdGlvbiAy IGZpdHMgaW50byBkcmFmdC1pZXRmLXRscy1lc25pIGFzLWlzLiBPcHRpb24gMSByZXF1aXJlcyBp bmplY3RpbmcgaHlicmlkX2V4dGVuc2lvbiBpbnRvIEVTTkkgc29tZWhvdy4gQW5hbHlzaXMgbXVz dCBmdXJ0aGVyIGNoZWNrIGV2ZXJ5IHVzZSwgc2F5LCBpbmNvcnBvcmF0ZXMgdGhpcyBwYXJhbGxl bCBsb29rdXAgdGFibGUgaW50byB0cmFuc2NyaXB0LWxpa2UgbWVhc3VyZXMuDQoNClRoZSBsZXNz b24gZnJvbSBUTFMgMS4yIGNvZGUgcG9pbnRzIGlzIG5vdCBjb21iaW5lZCBjb2RlcG9pbnRzIHZz LiBzcGxpdCBvbmVzLiBSYXRoZXIsIHRoZSBsZXNzb24gaXMgdG8gYXZvaWQgaW50ZXJkZXBlbmRl bnQgZGVjaXNpb25zOg0KDQoqIFNpZ25hdHVyZSBhbGdvcml0aG1zIGluIFRMUyAxLjIgd2VyZSBh IG1lc3MgYmVjYXVzZSB0aGUgRUNEU0EgY29kZXBvaW50cyByZXF1aXJlZCBjcm9zcy1yZWZlcmVu Y2luZyBhZ2FpbnN0IHRoZSBzdXBwb3J0ZWQgY3VydmVzIGxpc3QuIFRoZSB2ZXJpZmllciBjb3Vs ZCBub3QgZXhwcmVzcyBzb21lIHByZWZlcmVuY2VzIChzaWduaW5nIFNIQS01MTIgd2l0aCBQLTI1 NiBpcyBzaWxseSwgYW5kIG1peGluZyBoYXNoK2N1cnZlIHBhaXJzIGluIEVDRFNBIGlzIHNsaWdo dGx5IG9mZiBpbiBnZW5lcmFsKS4gQXMgYW5hbG9neSB0byBvcHRpb24gMSdzIEVTTkkgcHJvYmxl bSwgd2UgZXZlbiBmb3Jnb3QgdG8gYWxsb3cgdGhlIHNlcnZlciB0byBleHByZXNzIGN1cnZlIHBy ZWZlcmVuY2VzLiBUTFMgMS4zIGNvbWJpbmVkIHNpZ25hdHVyZSBhbGdvcml0aG0gY29uc2lkZXJh dGlvbnMgaW50byBhIHNpbmdsZSBjb2RlcG9pbnQgdG8gYWRkcmVzcyBhbGwgdGhpcy4NCg0KKiBD aXBoZXIgc3VpdGVzIGluIFRMUyAxLjIgd2VyZSBhIG1lc3MgYmVjYXVzZSB0aGV5IHdlcmUgaGFs Zi1jb21iaW5lZCBhbmQgaGFsZi1zcGxpdC4gVExTX0VDREhFX0VDRFNBX1dJVEhfQUVTXzEyOF9H Q01fU0hBMjU2IHNhaWQgdG8gdXNlIHNvbWUgRUNESEUga2V5IGV4Y2hhbmdlLCBidXQgeW91IG5l ZWQgdG8gY2hlY2sgaWYgeW91IGhhdmUgYSBOYW1lZEdyb3VwIGluIGNvbW1vbiBmaXJzdC4gSXQg c2FpZCB0byB1c2UgRUNEU0EsIGJ1dCB5b3UgbmVlZCB0byBjaGVjayBzaWduYXR1cmUgYWxnb3Jp dGhtcyAod2hpY2ggdGhlbXNlbHZlcyBjcm9zcy1yZWZlcmVuY2UgY3VydmVzKSBmaXJzdC4gRWFy bHkgZHJhZnRzIG9mIFRMUyAxLjMgaGFkIGl0IGV2ZW4gd29yc2UsIHdoZXJlIGEgVExTX0VDREhF X0VDRFNBX1dJVEhfQUVTXzEyOF9HQ01fU0hBMjU2IGZ1bGwgaGFuZHNoYWtlIG1vcnBoZWQgaW50 byBUTFNfRUNESEVfUFNLX1dJVEhfQUVTXzEyOF9HQ01fU0hBMjU2IG9uIHJlc3VtcHRpb24uIFRo dXMsIFRMUyAxLjMgY2lwaGVyIHN1aXRlcyBuZWdvdGlhdGUgc29sZWx5IEFFQUQgKyBQUkYgaGFz aC4NCg0KSW4gZmFpcm5lc3MgdG8gVExTIDEuMiwgc29tZSBvZiB0aGlzIHdhcyBhIGNvbnNlcXVl bmNlIG9mIFRMUyAxLjIncyBldm9sdXRpb24gb3ZlciB0aW1lIGFzIGluY3JlbWVudGFsIGV4dGVu c2lvbnMgb3ZlciBTU0wgMy4wLiBBbmQgc29tZXRpbWVzIHdlIGRvIG5lZWQgdG8gcGF5IGNvc3Rz IGxpa2UgdGhlc2UuIEJ1dCBoeWJyaWQga2V5IGV4Y2hhbmdlcyBmaXQgaW50byB0aGUgTmFtZWRH cm91cCAiQVBJIiBqdXN0IGZpbmUsIHNvIG9wdGlvbiAyIGlzIHRoZSBjbGVhciBhbnN3ZXIuIENv ZGUgcG9pbnRzIGFyZSBjaGVhcC4gUHJvdG9jb2wgY29tcGxleGl0eSBpcyBtdWNoIG1vcmUgZXhw ZW5zaXZlLg0KDQpJdCdzIHRydWUgdGhhdCBzdGFuZGFyZHMgYXJlIG9mdGVuIHVuZGVyc3BlY2lm aWVkLiBUaGlzIG1lYW5zIHRoZSBJRVRGIHNob3VsZCBmaW5pc2ggdGhlIGpvYiwgbm90IHBhc3Mg YWxsIHZhcmlhdGlvbnMgdGhyb3VnaC4gUlNBLVBTUyBpcyBhIGNsZWFyIGV4YW1wbGUgb2Ygd2hh dCB0byBhdm9pZC4gSXQgdGFrZXMgbW9yZSBieXRlcyB0byBtZXJlbHkgdXR0ZXIgIlJTQS1QU1Mg d2l0aCBTSEEtMjU2IGFuZCB1c3VhbCBwYXJhbWV0ZXJzIiBpbiBYLjUwOSB0aGFuIHRvIGVuY29k ZSBhbiBlbnRpcmUgRUNEU0Egc2lnbmF0dXJlISBXZSBzaG91bGQgbm90IGRlZmluZSBtb3JlIHRo YW4gYSBoYW5kZnVsIG9mIG9wdGlvbnMsIHJlZ2FyZGxlc3Mgb2YgdGhlIGVuY29kaW5nLi4NCg0K T24gVHVlLCBKdWwgMzAsIDIwMTkgYXQgMTI6MTggUE0gV2F0c29uIExhZGQgPHdhdHNvbmJsYWRk QGdtYWlsLmNvbTxtYWlsdG86d2F0c29uYmxhZGRAZ21haWwuY29tPj4gd3JvdGU6DQoNCk9uIFR1 ZSwgSnVsIDMwLCAyMDE5LCA4OjIxIEFNIFNjb3R0IEZsdWhyZXIgKHNmbHVocmVyKSA8c2ZsdWhy ZXJAY2lzY28uY29tPG1haWx0bzpzZmx1aHJlckBjaXNjby5jb20+PiB3cm90ZToNCkR1cmluZyB0 aGUgcGh5c2ljYWwgbWVldGluZyBpbiBNb250cmVhbCwgd2UgaGFkIGEgZGlzY3Vzc2lvbiBhYm91 dCBwb3N0cXVhbnR1bSBzZWN1cml0eSwgYW5kIGluIHBhcnRpY3VsYXIsIG9uIGhvdyBvbmUgbWln aHQgd2FudCB0byBuZWdvdGlhdGUgc2V2ZXJhbCBkaWZmZXJlbnQg4oCYZ3JvdXBz4oCZIHNpbXVs dGFuZW91c2x5IChiZWNhdXNlIHRoZXJlIG1pZ2h0IG5vdCBiZSBvbmUgZ3JvdXAgdGhhdCBpcyBl bnRpcmVseSB0cnVzdGVkLCBhbmQgSSBwdXQg4oCYZ3JvdXBz4oCZIGluIHNjYXJlcXVvdGVzIGJl Y2F1c2UgcG9zdHF1YW50dW0ga2V5IGV4Y2hhbmdlcyBhcmUgdHlwaWNhbGx5IG5vdCBmb3JtZWQg ZnJvbSBhIERpZmZpZS1IZWxsbWFuIGdyb3VwKS4NCg0KQXQgdGhlIG1lZXRpbmcsIHRoZXJlIHdl cmUgdHdvIG9wdGlvbnMgcHJlc2VudGVkOg0KDQpPcHRpb24gMTogYXMgdGhlIHN1cHBvcnRlZCBn cm91cCwgd2UgaW5zZXJ0IGEg4oCYaHlicmlkIG1hcmtlcuKAmSAoYW5kIGluY2x1ZGUgYW4gZXh0 ZW5zaW9uIHRoYXQgbWFwIGxpc3RzIHdoaWNoIGNvbWJpbmF0aW9uIHRoZSBoeWJyaWQgbWFya2Vy IHN0YW5kcyBmb3IpDQogICAgICAgICAgICAgICAgRm9yIGV4YW1wbGUsIHRoZSBjbGllbnQgbWln aHQgbGlzdCBpbiBoaXMgc3VwcG9ydGVkIGdyb3VwcyBoeWJyaWRfbWFya2VyXzAgYW5kIGh5YnJp ZF9tYXJrZXJfMSwgYW5kIHRoZXJlIHdvdWxkIGJlIGEgc2VwYXJhdGUgZXh0ZW5zaW9uIHRoYXQg bGlzdHMgaHlicmlkX21hcmtlcl8wID0gWDI1NTE5ICsgU0lLRXA0MzQgYW5kIGh5YnJpZF9tYXJr ZXJfMSA9IFgyNTUxOSArIE5UUlVQUjY1My4gIFRoZSBzZXJ2ZXIgd291bGQgdGhlbiBsb29rIHVw IHRoZSBtZWFuaW5ncyBvZiBoeWJyaWRfbWFya2VyXzAgYW5kIDEgaW4gdGhlIGV4dGVuc2lvbiwg YW5kIHRoZW4gY29tcGFyZSB0aGF0IGFnYWluc3QgaGlzIHNlY3VyaXR5IHBvbGljeS4NCkluIHRo aXMgb3B0aW9uLCB3ZSB3b3VsZCBhc2sgSUFOQSB0byBhbGxvY2F0ZSBjb2RlIHBvaW50cyBmb3Ig dGhlIHZhcmlvdXMgaW5kaXZpZHVhbCBwb3N0cXVhbnR1bSBrZXkgZXhjaGFuZ2VzIChpbiB0aGlz IGV4YW1wbGUsIFNJS0VwNDM0IGFuZCBOVFJVUFI2NTMpLCBhcyB3ZWxsIGEgcmFuZ2Ugb2YgY29k ZSBwb2ludHMgZm9yIHRoZSB2YXJpb3VzIGh5YnJpZF9tYXJrZXJzLg0KDQpPcHRpb24gMjogd2Ug aGF2ZSBjb2RlIHBvaW50cyBmb3IgYWxsIHRoZSB2YXJpb3VzIGNvbWJpbmF0aW9ucyB0aGF0IHdl IG1heSB3YW50IHRvIHN1cHBvcnQ7IGhlbmNlIElBTkEgbWlnaHQgYWxsb2NhdGUgYSBjb2RlIHBv aW50IFgyNTUxOV9TSUtFcDQzNCBhbmQgYW5vdGhlciBjb2RlIHBvaW50IGZvciBYMjU1MTlfTlRS VVBSNjUzLiAgV2l0aCB0aGlzIG9wdGlvbiwgdGhlIGNsaWVudCB3b3VsZCBsaXN0IFgyNTUxOV9T SUtFcDQzNCBhbmQgWDI1NTE5X05UUlVQUjY1MyBpbiB0aGVpciBzdXBwb3J0ZWQgZ3JvdXBzLg0K ICAgICAgICAgICAgICAgIEluIHRoaXMgb3B0aW9uLCB3ZSB3b3VsZCBhc2sgSUFOQSB0byBhbGxv Y2F0ZSBjb2RlIHBvaW50cyBmb3IgYWxsIHRoZSB2YXJpb3VzIGNvbWJpbmF0aW9ucyB0aGF0IHdl IHdhbnQgYWxsb3cgdG8gYmUgbmVnb3RpYXRlZC4NCg0KSSB3b3VsZCBsaWtlIHRvIG1ha2UgYW4g YXJndW1lbnQgaW4gZmF2b3Igb2Ygb3B0aW9uIDE6DQoNCg0KICAqICAgSXQgaXMgbGlrZWx5IHRo YXQgbm90IGV2ZXJ5b25lIHdpbGwgYmUgc2F0aXNpZmllZCB3aXRoIOKAnFgyNTUxOSBwbHVzIG9u ZSBvZiBhIGhhbmRmdWwgb2Ygc3BlY2lmaWMgcG9zdHF1YW50dW0gYWxnb3JpdGhtc+KAnTsgc29t ZSBtYXkgcHJlZmVyIGFub3RoZXIgZWxsaXB0aWMgY3VydmUgKGZvciBleGFtcGxlLCB4NDQ4KSwg b3IgcGVyaGFwcyBldmVuIGEgTU9EUCBncm91cDsgSSBoYXZlIHRhbGtlZCB0byBwZW9wbGUgd2hv IGRvIG5vdCB0cnVzdCBFQ0MpOyBpbiBhZGRpdGlvbiwgb3RoZXIgcGVvcGxlIG1pZ2h0IG5vdCB0 cnVzdCBhIHNpbmdsZSBwb3N0cXVhbnR1bSBhbGdvcml0aG0sIGFuZCBtYXkgd2FudCB0byByZWx5 IG9uIGJvdGggKGZvciBleGFtcGxlKSBTSUtFIGFuZCBOZXdIb3BlICh3aGljaCBhcmUgYmFzZWQg b24gdmVyeSBkaWZmZXJlbnQgaGFyZCBwcm9ibGVtcykuICBXaXRoIG9wdGlvbiAyLCB3ZSBjb3Vs ZCB0cnkgdG8gYW50aWNpcGF0ZSBhbGwgdGhlIGNvbW1vbiBjb21iaW50YXRpb25zIChzdWNoIGFz IFAzODRfU0lLRXA0MzRfTkVXSE9QRTUxMkNDQSksIGhvd2V2ZXIgdGhhdCBjb3VsZCB2ZXJ5IHdl bGwgZW5kIHVwIGFzIGEgbG90IG9mIGNvbWJpbmF0aW9ucy4NCiAgKiAgIFRoZXJlIGFyZSBsaWtl bHkgdG8gYmUgc2V2ZXJhbCBOSVNULWFwcHJvdmVkIHBvc3RxdWFudHVtIGtleSBleGNoYW5nZXMs IGFuZCBlYWNoIG9mIHRob3NlIGtleSBleGNoYW5nZXMgYXJlIGxpa2VseSB0byBoYXZlIGEgbnVt YmVyIG9mIHN1cHBvcnRlZCBwYXJhbWV0ZXIgc2V0cyAoaWYgd2UgdGFrZSB0aGUgc3BlY2lmaWMg cG9zdHF1YW50dW0ga2V5IGV4Y2hhbmdlIGFzIGFuYWxvZ291cyB0byB0aCBFQ0RIIHByb3RvY29v bCwgdGhlIOKAnHBhcmFtZXRlciBzZXTigJ0gY291bGQgYmUgdGhvdWdodCBvZiBhbiBhbmFsb2dv dXMgdG8gdGhlIHNwZWNpZmljIGVsbGlwdHVjIGN1cnZlLCBhbmQgaXQgbW9kaWZpZXMgdGhlIGtl eSBzaGFyZSBzaXplLCB0aGUgcGVyZm9ybWFuY2UgYW5kIHNvbWV0aW1lcyB0aGUgc2VjdXJpdHkg cHJvcGVydGllcykuICBJbiBmYWN0LCBvbmUgb2YgdGhlIE5JU1Qgc3VibWlzc29pbnMgY3VycmVu dGx5IGhhcyAzMCBwYXJhbWV0ZXIgc2V0cyBkZWZpbmVkLiAgSGVuY2UsIGV2ZW4gaWYgTklTVCBk b2VzbuKAmXQgYXBwcm92ZSBhbGwgdGhlIHBhcmFtZXRlciBzZXRzIChvciBzb21lIG9mIHRoZW0g ZG8gbm90IG1ha2Ugc2Vuc2UgZm9yIFRMUyBpbiBhbnkgc2NlbmFyaW8pLCB3ZSBtaWdodCBlbmQg dXAgd2l0aCAyMCBvciBtb3JlIGRpZmZlcmVudCBrZXkgZXhjaGFuZ2UvcGFyYW1ldGVyIHNldCBj b21iaW5hdGlvbnMgdGhhdCBkbyBtYWtlIHNlbnNlIGZvciBzb21lIHNjZW5hcmlvIHRoYXQgdXNl cyB0TFMgKGJlIGl0IGluIGEgdHJhbmRpdGlvbmFsIFBDIGNsaWVudC9zZXJ2ZXIsIGEgd2lyZWxl c3MgY2xpZW50LCB0d28gY2xvdWQgZGV2aWNlcyBjb21tdW5pY2F0aW5nIG9yIGFuIElPVCBkZXZp Y2UpLg0KICAqICAgSW4gYWRkaXRpb24sIHdlIGFyZSBsaWtlbHkgdG8gc3VwcG9ydCBhZGRpdGlv bmFsIHByaW1pdGl2ZXMgaW4gdGhlIGZ1dHVyZTsgcG9zc2libHkgTmF0aW9uYWwgY3VydmVzIChl LmcuIEJyYWlucG9vbCksIG9yIGFkZGl0aW9uYWwgUG9zdHF1YW50dW0gYWxnb3JpdGhtcyAob3Ig YWRkaXRpb25hbCBwYXJhbWV0ZXIgc2V0cyB0byBleGlzdGluZyBvbmVzKS4gIE9mIGNvdXJzZSwg b25jZSB3ZSBhZGQgdGhhdCBjb2RlIHBvaW50LCB3ZeKAmWxsIG5lZWQgdG8gYWRkIHRoZSBhZGRp dGlvbmFsIGNvZGUgcG9pbnRzIGZvciBhbGwgdGhlIGNvbWJpbmF0aW9ucyB0aGF0IGl04oCZbGwg bWFrZSBzZW5zZSBpbiAodmVyeSBtdWNoIGxpa2Ugd2UgaGFkIHRvIGFkZCBhIG51bWJlciBvZiBj aXBoZXJzdWl0ZXMgd2hlbmV2ZXIgd2UgYWRkZWQgYSBuZXcgZW5jcnlwdGlvbiBhbGdvcml0aG0g aW50byBUTFMgMS4yKS4NCg0KDQpBcmUgcGVvcGxlIGFjdHVhbGx5IGdvaW5nIHRvIHVzZSBoeWJy aWQgZW5jcnlwdGlvbiBwb3N0IE5JU1Q/IFRoZSBhY3R1YWwgZGVwbG95bWVudHMgdG9kYXkgIGZv ciBleHBlcmltZW50IGhhdmUgYWxsIGZpdCBvcHRpb24gMiBhbmQgaHlicmlkcyBhcmUgdW5saWtl bHkgaW4gdGhlIGZ1dHVyZS4NCg0KTXkgb2JqZWN0aW9uIHRvIDEgaXMgaXQgZ2V0cyB2ZXJ5IG1l c3N5LiBEbyB3ZSB1c2Ugb25seSB0aGUgaHlicmlkcyB3ZSBib3RoIHN1cHBvcnQ/IFdoYXQgaWYg SSB0aHJvdyBhIGJ1bmNoIG9mIGV4cGVuc2l2ZSB0aGluZ3MgdG9nZXRoZXI/IE5vIHJlYXNvbiB3 ZSBuZWVkIGEgaHlicmlkIHNjaGVtZSENCg0KSXQgc2VlbWRzIHJlYXNvbmFibGUgdG8gbWUgdGhh dCB0aGUgY29tYmluYXRpb24gb2YgdGhlc2UgdHdvIGZhY3RvcnMgYXJlIGxpa2VseSB0byBjYXVz ZSB1cyAoc2hvdWxkIHdlIHNlbGVjdCBvcHRpb24gMikgdG8gZGVmaW5lIGEgdmVyeSBsYXJnZSBu dW1iZXIgb2YgY29kZSBwb2ludHMgdG8gY292ZXIgYWxsIHRoZSB2YXJpb3VzIG9wdGlvbnMgdGhh dCBwZW9wbGUgbmVlZC4NCg0KTm93LCB0aGlzIGlzIGJhc2VkIG9uIHNwZWN1bGF0aW9uIChib3Ro IG9mIHRoZSBOSVNUIHByb2Nlc3MsIGFuZCBhZGRpdGlvbmFsIHByaW1pdGl2ZXMgdGhhdCB3aWxs IGJlIGFkZGVkIHRvIHRoZSBwcm90b2NvbCksIGFuZCBvbmUgb2JqZWN0aW9uIEnigJl2ZSBoZWFy ZCBpcyDigJx3ZSBkb27igJl0IGtub3cgd2hhdOKAmXMgZ29pbmcgdG8gaGFwcGVuLCBhbmQgc28g d2h5IHdvdWxkIHdlIG1ha2UgZGVjaXNpb25zIGJhc2VkIG9uIHRoaXMgc3BlY3VsYXRpb24/4oCd ICBJIGFncmVlIHRoYXQgd2UgaGF2ZSBsYWNrIG9mIGtub3dsZWRnZTsgaG93ZXZlciBpdCBzZWVt cyB0byBtZSB0aGF0IGEgbGFjayBvZiBrbm93bGVkZ2UgaXMgYW4gYXJndW1lbnQgaW4gZmF2b3Ig b2Ygc2VsZWN0aW5nIHRoZSBtb3JlIGZsZXhpYmxlIG9wdGlvbiAod2hpY2gsIGluIG15IG9waW5p b24sIGlzIG9wdGlvbiAxLCBhcyBpdCBhbGxvd3MgdGhlIG5lZ290aWF0aW9uIG9mIGNvbWJpbmF0 aW9ucyBvZiBrZXkgZXhjaGFuZ2VzIHRoYXQgdGhlIFdHIGhhcyBub3QgYW50aWNpcGF0ZWQpLg0K DQpNeSBwbGVhOiBsZXRzIG5vdCByZXBlYXQgdGhlIFRMUyAxLjIgY2lwaGVyc3VpdGUgbWVzczsg bGV0cyBhZGQgYW4gZXh0ZW5zaW9uIHRoYXQga2VlcHMgdGhlIG51bWJlciBvZiBjb2RlIHBvaW50 cyB3ZSBuZWVkIHRvIGEgcmVhc29uYWJsZSBib3VuZC4NCg0KVGhlIGNvc3RzIG9mIG9wdGlvbiAx Pw0KDQogICogICBJdCBkb2VzIGluY3JlYXNlIHRoZSBjb21wbGV4aXR5IG9uIHRoZSBzZXJ2ZXIg YSBzbWFsbCBhbW91bnQgKEnigJltIG5vdCBhIFRMUyBpbXBsZW1lbnRvciwgaG93ZXZlciBpdCB3 b3VsZCBzZWVtIHRvIG1lIHRvIGJlIG9ubHkgYSBmYWlybHkgc21hbGwgYW1vdW50KQ0KICAqICAg SXQgbWF5IGluY3JlYXNlIHRoZSBzaXplIG9mIHRoZSBjbGllbnQgaGVsbG8gYSBzbWFsbCBhbW91 bnQgKG9uIHRoZSBvdGhlciBoYW5kLCBiZWNhdXNlIGl0IGFsbG93cyB1cyB0byBhdm9pZCBzZW5k aW5nIGR1cGxpY2F0ZSBrZXkgc2hhcmVzLCBpdCBjYW4gYWxzbyByZWR1Y2UgdGhlIHNpemUgb2Yg dGhlIGNsaWVudCBoZWxsbyBhcyB3ZWxsLCBkZXBlbmRpbmcgb24gd2hhdOKAmXMgYWN0dWFsbHkg bmVnb3RpYXRlZCkNCklNSE8sIHRoZSBzbWFsbCBpbmNyZWFzZSBpbiBjb21wbGV4aXR5IGlzIHdv cnRoIHRoZSBsYWNrIG9mIGNvbXBsZXhpdHkgaW4gdGhlIGNvZGUgcG9pbnQgdGFibGUsIGFuZCB0 aGUgYWRkaXRpb25hbCBmbGV4aWJpbGl0eSBpdCBnaXZlcy4NCl9fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fDQpUTFMgbWFpbGluZyBsaXN0DQpUTFNAaWV0Zi5v cmc8bWFpbHRvOlRMU0BpZXRmLm9yZz4NCmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlz dGluZm8vdGxzPGh0dHBzOi8vbmFtMDYuc2FmZWxpbmtzLnByb3RlY3Rpb24ub3V0bG9vay5jb20v P3VybD1odHRwcyUzQSUyRiUyRnd3dy5pZXRmLm9yZyUyRm1haWxtYW4lMkZsaXN0aW5mbyUyRnRs cyZkYXRhPTAyJTdDMDElN0NBbmRyZWkuUG9wb3YlNDBtaWNyb3NvZnQuY29tJTdDOGI0NTc0MGYw ODFmNDQ4MjBhNGMwOGQ3MTUxYjMwZTMlN0M3MmY5ODhiZjg2ZjE0MWFmOTFhYjJkN2NkMDExZGI0 NyU3QzElN0MwJTdDNjM3MDAxMDc5MDAzODQ5MDQyJnNkYXRhPXN3QjUya0glMkZ4N0R2TE5hWDlF QXlIY05mN1Z1aVhSUlVzeCUyRnRkbjBlMVM0JTNEJnJlc2VydmVkPTA+DQpfX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KVExTIG1haWxpbmcgbGlzdA0KVExT QGlldGYub3JnPG1haWx0bzpUTFNAaWV0Zi5vcmc+DQpodHRwczovL3d3dy5pZXRmLm9yZy9tYWls bWFuL2xpc3RpbmZvL3RsczxodHRwczovL25hbTA2LnNhZmVsaW5rcy5wcm90ZWN0aW9uLm91dGxv b2suY29tLz91cmw9aHR0cHMlM0ElMkYlMkZ3d3cuaWV0Zi5vcmclMkZtYWlsbWFuJTJGbGlzdGlu Zm8lMkZ0bHMmZGF0YT0wMiU3QzAxJTdDQW5kcmVpLlBvcG92JTQwbWljcm9zb2Z0LmNvbSU3Qzhi NDU3NDBmMDgxZjQ0ODIwYTRjMDhkNzE1MWIzMGUzJTdDNzJmOTg4YmY4NmYxNDFhZjkxYWIyZDdj ZDAxMWRiNDclN0MxJTdDMCU3QzYzNzAwMTA3OTAwMzg1OTAzNSZzZGF0YT1PSEV3QzZpdG13YnJx VDFUcEJ5S295dE91aEtPSWdoaXg3U3pNa1BkWHZRJTNEJnJlc2VydmVkPTA+DQo= --_000_DM5PR2101MB09177EFFFB5C2D64556724848CDC0DM5PR2101MB0917_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQph OmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xv cjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1z b0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpwdXJw bGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLm1zb25vcm1hbDAsIGxpLm1zb25v cm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCgltc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4tYm90 dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZv bnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnAuZ21haWwtbTE2NzM2OTQxNzU1NTc5 NTg3MTFtNTAxMjExMjg4NjcxMTIxMjg5MG1zb2xpc3RwYXJhZ3JhcGgsIGxpLmdtYWlsLW0xNjcz Njk0MTc1NTU3OTU4NzExbTUwMTIxMTI4ODY3MTEyMTI4OTBtc29saXN0cGFyYWdyYXBoLCBkaXYu Z21haWwtbTE2NzM2OTQxNzU1NTc5NTg3MTFtNTAxMjExMjg4NjcxMTIxMjg5MG1zb2xpc3RwYXJh Z3JhcGgNCgl7bXNvLXN0eWxlLW5hbWU6Z21haWwtbV8xNjczNjk0MTc1NTU3OTU4NzExbV81MDEy MTEyODg2NzExMjEyODkwbXNvbGlzdHBhcmFncmFwaDsNCgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0 bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0KCW1h cmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJp IixzYW5zLXNlcmlmO30NCnNwYW4uRW1haWxTdHlsZTE5DQoJe21zby1zdHlsZS10eXBlOnBlcnNv bmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOndp bmRvd3RleHQ7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7 fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBp biAxLjBpbiAxLjBpbiAxLjBpbjt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rp b24xO30NCi8qIExpc3QgRGVmaW5pdGlvbnMgKi8NCkBsaXN0IGwwDQoJe21zby1saXN0LWlkOjcy NjIyODAzMzsNCgltc28tbGlzdC10ZW1wbGF0ZS1pZHM6LTEyNzM3NjE5Njt9DQpAbGlzdCBsMDps ZXZlbDENCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0 Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6LjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0 aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4w cHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwwOmxldmVsMg0KCXttc28tbGV2ZWwt bnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10 YWItc3RvcDoxLjBpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1p bmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6 U3ltYm9sO30NCkBsaXN0IGwwOmxldmVsMw0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxs ZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDoxLjVpbjsNCglt c28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1z by1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGww OmxldmVsNA0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRl eHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDoyLjBpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBv c2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZTox MC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwwOmxldmVsNQ0KCXttc28tbGV2 ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZl bC10YWItc3RvcDoyLjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4 dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1p bHk6U3ltYm9sO30NCkBsaXN0IGwwOmxldmVsNg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpi dWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDozLjBpbjsN Cgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0K CW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0 IGwwOmxldmVsNw0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVs LXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDozLjVpbjsNCgltc28tbGV2ZWwtbnVtYmVy LXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6 ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwwOmxldmVsOA0KCXttc28t bGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1s ZXZlbC10YWItc3RvcDo0LjBpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJ dGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1m YW1pbHk6U3ltYm9sO30NCkBsaXN0IGwwOmxldmVsOQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1h dDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDo0LjVp bjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWlu Ow0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBs aXN0IGwxDQoJe21zby1saXN0LWlkOjE2Mzk2NDk5Mjc7DQoJbXNvLWxpc3QtdGVtcGxhdGUtaWRz Oi0yNTA3Mjk3NjQ7fQ0KQGxpc3QgbDE6bGV2ZWwxDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0 OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOi41aW47 DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsN Cgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlz dCBsMTpsZXZlbDINCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZl bC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6MS4waW47DQoJbXNvLWxldmVsLW51bWJl ci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNp emU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMTpsZXZlbDMNCgl7bXNv LWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28t bGV2ZWwtdGFiLXN0b3A6MS41aW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0K CXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQt ZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMTpsZXZlbDQNCgl7bXNvLWxldmVsLW51bWJlci1mb3Jt YXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6Mi4w aW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVp bjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpA bGlzdCBsMTpsZXZlbDUNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1s ZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6Mi41aW47DQoJbXNvLWxldmVsLW51 bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250 LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMTpsZXZlbDYNCgl7 bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCglt c28tbGV2ZWwtdGFiLXN0b3A6My4waW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0 Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZv bnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMTpsZXZlbDcNCgl7bXNvLWxldmVsLW51bWJlci1m b3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6 My41aW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0u MjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9 DQpAbGlzdCBsMTpsZXZlbDgNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1z by1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6NC4waW47DQoJbXNvLWxldmVs LW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1m b250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMTpsZXZlbDkN Cgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsN Cgltc28tbGV2ZWwtdGFiLXN0b3A6NC41aW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjps ZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0K CWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpvbA0KCXttYXJnaW4tYm90dG9tOjBpbjt9DQp1bA0KCXtt YXJnaW4tYm90dG9tOjBpbjt9DQotLT48L3N0eWxlPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0K PG86c2hhcGVkZWZhdWx0cyB2OmV4dD0iZWRpdCIgc3BpZG1heD0iMTAyNiIgLz4NCjwveG1sPjwh W2VuZGlmXS0tPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVsYXlvdXQgdjpleHQ9 ImVkaXQiPg0KPG86aWRtYXAgdjpleHQ9ImVkaXQiIGRhdGE9IjEiIC8+DQo8L286c2hhcGVsYXlv dXQ+PC94bWw+PCFbZW5kaWZdLS0+DQo8L2hlYWQ+DQo8Ym9keSBsYW5nPSJFTi1VUyIgbGluaz0i Ymx1ZSIgdmxpbms9InB1cnBsZSI+DQo8ZGl2IGNsYXNzPSJXb3JkU2VjdGlvbjEiPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+R2l2ZW4gdGhlc2Ugb3B0aW9ucywgSSBhbHNvIHByZWZlciBvcHRpb24g MiwgZm9yIHNvbWUgb2YgdGhlIHNhbWUgcmVhc29ucy48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ Rm9yIG15IHVuZGVyc3RhbmRpbmcgdGhvdWdoLCB3aHkgbm90IGhhdmUgdGhlIGNsaWVudCBhZHZl cnRpc2Ugc3VwcG9ydCBmb3IgaHlicmlkLWtleS1leGNoYW5nZSAoZS5nLiB2aWEgYSDigJxmbGFn 4oCdIGV4dGVuc2lvbikgYW5kIHRoZW4gS2V5U2hhcmVTZXJ2ZXJIZWxsbyBjYW4gY29udGFpbiB0 d28gS2V5U2hhcmVFbnRyaWVzIChlc3NlbnRpYWxseSwgdXNpbmcgdGhlIHNhbWUgZm9ybWF0IGFz IEtleVNoYXJlQ2xpZW50SGVsbG8/DQogVGhpcyB3b3VsZCBzb2x2ZSB0aGUgQ2FydGVzaWFuIHBy b2R1Y3QgaXNzdWUuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZu YnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkNoZWVycyw8bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+QW5kcmVpPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPkZyb206PC9iPiBU TFMgJmx0O3Rscy1ib3VuY2VzQGlldGYub3JnJmd0OyA8Yj5PbiBCZWhhbGYgT2YgPC9iPg0KRGF2 aWQgQmVuamFtaW48YnI+DQo8Yj5TZW50OjwvYj4gVHVlc2RheSwgSnVseSAzMCwgMjAxOSAxMToy NCBBTTxicj4NCjxiPlRvOjwvYj4gV2F0c29uIExhZGQgJmx0O3dhdHNvbmJsYWRkQGdtYWlsLmNv bSZndDs8YnI+DQo8Yj5DYzo8L2I+IFRMUyBMaXN0ICZsdDt0bHNAaWV0Zi5vcmcmZ3Q7PGJyPg0K PGI+U3ViamVjdDo8L2I+IFJlOiBbVExTXSBPcHRpb25zIGZvciBuZWdvdGlhdGluZyBoeWJyaWQg a2V5IGV4Y2hhbmdlcyBmb3IgcG9zdHF1YW50dW08bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj5JIHRoaW5rIHRoaXMgdW5kZXJlc3RpbWF0ZXMgdGhlIGNvbXBsZXhpdHkgY29z dCBvZiBvcHRpb24gMSB0byB0aGUgcHJvdG9jb2wgYW5kIGltcGxlbWVudGF0aW9ucy4gT3B0aW9u IDEgbWVhbnMgZ3JvdXAgbmVnb3RpYXRpb24gaW5jbHVkZXMgZW50aXJlIGNvZGVwb2ludHMgd2hv c2UgbWVhbmluZyBjYW5ub3QgYmUgZGV0ZXJtaW5lZCB3aXRob3V0IGEgcGFyYWxsZWwgZXh0ZW5z aW9uLiBUaGlzIGNvbXBvdW5kcw0KIGFjcm9zcyBldmVyeXRoaW5nIHdoaWNoIGludGVyYWN0cyB3 aXRoIG5hbWVkIGdyb3VwcywgaW1wYWN0aW5nIGV2ZXJ5dGhpbmcgZnJvbSBBUElzIHRvIGNvbmZp ZyBmaWxlIGZvcm1hdHMgdG8gZXZlbiBVSSBzdXJmYWNlcy4gT3RoZXIgdXNlcyBvZiBOYW1lZEdy b3VwcyBhcmUgaW1wYWN0ZWQgdG9vLiBGb3IgaW5zdGFuY2UsIG9wdGlvbiAyIGZpdHMgaW50byBk cmFmdC1pZXRmLXRscy1lc25pIGFzLWlzLiBPcHRpb24gMSByZXF1aXJlcyBpbmplY3RpbmcmbmJz cDtoeWJyaWRfZXh0ZW5zaW9uDQogaW50byBFU05JIHNvbWVob3cuIEFuYWx5c2lzIG11c3QgZnVy dGhlciBjaGVjayBldmVyeSB1c2UsIHNheSwgaW5jb3Jwb3JhdGVzIHRoaXMgcGFyYWxsZWwgbG9v a3VwIHRhYmxlIGludG8gdHJhbnNjcmlwdC1saWtlIG1lYXN1cmVzLjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5UaGUgbGVzc29uIGZyb20gVExT IDEuMiBjb2RlIHBvaW50cyBpcyBub3QgY29tYmluZWQgY29kZXBvaW50cyB2cy4gc3BsaXQgb25l cy4gUmF0aGVyLCB0aGUgbGVzc29uIGlzIHRvIGF2b2lkIGludGVyZGVwZW5kZW50IGRlY2lzaW9u czo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxv OnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ KiBTaWduYXR1cmUgYWxnb3JpdGhtcyBpbiBUTFMgMS4yIHdlcmUgYSBtZXNzIGJlY2F1c2UgdGhl IEVDRFNBIGNvZGVwb2ludHMgcmVxdWlyZWQgY3Jvc3MtcmVmZXJlbmNpbmcgYWdhaW5zdCB0aGUg c3VwcG9ydGVkIGN1cnZlcyBsaXN0LiBUaGUgdmVyaWZpZXIgY291bGQgbm90IGV4cHJlc3Mgc29t ZSBwcmVmZXJlbmNlcyAoc2lnbmluZyBTSEEtNTEyIHdpdGggUC0yNTYgaXMgc2lsbHksIGFuZCBt aXhpbmcgaGFzaCYjNDM7Y3VydmUNCiBwYWlycyBpbiBFQ0RTQSBpcyBzbGlnaHRseSBvZmYgaW4g Z2VuZXJhbCkuIEFzIGFuYWxvZ3kgdG8gb3B0aW9uIDEncyBFU05JIHByb2JsZW0sIHdlIGV2ZW4g Zm9yZ290IHRvIGFsbG93IHRoZSBzZXJ2ZXIgdG8gZXhwcmVzcyBjdXJ2ZSBwcmVmZXJlbmNlcy4g VExTIDEuMyBjb21iaW5lZCBzaWduYXR1cmUgYWxnb3JpdGhtIGNvbnNpZGVyYXRpb25zIGludG8g YSBzaW5nbGUgY29kZXBvaW50IHRvIGFkZHJlc3MgYWxsIHRoaXMuPG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiogQ2lwaGVyIHN1aXRlcyBpbiBU TFMgMS4yIHdlcmUgYSBtZXNzIGJlY2F1c2UgdGhleSB3ZXJlIGhhbGYtY29tYmluZWQgYW5kIGhh bGYtc3BsaXQuIFRMU19FQ0RIRV9FQ0RTQV9XSVRIX0FFU18xMjhfR0NNX1NIQTI1NiBzYWlkIHRv IHVzZSBzb21lIEVDREhFIGtleSBleGNoYW5nZSwgYnV0IHlvdSBuZWVkIHRvIGNoZWNrIGlmIHlv dSBoYXZlIGEgTmFtZWRHcm91cCBpbiBjb21tb24gZmlyc3QuIEl0IHNhaWQNCiB0byB1c2UgRUNE U0EsIGJ1dCB5b3UgbmVlZCB0byBjaGVjayBzaWduYXR1cmUgYWxnb3JpdGhtcyAod2hpY2ggdGhl bXNlbHZlcyBjcm9zcy1yZWZlcmVuY2UgY3VydmVzKSBmaXJzdC4gRWFybHkgZHJhZnRzIG9mIFRM UyAxLjMgaGFkIGl0IGV2ZW4gd29yc2UsIHdoZXJlIGEmbmJzcDtUTFNfRUNESEVfRUNEU0FfV0lU SF9BRVNfMTI4X0dDTV9TSEEyNTYgZnVsbCBoYW5kc2hha2UgbW9ycGhlZCBpbnRvJm5ic3A7VExT X0VDREhFX1BTS19XSVRIX0FFU18xMjhfR0NNX1NIQTI1Ng0KIG9uIHJlc3VtcHRpb24uIFRodXMs IFRMUyAxLjMgY2lwaGVyIHN1aXRlcyBuZWdvdGlhdGUgc29sZWx5IEFFQUQmbmJzcDsmIzQzOyBQ UkYgaGFzaC48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+SW4gZmFpcm5lc3MgdG8gVExTIDEuMiwgc29tZSBvZiB0aGlzIHdhcyBhIGNvbnNlcXVl bmNlIG9mIFRMUyAxLjIncyBldm9sdXRpb24gb3ZlciB0aW1lIGFzIGluY3JlbWVudGFsIGV4dGVu c2lvbnMgb3ZlciBTU0wgMy4wLiBBbmQgc29tZXRpbWVzIHdlIGRvIG5lZWQgdG8gcGF5IGNvc3Rz IGxpa2UgdGhlc2UuIEJ1dCBoeWJyaWQga2V5IGV4Y2hhbmdlcyBmaXQgaW50byB0aGUgTmFtZWRH cm91cCAmcXVvdDtBUEkmcXVvdDsganVzdA0KIGZpbmUsIHNvIG9wdGlvbiAyIGlzIHRoZSBjbGVh ciBhbnN3ZXIuIENvZGUgcG9pbnRzIGFyZSBjaGVhcC4gUHJvdG9jb2wgY29tcGxleGl0eSBpcyBt dWNoIG1vcmUgZXhwZW5zaXZlLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj5JdCdzIHRydWUgdGhhdCBzdGFuZGFyZHMgYXJlIG9mdGVuIHVuZGVy c3BlY2lmaWVkLiBUaGlzIG1lYW5zIHRoZSBJRVRGIHNob3VsZCBmaW5pc2ggdGhlIGpvYiwgbm90 IHBhc3MgYWxsIHZhcmlhdGlvbnMgdGhyb3VnaC4gUlNBLVBTUyBpcyBhIGNsZWFyIGV4YW1wbGUg b2Ygd2hhdCB0byBhdm9pZC4gSXQgdGFrZXMgbW9yZSBieXRlcyB0byBtZXJlbHkgdXR0ZXIgJnF1 b3Q7UlNBLVBTUyB3aXRoIFNIQS0yNTYgYW5kIHVzdWFsDQogcGFyYW1ldGVycyZxdW90OyBpbiBY LjUwOSB0aGFuIHRvIGVuY29kZSBhbiBlbnRpcmUgRUNEU0Egc2lnbmF0dXJlISBXZSBzaG91bGQg bm90IGRlZmluZSBtb3JlIHRoYW4gYSBoYW5kZnVsIG9mIG9wdGlvbnMsIHJlZ2FyZGxlc3Mgb2Yg dGhlIGVuY29kaW5nLi48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPk9uIFR1ZSwgSnVsIDMwLCAyMDE5IGF0IDEyOjE4IFBNIFdhdHNvbiBMYWRkICZsdDs8YSBo cmVmPSJtYWlsdG86d2F0c29uYmxhZGRAZ21haWwuY29tIj53YXRzb25ibGFkZEBnbWFpbC5jb208 L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9 ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowaW4g MGluIDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tcmlnaHQ6MGluIj4NCjxkaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1ib3R0b206MTIuMHB0 Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+T24gVHVlLCBKdWwgMzAsIDIwMTksIDg6MjEgQU0gU2NvdHQgRmx1aHJlciAoc2ZsdWhyZXIp ICZsdDs8YSBocmVmPSJtYWlsdG86c2ZsdWhyZXJAY2lzY28uY29tIiB0YXJnZXQ9Il9ibGFuayI+ c2ZsdWhyZXJAY2lzY28uY29tPC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjxibG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0ND IDEuMHB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2lu LXJpZ2h0OjBpbiI+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt c28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+RHVyaW5n IHRoZSBwaHlzaWNhbCBtZWV0aW5nIGluIE1vbnRyZWFsLCB3ZSBoYWQgYSBkaXNjdXNzaW9uIGFi b3V0IHBvc3RxdWFudHVtIHNlY3VyaXR5LCBhbmQgaW4gcGFydGljdWxhciwgb24gaG93IG9uZSBt aWdodCB3YW50IHRvIG5lZ290aWF0ZSBzZXZlcmFsIGRpZmZlcmVudCDigJhncm91cHPigJkgc2lt dWx0YW5lb3VzbHkNCiAoYmVjYXVzZSB0aGVyZSBtaWdodCBub3QgYmUgb25lIGdyb3VwIHRoYXQg aXMgZW50aXJlbHkgdHJ1c3RlZCwgYW5kIEkgcHV0IOKAmGdyb3Vwc+KAmSBpbiBzY2FyZXF1b3Rl cyBiZWNhdXNlIHBvc3RxdWFudHVtIGtleSBleGNoYW5nZXMgYXJlIHR5cGljYWxseSBub3QgZm9y bWVkIGZyb20gYSBEaWZmaWUtSGVsbG1hbiBncm91cCkuPG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1i b3R0b20tYWx0OmF1dG8iPjxzcGFuIGxhbmc9IkVOLUdCIj4mbmJzcDs8L3NwYW4+PG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1 dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIGxhbmc9IkVOLUdCIj5BdCB0aGUg bWVldGluZywgdGhlcmUgd2VyZSB0d28gb3B0aW9ucyBwcmVzZW50ZWQ6PC9zcGFuPjxvOnA+PC9v OnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDph dXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBsYW5nPSJFTi1HQiI+Jm5ic3A7 PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1t YXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBsYW5n PSJFTi1HQiI+T3B0aW9uIDE6IGFzIHRoZSBzdXBwb3J0ZWQgZ3JvdXAsIHdlIGluc2VydCBhIOKA mGh5YnJpZCBtYXJrZXLigJkgKGFuZCBpbmNsdWRlIGFuIGV4dGVuc2lvbiB0aGF0IG1hcCBsaXN0 cyB3aGljaCBjb21iaW5hdGlvbiB0aGUgaHlicmlkIG1hcmtlciBzdGFuZHMgZm9yKTwvc3Bhbj48 bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRv cC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gbGFuZz0iRU4tR0Ii PiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBGb3IgZXhhbXBsZSwgdGhlIGNsaWVu dCBtaWdodCBsaXN0IGluIGhpcyBzdXBwb3J0ZWQgZ3JvdXBzIGh5YnJpZF9tYXJrZXJfMCBhbmQg aHlicmlkX21hcmtlcl8xLCBhbmQgdGhlcmUgd291bGQgYmUgYSBzZXBhcmF0ZSBleHRlbnNpb24g dGhhdCBsaXN0cw0KIGh5YnJpZF9tYXJrZXJfMCA9IFgyNTUxOSAmIzQzOyBTSUtFcDQzNCBhbmQg aHlicmlkX21hcmtlcl8xID0gWDI1NTE5ICYjNDM7IE5UUlVQUjY1My4mbmJzcDsgVGhlIHNlcnZl ciB3b3VsZCB0aGVuIGxvb2sgdXAgdGhlIG1lYW5pbmdzIG9mIGh5YnJpZF9tYXJrZXJfMCBhbmQg MSBpbiB0aGUgZXh0ZW5zaW9uLCBhbmQgdGhlbiBjb21wYXJlIHRoYXQgYWdhaW5zdCBoaXMgc2Vj dXJpdHkgcG9saWN5Ljwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0 bzt0ZXh0LWluZGVudDouNWluIj4NCjxzcGFuIGxhbmc9IkVOLUdCIj5JbiB0aGlzIG9wdGlvbiwg d2Ugd291bGQgYXNrIElBTkEgdG8gYWxsb2NhdGUgY29kZSBwb2ludHMgZm9yIHRoZSB2YXJpb3Vz IGluZGl2aWR1YWwgcG9zdHF1YW50dW0ga2V5IGV4Y2hhbmdlcyAoaW4gdGhpcyBleGFtcGxlLCBT SUtFcDQzNCBhbmQgTlRSVVBSNjUzKSwgYXMgd2VsbCBhIHJhbmdlIG9mIGNvZGUgcG9pbnRzIGZv ciB0aGUgdmFyaW91cyBoeWJyaWRfbWFya2Vycy48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0K PGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0Mg MS4wcHQ7cGFkZGluZzowaW4gMGluIDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4t cmlnaHQ6MGluIj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1z by1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBs YW5nPSJFTi1HQiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFs dDphdXRvIj48c3BhbiBsYW5nPSJFTi1HQiI+T3B0aW9uIDI6IHdlIGhhdmUgY29kZSBwb2ludHMg Zm9yIGFsbCB0aGUgdmFyaW91cyBjb21iaW5hdGlvbnMgdGhhdCB3ZSBtYXkgd2FudCB0byBzdXBw b3J0OyBoZW5jZSBJQU5BIG1pZ2h0IGFsbG9jYXRlIGEgY29kZSBwb2ludCBYMjU1MTlfU0lLRXA0 MzQgYW5kIGFub3RoZXINCiBjb2RlIHBvaW50IGZvciBYMjU1MTlfTlRSVVBSNjUzLiZuYnNwOyBX aXRoIHRoaXMgb3B0aW9uLCB0aGUgY2xpZW50IHdvdWxkIGxpc3QgWDI1NTE5X1NJS0VwNDM0IGFu ZCBYMjU1MTlfTlRSVVBSNjUzIGluIHRoZWlyIHN1cHBvcnRlZCBncm91cHMuPC9zcGFuPjxvOnA+ PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFs dDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBsYW5nPSJFTi1HQiI+Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IEluIHRoaXMgb3B0aW9uLCB3ZSB3b3VsZCBh c2sgSUFOQSB0byBhbGxvY2F0ZSBjb2RlIHBvaW50cyBmb3IgYWxsIHRoZSB2YXJpb3VzIGNvbWJp bmF0aW9ucyB0aGF0IHdlIHdhbnQgYWxsb3cgdG8gYmUgbmVnb3RpYXRlZC48L3NwYW4+PG86cD48 L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0 OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIGxhbmc9IkVOLUdCIj4mbmJz cDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNv LW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIGxh bmc9IkVOLUdCIj5JIHdvdWxkIGxpa2UgdG8gbWFrZSBhbiBhcmd1bWVudCBpbiBmYXZvciBvZiBv cHRpb24gMTo8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxz cGFuIGxhbmc9IkVOLUdCIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8dWwgdHlwZT0i ZGlzYyI+DQo8bGkgY2xhc3M9ImdtYWlsLW0xNjczNjk0MTc1NTU3OTU4NzExbTUwMTIxMTI4ODY3 MTEyMTI4OTBtc29saXN0cGFyYWdyYXBoIiBzdHlsZT0ibXNvLWxpc3Q6bDAgbGV2ZWwxIGxmbzEi Pg0KPHNwYW4gbGFuZz0iRU4tR0IiPkl0IGlzIGxpa2VseSB0aGF0IG5vdCBldmVyeW9uZSB3aWxs IGJlIHNhdGlzaWZpZWQgd2l0aCDigJxYMjU1MTkgcGx1cyBvbmUgb2YgYSBoYW5kZnVsIG9mIHNw ZWNpZmljIHBvc3RxdWFudHVtIGFsZ29yaXRobXPigJ07IHNvbWUgbWF5IHByZWZlciBhbm90aGVy IGVsbGlwdGljIGN1cnZlIChmb3IgZXhhbXBsZSwgeDQ0OCksIG9yIHBlcmhhcHMgZXZlbiBhIE1P RFAgZ3JvdXA7IEkgaGF2ZSB0YWxrZWQgdG8gcGVvcGxlIHdobw0KIGRvIG5vdCB0cnVzdCBFQ0Mp OyBpbiBhZGRpdGlvbiwgb3RoZXIgcGVvcGxlIG1pZ2h0IG5vdCB0cnVzdCBhIHNpbmdsZSBwb3N0 cXVhbnR1bSBhbGdvcml0aG0sIGFuZCBtYXkgd2FudCB0byByZWx5IG9uIGJvdGggKGZvciBleGFt cGxlKSBTSUtFIGFuZCBOZXdIb3BlICh3aGljaCBhcmUgYmFzZWQgb24gdmVyeSBkaWZmZXJlbnQg aGFyZCBwcm9ibGVtcykuJm5ic3A7IFdpdGggb3B0aW9uIDIsIHdlIGNvdWxkIHRyeSB0byBhbnRp Y2lwYXRlIGFsbCB0aGUgY29tbW9uDQogY29tYmludGF0aW9ucyAoc3VjaCBhcyBQMzg0X1NJS0Vw NDM0X05FV0hPUEU1MTJDQ0EpLCBob3dldmVyIHRoYXQgY291bGQgdmVyeSB3ZWxsIGVuZCB1cCBh cyBhIGxvdCBvZiBjb21iaW5hdGlvbnMuPC9zcGFuPjxvOnA+PC9vOnA+PC9saT48bGkgY2xhc3M9 ImdtYWlsLW0xNjczNjk0MTc1NTU3OTU4NzExbTUwMTIxMTI4ODY3MTEyMTI4OTBtc29saXN0cGFy YWdyYXBoIiBzdHlsZT0ibXNvLWxpc3Q6bDAgbGV2ZWwxIGxmbzEiPg0KPHNwYW4gbGFuZz0iRU4t R0IiPlRoZXJlIGFyZSBsaWtlbHkgdG8gYmUgc2V2ZXJhbCBOSVNULWFwcHJvdmVkIHBvc3RxdWFu dHVtIGtleSBleGNoYW5nZXMsIGFuZCBlYWNoIG9mIHRob3NlIGtleSBleGNoYW5nZXMgYXJlIGxp a2VseSB0byBoYXZlIGEgbnVtYmVyIG9mIHN1cHBvcnRlZCBwYXJhbWV0ZXIgc2V0cyAoaWYgd2Ug dGFrZSB0aGUgc3BlY2lmaWMgcG9zdHF1YW50dW0ga2V5IGV4Y2hhbmdlIGFzIGFuYWxvZ291cyB0 byB0aCBFQ0RIIHByb3RvY29vbCwNCiB0aGUg4oCccGFyYW1ldGVyIHNldOKAnSBjb3VsZCBiZSB0 aG91Z2h0IG9mIGFuIGFuYWxvZ291cyB0byB0aGUgc3BlY2lmaWMgZWxsaXB0dWMgY3VydmUsIGFu ZCBpdCBtb2RpZmllcyB0aGUga2V5IHNoYXJlIHNpemUsIHRoZSBwZXJmb3JtYW5jZSBhbmQgc29t ZXRpbWVzIHRoZSBzZWN1cml0eSBwcm9wZXJ0aWVzKS4mbmJzcDsgSW4gZmFjdCwgb25lIG9mIHRo ZSBOSVNUIHN1Ym1pc3NvaW5zIGN1cnJlbnRseSBoYXMgMzAgcGFyYW1ldGVyIHNldHMgZGVmaW5l ZC4mbmJzcDsNCiBIZW5jZSwgZXZlbiBpZiBOSVNUIGRvZXNu4oCZdCBhcHByb3ZlIGFsbCB0aGUg cGFyYW1ldGVyIHNldHMgKG9yIHNvbWUgb2YgdGhlbSBkbyBub3QgbWFrZSBzZW5zZSBmb3IgVExT IGluIGFueSBzY2VuYXJpbyksIHdlIG1pZ2h0IGVuZCB1cCB3aXRoIDIwIG9yIG1vcmUgZGlmZmVy ZW50IGtleSBleGNoYW5nZS9wYXJhbWV0ZXIgc2V0IGNvbWJpbmF0aW9ucyB0aGF0IGRvIG1ha2Ug c2Vuc2UgZm9yIHNvbWUgc2NlbmFyaW8gdGhhdCB1c2VzIHRMUyAoYmUNCiBpdCBpbiBhIHRyYW5k aXRpb25hbCBQQyBjbGllbnQvc2VydmVyLCBhIHdpcmVsZXNzIGNsaWVudCwgdHdvIGNsb3VkIGRl dmljZXMgY29tbXVuaWNhdGluZyBvciBhbiBJT1QgZGV2aWNlKS48L3NwYW4+PG86cD48L286cD48 L2xpPjxsaSBjbGFzcz0iZ21haWwtbTE2NzM2OTQxNzU1NTc5NTg3MTFtNTAxMjExMjg4NjcxMTIx Mjg5MG1zb2xpc3RwYXJhZ3JhcGgiIHN0eWxlPSJtc28tbGlzdDpsMCBsZXZlbDEgbGZvMSI+DQo8 c3BhbiBsYW5nPSJFTi1HQiI+SW4gYWRkaXRpb24sIHdlIGFyZSBsaWtlbHkgdG8gc3VwcG9ydCBh ZGRpdGlvbmFsIHByaW1pdGl2ZXMgaW4gdGhlIGZ1dHVyZTsgcG9zc2libHkgTmF0aW9uYWwgY3Vy dmVzIChlLmcuIEJyYWlucG9vbCksIG9yIGFkZGl0aW9uYWwgUG9zdHF1YW50dW0gYWxnb3JpdGht cyAob3IgYWRkaXRpb25hbCBwYXJhbWV0ZXIgc2V0cyB0byBleGlzdGluZyBvbmVzKS4mbmJzcDsg T2YgY291cnNlLCBvbmNlIHdlIGFkZCB0aGF0IGNvZGUNCiBwb2ludCwgd2XigJlsbCBuZWVkIHRv IGFkZCB0aGUgYWRkaXRpb25hbCBjb2RlIHBvaW50cyBmb3IgYWxsIHRoZSBjb21iaW5hdGlvbnMg dGhhdCBpdOKAmWxsIG1ha2Ugc2Vuc2UgaW4gKHZlcnkgbXVjaCBsaWtlIHdlIGhhZCB0byBhZGQg YSBudW1iZXIgb2YgY2lwaGVyc3VpdGVzIHdoZW5ldmVyIHdlIGFkZGVkIGEgbmV3IGVuY3J5cHRp b24gYWxnb3JpdGhtIGludG8gVExTIDEuMikuPC9zcGFuPjxvOnA+PC9vOnA+PC9saT48L3VsPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1t YXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBsYW5nPSJFTi1HQiI+Jm5ic3A7PC9zcGFuPjxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5BcmUgcGVvcGxlIGFjdHVhbGx5IGdv aW5nIHRvIHVzZSBoeWJyaWQgZW5jcnlwdGlvbiBwb3N0IE5JU1Q/IFRoZSBhY3R1YWwgZGVwbG95 bWVudHMgdG9kYXkmbmJzcDsgZm9yIGV4cGVyaW1lbnQgaGF2ZSBhbGwgZml0IG9wdGlvbiAyIGFu ZCBoeWJyaWRzIGFyZSB1bmxpa2VseSBpbiB0aGUgZnV0dXJlLiZuYnNwOzxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5NeSBvYmplY3Rpb24gdG8g MSBpcyBpdCBnZXRzIHZlcnkgbWVzc3kuIERvIHdlIHVzZSBvbmx5IHRoZSBoeWJyaWRzIHdlIGJv dGggc3VwcG9ydD8gV2hhdCBpZiBJIHRocm93IGEgYnVuY2ggb2YgZXhwZW5zaXZlIHRoaW5ncyB0 b2dldGhlcj8gTm8gcmVhc29uIHdlIG5lZWQgYSBoeWJyaWQgc2NoZW1lISZuYnNwOzxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8 L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRl cjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowaW4gMGluIDBp biA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tcmlnaHQ6MGluIj4NCjxkaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21z by1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBsYW5nPSJFTi1HQiI+SXQgc2VlbWRzIHJl YXNvbmFibGUgdG8gbWUgdGhhdCB0aGUgY29tYmluYXRpb24gb2YgdGhlc2UgdHdvIGZhY3RvcnMg YXJlIGxpa2VseSB0byBjYXVzZSB1cyAoc2hvdWxkIHdlIHNlbGVjdCBvcHRpb24gMikgdG8gZGVm aW5lIGEgdmVyeSBsYXJnZSBudW1iZXIgb2YgY29kZQ0KIHBvaW50cyB0byBjb3ZlciBhbGwgdGhl IHZhcmlvdXMgb3B0aW9ucyB0aGF0IHBlb3BsZSBuZWVkLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28t bWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gbGFuZz0iRU4tR0IiPiZuYnNwOzwvc3Bhbj48 bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRv cC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gbGFuZz0iRU4tR0Ii Pk5vdywgdGhpcyBpcyBiYXNlZCBvbiBzcGVjdWxhdGlvbiAoYm90aCBvZiB0aGUgTklTVCBwcm9j ZXNzLCBhbmQgYWRkaXRpb25hbCBwcmltaXRpdmVzIHRoYXQgd2lsbCBiZSBhZGRlZCB0byB0aGUg cHJvdG9jb2wpLCBhbmQgb25lIG9iamVjdGlvbiBJ4oCZdmUgaGVhcmQgaXMg4oCcd2UNCiBkb27i gJl0IGtub3cgd2hhdOKAmXMgZ29pbmcgdG8gaGFwcGVuLCBhbmQgc28gd2h5IHdvdWxkIHdlIG1h a2UgZGVjaXNpb25zIGJhc2VkIG9uIHRoaXMgc3BlY3VsYXRpb24/4oCdJm5ic3A7IEkgYWdyZWUg dGhhdCB3ZSBoYXZlIGxhY2sgb2Yga25vd2xlZGdlOyBob3dldmVyIGl0IHNlZW1zIHRvIG1lIHRo YXQgYSBsYWNrIG9mIGtub3dsZWRnZSBpcyBhbiBhcmd1bWVudCBpbiBmYXZvciBvZiBzZWxlY3Rp bmcgdGhlIG1vcmUgZmxleGlibGUgb3B0aW9uICh3aGljaCwNCiBpbiBteSBvcGluaW9uLCBpcyBv cHRpb24gMSwgYXMgaXQgYWxsb3dzIHRoZSBuZWdvdGlhdGlvbiBvZiBjb21iaW5hdGlvbnMgb2Yg a2V5IGV4Y2hhbmdlcyB0aGF0IHRoZSBXRyBoYXMgbm90IGFudGljaXBhdGVkKS48L3NwYW4+PG86 cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3At YWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21z by1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj5NeSBwbGVhOiBsZXRzIG5vdCByZXBlYXQgdGhlIFRM UyAxLjIgY2lwaGVyc3VpdGUgbWVzczsgbGV0cyBhZGQgYW4gZXh0ZW5zaW9uIHRoYXQga2VlcHMg dGhlIG51bWJlciBvZiBjb2RlIHBvaW50cyB3ZSBuZWVkIHRvIGEgcmVhc29uYWJsZSBib3VuZC48 bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRv cC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48L286cD48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87 bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPlRoZSBjb3N0cyBvZiBvcHRpb24gMT88bzpwPjwv bzpwPjwvcD4NCjx1bCB0eXBlPSJkaXNjIj4NCjxsaSBjbGFzcz0iZ21haWwtbTE2NzM2OTQxNzU1 NTc5NTg3MTFtNTAxMjExMjg4NjcxMTIxMjg5MG1zb2xpc3RwYXJhZ3JhcGgiIHN0eWxlPSJtc28t bGlzdDpsMSBsZXZlbDEgbGZvMiI+DQpJdCBkb2VzIGluY3JlYXNlIHRoZSBjb21wbGV4aXR5IG9u IHRoZSBzZXJ2ZXIgYSBzbWFsbCBhbW91bnQgKEnigJltIG5vdCBhIFRMUyBpbXBsZW1lbnRvciwg aG93ZXZlciBpdCB3b3VsZCBzZWVtIHRvIG1lIHRvIGJlIG9ubHkgYSBmYWlybHkgc21hbGwgYW1v dW50KTxvOnA+PC9vOnA+PC9saT48bGkgY2xhc3M9ImdtYWlsLW0xNjczNjk0MTc1NTU3OTU4NzEx bTUwMTIxMTI4ODY3MTEyMTI4OTBtc29saXN0cGFyYWdyYXBoIiBzdHlsZT0ibXNvLWxpc3Q6bDEg bGV2ZWwxIGxmbzIiPg0KSXQgbWF5IGluY3JlYXNlIHRoZSBzaXplIG9mIHRoZSBjbGllbnQgaGVs bG8gYSBzbWFsbCBhbW91bnQgKG9uIHRoZSBvdGhlciBoYW5kLCBiZWNhdXNlIGl0IGFsbG93cyB1 cyB0byBhdm9pZCBzZW5kaW5nIGR1cGxpY2F0ZSBrZXkgc2hhcmVzLCBpdCBjYW4gYWxzbyByZWR1 Y2UgdGhlIHNpemUgb2YgdGhlIGNsaWVudCBoZWxsbyBhcyB3ZWxsLCBkZXBlbmRpbmcgb24gd2hh dOKAmXMgYWN0dWFsbHkgbmVnb3RpYXRlZCk8bzpwPjwvbzpwPjwvbGk+PC91bD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJv dHRvbS1hbHQ6YXV0byI+SU1ITywgdGhlIHNtYWxsIGluY3JlYXNlIGluIGNvbXBsZXhpdHkgaXMg d29ydGggdGhlIGxhY2sgb2YgY29tcGxleGl0eSBpbiB0aGUgY29kZSBwb2ludCB0YWJsZSwgYW5k IHRoZSBhZGRpdGlvbmFsIGZsZXhpYmlsaXR5IGl0IGdpdmVzLjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPl9fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fPGJyPg0KVExTIG1haWxpbmcgbGlzdDxicj4NCjxhIGhy ZWY9Im1haWx0bzpUTFNAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj5UTFNAaWV0Zi5vcmc8L2E+ PGJyPg0KPGEgaHJlZj0iaHR0cHM6Ly9uYW0wNi5zYWZlbGlua3MucHJvdGVjdGlvbi5vdXRsb29r LmNvbS8/dXJsPWh0dHBzJTNBJTJGJTJGd3d3LmlldGYub3JnJTJGbWFpbG1hbiUyRmxpc3RpbmZv JTJGdGxzJmFtcDtkYXRhPTAyJTdDMDElN0NBbmRyZWkuUG9wb3YlNDBtaWNyb3NvZnQuY29tJTdD OGI0NTc0MGYwODFmNDQ4MjBhNGMwOGQ3MTUxYjMwZTMlN0M3MmY5ODhiZjg2ZjE0MWFmOTFhYjJk N2NkMDExZGI0NyU3QzElN0MwJTdDNjM3MDAxMDc5MDAzODQ5MDQyJmFtcDtzZGF0YT1zd0I1MmtI JTJGeDdEdkxOYVg5RUF5SGNOZjdWdWlYUlJVc3glMkZ0ZG4wZTFTNCUzRCZhbXA7cmVzZXJ2ZWQ9 MCIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8v dGxzPC9hPjxvOnA+PC9vOnA+PC9wPg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8L2Rpdj4NCjwv ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+X19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX188YnI+DQpUTFMgbWFpbGluZyBsaXN0PGJyPg0KPGEgaHJlZj0ibWFp bHRvOlRMU0BpZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPlRMU0BpZXRmLm9yZzwvYT48YnI+DQo8 YSBocmVmPSJodHRwczovL25hbTA2LnNhZmVsaW5rcy5wcm90ZWN0aW9uLm91dGxvb2suY29tLz91 cmw9aHR0cHMlM0ElMkYlMkZ3d3cuaWV0Zi5vcmclMkZtYWlsbWFuJTJGbGlzdGluZm8lMkZ0bHMm YW1wO2RhdGE9MDIlN0MwMSU3Q0FuZHJlaS5Qb3BvdiU0MG1pY3Jvc29mdC5jb20lN0M4YjQ1NzQw ZjA4MWY0NDgyMGE0YzA4ZDcxNTFiMzBlMyU3QzcyZjk4OGJmODZmMTQxYWY5MWFiMmQ3Y2QwMTFk YjQ3JTdDMSU3QzAlN0M2MzcwMDEwNzkwMDM4NTkwMzUmYW1wO3NkYXRhPU9IRXdDNml0bXdicnFU MVRwQnlLb3l0T3VoS09JZ2hpeDdTek1rUGRYdlElM0QmYW1wO3Jlc2VydmVkPTAiIHRhcmdldD0i X2JsYW5rIj5odHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3RsczwvYT48bzpw PjwvbzpwPjwvcD4NCjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYm9k eT4NCjwvaHRtbD4NCg== --_000_DM5PR2101MB09177EFFFB5C2D64556724848CDC0DM5PR2101MB0917_-- From nobody Tue Jul 30 11:59:45 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BEC35120196 for ; Tue, 30 Jul 2019 11:59:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.15 X-Spam-Level: X-Spam-Status: No, score=-9.15 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.249, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_SPF_WL=-7.5] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=chromium.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yKtgFVU5bE_B for ; Tue, 30 Jul 2019 11:59:38 -0700 (PDT) Received: from mail-qk1-x729.google.com (mail-qk1-x729.google.com [IPv6:2607:f8b0:4864:20::729]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 72D99120110 for ; Tue, 30 Jul 2019 11:59:38 -0700 (PDT) Received: by mail-qk1-x729.google.com with SMTP id t8so47379556qkt.1 for ; Tue, 30 Jul 2019 11:59:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=OQWVlSt6nRAEkNMtQBpeuoeyjkVqHv7CYYc+dglmhLU=; b=A/m6kuopVr4QJvAmWvMs8MOe+M8Yqpu4+7frjKGiy/9TCIgHIEyshNd1orsakEb8KM vl6wRfNdpXp/6YaZZto3kvRmI+faulKzoXSC9EiOWLLSPXTB08M+1OKMoTLlnOk7VeQx 1ALEepiK0zLVCTqdpz/sf/npRXKjpzvfbnMOk= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=OQWVlSt6nRAEkNMtQBpeuoeyjkVqHv7CYYc+dglmhLU=; b=kgJHNYkYNHnWlrbP0wKAWHgeOwnNWEz2MLxdam9hWu5QIHm/1cZtuJkvsDVfJ9QJ8u LIOlNApP2EGSNxLSgGDBL4xgPXvSLDwGY7vetAh3mwKk/wN86f4CD9PwuipEPrG3Yx+a 60rLZPMca9fa2JWH/uhXohpGZqKFM5Yy5A71wDbU1I+K0Wbhr2wR+aMlT1DnIo2ZiW3E 4pI8nM4Jd96udUEVw7Gjw1Q4amohet0K9adPbClPCrohe4/O3RA8o5WQsKYbt3qn+FCu mHZ5HWFul7MggU0s5nAuf7t21x5OVKZbtarGVi9ItMmxjgLAhQ5yOBBH20C5lFESRKY+ 3ySg== X-Gm-Message-State: APjAAAVrxoxZGhVvA6fJW8C7NZYMxn2xkPOAEhmNwvML1L3vogn5A6XR f5L0JY7yGVef7YP+Va6yZxhMZ7+H88kfhy9zz/rl X-Google-Smtp-Source: APXvYqwfTW53mvFlQEtIccdj0KuhkA6uobJ1u1HNUTaXU52a2fxkNu8BArWn5QU93pN8e2RZ0GhHH9NJR2YvPvUrf44= X-Received: by 2002:a37:a14e:: with SMTP id k75mr79027428qke.65.1564513177209; Tue, 30 Jul 2019 11:59:37 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: David Benjamin Date: Tue, 30 Jul 2019 14:59:21 -0400 Message-ID: To: Andrei Popov Cc: Watson Ladd , TLS List Content-Type: multipart/alternative; boundary="0000000000002cf405058eea9c46" Archived-At: Subject: Re: [TLS] Options for negotiating hybrid key exchanges for postquantum X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 30 Jul 2019 18:59:42 -0000 --0000000000002cf405058eea9c46 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable The nuisance with just a flag is the client can't express [what I think are] reasonable preferences. It should be able to say things like: * Don't do X25519 + P-256. This is just silly. * Don't do PQ1 on its own. I really want the PQ scheme paired with something more established. * Don't do PQ1 + PQ2. I said something more established, please. * PQ1 + X25519 is cool. I like that combo. * Don't do PQ1 + X25519 + P-256. Why are you doing three of these? * Don't do PQ1 + PQ2 + PQ3 + PQ4 + X25519 + P-256 + P-384 + FFDHE2048 + FFDHE3072, oww my head. We can make things implicit by categorizing named groups and building all this into the protocol itself, but I think that's an unnecessary moving part. On Tue, Jul 30, 2019 at 2:48 PM Andrei Popov wrote: > Given these options, I also prefer option 2, for some of the same reasons= . > > > > For my understanding though, why not have the client advertise support fo= r > hybrid-key-exchange (e.g. via a =E2=80=9Cflag=E2=80=9D extension) and the= n > KeyShareServerHello can contain two KeyShareEntries (essentially, using t= he > same format as KeyShareClientHello? This would solve the Cartesian produc= t > issue. > > > > Cheers, > > > > Andrei > > > > *From:* TLS *On Behalf Of * David Benjamin > *Sent:* Tuesday, July 30, 2019 11:24 AM > *To:* Watson Ladd > *Cc:* TLS List > *Subject:* Re: [TLS] Options for negotiating hybrid key exchanges for > postquantum > > > > I think this underestimates the complexity cost of option 1 to the > protocol and implementations. Option 1 means group negotiation includes > entire codepoints whose meaning cannot be determined without a parallel > extension. This compounds across everything which interacts with named > groups, impacting everything from APIs to config file formats to even UI > surfaces. Other uses of NamedGroups are impacted too. For instance, optio= n > 2 fits into draft-ietf-tls-esni as-is. Option 1 requires > injecting hybrid_extension into ESNI somehow. Analysis must further check > every use, say, incorporates this parallel lookup table into > transcript-like measures. > > > > The lesson from TLS 1.2 code points is not combined codepoints vs. split > ones. Rather, the lesson is to avoid interdependent decisions: > > > > * Signature algorithms in TLS 1.2 were a mess because the ECDSA codepoint= s > required cross-referencing against the supported curves list. The verifie= r > could not express some preferences (signing SHA-512 with P-256 is silly, > and mixing hash+curve pairs in ECDSA is slightly off in general). As > analogy to option 1's ESNI problem, we even forgot to allow the server to > express curve preferences. TLS 1.3 combined signature algorithm > considerations into a single codepoint to address all this. > > > > * Cipher suites in TLS 1.2 were a mess because they were half-combined an= d > half-split. TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 said to use some ECDH= E > key exchange, but you need to check if you have a NamedGroup in common > first. It said to use ECDSA, but you need to check signature algorithms > (which themselves cross-reference curves) first. Early drafts of TLS 1.3 > had it even worse, where a TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 full > handshake morphed into TLS_ECDHE_PSK_WITH_AES_128_GCM_SHA256 on resumptio= n. > Thus, TLS 1.3 cipher suites negotiate solely AEAD + PRF hash. > > > > In fairness to TLS 1.2, some of this was a consequence of TLS 1.2's > evolution over time as incremental extensions over SSL 3.0. And sometimes > we do need to pay costs like these. But hybrid key exchanges fit into the > NamedGroup "API" just fine, so option 2 is the clear answer. Code points > are cheap. Protocol complexity is much more expensive. > > > > It's true that standards are often underspecified. This means the IETF > should finish the job, not pass all variations through. RSA-PSS is a clea= r > example of what to avoid. It takes more bytes to merely utter "RSA-PSS wi= th > SHA-256 and usual parameters" in X.509 than to encode an entire ECDSA > signature! We should not define more than a handful of options, regardles= s > of the encoding.. > > > > On Tue, Jul 30, 2019 at 12:18 PM Watson Ladd > wrote: > > > > On Tue, Jul 30, 2019, 8:21 AM Scott Fluhrer (sfluhrer) > wrote: > > During the physical meeting in Montreal, we had a discussion about > postquantum security, and in particular, on how one might want to negotia= te > several different =E2=80=98groups=E2=80=99 simultaneously (because there = might not be one > group that is entirely trusted, and I put =E2=80=98groups=E2=80=99 in sca= requotes because > postquantum key exchanges are typically not formed from a Diffie-Hellman > group). > > > > At the meeting, there were two options presented: > > > > Option 1: as the supported group, we insert a =E2=80=98hybrid marker=E2= =80=99 (and include > an extension that map lists which combination the hybrid marker stands fo= r) > > For example, the client might list in his supported group= s > hybrid_marker_0 and hybrid_marker_1, and there would be a separate > extension that lists hybrid_marker_0 =3D X25519 + SIKEp434 and > hybrid_marker_1 =3D X25519 + NTRUPR653. The server would then look up th= e > meanings of hybrid_marker_0 and 1 in the extension, and then compare that > against his security policy. > > In this option, we would ask IANA to allocate code points for the various > individual postquantum key exchanges (in this example, SIKEp434 and > NTRUPR653), as well a range of code points for the various hybrid_markers= . > > > > Option 2: we have code points for all the various combinations that we ma= y > want to support; hence IANA might allocate a code point X25519_SIKEp434 a= nd > another code point for X25519_NTRUPR653. With this option, the client > would list X25519_SIKEp434 and X25519_NTRUPR653 in their supported groups= . > > In this option, we would ask IANA to allocate code points > for all the various combinations that we want allow to be negotiated. > > > > I would like to make an argument in favor of option 1: > > > > - It is likely that not everyone will be satisified with =E2=80=9CX255= 19 plus > one of a handful of specific postquantum algorithms=E2=80=9D; some may= prefer > another elliptic curve (for example, x448), or perhaps even a MODP gro= up; I > have talked to people who do not trust ECC); in addition, other people > might not trust a single postquantum algorithm, and may want to rely o= n > both (for example) SIKE and NewHope (which are based on very different= hard > problems). With option 2, we could try to anticipate all the common > combintations (such as P384_SIKEp434_NEWHOPE512CCA), however that coul= d > very well end up as a lot of combinations. > - There are likely to be several NIST-approved postquantum key > exchanges, and each of those key exchanges are likely to have a number= of > supported parameter sets (if we take the specific postquantum key exch= ange > as analogous to th ECDH protocool, the =E2=80=9Cparameter set=E2=80=9D= could be thought of > an analogous to the specific elliptuc curve, and it modifies the key s= hare > size, the performance and sometimes the security properties). In fact= , one > of the NIST submissoins currently has 30 parameter sets defined. Henc= e, > even if NIST doesn=E2=80=99t approve all the parameter sets (or some o= f them do not > make sense for TLS in any scenario), we might end up with 20 or more > different key exchange/parameter set combinations that do make sense f= or > some scenario that uses tLS (be it in a tranditional PC client/server,= a > wireless client, two cloud devices communicating or an IOT device). > - In addition, we are likely to support additional primitives in the > future; possibly National curves (e.g. Brainpool), or additional > Postquantum algorithms (or additional parameter sets to existing ones)= . Of > course, once we add that code point, we=E2=80=99ll need to add the add= itional code > points for all the combinations that it=E2=80=99ll make sense in (very= much like we > had to add a number of ciphersuites whenever we added a new encryption > algorithm into TLS 1.2). > > > > > > Are people actually going to use hybrid encryption post NIST? The actual > deployments today for experiment have all fit option 2 and hybrids are > unlikely in the future. > > > > My objection to 1 is it gets very messy. Do we use only the hybrids we > both support? What if I throw a bunch of expensive things together? No > reason we need a hybrid scheme! > > > > It seemds reasonable to me that the combination of these two factors are > likely to cause us (should we select option 2) to define a very large > number of code points to cover all the various options that people need. > > > > Now, this is based on speculation (both of the NIST process, and > additional primitives that will be added to the protocol), and one > objection I=E2=80=99ve heard is =E2=80=9Cwe don=E2=80=99t know what=E2=80= =99s going to happen, and so why > would we make decisions based on this speculation?=E2=80=9D I agree that= we have > lack of knowledge; however it seems to me that a lack of knowledge is an > argument in favor of selecting the more flexible option (which, in my > opinion, is option 1, as it allows the negotiation of combinations of key > exchanges that the WG has not anticipated). > > > > My plea: lets not repeat the TLS 1.2 ciphersuite mess; lets add an > extension that keeps the number of code points we need to a reasonable > bound. > > > > The costs of option 1? > > - It does increase the complexity on the server a small amount (I=E2= =80=99m > not a TLS implementor, however it would seem to me to be only a fairly > small amount) > - It may increase the size of the client hello a small amount (on the > other hand, because it allows us to avoid sending duplicate key shares= , it > can also reduce the size of the client hello as well, depending on wha= t=E2=80=99s > actually negotiated) > > IMHO, the small increase in complexity is worth the lack of complexity in > the code point table, and the additional flexibility it gives. > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > > > --0000000000002cf405058eea9c46 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
The nuisance with just a flag is the client can't expr= ess [what I think are] reasonable preferences. It should be able to say thi= ngs like:

* Don't do X25519=C2=A0+ P-256. This is ju= st silly.
* Don't do PQ1 on its own. I really want the PQ sch= eme paired with something more established.
* Don't do PQ1=C2= =A0+ PQ2. I said something more established, please.
* PQ1=C2=A0+= X25519 is cool. I like that combo.
* Don't do PQ1=C2=A0+= X25519=C2=A0+ P-256. Why are you doing three of these?
* Don'= ;t do PQ1=C2=A0+ PQ2=C2=A0+ PQ3=C2=A0+ PQ4=C2=A0+ X25519=C2=A0+ P-256=C2=A0= + P-384=C2=A0+ FFDHE2048=C2=A0+ FFDHE3072, oww my head.

We can make things implicit by categorizing named groups and building= all this into the protocol itself, but I think that's an unnecessary m= oving part.

On Tue, Jul 30, 2019 at 2:48 PM Andrei Popov <Andrei.Popov@micro= soft.com> wrote:

Given these options, I also prefer option 2, for som= e of the same reasons.

=C2=A0

For my understanding though, why not have the client= advertise support for hybrid-key-exchange (e.g. via a =E2=80=9Cflag=E2=80= =9D extension) and then KeyShareServerHello can contain two KeyShareEntries= (essentially, using the same format as KeyShareClientHello? This would solve the Cartesian product issue.

=C2=A0

Cheers,

=C2=A0

Andrei

=C2=A0

From: TLS <tls-bounces@ietf.org> On Behalf Of David Benjamin
Sent: Tuesday, July 30, 2019 11:24 AM
To: Watson Ladd <watsonbladd@gmail.com>
Cc: TLS List <t= ls@ietf.org>
Subject: Re: [TLS] Options for negotiating hybrid key exchanges for = postquantum

=C2=A0

I think this underestimates the complexity cost of o= ption 1 to the protocol and implementations. Option 1 means group negotiati= on includes entire codepoints whose meaning cannot be determined without a = parallel extension. This compounds across everything which interacts with named groups, impacting everything = from APIs to config file formats to even UI surfaces. Other uses of NamedGr= oups are impacted too. For instance, option 2 fits into draft-ietf-tls-esni= as-is. Option 1 requires injecting=C2=A0hybrid_extension into ESNI somehow. Analysis must further check every use, say, incorporate= s this parallel lookup table into transcript-like measures.

=C2=A0

The lesson from TLS 1.2 code points is not combined = codepoints vs. split ones. Rather, the lesson is to avoid interdependent de= cisions:

=C2=A0

* Signature algorithms in TLS 1.2 were a mess becaus= e the ECDSA codepoints required cross-referencing against the supported cur= ves list. The verifier could not express some preferences (signing SHA-512 = with P-256 is silly, and mixing hash+curve pairs in ECDSA is slightly off in general). As analogy to option 1's E= SNI problem, we even forgot to allow the server to express curve preference= s. TLS 1.3 combined signature algorithm considerations into a single codepo= int to address all this.

=C2=A0

* Cipher suites in TLS 1.2 were a mess because they = were half-combined and half-split. TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 = said to use some ECDHE key exchange, but you need to check if you have a Na= medGroup in common first. It said to use ECDSA, but you need to check signature algorithms (which themselves= cross-reference curves) first. Early drafts of TLS 1.3 had it even worse, = where a=C2=A0TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 full handshake morphed= into=C2=A0TLS_ECDHE_PSK_WITH_AES_128_GCM_SHA256 on resumption. Thus, TLS 1.3 cipher suites negotiate solely AEAD=C2=A0+ PR= F hash.

=C2=A0

In fairness to TLS 1.2, some of this was a consequen= ce of TLS 1.2's evolution over time as incremental extensions over SSL = 3.0. And sometimes we do need to pay costs like these. But hybrid key excha= nges fit into the NamedGroup "API" just fine, so option 2 is the clear answer. Code points are cheap. Protocol com= plexity is much more expensive.

=C2=A0

It's true that standards are often underspecifie= d. This means the IETF should finish the job, not pass all variations throu= gh. RSA-PSS is a clear example of what to avoid. It takes more bytes to mer= ely utter "RSA-PSS with SHA-256 and usual parameters" in X.509 than to encode an entire ECDSA signature! We sho= uld not define more than a handful of options, regardless of the encoding..=

=C2=A0

On Tue, Jul 30, 2019 at 12:18 PM Watson Ladd <watsonbladd@gmail.c= om> wrote:

=C2=A0

On Tue, Jul 30, 2019, 8:21 AM Scott Fluhrer (sfluhre= r) <sfluhrer@cis= co.com> wrote:

During the physical meeting in Montreal, we had a di= scussion about postquantum security, and in particular, on how one might wa= nt to negotiate several different =E2=80=98groups=E2=80=99 simultaneously (because there might not be one group that is entirely trusted, and I put = =E2=80=98groups=E2=80=99 in scarequotes because postquantum key exchanges a= re typically not formed from a Diffie-Hellman group).

=C2=A0

At the meeting, there were two = options presented:

=C2=A0

Option 1: as the supported grou= p, we insert a =E2=80=98hybrid marker=E2=80=99 (and include an extension th= at map lists which combination the hybrid marker stands for)<= u>

=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 For example, t= he client might list in his supported groups hybrid_marker_0 and hybrid_mar= ker_1, and there would be a separate extension that lists hybrid_marker_0 =3D X25519 + SIKEp434 and hybrid_marker_1 =3D X25519 + NTR= UPR653.=C2=A0 The server would then look up the meanings of hybrid_marker_0= and 1 in the extension, and then compare that against his security policy.=

In this option, we would ask IANA to allocate code poi= nts for the various individual postquantum key exchanges (in this example, = SIKEp434 and NTRUPR653), as well a range of code points for the various hyb= rid_markers.

=C2=A0

Option 2: we have code points f= or all the various combinations that we may want to support; hence IANA mig= ht allocate a code point X25519_SIKEp434 and another code point for X25519_NTRUPR653.=C2=A0 With this option, the client would = list X25519_SIKEp434 and X25519_NTRUPR653 in their supported groups.=

=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 In this option= , we would ask IANA to allocate code points for all the various combination= s that we want allow to be negotiated.

=C2=A0

I would like to make an argumen= t in favor of option 1:

=C2=A0

  • It is likely that not everyone will be satisified with= =E2=80=9CX25519 plus one of a handful of specific postquantum algorithms= =E2=80=9D; some may prefer another elliptic curve (for example, x448), or p= erhaps even a MODP group; I have talked to people who do not trust ECC); in addition, other people might not trust a single post= quantum algorithm, and may want to rely on both (for example) SIKE and NewH= ope (which are based on very different hard problems).=C2=A0 With option 2,= we could try to anticipate all the common combintations (such as P384_SIKEp434_NEWHOPE512CCA), however that could ve= ry well end up as a lot of combinations.
  • There are likely to be several NIST-approved postquant= um key exchanges, and each of those key exchanges are likely to have a numb= er of supported parameter sets (if we take the specific postquantum key exc= hange as analogous to th ECDH protocool, the =E2=80=9Cparameter set=E2=80=9D could be thought of an analogous to th= e specific elliptuc curve, and it modifies the key share size, the performa= nce and sometimes the security properties).=C2=A0 In fact, one of the NIST = submissoins currently has 30 parameter sets defined.=C2=A0 Hence, even if NIST doesn=E2=80=99t approve all the parameter sets (or som= e of them do not make sense for TLS in any scenario), we might end up with = 20 or more different key exchange/parameter set combinations that do make s= ense for some scenario that uses tLS (be it in a tranditional PC client/server, a wireless client, two cloud device= s communicating or an IOT device).
  • In addition, we are likely to support additional primi= tives in the future; possibly National curves (e.g. Brainpool), or addition= al Postquantum algorithms (or additional parameter sets to existing ones).= =C2=A0 Of course, once we add that code point, we=E2=80=99ll need to add the additional code points for all the co= mbinations that it=E2=80=99ll make sense in (very much like we had to add a= number of ciphersuites whenever we added a new encryption algorithm into T= LS 1.2).

=C2=A0

=C2=A0

Are people actually going to use hybrid encryption p= ost NIST? The actual deployments today=C2=A0 for experiment have all fit op= tion 2 and hybrids are unlikely in the future.=C2=A0

=C2=A0

My objection to 1 is it gets very messy. Do we use o= nly the hybrids we both support? What if I throw a bunch of expensive thing= s together? No reason we need a hybrid scheme!=C2=A0

=C2=A0

It seemds reasonable to me that= the combination of these two factors are likely to cause us (should we sel= ect option 2) to define a very large number of code points to cover all the various options that people need.=

=C2=A0

Now, this is based on speculati= on (both of the NIST process, and additional primitives that will be added = to the protocol), and one objection I=E2=80=99ve heard is =E2=80=9Cwe don=E2=80=99t know what=E2=80=99s going to happen, and so why would we mak= e decisions based on this speculation?=E2=80=9D=C2=A0 I agree that we have = lack of knowledge; however it seems to me that a lack of knowledge is an ar= gument in favor of selecting the more flexible option (which, in my opinion, is option 1, as it allows the negotiation of combinations o= f key exchanges that the WG has not anticipated).

=C2=A0

My plea: lets not repeat the TLS 1.2 ciphersuite mes= s; lets add an extension that keeps the number of code points we need to a = reasonable bound.

=C2=A0

The costs of option 1?

  • It does increase the complexity on the server a small amount (I=E2=80=99m n= ot a TLS implementor, however it would seem to me to be only a fairly small= amount)
  • It may increase the size of the client hello a small amount (on the other h= and, because it allows us to avoid sending duplicate key shares, it can als= o reduce the size of the client hello as well, depending on what=E2=80=99s = actually negotiated)

IMHO, the small increase in complexity is worth the = lack of complexity in the code point table, and the additional flexibility = it gives.

_______________________________________________
TLS mailing list
TLS@ietf.org
https://= www.ietf.org/mailman/listinfo/tls

_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.= ietf.org/mailman/listinfo/tls

--0000000000002cf405058eea9c46-- From nobody Tue Jul 30 12:09:21 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 859931201AF for ; Tue, 30 Jul 2019 12:09:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.25 X-Spam-Level: X-Spam-Status: No, score=-9.25 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.249, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_SPF_WL=-7.5] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=chromium.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6YZZTvZ8wZPL for ; Tue, 30 Jul 2019 12:09:19 -0700 (PDT) Received: from mail-qk1-x733.google.com (mail-qk1-x733.google.com [IPv6:2607:f8b0:4864:20::733]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DC6DD12010F for ; Tue, 30 Jul 2019 12:09:18 -0700 (PDT) Received: by mail-qk1-x733.google.com with SMTP id r4so47321311qkm.13 for ; Tue, 30 Jul 2019 12:09:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to; bh=WmjwWWdP7mD129WUhhz1UHhqAacQClWsZ4JwXaJy8bw=; b=nFK4LH5fyy/5Stm799bcCGq4VVSGTeB/aAiyDi8UA3ZUzgdVVYiUhtAPQF27e4ySNs uI5vVUNGgZr31GP9naeSbaQ/DAZ4pNXLb15+bpOxf7+GU1bkO/7shqUp8j9ZeSkMHAX4 KZgGhhkFIN9tJrDlC1ZRBvBotbk1wmMnp3JOQ= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to; bh=WmjwWWdP7mD129WUhhz1UHhqAacQClWsZ4JwXaJy8bw=; b=Fn98FlthTC0998Sb/PEuVLtGSADWpQv9jmqMQs/6an67HeUmi2Shmp1CPzhTbEYbqY 8kdTL418g+duVyVMjeyr9O43M3QN2LVVysIa3UL+Yo0dX31ToeEx2zC6l+NN/CQPE8uJ Vgm5YNkvuOQ5WBV+3mfuWcvDwS1V2YQEu2KVfdeyDImJt9sOFDHIHtqWP7Z6MZYmxzwt gD8DHLs5BoqUhqNO8kz2GfxOVUvm6AdGbtysmcVF7MHLPwhrBGL7TQ82N7upCSaAL/Kb PQ6vYHUSHhogbHwC6xOt0v4fxgjC0OCXyVZlWfvSGeDu80TlQUPSqG3pF4Vvfb7nZZxC YhhA== X-Gm-Message-State: APjAAAWiQWJp5GqWMdLdnMMEbXrYPT0/vU7atx19oDSsiu6KH96CdSyd pLsMwkQm3tjLuv5Q+eJsCUeqEzhf1ccPEj+8Tk3psJYzyA== X-Google-Smtp-Source: APXvYqxwTXzQymt0okbm6//KhTPe8liDn9dWUYdiD4kF00FgPI+9ZP5NFfty6RHLxBb4s7f5i0Rsbe51YuWUVUqpkIM= X-Received: by 2002:a37:464a:: with SMTP id t71mr78419476qka.436.1564513757660; Tue, 30 Jul 2019 12:09:17 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: David Benjamin Date: Tue, 30 Jul 2019 15:09:01 -0400 Message-ID: To: "" Content-Type: multipart/alternative; boundary="000000000000c615f8058eeabe32" Archived-At: Subject: Re: [TLS] Drafts for batch signing and PKCS#1 v1.5 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 30 Jul 2019 19:09:21 -0000 --000000000000c615f8058eeabe32 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Oops. draft-davidben-tls-batch-signing-00 cites draft-davidben-http2-tls13-00. That should be draft-davidben-tls13-pkcs1-00. (The XML file took a really long time to be created, so I manually tried to recreate it based on another file and forgot to update one of the fields.) I'll fix this in -01. On Mon, Jul 29, 2019 at 8:15 PM David Benjamin wrote: > Hi all, > > I=E2=80=99ve just uploaded a pair of drafts relating to signatures in TLS= 1.3. > https://tools.ietf.org/html/draft-davidben-tls13-pkcs1-00 > https://tools.ietf.org/html/draft-davidben-tls-batch-signing-00 > > The first introduces optional legacy codepoints for PKCS#1 v1.5 signature= s > with client certificates. This is unfortunate, but I think we should do i= t. > On the Chrome side, we=E2=80=99ve encountered some headaches with the TLS= 1.3 PSS > requirement which are unique to client certificates. The document describ= es > the motivations in detail. > > The second describes a batch signing mechanism for TLS using Merkle trees= . > It allows TLS clients and servers to better handle signing load. I think = it > could be beneficial for a number of DoS and remote key scenarios. > > Thoughts? > > David > --000000000000c615f8058eeabe32 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Oops. draft-davidben-tls-batch-signing-00=C2=A0cites draft= -davidben-http2-tls13-00. That should be draft-davidben-tls13-pkcs1-00. (Th= e XML file took a really long time to=C2=A0be created, so I manually tried = to recreate it based on another file and forgot to update one of the fields= .) I'll fix this in -01.

On Mon, Jul 29, 2019 at 8:15 PM David Benja= min <davidben@chromium.org&= gt; wrote:
Hi all,

I=E2=80=99ve just uploaded a pair of drafts rela= ting to signatures in TLS 1.3.
https://tools.ietf.org/html/= draft-davidben-tls13-pkcs1-00
https://tools.ietf.= org/html/draft-davidben-tls-batch-signing-00

The first introduce= s optional legacy codepoints for PKCS#1 v1.5 signatures with client certifi= cates. This is unfortunate, but I think we should do it. On the Chrome side= , we=E2=80=99ve encountered some headaches with the TLS 1.3 PSS requirement= which are unique to client certificates. The document describes the motiva= tions in detail.

The second describes a batch signing mechanism for = TLS using Merkle trees. It allows TLS clients and servers to better handle = signing load. I think it could be beneficial for a number of DoS and remote= key scenarios.

Thoughts?

David
--000000000000c615f8058eeabe32-- From nobody Tue Jul 30 12:09:58 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BA0DB12027C for ; Tue, 30 Jul 2019 12:09:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1oRU9oaYWqXy for ; Tue, 30 Jul 2019 12:09:41 -0700 (PDT) Received: from NAM05-BY2-obe.outbound.protection.outlook.com (mail-by2nam05on071f.outbound.protection.outlook.com [IPv6:2a01:111:f400:fe52::71f]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A414B1201D6 for ; Tue, 30 Jul 2019 12:09:41 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=Dpxd12SAvpjiX5dKfMLyNISrsDlRqKVj4GO8NHKIa1F6TnRkGA2AWeC1NCZljFcsTDmfe+i6KtFb4V63gBp5OLZrLMYMS+ciTQX2RT6LJYBk6LLBjSm5eXzGZABGEQZde+gnfn0L9HMVELHBjfQmB1lFQbRDFYc5QLToWteCy7F3KlRCA6mEMn5yQX7QBNie7hffz/6EMkonIR7wc5D8lAxWZJHPnZkCOeQxp6+c5/a8EhWyHamSaQa3kcHtbbOwk0ycvHo1d7Zdw9726sUQctQ9LjX7PLB0910agHmEmbkgU9RZ/Kinn7FxbKYZ14enlI4Z25/wfZOVW5cU69eK9Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=QlXx/0CvvCDppLDKAAFjFIc15ZW9+CnDrAMuwAF3urw=; b=mKoKIYS2WBSfPSoksAN8o+spTcP7KAvfi5QnUqk/PsAHlpAYNW/JH2LkZEUuRioMEvc4RKpBpbU+F+lTeR3A9jLCtQV+casZsgLRCQMHYizDPngJfZqVQS94yyD05u6z8CwThuPUQksBgh650sM5bJbmTcsrp63nPveHuJcOspDn+CkIuNd/uxOLemJUk5RKAiofsboQFfm9H7EaXymqxMs7HFBBgpXF0DxIHq3r/fkiWTE/gJMLvQDimSfy3Pt+fTbG8z1OnNesIKzl3YyB/7gLLF4v+T8H9lKfHlYc83I1p2GdR9Ji/oT/auLCgpwQCyGDHuzUyfFaFT46Gz8LwQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=microsoft.com; dmarc=pass action=none header.from=microsoft.com; dkim=pass header.d=microsoft.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=QlXx/0CvvCDppLDKAAFjFIc15ZW9+CnDrAMuwAF3urw=; b=DlaA5nR+2a5VhhuS2UtQZjnuGjYfGx9MxxeL93aq1td9eeM87irVlzxhddJT7srR6uEb0rhu8594hRiUPokYfLDdDwtuwmT138i3E1wHz5GnTyt3pAaJGxD3fgR5ZHEWXyWb0dNugA7nugQA+TtIqK/0Fej8lrMbnRVV1vNlp4U= Received: from DM5PR2101MB0917.namprd21.prod.outlook.com (52.132.132.162) by DM5PR2101MB1046.namprd21.prod.outlook.com (52.132.128.15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2157.2; Tue, 30 Jul 2019 19:09:39 +0000 Received: from DM5PR2101MB0917.namprd21.prod.outlook.com ([fe80::6cee:c549:a46c:9e5c]) by DM5PR2101MB0917.namprd21.prod.outlook.com ([fe80::6cee:c549:a46c:9e5c%7]) with mapi id 15.20.2157.001; Tue, 30 Jul 2019 19:09:39 +0000 From: Andrei Popov To: David Benjamin CC: Watson Ladd , TLS List Thread-Topic: [TLS] Options for negotiating hybrid key exchanges for postquantum Thread-Index: AdVG1haOE+yO4N1wQQSyYtQ5VKKSwAAHEKmAAARkcYAAAMUecAAAeXmAAAANbTA= Date: Tue, 30 Jul 2019 19:09:39 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Andrei.Popov@microsoft.com; x-originating-ip: [2001:4898:80e8:a:28b3:a023:971b:e42c] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: d8a98b3f-cc2e-4c8b-06c8-08d7152178a9 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(4618075)(2017052603328)(7193020); SRVR:DM5PR2101MB1046; x-ms-traffictypediagnostic: DM5PR2101MB1046: x-ms-exchange-purlcount: 3 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:7691; x-forefront-prvs: 0114FF88F6 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(4636009)(39860400002)(376002)(396003)(136003)(366004)(346002)(15404003)(51444003)(199004)(189003)(790700001)(99286004)(66476007)(10090500001)(14454004)(9686003)(8990500004)(66446008)(66946007)(236005)(76116006)(30864003)(55016002)(52536014)(5070765005)(64756008)(25786009)(86362001)(5660300002)(10290500003)(606006)(966005)(478600001)(6246003)(4326008)(68736007)(74316002)(46003)(14444005)(22452003)(7696005)(53546011)(2906002)(8676002)(71200400001)(71190400001)(33656002)(186003)(6506007)(102836004)(81156014)(81166006)(256004)(229853002)(8936002)(76176011)(486006)(54906003)(11346002)(446003)(7736002)(6436002)(54896002)(6306002)(6116002)(476003)(6916009)(66556008)(53936002)(316002); DIR:OUT; SFP:1102; SCL:1; SRVR:DM5PR2101MB1046; H:DM5PR2101MB0917.namprd21.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: iX7Y19IA+XiRB/Inya59W160xteWtKMjj/oYsuVdos4vrCVxdAFTfRRG0s0zrKM470cSwBgVXm4O4mKncPAjxnb1FKYFuVyn2I+/1HqDUY8oExQgHWKdQh0BxNrsz/9KtcrN/AxRkICs6GFKrNI6V/AFoDkmkqQW6HD7M7z6r7bhymlILOx+3/q2sVk2STroA7ESFqbXKlmRedQw3WN/CKklnIoCDosGRQwg8bC30GpAt/25JNgKGumeZ7LphHTaopRgkogcjLj1iAOCKeFPkwZ4KlvQvl5+XE4rGiW66KoGamyvVg20bnZ8D02srN7ZyB7D0lb6gaMV3a7ZyF2E7RyQ1/8I9KxC7R5SHbtZ/1A1EibCVsTNpVl7BdxWsktYYGKSi9qgLTIQKwW2Jo0AG/G2+hVQc7qohIpp33g4oMU= x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_DM5PR2101MB0917D921E7C79CAA4D2AAA5A8CDC0DM5PR2101MB0917_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: d8a98b3f-cc2e-4c8b-06c8-08d7152178a9 X-MS-Exchange-CrossTenant-originalarrivaltime: 30 Jul 2019 19:09:39.6902 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: TO3tlevdRD0PLzlV/9UWBjOBBK6kuq0ioazJEkVaQx5ksRGAtxVOQv8F6iwAIl3t4wffhdchuKtfxUHP1wexhg== X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM5PR2101MB1046 Archived-At: Subject: Re: [TLS] Options for negotiating hybrid key exchanges for postquantum X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 30 Jul 2019 19:09:55 -0000 --_000_DM5PR2101MB0917D921E7C79CAA4D2AAA5A8CDC0DM5PR2101MB0917_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 WWVzLCBJIHNlZSB5b3VyIHBvaW50IFdSVCBjbGllbnRzIGV4cHJlc3NpbmcgcHJlZmVyZW5jZXMu DQoNClJlZ2FyZGxlc3Mgb2YgdGhlIHByb3RvY29sIG9wdGlvbiB3ZSBjaG9vc2UsIEkgYW50aWNp cGF0ZSBzb21lIGRpZmZpY3VsdHkgaW4gYWdyZWVpbmcgb24gd2hhdOKAmXMg4oCccmVhc29uYWJs ZeKAnS4NCkUuZy4gSeKAmXZlIGhhZCBzZXZlcmFsIGN1c3RvbWVycyBhc2sgYWJvdXQgdGhlIHBv c3NpYmlsaXR5IG9mIGNvbWJpbmluZyBhIGNvdXBsZSBvZiB0cmFkaXRpb25hbCBhbGdvcml0aG1z IChlLmcuIG5hdGlvbmFsIHZhbml0eSArIE5JU1QpLg0KU29tZSBvZiB0aGVtIGVuZGVkIHVwIGRv aW5nIFRMUy1pbi1UTFMsIHdoaWNoIG9mIGNvdXJzZSBvbmx5IHdvcmtzIGJldHdlZW4gdGhlaXIg cGFydGljdWxhciBjbGllbnRzIGFuZCBzZXJ2ZXJzLg0KDQpGcm9tOiBEYXZpZCBCZW5qYW1pbiA8 ZGF2aWRiZW5AY2hyb21pdW0ub3JnPg0KU2VudDogVHVlc2RheSwgSnVseSAzMCwgMjAxOSAxMTo1 OSBBTQ0KVG86IEFuZHJlaSBQb3BvdiA8QW5kcmVpLlBvcG92QG1pY3Jvc29mdC5jb20+DQpDYzog V2F0c29uIExhZGQgPHdhdHNvbmJsYWRkQGdtYWlsLmNvbT47IFRMUyBMaXN0IDx0bHNAaWV0Zi5v cmc+DQpTdWJqZWN0OiBSZTogW1RMU10gT3B0aW9ucyBmb3IgbmVnb3RpYXRpbmcgaHlicmlkIGtl eSBleGNoYW5nZXMgZm9yIHBvc3RxdWFudHVtDQoNClRoZSBudWlzYW5jZSB3aXRoIGp1c3QgYSBm bGFnIGlzIHRoZSBjbGllbnQgY2FuJ3QgZXhwcmVzcyBbd2hhdCBJIHRoaW5rIGFyZV0gcmVhc29u YWJsZSBwcmVmZXJlbmNlcy4gSXQgc2hvdWxkIGJlIGFibGUgdG8gc2F5IHRoaW5ncyBsaWtlOg0K DQoqIERvbid0IGRvIFgyNTUxOSArIFAtMjU2LiBUaGlzIGlzIGp1c3Qgc2lsbHkuDQoqIERvbid0 IGRvIFBRMSBvbiBpdHMgb3duLiBJIHJlYWxseSB3YW50IHRoZSBQUSBzY2hlbWUgcGFpcmVkIHdp dGggc29tZXRoaW5nIG1vcmUgZXN0YWJsaXNoZWQuDQoqIERvbid0IGRvIFBRMSArIFBRMi4gSSBz YWlkIHNvbWV0aGluZyBtb3JlIGVzdGFibGlzaGVkLCBwbGVhc2UuDQoqIFBRMSArIFgyNTUxOSBp cyBjb29sLiBJIGxpa2UgdGhhdCBjb21iby4NCiogRG9uJ3QgZG8gUFExICsgWDI1NTE5ICsgUC0y NTYuIFdoeSBhcmUgeW91IGRvaW5nIHRocmVlIG9mIHRoZXNlPw0KKiBEb24ndCBkbyBQUTEgKyBQ UTIgKyBQUTMgKyBQUTQgKyBYMjU1MTkgKyBQLTI1NiArIFAtMzg0ICsgRkZESEUyMDQ4ICsgRkZE SEUzMDcyLCBvd3cgbXkgaGVhZC4NCg0KV2UgY2FuIG1ha2UgdGhpbmdzIGltcGxpY2l0IGJ5IGNh dGVnb3JpemluZyBuYW1lZCBncm91cHMgYW5kIGJ1aWxkaW5nIGFsbCB0aGlzIGludG8gdGhlIHBy b3RvY29sIGl0c2VsZiwgYnV0IEkgdGhpbmsgdGhhdCdzIGFuIHVubmVjZXNzYXJ5IG1vdmluZyBw YXJ0Lg0KDQpPbiBUdWUsIEp1bCAzMCwgMjAxOSBhdCAyOjQ4IFBNIEFuZHJlaSBQb3BvdiA8QW5k cmVpLlBvcG92QG1pY3Jvc29mdC5jb208bWFpbHRvOkFuZHJlaS5Qb3BvdkBtaWNyb3NvZnQuY29t Pj4gd3JvdGU6DQpHaXZlbiB0aGVzZSBvcHRpb25zLCBJIGFsc28gcHJlZmVyIG9wdGlvbiAyLCBm b3Igc29tZSBvZiB0aGUgc2FtZSByZWFzb25zLg0KDQpGb3IgbXkgdW5kZXJzdGFuZGluZyB0aG91 Z2gsIHdoeSBub3QgaGF2ZSB0aGUgY2xpZW50IGFkdmVydGlzZSBzdXBwb3J0IGZvciBoeWJyaWQt a2V5LWV4Y2hhbmdlIChlLmcuIHZpYSBhIOKAnGZsYWfigJ0gZXh0ZW5zaW9uKSBhbmQgdGhlbiBL ZXlTaGFyZVNlcnZlckhlbGxvIGNhbiBjb250YWluIHR3byBLZXlTaGFyZUVudHJpZXMgKGVzc2Vu dGlhbGx5LCB1c2luZyB0aGUgc2FtZSBmb3JtYXQgYXMgS2V5U2hhcmVDbGllbnRIZWxsbz8gVGhp cyB3b3VsZCBzb2x2ZSB0aGUgQ2FydGVzaWFuIHByb2R1Y3QgaXNzdWUuDQoNCkNoZWVycywNCg0K QW5kcmVpDQoNCkZyb206IFRMUyA8dGxzLWJvdW5jZXNAaWV0Zi5vcmc8bWFpbHRvOnRscy1ib3Vu Y2VzQGlldGYub3JnPj4gT24gQmVoYWxmIE9mIERhdmlkIEJlbmphbWluDQpTZW50OiBUdWVzZGF5 LCBKdWx5IDMwLCAyMDE5IDExOjI0IEFNDQpUbzogV2F0c29uIExhZGQgPHdhdHNvbmJsYWRkQGdt YWlsLmNvbTxtYWlsdG86d2F0c29uYmxhZGRAZ21haWwuY29tPj4NCkNjOiBUTFMgTGlzdCA8dGxz QGlldGYub3JnPG1haWx0bzp0bHNAaWV0Zi5vcmc+Pg0KU3ViamVjdDogUmU6IFtUTFNdIE9wdGlv bnMgZm9yIG5lZ290aWF0aW5nIGh5YnJpZCBrZXkgZXhjaGFuZ2VzIGZvciBwb3N0cXVhbnR1bQ0K DQpJIHRoaW5rIHRoaXMgdW5kZXJlc3RpbWF0ZXMgdGhlIGNvbXBsZXhpdHkgY29zdCBvZiBvcHRp b24gMSB0byB0aGUgcHJvdG9jb2wgYW5kIGltcGxlbWVudGF0aW9ucy4gT3B0aW9uIDEgbWVhbnMg Z3JvdXAgbmVnb3RpYXRpb24gaW5jbHVkZXMgZW50aXJlIGNvZGVwb2ludHMgd2hvc2UgbWVhbmlu ZyBjYW5ub3QgYmUgZGV0ZXJtaW5lZCB3aXRob3V0IGEgcGFyYWxsZWwgZXh0ZW5zaW9uLiBUaGlz IGNvbXBvdW5kcyBhY3Jvc3MgZXZlcnl0aGluZyB3aGljaCBpbnRlcmFjdHMgd2l0aCBuYW1lZCBn cm91cHMsIGltcGFjdGluZyBldmVyeXRoaW5nIGZyb20gQVBJcyB0byBjb25maWcgZmlsZSBmb3Jt YXRzIHRvIGV2ZW4gVUkgc3VyZmFjZXMuIE90aGVyIHVzZXMgb2YgTmFtZWRHcm91cHMgYXJlIGlt cGFjdGVkIHRvby4gRm9yIGluc3RhbmNlLCBvcHRpb24gMiBmaXRzIGludG8gZHJhZnQtaWV0Zi10 bHMtZXNuaSBhcy1pcy4gT3B0aW9uIDEgcmVxdWlyZXMgaW5qZWN0aW5nIGh5YnJpZF9leHRlbnNp b24gaW50byBFU05JIHNvbWVob3cuIEFuYWx5c2lzIG11c3QgZnVydGhlciBjaGVjayBldmVyeSB1 c2UsIHNheSwgaW5jb3Jwb3JhdGVzIHRoaXMgcGFyYWxsZWwgbG9va3VwIHRhYmxlIGludG8gdHJh bnNjcmlwdC1saWtlIG1lYXN1cmVzLg0KDQpUaGUgbGVzc29uIGZyb20gVExTIDEuMiBjb2RlIHBv aW50cyBpcyBub3QgY29tYmluZWQgY29kZXBvaW50cyB2cy4gc3BsaXQgb25lcy4gUmF0aGVyLCB0 aGUgbGVzc29uIGlzIHRvIGF2b2lkIGludGVyZGVwZW5kZW50IGRlY2lzaW9uczoNCg0KKiBTaWdu YXR1cmUgYWxnb3JpdGhtcyBpbiBUTFMgMS4yIHdlcmUgYSBtZXNzIGJlY2F1c2UgdGhlIEVDRFNB IGNvZGVwb2ludHMgcmVxdWlyZWQgY3Jvc3MtcmVmZXJlbmNpbmcgYWdhaW5zdCB0aGUgc3VwcG9y dGVkIGN1cnZlcyBsaXN0LiBUaGUgdmVyaWZpZXIgY291bGQgbm90IGV4cHJlc3Mgc29tZSBwcmVm ZXJlbmNlcyAoc2lnbmluZyBTSEEtNTEyIHdpdGggUC0yNTYgaXMgc2lsbHksIGFuZCBtaXhpbmcg aGFzaCtjdXJ2ZSBwYWlycyBpbiBFQ0RTQSBpcyBzbGlnaHRseSBvZmYgaW4gZ2VuZXJhbCkuIEFz IGFuYWxvZ3kgdG8gb3B0aW9uIDEncyBFU05JIHByb2JsZW0sIHdlIGV2ZW4gZm9yZ290IHRvIGFs bG93IHRoZSBzZXJ2ZXIgdG8gZXhwcmVzcyBjdXJ2ZSBwcmVmZXJlbmNlcy4gVExTIDEuMyBjb21i aW5lZCBzaWduYXR1cmUgYWxnb3JpdGhtIGNvbnNpZGVyYXRpb25zIGludG8gYSBzaW5nbGUgY29k ZXBvaW50IHRvIGFkZHJlc3MgYWxsIHRoaXMuDQoNCiogQ2lwaGVyIHN1aXRlcyBpbiBUTFMgMS4y IHdlcmUgYSBtZXNzIGJlY2F1c2UgdGhleSB3ZXJlIGhhbGYtY29tYmluZWQgYW5kIGhhbGYtc3Bs aXQuIFRMU19FQ0RIRV9FQ0RTQV9XSVRIX0FFU18xMjhfR0NNX1NIQTI1NiBzYWlkIHRvIHVzZSBz b21lIEVDREhFIGtleSBleGNoYW5nZSwgYnV0IHlvdSBuZWVkIHRvIGNoZWNrIGlmIHlvdSBoYXZl IGEgTmFtZWRHcm91cCBpbiBjb21tb24gZmlyc3QuIEl0IHNhaWQgdG8gdXNlIEVDRFNBLCBidXQg eW91IG5lZWQgdG8gY2hlY2sgc2lnbmF0dXJlIGFsZ29yaXRobXMgKHdoaWNoIHRoZW1zZWx2ZXMg Y3Jvc3MtcmVmZXJlbmNlIGN1cnZlcykgZmlyc3QuIEVhcmx5IGRyYWZ0cyBvZiBUTFMgMS4zIGhh ZCBpdCBldmVuIHdvcnNlLCB3aGVyZSBhIFRMU19FQ0RIRV9FQ0RTQV9XSVRIX0FFU18xMjhfR0NN X1NIQTI1NiBmdWxsIGhhbmRzaGFrZSBtb3JwaGVkIGludG8gVExTX0VDREhFX1BTS19XSVRIX0FF U18xMjhfR0NNX1NIQTI1NiBvbiByZXN1bXB0aW9uLiBUaHVzLCBUTFMgMS4zIGNpcGhlciBzdWl0 ZXMgbmVnb3RpYXRlIHNvbGVseSBBRUFEICsgUFJGIGhhc2guDQoNCkluIGZhaXJuZXNzIHRvIFRM UyAxLjIsIHNvbWUgb2YgdGhpcyB3YXMgYSBjb25zZXF1ZW5jZSBvZiBUTFMgMS4yJ3MgZXZvbHV0 aW9uIG92ZXIgdGltZSBhcyBpbmNyZW1lbnRhbCBleHRlbnNpb25zIG92ZXIgU1NMIDMuMC4gQW5k IHNvbWV0aW1lcyB3ZSBkbyBuZWVkIHRvIHBheSBjb3N0cyBsaWtlIHRoZXNlLiBCdXQgaHlicmlk IGtleSBleGNoYW5nZXMgZml0IGludG8gdGhlIE5hbWVkR3JvdXAgIkFQSSIganVzdCBmaW5lLCBz byBvcHRpb24gMiBpcyB0aGUgY2xlYXIgYW5zd2VyLiBDb2RlIHBvaW50cyBhcmUgY2hlYXAuIFBy b3RvY29sIGNvbXBsZXhpdHkgaXMgbXVjaCBtb3JlIGV4cGVuc2l2ZS4NCg0KSXQncyB0cnVlIHRo YXQgc3RhbmRhcmRzIGFyZSBvZnRlbiB1bmRlcnNwZWNpZmllZC4gVGhpcyBtZWFucyB0aGUgSUVU RiBzaG91bGQgZmluaXNoIHRoZSBqb2IsIG5vdCBwYXNzIGFsbCB2YXJpYXRpb25zIHRocm91Z2gu IFJTQS1QU1MgaXMgYSBjbGVhciBleGFtcGxlIG9mIHdoYXQgdG8gYXZvaWQuIEl0IHRha2VzIG1v cmUgYnl0ZXMgdG8gbWVyZWx5IHV0dGVyICJSU0EtUFNTIHdpdGggU0hBLTI1NiBhbmQgdXN1YWwg cGFyYW1ldGVycyIgaW4gWC41MDkgdGhhbiB0byBlbmNvZGUgYW4gZW50aXJlIEVDRFNBIHNpZ25h dHVyZSEgV2Ugc2hvdWxkIG5vdCBkZWZpbmUgbW9yZSB0aGFuIGEgaGFuZGZ1bCBvZiBvcHRpb25z LCByZWdhcmRsZXNzIG9mIHRoZSBlbmNvZGluZy4uDQoNCk9uIFR1ZSwgSnVsIDMwLCAyMDE5IGF0 IDEyOjE4IFBNIFdhdHNvbiBMYWRkIDx3YXRzb25ibGFkZEBnbWFpbC5jb208bWFpbHRvOndhdHNv bmJsYWRkQGdtYWlsLmNvbT4+IHdyb3RlOg0KDQpPbiBUdWUsIEp1bCAzMCwgMjAxOSwgODoyMSBB TSBTY290dCBGbHVocmVyIChzZmx1aHJlcikgPHNmbHVocmVyQGNpc2NvLmNvbTxtYWlsdG86c2Zs dWhyZXJAY2lzY28uY29tPj4gd3JvdGU6DQpEdXJpbmcgdGhlIHBoeXNpY2FsIG1lZXRpbmcgaW4g TW9udHJlYWwsIHdlIGhhZCBhIGRpc2N1c3Npb24gYWJvdXQgcG9zdHF1YW50dW0gc2VjdXJpdHks IGFuZCBpbiBwYXJ0aWN1bGFyLCBvbiBob3cgb25lIG1pZ2h0IHdhbnQgdG8gbmVnb3RpYXRlIHNl dmVyYWwgZGlmZmVyZW50IOKAmGdyb3Vwc+KAmSBzaW11bHRhbmVvdXNseSAoYmVjYXVzZSB0aGVy ZSBtaWdodCBub3QgYmUgb25lIGdyb3VwIHRoYXQgaXMgZW50aXJlbHkgdHJ1c3RlZCwgYW5kIEkg cHV0IOKAmGdyb3Vwc+KAmSBpbiBzY2FyZXF1b3RlcyBiZWNhdXNlIHBvc3RxdWFudHVtIGtleSBl eGNoYW5nZXMgYXJlIHR5cGljYWxseSBub3QgZm9ybWVkIGZyb20gYSBEaWZmaWUtSGVsbG1hbiBn cm91cCkuDQoNCkF0IHRoZSBtZWV0aW5nLCB0aGVyZSB3ZXJlIHR3byBvcHRpb25zIHByZXNlbnRl ZDoNCg0KT3B0aW9uIDE6IGFzIHRoZSBzdXBwb3J0ZWQgZ3JvdXAsIHdlIGluc2VydCBhIOKAmGh5 YnJpZCBtYXJrZXLigJkgKGFuZCBpbmNsdWRlIGFuIGV4dGVuc2lvbiB0aGF0IG1hcCBsaXN0cyB3 aGljaCBjb21iaW5hdGlvbiB0aGUgaHlicmlkIG1hcmtlciBzdGFuZHMgZm9yKQ0KICAgICAgICAg ICAgICAgIEZvciBleGFtcGxlLCB0aGUgY2xpZW50IG1pZ2h0IGxpc3QgaW4gaGlzIHN1cHBvcnRl ZCBncm91cHMgaHlicmlkX21hcmtlcl8wIGFuZCBoeWJyaWRfbWFya2VyXzEsIGFuZCB0aGVyZSB3 b3VsZCBiZSBhIHNlcGFyYXRlIGV4dGVuc2lvbiB0aGF0IGxpc3RzIGh5YnJpZF9tYXJrZXJfMCA9 IFgyNTUxOSArIFNJS0VwNDM0IGFuZCBoeWJyaWRfbWFya2VyXzEgPSBYMjU1MTkgKyBOVFJVUFI2 NTMuICBUaGUgc2VydmVyIHdvdWxkIHRoZW4gbG9vayB1cCB0aGUgbWVhbmluZ3Mgb2YgaHlicmlk X21hcmtlcl8wIGFuZCAxIGluIHRoZSBleHRlbnNpb24sIGFuZCB0aGVuIGNvbXBhcmUgdGhhdCBh Z2FpbnN0IGhpcyBzZWN1cml0eSBwb2xpY3kuDQpJbiB0aGlzIG9wdGlvbiwgd2Ugd291bGQgYXNr IElBTkEgdG8gYWxsb2NhdGUgY29kZSBwb2ludHMgZm9yIHRoZSB2YXJpb3VzIGluZGl2aWR1YWwg cG9zdHF1YW50dW0ga2V5IGV4Y2hhbmdlcyAoaW4gdGhpcyBleGFtcGxlLCBTSUtFcDQzNCBhbmQg TlRSVVBSNjUzKSwgYXMgd2VsbCBhIHJhbmdlIG9mIGNvZGUgcG9pbnRzIGZvciB0aGUgdmFyaW91 cyBoeWJyaWRfbWFya2Vycy4NCg0KT3B0aW9uIDI6IHdlIGhhdmUgY29kZSBwb2ludHMgZm9yIGFs bCB0aGUgdmFyaW91cyBjb21iaW5hdGlvbnMgdGhhdCB3ZSBtYXkgd2FudCB0byBzdXBwb3J0OyBo ZW5jZSBJQU5BIG1pZ2h0IGFsbG9jYXRlIGEgY29kZSBwb2ludCBYMjU1MTlfU0lLRXA0MzQgYW5k IGFub3RoZXIgY29kZSBwb2ludCBmb3IgWDI1NTE5X05UUlVQUjY1My4gIFdpdGggdGhpcyBvcHRp b24sIHRoZSBjbGllbnQgd291bGQgbGlzdCBYMjU1MTlfU0lLRXA0MzQgYW5kIFgyNTUxOV9OVFJV UFI2NTMgaW4gdGhlaXIgc3VwcG9ydGVkIGdyb3Vwcy4NCiAgICAgICAgICAgICAgICBJbiB0aGlz IG9wdGlvbiwgd2Ugd291bGQgYXNrIElBTkEgdG8gYWxsb2NhdGUgY29kZSBwb2ludHMgZm9yIGFs bCB0aGUgdmFyaW91cyBjb21iaW5hdGlvbnMgdGhhdCB3ZSB3YW50IGFsbG93IHRvIGJlIG5lZ290 aWF0ZWQuDQoNCkkgd291bGQgbGlrZSB0byBtYWtlIGFuIGFyZ3VtZW50IGluIGZhdm9yIG9mIG9w dGlvbiAxOg0KDQoNCiAgKiAgIEl0IGlzIGxpa2VseSB0aGF0IG5vdCBldmVyeW9uZSB3aWxsIGJl IHNhdGlzaWZpZWQgd2l0aCDigJxYMjU1MTkgcGx1cyBvbmUgb2YgYSBoYW5kZnVsIG9mIHNwZWNp ZmljIHBvc3RxdWFudHVtIGFsZ29yaXRobXPigJ07IHNvbWUgbWF5IHByZWZlciBhbm90aGVyIGVs bGlwdGljIGN1cnZlIChmb3IgZXhhbXBsZSwgeDQ0OCksIG9yIHBlcmhhcHMgZXZlbiBhIE1PRFAg Z3JvdXA7IEkgaGF2ZSB0YWxrZWQgdG8gcGVvcGxlIHdobyBkbyBub3QgdHJ1c3QgRUNDKTsgaW4g YWRkaXRpb24sIG90aGVyIHBlb3BsZSBtaWdodCBub3QgdHJ1c3QgYSBzaW5nbGUgcG9zdHF1YW50 dW0gYWxnb3JpdGhtLCBhbmQgbWF5IHdhbnQgdG8gcmVseSBvbiBib3RoIChmb3IgZXhhbXBsZSkg U0lLRSBhbmQgTmV3SG9wZSAod2hpY2ggYXJlIGJhc2VkIG9uIHZlcnkgZGlmZmVyZW50IGhhcmQg cHJvYmxlbXMpLiAgV2l0aCBvcHRpb24gMiwgd2UgY291bGQgdHJ5IHRvIGFudGljaXBhdGUgYWxs IHRoZSBjb21tb24gY29tYmludGF0aW9ucyAoc3VjaCBhcyBQMzg0X1NJS0VwNDM0X05FV0hPUEU1 MTJDQ0EpLCBob3dldmVyIHRoYXQgY291bGQgdmVyeSB3ZWxsIGVuZCB1cCBhcyBhIGxvdCBvZiBj b21iaW5hdGlvbnMuDQogICogICBUaGVyZSBhcmUgbGlrZWx5IHRvIGJlIHNldmVyYWwgTklTVC1h cHByb3ZlZCBwb3N0cXVhbnR1bSBrZXkgZXhjaGFuZ2VzLCBhbmQgZWFjaCBvZiB0aG9zZSBrZXkg ZXhjaGFuZ2VzIGFyZSBsaWtlbHkgdG8gaGF2ZSBhIG51bWJlciBvZiBzdXBwb3J0ZWQgcGFyYW1l dGVyIHNldHMgKGlmIHdlIHRha2UgdGhlIHNwZWNpZmljIHBvc3RxdWFudHVtIGtleSBleGNoYW5n ZSBhcyBhbmFsb2dvdXMgdG8gdGggRUNESCBwcm90b2Nvb2wsIHRoZSDigJxwYXJhbWV0ZXIgc2V0 4oCdIGNvdWxkIGJlIHRob3VnaHQgb2YgYW4gYW5hbG9nb3VzIHRvIHRoZSBzcGVjaWZpYyBlbGxp cHR1YyBjdXJ2ZSwgYW5kIGl0IG1vZGlmaWVzIHRoZSBrZXkgc2hhcmUgc2l6ZSwgdGhlIHBlcmZv cm1hbmNlIGFuZCBzb21ldGltZXMgdGhlIHNlY3VyaXR5IHByb3BlcnRpZXMpLiAgSW4gZmFjdCwg b25lIG9mIHRoZSBOSVNUIHN1Ym1pc3NvaW5zIGN1cnJlbnRseSBoYXMgMzAgcGFyYW1ldGVyIHNl dHMgZGVmaW5lZC4gIEhlbmNlLCBldmVuIGlmIE5JU1QgZG9lc27igJl0IGFwcHJvdmUgYWxsIHRo ZSBwYXJhbWV0ZXIgc2V0cyAob3Igc29tZSBvZiB0aGVtIGRvIG5vdCBtYWtlIHNlbnNlIGZvciBU TFMgaW4gYW55IHNjZW5hcmlvKSwgd2UgbWlnaHQgZW5kIHVwIHdpdGggMjAgb3IgbW9yZSBkaWZm ZXJlbnQga2V5IGV4Y2hhbmdlL3BhcmFtZXRlciBzZXQgY29tYmluYXRpb25zIHRoYXQgZG8gbWFr ZSBzZW5zZSBmb3Igc29tZSBzY2VuYXJpbyB0aGF0IHVzZXMgdExTIChiZSBpdCBpbiBhIHRyYW5k aXRpb25hbCBQQyBjbGllbnQvc2VydmVyLCBhIHdpcmVsZXNzIGNsaWVudCwgdHdvIGNsb3VkIGRl dmljZXMgY29tbXVuaWNhdGluZyBvciBhbiBJT1QgZGV2aWNlKS4NCiAgKiAgIEluIGFkZGl0aW9u LCB3ZSBhcmUgbGlrZWx5IHRvIHN1cHBvcnQgYWRkaXRpb25hbCBwcmltaXRpdmVzIGluIHRoZSBm dXR1cmU7IHBvc3NpYmx5IE5hdGlvbmFsIGN1cnZlcyAoZS5nLiBCcmFpbnBvb2wpLCBvciBhZGRp dGlvbmFsIFBvc3RxdWFudHVtIGFsZ29yaXRobXMgKG9yIGFkZGl0aW9uYWwgcGFyYW1ldGVyIHNl dHMgdG8gZXhpc3Rpbmcgb25lcykuICBPZiBjb3Vyc2UsIG9uY2Ugd2UgYWRkIHRoYXQgY29kZSBw b2ludCwgd2XigJlsbCBuZWVkIHRvIGFkZCB0aGUgYWRkaXRpb25hbCBjb2RlIHBvaW50cyBmb3Ig YWxsIHRoZSBjb21iaW5hdGlvbnMgdGhhdCBpdOKAmWxsIG1ha2Ugc2Vuc2UgaW4gKHZlcnkgbXVj aCBsaWtlIHdlIGhhZCB0byBhZGQgYSBudW1iZXIgb2YgY2lwaGVyc3VpdGVzIHdoZW5ldmVyIHdl IGFkZGVkIGEgbmV3IGVuY3J5cHRpb24gYWxnb3JpdGhtIGludG8gVExTIDEuMikuDQoNCg0KQXJl IHBlb3BsZSBhY3R1YWxseSBnb2luZyB0byB1c2UgaHlicmlkIGVuY3J5cHRpb24gcG9zdCBOSVNU PyBUaGUgYWN0dWFsIGRlcGxveW1lbnRzIHRvZGF5ICBmb3IgZXhwZXJpbWVudCBoYXZlIGFsbCBm aXQgb3B0aW9uIDIgYW5kIGh5YnJpZHMgYXJlIHVubGlrZWx5IGluIHRoZSBmdXR1cmUuDQoNCk15 IG9iamVjdGlvbiB0byAxIGlzIGl0IGdldHMgdmVyeSBtZXNzeS4gRG8gd2UgdXNlIG9ubHkgdGhl IGh5YnJpZHMgd2UgYm90aCBzdXBwb3J0PyBXaGF0IGlmIEkgdGhyb3cgYSBidW5jaCBvZiBleHBl bnNpdmUgdGhpbmdzIHRvZ2V0aGVyPyBObyByZWFzb24gd2UgbmVlZCBhIGh5YnJpZCBzY2hlbWUh DQoNCkl0IHNlZW1kcyByZWFzb25hYmxlIHRvIG1lIHRoYXQgdGhlIGNvbWJpbmF0aW9uIG9mIHRo ZXNlIHR3byBmYWN0b3JzIGFyZSBsaWtlbHkgdG8gY2F1c2UgdXMgKHNob3VsZCB3ZSBzZWxlY3Qg b3B0aW9uIDIpIHRvIGRlZmluZSBhIHZlcnkgbGFyZ2UgbnVtYmVyIG9mIGNvZGUgcG9pbnRzIHRv IGNvdmVyIGFsbCB0aGUgdmFyaW91cyBvcHRpb25zIHRoYXQgcGVvcGxlIG5lZWQuDQoNCk5vdywg dGhpcyBpcyBiYXNlZCBvbiBzcGVjdWxhdGlvbiAoYm90aCBvZiB0aGUgTklTVCBwcm9jZXNzLCBh bmQgYWRkaXRpb25hbCBwcmltaXRpdmVzIHRoYXQgd2lsbCBiZSBhZGRlZCB0byB0aGUgcHJvdG9j b2wpLCBhbmQgb25lIG9iamVjdGlvbiBJ4oCZdmUgaGVhcmQgaXMg4oCcd2UgZG9u4oCZdCBrbm93 IHdoYXTigJlzIGdvaW5nIHRvIGhhcHBlbiwgYW5kIHNvIHdoeSB3b3VsZCB3ZSBtYWtlIGRlY2lz aW9ucyBiYXNlZCBvbiB0aGlzIHNwZWN1bGF0aW9uP+KAnSAgSSBhZ3JlZSB0aGF0IHdlIGhhdmUg bGFjayBvZiBrbm93bGVkZ2U7IGhvd2V2ZXIgaXQgc2VlbXMgdG8gbWUgdGhhdCBhIGxhY2sgb2Yg a25vd2xlZGdlIGlzIGFuIGFyZ3VtZW50IGluIGZhdm9yIG9mIHNlbGVjdGluZyB0aGUgbW9yZSBm bGV4aWJsZSBvcHRpb24gKHdoaWNoLCBpbiBteSBvcGluaW9uLCBpcyBvcHRpb24gMSwgYXMgaXQg YWxsb3dzIHRoZSBuZWdvdGlhdGlvbiBvZiBjb21iaW5hdGlvbnMgb2Yga2V5IGV4Y2hhbmdlcyB0 aGF0IHRoZSBXRyBoYXMgbm90IGFudGljaXBhdGVkKS4NCg0KTXkgcGxlYTogbGV0cyBub3QgcmVw ZWF0IHRoZSBUTFMgMS4yIGNpcGhlcnN1aXRlIG1lc3M7IGxldHMgYWRkIGFuIGV4dGVuc2lvbiB0 aGF0IGtlZXBzIHRoZSBudW1iZXIgb2YgY29kZSBwb2ludHMgd2UgbmVlZCB0byBhIHJlYXNvbmFi bGUgYm91bmQuDQoNClRoZSBjb3N0cyBvZiBvcHRpb24gMT8NCg0KICAqICAgSXQgZG9lcyBpbmNy ZWFzZSB0aGUgY29tcGxleGl0eSBvbiB0aGUgc2VydmVyIGEgc21hbGwgYW1vdW50IChJ4oCZbSBu b3QgYSBUTFMgaW1wbGVtZW50b3IsIGhvd2V2ZXIgaXQgd291bGQgc2VlbSB0byBtZSB0byBiZSBv bmx5IGEgZmFpcmx5IHNtYWxsIGFtb3VudCkNCiAgKiAgIEl0IG1heSBpbmNyZWFzZSB0aGUgc2l6 ZSBvZiB0aGUgY2xpZW50IGhlbGxvIGEgc21hbGwgYW1vdW50IChvbiB0aGUgb3RoZXIgaGFuZCwg YmVjYXVzZSBpdCBhbGxvd3MgdXMgdG8gYXZvaWQgc2VuZGluZyBkdXBsaWNhdGUga2V5IHNoYXJl cywgaXQgY2FuIGFsc28gcmVkdWNlIHRoZSBzaXplIG9mIHRoZSBjbGllbnQgaGVsbG8gYXMgd2Vs bCwgZGVwZW5kaW5nIG9uIHdoYXTigJlzIGFjdHVhbGx5IG5lZ290aWF0ZWQpDQpJTUhPLCB0aGUg c21hbGwgaW5jcmVhc2UgaW4gY29tcGxleGl0eSBpcyB3b3J0aCB0aGUgbGFjayBvZiBjb21wbGV4 aXR5IGluIHRoZSBjb2RlIHBvaW50IHRhYmxlLCBhbmQgdGhlIGFkZGl0aW9uYWwgZmxleGliaWxp dHkgaXQgZ2l2ZXMuDQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fXw0KVExTIG1haWxpbmcgbGlzdA0KVExTQGlldGYub3JnPG1haWx0bzpUTFNAaWV0Zi5vcmc+ DQpodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3RsczxodHRwczovL25hbTA2 LnNhZmVsaW5rcy5wcm90ZWN0aW9uLm91dGxvb2suY29tLz91cmw9aHR0cHMlM0ElMkYlMkZ3d3cu aWV0Zi5vcmclMkZtYWlsbWFuJTJGbGlzdGluZm8lMkZ0bHMmZGF0YT0wMiU3QzAxJTdDQW5kcmVp LlBvcG92JTQwbWljcm9zb2Z0LmNvbSU3QzZkMTY4MTgxZTMzMDQzMDQ1MmYxMDhkNzE1MjAxMjE2 JTdDNzJmOTg4YmY4NmYxNDFhZjkxYWIyZDdjZDAxMWRiNDclN0MxJTdDMCU3QzYzNzAwMTA5OTgw ODA1NjU0OCZzZGF0YT0wSXJ2NmszTkxnZ1VaSE1teHVwYUZtV2lCcGVFQ1hRMm5EWk5QbUcxTDc4 JTNEJnJlc2VydmVkPTA+DQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fXw0KVExTIG1haWxpbmcgbGlzdA0KVExTQGlldGYub3JnPG1haWx0bzpUTFNAaWV0Zi5v cmc+DQpodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3RsczxodHRwczovL25h bTA2LnNhZmVsaW5rcy5wcm90ZWN0aW9uLm91dGxvb2suY29tLz91cmw9aHR0cHMlM0ElMkYlMkZ3 d3cuaWV0Zi5vcmclMkZtYWlsbWFuJTJGbGlzdGluZm8lMkZ0bHMmZGF0YT0wMiU3QzAxJTdDQW5k cmVpLlBvcG92JTQwbWljcm9zb2Z0LmNvbSU3QzZkMTY4MTgxZTMzMDQzMDQ1MmYxMDhkNzE1MjAx MjE2JTdDNzJmOTg4YmY4NmYxNDFhZjkxYWIyZDdjZDAxMWRiNDclN0MxJTdDMCU3QzYzNzAwMTA5 OTgwODA2NjU0NiZzZGF0YT1FWHJORlpKN2Z2amtmSXhqSVVyTVNaMmpzb1JQRE13TkFRbTg1Ykp1 c25RJTNEJnJlc2VydmVkPTA+DQo= --_000_DM5PR2101MB0917D921E7C79CAA4D2AAA5A8CDC0DM5PR2101MB0917_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQph OmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xv cjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1z b0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpwdXJw bGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLm1zb25vcm1hbDAsIGxpLm1zb25v cm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCgltc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4tYm90 dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZv bnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnAuZ21haWwtbTY3MDI1MzY2NDQxMjMy NjE3MzBnbWFpbC1tLTc5MDg5NzI2NTQ2MzcxOTM5ODRnbWFpbC1tNDk0NDg1Njk3NzY5NTY5ODYy OGdtYWlsLW00NDYwODA5MjAxOTIyOTEwMTEyZ21haWwtbTE2NzM2OTQxNzU1NTc5NTg3MTFtNTAx MjExMjg4NjcxMTIxMjg5MG1zb2xpc3RwYXJhZ3JhcGgsIGxpLmdtYWlsLW02NzAyNTM2NjQ0MTIz MjYxNzMwZ21haWwtbS03OTA4OTcyNjU0NjM3MTkzOTg0Z21haWwtbTQ5NDQ4NTY5Nzc2OTU2OTg2 MjhnbWFpbC1tNDQ2MDgwOTIwMTkyMjkxMDExMmdtYWlsLW0xNjczNjk0MTc1NTU3OTU4NzExbTUw MTIxMTI4ODY3MTEyMTI4OTBtc29saXN0cGFyYWdyYXBoLCBkaXYuZ21haWwtbTY3MDI1MzY2NDQx MjMyNjE3MzBnbWFpbC1tLTc5MDg5NzI2NTQ2MzcxOTM5ODRnbWFpbC1tNDk0NDg1Njk3NzY5NTY5 ODYyOGdtYWlsLW00NDYwODA5MjAxOTIyOTEwMTEyZ21haWwtbTE2NzM2OTQxNzU1NTc5NTg3MTFt NTAxMjExMjg4NjcxMTIxMjg5MG1zb2xpc3RwYXJhZ3JhcGgNCgl7bXNvLXN0eWxlLW5hbWU6Z21h aWwtbV82NzAyNTM2NjQ0MTIzMjYxNzMwZ21haWwtbV8tNzkwODk3MjY1NDYzNzE5Mzk4NGdtYWls LW1fNDk0NDg1Njk3NzY5NTY5ODYyOGdtYWlsLW1fNDQ2MDgwOTIwMTkyMjkxMDExMmdtYWlsLW0x NjczNjk0MTc1NTU3OTU4NzExbTUwMTIxMTI4ODY3MTEyMTI4OTBtc29saXN0cGFyYWdyYXBoOw0K CW1zby1tYXJnaW4tdG9wLWFsdDphdXRvOw0KCW1hcmdpbi1yaWdodDowaW47DQoJbXNvLW1hcmdp bi1ib3R0b20tYWx0OmF1dG87DQoJbWFyZ2luLWxlZnQ6MGluOw0KCWZvbnQtc2l6ZToxMS4wcHQ7 DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0Kc3Bhbi5FbWFpbFN0eWxlMTkN Cgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwtcmVwbHk7DQoJZm9udC1mYW1pbHk6IkNhbGlicmki LHNhbnMtc2VyaWY7DQoJY29sb3I6d2luZG93dGV4dDt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28t c3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJp Zjt9DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo4LjVpbiAxMS4waW47DQoJbWFyZ2luOjEu MGluIDEuMGluIDEuMGluIDEuMGluO30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7cGFnZTpXb3JkU2Vj dGlvbjE7fQ0KLyogTGlzdCBEZWZpbml0aW9ucyAqLw0KQGxpc3QgbDANCgl7bXNvLWxpc3QtaWQ6 MjM4NjM0MDQ5Ow0KCW1zby1saXN0LXRlbXBsYXRlLWlkczoxMTc1Mzg0NjQyO30NCkBsaXN0IGww OmxldmVsMQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRl eHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDouNWluOw0KCW1zby1sZXZlbC1udW1iZXItcG9z aXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEw LjBwdDsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDA6bGV2ZWwyDQoJe21zby1sZXZl bC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVs LXRhYi1zdG9wOjEuMGluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0 LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWls eTpTeW1ib2w7fQ0KQGxpc3QgbDA6bGV2ZWwzDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1 bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjEuNWluOw0K CW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJ bXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3Qg bDA6bGV2ZWw0DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwt dGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjIuMGluOw0KCW1zby1sZXZlbC1udW1iZXIt cG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXpl OjEwLjBwdDsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDA6bGV2ZWw1DQoJe21zby1s ZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxl dmVsLXRhYi1zdG9wOjIuNWluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0 ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZh bWlseTpTeW1ib2w7fQ0KQGxpc3QgbDA6bGV2ZWw2DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0 OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjMuMGlu Ow0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47 DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxp c3QgbDA6bGV2ZWw3DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2 ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjMuNWluOw0KCW1zby1sZXZlbC1udW1i ZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1z aXplOjEwLjBwdDsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDA6bGV2ZWw4DQoJe21z by1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNv LWxldmVsLXRhYi1zdG9wOjQuMGluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsN Cgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250 LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDA6bGV2ZWw5DQoJe21zby1sZXZlbC1udW1iZXItZm9y bWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjQu NWluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1 aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0K QGxpc3QgbDENCgl7bXNvLWxpc3QtaWQ6MTIzOTM2NDAzOTsNCgltc28tbGlzdC10ZW1wbGF0ZS1p ZHM6LTU4NDQ0NTY1NDt9DQpAbGlzdCBsMTpsZXZlbDENCgl7bXNvLWxldmVsLW51bWJlci1mb3Jt YXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6LjVp bjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWlu Ow0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBs aXN0IGwxOmxldmVsMg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxl dmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDoxLjBpbjsNCgltc28tbGV2ZWwtbnVt YmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQt c2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwxOmxldmVsMw0KCXtt c28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1z by1sZXZlbC10YWItc3RvcDoxLjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7 DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9u dC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwxOmxldmVsNA0KCXttc28tbGV2ZWwtbnVtYmVyLWZv cm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDoy LjBpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4y NWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30N CkBsaXN0IGwxOmxldmVsNQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNv LWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDoyLjVpbjsNCgltc28tbGV2ZWwt bnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZv bnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwxOmxldmVsNg0K CXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0K CW1zby1sZXZlbC10YWItc3RvcDozLjBpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxl ZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJ Zm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwxOmxldmVsNw0KCXttc28tbGV2ZWwtbnVtYmVy LWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3Rv cDozLjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6 LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9s O30NCkBsaXN0IGwxOmxldmVsOA0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJ bXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDo0LjBpbjsNCgltc28tbGV2 ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNp LWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwxOmxldmVs OQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3 Ow0KCW1zby1sZXZlbC10YWItc3RvcDo0LjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9u OmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7 DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCm9sDQoJe21hcmdpbi1ib3R0b206MGluO30NCnVsDQoJ e21hcmdpbi1ib3R0b206MGluO30NCi0tPjwvc3R5bGU+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+ DQo8bzpzaGFwZWRlZmF1bHRzIHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2IiAvPg0KPC94bWw+ PCFbZW5kaWZdLS0+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWxheW91dCB2OmV4 dD0iZWRpdCI+DQo8bzppZG1hcCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4NCjwvbzpzaGFwZWxh eW91dD48L3htbD48IVtlbmRpZl0tLT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9IkVOLVVTIiBsaW5r PSJibHVlIiB2bGluaz0icHVycGxlIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj5ZZXMsIEkgc2VlIHlvdXIgcG9pbnQgV1JUIGNsaWVudHMgZXhwcmVz c2luZyBwcmVmZXJlbmNlcy48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxv OnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+UmVnYXJkbGVzcyBvZiB0 aGUgcHJvdG9jb2wgb3B0aW9uIHdlIGNob29zZSwgSSBhbnRpY2lwYXRlIHNvbWUgZGlmZmljdWx0 eSBpbiBhZ3JlZWluZyBvbiB3aGF04oCZcyDigJxyZWFzb25hYmxl4oCdLjxvOnA+PC9vOnA+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+RS5nLiBJ4oCZdmUgaGFkIHNldmVyYWwgY3VzdG9tZXJz IGFzayBhYm91dCB0aGUgcG9zc2liaWxpdHkgb2YgY29tYmluaW5nIGEgY291cGxlIG9mIHRyYWRp dGlvbmFsIGFsZ29yaXRobXMgKGUuZy4gbmF0aW9uYWwgdmFuaXR5ICYjNDM7IE5JU1QpLjxvOnA+ PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+U29tZSBvZiB0aGVtIGVuZGVkIHVwIGRv aW5nIFRMUy1pbi1UTFMsIHdoaWNoIG9mIGNvdXJzZSBvbmx5IHdvcmtzIGJldHdlZW4gdGhlaXIg cGFydGljdWxhciBjbGllbnRzIGFuZCBzZXJ2ZXJzLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 Yj5Gcm9tOjwvYj4gRGF2aWQgQmVuamFtaW4gJmx0O2RhdmlkYmVuQGNocm9taXVtLm9yZyZndDsg PGJyPg0KPGI+U2VudDo8L2I+IFR1ZXNkYXksIEp1bHkgMzAsIDIwMTkgMTE6NTkgQU08YnI+DQo8 Yj5Ubzo8L2I+IEFuZHJlaSBQb3BvdiAmbHQ7QW5kcmVpLlBvcG92QG1pY3Jvc29mdC5jb20mZ3Q7 PGJyPg0KPGI+Q2M6PC9iPiBXYXRzb24gTGFkZCAmbHQ7d2F0c29uYmxhZGRAZ21haWwuY29tJmd0 OzsgVExTIExpc3QgJmx0O3Rsc0BpZXRmLm9yZyZndDs8YnI+DQo8Yj5TdWJqZWN0OjwvYj4gUmU6 IFtUTFNdIE9wdGlvbnMgZm9yIG5lZ290aWF0aW5nIGh5YnJpZCBrZXkgZXhjaGFuZ2VzIGZvciBw b3N0cXVhbnR1bTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJz cDs8L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+VGhlIG51aXNhbmNlIHdp dGgganVzdCBhIGZsYWcgaXMgdGhlIGNsaWVudCBjYW4ndCBleHByZXNzIFt3aGF0IEkgdGhpbmsg YXJlXSByZWFzb25hYmxlIHByZWZlcmVuY2VzLiBJdCBzaG91bGQgYmUgYWJsZSB0byBzYXkgdGhp bmdzIGxpa2U6PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86 cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4q IERvbid0IGRvIFgyNTUxOSZuYnNwOyYjNDM7IFAtMjU2LiBUaGlzIGlzIGp1c3Qgc2lsbHkuPG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4qIERvbid0 IGRvIFBRMSBvbiBpdHMgb3duLiBJIHJlYWxseSB3YW50IHRoZSBQUSBzY2hlbWUgcGFpcmVkIHdp dGggc29tZXRoaW5nIG1vcmUgZXN0YWJsaXNoZWQuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4qIERvbid0IGRvIFBRMSZuYnNwOyYjNDM7IFBRMi4g SSBzYWlkIHNvbWV0aGluZyBtb3JlIGVzdGFibGlzaGVkLCBwbGVhc2UuPG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4qIFBRMSZuYnNwOyYjNDM7IFgy NTUxOSBpcyBjb29sLiBJIGxpa2UgdGhhdCBjb21iby48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiogRG9uJ3QgZG8gUFExJm5ic3A7JiM0MzsgWDI1 NTE5Jm5ic3A7JiM0MzsgUC0yNTYuIFdoeSBhcmUgeW91IGRvaW5nIHRocmVlIG9mIHRoZXNlPzxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+KiBEb24n dCBkbyBQUTEmbmJzcDsmIzQzOyBQUTImbmJzcDsmIzQzOyBQUTMmbmJzcDsmIzQzOyBQUTQmbmJz cDsmIzQzOyBYMjU1MTkmbmJzcDsmIzQzOyBQLTI1NiZuYnNwOyYjNDM7IFAtMzg0Jm5ic3A7JiM0 MzsgRkZESEUyMDQ4Jm5ic3A7JiM0MzsgRkZESEUzMDcyLCBvd3cgbXkgaGVhZC48bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+V2UgY2FuIG1ha2Ug dGhpbmdzIGltcGxpY2l0IGJ5IGNhdGVnb3JpemluZyBuYW1lZCBncm91cHMgYW5kIGJ1aWxkaW5n IGFsbCB0aGlzIGludG8gdGhlIHByb3RvY29sIGl0c2VsZiwgYnV0IEkgdGhpbmsgdGhhdCdzIGFu IHVubmVjZXNzYXJ5IG1vdmluZyBwYXJ0LjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5PbiBUdWUsIEp1bCAzMCwgMjAxOSBhdCAyOjQ4IFBNIEFu ZHJlaSBQb3BvdiAmbHQ7PGEgaHJlZj0ibWFpbHRvOkFuZHJlaS5Qb3BvdkBtaWNyb3NvZnQuY29t IiB0YXJnZXQ9Il9ibGFuayI+QW5kcmVpLlBvcG92QG1pY3Jvc29mdC5jb208L2E+Jmd0OyB3cm90 ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25l O2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowaW4gMGluIDBpbiA2LjBw dDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tcmlnaHQ6MGluIj4NCjxkaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJn aW4tYm90dG9tLWFsdDphdXRvIj5HaXZlbiB0aGVzZSBvcHRpb25zLCBJIGFsc28gcHJlZmVyIG9w dGlvbiAyLCBmb3Igc29tZSBvZiB0aGUgc2FtZSByZWFzb25zLjxvOnA+PC9vOnA+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJn aW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1h bHQ6YXV0byI+Rm9yIG15IHVuZGVyc3RhbmRpbmcgdGhvdWdoLCB3aHkgbm90IGhhdmUgdGhlIGNs aWVudCBhZHZlcnRpc2Ugc3VwcG9ydCBmb3IgaHlicmlkLWtleS1leGNoYW5nZSAoZS5nLiB2aWEg YSDigJxmbGFn4oCdIGV4dGVuc2lvbikgYW5kIHRoZW4gS2V5U2hhcmVTZXJ2ZXJIZWxsbyBjYW4g Y29udGFpbiB0d28gS2V5U2hhcmVFbnRyaWVzDQogKGVzc2VudGlhbGx5LCB1c2luZyB0aGUgc2Ft ZSBmb3JtYXQgYXMgS2V5U2hhcmVDbGllbnRIZWxsbz8gVGhpcyB3b3VsZCBzb2x2ZSB0aGUgQ2Fy dGVzaWFuIHByb2R1Y3QgaXNzdWUuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1 dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1z by1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj5DaGVlcnMs PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10 b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRv O21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj5BbmRyZWk8bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2lu LWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0 OmF1dG8iPjxiPkZyb206PC9iPiBUTFMgJmx0OzxhIGhyZWY9Im1haWx0bzp0bHMtYm91bmNlc0Bp ZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPnRscy1ib3VuY2VzQGlldGYub3JnPC9hPiZndDsNCjxi Pk9uIEJlaGFsZiBPZiA8L2I+RGF2aWQgQmVuamFtaW48YnI+DQo8Yj5TZW50OjwvYj4gVHVlc2Rh eSwgSnVseSAzMCwgMjAxOSAxMToyNCBBTTxicj4NCjxiPlRvOjwvYj4gV2F0c29uIExhZGQgJmx0 OzxhIGhyZWY9Im1haWx0bzp3YXRzb25ibGFkZEBnbWFpbC5jb20iIHRhcmdldD0iX2JsYW5rIj53 YXRzb25ibGFkZEBnbWFpbC5jb208L2E+Jmd0Ozxicj4NCjxiPkNjOjwvYj4gVExTIExpc3QgJmx0 OzxhIGhyZWY9Im1haWx0bzp0bHNAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj50bHNAaWV0Zi5v cmc8L2E+Jmd0Ozxicj4NCjxiPlN1YmplY3Q6PC9iPiBSZTogW1RMU10gT3B0aW9ucyBmb3IgbmVn b3RpYXRpbmcgaHlicmlkIGtleSBleGNoYW5nZXMgZm9yIHBvc3RxdWFudHVtPG86cD48L286cD48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87 bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPGRpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1 dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPkkgdGhpbmsgdGhpcyB1bmRlcmVzdGltYXRl cyB0aGUgY29tcGxleGl0eSBjb3N0IG9mIG9wdGlvbiAxIHRvIHRoZSBwcm90b2NvbCBhbmQgaW1w bGVtZW50YXRpb25zLiBPcHRpb24gMSBtZWFucyBncm91cCBuZWdvdGlhdGlvbiBpbmNsdWRlcyBl bnRpcmUgY29kZXBvaW50cyB3aG9zZSBtZWFuaW5nIGNhbm5vdA0KIGJlIGRldGVybWluZWQgd2l0 aG91dCBhIHBhcmFsbGVsIGV4dGVuc2lvbi4gVGhpcyBjb21wb3VuZHMgYWNyb3NzIGV2ZXJ5dGhp bmcgd2hpY2ggaW50ZXJhY3RzIHdpdGggbmFtZWQgZ3JvdXBzLCBpbXBhY3RpbmcgZXZlcnl0aGlu ZyBmcm9tIEFQSXMgdG8gY29uZmlnIGZpbGUgZm9ybWF0cyB0byBldmVuIFVJIHN1cmZhY2VzLiBP dGhlciB1c2VzIG9mIE5hbWVkR3JvdXBzIGFyZSBpbXBhY3RlZCB0b28uIEZvciBpbnN0YW5jZSwg b3B0aW9uIDIgZml0cw0KIGludG8gZHJhZnQtaWV0Zi10bHMtZXNuaSBhcy1pcy4gT3B0aW9uIDEg cmVxdWlyZXMgaW5qZWN0aW5nJm5ic3A7aHlicmlkX2V4dGVuc2lvbiBpbnRvIEVTTkkgc29tZWhv dy4gQW5hbHlzaXMgbXVzdCBmdXJ0aGVyIGNoZWNrIGV2ZXJ5IHVzZSwgc2F5LCBpbmNvcnBvcmF0 ZXMgdGhpcyBwYXJhbGxlbCBsb29rdXAgdGFibGUgaW50byB0cmFuc2NyaXB0LWxpa2UgbWVhc3Vy ZXMuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8i PiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDph dXRvIj5UaGUgbGVzc29uIGZyb20gVExTIDEuMiBjb2RlIHBvaW50cyBpcyBub3QgY29tYmluZWQg Y29kZXBvaW50cyB2cy4gc3BsaXQgb25lcy4gUmF0aGVyLCB0aGUgbGVzc29uIGlzIHRvIGF2b2lk IGludGVyZGVwZW5kZW50IGRlY2lzaW9uczo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28t bWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87 bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiogU2lnbmF0dXJlIGFsZ29yaXRobXMgaW4gVExT IDEuMiB3ZXJlIGEgbWVzcyBiZWNhdXNlIHRoZSBFQ0RTQSBjb2RlcG9pbnRzIHJlcXVpcmVkIGNy b3NzLXJlZmVyZW5jaW5nIGFnYWluc3QgdGhlIHN1cHBvcnRlZCBjdXJ2ZXMgbGlzdC4gVGhlIHZl cmlmaWVyIGNvdWxkIG5vdCBleHByZXNzIHNvbWUgcHJlZmVyZW5jZXMNCiAoc2lnbmluZyBTSEEt NTEyIHdpdGggUC0yNTYgaXMgc2lsbHksIGFuZCBtaXhpbmcgaGFzaCYjNDM7Y3VydmUgcGFpcnMg aW4gRUNEU0EgaXMgc2xpZ2h0bHkgb2ZmIGluIGdlbmVyYWwpLiBBcyBhbmFsb2d5IHRvIG9wdGlv biAxJ3MgRVNOSSBwcm9ibGVtLCB3ZSBldmVuIGZvcmdvdCB0byBhbGxvdyB0aGUgc2VydmVyIHRv IGV4cHJlc3MgY3VydmUgcHJlZmVyZW5jZXMuIFRMUyAxLjMgY29tYmluZWQgc2lnbmF0dXJlIGFs Z29yaXRobSBjb25zaWRlcmF0aW9ucw0KIGludG8gYSBzaW5nbGUgY29kZXBvaW50IHRvIGFkZHJl c3MgYWxsIHRoaXMuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20t YWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90 dG9tLWFsdDphdXRvIj4qIENpcGhlciBzdWl0ZXMgaW4gVExTIDEuMiB3ZXJlIGEgbWVzcyBiZWNh dXNlIHRoZXkgd2VyZSBoYWxmLWNvbWJpbmVkIGFuZCBoYWxmLXNwbGl0LiBUTFNfRUNESEVfRUNE U0FfV0lUSF9BRVNfMTI4X0dDTV9TSEEyNTYgc2FpZCB0byB1c2Ugc29tZSBFQ0RIRSBrZXkgZXhj aGFuZ2UsIGJ1dCB5b3UgbmVlZA0KIHRvIGNoZWNrIGlmIHlvdSBoYXZlIGEgTmFtZWRHcm91cCBp biBjb21tb24gZmlyc3QuIEl0IHNhaWQgdG8gdXNlIEVDRFNBLCBidXQgeW91IG5lZWQgdG8gY2hl Y2sgc2lnbmF0dXJlIGFsZ29yaXRobXMgKHdoaWNoIHRoZW1zZWx2ZXMgY3Jvc3MtcmVmZXJlbmNl IGN1cnZlcykgZmlyc3QuIEVhcmx5IGRyYWZ0cyBvZiBUTFMgMS4zIGhhZCBpdCBldmVuIHdvcnNl LCB3aGVyZSBhJm5ic3A7VExTX0VDREhFX0VDRFNBX1dJVEhfQUVTXzEyOF9HQ01fU0hBMjU2DQog ZnVsbCBoYW5kc2hha2UgbW9ycGhlZCBpbnRvJm5ic3A7VExTX0VDREhFX1BTS19XSVRIX0FFU18x MjhfR0NNX1NIQTI1NiBvbiByZXN1bXB0aW9uLiBUaHVzLCBUTFMgMS4zIGNpcGhlciBzdWl0ZXMg bmVnb3RpYXRlIHNvbGVseSBBRUFEJm5ic3A7JiM0MzsgUFJGIGhhc2guPG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10 b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJn aW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj5JbiBmYWlybmVzcyB0 byBUTFMgMS4yLCBzb21lIG9mIHRoaXMgd2FzIGEgY29uc2VxdWVuY2Ugb2YgVExTIDEuMidzIGV2 b2x1dGlvbiBvdmVyIHRpbWUgYXMgaW5jcmVtZW50YWwgZXh0ZW5zaW9ucyBvdmVyIFNTTCAzLjAu IEFuZCBzb21ldGltZXMgd2UgZG8gbmVlZCB0byBwYXkgY29zdHMgbGlrZSB0aGVzZS4NCiBCdXQg aHlicmlkIGtleSBleGNoYW5nZXMgZml0IGludG8gdGhlIE5hbWVkR3JvdXAgJnF1b3Q7QVBJJnF1 b3Q7IGp1c3QgZmluZSwgc28gb3B0aW9uIDIgaXMgdGhlIGNsZWFyIGFuc3dlci4gQ29kZSBwb2lu dHMgYXJlIGNoZWFwLiBQcm90b2NvbCBjb21wbGV4aXR5IGlzIG11Y2ggbW9yZSBleHBlbnNpdmUu PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZu YnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRv Ij5JdCdzIHRydWUgdGhhdCBzdGFuZGFyZHMgYXJlIG9mdGVuIHVuZGVyc3BlY2lmaWVkLiBUaGlz IG1lYW5zIHRoZSBJRVRGIHNob3VsZCBmaW5pc2ggdGhlIGpvYiwgbm90IHBhc3MgYWxsIHZhcmlh dGlvbnMgdGhyb3VnaC4gUlNBLVBTUyBpcyBhIGNsZWFyIGV4YW1wbGUgb2Ygd2hhdCB0byBhdm9p ZC4gSXQgdGFrZXMNCiBtb3JlIGJ5dGVzIHRvIG1lcmVseSB1dHRlciAmcXVvdDtSU0EtUFNTIHdp dGggU0hBLTI1NiBhbmQgdXN1YWwgcGFyYW1ldGVycyZxdW90OyBpbiBYLjUwOSB0aGFuIHRvIGVu Y29kZSBhbiBlbnRpcmUgRUNEU0Egc2lnbmF0dXJlISBXZSBzaG91bGQgbm90IGRlZmluZSBtb3Jl IHRoYW4gYSBoYW5kZnVsIG9mIG9wdGlvbnMsIHJlZ2FyZGxlc3Mgb2YgdGhlIGVuY29kaW5nLi48 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1t YXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpw PjwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1z by1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj5PbiBUdWUs IEp1bCAzMCwgMjAxOSBhdCAxMjoxOCBQTSBXYXRzb24gTGFkZCAmbHQ7PGEgaHJlZj0ibWFpbHRv OndhdHNvbmJsYWRkQGdtYWlsLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPndhdHNvbmJsYWRkQGdtYWls LmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8YmxvY2txdW90ZSBz dHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRkaW5n OjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi10b3A6NS4wcHQ7bWFy Z2luLXJpZ2h0OjBpbjttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21hcmdpbi1ib3R0 b206MTIuMHB0Ij4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90 dG9tLWFsdDphdXRvIj5PbiBUdWUsIEp1bCAzMCwgMjAxOSwgODoyMSBBTSBTY290dCBGbHVocmVy IChzZmx1aHJlcikgJmx0OzxhIGhyZWY9Im1haWx0bzpzZmx1aHJlckBjaXNjby5jb20iIHRhcmdl dD0iX2JsYW5rIj5zZmx1aHJlckBjaXNjby5jb208L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNv bGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowaW4gMGluIDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0 LjhwdDttYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1yaWdodDowaW47bWFyZ2luLWJvdHRvbTo1LjBw dCI+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2lu LXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+RHVyaW5nIHRoZSBwaHlz aWNhbCBtZWV0aW5nIGluIE1vbnRyZWFsLCB3ZSBoYWQgYSBkaXNjdXNzaW9uIGFib3V0IHBvc3Rx dWFudHVtIHNlY3VyaXR5LCBhbmQgaW4gcGFydGljdWxhciwgb24gaG93IG9uZSBtaWdodCB3YW50 IHRvIG5lZ290aWF0ZSBzZXZlcmFsIGRpZmZlcmVudCDigJhncm91cHPigJkgc2ltdWx0YW5lb3Vz bHkNCiAoYmVjYXVzZSB0aGVyZSBtaWdodCBub3QgYmUgb25lIGdyb3VwIHRoYXQgaXMgZW50aXJl bHkgdHJ1c3RlZCwgYW5kIEkgcHV0IOKAmGdyb3Vwc+KAmSBpbiBzY2FyZXF1b3RlcyBiZWNhdXNl IHBvc3RxdWFudHVtIGtleSBleGNoYW5nZXMgYXJlIHR5cGljYWxseSBub3QgZm9ybWVkIGZyb20g YSBEaWZmaWUtSGVsbG1hbiBncm91cCkuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0 OmF1dG8iPjxzcGFuIGxhbmc9IkVOLUdCIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1h cmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIGxhbmc9IkVOLUdCIj5BdCB0aGUgbWVldGluZywg dGhlcmUgd2VyZSB0d28gb3B0aW9ucyBwcmVzZW50ZWQ6PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1t YXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBsYW5nPSJFTi1HQiI+Jm5ic3A7PC9zcGFuPjxv OnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9w LWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBsYW5nPSJFTi1HQiI+ T3B0aW9uIDE6IGFzIHRoZSBzdXBwb3J0ZWQgZ3JvdXAsIHdlIGluc2VydCBhIOKAmGh5YnJpZCBt YXJrZXLigJkgKGFuZCBpbmNsdWRlIGFuIGV4dGVuc2lvbiB0aGF0IG1hcCBsaXN0cyB3aGljaCBj b21iaW5hdGlvbiB0aGUgaHlicmlkIG1hcmtlciBzdGFuZHMgZm9yKTwvc3Bhbj48bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0 bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gbGFuZz0iRU4tR0IiPiZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBGb3IgZXhhbXBsZSwgdGhlIGNsaWVudCBtaWdodCBs aXN0IGluIGhpcyBzdXBwb3J0ZWQgZ3JvdXBzIGh5YnJpZF9tYXJrZXJfMCBhbmQgaHlicmlkX21h cmtlcl8xLCBhbmQgdGhlcmUgd291bGQgYmUgYSBzZXBhcmF0ZSBleHRlbnNpb24gdGhhdCBsaXN0 cw0KIGh5YnJpZF9tYXJrZXJfMCA9IFgyNTUxOSAmIzQzOyBTSUtFcDQzNCBhbmQgaHlicmlkX21h cmtlcl8xID0gWDI1NTE5ICYjNDM7IE5UUlVQUjY1My4mbmJzcDsgVGhlIHNlcnZlciB3b3VsZCB0 aGVuIGxvb2sgdXAgdGhlIG1lYW5pbmdzIG9mIGh5YnJpZF9tYXJrZXJfMCBhbmQgMSBpbiB0aGUg ZXh0ZW5zaW9uLCBhbmQgdGhlbiBjb21wYXJlIHRoYXQgYWdhaW5zdCBoaXMgc2VjdXJpdHkgcG9s aWN5Ljwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt c28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzt0ZXh0LWlu ZGVudDouNWluIj4NCjxzcGFuIGxhbmc9IkVOLUdCIj5JbiB0aGlzIG9wdGlvbiwgd2Ugd291bGQg YXNrIElBTkEgdG8gYWxsb2NhdGUgY29kZSBwb2ludHMgZm9yIHRoZSB2YXJpb3VzIGluZGl2aWR1 YWwgcG9zdHF1YW50dW0ga2V5IGV4Y2hhbmdlcyAoaW4gdGhpcyBleGFtcGxlLCBTSUtFcDQzNCBh bmQgTlRSVVBSNjUzKSwgYXMgd2VsbCBhIHJhbmdlIG9mIGNvZGUgcG9pbnRzIGZvciB0aGUgdmFy aW91cyBoeWJyaWRfbWFya2Vycy48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2 Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGJsb2NrcXVv dGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFk ZGluZzowaW4gMGluIDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tdG9wOjUuMHB0 O21hcmdpbi1yaWdodDowaW47bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFy Z2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gbGFuZz0iRU4tR0IiPiZuYnNwOzwvc3Bhbj48bzpw PjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1h bHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gbGFuZz0iRU4tR0IiPk9w dGlvbiAyOiB3ZSBoYXZlIGNvZGUgcG9pbnRzIGZvciBhbGwgdGhlIHZhcmlvdXMgY29tYmluYXRp b25zIHRoYXQgd2UgbWF5IHdhbnQgdG8gc3VwcG9ydDsgaGVuY2UgSUFOQSBtaWdodCBhbGxvY2F0 ZSBhIGNvZGUgcG9pbnQgWDI1NTE5X1NJS0VwNDM0IGFuZCBhbm90aGVyDQogY29kZSBwb2ludCBm b3IgWDI1NTE5X05UUlVQUjY1My4mbmJzcDsgV2l0aCB0aGlzIG9wdGlvbiwgdGhlIGNsaWVudCB3 b3VsZCBsaXN0IFgyNTUxOV9TSUtFcDQzNCBhbmQgWDI1NTE5X05UUlVQUjY1MyBpbiB0aGVpciBz dXBwb3J0ZWQgZ3JvdXBzLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6 YXV0byI+PHNwYW4gbGFuZz0iRU4tR0IiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyBJbiB0aGlzIG9wdGlvbiwgd2Ugd291bGQgYXNrIElBTkEgdG8gYWxsb2NhdGUgY29kZSBwb2lu dHMgZm9yIGFsbCB0aGUgdmFyaW91cyBjb21iaW5hdGlvbnMgdGhhdCB3ZSB3YW50IGFsbG93IHRv IGJlIG5lZ290aWF0ZWQuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDph dXRvIj48c3BhbiBsYW5nPSJFTi1HQiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJn aW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBsYW5nPSJFTi1HQiI+SSB3b3VsZCBsaWtlIHRvIG1h a2UgYW4gYXJndW1lbnQgaW4gZmF2b3Igb2Ygb3B0aW9uIDE6PC9zcGFuPjxvOnA+PC9vOnA+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21z by1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBsYW5nPSJFTi1HQiI+Jm5ic3A7PC9zcGFu PjxvOnA+PC9vOnA+PC9wPg0KPHVsIHR5cGU9ImRpc2MiPg0KPGxpIGNsYXNzPSJnbWFpbC1tNjcw MjUzNjY0NDEyMzI2MTczMGdtYWlsLW0tNzkwODk3MjY1NDYzNzE5Mzk4NGdtYWlsLW00OTQ0ODU2 OTc3Njk1Njk4NjI4Z21haWwtbTQ0NjA4MDkyMDE5MjI5MTAxMTJnbWFpbC1tMTY3MzY5NDE3NTU1 Nzk1ODcxMW01MDEyMTEyODg2NzExMjEyODkwbXNvbGlzdHBhcmFncmFwaCIgc3R5bGU9Im1zby1s aXN0OmwwIGxldmVsMSBsZm8xIj4NCjxzcGFuIGxhbmc9IkVOLUdCIj5JdCBpcyBsaWtlbHkgdGhh dCBub3QgZXZlcnlvbmUgd2lsbCBiZSBzYXRpc2lmaWVkIHdpdGgg4oCcWDI1NTE5IHBsdXMgb25l IG9mIGEgaGFuZGZ1bCBvZiBzcGVjaWZpYyBwb3N0cXVhbnR1bSBhbGdvcml0aG1z4oCdOyBzb21l IG1heSBwcmVmZXIgYW5vdGhlciBlbGxpcHRpYyBjdXJ2ZSAoZm9yIGV4YW1wbGUsIHg0NDgpLCBv ciBwZXJoYXBzIGV2ZW4gYSBNT0RQIGdyb3VwOyBJIGhhdmUgdGFsa2VkIHRvIHBlb3BsZSB3aG8N CiBkbyBub3QgdHJ1c3QgRUNDKTsgaW4gYWRkaXRpb24sIG90aGVyIHBlb3BsZSBtaWdodCBub3Qg dHJ1c3QgYSBzaW5nbGUgcG9zdHF1YW50dW0gYWxnb3JpdGhtLCBhbmQgbWF5IHdhbnQgdG8gcmVs eSBvbiBib3RoIChmb3IgZXhhbXBsZSkgU0lLRSBhbmQgTmV3SG9wZSAod2hpY2ggYXJlIGJhc2Vk IG9uIHZlcnkgZGlmZmVyZW50IGhhcmQgcHJvYmxlbXMpLiZuYnNwOyBXaXRoIG9wdGlvbiAyLCB3 ZSBjb3VsZCB0cnkgdG8gYW50aWNpcGF0ZSBhbGwgdGhlIGNvbW1vbg0KIGNvbWJpbnRhdGlvbnMg KHN1Y2ggYXMgUDM4NF9TSUtFcDQzNF9ORVdIT1BFNTEyQ0NBKSwgaG93ZXZlciB0aGF0IGNvdWxk IHZlcnkgd2VsbCBlbmQgdXAgYXMgYSBsb3Qgb2YgY29tYmluYXRpb25zLjwvc3Bhbj48bzpwPjwv bzpwPjwvbGk+PGxpIGNsYXNzPSJnbWFpbC1tNjcwMjUzNjY0NDEyMzI2MTczMGdtYWlsLW0tNzkw ODk3MjY1NDYzNzE5Mzk4NGdtYWlsLW00OTQ0ODU2OTc3Njk1Njk4NjI4Z21haWwtbTQ0NjA4MDky MDE5MjI5MTAxMTJnbWFpbC1tMTY3MzY5NDE3NTU1Nzk1ODcxMW01MDEyMTEyODg2NzExMjEyODkw bXNvbGlzdHBhcmFncmFwaCIgc3R5bGU9Im1zby1saXN0OmwwIGxldmVsMSBsZm8xIj4NCjxzcGFu IGxhbmc9IkVOLUdCIj5UaGVyZSBhcmUgbGlrZWx5IHRvIGJlIHNldmVyYWwgTklTVC1hcHByb3Zl ZCBwb3N0cXVhbnR1bSBrZXkgZXhjaGFuZ2VzLCBhbmQgZWFjaCBvZiB0aG9zZSBrZXkgZXhjaGFu Z2VzIGFyZSBsaWtlbHkgdG8gaGF2ZSBhIG51bWJlciBvZiBzdXBwb3J0ZWQgcGFyYW1ldGVyIHNl dHMgKGlmIHdlIHRha2UgdGhlIHNwZWNpZmljIHBvc3RxdWFudHVtIGtleSBleGNoYW5nZSBhcyBh bmFsb2dvdXMgdG8gdGggRUNESCBwcm90b2Nvb2wsDQogdGhlIOKAnHBhcmFtZXRlciBzZXTigJ0g Y291bGQgYmUgdGhvdWdodCBvZiBhbiBhbmFsb2dvdXMgdG8gdGhlIHNwZWNpZmljIGVsbGlwdHVj IGN1cnZlLCBhbmQgaXQgbW9kaWZpZXMgdGhlIGtleSBzaGFyZSBzaXplLCB0aGUgcGVyZm9ybWFu Y2UgYW5kIHNvbWV0aW1lcyB0aGUgc2VjdXJpdHkgcHJvcGVydGllcykuJm5ic3A7IEluIGZhY3Qs IG9uZSBvZiB0aGUgTklTVCBzdWJtaXNzb2lucyBjdXJyZW50bHkgaGFzIDMwIHBhcmFtZXRlciBz ZXRzIGRlZmluZWQuJm5ic3A7DQogSGVuY2UsIGV2ZW4gaWYgTklTVCBkb2VzbuKAmXQgYXBwcm92 ZSBhbGwgdGhlIHBhcmFtZXRlciBzZXRzIChvciBzb21lIG9mIHRoZW0gZG8gbm90IG1ha2Ugc2Vu c2UgZm9yIFRMUyBpbiBhbnkgc2NlbmFyaW8pLCB3ZSBtaWdodCBlbmQgdXAgd2l0aCAyMCBvciBt b3JlIGRpZmZlcmVudCBrZXkgZXhjaGFuZ2UvcGFyYW1ldGVyIHNldCBjb21iaW5hdGlvbnMgdGhh dCBkbyBtYWtlIHNlbnNlIGZvciBzb21lIHNjZW5hcmlvIHRoYXQgdXNlcyB0TFMgKGJlDQogaXQg aW4gYSB0cmFuZGl0aW9uYWwgUEMgY2xpZW50L3NlcnZlciwgYSB3aXJlbGVzcyBjbGllbnQsIHR3 byBjbG91ZCBkZXZpY2VzIGNvbW11bmljYXRpbmcgb3IgYW4gSU9UIGRldmljZSkuPC9zcGFuPjxv OnA+PC9vOnA+PC9saT48bGkgY2xhc3M9ImdtYWlsLW02NzAyNTM2NjQ0MTIzMjYxNzMwZ21haWwt bS03OTA4OTcyNjU0NjM3MTkzOTg0Z21haWwtbTQ5NDQ4NTY5Nzc2OTU2OTg2MjhnbWFpbC1tNDQ2 MDgwOTIwMTkyMjkxMDExMmdtYWlsLW0xNjczNjk0MTc1NTU3OTU4NzExbTUwMTIxMTI4ODY3MTEy MTI4OTBtc29saXN0cGFyYWdyYXBoIiBzdHlsZT0ibXNvLWxpc3Q6bDAgbGV2ZWwxIGxmbzEiPg0K PHNwYW4gbGFuZz0iRU4tR0IiPkluIGFkZGl0aW9uLCB3ZSBhcmUgbGlrZWx5IHRvIHN1cHBvcnQg YWRkaXRpb25hbCBwcmltaXRpdmVzIGluIHRoZSBmdXR1cmU7IHBvc3NpYmx5IE5hdGlvbmFsIGN1 cnZlcyAoZS5nLiBCcmFpbnBvb2wpLCBvciBhZGRpdGlvbmFsIFBvc3RxdWFudHVtIGFsZ29yaXRo bXMgKG9yIGFkZGl0aW9uYWwgcGFyYW1ldGVyIHNldHMgdG8gZXhpc3Rpbmcgb25lcykuJm5ic3A7 IE9mIGNvdXJzZSwgb25jZSB3ZSBhZGQgdGhhdCBjb2RlDQogcG9pbnQsIHdl4oCZbGwgbmVlZCB0 byBhZGQgdGhlIGFkZGl0aW9uYWwgY29kZSBwb2ludHMgZm9yIGFsbCB0aGUgY29tYmluYXRpb25z IHRoYXQgaXTigJlsbCBtYWtlIHNlbnNlIGluICh2ZXJ5IG11Y2ggbGlrZSB3ZSBoYWQgdG8gYWRk IGEgbnVtYmVyIG9mIGNpcGhlcnN1aXRlcyB3aGVuZXZlciB3ZSBhZGRlZCBhIG5ldyBlbmNyeXB0 aW9uIGFsZ29yaXRobSBpbnRvIFRMUyAxLjIpLjwvc3Bhbj48bzpwPjwvbzpwPjwvbGk+PC91bD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28t bWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gbGFuZz0iRU4tR0IiPiZuYnNwOzwvc3Bhbj48 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1h bHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10 b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPkFyZSBwZW9wbGUgYWN0dWFs bHkgZ29pbmcgdG8gdXNlIGh5YnJpZCBlbmNyeXB0aW9uIHBvc3QgTklTVD8gVGhlIGFjdHVhbCBk ZXBsb3ltZW50cyB0b2RheSZuYnNwOyBmb3IgZXhwZXJpbWVudCBoYXZlIGFsbCBmaXQgb3B0aW9u IDIgYW5kIGh5YnJpZHMgYXJlIHVubGlrZWx5IGluIHRoZSBmdXR1cmUuJm5ic3A7PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1h cmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1z by1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj5NeSBvYmpl Y3Rpb24gdG8gMSBpcyBpdCBnZXRzIHZlcnkgbWVzc3kuIERvIHdlIHVzZSBvbmx5IHRoZSBoeWJy aWRzIHdlIGJvdGggc3VwcG9ydD8gV2hhdCBpZiBJIHRocm93IGEgYnVuY2ggb2YgZXhwZW5zaXZl IHRoaW5ncyB0b2dldGhlcj8gTm8gcmVhc29uIHdlIG5lZWQgYSBoeWJyaWQgc2NoZW1lISZuYnNw OzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4m bmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8YmxvY2txdW90ZSBz dHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRkaW5n OjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi10b3A6NS4wcHQ7bWFy Z2luLXJpZ2h0OjBpbjttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvIj48c3BhbiBsYW5nPSJFTi1HQiI+SXQgc2VlbWRzIHJlYXNvbmFibGUg dG8gbWUgdGhhdCB0aGUgY29tYmluYXRpb24gb2YgdGhlc2UgdHdvIGZhY3RvcnMgYXJlIGxpa2Vs eSB0byBjYXVzZSB1cyAoc2hvdWxkIHdlIHNlbGVjdCBvcHRpb24gMikgdG8gZGVmaW5lIGEgdmVy eSBsYXJnZSBudW1iZXIgb2YgY29kZQ0KIHBvaW50cyB0byBjb3ZlciBhbGwgdGhlIHZhcmlvdXMg b3B0aW9ucyB0aGF0IHBlb3BsZSBuZWVkLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJv dHRvbS1hbHQ6YXV0byI+PHNwYW4gbGFuZz0iRU4tR0IiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0 bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gbGFuZz0iRU4tR0IiPk5vdywgdGhp cyBpcyBiYXNlZCBvbiBzcGVjdWxhdGlvbiAoYm90aCBvZiB0aGUgTklTVCBwcm9jZXNzLCBhbmQg YWRkaXRpb25hbCBwcmltaXRpdmVzIHRoYXQgd2lsbCBiZSBhZGRlZCB0byB0aGUgcHJvdG9jb2wp LCBhbmQgb25lIG9iamVjdGlvbiBJ4oCZdmUgaGVhcmQgaXMg4oCcd2UNCiBkb27igJl0IGtub3cg d2hhdOKAmXMgZ29pbmcgdG8gaGFwcGVuLCBhbmQgc28gd2h5IHdvdWxkIHdlIG1ha2UgZGVjaXNp b25zIGJhc2VkIG9uIHRoaXMgc3BlY3VsYXRpb24/4oCdJm5ic3A7IEkgYWdyZWUgdGhhdCB3ZSBo YXZlIGxhY2sgb2Yga25vd2xlZGdlOyBob3dldmVyIGl0IHNlZW1zIHRvIG1lIHRoYXQgYSBsYWNr IG9mIGtub3dsZWRnZSBpcyBhbiBhcmd1bWVudCBpbiBmYXZvciBvZiBzZWxlY3RpbmcgdGhlIG1v cmUgZmxleGlibGUgb3B0aW9uICh3aGljaCwNCiBpbiBteSBvcGluaW9uLCBpcyBvcHRpb24gMSwg YXMgaXQgYWxsb3dzIHRoZSBuZWdvdGlhdGlvbiBvZiBjb21iaW5hdGlvbnMgb2Yga2V5IGV4Y2hh bmdlcyB0aGF0IHRoZSBXRyBoYXMgbm90IGFudGljaXBhdGVkKS48L3NwYW4+PG86cD48L286cD48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87 bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvIj5NeSBwbGVhOiBsZXRzIG5vdCByZXBlYXQgdGhlIFRMUyAxLjIgY2lw aGVyc3VpdGUgbWVzczsgbGV0cyBhZGQgYW4gZXh0ZW5zaW9uIHRoYXQga2VlcHMgdGhlIG51bWJl ciBvZiBjb2RlIHBvaW50cyB3ZSBuZWVkIHRvIGEgcmVhc29uYWJsZSBib3VuZC48bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0 bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdp bi1ib3R0b20tYWx0OmF1dG8iPlRoZSBjb3N0cyBvZiBvcHRpb24gMT88bzpwPjwvbzpwPjwvcD4N Cjx1bCB0eXBlPSJkaXNjIj4NCjxsaSBjbGFzcz0iZ21haWwtbTY3MDI1MzY2NDQxMjMyNjE3MzBn bWFpbC1tLTc5MDg5NzI2NTQ2MzcxOTM5ODRnbWFpbC1tNDk0NDg1Njk3NzY5NTY5ODYyOGdtYWls LW00NDYwODA5MjAxOTIyOTEwMTEyZ21haWwtbTE2NzM2OTQxNzU1NTc5NTg3MTFtNTAxMjExMjg4 NjcxMTIxMjg5MG1zb2xpc3RwYXJhZ3JhcGgiIHN0eWxlPSJtc28tbGlzdDpsMSBsZXZlbDEgbGZv MiI+DQpJdCBkb2VzIGluY3JlYXNlIHRoZSBjb21wbGV4aXR5IG9uIHRoZSBzZXJ2ZXIgYSBzbWFs bCBhbW91bnQgKEnigJltIG5vdCBhIFRMUyBpbXBsZW1lbnRvciwgaG93ZXZlciBpdCB3b3VsZCBz ZWVtIHRvIG1lIHRvIGJlIG9ubHkgYSBmYWlybHkgc21hbGwgYW1vdW50KTxvOnA+PC9vOnA+PC9s aT48bGkgY2xhc3M9ImdtYWlsLW02NzAyNTM2NjQ0MTIzMjYxNzMwZ21haWwtbS03OTA4OTcyNjU0 NjM3MTkzOTg0Z21haWwtbTQ5NDQ4NTY5Nzc2OTU2OTg2MjhnbWFpbC1tNDQ2MDgwOTIwMTkyMjkx MDExMmdtYWlsLW0xNjczNjk0MTc1NTU3OTU4NzExbTUwMTIxMTI4ODY3MTEyMTI4OTBtc29saXN0 cGFyYWdyYXBoIiBzdHlsZT0ibXNvLWxpc3Q6bDEgbGV2ZWwxIGxmbzIiPg0KSXQgbWF5IGluY3Jl YXNlIHRoZSBzaXplIG9mIHRoZSBjbGllbnQgaGVsbG8gYSBzbWFsbCBhbW91bnQgKG9uIHRoZSBv dGhlciBoYW5kLCBiZWNhdXNlIGl0IGFsbG93cyB1cyB0byBhdm9pZCBzZW5kaW5nIGR1cGxpY2F0 ZSBrZXkgc2hhcmVzLCBpdCBjYW4gYWxzbyByZWR1Y2UgdGhlIHNpemUgb2YgdGhlIGNsaWVudCBo ZWxsbyBhcyB3ZWxsLCBkZXBlbmRpbmcgb24gd2hhdOKAmXMgYWN0dWFsbHkgbmVnb3RpYXRlZCk8 bzpwPjwvbzpwPjwvbGk+PC91bD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFy Z2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+SU1ITywgdGhlIHNt YWxsIGluY3JlYXNlIGluIGNvbXBsZXhpdHkgaXMgd29ydGggdGhlIGxhY2sgb2YgY29tcGxleGl0 eSBpbiB0aGUgY29kZSBwb2ludCB0YWJsZSwgYW5kIHRoZSBhZGRpdGlvbmFsIGZsZXhpYmlsaXR5 IGl0IGdpdmVzLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1h bHQ6YXV0byI+X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX188 YnI+DQpUTFMgbWFpbGluZyBsaXN0PGJyPg0KPGEgaHJlZj0ibWFpbHRvOlRMU0BpZXRmLm9yZyIg dGFyZ2V0PSJfYmxhbmsiPlRMU0BpZXRmLm9yZzwvYT48YnI+DQo8YSBocmVmPSJodHRwczovL25h bTA2LnNhZmVsaW5rcy5wcm90ZWN0aW9uLm91dGxvb2suY29tLz91cmw9aHR0cHMlM0ElMkYlMkZ3 d3cuaWV0Zi5vcmclMkZtYWlsbWFuJTJGbGlzdGluZm8lMkZ0bHMmYW1wO2RhdGE9MDIlN0MwMSU3 Q0FuZHJlaS5Qb3BvdiU0MG1pY3Jvc29mdC5jb20lN0M2ZDE2ODE4MWUzMzA0MzA0NTJmMTA4ZDcx NTIwMTIxNiU3QzcyZjk4OGJmODZmMTQxYWY5MWFiMmQ3Y2QwMTFkYjQ3JTdDMSU3QzAlN0M2Mzcw MDEwOTk4MDgwNTY1NDgmYW1wO3NkYXRhPTBJcnY2azNOTGdnVVpITW14dXBhRm1XaUJwZUVDWFEy bkRaTlBtRzFMNzglM0QmYW1wO3Jlc2VydmVkPTAiIHRhcmdldD0iX2JsYW5rIj5odHRwczovL3d3 dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3RsczwvYT48bzpwPjwvbzpwPjwvcD4NCjwvYmxv Y2txdW90ZT4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+ X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX188YnI+DQpUTFMg bWFpbGluZyBsaXN0PGJyPg0KPGEgaHJlZj0ibWFpbHRvOlRMU0BpZXRmLm9yZyIgdGFyZ2V0PSJf YmxhbmsiPlRMU0BpZXRmLm9yZzwvYT48YnI+DQo8YSBocmVmPSJodHRwczovL25hbTA2LnNhZmVs aW5rcy5wcm90ZWN0aW9uLm91dGxvb2suY29tLz91cmw9aHR0cHMlM0ElMkYlMkZ3d3cuaWV0Zi5v cmclMkZtYWlsbWFuJTJGbGlzdGluZm8lMkZ0bHMmYW1wO2RhdGE9MDIlN0MwMSU3Q0FuZHJlaS5Q b3BvdiU0MG1pY3Jvc29mdC5jb20lN0M2ZDE2ODE4MWUzMzA0MzA0NTJmMTA4ZDcxNTIwMTIxNiU3 QzcyZjk4OGJmODZmMTQxYWY5MWFiMmQ3Y2QwMTFkYjQ3JTdDMSU3QzAlN0M2MzcwMDEwOTk4MDgw NjY1NDYmYW1wO3NkYXRhPUVYck5GWko3ZnZqa2ZJeGpJVXJNU1oyanNvUlBETXdOQVFtODViSnVz blElM0QmYW1wO3Jlc2VydmVkPTAiIHRhcmdldD0iX2JsYW5rIj5odHRwczovL3d3dy5pZXRmLm9y Zy9tYWlsbWFuL2xpc3RpbmZvL3RsczwvYT48bzpwPjwvbzpwPjwvcD4NCjwvYmxvY2txdW90ZT4N CjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8 L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_DM5PR2101MB0917D921E7C79CAA4D2AAA5A8CDC0DM5PR2101MB0917_-- From nobody Tue Jul 30 12:12:41 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C8F8C12010F for ; Tue, 30 Jul 2019 12:12:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.094 X-Spam-Level: X-Spam-Status: No, score=-4.094 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=0.1, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_NONE=0.001, UNPARSEABLE_RELAY=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NdAOvuUvMOSA for ; Tue, 30 Jul 2019 12:12:19 -0700 (PDT) Received: from llmx2.ll.mit.edu (LLMX2.LL.MIT.EDU [129.55.12.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AF5B012014F for ; Tue, 30 Jul 2019 12:12:19 -0700 (PDT) Received: from LLE2K16-MBX03.mitll.ad.local (LLE2K16-MBX03.mitll.ad.local) by llmx2.ll.mit.edu (unknown) with ESMTPS id x6UJCHOB020650; Tue, 30 Jul 2019 15:12:17 -0400 From: "Blumenthal, Uri - 0553 - MITLL" To: David Benjamin CC: TLS List Thread-Topic: [TLS] Options for negotiating hybrid key exchanges for postquantum Thread-Index: AdVG1haOE+yO4N1wQQSyYtQ5VKKSwAAPcm6AAARkcYAAANpzgAAAZCOA///AiwA= Date: Tue, 30 Jul 2019 19:12:15 +0000 Message-ID: <5B5A7CC1-D48A-4CB6-891A-B73F82C23F72@ll.mit.edu> References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.19.0.190512 x-originating-ip: [172.25.1.90] Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha256; boundary="B_3647344334_843929783" MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-07-30_09:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 mlxscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1906280000 definitions=main-1907300193 Archived-At: Subject: Re: [TLS] Options for negotiating hybrid key exchanges for postquantum X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 30 Jul 2019 19:12:25 -0000 --B_3647344334_843929783 Content-type: multipart/alternative; boundary="B_3647344334_1651227186" --B_3647344334_1651227186 Content-type: text/plain; charset="UTF-8" Content-transfer-encoding: quoted-printable The nuisance with just a flag is the client can't express [what I think are= ] reasonable preferences. It should be able to say things like:=20 =20 Offhand, I don=E2=80=99t see at all why the client should be able to say any of t= hese =E2=80=9Cdon=E2=80=99t=E2=80=9Ds: =20 * Don't do X25519 + P-256. This is just silly. * Don't do PQ1 on its own. I really want the PQ scheme paired with somethin= g more established. * Don't do PQ1 + PQ2. I said something more established, please. * Don't do PQ1 + X25519 + P-256. Why are you doing three of these? * Don't do PQ1 + PQ2 + PQ3 + PQ4 + X25519 + P-256 + P-384 + FFDHE2048 + FFD= HE3072, oww my head. =20 This is the only thing that IMHO the client should be able to say: =20 * PQ1 + X25519 is cool. I like that combo. =20 =20 =20 =20 On Tue, Jul 30, 2019 at 2:48 PM Andrei Popov w= rote: Given these options, I also prefer option 2, for some of the same reasons. =20 For my understanding though, why not have the client advertise support for = hybrid-key-exchange (e.g. via a =E2=80=9Cflag=E2=80=9D extension) and then KeyShareServe= rHello can contain two KeyShareEntries (essentially, using the same format a= s KeyShareClientHello? This would solve the Cartesian product issue. =20 Cheers, =20 Andrei =20 From: TLS On Behalf Of David Benjamin Sent: Tuesday, July 30, 2019 11:24 AM To: Watson Ladd Cc: TLS List Subject: Re: [TLS] Options for negotiating hybrid key exchanges for postqua= ntum =20 I think this underestimates the complexity cost of option 1 to the protocol= and implementations. Option 1 means group negotiation includes entire codep= oints whose meaning cannot be determined without a parallel extension. This = compounds across everything which interacts with named groups, impacting eve= rything from APIs to config file formats to even UI surfaces. Other uses of = NamedGroups are impacted too. For instance, option 2 fits into draft-ietf-tl= s-esni as-is. Option 1 requires injecting hybrid_extension into ESNI somehow= . Analysis must further check every use, say, incorporates this parallel loo= kup table into transcript-like measures. =20 The lesson from TLS 1.2 code points is not combined codepoints vs. split on= es. Rather, the lesson is to avoid interdependent decisions: =20 * Signature algorithms in TLS 1.2 were a mess because the ECDSA codepoints = required cross-referencing against the supported curves list. The verifier c= ould not express some preferences (signing SHA-512 with P-256 is silly, and = mixing hash+curve pairs in ECDSA is slightly off in general). As analogy to = option 1's ESNI problem, we even forgot to allow the server to express curve= preferences. TLS 1.3 combined signature algorithm considerations into a sin= gle codepoint to address all this. =20 * Cipher suites in TLS 1.2 were a mess because they were half-combined and = half-split. TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 said to use some ECDHE k= ey exchange, but you need to check if you have a NamedGroup in common first.= It said to use ECDSA, but you need to check signature algorithms (which the= mselves cross-reference curves) first. Early drafts of TLS 1.3 had it even w= orse, where a TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 full handshake morphed= into TLS_ECDHE_PSK_WITH_AES_128_GCM_SHA256 on resumption. Thus, TLS 1.3 cip= her suites negotiate solely AEAD + PRF hash. =20 In fairness to TLS 1.2, some of this was a consequence of TLS 1.2's evoluti= on over time as incremental extensions over SSL 3.0. And sometimes we do nee= d to pay costs like these. But hybrid key exchanges fit into the NamedGroup = "API" just fine, so option 2 is the clear answer. Code points are cheap. Pro= tocol complexity is much more expensive. =20 It's true that standards are often underspecified. This means the IETF shou= ld finish the job, not pass all variations through. RSA-PSS is a clear examp= le of what to avoid. It takes more bytes to merely utter "RSA-PSS with SHA-2= 56 and usual parameters" in X.509 than to encode an entire ECDSA signature! = We should not define more than a handful of options, regardless of the encod= ing.. =20 On Tue, Jul 30, 2019 at 12:18 PM Watson Ladd wrote: =20 On Tue, Jul 30, 2019, 8:21 AM Scott Fluhrer (sfluhrer) = wrote: During the physical meeting in Montreal, we had a discussion about postquan= tum security, and in particular, on how one might want to negotiate several = different =E2=80=98groups=E2=80=99 simultaneously (because there might not be one group = that is entirely trusted, and I put =E2=80=98groups=E2=80=99 in scarequotes because post= quantum key exchanges are typically not formed from a Diffie-Hellman group). =20 At the meeting, there were two options presented: =20 Option 1: as the supported group, we insert a =E2=80=98hybrid marker=E2=80=99 (and incl= ude an extension that map lists which combination the hybrid marker stands f= or) For example, the client might list in his supported groups = hybrid_marker_0 and hybrid_marker_1, and there would be a separate extension= that lists hybrid_marker_0 =3D X25519 + SIKEp434 and hybrid_marker_1 =3D X25519= + NTRUPR653. The server would then look up the meanings of hybrid_marker_0= and 1 in the extension, and then compare that against his security policy. In this option, we would ask IANA to allocate code points for the various i= ndividual postquantum key exchanges (in this example, SIKEp434 and NTRUPR653= ), as well a range of code points for the various hybrid_markers. =20 Option 2: we have code points for all the various combinations that we may = want to support; hence IANA might allocate a code point X25519_SIKEp434 and = another code point for X25519_NTRUPR653. With this option, the client would= list X25519_SIKEp434 and X25519_NTRUPR653 in their supported groups. In this option, we would ask IANA to allocate code points f= or all the various combinations that we want allow to be negotiated. =20 I would like to make an argument in favor of option 1: =20 =C2=B7 It is likely that not everyone will be satisified with =E2=80=9CX25519= plus one of a handful of specific postquantum algorithms=E2=80=9D; some may prefe= r another elliptic curve (for example, x448), or perhaps even a MODP group; = I have talked to people who do not trust ECC); in addition, other people mig= ht not trust a single postquantum algorithm, and may want to rely on both (f= or example) SIKE and NewHope (which are based on very different hard problem= s). With option 2, we could try to anticipate all the common combintations = (such as P384_SIKEp434_NEWHOPE512CCA), however that could very well end up a= s a lot of combinations. =C2=B7 There are likely to be several NIST-approved postquantum key exc= hanges, and each of those key exchanges are likely to have a number of suppo= rted parameter sets (if we take the specific postquantum key exchange as ana= logous to th ECDH protocool, the =E2=80=9Cparameter set=E2=80=9D could be thought of an = analogous to the specific elliptuc curve, and it modifies the key share size= , the performance and sometimes the security properties). In fact, one of t= he NIST submissoins currently has 30 parameter sets defined. Hence, even if= NIST doesn=E2=80=99t approve all the parameter sets (or some of them do not make = sense for TLS in any scenario), we might end up with 20 or more different ke= y exchange/parameter set combinations that do make sense for some scenario t= hat uses tLS (be it in a tranditional PC client/server, a wireless client, t= wo cloud devices communicating or an IOT device). =C2=B7 In addition, we are likely to support additional primitives in t= he future; possibly National curves (e.g. Brainpool), or additional Postquan= tum algorithms (or additional parameter sets to existing ones). Of course, = once we add that code point, we=E2=80=99ll need to add the additional code points = for all the combinations that it=E2=80=99ll make sense in (very much like we had t= o add a number of ciphersuites whenever we added a new encryption algorithm = into TLS 1.2). =20 =20 Are people actually going to use hybrid encryption post NIST? The actual de= ployments today for experiment have all fit option 2 and hybrids are unlike= ly in the future.=20 =20 My objection to 1 is it gets very messy. Do we use only the hybrids we both= support? What if I throw a bunch of expensive things together? No reason we= need a hybrid scheme!=20 =20 It seemds reasonable to me that the combination of these two factors are li= kely to cause us (should we select option 2) to define a very large number o= f code points to cover all the various options that people need. =20 Now, this is based on speculation (both of the NIST process, and additional= primitives that will be added to the protocol), and one objection I=E2=80=99ve he= ard is =E2=80=9Cwe don=E2=80=99t know what=E2=80=99s going to happen, and so why would we make= decisions based on this speculation?=E2=80=9D I agree that we have lack of knowl= edge; however it seems to me that a lack of knowledge is an argument in favo= r of selecting the more flexible option (which, in my opinion, is option 1, = as it allows the negotiation of combinations of key exchanges that the WG ha= s not anticipated). =20 My plea: lets not repeat the TLS 1.2 ciphersuite mess; lets add an extensio= n that keeps the number of code points we need to a reasonable bound. =20 The costs of option 1? =C2=B7 It does increase the complexity on the server a small amount (I=E2= =80=99m not a TLS implementor, however it would seem to me to be only a fairly s= mall amount) =C2=B7 It may increase the size of the client hello a small amount (on = the other hand, because it allows us to avoid sending duplicate key shares, = it can also reduce the size of the client hello as well, depending on what=E2=80= =99s actually negotiated) IMHO, the small increase in complexity is worth the lack of complexity in t= he code point table, and the additional flexibility it gives. _______________________________________________ TLS mailing list TLS@ietf.org https://www.ietf.org/mailman/listinfo/tls _______________________________________________ TLS mailing list TLS@ietf.org https://www.ietf.org/mailman/listinfo/tls --B_3647344334_1651227186 Content-type: text/html; charset="UTF-8" Content-transfer-encoding: quoted-printable

The nuisance with just a = flag is the client can't express [what I think are] reasonable preferences. = It should be able to say things like:

 

Offhand, I <= u>don=E2=80=99t see at all why the client should be able to say any of these =E2= =80=9Cdon=E2=80=99t=E2=80=9Ds:

 

* Don't do X25519 + P-256. This is just silly.

<= /div>

* Don't do PQ1 on its = own. I really want the PQ scheme paired with something more established.

* Don't do= PQ1 + PQ2. I said something more established, please.

* Don't do PQ1 + X25519 = + P-256. Why are you doing three of these?

* Don't do PQ1 + PQ2 + PQ3 + PQ4&nbs= p;+ X25519 + P-256 + P-384 + FFDHE2048 + FFDHE3072, oww = my head.

 

This is the only thing that IMHO the clien= t should be able to say:

 

* PQ= 1 + X25519 is cool. I like that combo.

 

 

=  

 

On Tue, Jul 30, 2019 at 2:4= 8 PM Andrei Popov <Andrei.Popov@microsoft.com> wrote:

Given = these options, I also prefer option 2, for some of the same reasons.

 

For my und= erstanding though, why not have the client advertise support for hybrid-key-= exchange (e.g. via a =E2=80=9Cflag=E2=80=9D extension) and then KeyShareServerHello can = contain two KeyShareEntries (essentially, using the same format as KeyShareC= lientHello? This would solve the Cartesian product issue.

 

Cheers,

 

Andrei

 

From:= TLS <tls-bounces@i= etf.org> On Behalf Of David Benjamin
Sent: Tuesday, = July 30, 2019 11:24 AM
To: Watson Ladd <watsonbladd@gmail.com>
Cc: = TLS List <tls@ietf.org&= gt;
Subject: Re: [TLS] Options for negotiating hybrid key exchange= s for postquantum

 

I think this underestimates the complexity cost of = option 1 to the protocol and implementations. Option 1 means group negotiati= on includes entire codepoints whose meaning cannot be determined without a p= arallel extension. This compounds across everything which interacts with nam= ed groups, impacting everything from APIs to config file formats to even UI = surfaces. Other uses of NamedGroups are impacted too. For instance, option 2= fits into draft-ietf-tls-esni as-is. Option 1 requires injecting hybri= d_extension into ESNI somehow. Analysis must further check every use, say, i= ncorporates this parallel lookup table into transcript-like measures.

 

The lesson from TLS 1.2 code points is not combined codepoints = vs. split ones. Rather, the lesson is to avoid interdependent decisions:

 

* Signature algorithms in TLS 1.2 were a mess because the EC= DSA codepoints required cross-referencing against the supported curves list.= The verifier could not express some preferences (signing SHA-512 with P-256= is silly, and mixing hash+curve pairs in ECDSA is slightly off in general).= As analogy to option 1's ESNI problem, we even forgot to allow the server t= o express curve preferences. TLS 1.3 combined signature algorithm considerat= ions into a single codepoint to address all this.

<= p class=3DMsoNormal style=3D'mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;= margin-left:.5in'> 

* Ciphe= r suites in TLS 1.2 were a mess because they were half-combined and half-spl= it. TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 said to use some ECDHE key excha= nge, but you need to check if you have a NamedGroup in common first. It said= to use ECDSA, but you need to check signature algorithms (which themselves = cross-reference curves) first. Early drafts of TLS 1.3 had it even worse, wh= ere a TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 full handshake morphed in= to TLS_ECDHE_PSK_WITH_AES_128_GCM_SHA256 on resumption. Thus, TLS 1.3 c= ipher suites negotiate solely AEAD + PRF hash.

 

In fa= irness to TLS 1.2, some of this was a consequence of TLS 1.2's evolution ove= r time as incremental extensions over SSL 3.0. And sometimes we do need to p= ay costs like these. But hybrid key exchanges fit into the NamedGroup "= API" just fine, so option 2 is the clear answer. Code points are cheap.= Protocol complexity is much more expensive.

 

It's true th= at standards are often underspecified. This means the IETF should finish the= job, not pass all variations through. RSA-PSS is a clear example of what to= avoid. It takes more bytes to merely utter "RSA-PSS with SHA-256 and u= sual parameters" in X.509 than to encode an entire ECDSA signature! We = should not define more than a handful of options, regardless of the encoding= ..

 

On Tue, Jul 30, 2019 at 12:18 PM Watson Ladd <watsonbladd@gmail.com> wr= ote:

 =

On Tue, Jul 30, 2019, 8:21 AM Scott Fluhrer= (sfluhrer) <sfluhrer= @cisco.com> wrote:

During the physical meeting in Montreal, we had a discussion about= postquantum security, and in particular, on how one might want to negotiate= several different =E2=80=98groups=E2=80=99 simultaneously (because there might not be o= ne group that is entirely trusted, and I put =E2=80=98groups=E2=80=99 in scarequotes bec= ause postquantum key exchanges are typically not formed from a Diffie-Hellma= n group).

 

At the meeting, there were t= wo options presented:

 

Option 1:= as the supported group, we insert a =E2=80=98hybrid marker=E2=80=99 (and include an ext= ension that map lists which combination the hybrid marker stands for)=

    &= nbsp;           For exampl= e, the client might list in his supported groups hybrid_marker_0 and hybrid_= marker_1, and there would be a separate extension that lists hybrid_marker_0= =3D X25519 + SIKEp434 and hybrid_marker_1 =3D X25519 + NTRUPR653.  The ser= ver would then look up the meanings of hybrid_marker_0 and 1 in the extensio= n, and then compare that against his security policy.

<= p class=3DMsoNormal style=3D'mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;= margin-left:.5in;text-indent:.5in'>In this option, we would= ask IANA to allocate code points for the various individual postquantum key= exchanges (in this example, SIKEp434 and NTRUPR653), as well a range of cod= e points for the various hybrid_markers.

 

Option 2: we have code points for all the various combinations that we may= want to support; hence IANA might allocate a code point X25519_SIKEp434 and= another code point for X25519_NTRUPR653.  With this option, the client= would list X25519_SIKEp434 and X25519_NTRUPR653 in their supported groups.<= /span>

   &= nbsp;            In t= his option, we would ask IANA to allocate code points for all the various co= mbinations that we want allow to be negotiated.

 

= I would like to make an argument in favor of option 1:

 

=C2=B7         <= /span>It is likely th= at not everyone will be satisified with =E2=80=9CX25519 plus one of a handful of s= pecific postquantum algorithms=E2=80=9D; some may prefer another elliptic curve (f= or example, x448), or perhaps even a MODP group; I have talked to people who= do not trust ECC); in addition, other people might not trust a single postq= uantum algorithm, and may want to rely on both (for example) SIKE and NewHop= e (which are based on very different hard problems).  With option 2, we= could try to anticipate all the common combintations (such as P384_SIKEp434= _NEWHOPE512CCA), however that could very well end up as a lot of combination= s.

=C2=B7      &n= bsp;  There are likely to be several NIST-approved postquantum key exchanges, = and each of those key exchanges are likely to have a number of supported par= ameter sets (if we take the specific postquantum key exchange as analogous t= o th ECDH protocool, the =E2=80=9Cparameter set=E2=80=9D could be thought of an analogou= s to the specific elliptuc curve, and it modifies the key share size, the pe= rformance and sometimes the security properties).  In fact, one of the = NIST submissoins currently has 30 parameter sets defined.  Hence, even = if NIST doesn=E2=80=99t approve all the parameter sets (or some of them do not mak= e sense for TLS in any scenario), we might end up with 20 or more different = key exchange/parameter set combinations that do make sense for some scenario= that uses tLS (be it in a tranditional PC client/server, a wireless client,= two cloud devices communicating or an IOT device).

=C2=B7         In addition, we are lik= ely to support additional primitives in the future; possibly National curves= (e.g. Brainpool), or additional Postquantum algorithms (or additional param= eter sets to existing ones).  Of course, once we add that code point, w= e=E2=80=99ll need to add the additional code points for all the combinations that = it=E2=80=99ll make sense in (very much like we had to add a number of ciphersuites= whenever we added a new encryption algorithm into TLS 1.2).

 

=

 

=

Are people actually going to use hybrid encryp= tion post NIST? The actual deployments today  for experiment have all f= it option 2 and hybrids are unlikely in the future. 

 

My objection to 1 is it gets very messy. Do we use only the hybrids we both= support? What if I throw a bunch of expensive things together? No reason we= need a hybrid scheme! 

&nb= sp;

It seemds reasonable to me that the combination of these two = factors are likely to cause us (should we select option 2) to define a very = large number of code points to cover all the various options that people nee= d.

 

Now, this is based on specul= ation (both of the NIST process, and additional primitives that will be adde= d to the protocol), and one objection I=E2=80=99ve heard is =E2=80=9Cwe don=E2=80=99t know wha= t=E2=80=99s going to happen, and so why would we make decisions based on this spec= ulation?=E2=80=9D  I agree that we have lack of knowledge; however it seems t= o me that a lack of knowledge is an argument in favor of selecting the more = flexible option (which, in my opinion, is option 1, as it allows the negotia= tion of combinations of key exchanges that the WG has not anticipated).

 

= My plea: lets not repeat the TLS 1.2 ciphersuite mess; lets add an extension= that keeps the number of code points we need to a reasonable bound.

 

The costs = of option 1?

=C2=B7      = ;   It does in= crease the complexity on the server a small amount (I=E2=80=99m not a TLS implemen= tor, however it would seem to me to be only a fairly small amount)

=C2=B7         <= /span>It may increase the size of the = client hello a small amount (on the other hand, because it allows us to avoi= d sending duplicate key shares, it can also reduce the size of the client he= llo as well, depending on what=E2=80=99s actually negotiated)

IMHO, the small increase in complexity is worth the lack of com= plexity in the code point table, and the additional flexibility it gives.

_________________________________= ______________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls

=

_______________________________________= ________
TLS mailing list
TLS@ietf.org
https:/= /www.ietf.org/mailman/listinfo/tls

--B_3647344334_1651227186-- --B_3647344334_843929783 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" MIIUfQYJKoZIhvcNAQcCoIIUbjCCFGoCAQExDzANBglghkgBZQMEAgEFADALBgkqhkiG9w0B BwGgghJDMIIE8zCCA9ugAwIBAgITWQADyHaxtc8GrYDIrgAAAAPIdjANBgkqhkiG9w0BAQsF ADBRMQswCQYDVQQGEwJVUzEfMB0GA1UECgwWTUlUIExpbmNvbG4gTGFib3JhdG9yeTEMMAoG A1UECwwDUEtJMRMwEQYDVQQDDApNSVRMTCBDQS01MB4XDTE5MDMyNjE4NDEwMVoXDTIyMDMy NTE4NDEwMVowYTELMAkGA1UEBhMCVVMxHzAdBgNVBAoTFk1JVCBMaW5jb2xuIExhYm9yYXRv cnkxDzANBgNVBAsTBlBlb3BsZTEgMB4GA1UEAxMXQmx1bWVudGhhbC5VcmkuNTAwMTA1ODQw ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCzD7FJptOjLaaidxt9QIIH/dAblMrT ESMm4ggEBR0KqbmSkRY+x45ed8E2u9fJuFWKAgwU+vJo//kzavEpAAuyhe61Z+4noWIvV0sY WkUs+ffLh+29MxDs8Mt1++mDAC1+NyLCPN8QNPRJVu7ECRtmKu3DiAtuEKva3J7lZyVVNE+3 e9HQJlr/3alifN4sg/NxOFMTKMMEq15RgOhDyAudnNSs2IesRnoKTZq/Jykwbm0fg06ePSBR /k2JuYNW8/UZnU7d/Ez2n1NEtZkQw5QzWrC27ijf7FFQxM9yLToJneFVK+krQsfvtMbHGpnz Yo9keqc3Uxb13P4mpDbZiIBTAgMBAAGjggGyMIIBrjAdBgNVHQ4EFgQUMzH1HGnW9jHVrCuy FAmJhhljwLcwDgYDVR0PAQH/BAQDAgbAMB8GA1UdIwQYMBaAFC/vu8YNHbvpav6sZ/MHOwh2 9ktZMDMGA1UdHwQsMCowKKAmoCSGImh0dHA6Ly9jcmwubGwubWl0LmVkdS9nZXRjcmwvbGxj YTUwZgYIKwYBBQUHAQEEWjBYMC0GCCsGAQUFBzAChiFodHRwOi8vY3JsLmxsLm1pdC5lZHUv Z2V0dG8vbGxjYTUwJwYIKwYBBQUHMAGGG2h0dHA6Ly9vY3NwLmxsLm1pdC5lZHUvb2NzcDA9 BgkrBgEEAYI3FQcEMDAuBiYrBgEEAYI3FQiDg+Udh+ynZoathxWD6vBFhbahHx2Fy94yh/+K cwIBZAIBCDAiBgNVHSUBAf8EGDAWBggrBgEFBQcDBAYKKwYBBAGCNwoDDDAZBgNVHREEEjAQ gQ51cmlAbGwubWl0LmVkdTAYBgNVHSAEETAPMA0GCyqGSIb3EgIBAwEIMCcGCSsGAQQBgjcU AgQaHhgATABMAFUAcwBlAHIAUwBpAGcALQBTAFcwDQYJKoZIhvcNAQELBQADggEBACztsHHc HX+FTwlhjHUUU+AcLyX3hgIdnTovNmPWVhVgzpN25AotcwODhCwuaLNoLsC0OHRISFUvkqHg 7aeZ9CiDOL4KwlNZgzGpDlqZ/AgMJ+JodWz0XqoNm4wYNs2rl7sEzLe70yPVyzTYlhECYnex UxE4hL334w/cx+Mb8vKn+/EQ9NFKVfCJ8X1dDkCA19EkZu2DbFF2oAM0kr6JX2dNx1rChTMZ iOSkGkKKpnVNFBMl/uw8qH8XrD+slPhLpTQg5t9l0pCtkJSMnrMovPvgwhlOP7yCLdPYYTwY IjwvUeqj1VAvid80L9vevRY1D6NDz/eWfoqCxXxPvtue//owggTAMIIDqKADAgECAgEGMA0G CSqGSIb3DQEBCwUAMFYxCzAJBgNVBAYTAlVTMR8wHQYDVQQKExZNSVQgTGluY29sbiBMYWJv cmF0b3J5MQwwCgYDVQQLEwNQS0kxGDAWBgNVBAMTD01JVExMIFJvb3QgQ0EtMjAeFw0xNzAz MDIxMjAwMDBaFw0yNjAzMDIyMzU5NTlaMFExCzAJBgNVBAYTAlVTMR8wHQYDVQQKDBZNSVQg TGluY29sbiBMYWJvcmF0b3J5MQwwCgYDVQQLDANQS0kxEzARBgNVBAMMCk1JVExMIENBLTUw ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCnmoMOvTkfw7nq19mrWazGaa+Q83Uv 0+ATXT3q6kr+WExIMIZ87C74WCcRXpvO7uvx7HvMsYWAFHW93wQwhjytxHIOZgKNJ4VnGVDU l+KI7g0n9+Zjt3hB3HhHbcvbe9+Y4jz+XzCiLl2OaYvICKbxvbBSCLtPEeZQ6x6Tb6EK0ym0 gvYeHO3kuuY+SJHJMltbrLnIVLxjZrNVS77zXKvu6Q3hSdkRIB7kJgEXfL+p/z/2p94bEEZ2 TnQz0TkOjG+Jq7UlXlFRtvsYcDPEQD3UNkZsWcXgC1hXG8TGknUcAhlGxVhlKlFLmNd7342s eGy2s9YxNDnSE+eXTtb0I5LLAgMBAAGjggGcMIIBmDASBgNVHRMBAf8ECDAGAQH/AgEAMB0G A1UdDgQWBBQv77vGDR276Wr+rGfzBzsIdvZLWTAfBgNVHSMEGDAWgBT/ycllTFOA8akMPCGu girH7vgy+zAOBgNVHQ8BAf8EBAMCAYYwZwYIKwYBBQUHAQEEWzBZMC4GCCsGAQUFBzAChiJo dHRwOi8vY3JsLmxsLm1pdC5lZHUvZ2V0dG8vTExSQ0EyMCcGCCsGAQUFBzABhhtodHRwOi8v b2NzcC5sbC5taXQuZWR1L29jc3AwNAYDVR0fBC0wKzApoCegJYYjaHR0cDovL2NybC5sbC5t aXQuZWR1L2dldGNybC9MTFJDQTIwgZIGA1UdIASBijCBhzANBgsqhkiG9xICAQMBBjANBgsq hkiG9xICAQMBCDANBgsqhkiG9xICAQMBBzANBgsqhkiG9xICAQMBCTANBgsqhkiG9xICAQMB CjANBgsqhkiG9xICAQMBCzANBgsqhkiG9xICAQMBDjANBgsqhkiG9xICAQMBDzANBgsqhkiG 9xICAQMBEDANBgkqhkiG9w0BAQsFAAOCAQEAMJYRwLPJ91K7e2mA2Nj10W0o5JMHYkaa+ctL 8/xY8QzIHFI5Ij+iydpPN9KCYn/4Sy80T3aNoYkFlS0GRQXhf0nsiY7TWJwAKw4AiO/yJ37/ oRKRgtyRicvaJ6RjlHCXBOalFLw9UtpodP4/idC51lxzsolaQZraBjVe7PL95PhS7D+22Nff InzLdIb1DBf54NwOVfPIgABtxH1fhZrja7EhR9RoUw5E1O6iWaAuP/xWhSTQFWlhyA0/kkIi 9/HXaY0hYnhcjcbPPqjpyfIhSFjjXhjqK7t2wPrSrBFLFUbnLiNlgQHrvNYF5IqgIfnSBWIr m3rfLhpZZJ/xJ7Yf6DCCA4owggJyoAMCAQICAQEwDQYJKoZIhvcNAQELBQAwVjELMAkGA1UE BhMCVVMxHzAdBgNVBAoTFk1JVCBMaW5jb2xuIExhYm9yYXRvcnkxDDAKBgNVBAsTA1BLSTEY MBYGA1UEAxMPTUlUTEwgUm9vdCBDQS0yMB4XDTE2MDQyMDEyMDAwMFoXDTM1MDQxOTIzNTk1 OVowVjELMAkGA1UEBhMCVVMxHzAdBgNVBAoTFk1JVCBMaW5jb2xuIExhYm9yYXRvcnkxDDAK BgNVBAsTA1BLSTEYMBYGA1UEAxMPTUlUTEwgUm9vdCBDQS0yMIIBIjANBgkqhkiG9w0BAQEF AAOCAQ8AMIIBCgKCAQEAv3WoBEGOOJtm4ucvaf6vKIFPs8watCd6Smwq/XeRNo7P3jPIxNPw F398RGDUmPJIXA7idzD6j0opFIW+kLqYye9e788PV0dqaJlX8818fNDbSE+8B6hieqKTR7Vf OI74UVQEUKVRFuRFw6uVYuvgew2Tj/C2dEee37eruQl5nHkbV2OsWnZ7O+yt+etd6HRcaXLl P9q8WKgA3B7vkOVIMCKoAuaWj+BFq7K+WNkiyi/KdOH9JmOpbyRK4jcA7xbLnF8JFUSNg5c4 Y1BJrFaZtkCeG6Nm9p524GllkRFzPgpj8VicV+AK+9rY07dTx02kYotTnKuy0YxBAwsUXxAQ EwIDAQABo2MwYTAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBT/ycllTFOA8akMPCGugirH 7vgy+zAfBgNVHSMEGDAWgBT/ycllTFOA8akMPCGugirH7vgy+zAOBgNVHQ8BAf8EBAMCAYYw DQYJKoZIhvcNAQELBQADggEBAHqYfEf/3J5aMKhlYQ0PnUAbMB8jZSr9/HvjfOF00crFUCfS rqG8JQwo+S/iq66gcp62FEgJ0fQkDgVg6m+C2ETo1LoWiSxhYCfcSIQECljlXwR8wFSayF82 2S69IqvHhdq4d58jU6gYi6ssjU4vwsvsVLRJKk/m/Cg/w8gW6YHM5ahBD6/5Ccel2fI7oSms kO991+otrC11YfDwCFvz7Am0r+K9iVhSWta4hmIuV0YBia07eZKSO02LPgQ8YOz3ku0Yt+mh 8VWRKux2CcYjMpk+WDV0BMp75tqb6pqBFkcKvEBXqxg+8+G/umjii4H0c5kvJhaQyykbmOKm xO9IcJIwggT2MIID3qADAgECAhNZAAA7OX5fo0OiIK0RAAAAADs5MA0GCSqGSIb3DQEBCwUA MFExCzAJBgNVBAYTAlVTMR8wHQYDVQQKDBZNSVQgTGluY29sbiBMYWJvcmF0b3J5MQwwCgYD VQQLDANQS0kxEzARBgNVBAMMCk1JVExMIENBLTUwHhcNMTgwODI4MjE0NTI5WhcNMjEwODI3 MjE0NTI5WjBhMQswCQYDVQQGEwJVUzEfMB0GA1UEChMWTUlUIExpbmNvbG4gTGFib3JhdG9y eTEPMA0GA1UECxMGUGVvcGxlMSAwHgYDVQQDExdCbHVtZW50aGFsLlVyaS41MDAxMDU4NDCC ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAI5Vc19RKc/69lmwhogDOjjzPQbmc8s6 Z6rzP6oUHAswDICqZWwPt+FTbKr0YTAqRNsTEN4YiW0fORK+fNRvClo0pdiCqj3DwDQZLRI4 Dak1yTsUtVe35oomQbXtO+0A0L/CowYri/UKeRG1i1/0cXSf4mAx0ed9wh2SordAb8o2FuOU 0B2ppnqjro1VFugHHX6QOggaeLFOprT5gnTZUmqM37/d4DGB9XDdTQi144zQSwSWKkaUThsy D9CHSRNcB79HBvlZGSM+BkIbayPdhQAuz4yKsOZEWPx/6LnMotzBevSswnCDf+u9ajCgMnje WbrZRN+xoYEuhycXyK2b8/MCAwEAAaOCAbUwggGxMB0GA1UdDgQWBBTZUpq7Rsccv42yU9UQ 4wvojOl4pzAOBgNVHQ8BAf8EBAMCBSAwHwYDVR0jBBgwFoAUL++7xg0du+lq/qxn8wc7CHb2 S1kwMwYDVR0fBCwwKjAooCagJIYiaHR0cDovL2NybC5sbC5taXQuZWR1L2dldGNybC9sbGNh NTBmBggrBgEFBQcBAQRaMFgwLQYIKwYBBQUHMAKGIWh0dHA6Ly9jcmwubGwubWl0LmVkdS9n ZXR0by9sbGNhNTAnBggrBgEFBQcwAYYbaHR0cDovL29jc3AubGwubWl0LmVkdS9vY3NwMD0G CSsGAQQBgjcVBwQwMC4GJisGAQQBgjcVCIOD5R2H7Kdmhq2HFYPq8EWFtqEfHYXr0HCD6+0g AgFkAgEJMCUGA1UdJQQeMBwGBFUdJQAGCCsGAQUFBwMEBgorBgEEAYI3CgMEMBkGA1UdEQQS MBCBDnVyaUBsbC5taXQuZWR1MBgGA1UdIAQRMA8wDQYLKoZIhvcSAgEDAQgwJwYJKwYBBAGC NxQCBBoeGABMAEwAVQBzAGUAcgBFAG4AYwAtAFMAVzANBgkqhkiG9w0BAQsFAAOCAQEACyN6 Yhi9LApOPpf60ypSV2WmV3sqnrsrdlPTW+am4wMK/M/5PZmt5jFVtXaErkWYdrbMdjeo2o/G 9N2DnrFOhz7kDYM9HC9AH/rWCfoSkI/C2N6Rq/uDnRJfao61wyv37qKtanNdkp+reyLxdVPn foVrD/VZli4UV28u4XBuYDkjXPyyiH+bb395FnxOtTA3Uz41Ohpdvr6oLPEuy0IP4MPfK5wD mS6GXcB+ze9sYEp+DJxE7WAbkW5Y536WPl/rfWm/k6ZC1KPVSRM7mS+atk44VOgzPLXkl6Tu 6zY8tMczfr5F0om1JfN8G50s4QDUGtsMgzW+LXVDhFD24xnUojGCAf4wggH6AgEBMGgwUTEL MAkGA1UEBhMCVVMxHzAdBgNVBAoMFk1JVCBMaW5jb2xuIExhYm9yYXRvcnkxDDAKBgNVBAsM A1BLSTETMBEGA1UEAwwKTUlUTEwgQ0EtNQITWQADyHaxtc8GrYDIrgAAAAPIdjANBglghkgB ZQMEAgEFAKBpMC8GCSqGSIb3DQEJBDEiBCAM2NOtqKtaPvpkg4tAAcZ11BSInJlOTjRHNSif dqYV+DAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0xOTA3MzAx OTEyMTRaMA0GCSqGSIb3DQEBAQUABIIBAGXgXhIloYgtSI0ZUynbZ/hRLyKf21/ktaIGSA6H TE0oTnrKnjWvXxkOX0QzAngQf+jgobHTCGjFncXTNbBDgOVMCmQttpKMa5vMSCJeXHH3pguw rDNwMM8SL6+9gViUy+3O5hl7+copfaHwnzK+9zWg3B2IODBBuSpN2fFSUF4ljP5UUym4MsXe 7GNvpDEBtoK/43X7q/1B640ih8UR0U+5Uh6mAKYRIrlJXtcRvQTbDNeqgrshTXS/tntaczPb +pAjyvUOkqwYjwRE3eGic8vy/ldqRRaXfZoYEe/k5+owypC4YjS7sBQLIFdffNgt3J+1c2WH SCBT9T4O7fTbv/8= --B_3647344334_843929783-- From nobody Tue Jul 30 12:36:51 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A0E26120156 for ; Tue, 30 Jul 2019 12:36:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.499 X-Spam-Level: X-Spam-Status: No, score=-14.499 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=FwG7st/q; dkim=pass (1024-bit key) header.d=cisco.onmicrosoft.com header.b=Pa2Zorry Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id u802AfS-DSXZ for ; Tue, 30 Jul 2019 12:36:36 -0700 (PDT) Received: from rcdn-iport-1.cisco.com (rcdn-iport-1.cisco.com [173.37.86.72]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E6B3312001E for ; Tue, 30 Jul 2019 12:36:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=23615; q=dns/txt; s=iport; t=1564515395; x=1565724995; h=from:to:subject:date:message-id:references:in-reply-to: mime-version; bh=LR5iyZqFjAbM+cbDfz3imA8Q1cG57QFwbwouzhDik/M=; b=FwG7st/qieLzmB4k7Y3ynlNEfcDcGSofvD5K4HR6c9U+YOOQ8r419IYC IEQlif7Lnfb5gNhrmh8Vig34BC8UcLOreAp4qPLizhQD8U6bETjXQZj2q 4k84tDWktMw05/ICMhPJ80YciG5L/QSpvznIMqXuD/D512UfmKqBPzv4W I=; IronPort-PHdr: =?us-ascii?q?9a23=3A++wyxxxHu64o1fzXCy+N+z0EezQntrPoPwUc9p?= =?us-ascii?q?sgjfdUf7+++4j5YhWN/u1j2VnOW4iTq+lJjebbqejBYSQB+t7A1RJKa5lQT1?= =?us-ascii?q?kAgMQSkRYnBZudCkT+NPfsZgQxHd9JUxlu+HToeUU=3D?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0D6AAAFm0Bd/5pdJa1lGgEBAQEBAgE?= =?us-ascii?q?BAQEHAgEBAQGBZ4EVL1ADbVUgBAsqCodbA40FTIIPfpZWglIDVAkBAQEMAQE?= =?us-ascii?q?tAgEBhEACgkIjOBMBAwEBBAEBAgEGbYUeDIVKAQEBAQMSGxMBATgPAgEIEQQ?= =?us-ascii?q?BASEOMh0IAQEEARIIGoMBgR1NAx0BAqFZAoE4iGCCI4J6AQEFhQ0YghMJgTS?= =?us-ascii?q?LYBeBQD+BEUaCFwcuPoFUgloYgzuCJowFh3mWFm0JAoIalDGYEY09l1oCBAI?= =?us-ascii?q?EBQIOAQEFgWchgVhwFTuCbIJCg3GKU3KBKYwsAYEgAQE?= X-IronPort-AV: E=Sophos;i="5.64,327,1559520000"; d="scan'208,217";a="605684453" Received: from rcdn-core-3.cisco.com ([173.37.93.154]) by rcdn-iport-1.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 30 Jul 2019 19:36:34 +0000 Received: from XCH-ALN-013.cisco.com (xch-aln-013.cisco.com [173.36.7.23]) by rcdn-core-3.cisco.com (8.15.2/8.15.2) with ESMTPS id x6UJaYg0018138 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL) for ; Tue, 30 Jul 2019 19:36:34 GMT Received: from xhs-aln-003.cisco.com (173.37.135.120) by XCH-ALN-013.cisco.com (173.36.7.23) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Tue, 30 Jul 2019 14:36:33 -0500 Received: from xhs-rtp-001.cisco.com (64.101.210.228) by xhs-aln-003.cisco.com (173.37.135.120) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Tue, 30 Jul 2019 14:36:24 -0500 Received: from NAM02-BL2-obe.outbound.protection.outlook.com (64.101.32.56) by xhs-rtp-001.cisco.com (64.101.210.228) with Microsoft SMTP Server (TLS) id 15.0.1473.3 via Frontend Transport; Tue, 30 Jul 2019 15:36:24 -0400 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=TcM6ViV1m6JDOY+mInvRC/83KtqOH5QgOyjLi/fPXsNfa294pqfrsq0b1P+vPTAW+hMyzZSSXCYdUcN96HCn0tB+zdsKc5L6r40bqcgOtzEWmNv4X+bWKylQt6jhKIpkv5auTomjLSow/6f5RUs8VyXW0h9BLVOmxLYhmO2N5WtEs4193yhU15lTvmqHwLYXVgr/2ny8l7lMCY3mneULyGgmq8lY7oF7YJ+5tJR/XDqfF5My0f8PDm0mspAYLa79cyw4vx39XSv9bmD4eGBv//HAfxgbJWIJ3kiPkTGt5khol+Jfksnb4pkS/3bcDfZYDHNCNC8c/5A23j2CF0tXtg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=4qrOD8dXiDW31B4tyt69+d1n/siZHXGf66DQ3LnwNaQ=; b=Hh4ArAnHFfSHDU62dTfKq0rUCKgWd55MuWVSXl1zY85XZfb60oh/6yQJBqwHjJN7aUsOoeyuw9peDTM11jCR7A+nQRG+91FxFkkDga0G72BpaicwYTWqYuCZCtcfowOU4b9CMAjMMWdlJZyDlDr+135qT7sirR1FM4uMHCMhyKf4UaipOV6hrLzEBRZ/NIVPURysjOyJ6vRqOOewce8r7pHmcfm/X+wfU/l6h7yKFu4L5Jp0/sUyuoGxFJCSAmas8yLMcSEfJrNd/f98Y7SO8yMqW/NykIS7/Weuve+x0nZZgvlbmYnw6UQ+lbKU3RR8uR06OXD9Fd/mHKKx+GEcmA== ARC-Authentication-Results: i=1; mx.microsoft.com 1;spf=pass smtp.mailfrom=cisco.com;dmarc=pass action=none header.from=cisco.com;dkim=pass header.d=cisco.com;arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector2-cisco-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=4qrOD8dXiDW31B4tyt69+d1n/siZHXGf66DQ3LnwNaQ=; b=Pa2ZorryHuR6sS9/m8xPbSjoLDRpVwOY4jbF1VfWvsVOdptPfSjy2s5M/Naw9flU8fPENEpgjxr5QkOdy0p8c8EJb6bUb1Lf6umPd3eGhRh4fXtnPdtYRppfqeAsxsDkXA7v6JMqyGloDkBzewp/cJS3C08kATpbHQWKMMAZwyQ= Received: from DM6PR11MB2555.namprd11.prod.outlook.com (20.176.98.161) by DM6PR11MB3675.namprd11.prod.outlook.com (20.178.231.76) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2115.14; Tue, 30 Jul 2019 19:36:23 +0000 Received: from DM6PR11MB2555.namprd11.prod.outlook.com ([fe80::61ac:42a5:2f3e:5e70]) by DM6PR11MB2555.namprd11.prod.outlook.com ([fe80::61ac:42a5:2f3e:5e70%7]) with mapi id 15.20.2115.005; Tue, 30 Jul 2019 19:36:23 +0000 From: "Panos Kampanakis (pkampana)" To: "Scott Fluhrer (sfluhrer)" , "" Thread-Topic: Options for negotiating hybrid key exchanges for postquantum Thread-Index: AdVG1haOE+yO4N1wQQSyYtQ5VKKSwAAN/CPg Date: Tue, 30 Jul 2019 19:36:23 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=pkampana@cisco.com; x-originating-ip: [173.38.117.86] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 810f498f-20c7-4a7b-c47f-08d71525346d x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(5600148)(711020)(4605104)(1401327)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(2017052603328)(7193020); SRVR:DM6PR11MB3675; x-ms-traffictypediagnostic: DM6PR11MB3675: x-ms-exchange-purlcount: 2 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-forefront-prvs: 0114FF88F6 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(4636009)(346002)(39860400002)(136003)(376002)(396003)(366004)(189003)(199004)(15404003)(64756008)(68736007)(14454004)(6306002)(81166006)(55016002)(8676002)(71190400001)(71200400001)(3846002)(25786009)(2906002)(81156014)(478600001)(9686003)(6116002)(6436002)(8936002)(54896002)(33656002)(53936002)(446003)(26005)(6246003)(66476007)(53546011)(66446008)(66574012)(66946007)(66066001)(86362001)(52536014)(76116006)(186003)(14444005)(5660300002)(7696005)(476003)(229853002)(256004)(790700001)(7736002)(486006)(110136005)(76176011)(6506007)(74316002)(102836004)(11346002)(99286004)(316002)(66556008)(491001); DIR:OUT; SFP:1101; SCL:1; SRVR:DM6PR11MB3675; H:DM6PR11MB2555.namprd11.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: cisco.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: POcJ8sE930pJ0r0BZSD1xsbZNw41+rdUoMnUGGIzFDHEwx3e0XBT84+OydlKGMd32D7bkohMlwjhPuNwl27voEKVyBUXzg1GCRuhKofnV8x26tnL/vF924ZSYTHN6AEWS9FW1UcUqCPIHovFUiCiu1eAQieVytg5ioZcIHEHQjkrxm2/eCrvdUIKs/DkDhOherqBW7wOnePRMgTUvaamz4iCnhmH6mGgGX1kmeBU7goDEbyQ6EPXywWUyZkIwV//brR0n8PfuCyanbP7Ia+vEiNnB/HBoeq4NwUk892cuarCdc31O7k/hB8kYhBF08Nfko/luo6ipmF+bfAgBKcs/id03j2Ee4Emr4vQM4MfpNIONz1RtneRKO+SKrCs9ZuiMFnwtEZsYUMFc2cPDN4LOI+yQvi6t/krimHbSZU7e2g= Content-Type: multipart/alternative; boundary="_000_DM6PR11MB2555BB65C283C0F08C4F7E3AC9DC0DM6PR11MB2555namp_" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: 810f498f-20c7-4a7b-c47f-08d71525346d X-MS-Exchange-CrossTenant-originalarrivaltime: 30 Jul 2019 19:36:23.0998 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: pkampana@cisco.com X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR11MB3675 X-OriginatorOrg: cisco.com X-Outbound-SMTP-Client: 173.36.7.23, xch-aln-013.cisco.com X-Outbound-Node: rcdn-core-3.cisco.com Archived-At: Subject: Re: [TLS] Options for negotiating hybrid key exchanges for postquantum X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 30 Jul 2019 19:36:41 -0000 --_000_DM6PR11MB2555BB65C283C0F08C4F7E3AC9DC0DM6PR11MB2555namp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable +1 for option 2. The combinatoric explosion and complexity of 1 is unnecess= ary. I expect that just a few, conservative, acceptably efficient, classica= l+PQ combinations need to be standardized and used. Combining a classical a= lgo with more than one postquantum algorithms in a key exchange does not se= em practical based on the PQ candidates key sizes and performance. Panos From: TLS On Behalf Of Scott Fluhrer (sfluhrer) Sent: Tuesday, July 30, 2019 11:21 AM To: Subject: [TLS] Options for negotiating hybrid key exchanges for postquantum During the physical meeting in Montreal, we had a discussion about postquan= tum security, and in particular, on how one might want to negotiate several= different 'groups' simultaneously (because there might not be one group th= at is entirely trusted, and I put 'groups' in scarequotes because postquant= um key exchanges are typically not formed from a Diffie-Hellman group). At the meeting, there were two options presented: Option 1: as the supported group, we insert a 'hybrid marker' (and include = an extension that map lists which combination the hybrid marker stands for) For example, the client might list in his supported groups = hybrid_marker_0 and hybrid_marker_1, and there would be a separate extensio= n that lists hybrid_marker_0 =3D X25519 + SIKEp434 and hybrid_marker_1 =3D = X25519 + NTRUPR653. The server would then look up the meanings of hybrid_m= arker_0 and 1 in the extension, and then compare that against his security = policy. In this option, we would ask IANA to allocate code points for the various i= ndividual postquantum key exchanges (in this example, SIKEp434 and NTRUPR65= 3), as well a range of code points for the various hybrid_markers. Option 2: we have code points for all the various combinations that we may = want to support; hence IANA might allocate a code point X25519_SIKEp434 and= another code point for X25519_NTRUPR653. With this option, the client wou= ld list X25519_SIKEp434 and X25519_NTRUPR653 in their supported groups. In this option, we would ask IANA to allocate code points f= or all the various combinations that we want allow to be negotiated. I would like to make an argument in favor of option 1: * It is likely that not everyone will be satisified with "X25519 plus o= ne of a handful of specific postquantum algorithms"; some may prefer anothe= r elliptic curve (for example, x448), or perhaps even a MODP group; I have = talked to people who do not trust ECC); in addition, other people might not= trust a single postquantum algorithm, and may want to rely on both (for ex= ample) SIKE and NewHope (which are based on very different hard problems). = With option 2, we could try to anticipate all the common combintations (su= ch as P384_SIKEp434_NEWHOPE512CCA), however that could very well end up as = a lot of combinations. * There are likely to be several NIST-approved postquantum key exchange= s, and each of those key exchanges are likely to have a number of supported= parameter sets (if we take the specific postquantum key exchange as analog= ous to th ECDH protocool, the "parameter set" could be thought of an analog= ous to the specific elliptuc curve, and it modifies the key share size, the= performance and sometimes the security properties). In fact, one of the N= IST submissoins currently has 30 parameter sets defined. Hence, even if NI= ST doesn't approve all the parameter sets (or some of them do not make sens= e for TLS in any scenario), we might end up with 20 or more different key e= xchange/parameter set combinations that do make sense for some scenario tha= t uses tLS (be it in a tranditional PC client/server, a wireless client, tw= o cloud devices communicating or an IOT device). * In addition, we are likely to support additional primitives in the fu= ture; possibly National curves (e.g. Brainpool), or additional Postquantum = algorithms (or additional parameter sets to existing ones). Of course, onc= e we add that code point, we'll need to add the additional code points for = all the combinations that it'll make sense in (very much like we had to add= a number of ciphersuites whenever we added a new encryption algorithm into= TLS 1.2). It seemds reasonable to me that the combination of these two factors are li= kely to cause us (should we select option 2) to define a very large number = of code points to cover all the various options that people need. Now, this is based on speculation (both of the NIST process, and additional= primitives that will be added to the protocol), and one objection I've hea= rd is "we don't know what's going to happen, and so why would we make decis= ions based on this speculation?" I agree that we have lack of knowledge; h= owever it seems to me that a lack of knowledge is an argument in favor of s= electing the more flexible option (which, in my opinion, is option 1, as it= allows the negotiation of combinations of key exchanges that the WG has no= t anticipated). My plea: lets not repeat the TLS 1.2 ciphersuite mess; lets add an extensio= n that keeps the number of code points we need to a reasonable bound. The costs of option 1? * It does increase the complexity on the server a small amount (I'm not= a TLS implementor, however it would seem to me to be only a fairly small a= mount) * It may increase the size of the client hello a small amount (on the o= ther hand, because it allows us to avoid sending duplicate key shares, it c= an also reduce the size of the client hello as well, depending on what's ac= tually negotiated) IMHO, the small increase in complexity is worth the lack of complexity in t= he code point table, and the additional flexibility it gives. --_000_DM6PR11MB2555BB65C283C0F08C4F7E3AC9DC0DM6PR11MB2555namp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

+1 for option 2. T= he combinatoric explosion and complexity of 1 is unnecessary. I expect that= just a few, conservative, acceptably efficient, classical+PQ combinati= ons need to be standardized and used. Combining a classical algo with more than one postquantum algorithms in a key exchan= ge does not seem practical based on the PQ candidates key sizes and perform= ance.

 

Panos

 

 

From: TLS <tls-bounces@ietf.org> On = Behalf Of Scott Fluhrer (sfluhrer)
Sent: Tuesday, July 30, 2019 11:21 AM
To: <tls@ietf.org> <tls@ietf.org>
Subject: [TLS] Options for negotiating hybrid key exchanges for post= quantum

 

During the physical meeting in Montreal, we had a di= scussion about postquantum security, and in particular, on how one might wa= nt to negotiate several different ‘groups’ simultaneously (beca= use there might not be one group that is entirely trusted, and I put ‘groups’ in scarequotes because postquantum= key exchanges are typically not formed from a Diffie-Hellman group).<= /o:p>

 

At the meeting, there were two = options presented:

 

Option 1: as the supported grou= p, we insert a ‘hybrid marker’ (and include an extension that m= ap lists which combination the hybrid marker stands for)<= /p>

     &= nbsp;          For example, th= e client might list in his supported groups hybrid_marker_0 and hybrid_mark= er_1, and there would be a separate extension that lists hybrid_marker_0 = =3D X25519 + SIKEp434 and hybrid_marker_1 =3D X25519 + NTRUPR653.  The server would then look up the meanin= gs of hybrid_marker_0 and 1 in the extension, and then compare that against= his security policy.

In t= his option, we would ask IANA to allocate code points for the various indiv= idual postquantum key exchanges (in this example, SIKEp434 and NTRUPR653), = as well a range of code points for the various hybrid_markers.

 

Option 2: we have code points f= or all the various combinations that we may want to support; hence IANA mig= ht allocate a code point X25519_SIKEp434 and another code point for X25519_= NTRUPR653.  With this option, the client would list X25519_SIKEp434 and X25519_NTRUPR653 in their supported groups.=

     &= nbsp;          In this option,= we would ask IANA to allocate code points for all the various combinations= that we want allow to be negotiated.

 

I would like to make an argumen= t in favor of option 1:

 

  • It is likely that not everyone will be satisifie= d with “X25519 plus one of a handful of specific postquantum algorith= ms”; some may prefer another elliptic curve (for example, x448), or perhaps even a MODP group; I have talked to people= who do not trust ECC); in addition, other people might not trust a single = postquantum algorithm, and may want to rely on both (for example) SIKE and = NewHope (which are based on very different hard problems).  With option 2, we could try to anticipate = all the common combintations (such as P384_SIKEp434_NEWHOPE512CCA), however= that could very well end up as a lot of combinations.
  • There are likely to be several NIST-approved p= ostquantum key exchanges, and each of those key exchanges are likely to hav= e a number of supported parameter sets (if we take the specific postquantum key exchange as analogous to th ECDH prot= ocool, the “parameter set” could be thought of an analogous to = the specific elliptuc curve, and it modifies the key share size, the perfor= mance and sometimes the security properties).  In fact, one of the NIST submissoins currently has 30 parameter sets defin= ed.  Hence, even if NIST doesn’t approve all the parameter sets = (or some of them do not make sense for TLS in any scenario), we might end u= p with 20 or more different key exchange/parameter set combinations that do make sense for some scenario that uses tLS (be it= in a tranditional PC client/server, a wireless client, two cloud devices c= ommunicating or an IOT device).
  • In addition, we are likely to support additional primitives in the fu= ture; possibly National curves (e.g. Brainpool), or additional Postquantum = algorithms (or additional parameter sets to existing ones).  Of course, once we add that code p= oint, we’ll need to add the additional code points for all the combin= ations that it’ll make sense in (very much like we had to add a numbe= r of ciphersuites whenever we added a new encryption algorithm into TLS 1.2).

 

It seemds reasonable to me that= the combination of these two factors are likely to cause us (should we sel= ect option 2) to define a very large number of code points to cover all the= various options that people need.

 

Now, this is based on speculati= on (both of the NIST process, and additional primitives that will be added = to the protocol), and one objection I’ve heard is “we don’= ;t know what’s going to happen, and so why would we make decisions based on this speculation?”  I agree that we have lac= k of knowledge; however it seems to me that a lack of knowledge is an argum= ent in favor of selecting the more flexible option (which, in my opinion, i= s option 1, as it allows the negotiation of combinations of key exchanges that the WG has not anticipated).=

 

My plea: lets not repeat the TLS 1.2 ciphersuite mes= s; lets add an extension that keeps the number of code points we need to a = reasonable bound.

 

The costs of option 1?

  • It does increase the complexity on the server a small amount (I’= ;m not a TLS implementor, however it would seem to me to be only a fairly s= mall amount)
  • It may increase the size of the client he= llo a small amount (on the other hand, because it allows us to avoid sendin= g duplicate key shares, it can also reduce the size of the client hello as well, depending on what’s actually negotiated)

IMHO, the small increase in complexity is worth the = lack of complexity in the code point table, and the additional flexibility = it gives.

--_000_DM6PR11MB2555BB65C283C0F08C4F7E3AC9DC0DM6PR11MB2555namp_-- From nobody Tue Jul 30 12:41:34 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CD8F312001E for ; Tue, 30 Jul 2019 12:41:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.194 X-Spam-Level: X-Spam-Status: No, score=-4.194 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_NONE=0.001, UNPARSEABLE_RELAY=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yTectNjuCYd2 for ; Tue, 30 Jul 2019 12:41:27 -0700 (PDT) Received: from llmx3.ll.mit.edu (LLMX3.LL.MIT.EDU [129.55.12.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B005012010F for ; Tue, 30 Jul 2019 12:41:27 -0700 (PDT) Received: from LLE2K16-MBX02.mitll.ad.local (LLE2K16-MBX02.mitll.ad.local) by llmx3.ll.mit.edu (unknown) with ESMTPS id x6UJfNHP022986; Tue, 30 Jul 2019 15:41:23 -0400 From: "Blumenthal, Uri - 0553 - MITLL" To: "Panos Kampanakis (pkampana)" , "Scott Fluhrer (sfluhrer)" , "" Thread-Topic: [TLS] Options for negotiating hybrid key exchanges for postquantum Thread-Index: AQHVRw7EE+yO4N1wQQSyYtQ5VKKSwA== Date: Tue, 30 Jul 2019 19:41:22 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.19.0.190512 x-originating-ip: [172.25.1.85] Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha256; boundary="B_3647346082_1004216318" MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-07-30_09:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 mlxscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1906280000 definitions=main-1907300198 Archived-At: Subject: Re: [TLS] Options for negotiating hybrid key exchanges for postquantum X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 30 Jul 2019 19:41:31 -0000 --B_3647346082_1004216318 Content-type: multipart/alternative; boundary="B_3647346082_730350364" --B_3647346082_730350364 Content-type: text/plain; charset="UTF-8" Content-transfer-encoding: quoted-printable One more thing: I would expect to use SIDH rather than SIKE.=20 =20 Because to emulate the security advantages of DH, you=E2=80=99d have to run two S= IKE=E2=80=99s =E2=80=93 one in each direction. =20 =20 From: TLS on behalf of "Panos Kampanakis (pkampana)"= Date: Tuesday, July 30, 2019 at 3:37 PM To: "Scott Fluhrer (sfluhrer)" , "" Subject: Re: [TLS] Options for negotiating hybrid key exchanges for postqua= ntum =20 +1 for option 2. The combinatoric explosion and complexity of 1 is unnecess= ary. I expect that just a few, conservative, acceptably efficient, classical= +PQ combinations need to be standardized and used. Combining a classical alg= o with more than one postquantum algorithms in a key exchange does not seem = practical based on the PQ candidates key sizes and performance. =20 Panos =20 =20 From: TLS On Behalf Of Scott Fluhrer (sfluhrer) Sent: Tuesday, July 30, 2019 11:21 AM To: Subject: [TLS] Options for negotiating hybrid key exchanges for postquantum =20 During the physical meeting in Montreal, we had a discussion about postquan= tum security, and in particular, on how one might want to negotiate several = different =E2=80=98groups=E2=80=99 simultaneously (because there might not be one group = that is entirely trusted, and I put =E2=80=98groups=E2=80=99 in scarequotes because post= quantum key exchanges are typically not formed from a Diffie-Hellman group). =20 At the meeting, there were two options presented: =20 Option 1: as the supported group, we insert a =E2=80=98hybrid marker=E2=80=99 (and incl= ude an extension that map lists which combination the hybrid marker stands f= or) For example, the client might list in his supported groups = hybrid_marker_0 and hybrid_marker_1, and there would be a separate extension= that lists hybrid_marker_0 =3D X25519 + SIKEp434 and hybrid_marker_1 =3D X25519= + NTRUPR653. The server would then look up the meanings of hybrid_marker_0= and 1 in the extension, and then compare that against his security policy. In this option, we would ask IANA to allocate code points for the various i= ndividual postquantum key exchanges (in this example, SIKEp434 and NTRUPR653= ), as well a range of code points for the various hybrid_markers. =20 Option 2: we have code points for all the various combinations that we may = want to support; hence IANA might allocate a code point X25519_SIKEp434 and = another code point for X25519_NTRUPR653. With this option, the client would= list X25519_SIKEp434 and X25519_NTRUPR653 in their supported groups. In this option, we would ask IANA to allocate code points f= or all the various combinations that we want allow to be negotiated. =20 I would like to make an argument in favor of option 1: =20 - It is likely that not everyone will be satisified with =E2=80=9CX25519= plus one of a handful of specific postquantum algorithms=E2=80=9D; some may prefe= r another elliptic curve (for example, x448), or perhaps even a MODP group; = I have talked to people who do not trust ECC); in addition, other people mig= ht not trust a single postquantum algorithm, and may want to rely on both (f= or example) SIKE and NewHope (which are based on very different hard problem= s). With option 2, we could try to anticipate all the common combintations = (such as P384_SIKEp434_NEWHOPE512CCA), however that could very well end up a= s a lot of combinations. - There are likely to be several NIST-approved postquantum key exc= hanges, and each of those key exchanges are likely to have a number of suppo= rted parameter sets (if we take the specific postquantum key exchange as ana= logous to th ECDH protocool, the =E2=80=9Cparameter set=E2=80=9D could be thought of an = analogous to the specific elliptuc curve, and it modifies the key share size= , the performance and sometimes the security properties). In fact, one of t= he NIST submissoins currently has 30 parameter sets defined. Hence, even if= NIST doesn=E2=80=99t approve all the parameter sets (or some of them do not make = sense for TLS in any scenario), we might end up with 20 or more different ke= y exchange/parameter set combinations that do make sense for some scenario t= hat uses tLS (be it in a tranditional PC client/server, a wireless client, t= wo cloud devices communicating or an IOT device). - In addition, we are likely to support additional primitives in t= he future; possibly National curves (e.g. Brainpool), or additional Postquan= tum algorithms (or additional parameter sets to existing ones). Of course, = once we add that code point, we=E2=80=99ll need to add the additional code points = for all the combinations that it=E2=80=99ll make sense in (very much like we had t= o add a number of ciphersuites whenever we added a new encryption algorithm = into TLS 1.2). =20 It seemds reasonable to me that the combination of these two factors are li= kely to cause us (should we select option 2) to define a very large number o= f code points to cover all the various options that people need. =20 Now, this is based on speculation (both of the NIST process, and additional= primitives that will be added to the protocol), and one objection I=E2=80=99ve he= ard is =E2=80=9Cwe don=E2=80=99t know what=E2=80=99s going to happen, and so why would we make= decisions based on this speculation?=E2=80=9D I agree that we have lack of knowl= edge; however it seems to me that a lack of knowledge is an argument in favo= r of selecting the more flexible option (which, in my opinion, is option 1, = as it allows the negotiation of combinations of key exchanges that the WG ha= s not anticipated). =20 My plea: lets not repeat the TLS 1.2 ciphersuite mess; lets add an extensio= n that keeps the number of code points we need to a reasonable bound. =20 The costs of option 1? - It does increase the complexity on the server a small amount (I=E2= =80=99m not a TLS implementor, however it would seem to me to be only a fairly s= mall amount) - It may increase the size of the client hello a small amount (on = the other hand, because it allows us to avoid sending duplicate key shares, = it can also reduce the size of the client hello as well, depending on what=E2=80= =99s actually negotiated) IMHO, the small increase in complexity is worth the lack of complexity in t= he code point table, and the additional flexibility it gives. --B_3647346082_730350364 Content-type: text/html; charset="UTF-8" Content-transfer-encoding: quoted-printable

One more thing: I would expect to use SIDH rather = than SIKE.

 

Because to emulate the security advantages of DH, you=E2=80=99d have to r= un two SIKE=E2=80=99s =E2=80=93 one in each direction.

 

 

From: TLS = <tls-bounces@ietf.org> on behalf of "Panos Kampanakis (pkampana)&= quot; <pkampana@cisco.com>
Date: Tuesday, July 30, 2019 at 3= :37 PM
To: "Scott Fluhrer (sfluhrer)" <sfluhrer@cisco= .com>, "<tls@ietf.org>" <tls@ietf.org>
Subjec= t: Re: [TLS] Options for negotiating hybrid key exchanges for postquantu= m

 

+1 for option 2. The combinatoric explosion and com= plexity of 1 is unnecessary. I expect that just a few, conservative, accepta= bly efficient, classical+PQ combinations need to be standardized and used. C= ombining a classical algo with more than one postquantum algorithms in a key= exchange does not seem practical based on the PQ candidates key sizes and p= erformance.

 

Panos=

=  

 

From: TLS <tls-bounces@ietf.org>= On Behalf Of Scott Fluhrer (sfluhrer)
Sent: Tuesday, July = 30, 2019 11:21 AM
To: <tls@ietf.org> <tls@ietf.org>Subject: [TLS] Options for negotiating hybrid key exchanges for post= quantum

 

During th= e physical meeting in Montreal, we had a discussion about postquantum securi= ty, and in particular, on how one might want to negotiate several different = =E2=80=98groups=E2=80=99 simultaneously (because there might not be one group that is en= tirely trusted, and I put =E2=80=98groups=E2=80=99 in scarequotes because postquantum ke= y exchanges are typically not formed from a Diffie-Hellman group).

 

At the meeting, there were two options presented:

 

Opti= on 1: as the supported group, we insert a =E2=80=98hybrid marker=E2=80=99 (and include a= n extension that map lists which combination the hybrid marker stands for)

            = ;    For example, the client might list in his supported grou= ps hybrid_marker_0 and hybrid_marker_1, and there would be a separate extens= ion that lists hybrid_marker_0 =3D X25519 + SIKEp434 and hybrid_marker_1 =3D X25= 519 + NTRUPR653.  The server would then look up the meanings of hybrid_= marker_0 and 1 in the extension, and then compare that against his security = policy.

In this option, we would ask IANA to allocate= code points for the various individual postquantum key exchanges (in this e= xample, SIKEp434 and NTRUPR653), as well a range of code points for the vari= ous hybrid_markers.

 

Option 2: we have code points for all= the various combinations that we may want to support; hence IANA might allo= cate a code point X25519_SIKEp434 and another code point for X25519_NTRUPR65= 3.  With this option, the client would list X25519_SIKEp434 and X25519_= NTRUPR653 in their supported groups.

     &nb= sp;          In this option, we= would ask IANA to allocate code points for all the various combinations tha= t we want allow to be negotiated.

 

I would like to make an= argument in favor of option 1:

 

-        =   It is l= ikely that not everyone will be satisified with =E2=80=9CX25519 plus one of a hand= ful of specific postquantum algorithms=E2=80=9D; some may prefer another elliptic = curve (for example, x448), or perhaps even a MODP group; I have talked to pe= ople who do not trust ECC); in addition, other people might not trust a sing= le postquantum algorithm, and may want to rely on both (for example) SIKE an= d NewHope (which are based on very different hard problems).  With opti= on 2, we could try to anticipate all the common combintations (such as P384_= SIKEp434_NEWHOPE512CCA), however that could very well end up as a lot of com= binations.

- =          There are likely to be several NIST-appro= ved postquantum key exchanges, and each of those key exchanges are likely to= have a number of supported parameter sets (if we take the specific postquan= tum key exchange as analogous to th ECDH protocool, the =E2=80=9Cparameter set=E2=80=9D = could be thought of an analogous to the specific elliptuc curve, and it modi= fies the key share size, the performance and sometimes the security properti= es).  In fact, one of the NIST submissoins currently has 30 parameter s= ets defined.  Hence, even if NIST doesn=E2=80=99t approve all the parameter s= ets (or some of them do not make sense for TLS in any scenario), we might en= d up with 20 or more different key exchange/parameter set combinations that = do make sense for some scenario that uses tLS (be it in a tranditional PC cl= ient/server, a wireless client, two cloud devices communicating or an IOT de= vice).

- &nbs= p;        In addition, we are likely to support additio= nal primitives in the future; possibly National curves (e.g. Brainpool), or = additional Postquantum algorithms (or additional parameter sets to existing = ones).  Of course, once we add that code point, we=E2=80=99ll need to add the= additional code points for all the combinations that it=E2=80=99ll make sense in = (very much like we had to add a number of ciphersuites whenever we added a n= ew encryption algorithm into TLS 1.2).

 

It seemds reasonab= le to me that the combination of these two factors are likely to cause us (s= hould we select option 2) to define a very large number of code points to co= ver all the various options that people need.

 =

Now, this i= s based on speculation (both of the NIST process, and additional primitives = that will be added to the protocol), and one objection I=E2=80=99ve heard is =E2=80=9Cwe= don=E2=80=99t know what=E2=80=99s going to happen, and so why would we make decisions b= ased on this speculation?=E2=80=9D  I agree that we have lack of knowledge; h= owever it seems to me that a lack of knowledge is an argument in favor of se= lecting the more flexible option (which, in my opinion, is option 1, as it a= llows the negotiation of combinations of key exchanges that the WG has not a= nticipated).

 

My plea: = lets not repeat the TLS 1.2 ciphersuite mess; lets add an extension that kee= ps the number of code points we need to a reasonable bound.

 

The costs of option 1?

-       &nbs= p;  It does increase the c= omplexity on the server a small amount (I=E2=80=99m not a TLS implementor, however= it would seem to me to be only a fairly small amount)

-       &nb= sp;  It may increase the s= ize of the client hello a small amount (on the other hand, because it allows= us to avoid sending duplicate key shares, it can also reduce the size of th= e client hello as well, depending on what=E2=80=99s actually negotiated)

IMHO, the small increase in= complexity is worth the lack of complexity in the code point table, and the= additional flexibility it gives.

--B_3647346082_730350364-- --B_3647346082_1004216318 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" MIIUfQYJKoZIhvcNAQcCoIIUbjCCFGoCAQExDzANBglghkgBZQMEAgEFADALBgkqhkiG9w0B BwGgghJDMIIE8zCCA9ugAwIBAgITWQADyHaxtc8GrYDIrgAAAAPIdjANBgkqhkiG9w0BAQsF ADBRMQswCQYDVQQGEwJVUzEfMB0GA1UECgwWTUlUIExpbmNvbG4gTGFib3JhdG9yeTEMMAoG A1UECwwDUEtJMRMwEQYDVQQDDApNSVRMTCBDQS01MB4XDTE5MDMyNjE4NDEwMVoXDTIyMDMy NTE4NDEwMVowYTELMAkGA1UEBhMCVVMxHzAdBgNVBAoTFk1JVCBMaW5jb2xuIExhYm9yYXRv cnkxDzANBgNVBAsTBlBlb3BsZTEgMB4GA1UEAxMXQmx1bWVudGhhbC5VcmkuNTAwMTA1ODQw ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCzD7FJptOjLaaidxt9QIIH/dAblMrT ESMm4ggEBR0KqbmSkRY+x45ed8E2u9fJuFWKAgwU+vJo//kzavEpAAuyhe61Z+4noWIvV0sY WkUs+ffLh+29MxDs8Mt1++mDAC1+NyLCPN8QNPRJVu7ECRtmKu3DiAtuEKva3J7lZyVVNE+3 e9HQJlr/3alifN4sg/NxOFMTKMMEq15RgOhDyAudnNSs2IesRnoKTZq/Jykwbm0fg06ePSBR /k2JuYNW8/UZnU7d/Ez2n1NEtZkQw5QzWrC27ijf7FFQxM9yLToJneFVK+krQsfvtMbHGpnz Yo9keqc3Uxb13P4mpDbZiIBTAgMBAAGjggGyMIIBrjAdBgNVHQ4EFgQUMzH1HGnW9jHVrCuy FAmJhhljwLcwDgYDVR0PAQH/BAQDAgbAMB8GA1UdIwQYMBaAFC/vu8YNHbvpav6sZ/MHOwh2 9ktZMDMGA1UdHwQsMCowKKAmoCSGImh0dHA6Ly9jcmwubGwubWl0LmVkdS9nZXRjcmwvbGxj YTUwZgYIKwYBBQUHAQEEWjBYMC0GCCsGAQUFBzAChiFodHRwOi8vY3JsLmxsLm1pdC5lZHUv Z2V0dG8vbGxjYTUwJwYIKwYBBQUHMAGGG2h0dHA6Ly9vY3NwLmxsLm1pdC5lZHUvb2NzcDA9 BgkrBgEEAYI3FQcEMDAuBiYrBgEEAYI3FQiDg+Udh+ynZoathxWD6vBFhbahHx2Fy94yh/+K cwIBZAIBCDAiBgNVHSUBAf8EGDAWBggrBgEFBQcDBAYKKwYBBAGCNwoDDDAZBgNVHREEEjAQ gQ51cmlAbGwubWl0LmVkdTAYBgNVHSAEETAPMA0GCyqGSIb3EgIBAwEIMCcGCSsGAQQBgjcU AgQaHhgATABMAFUAcwBlAHIAUwBpAGcALQBTAFcwDQYJKoZIhvcNAQELBQADggEBACztsHHc HX+FTwlhjHUUU+AcLyX3hgIdnTovNmPWVhVgzpN25AotcwODhCwuaLNoLsC0OHRISFUvkqHg 7aeZ9CiDOL4KwlNZgzGpDlqZ/AgMJ+JodWz0XqoNm4wYNs2rl7sEzLe70yPVyzTYlhECYnex UxE4hL334w/cx+Mb8vKn+/EQ9NFKVfCJ8X1dDkCA19EkZu2DbFF2oAM0kr6JX2dNx1rChTMZ iOSkGkKKpnVNFBMl/uw8qH8XrD+slPhLpTQg5t9l0pCtkJSMnrMovPvgwhlOP7yCLdPYYTwY IjwvUeqj1VAvid80L9vevRY1D6NDz/eWfoqCxXxPvtue//owggTAMIIDqKADAgECAgEGMA0G CSqGSIb3DQEBCwUAMFYxCzAJBgNVBAYTAlVTMR8wHQYDVQQKExZNSVQgTGluY29sbiBMYWJv cmF0b3J5MQwwCgYDVQQLEwNQS0kxGDAWBgNVBAMTD01JVExMIFJvb3QgQ0EtMjAeFw0xNzAz MDIxMjAwMDBaFw0yNjAzMDIyMzU5NTlaMFExCzAJBgNVBAYTAlVTMR8wHQYDVQQKDBZNSVQg TGluY29sbiBMYWJvcmF0b3J5MQwwCgYDVQQLDANQS0kxEzARBgNVBAMMCk1JVExMIENBLTUw ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCnmoMOvTkfw7nq19mrWazGaa+Q83Uv 0+ATXT3q6kr+WExIMIZ87C74WCcRXpvO7uvx7HvMsYWAFHW93wQwhjytxHIOZgKNJ4VnGVDU l+KI7g0n9+Zjt3hB3HhHbcvbe9+Y4jz+XzCiLl2OaYvICKbxvbBSCLtPEeZQ6x6Tb6EK0ym0 gvYeHO3kuuY+SJHJMltbrLnIVLxjZrNVS77zXKvu6Q3hSdkRIB7kJgEXfL+p/z/2p94bEEZ2 TnQz0TkOjG+Jq7UlXlFRtvsYcDPEQD3UNkZsWcXgC1hXG8TGknUcAhlGxVhlKlFLmNd7342s eGy2s9YxNDnSE+eXTtb0I5LLAgMBAAGjggGcMIIBmDASBgNVHRMBAf8ECDAGAQH/AgEAMB0G A1UdDgQWBBQv77vGDR276Wr+rGfzBzsIdvZLWTAfBgNVHSMEGDAWgBT/ycllTFOA8akMPCGu girH7vgy+zAOBgNVHQ8BAf8EBAMCAYYwZwYIKwYBBQUHAQEEWzBZMC4GCCsGAQUFBzAChiJo dHRwOi8vY3JsLmxsLm1pdC5lZHUvZ2V0dG8vTExSQ0EyMCcGCCsGAQUFBzABhhtodHRwOi8v b2NzcC5sbC5taXQuZWR1L29jc3AwNAYDVR0fBC0wKzApoCegJYYjaHR0cDovL2NybC5sbC5t aXQuZWR1L2dldGNybC9MTFJDQTIwgZIGA1UdIASBijCBhzANBgsqhkiG9xICAQMBBjANBgsq hkiG9xICAQMBCDANBgsqhkiG9xICAQMBBzANBgsqhkiG9xICAQMBCTANBgsqhkiG9xICAQMB CjANBgsqhkiG9xICAQMBCzANBgsqhkiG9xICAQMBDjANBgsqhkiG9xICAQMBDzANBgsqhkiG 9xICAQMBEDANBgkqhkiG9w0BAQsFAAOCAQEAMJYRwLPJ91K7e2mA2Nj10W0o5JMHYkaa+ctL 8/xY8QzIHFI5Ij+iydpPN9KCYn/4Sy80T3aNoYkFlS0GRQXhf0nsiY7TWJwAKw4AiO/yJ37/ oRKRgtyRicvaJ6RjlHCXBOalFLw9UtpodP4/idC51lxzsolaQZraBjVe7PL95PhS7D+22Nff InzLdIb1DBf54NwOVfPIgABtxH1fhZrja7EhR9RoUw5E1O6iWaAuP/xWhSTQFWlhyA0/kkIi 9/HXaY0hYnhcjcbPPqjpyfIhSFjjXhjqK7t2wPrSrBFLFUbnLiNlgQHrvNYF5IqgIfnSBWIr m3rfLhpZZJ/xJ7Yf6DCCA4owggJyoAMCAQICAQEwDQYJKoZIhvcNAQELBQAwVjELMAkGA1UE BhMCVVMxHzAdBgNVBAoTFk1JVCBMaW5jb2xuIExhYm9yYXRvcnkxDDAKBgNVBAsTA1BLSTEY MBYGA1UEAxMPTUlUTEwgUm9vdCBDQS0yMB4XDTE2MDQyMDEyMDAwMFoXDTM1MDQxOTIzNTk1 OVowVjELMAkGA1UEBhMCVVMxHzAdBgNVBAoTFk1JVCBMaW5jb2xuIExhYm9yYXRvcnkxDDAK BgNVBAsTA1BLSTEYMBYGA1UEAxMPTUlUTEwgUm9vdCBDQS0yMIIBIjANBgkqhkiG9w0BAQEF AAOCAQ8AMIIBCgKCAQEAv3WoBEGOOJtm4ucvaf6vKIFPs8watCd6Smwq/XeRNo7P3jPIxNPw F398RGDUmPJIXA7idzD6j0opFIW+kLqYye9e788PV0dqaJlX8818fNDbSE+8B6hieqKTR7Vf OI74UVQEUKVRFuRFw6uVYuvgew2Tj/C2dEee37eruQl5nHkbV2OsWnZ7O+yt+etd6HRcaXLl P9q8WKgA3B7vkOVIMCKoAuaWj+BFq7K+WNkiyi/KdOH9JmOpbyRK4jcA7xbLnF8JFUSNg5c4 Y1BJrFaZtkCeG6Nm9p524GllkRFzPgpj8VicV+AK+9rY07dTx02kYotTnKuy0YxBAwsUXxAQ EwIDAQABo2MwYTAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBT/ycllTFOA8akMPCGugirH 7vgy+zAfBgNVHSMEGDAWgBT/ycllTFOA8akMPCGugirH7vgy+zAOBgNVHQ8BAf8EBAMCAYYw DQYJKoZIhvcNAQELBQADggEBAHqYfEf/3J5aMKhlYQ0PnUAbMB8jZSr9/HvjfOF00crFUCfS rqG8JQwo+S/iq66gcp62FEgJ0fQkDgVg6m+C2ETo1LoWiSxhYCfcSIQECljlXwR8wFSayF82 2S69IqvHhdq4d58jU6gYi6ssjU4vwsvsVLRJKk/m/Cg/w8gW6YHM5ahBD6/5Ccel2fI7oSms kO991+otrC11YfDwCFvz7Am0r+K9iVhSWta4hmIuV0YBia07eZKSO02LPgQ8YOz3ku0Yt+mh 8VWRKux2CcYjMpk+WDV0BMp75tqb6pqBFkcKvEBXqxg+8+G/umjii4H0c5kvJhaQyykbmOKm xO9IcJIwggT2MIID3qADAgECAhNZAAA7OX5fo0OiIK0RAAAAADs5MA0GCSqGSIb3DQEBCwUA MFExCzAJBgNVBAYTAlVTMR8wHQYDVQQKDBZNSVQgTGluY29sbiBMYWJvcmF0b3J5MQwwCgYD VQQLDANQS0kxEzARBgNVBAMMCk1JVExMIENBLTUwHhcNMTgwODI4MjE0NTI5WhcNMjEwODI3 MjE0NTI5WjBhMQswCQYDVQQGEwJVUzEfMB0GA1UEChMWTUlUIExpbmNvbG4gTGFib3JhdG9y eTEPMA0GA1UECxMGUGVvcGxlMSAwHgYDVQQDExdCbHVtZW50aGFsLlVyaS41MDAxMDU4NDCC ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAI5Vc19RKc/69lmwhogDOjjzPQbmc8s6 Z6rzP6oUHAswDICqZWwPt+FTbKr0YTAqRNsTEN4YiW0fORK+fNRvClo0pdiCqj3DwDQZLRI4 Dak1yTsUtVe35oomQbXtO+0A0L/CowYri/UKeRG1i1/0cXSf4mAx0ed9wh2SordAb8o2FuOU 0B2ppnqjro1VFugHHX6QOggaeLFOprT5gnTZUmqM37/d4DGB9XDdTQi144zQSwSWKkaUThsy D9CHSRNcB79HBvlZGSM+BkIbayPdhQAuz4yKsOZEWPx/6LnMotzBevSswnCDf+u9ajCgMnje WbrZRN+xoYEuhycXyK2b8/MCAwEAAaOCAbUwggGxMB0GA1UdDgQWBBTZUpq7Rsccv42yU9UQ 4wvojOl4pzAOBgNVHQ8BAf8EBAMCBSAwHwYDVR0jBBgwFoAUL++7xg0du+lq/qxn8wc7CHb2 S1kwMwYDVR0fBCwwKjAooCagJIYiaHR0cDovL2NybC5sbC5taXQuZWR1L2dldGNybC9sbGNh NTBmBggrBgEFBQcBAQRaMFgwLQYIKwYBBQUHMAKGIWh0dHA6Ly9jcmwubGwubWl0LmVkdS9n ZXR0by9sbGNhNTAnBggrBgEFBQcwAYYbaHR0cDovL29jc3AubGwubWl0LmVkdS9vY3NwMD0G CSsGAQQBgjcVBwQwMC4GJisGAQQBgjcVCIOD5R2H7Kdmhq2HFYPq8EWFtqEfHYXr0HCD6+0g AgFkAgEJMCUGA1UdJQQeMBwGBFUdJQAGCCsGAQUFBwMEBgorBgEEAYI3CgMEMBkGA1UdEQQS MBCBDnVyaUBsbC5taXQuZWR1MBgGA1UdIAQRMA8wDQYLKoZIhvcSAgEDAQgwJwYJKwYBBAGC NxQCBBoeGABMAEwAVQBzAGUAcgBFAG4AYwAtAFMAVzANBgkqhkiG9w0BAQsFAAOCAQEACyN6 Yhi9LApOPpf60ypSV2WmV3sqnrsrdlPTW+am4wMK/M/5PZmt5jFVtXaErkWYdrbMdjeo2o/G 9N2DnrFOhz7kDYM9HC9AH/rWCfoSkI/C2N6Rq/uDnRJfao61wyv37qKtanNdkp+reyLxdVPn foVrD/VZli4UV28u4XBuYDkjXPyyiH+bb395FnxOtTA3Uz41Ohpdvr6oLPEuy0IP4MPfK5wD mS6GXcB+ze9sYEp+DJxE7WAbkW5Y536WPl/rfWm/k6ZC1KPVSRM7mS+atk44VOgzPLXkl6Tu 6zY8tMczfr5F0om1JfN8G50s4QDUGtsMgzW+LXVDhFD24xnUojGCAf4wggH6AgEBMGgwUTEL MAkGA1UEBhMCVVMxHzAdBgNVBAoMFk1JVCBMaW5jb2xuIExhYm9yYXRvcnkxDDAKBgNVBAsM A1BLSTETMBEGA1UEAwwKTUlUTEwgQ0EtNQITWQADyHaxtc8GrYDIrgAAAAPIdjANBglghkgB ZQMEAgEFAKBpMC8GCSqGSIb3DQEJBDEiBCCfQi7Jz44mVLt0LRn5f9ZQFw1oDqWGMRis42Fa yMuqiTAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0xOTA3MzAx OTQxMjJaMA0GCSqGSIb3DQEBAQUABIIBACFBBXkquLS0WCw2pmBhn1TVHg4yZe06WUOn3WWH I+9PYAVqka8wiqxlK/zT1mZ0L98XU+2f/pEDqeLvK67dE9DQPX12ZEsK7wMyYi+HBv0y7JcS JPX0l3icBjG5DvLPP2op2Oawo0SbVy/+THuRT5yYypK/bVacp31KjIASJ8sgzUTK7PSfpic4 TVicjl73PL/kjqeR119xXTSwTYbJdc+OkJfbFOlzBKx0/ZHXLA2wRWcdHhqw4jKCQxTfIaPy IKmYKlM9ZY6/L/bJlMUE2wsNWAnXIL8CWMYiCaYNjNpQW79rsGtsSOqHMlyImFFj8pspIoWJ F9SV8xLFrAlaRSw= --B_3647346082_1004216318-- From nobody Tue Jul 30 12:42:14 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7B35A120234 for ; Tue, 30 Jul 2019 12:41:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id h3368bFn7nkJ for ; Tue, 30 Jul 2019 12:41:51 -0700 (PDT) Received: from NAM01-SN1-obe.outbound.protection.outlook.com (mail-eopbgr820123.outbound.protection.outlook.com [40.107.82.123]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AED5412025D for ; Tue, 30 Jul 2019 12:41:51 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=j4Y7WQ+iwrTKBwnrqH7DVQ8UK3uisdekmtY5FUWY6pPtaTTT37iGf04yQAIN9A97oj0Eap8JiT7PSnKwX9/bvbprwRffV/f00fVH1/dHvlhxgtkI2bfOhUYEdVBP2ALJTniZ5+jYiu/gSreP+c+xi+uWrKaEo3wa5/zs78t0FfPTvYRaPBcZHwYPoxfQDy7TM6V7Mbe/kdQiuu3pR2Bc+LtzkKVE5xv8CgFAWGUnCqI1sJVKxIoKVfQsWC2OgG9vA+U/QFWdQvrODy11+Nv/YAhkL/GEmHhfYR+Qu/zcVYvfvvCoKPwsYluQiL3bOnRUNxq2Hzv7SkGyg0s/2BhjHA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=fHUifljdzDEJPUO3LVbL/XWWi6Qn1skqZqbEJbpkKWs=; b=KsZT41f6YT3L5jrFLtLHVTs0xzy+cGahz6MlyILZO279maAN50bgesmfqUHkA4LFcxJQJNBPVa6z1G0W5PErOxlFl3jHI06fBlSDk3/oNPXYbC9GBZbMHzBeEoLJdWzwSborDsm8neOhZwAOkSnjpR33fm4HR9YVzW5Ld6Pg+k42lfRMXgx1MF37o5dA99IW0wLXrshOHn3GzaBhirc6YturBB1XoK2D9F2cjiTMg3091AYa7mPsLlM9+v+ceNFxAcBTMmueZrD08qYctYLjmp8dCLq65WfFWtuEW7RU4/tpSXLuONShhC21LSe1D+TawrZnhSoUTIAJeZOY7QAPQw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=microsoft.com; dmarc=pass action=none header.from=microsoft.com; dkim=pass header.d=microsoft.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=fHUifljdzDEJPUO3LVbL/XWWi6Qn1skqZqbEJbpkKWs=; b=DdbJoAI3T/1DOrFQR04VJ0sk/Hj+IQyRAeXPmx8pTstlITdUXj8YyN0316kMitLeMdVROc7pcLwP/INRPQUKURL8AE31fBO2n1CjK59cyGy9yJMYinDQxKugaavFak6taQO/83znB1HmSP2Fnm6ABKHcnYqMFud782IVKdbnmlw= Received: from DM5PR2101MB0917.namprd21.prod.outlook.com (52.132.132.162) by DM5PR2101MB0903.namprd21.prod.outlook.com (52.132.132.160) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2157.2; Tue, 30 Jul 2019 19:41:50 +0000 Received: from DM5PR2101MB0917.namprd21.prod.outlook.com ([fe80::6cee:c549:a46c:9e5c]) by DM5PR2101MB0917.namprd21.prod.outlook.com ([fe80::6cee:c549:a46c:9e5c%7]) with mapi id 15.20.2157.001; Tue, 30 Jul 2019 19:41:50 +0000 From: Andrei Popov To: "Blumenthal, Uri - 0553 - MITLL" , David Benjamin CC: TLS List Thread-Topic: [TLS] Options for negotiating hybrid key exchanges for postquantum Thread-Index: AdVG1haOE+yO4N1wQQSyYtQ5VKKSwAAHEKmAAARkcYAAAMUecAAAeXmAAABzVYAAANYKwA== Date: Tue, 30 Jul 2019 19:41:49 +0000 Message-ID: References: <5B5A7CC1-D48A-4CB6-891A-B73F82C23F72@ll.mit.edu> In-Reply-To: <5B5A7CC1-D48A-4CB6-891A-B73F82C23F72@ll.mit.edu> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Andrei.Popov@microsoft.com; x-originating-ip: [2001:4898:80e8:a:28b3:a023:971b:e42c] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: efe78ae7-5bb6-4ed8-0c0f-08d71525f733 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(5600148)(711020)(4605104)(1401327)(4618075)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(2017052603328)(7193020); SRVR:DM5PR2101MB0903; x-ms-traffictypediagnostic: DM5PR2101MB0903: x-ms-exchange-purlcount: 3 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8273; x-forefront-prvs: 0114FF88F6 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(4636009)(396003)(366004)(39860400002)(376002)(346002)(136003)(15404003)(199004)(189003)(966005)(66556008)(4326008)(8676002)(316002)(81156014)(14454004)(14444005)(81166006)(53936002)(2171002)(256004)(46003)(110136005)(2906002)(22452003)(7736002)(86362001)(68736007)(10290500003)(476003)(25786009)(606006)(478600001)(6246003)(53546011)(55016002)(6506007)(71190400001)(6436002)(76176011)(102836004)(8936002)(54896002)(6306002)(9686003)(71200400001)(236005)(486006)(74316002)(66476007)(66946007)(33656002)(11346002)(186003)(446003)(30864003)(7696005)(10090500001)(52536014)(76116006)(790700001)(66446008)(229853002)(5070765005)(8990500004)(5660300002)(6116002)(53946003)(64756008)(99286004); DIR:OUT; SFP:1102; SCL:1; SRVR:DM5PR2101MB0903; H:DM5PR2101MB0917.namprd21.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: 1TKdDm5tAE09pkqQ0pFuPFLW+NoMZFuHC+nZOOj30zM27d1F6Z3a4gz7q9OZ9CSyq9SoSpU1yurLwKnkz/o8FWWrrO+iIFV8C3CVkGUXNeuJ+l+QaTQ9uBczbr4vEzemwT0UgJiHXBUhx6Wqiwj/4f+xzdocQ+dUjs/qyjdTZpig24P52ekoaYc4yJ/9GCkK9DqNOVJuuLj417KljpTTXsGxXWPoyBeQj5iLE28Ava86S58T/2OV2KjXQGRw9SVSr+z583Y1txacmRlzAoTT+CoCN+C6Epik4xMDCnoTwEz0dVZppn+DqCc3Kauihmltz54vogegMi2I0p2mMZ9yOdXSYOxnC4obZd+q+3fypTxdGurCRi0NmHdeQwL3V0Tz5noNKbv5QmD3vCgg4iPw293BeCgvFuKlotVR/h2dqME= x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_DM5PR2101MB0917BFF8B79FA4D1823F6C4C8CDC0DM5PR2101MB0917_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: efe78ae7-5bb6-4ed8-0c0f-08d71525f733 X-MS-Exchange-CrossTenant-originalarrivaltime: 30 Jul 2019 19:41:50.0306 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: hLZQAfHmV4qChW1maspCPV6a+PJkazOv8ZEpibU0u9GEkEzEuNSgMWW0LTQXU2W3BjV7Mom6w2yWxtgdqQ0bDQ== X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM5PR2101MB0903 Archived-At: Subject: Re: [TLS] Options for negotiating hybrid key exchanges for postquantum X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 30 Jul 2019 19:42:04 -0000 --_000_DM5PR2101MB0917BFF8B79FA4D1823F6C4C8CDC0DM5PR2101MB0917_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 U3VyZSwgaHlicmlkLWtleS1leGNoYW5nZSDigJxmbGFn4oCdIGV4dGVuc2lvbiBpcyB0b28gZ2Vu ZXJpYy4gV2UgY291bGQgaGF2ZSB0aGUgY2xpZW50IGFkdmVydGlzZSBzb21ldGhpbmcgbGlrZSBv bmUtdHJhZGl0aW9uYWwtYW5kLW9uZS1QUSwgYW5kIHN0aWxsIGF2b2lkIHRoZSBDYXJ0ZXNpYW4g cHJvZHVjdC4NCkZyb206IFRMUyA8dGxzLWJvdW5jZXNAaWV0Zi5vcmc+IE9uIEJlaGFsZiBPZiBC bHVtZW50aGFsLCBVcmkgLSAwNTUzIC0gTUlUTEwNClNlbnQ6IFR1ZXNkYXksIEp1bHkgMzAsIDIw MTkgMTI6MTIgUE0NClRvOiBEYXZpZCBCZW5qYW1pbiA8ZGF2aWRiZW5AY2hyb21pdW0ub3JnPg0K Q2M6IFRMUyBMaXN0IDx0bHNAaWV0Zi5vcmc+DQpTdWJqZWN0OiBSZTogW1RMU10gT3B0aW9ucyBm b3IgbmVnb3RpYXRpbmcgaHlicmlkIGtleSBleGNoYW5nZXMgZm9yIHBvc3RxdWFudHVtDQoNClRo ZSBudWlzYW5jZSB3aXRoIGp1c3QgYSBmbGFnIGlzIHRoZSBjbGllbnQgY2FuJ3QgZXhwcmVzcyBb d2hhdCBJIHRoaW5rIGFyZV0gcmVhc29uYWJsZSBwcmVmZXJlbmNlcy4gSXQgc2hvdWxkIGJlIGFi bGUgdG8gc2F5IHRoaW5ncyBsaWtlOg0KDQpPZmZoYW5kLCBJIGRvbuKAmXQgc2VlIGF0IGFsbCB3 aHkgdGhlIGNsaWVudCBzaG91bGQgYmUgYWJsZSB0byBzYXkgYW55IG9mIHRoZXNlIOKAnGRvbuKA mXTigJ1zOg0KDQoqIERvbid0IGRvIFgyNTUxOSArIFAtMjU2LiBUaGlzIGlzIGp1c3Qgc2lsbHku DQoqIERvbid0IGRvIFBRMSBvbiBpdHMgb3duLiBJIHJlYWxseSB3YW50IHRoZSBQUSBzY2hlbWUg cGFpcmVkIHdpdGggc29tZXRoaW5nIG1vcmUgZXN0YWJsaXNoZWQuDQoqIERvbid0IGRvIFBRMSAr IFBRMi4gSSBzYWlkIHNvbWV0aGluZyBtb3JlIGVzdGFibGlzaGVkLCBwbGVhc2UuDQoqIERvbid0 IGRvIFBRMSArIFgyNTUxOSArIFAtMjU2LiBXaHkgYXJlIHlvdSBkb2luZyB0aHJlZSBvZiB0aGVz ZT8NCiogRG9uJ3QgZG8gUFExICsgUFEyICsgUFEzICsgUFE0ICsgWDI1NTE5ICsgUC0yNTYgKyBQ LTM4NCArIEZGREhFMjA0OCArIEZGREhFMzA3Miwgb3d3IG15IGhlYWQuDQoNClRoaXMgaXMgdGhl IG9ubHkgdGhpbmcgdGhhdCBJTUhPIHRoZSBjbGllbnQgc2hvdWxkIGJlIGFibGUgdG8gc2F5Og0K DQoqIFBRMSArIFgyNTUxOSBpcyBjb29sLiBJIGxpa2UgdGhhdCBjb21iby4NCg0KDQoNCg0KT24g VHVlLCBKdWwgMzAsIDIwMTkgYXQgMjo0OCBQTSBBbmRyZWkgUG9wb3YgPEFuZHJlaS5Qb3BvdkBt aWNyb3NvZnQuY29tPG1haWx0bzpBbmRyZWkuUG9wb3ZAbWljcm9zb2Z0LmNvbT4+IHdyb3RlOg0K R2l2ZW4gdGhlc2Ugb3B0aW9ucywgSSBhbHNvIHByZWZlciBvcHRpb24gMiwgZm9yIHNvbWUgb2Yg dGhlIHNhbWUgcmVhc29ucy4NCg0KRm9yIG15IHVuZGVyc3RhbmRpbmcgdGhvdWdoLCB3aHkgbm90 IGhhdmUgdGhlIGNsaWVudCBhZHZlcnRpc2Ugc3VwcG9ydCBmb3IgaHlicmlkLWtleS1leGNoYW5n ZSAoZS5nLiB2aWEgYSDigJxmbGFn4oCdIGV4dGVuc2lvbikgYW5kIHRoZW4gS2V5U2hhcmVTZXJ2 ZXJIZWxsbyBjYW4gY29udGFpbiB0d28gS2V5U2hhcmVFbnRyaWVzIChlc3NlbnRpYWxseSwgdXNp bmcgdGhlIHNhbWUgZm9ybWF0IGFzIEtleVNoYXJlQ2xpZW50SGVsbG8/IFRoaXMgd291bGQgc29s dmUgdGhlIENhcnRlc2lhbiBwcm9kdWN0IGlzc3VlLg0KDQpDaGVlcnMsDQoNCkFuZHJlaQ0KDQpG cm9tOiBUTFMgPHRscy1ib3VuY2VzQGlldGYub3JnPG1haWx0bzp0bHMtYm91bmNlc0BpZXRmLm9y Zz4+IE9uIEJlaGFsZiBPZiBEYXZpZCBCZW5qYW1pbg0KU2VudDogVHVlc2RheSwgSnVseSAzMCwg MjAxOSAxMToyNCBBTQ0KVG86IFdhdHNvbiBMYWRkIDx3YXRzb25ibGFkZEBnbWFpbC5jb208bWFp bHRvOndhdHNvbmJsYWRkQGdtYWlsLmNvbT4+DQpDYzogVExTIExpc3QgPHRsc0BpZXRmLm9yZzxt YWlsdG86dGxzQGlldGYub3JnPj4NClN1YmplY3Q6IFJlOiBbVExTXSBPcHRpb25zIGZvciBuZWdv dGlhdGluZyBoeWJyaWQga2V5IGV4Y2hhbmdlcyBmb3IgcG9zdHF1YW50dW0NCg0KSSB0aGluayB0 aGlzIHVuZGVyZXN0aW1hdGVzIHRoZSBjb21wbGV4aXR5IGNvc3Qgb2Ygb3B0aW9uIDEgdG8gdGhl IHByb3RvY29sIGFuZCBpbXBsZW1lbnRhdGlvbnMuIE9wdGlvbiAxIG1lYW5zIGdyb3VwIG5lZ290 aWF0aW9uIGluY2x1ZGVzIGVudGlyZSBjb2RlcG9pbnRzIHdob3NlIG1lYW5pbmcgY2Fubm90IGJl IGRldGVybWluZWQgd2l0aG91dCBhIHBhcmFsbGVsIGV4dGVuc2lvbi4gVGhpcyBjb21wb3VuZHMg YWNyb3NzIGV2ZXJ5dGhpbmcgd2hpY2ggaW50ZXJhY3RzIHdpdGggbmFtZWQgZ3JvdXBzLCBpbXBh Y3RpbmcgZXZlcnl0aGluZyBmcm9tIEFQSXMgdG8gY29uZmlnIGZpbGUgZm9ybWF0cyB0byBldmVu IFVJIHN1cmZhY2VzLiBPdGhlciB1c2VzIG9mIE5hbWVkR3JvdXBzIGFyZSBpbXBhY3RlZCB0b28u IEZvciBpbnN0YW5jZSwgb3B0aW9uIDIgZml0cyBpbnRvIGRyYWZ0LWlldGYtdGxzLWVzbmkgYXMt aXMuIE9wdGlvbiAxIHJlcXVpcmVzIGluamVjdGluZyBoeWJyaWRfZXh0ZW5zaW9uIGludG8gRVNO SSBzb21laG93LiBBbmFseXNpcyBtdXN0IGZ1cnRoZXIgY2hlY2sgZXZlcnkgdXNlLCBzYXksIGlu Y29ycG9yYXRlcyB0aGlzIHBhcmFsbGVsIGxvb2t1cCB0YWJsZSBpbnRvIHRyYW5zY3JpcHQtbGlr ZSBtZWFzdXJlcy4NCg0KVGhlIGxlc3NvbiBmcm9tIFRMUyAxLjIgY29kZSBwb2ludHMgaXMgbm90 IGNvbWJpbmVkIGNvZGVwb2ludHMgdnMuIHNwbGl0IG9uZXMuIFJhdGhlciwgdGhlIGxlc3NvbiBp cyB0byBhdm9pZCBpbnRlcmRlcGVuZGVudCBkZWNpc2lvbnM6DQoNCiogU2lnbmF0dXJlIGFsZ29y aXRobXMgaW4gVExTIDEuMiB3ZXJlIGEgbWVzcyBiZWNhdXNlIHRoZSBFQ0RTQSBjb2RlcG9pbnRz IHJlcXVpcmVkIGNyb3NzLXJlZmVyZW5jaW5nIGFnYWluc3QgdGhlIHN1cHBvcnRlZCBjdXJ2ZXMg bGlzdC4gVGhlIHZlcmlmaWVyIGNvdWxkIG5vdCBleHByZXNzIHNvbWUgcHJlZmVyZW5jZXMgKHNp Z25pbmcgU0hBLTUxMiB3aXRoIFAtMjU2IGlzIHNpbGx5LCBhbmQgbWl4aW5nIGhhc2grY3VydmUg cGFpcnMgaW4gRUNEU0EgaXMgc2xpZ2h0bHkgb2ZmIGluIGdlbmVyYWwpLiBBcyBhbmFsb2d5IHRv IG9wdGlvbiAxJ3MgRVNOSSBwcm9ibGVtLCB3ZSBldmVuIGZvcmdvdCB0byBhbGxvdyB0aGUgc2Vy dmVyIHRvIGV4cHJlc3MgY3VydmUgcHJlZmVyZW5jZXMuIFRMUyAxLjMgY29tYmluZWQgc2lnbmF0 dXJlIGFsZ29yaXRobSBjb25zaWRlcmF0aW9ucyBpbnRvIGEgc2luZ2xlIGNvZGVwb2ludCB0byBh ZGRyZXNzIGFsbCB0aGlzLg0KDQoqIENpcGhlciBzdWl0ZXMgaW4gVExTIDEuMiB3ZXJlIGEgbWVz cyBiZWNhdXNlIHRoZXkgd2VyZSBoYWxmLWNvbWJpbmVkIGFuZCBoYWxmLXNwbGl0LiBUTFNfRUNE SEVfRUNEU0FfV0lUSF9BRVNfMTI4X0dDTV9TSEEyNTYgc2FpZCB0byB1c2Ugc29tZSBFQ0RIRSBr ZXkgZXhjaGFuZ2UsIGJ1dCB5b3UgbmVlZCB0byBjaGVjayBpZiB5b3UgaGF2ZSBhIE5hbWVkR3Jv dXAgaW4gY29tbW9uIGZpcnN0LiBJdCBzYWlkIHRvIHVzZSBFQ0RTQSwgYnV0IHlvdSBuZWVkIHRv IGNoZWNrIHNpZ25hdHVyZSBhbGdvcml0aG1zICh3aGljaCB0aGVtc2VsdmVzIGNyb3NzLXJlZmVy ZW5jZSBjdXJ2ZXMpIGZpcnN0LiBFYXJseSBkcmFmdHMgb2YgVExTIDEuMyBoYWQgaXQgZXZlbiB3 b3JzZSwgd2hlcmUgYSBUTFNfRUNESEVfRUNEU0FfV0lUSF9BRVNfMTI4X0dDTV9TSEEyNTYgZnVs bCBoYW5kc2hha2UgbW9ycGhlZCBpbnRvIFRMU19FQ0RIRV9QU0tfV0lUSF9BRVNfMTI4X0dDTV9T SEEyNTYgb24gcmVzdW1wdGlvbi4gVGh1cywgVExTIDEuMyBjaXBoZXIgc3VpdGVzIG5lZ290aWF0 ZSBzb2xlbHkgQUVBRCArIFBSRiBoYXNoLg0KDQpJbiBmYWlybmVzcyB0byBUTFMgMS4yLCBzb21l IG9mIHRoaXMgd2FzIGEgY29uc2VxdWVuY2Ugb2YgVExTIDEuMidzIGV2b2x1dGlvbiBvdmVyIHRp bWUgYXMgaW5jcmVtZW50YWwgZXh0ZW5zaW9ucyBvdmVyIFNTTCAzLjAuIEFuZCBzb21ldGltZXMg d2UgZG8gbmVlZCB0byBwYXkgY29zdHMgbGlrZSB0aGVzZS4gQnV0IGh5YnJpZCBrZXkgZXhjaGFu Z2VzIGZpdCBpbnRvIHRoZSBOYW1lZEdyb3VwICJBUEkiIGp1c3QgZmluZSwgc28gb3B0aW9uIDIg aXMgdGhlIGNsZWFyIGFuc3dlci4gQ29kZSBwb2ludHMgYXJlIGNoZWFwLiBQcm90b2NvbCBjb21w bGV4aXR5IGlzIG11Y2ggbW9yZSBleHBlbnNpdmUuDQoNCkl0J3MgdHJ1ZSB0aGF0IHN0YW5kYXJk cyBhcmUgb2Z0ZW4gdW5kZXJzcGVjaWZpZWQuIFRoaXMgbWVhbnMgdGhlIElFVEYgc2hvdWxkIGZp bmlzaCB0aGUgam9iLCBub3QgcGFzcyBhbGwgdmFyaWF0aW9ucyB0aHJvdWdoLiBSU0EtUFNTIGlz IGEgY2xlYXIgZXhhbXBsZSBvZiB3aGF0IHRvIGF2b2lkLiBJdCB0YWtlcyBtb3JlIGJ5dGVzIHRv IG1lcmVseSB1dHRlciAiUlNBLVBTUyB3aXRoIFNIQS0yNTYgYW5kIHVzdWFsIHBhcmFtZXRlcnMi IGluIFguNTA5IHRoYW4gdG8gZW5jb2RlIGFuIGVudGlyZSBFQ0RTQSBzaWduYXR1cmUhIFdlIHNo b3VsZCBub3QgZGVmaW5lIG1vcmUgdGhhbiBhIGhhbmRmdWwgb2Ygb3B0aW9ucywgcmVnYXJkbGVz cyBvZiB0aGUgZW5jb2RpbmcuLi4NCg0KT24gVHVlLCBKdWwgMzAsIDIwMTkgYXQgMTI6MTggUE0g V2F0c29uIExhZGQgPHdhdHNvbmJsYWRkQGdtYWlsLmNvbTxtYWlsdG86d2F0c29uYmxhZGRAZ21h aWwuY29tPj4gd3JvdGU6DQoNCk9uIFR1ZSwgSnVsIDMwLCAyMDE5LCA4OjIxIEFNIFNjb3R0IEZs dWhyZXIgKHNmbHVocmVyKSA8c2ZsdWhyZXJAY2lzY28uY29tPG1haWx0bzpzZmx1aHJlckBjaXNj by5jb20+PiB3cm90ZToNCkR1cmluZyB0aGUgcGh5c2ljYWwgbWVldGluZyBpbiBNb250cmVhbCwg d2UgaGFkIGEgZGlzY3Vzc2lvbiBhYm91dCBwb3N0cXVhbnR1bSBzZWN1cml0eSwgYW5kIGluIHBh cnRpY3VsYXIsIG9uIGhvdyBvbmUgbWlnaHQgd2FudCB0byBuZWdvdGlhdGUgc2V2ZXJhbCBkaWZm ZXJlbnQg4oCYZ3JvdXBz4oCZIHNpbXVsdGFuZW91c2x5IChiZWNhdXNlIHRoZXJlIG1pZ2h0IG5v dCBiZSBvbmUgZ3JvdXAgdGhhdCBpcyBlbnRpcmVseSB0cnVzdGVkLCBhbmQgSSBwdXQg4oCYZ3Jv dXBz4oCZIGluIHNjYXJlcXVvdGVzIGJlY2F1c2UgcG9zdHF1YW50dW0ga2V5IGV4Y2hhbmdlcyBh cmUgdHlwaWNhbGx5IG5vdCBmb3JtZWQgZnJvbSBhIERpZmZpZS1IZWxsbWFuIGdyb3VwKS4NCg0K QXQgdGhlIG1lZXRpbmcsIHRoZXJlIHdlcmUgdHdvIG9wdGlvbnMgcHJlc2VudGVkOg0KDQpPcHRp b24gMTogYXMgdGhlIHN1cHBvcnRlZCBncm91cCwgd2UgaW5zZXJ0IGEg4oCYaHlicmlkIG1hcmtl cuKAmSAoYW5kIGluY2x1ZGUgYW4gZXh0ZW5zaW9uIHRoYXQgbWFwIGxpc3RzIHdoaWNoIGNvbWJp bmF0aW9uIHRoZSBoeWJyaWQgbWFya2VyIHN0YW5kcyBmb3IpDQogICAgICAgICAgICAgICAgRm9y IGV4YW1wbGUsIHRoZSBjbGllbnQgbWlnaHQgbGlzdCBpbiBoaXMgc3VwcG9ydGVkIGdyb3VwcyBo eWJyaWRfbWFya2VyXzAgYW5kIGh5YnJpZF9tYXJrZXJfMSwgYW5kIHRoZXJlIHdvdWxkIGJlIGEg c2VwYXJhdGUgZXh0ZW5zaW9uIHRoYXQgbGlzdHMgaHlicmlkX21hcmtlcl8wID0gWDI1NTE5ICsg U0lLRXA0MzQgYW5kIGh5YnJpZF9tYXJrZXJfMSA9IFgyNTUxOSArIE5UUlVQUjY1My4gIFRoZSBz ZXJ2ZXIgd291bGQgdGhlbiBsb29rIHVwIHRoZSBtZWFuaW5ncyBvZiBoeWJyaWRfbWFya2VyXzAg YW5kIDEgaW4gdGhlIGV4dGVuc2lvbiwgYW5kIHRoZW4gY29tcGFyZSB0aGF0IGFnYWluc3QgaGlz IHNlY3VyaXR5IHBvbGljeS4NCkluIHRoaXMgb3B0aW9uLCB3ZSB3b3VsZCBhc2sgSUFOQSB0byBh bGxvY2F0ZSBjb2RlIHBvaW50cyBmb3IgdGhlIHZhcmlvdXMgaW5kaXZpZHVhbCBwb3N0cXVhbnR1 bSBrZXkgZXhjaGFuZ2VzIChpbiB0aGlzIGV4YW1wbGUsIFNJS0VwNDM0IGFuZCBOVFJVUFI2NTMp LCBhcyB3ZWxsIGEgcmFuZ2Ugb2YgY29kZSBwb2ludHMgZm9yIHRoZSB2YXJpb3VzIGh5YnJpZF9t YXJrZXJzLg0KDQpPcHRpb24gMjogd2UgaGF2ZSBjb2RlIHBvaW50cyBmb3IgYWxsIHRoZSB2YXJp b3VzIGNvbWJpbmF0aW9ucyB0aGF0IHdlIG1heSB3YW50IHRvIHN1cHBvcnQ7IGhlbmNlIElBTkEg bWlnaHQgYWxsb2NhdGUgYSBjb2RlIHBvaW50IFgyNTUxOV9TSUtFcDQzNCBhbmQgYW5vdGhlciBj b2RlIHBvaW50IGZvciBYMjU1MTlfTlRSVVBSNjUzLiAgV2l0aCB0aGlzIG9wdGlvbiwgdGhlIGNs aWVudCB3b3VsZCBsaXN0IFgyNTUxOV9TSUtFcDQzNCBhbmQgWDI1NTE5X05UUlVQUjY1MyBpbiB0 aGVpciBzdXBwb3J0ZWQgZ3JvdXBzLg0KICAgICAgICAgICAgICAgIEluIHRoaXMgb3B0aW9uLCB3 ZSB3b3VsZCBhc2sgSUFOQSB0byBhbGxvY2F0ZSBjb2RlIHBvaW50cyBmb3IgYWxsIHRoZSB2YXJp b3VzIGNvbWJpbmF0aW9ucyB0aGF0IHdlIHdhbnQgYWxsb3cgdG8gYmUgbmVnb3RpYXRlZC4NCg0K SSB3b3VsZCBsaWtlIHRvIG1ha2UgYW4gYXJndW1lbnQgaW4gZmF2b3Igb2Ygb3B0aW9uIDE6DQoN Cg0KwrcgICAgICAgICBJdCBpcyBsaWtlbHkgdGhhdCBub3QgZXZlcnlvbmUgd2lsbCBiZSBzYXRp c2lmaWVkIHdpdGgg4oCcWDI1NTE5IHBsdXMgb25lIG9mIGEgaGFuZGZ1bCBvZiBzcGVjaWZpYyBw b3N0cXVhbnR1bSBhbGdvcml0aG1z4oCdOyBzb21lIG1heSBwcmVmZXIgYW5vdGhlciBlbGxpcHRp YyBjdXJ2ZSAoZm9yIGV4YW1wbGUsIHg0NDgpLCBvciBwZXJoYXBzIGV2ZW4gYSBNT0RQIGdyb3Vw OyBJIGhhdmUgdGFsa2VkIHRvIHBlb3BsZSB3aG8gZG8gbm90IHRydXN0IEVDQyk7IGluIGFkZGl0 aW9uLCBvdGhlciBwZW9wbGUgbWlnaHQgbm90IHRydXN0IGEgc2luZ2xlIHBvc3RxdWFudHVtIGFs Z29yaXRobSwgYW5kIG1heSB3YW50IHRvIHJlbHkgb24gYm90aCAoZm9yIGV4YW1wbGUpIFNJS0Ug YW5kIE5ld0hvcGUgKHdoaWNoIGFyZSBiYXNlZCBvbiB2ZXJ5IGRpZmZlcmVudCBoYXJkIHByb2Js ZW1zKS4gIFdpdGggb3B0aW9uIDIsIHdlIGNvdWxkIHRyeSB0byBhbnRpY2lwYXRlIGFsbCB0aGUg Y29tbW9uIGNvbWJpbnRhdGlvbnMgKHN1Y2ggYXMgUDM4NF9TSUtFcDQzNF9ORVdIT1BFNTEyQ0NB KSwgaG93ZXZlciB0aGF0IGNvdWxkIHZlcnkgd2VsbCBlbmQgdXAgYXMgYSBsb3Qgb2YgY29tYmlu YXRpb25zLg0KDQrCtyAgICAgICAgIFRoZXJlIGFyZSBsaWtlbHkgdG8gYmUgc2V2ZXJhbCBOSVNU LWFwcHJvdmVkIHBvc3RxdWFudHVtIGtleSBleGNoYW5nZXMsIGFuZCBlYWNoIG9mIHRob3NlIGtl eSBleGNoYW5nZXMgYXJlIGxpa2VseSB0byBoYXZlIGEgbnVtYmVyIG9mIHN1cHBvcnRlZCBwYXJh bWV0ZXIgc2V0cyAoaWYgd2UgdGFrZSB0aGUgc3BlY2lmaWMgcG9zdHF1YW50dW0ga2V5IGV4Y2hh bmdlIGFzIGFuYWxvZ291cyB0byB0aCBFQ0RIIHByb3RvY29vbCwgdGhlIOKAnHBhcmFtZXRlciBz ZXTigJ0gY291bGQgYmUgdGhvdWdodCBvZiBhbiBhbmFsb2dvdXMgdG8gdGhlIHNwZWNpZmljIGVs bGlwdHVjIGN1cnZlLCBhbmQgaXQgbW9kaWZpZXMgdGhlIGtleSBzaGFyZSBzaXplLCB0aGUgcGVy Zm9ybWFuY2UgYW5kIHNvbWV0aW1lcyB0aGUgc2VjdXJpdHkgcHJvcGVydGllcykuICBJbiBmYWN0 LCBvbmUgb2YgdGhlIE5JU1Qgc3VibWlzc29pbnMgY3VycmVudGx5IGhhcyAzMCBwYXJhbWV0ZXIg c2V0cyBkZWZpbmVkLiAgSGVuY2UsIGV2ZW4gaWYgTklTVCBkb2VzbuKAmXQgYXBwcm92ZSBhbGwg dGhlIHBhcmFtZXRlciBzZXRzIChvciBzb21lIG9mIHRoZW0gZG8gbm90IG1ha2Ugc2Vuc2UgZm9y IFRMUyBpbiBhbnkgc2NlbmFyaW8pLCB3ZSBtaWdodCBlbmQgdXAgd2l0aCAyMCBvciBtb3JlIGRp ZmZlcmVudCBrZXkgZXhjaGFuZ2UvcGFyYW1ldGVyIHNldCBjb21iaW5hdGlvbnMgdGhhdCBkbyBt YWtlIHNlbnNlIGZvciBzb21lIHNjZW5hcmlvIHRoYXQgdXNlcyB0TFMgKGJlIGl0IGluIGEgdHJh bmRpdGlvbmFsIFBDIGNsaWVudC9zZXJ2ZXIsIGEgd2lyZWxlc3MgY2xpZW50LCB0d28gY2xvdWQg ZGV2aWNlcyBjb21tdW5pY2F0aW5nIG9yIGFuIElPVCBkZXZpY2UpLg0KDQrCtyAgICAgICAgIElu IGFkZGl0aW9uLCB3ZSBhcmUgbGlrZWx5IHRvIHN1cHBvcnQgYWRkaXRpb25hbCBwcmltaXRpdmVz IGluIHRoZSBmdXR1cmU7IHBvc3NpYmx5IE5hdGlvbmFsIGN1cnZlcyAoZS5nLiBCcmFpbnBvb2wp LCBvciBhZGRpdGlvbmFsIFBvc3RxdWFudHVtIGFsZ29yaXRobXMgKG9yIGFkZGl0aW9uYWwgcGFy YW1ldGVyIHNldHMgdG8gZXhpc3Rpbmcgb25lcykuICBPZiBjb3Vyc2UsIG9uY2Ugd2UgYWRkIHRo YXQgY29kZSBwb2ludCwgd2XigJlsbCBuZWVkIHRvIGFkZCB0aGUgYWRkaXRpb25hbCBjb2RlIHBv aW50cyBmb3IgYWxsIHRoZSBjb21iaW5hdGlvbnMgdGhhdCBpdOKAmWxsIG1ha2Ugc2Vuc2UgaW4g KHZlcnkgbXVjaCBsaWtlIHdlIGhhZCB0byBhZGQgYSBudW1iZXIgb2YgY2lwaGVyc3VpdGVzIHdo ZW5ldmVyIHdlIGFkZGVkIGEgbmV3IGVuY3J5cHRpb24gYWxnb3JpdGhtIGludG8gVExTIDEuMiku DQoNCg0KQXJlIHBlb3BsZSBhY3R1YWxseSBnb2luZyB0byB1c2UgaHlicmlkIGVuY3J5cHRpb24g cG9zdCBOSVNUPyBUaGUgYWN0dWFsIGRlcGxveW1lbnRzIHRvZGF5ICBmb3IgZXhwZXJpbWVudCBo YXZlIGFsbCBmaXQgb3B0aW9uIDIgYW5kIGh5YnJpZHMgYXJlIHVubGlrZWx5IGluIHRoZSBmdXR1 cmUuDQoNCk15IG9iamVjdGlvbiB0byAxIGlzIGl0IGdldHMgdmVyeSBtZXNzeS4gRG8gd2UgdXNl IG9ubHkgdGhlIGh5YnJpZHMgd2UgYm90aCBzdXBwb3J0PyBXaGF0IGlmIEkgdGhyb3cgYSBidW5j aCBvZiBleHBlbnNpdmUgdGhpbmdzIHRvZ2V0aGVyPyBObyByZWFzb24gd2UgbmVlZCBhIGh5YnJp ZCBzY2hlbWUhDQoNCkl0IHNlZW1kcyByZWFzb25hYmxlIHRvIG1lIHRoYXQgdGhlIGNvbWJpbmF0 aW9uIG9mIHRoZXNlIHR3byBmYWN0b3JzIGFyZSBsaWtlbHkgdG8gY2F1c2UgdXMgKHNob3VsZCB3 ZSBzZWxlY3Qgb3B0aW9uIDIpIHRvIGRlZmluZSBhIHZlcnkgbGFyZ2UgbnVtYmVyIG9mIGNvZGUg cG9pbnRzIHRvIGNvdmVyIGFsbCB0aGUgdmFyaW91cyBvcHRpb25zIHRoYXQgcGVvcGxlIG5lZWQu DQoNCk5vdywgdGhpcyBpcyBiYXNlZCBvbiBzcGVjdWxhdGlvbiAoYm90aCBvZiB0aGUgTklTVCBw cm9jZXNzLCBhbmQgYWRkaXRpb25hbCBwcmltaXRpdmVzIHRoYXQgd2lsbCBiZSBhZGRlZCB0byB0 aGUgcHJvdG9jb2wpLCBhbmQgb25lIG9iamVjdGlvbiBJ4oCZdmUgaGVhcmQgaXMg4oCcd2UgZG9u 4oCZdCBrbm93IHdoYXTigJlzIGdvaW5nIHRvIGhhcHBlbiwgYW5kIHNvIHdoeSB3b3VsZCB3ZSBt YWtlIGRlY2lzaW9ucyBiYXNlZCBvbiB0aGlzIHNwZWN1bGF0aW9uP+KAnSAgSSBhZ3JlZSB0aGF0 IHdlIGhhdmUgbGFjayBvZiBrbm93bGVkZ2U7IGhvd2V2ZXIgaXQgc2VlbXMgdG8gbWUgdGhhdCBh IGxhY2sgb2Yga25vd2xlZGdlIGlzIGFuIGFyZ3VtZW50IGluIGZhdm9yIG9mIHNlbGVjdGluZyB0 aGUgbW9yZSBmbGV4aWJsZSBvcHRpb24gKHdoaWNoLCBpbiBteSBvcGluaW9uLCBpcyBvcHRpb24g MSwgYXMgaXQgYWxsb3dzIHRoZSBuZWdvdGlhdGlvbiBvZiBjb21iaW5hdGlvbnMgb2Yga2V5IGV4 Y2hhbmdlcyB0aGF0IHRoZSBXRyBoYXMgbm90IGFudGljaXBhdGVkKS4NCg0KTXkgcGxlYTogbGV0 cyBub3QgcmVwZWF0IHRoZSBUTFMgMS4yIGNpcGhlcnN1aXRlIG1lc3M7IGxldHMgYWRkIGFuIGV4 dGVuc2lvbiB0aGF0IGtlZXBzIHRoZSBudW1iZXIgb2YgY29kZSBwb2ludHMgd2UgbmVlZCB0byBh IHJlYXNvbmFibGUgYm91bmQuDQoNClRoZSBjb3N0cyBvZiBvcHRpb24gMT8NCg0KwrcgICAgICAg ICBJdCBkb2VzIGluY3JlYXNlIHRoZSBjb21wbGV4aXR5IG9uIHRoZSBzZXJ2ZXIgYSBzbWFsbCBh bW91bnQgKEnigJltIG5vdCBhIFRMUyBpbXBsZW1lbnRvciwgaG93ZXZlciBpdCB3b3VsZCBzZWVt IHRvIG1lIHRvIGJlIG9ubHkgYSBmYWlybHkgc21hbGwgYW1vdW50KQ0KDQrCtyAgICAgICAgIEl0 IG1heSBpbmNyZWFzZSB0aGUgc2l6ZSBvZiB0aGUgY2xpZW50IGhlbGxvIGEgc21hbGwgYW1vdW50 IChvbiB0aGUgb3RoZXIgaGFuZCwgYmVjYXVzZSBpdCBhbGxvd3MgdXMgdG8gYXZvaWQgc2VuZGlu ZyBkdXBsaWNhdGUga2V5IHNoYXJlcywgaXQgY2FuIGFsc28gcmVkdWNlIHRoZSBzaXplIG9mIHRo ZSBjbGllbnQgaGVsbG8gYXMgd2VsbCwgZGVwZW5kaW5nIG9uIHdoYXTigJlzIGFjdHVhbGx5IG5l Z290aWF0ZWQpDQpJTUhPLCB0aGUgc21hbGwgaW5jcmVhc2UgaW4gY29tcGxleGl0eSBpcyB3b3J0 aCB0aGUgbGFjayBvZiBjb21wbGV4aXR5IGluIHRoZSBjb2RlIHBvaW50IHRhYmxlLCBhbmQgdGhl IGFkZGl0aW9uYWwgZmxleGliaWxpdHkgaXQgZ2l2ZXMuDQpfX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fXw0KVExTIG1haWxpbmcgbGlzdA0KVExTQGlldGYub3Jn PG1haWx0bzpUTFNAaWV0Zi5vcmc+DQpodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3Rp bmZvL3RsczxodHRwczovL25hbTA2LnNhZmVsaW5rcy5wcm90ZWN0aW9uLm91dGxvb2suY29tLz91 cmw9aHR0cHMlM0ElMkYlMkZ3d3cuaWV0Zi5vcmclMkZtYWlsbWFuJTJGbGlzdGluZm8lMkZ0bHMm ZGF0YT0wMiU3QzAxJTdDQW5kcmVpLlBvcG92JTQwbWljcm9zb2Z0LmNvbSU3QzQ2ZmNhN2ZhYjkx YzRkODc1YzNjMDhkNzE1MjFmNDEzJTdDNzJmOTg4YmY4NmYxNDFhZjkxYWIyZDdjZDAxMWRiNDcl N0MxJTdDMCU3QzYzNzAwMTEwNzkxOTA2NDcwNiZzZGF0YT1DbloxTnFVY1FTSUU4UnFucFBGOGpZ MG9OcCUyRkYlMkJnYkk3aldCN1JhTHNyQSUzRCZyZXNlcnZlZD0wPg0KX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NClRMUyBtYWlsaW5nIGxpc3QNClRMU0Bp ZXRmLm9yZzxtYWlsdG86VExTQGlldGYub3JnPg0KaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1h bi9saXN0aW5mby90bHM8aHR0cHM6Ly9uYW0wNi5zYWZlbGlua3MucHJvdGVjdGlvbi5vdXRsb29r LmNvbS8/dXJsPWh0dHBzJTNBJTJGJTJGd3d3LmlldGYub3JnJTJGbWFpbG1hbiUyRmxpc3RpbmZv JTJGdGxzJmRhdGE9MDIlN0MwMSU3Q0FuZHJlaS5Qb3BvdiU0MG1pY3Jvc29mdC5jb20lN0M0NmZj YTdmYWI5MWM0ZDg3NWMzYzA4ZDcxNTIxZjQxMyU3QzcyZjk4OGJmODZmMTQxYWY5MWFiMmQ3Y2Qw MTFkYjQ3JTdDMSU3QzAlN0M2MzcwMDExMDc5MTkwNjQ3MDYmc2RhdGE9Q25aMU5xVWNRU0lFOFJx bnBQRjhqWTBvTnAlMkZGJTJCZ2JJN2pXQjdSYUxzckElM0QmcmVzZXJ2ZWQ9MD4NCg== --_000_DM5PR2101MB0917BFF8B79FA4D1823F6C4C8CDC0DM5PR2101MB0917_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQph OmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xv cjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1z b0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpwdXJw bGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLm1zb25vcm1hbDAsIGxpLm1zb25v cm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCgltc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4tYm90 dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZv bnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnAuZ21haWwtbTY3MDI1MzY2NDQxMjMy NjE3MzBnbWFpbC1tLTc5MDg5NzI2NTQ2MzcxOTM5ODRnbWFpbC1tNDk0NDg1Njk3NzY5NTY5ODYy OGdtYWlsLW00NDYwODA5MjAxOTIyOTEwMTEyZ21haWwtbTE2NzM2OTQxNzU1NTc5NTg3MTFtNTAx MjExMjg4NjcxMTIxMjg5MG1zb2xpc3RwYXJhZ3JhcGgsIGxpLmdtYWlsLW02NzAyNTM2NjQ0MTIz MjYxNzMwZ21haWwtbS03OTA4OTcyNjU0NjM3MTkzOTg0Z21haWwtbTQ5NDQ4NTY5Nzc2OTU2OTg2 MjhnbWFpbC1tNDQ2MDgwOTIwMTkyMjkxMDExMmdtYWlsLW0xNjczNjk0MTc1NTU3OTU4NzExbTUw MTIxMTI4ODY3MTEyMTI4OTBtc29saXN0cGFyYWdyYXBoLCBkaXYuZ21haWwtbTY3MDI1MzY2NDQx MjMyNjE3MzBnbWFpbC1tLTc5MDg5NzI2NTQ2MzcxOTM5ODRnbWFpbC1tNDk0NDg1Njk3NzY5NTY5 ODYyOGdtYWlsLW00NDYwODA5MjAxOTIyOTEwMTEyZ21haWwtbTE2NzM2OTQxNzU1NTc5NTg3MTFt NTAxMjExMjg4NjcxMTIxMjg5MG1zb2xpc3RwYXJhZ3JhcGgNCgl7bXNvLXN0eWxlLW5hbWU6Z21h aWwtbV82NzAyNTM2NjQ0MTIzMjYxNzMwZ21haWwtbV8tNzkwODk3MjY1NDYzNzE5Mzk4NGdtYWls LW1fNDk0NDg1Njk3NzY5NTY5ODYyOGdtYWlsLW1fNDQ2MDgwOTIwMTkyMjkxMDExMmdtYWlsLW0x NjczNjk0MTc1NTU3OTU4NzExbTUwMTIxMTI4ODY3MTEyMTI4OTBtc29saXN0cGFyYWdyYXBoOw0K CW1zby1tYXJnaW4tdG9wLWFsdDphdXRvOw0KCW1hcmdpbi1yaWdodDowaW47DQoJbXNvLW1hcmdp bi1ib3R0b20tYWx0OmF1dG87DQoJbWFyZ2luLWxlZnQ6MGluOw0KCWZvbnQtc2l6ZToxMS4wcHQ7 DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0Kc3Bhbi5FbWFpbFN0eWxlMTkN Cgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWw7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMt c2VyaWY7DQoJY29sb3I6d2luZG93dGV4dDt9DQpzcGFuLkVtYWlsU3R5bGUyMA0KCXttc28tc3R5 bGUtdHlwZTpwZXJzb25hbC1yZXBseTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJp ZjsNCgljb2xvcjp3aW5kb3d0ZXh0O30NCi5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBl OmV4cG9ydC1vbmx5Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJ e3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBpbiAxLjBpbiAxLjBpbjt9DQpk aXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi8qIExpc3QgRGVmaW5pdGlv bnMgKi8NCkBsaXN0IGwwDQoJe21zby1saXN0LWlkOjU0MDI5MDY2NTsNCgltc28tbGlzdC10ZW1w bGF0ZS1pZHM6MjEyMzgxMzAwMDt9DQpAbGlzdCBsMDpsZXZlbDENCgl7bXNvLWxldmVsLW51bWJl ci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0 b3A6LjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6 LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9s O30NCkBsaXN0IGwwOmxldmVsMg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJ bXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDoxLjBpbjsNCgltc28tbGV2 ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNp LWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwwOmxldmVs Mw0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3 Ow0KCW1zby1sZXZlbC10YWItc3RvcDoxLjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9u OmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7 DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwwOmxldmVsNA0KCXttc28tbGV2ZWwtbnVt YmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWIt c3RvcDoyLjBpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRl bnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6U3lt Ym9sO30NCkBsaXN0IGwwOmxldmVsNQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7 DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDoyLjVpbjsNCgltc28t bGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1h bnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwwOmxl dmVsNg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6 74K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDozLjBpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0 aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4w cHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwwOmxldmVsNw0KCXttc28tbGV2ZWwt bnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10 YWItc3RvcDozLjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1p bmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6 U3ltYm9sO30NCkBsaXN0IGwwOmxldmVsOA0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxs ZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDo0LjBpbjsNCglt c28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1z by1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGww OmxldmVsOQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRl eHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDo0LjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBv c2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZTox MC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwxDQoJe21zby1saXN0LWlkOjE1 NTg1OTE3NzU7DQoJbXNvLWxpc3QtdGVtcGxhdGUtaWRzOjQ2Mjg2MjE2NDt9DQpAbGlzdCBsMTps ZXZlbDENCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0 Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6LjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0 aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4w cHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwxOmxldmVsMg0KCXttc28tbGV2ZWwt bnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10 YWItc3RvcDoxLjBpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1p bmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6 U3ltYm9sO30NCkBsaXN0IGwxOmxldmVsMw0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxs ZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDoxLjVpbjsNCglt c28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1z by1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwx OmxldmVsNA0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRl eHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDoyLjBpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBv c2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZTox MC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwxOmxldmVsNQ0KCXttc28tbGV2 ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZl bC10YWItc3RvcDoyLjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4 dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1p bHk6U3ltYm9sO30NCkBsaXN0IGwxOmxldmVsNg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpi dWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDozLjBpbjsN Cgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0K CW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0 IGwxOmxldmVsNw0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVs LXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDozLjVpbjsNCgltc28tbGV2ZWwtbnVtYmVy LXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6 ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwxOmxldmVsOA0KCXttc28t bGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1s ZXZlbC10YWItc3RvcDo0LjBpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJ dGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1m YW1pbHk6U3ltYm9sO30NCkBsaXN0IGwxOmxldmVsOQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1h dDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDo0LjVp bjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWlu Ow0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCm9s DQoJe21hcmdpbi1ib3R0b206MGluO30NCnVsDQoJe21hcmdpbi1ib3R0b206MGluO30NCi0tPjwv c3R5bGU+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWRlZmF1bHRzIHY6ZXh0PSJl ZGl0IiBzcGlkbWF4PSIxMDI2IiAvPg0KPC94bWw+PCFbZW5kaWZdLS0+PCEtLVtpZiBndGUgbXNv IDldPjx4bWw+DQo8bzpzaGFwZWxheW91dCB2OmV4dD0iZWRpdCI+DQo8bzppZG1hcCB2OmV4dD0i ZWRpdCIgZGF0YT0iMSIgLz4NCjwvbzpzaGFwZWxheW91dD48L3htbD48IVtlbmRpZl0tLT4NCjwv aGVhZD4NCjxib2R5IGxhbmc9IkVOLVVTIiBsaW5rPSJibHVlIiB2bGluaz0icHVycGxlIj4NCjxk aXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5TdXJlLCBoeWJy aWQta2V5LWV4Y2hhbmdlIOKAnGZsYWfigJ0gZXh0ZW5zaW9uIGlzIHRvbyBnZW5lcmljLiBXZSBj b3VsZCBoYXZlIHRoZSBjbGllbnQgYWR2ZXJ0aXNlIHNvbWV0aGluZyBsaWtlIG9uZS10cmFkaXRp b25hbC1hbmQtb25lLVBRLCBhbmQgc3RpbGwgYXZvaWQgdGhlIENhcnRlc2lhbiBwcm9kdWN0Ljxv OnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD48L286cD48L3A+DQo8ZGl2 Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjRTFFMUUxIDEuMHB0 O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+RnJv bTo8L2I+IFRMUyAmbHQ7dGxzLWJvdW5jZXNAaWV0Zi5vcmcmZ3Q7IDxiPk9uIEJlaGFsZiBPZiA8 L2I+DQpCbHVtZW50aGFsLCBVcmkgLSAwNTUzIC0gTUlUTEw8YnI+DQo8Yj5TZW50OjwvYj4gVHVl c2RheSwgSnVseSAzMCwgMjAxOSAxMjoxMiBQTTxicj4NCjxiPlRvOjwvYj4gRGF2aWQgQmVuamFt aW4gJmx0O2RhdmlkYmVuQGNocm9taXVtLm9yZyZndDs8YnI+DQo8Yj5DYzo8L2I+IFRMUyBMaXN0 ICZsdDt0bHNAaWV0Zi5vcmcmZ3Q7PGJyPg0KPGI+U3ViamVjdDo8L2I+IFJlOiBbVExTXSBPcHRp b25zIGZvciBuZWdvdGlhdGluZyBoeWJyaWQga2V5IGV4Y2hhbmdlcyBmb3IgcG9zdHF1YW50dW08 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpw PiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVm dDouNWluIj5UaGUgbnVpc2FuY2Ugd2l0aCBqdXN0IGEgZmxhZyBpcyB0aGUgY2xpZW50IGNhbid0 IGV4cHJlc3MgW3doYXQgSSB0aGluayBhcmVdIHJlYXNvbmFibGUgcHJlZmVyZW5jZXMuIEl0IHNo b3VsZCBiZSBhYmxlIHRvIHNheSB0aGluZ3MgbGlrZToNCjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iY29sb3I6IzAwNzBDMCI+T2ZmaGFuZCwgSSA8dT5kb27igJl0PC91PiBz ZWUgYXQgYWxsIHdoeSB0aGUgY2xpZW50IHNob3VsZCBiZSBhYmxlIHRvIHNheSBhbnkgb2YgdGhl c2Ug4oCcZG9u4oCZdOKAnXM6PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48bzpwPiZuYnNwOzwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVm dDouNWluIj4qIERvbid0IGRvIFgyNTUxOSZuYnNwOyYjNDM7IFAtMjU2LiBUaGlzIGlzIGp1c3Qg c2lsbHkuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+KiBEb24ndCBkbyBQUTEgb24gaXRzIG93bi4gSSBy ZWFsbHkgd2FudCB0aGUgUFEgc2NoZW1lIHBhaXJlZCB3aXRoIHNvbWV0aGluZyBtb3JlIGVzdGFi bGlzaGVkLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPiogRG9uJ3QgZG8gUFExJm5ic3A7JiM0MzsgUFEy LiBJIHNhaWQgc29tZXRoaW5nIG1vcmUgZXN0YWJsaXNoZWQsIHBsZWFzZS48bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4qIERvbid0 IGRvIFBRMSZuYnNwOyYjNDM7IFgyNTUxOSZuYnNwOyYjNDM7IFAtMjU2LiBXaHkgYXJlIHlvdSBk b2luZyB0aHJlZSBvZiB0aGVzZT88bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4qIERvbid0IGRvIFBRMSZuYnNwOyYjNDM7IFBRMiZu YnNwOyYjNDM7IFBRMyZuYnNwOyYjNDM7IFBRNCZuYnNwOyYjNDM7IFgyNTUxOSZuYnNwOyYjNDM7 IFAtMjU2Jm5ic3A7JiM0MzsgUC0zODQmbmJzcDsmIzQzOyBGRkRIRTIwNDgmbmJzcDsmIzQzOyBG RkRIRTMwNzIsIG93dyBteSBoZWFkLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iY29sb3I6IzAwNzBDMCI+VGhpcyBpcyB0aGUgb25seSB0aGluZyB0aGF0IElNSE8gdGhlIGNs aWVudA0KPHU+c2hvdWxkPC91PiBiZSBhYmxlIHRvIHNheTo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4qIFBRMSZu YnNwOyYjNDM7IFgyNTUxOSBpcyBjb29sLiBJIGxpa2UgdGhhdCBjb21iby48bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouLjVp biI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFy Z2luLWxlZnQ6LjVpbiI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+T24gVHVlLCBKdWwgMzAsIDIw MTkgYXQgMjo0OCBQTSBBbmRyZWkgUG9wb3YgJmx0OzxhIGhyZWY9Im1haWx0bzpBbmRyZWkuUG9w b3ZAbWljcm9zb2Z0LmNvbSIgdGFyZ2V0PSJfYmxhbmsiPkFuZHJlaS5Qb3BvdkBtaWNyb3NvZnQu Y29tPC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0 eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6 MGluIDBpbiAwaW4gMGluO21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi10b3A6NS4wcHQ7bWFyZ2lu LXJpZ2h0OjBpbjttYXJnaW4tYm90dG9tOjUuMHB0O3BhZGRpbmc6Ni4uMHB0Ij4NCjxkaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRv O21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0Oi41aW4iPg0KR2l2ZW4gdGhl c2Ugb3B0aW9ucywgSSBhbHNvIHByZWZlciBvcHRpb24gMiwgZm9yIHNvbWUgb2YgdGhlIHNhbWUg cmVhc29ucy48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVm dDouNWluIj4NCiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21h cmdpbi1sZWZ0Oi41aW4iPg0KRm9yIG15IHVuZGVyc3RhbmRpbmcgdGhvdWdoLCB3aHkgbm90IGhh dmUgdGhlIGNsaWVudCBhZHZlcnRpc2Ugc3VwcG9ydCBmb3IgaHlicmlkLWtleS1leGNoYW5nZSAo ZS5nLiB2aWEgYSDigJxmbGFn4oCdIGV4dGVuc2lvbikgYW5kIHRoZW4gS2V5U2hhcmVTZXJ2ZXJI ZWxsbyBjYW4gY29udGFpbiB0d28gS2V5U2hhcmVFbnRyaWVzIChlc3NlbnRpYWxseSwgdXNpbmcg dGhlIHNhbWUgZm9ybWF0IGFzIEtleVNoYXJlQ2xpZW50SGVsbG8/IFRoaXMgd291bGQNCiBzb2x2 ZSB0aGUgQ2FydGVzaWFuIHByb2R1Y3QgaXNzdWUuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0 b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6LjVpbiI+DQombmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFy Z2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDouNWluIj4NCkNoZWVycyw8bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0 bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDouNWluIj4NCiZuYnNwOzxv OnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9w LWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0Oi41aW4iPg0K QW5kcmVpPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1h cmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6 LjVpbiI+DQombmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJn aW4tbGVmdDouNWluIj4NCjxiPkZyb206PC9iPiBUTFMgJmx0OzxhIGhyZWY9Im1haWx0bzp0bHMt Ym91bmNlc0BpZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPnRscy1ib3VuY2VzQGlldGYub3JnPC9h PiZndDsNCjxiPk9uIEJlaGFsZiBPZiA8L2I+RGF2aWQgQmVuamFtaW48YnI+DQo8Yj5TZW50Ojwv Yj4gVHVlc2RheSwgSnVseSAzMCwgMjAxOSAxMToyNCBBTTxicj4NCjxiPlRvOjwvYj4gV2F0c29u IExhZGQgJmx0OzxhIGhyZWY9Im1haWx0bzp3YXRzb25ibGFkZEBnbWFpbC5jb20iIHRhcmdldD0i X2JsYW5rIj53YXRzb25ibGFkZEBnbWFpbC5jb208L2E+Jmd0Ozxicj4NCjxiPkNjOjwvYj4gVExT IExpc3QgJmx0OzxhIGhyZWY9Im1haWx0bzp0bHNAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj50 bHNAaWV0Zi5vcmc8L2E+Jmd0Ozxicj4NCjxiPlN1YmplY3Q6PC9iPiBSZTogW1RMU10gT3B0aW9u cyBmb3IgbmVnb3RpYXRpbmcgaHlicmlkIGtleSBleGNoYW5nZXMgZm9yIHBvc3RxdWFudHVtPG86 cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3At YWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6LjVpbiI+DQom bmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRv O21hcmdpbi1sZWZ0Oi41aW4iPg0KSSB0aGluayB0aGlzIHVuZGVyZXN0aW1hdGVzIHRoZSBjb21w bGV4aXR5IGNvc3Qgb2Ygb3B0aW9uIDEgdG8gdGhlIHByb3RvY29sIGFuZCBpbXBsZW1lbnRhdGlv bnMuIE9wdGlvbiAxIG1lYW5zIGdyb3VwIG5lZ290aWF0aW9uIGluY2x1ZGVzIGVudGlyZSBjb2Rl cG9pbnRzIHdob3NlIG1lYW5pbmcgY2Fubm90IGJlIGRldGVybWluZWQgd2l0aG91dCBhIHBhcmFs bGVsIGV4dGVuc2lvbi4gVGhpcyBjb21wb3VuZHMgYWNyb3NzIGV2ZXJ5dGhpbmcgd2hpY2gNCiBp bnRlcmFjdHMgd2l0aCBuYW1lZCBncm91cHMsIGltcGFjdGluZyBldmVyeXRoaW5nIGZyb20gQVBJ cyB0byBjb25maWcgZmlsZSBmb3JtYXRzIHRvIGV2ZW4gVUkgc3VyZmFjZXMuIE90aGVyIHVzZXMg b2YgTmFtZWRHcm91cHMgYXJlIGltcGFjdGVkIHRvby4gRm9yIGluc3RhbmNlLCBvcHRpb24gMiBm aXRzIGludG8gZHJhZnQtaWV0Zi10bHMtZXNuaSBhcy1pcy4gT3B0aW9uIDEgcmVxdWlyZXMgaW5q ZWN0aW5nJm5ic3A7aHlicmlkX2V4dGVuc2lvbiBpbnRvDQogRVNOSSBzb21laG93LiBBbmFseXNp cyBtdXN0IGZ1cnRoZXIgY2hlY2sgZXZlcnkgdXNlLCBzYXksIGluY29ycG9yYXRlcyB0aGlzIHBh cmFsbGVsIGxvb2t1cCB0YWJsZSBpbnRvIHRyYW5zY3JpcHQtbGlrZSBtZWFzdXJlcy48bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVm dDouNWluIj4NCiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90 dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0Oi41aW4iPg0KVGhlIGxlc3NvbiBmcm9tIFRMUyAxLjIg Y29kZSBwb2ludHMgaXMgbm90IGNvbWJpbmVkIGNvZGVwb2ludHMgdnMuIHNwbGl0IG9uZXMuIFJh dGhlciwgdGhlIGxlc3NvbiBpcyB0byBhdm9pZCBpbnRlcmRlcGVuZGVudCBkZWNpc2lvbnM6PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2lu LWxlZnQ6LjVpbiI+DQombmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2lu LWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDouNWluIj4NCiogU2lnbmF0dXJlIGFsZ29yaXRo bXMgaW4gVExTIDEuMiB3ZXJlIGEgbWVzcyBiZWNhdXNlIHRoZSBFQ0RTQSBjb2RlcG9pbnRzIHJl cXVpcmVkIGNyb3NzLXJlZmVyZW5jaW5nIGFnYWluc3QgdGhlIHN1cHBvcnRlZCBjdXJ2ZXMgbGlz dC4gVGhlIHZlcmlmaWVyIGNvdWxkIG5vdCBleHByZXNzIHNvbWUgcHJlZmVyZW5jZXMgKHNpZ25p bmcgU0hBLTUxMiB3aXRoIFAtMjU2IGlzIHNpbGx5LCBhbmQgbWl4aW5nIGhhc2gmIzQzO2N1cnZl IHBhaXJzIGluIEVDRFNBDQogaXMgc2xpZ2h0bHkgb2ZmIGluIGdlbmVyYWwpLiBBcyBhbmFsb2d5 IHRvIG9wdGlvbiAxJ3MgRVNOSSBwcm9ibGVtLCB3ZSBldmVuIGZvcmdvdCB0byBhbGxvdyB0aGUg c2VydmVyIHRvIGV4cHJlc3MgY3VydmUgcHJlZmVyZW5jZXMuIFRMUyAxLjMgY29tYmluZWQgc2ln bmF0dXJlIGFsZ29yaXRobSBjb25zaWRlcmF0aW9ucyBpbnRvIGEgc2luZ2xlIGNvZGVwb2ludCB0 byBhZGRyZXNzIGFsbCB0aGlzLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0Oi41aW4iPg0KJm5ic3A7PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10 b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6LjVpbiI+ DQoqIENpcGhlciBzdWl0ZXMgaW4gVExTIDEuMiB3ZXJlIGEgbWVzcyBiZWNhdXNlIHRoZXkgd2Vy ZSBoYWxmLWNvbWJpbmVkIGFuZCBoYWxmLXNwbGl0LiBUTFNfRUNESEVfRUNEU0FfV0lUSF9BRVNf MTI4X0dDTV9TSEEyNTYgc2FpZCB0byB1c2Ugc29tZSBFQ0RIRSBrZXkgZXhjaGFuZ2UsIGJ1dCB5 b3UgbmVlZCB0byBjaGVjayBpZiB5b3UgaGF2ZSBhIE5hbWVkR3JvdXAgaW4gY29tbW9uIGZpcnN0 LiBJdCBzYWlkIHRvIHVzZSBFQ0RTQSwgYnV0IHlvdQ0KIG5lZWQgdG8gY2hlY2sgc2lnbmF0dXJl IGFsZ29yaXRobXMgKHdoaWNoIHRoZW1zZWx2ZXMgY3Jvc3MtcmVmZXJlbmNlIGN1cnZlcykgZmly c3QuIEVhcmx5IGRyYWZ0cyBvZiBUTFMgMS4zIGhhZCBpdCBldmVuIHdvcnNlLCB3aGVyZSBhJm5i c3A7VExTX0VDREhFX0VDRFNBX1dJVEhfQUVTXzEyOF9HQ01fU0hBMjU2IGZ1bGwgaGFuZHNoYWtl IG1vcnBoZWQgaW50byZuYnNwO1RMU19FQ0RIRV9QU0tfV0lUSF9BRVNfMTI4X0dDTV9TSEEyNTYg b24gcmVzdW1wdGlvbi4NCiBUaHVzLCBUTFMgMS4zIGNpcGhlciBzdWl0ZXMgbmVnb3RpYXRlIHNv bGVseSBBRUFEJm5ic3A7JiM0MzsgUFJGIGhhc2guPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87 bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6LjVpbiI+DQombmJzcDs8bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt c28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4t bGVmdDouNWluIj4NCkluIGZhaXJuZXNzIHRvIFRMUyAxLjIsIHNvbWUgb2YgdGhpcyB3YXMgYSBj b25zZXF1ZW5jZSBvZiBUTFMgMS4yJ3MgZXZvbHV0aW9uIG92ZXIgdGltZSBhcyBpbmNyZW1lbnRh bCBleHRlbnNpb25zIG92ZXIgU1NMIDMuMC4gQW5kIHNvbWV0aW1lcyB3ZSBkbyBuZWVkIHRvIHBh eSBjb3N0cyBsaWtlIHRoZXNlLiBCdXQgaHlicmlkIGtleSBleGNoYW5nZXMgZml0IGludG8gdGhl IE5hbWVkR3JvdXAgJnF1b3Q7QVBJJnF1b3Q7IGp1c3QgZmluZSwgc28gb3B0aW9uIDIgaXMNCiB0 aGUgY2xlYXIgYW5zd2VyLiBDb2RlIHBvaW50cyBhcmUgY2hlYXAuIFByb3RvY29sIGNvbXBsZXhp dHkgaXMgbXVjaCBtb3JlIGV4cGVuc2l2ZS48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28t bWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDouNWluIj4NCiZuYnNwOzxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1t YXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0 Oi41aW4iPg0KSXQncyB0cnVlIHRoYXQgc3RhbmRhcmRzIGFyZSBvZnRlbiB1bmRlcnNwZWNpZmll ZC4gVGhpcyBtZWFucyB0aGUgSUVURiBzaG91bGQgZmluaXNoIHRoZSBqb2IsIG5vdCBwYXNzIGFs bCB2YXJpYXRpb25zIHRocm91Z2guIFJTQS1QU1MgaXMgYSBjbGVhciBleGFtcGxlIG9mIHdoYXQg dG8gYXZvaWQuIEl0IHRha2VzIG1vcmUgYnl0ZXMgdG8gbWVyZWx5IHV0dGVyICZxdW90O1JTQS1Q U1Mgd2l0aCBTSEEtMjU2IGFuZCB1c3VhbCBwYXJhbWV0ZXJzJnF1b3Q7IGluIFguNTA5DQogdGhh biB0byBlbmNvZGUgYW4gZW50aXJlIEVDRFNBIHNpZ25hdHVyZSEgV2Ugc2hvdWxkIG5vdCBkZWZp bmUgbW9yZSB0aGFuIGEgaGFuZGZ1bCBvZiBvcHRpb25zLCByZWdhcmRsZXNzIG9mIHRoZSBlbmNv ZGluZy4uLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFy Z2luLWxlZnQ6LjVpbiI+DQombmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJn aW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0Oi41aW4iPg0KT24gVHVlLCBKdWwgMzAsIDIw MTkgYXQgMTI6MTggUE0gV2F0c29uIExhZGQgJmx0OzxhIGhyZWY9Im1haWx0bzp3YXRzb25ibGFk ZEBnbWFpbC5jb20iIHRhcmdldD0iX2JsYW5rIj53YXRzb25ibGFkZEBnbWFpbC5jb208L2E+Jmd0 OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRl cjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowaW4gMGluIDBp biA2LjBwdDttYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1yaWdodDowaW47bWFyZ2luLWJvdHRvbTo1 LjBwdDttYXJnaW4tbGVmdDo0Li44cHQiPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bWFyZ2luLWJvdHRvbToxMi4wcHQ7 bWFyZ2luLWxlZnQ6LjVpbiI+DQombmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1t YXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0Oi41aW4iPg0KT24gVHVlLCBKdWwgMzAs IDIwMTksIDg6MjEgQU0gU2NvdHQgRmx1aHJlciAoc2ZsdWhyZXIpICZsdDs8YSBocmVmPSJtYWls dG86c2ZsdWhyZXJAY2lzY28uY29tIiB0YXJnZXQ9Il9ibGFuayI+c2ZsdWhyZXJAY2lzY28uY29t PC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxl PSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGlu IDBpbiAwaW4gNi4wcHQ7bWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tcmlnaHQ6MGluO21hcmdpbi1i b3R0b206NS4wcHQ7bWFyZ2luLWxlZnQ6NC4uOHB0Ij4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90 dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0Oi41aW4iPg0KRHVyaW5nIHRoZSBwaHlzaWNhbCBtZWV0 aW5nIGluIE1vbnRyZWFsLCB3ZSBoYWQgYSBkaXNjdXNzaW9uIGFib3V0IHBvc3RxdWFudHVtIHNl Y3VyaXR5LCBhbmQgaW4gcGFydGljdWxhciwgb24gaG93IG9uZSBtaWdodCB3YW50IHRvIG5lZ290 aWF0ZSBzZXZlcmFsIGRpZmZlcmVudCDigJhncm91cHPigJkgc2ltdWx0YW5lb3VzbHkgKGJlY2F1 c2UgdGhlcmUgbWlnaHQgbm90IGJlIG9uZSBncm91cCB0aGF0IGlzIGVudGlyZWx5IHRydXN0ZWQs IGFuZCBJIHB1dA0KIOKAmGdyb3Vwc+KAmSBpbiBzY2FyZXF1b3RlcyBiZWNhdXNlIHBvc3RxdWFu dHVtIGtleSBleGNoYW5nZXMgYXJlIHR5cGljYWxseSBub3QgZm9ybWVkIGZyb20gYSBEaWZmaWUt SGVsbG1hbiBncm91cCkuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFy Z2luLWxlZnQ6LjVpbiI+DQo8c3BhbiBsYW5nPSJFTi1HQiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9v OnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDph dXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0Oi41aW4iPg0KPHNwYW4g bGFuZz0iRU4tR0IiPkF0IHRoZSBtZWV0aW5nLCB0aGVyZSB3ZXJlIHR3byBvcHRpb25zIHByZXNl bnRlZDo8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2lu LWxlZnQ6LjVpbiI+DQo8c3BhbiBsYW5nPSJFTi1HQiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRv O21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0Oi41aW4iPg0KPHNwYW4gbGFu Zz0iRU4tR0IiPk9wdGlvbiAxOiBhcyB0aGUgc3VwcG9ydGVkIGdyb3VwLCB3ZSBpbnNlcnQgYSDi gJhoeWJyaWQgbWFya2Vy4oCZIChhbmQgaW5jbHVkZSBhbiBleHRlbnNpb24gdGhhdCBtYXAgbGlz dHMgd2hpY2ggY29tYmluYXRpb24gdGhlIGh5YnJpZCBtYXJrZXIgc3RhbmRzIGZvcik8L3NwYW4+ PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10 b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6LjVpbiI+ DQo8c3BhbiBsYW5nPSJFTi1HQiI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IEZv ciBleGFtcGxlLCB0aGUgY2xpZW50IG1pZ2h0IGxpc3QgaW4gaGlzIHN1cHBvcnRlZCBncm91cHMg aHlicmlkX21hcmtlcl8wIGFuZCBoeWJyaWRfbWFya2VyXzEsIGFuZCB0aGVyZSB3b3VsZCBiZSBh IHNlcGFyYXRlIGV4dGVuc2lvbiB0aGF0IGxpc3RzIGh5YnJpZF9tYXJrZXJfMCA9IFgyNTUxOSAm IzQzOyBTSUtFcDQzNCBhbmQgaHlicmlkX21hcmtlcl8xID0gWDI1NTE5ICYjNDM7IE5UUlVQUjY1 My4mbmJzcDsNCiBUaGUgc2VydmVyIHdvdWxkIHRoZW4gbG9vayB1cCB0aGUgbWVhbmluZ3Mgb2Yg aHlicmlkX21hcmtlcl8wIGFuZCAxIGluIHRoZSBleHRlbnNpb24sIGFuZCB0aGVuIGNvbXBhcmUg dGhhdCBhZ2FpbnN0IGhpcyBzZWN1cml0eSBwb2xpY3kuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1t YXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0Oi41aW47dGV4dC1pbmRlbnQ6LjVpbiI+ DQo8c3BhbiBsYW5nPSJFTi1HQiI+SW4gdGhpcyBvcHRpb24sIHdlIHdvdWxkIGFzayBJQU5BIHRv IGFsbG9jYXRlIGNvZGUgcG9pbnRzIGZvciB0aGUgdmFyaW91cyBpbmRpdmlkdWFsIHBvc3RxdWFu dHVtIGtleSBleGNoYW5nZXMgKGluIHRoaXMgZXhhbXBsZSwgU0lLRXA0MzQgYW5kIE5UUlVQUjY1 MyksIGFzIHdlbGwgYSByYW5nZSBvZiBjb2RlIHBvaW50cyBmb3IgdGhlIHZhcmlvdXMgaHlicmlk X21hcmtlcnMuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2tx dW90ZT4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJi b3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGluIDBp biAwaW4gNi4wcHQ7bWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tcmlnaHQ6MGluO21hcmdpbi1ib3R0 b206NS4wcHQ7bWFyZ2luLWxlZnQ6NC4uOHB0Ij4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9t LWFsdDphdXRvO21hcmdpbi1sZWZ0Oi41aW4iPg0KPHNwYW4gbGFuZz0iRU4tR0IiPiZuYnNwOzwv c3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFy Z2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDou NWluIj4NCjxzcGFuIGxhbmc9IkVOLUdCIj5PcHRpb24gMjogd2UgaGF2ZSBjb2RlIHBvaW50cyBm b3IgYWxsIHRoZSB2YXJpb3VzIGNvbWJpbmF0aW9ucyB0aGF0IHdlIG1heSB3YW50IHRvIHN1cHBv cnQ7IGhlbmNlIElBTkEgbWlnaHQgYWxsb2NhdGUgYSBjb2RlIHBvaW50IFgyNTUxOV9TSUtFcDQz NCBhbmQgYW5vdGhlciBjb2RlIHBvaW50IGZvciBYMjU1MTlfTlRSVVBSNjUzLiZuYnNwOyBXaXRo IHRoaXMgb3B0aW9uLCB0aGUgY2xpZW50IHdvdWxkIGxpc3QgWDI1NTE5X1NJS0VwNDM0DQogYW5k IFgyNTUxOV9OVFJVUFI2NTMgaW4gdGhlaXIgc3VwcG9ydGVkIGdyb3Vwcy48L3NwYW4+PG86cD48 L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0 OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6LjVpbiI+DQo8c3Bh biBsYW5nPSJFTi1HQiI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IEluIHRoaXMg b3B0aW9uLCB3ZSB3b3VsZCBhc2sgSUFOQSB0byBhbGxvY2F0ZSBjb2RlIHBvaW50cyBmb3IgYWxs IHRoZSB2YXJpb3VzIGNvbWJpbmF0aW9ucyB0aGF0IHdlIHdhbnQgYWxsb3cgdG8gYmUgbmVnb3Rp YXRlZC48L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2lu LWxlZnQ6LjVpbiI+DQo8c3BhbiBsYW5nPSJFTi1HQiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRv O21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0Oi41aW4iPg0KPHNwYW4gbGFu Zz0iRU4tR0IiPkkgd291bGQgbGlrZSB0byBtYWtlIGFuIGFyZ3VtZW50IGluIGZhdm9yIG9mIG9w dGlvbiAxOjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJn aW4tbGVmdDouNWluIj4NCjxzcGFuIGxhbmc9IkVOLUdCIj4mbmJzcDs8L3NwYW4+PG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTY3MDI1MzY2NDQxMjMyNjE3MzBnbWFpbC1tLTc5MDg5 NzI2NTQ2MzcxOTM5ODRnbWFpbC1tNDk0NDg1Njk3NzY5NTY5ODYyOGdtYWlsLW00NDYwODA5MjAx OTIyOTEwMTEyZ21haWwtbTE2NzM2OTQxNzU1NTc5NTg3MTFtNTAxMjExMjg4NjcxMTIxMjg5MG1z b2xpc3RwYXJhZ3JhcGgiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbjt0ZXh0LWluZGVudDotLjI1 aW47bXNvLWxpc3Q6bDAgbGV2ZWwxIGxmbzIiPg0KPCFbaWYgIXN1cHBvcnRMaXN0c10+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6U3ltYm9sIj48c3BhbiBzdHlsZT0i bXNvLWxpc3Q6SWdub3JlIj7CtzxzcGFuIHN0eWxlPSJmb250OjcuMHB0ICZxdW90O1RpbWVzIE5l dyBSb21hbiZxdW90OyI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7DQo8L3NwYW4+PC9zcGFuPjwvc3Bhbj48IVtlbmRpZl0+PHNwYW4gbGFuZz0iRU4tR0Ii Pkl0IGlzIGxpa2VseSB0aGF0IG5vdCBldmVyeW9uZSB3aWxsIGJlIHNhdGlzaWZpZWQgd2l0aCDi gJxYMjU1MTkgcGx1cyBvbmUgb2YgYSBoYW5kZnVsIG9mIHNwZWNpZmljIHBvc3RxdWFudHVtIGFs Z29yaXRobXPigJ07IHNvbWUgbWF5IHByZWZlciBhbm90aGVyIGVsbGlwdGljIGN1cnZlIChmb3Ig ZXhhbXBsZSwgeDQ0OCksIG9yIHBlcmhhcHMgZXZlbiBhIE1PRFAgZ3JvdXA7DQogSSBoYXZlIHRh bGtlZCB0byBwZW9wbGUgd2hvIGRvIG5vdCB0cnVzdCBFQ0MpOyBpbiBhZGRpdGlvbiwgb3RoZXIg cGVvcGxlIG1pZ2h0IG5vdCB0cnVzdCBhIHNpbmdsZSBwb3N0cXVhbnR1bSBhbGdvcml0aG0sIGFu ZCBtYXkgd2FudCB0byByZWx5IG9uIGJvdGggKGZvciBleGFtcGxlKSBTSUtFIGFuZCBOZXdIb3Bl ICh3aGljaCBhcmUgYmFzZWQgb24gdmVyeSBkaWZmZXJlbnQgaGFyZCBwcm9ibGVtcykuJm5ic3A7 IFdpdGggb3B0aW9uIDIsIHdlIGNvdWxkDQogdHJ5IHRvIGFudGljaXBhdGUgYWxsIHRoZSBjb21t b24gY29tYmludGF0aW9ucyAoc3VjaCBhcyBQMzg0X1NJS0VwNDM0X05FV0hPUEU1MTJDQ0EpLCBo b3dldmVyIHRoYXQgY291bGQgdmVyeSB3ZWxsIGVuZCB1cCBhcyBhIGxvdCBvZiBjb21iaW5hdGlv bnMuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW02NzAyNTM2NjQ0MTIz MjYxNzMwZ21haWwtbS03OTA4OTcyNjU0NjM3MTkzOTg0Z21haWwtbTQ5NDQ4NTY5Nzc2OTU2OTg2 MjhnbWFpbC1tNDQ2MDgwOTIwMTkyMjkxMDExMmdtYWlsLW0xNjczNjk0MTc1NTU3OTU4NzExbTUw MTIxMTI4ODY3MTEyMTI4OTBtc29saXN0cGFyYWdyYXBoIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4w aW47dGV4dC1pbmRlbnQ6LS4yNWluO21zby1saXN0OmwwIGxldmVsMSBsZm8yIj4NCjwhW2lmICFz dXBwb3J0TGlzdHNdPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OlN5 bWJvbCI+PHNwYW4gc3R5bGU9Im1zby1saXN0Oklnbm9yZSI+wrc8c3BhbiBzdHlsZT0iZm9udDo3 LjBwdCAmcXVvdDtUaW1lcyBOZXcgUm9tYW4mcXVvdDsiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOw0KPC9zcGFuPjwvc3Bhbj48L3NwYW4+PCFbZW5kaWZd PjxzcGFuIGxhbmc9IkVOLUdCIj5UaGVyZSBhcmUgbGlrZWx5IHRvIGJlIHNldmVyYWwgTklTVC1h cHByb3ZlZCBwb3N0cXVhbnR1bSBrZXkgZXhjaGFuZ2VzLCBhbmQgZWFjaCBvZiB0aG9zZSBrZXkg ZXhjaGFuZ2VzIGFyZSBsaWtlbHkgdG8gaGF2ZSBhIG51bWJlciBvZiBzdXBwb3J0ZWQgcGFyYW1l dGVyIHNldHMgKGlmIHdlIHRha2UgdGhlIHNwZWNpZmljIHBvc3RxdWFudHVtIGtleSBleGNoYW5n ZQ0KIGFzIGFuYWxvZ291cyB0byB0aCBFQ0RIIHByb3RvY29vbCwgdGhlIOKAnHBhcmFtZXRlciBz ZXTigJ0gY291bGQgYmUgdGhvdWdodCBvZiBhbiBhbmFsb2dvdXMgdG8gdGhlIHNwZWNpZmljIGVs bGlwdHVjIGN1cnZlLCBhbmQgaXQgbW9kaWZpZXMgdGhlIGtleSBzaGFyZSBzaXplLCB0aGUgcGVy Zm9ybWFuY2UgYW5kIHNvbWV0aW1lcyB0aGUgc2VjdXJpdHkgcHJvcGVydGllcykuJm5ic3A7IElu IGZhY3QsIG9uZSBvZiB0aGUgTklTVCBzdWJtaXNzb2lucyBjdXJyZW50bHkNCiBoYXMgMzAgcGFy YW1ldGVyIHNldHMgZGVmaW5lZC4mbmJzcDsgSGVuY2UsIGV2ZW4gaWYgTklTVCBkb2VzbuKAmXQg YXBwcm92ZSBhbGwgdGhlIHBhcmFtZXRlciBzZXRzIChvciBzb21lIG9mIHRoZW0gZG8gbm90IG1h a2Ugc2Vuc2UgZm9yIFRMUyBpbiBhbnkgc2NlbmFyaW8pLCB3ZSBtaWdodCBlbmQgdXAgd2l0aCAy MCBvciBtb3JlIGRpZmZlcmVudCBrZXkgZXhjaGFuZ2UvcGFyYW1ldGVyIHNldCBjb21iaW5hdGlv bnMgdGhhdCBkbyBtYWtlIHNlbnNlIGZvcg0KIHNvbWUgc2NlbmFyaW8gdGhhdCB1c2VzIHRMUyAo YmUgaXQgaW4gYSB0cmFuZGl0aW9uYWwgUEMgY2xpZW50L3NlcnZlciwgYSB3aXJlbGVzcyBjbGll bnQsIHR3byBjbG91ZCBkZXZpY2VzIGNvbW11bmljYXRpbmcgb3IgYW4gSU9UIGRldmljZSkuPC9z cGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW02NzAyNTM2NjQ0MTIzMjYxNzMw Z21haWwtbS03OTA4OTcyNjU0NjM3MTkzOTg0Z21haWwtbTQ5NDQ4NTY5Nzc2OTU2OTg2MjhnbWFp bC1tNDQ2MDgwOTIwMTkyMjkxMDExMmdtYWlsLW0xNjczNjk0MTc1NTU3OTU4NzExbTUwMTIxMTI4 ODY3MTEyMTI4OTBtc29saXN0cGFyYWdyYXBoIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW47dGV4 dC1pbmRlbnQ6LS4yNWluO21zby1saXN0OmwwIGxldmVsMSBsZm8yIj4NCjwhW2lmICFzdXBwb3J0 TGlzdHNdPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OlN5bWJvbCI+ PHNwYW4gc3R5bGU9Im1zby1saXN0Oklnbm9yZSI+wrc8c3BhbiBzdHlsZT0iZm9udDo3LjBwdCAm cXVvdDtUaW1lcyBOZXcgUm9tYW4mcXVvdDsiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOw0KPC9zcGFuPjwvc3Bhbj48L3NwYW4+PCFbZW5kaWZdPjxzcGFu IGxhbmc9IkVOLUdCIj5JbiBhZGRpdGlvbiwgd2UgYXJlIGxpa2VseSB0byBzdXBwb3J0IGFkZGl0 aW9uYWwgcHJpbWl0aXZlcyBpbiB0aGUgZnV0dXJlOyBwb3NzaWJseSBOYXRpb25hbCBjdXJ2ZXMg KGUuZy4gQnJhaW5wb29sKSwgb3IgYWRkaXRpb25hbCBQb3N0cXVhbnR1bSBhbGdvcml0aG1zIChv ciBhZGRpdGlvbmFsIHBhcmFtZXRlciBzZXRzIHRvIGV4aXN0aW5nIG9uZXMpLiZuYnNwOyBPZg0K IGNvdXJzZSwgb25jZSB3ZSBhZGQgdGhhdCBjb2RlIHBvaW50LCB3ZeKAmWxsIG5lZWQgdG8gYWRk IHRoZSBhZGRpdGlvbmFsIGNvZGUgcG9pbnRzIGZvciBhbGwgdGhlIGNvbWJpbmF0aW9ucyB0aGF0 IGl04oCZbGwgbWFrZSBzZW5zZSBpbiAodmVyeSBtdWNoIGxpa2Ugd2UgaGFkIHRvIGFkZCBhIG51 bWJlciBvZiBjaXBoZXJzdWl0ZXMgd2hlbmV2ZXIgd2UgYWRkZWQgYSBuZXcgZW5jcnlwdGlvbiBh bGdvcml0aG0gaW50byBUTFMgMS4yKS48L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0 b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6LjVpbiI+DQo8c3BhbiBsYW5nPSJFTi1HQiI+Jm5ic3A7 PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjwv ZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJn aW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0Oi41 aW4iPg0KJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20t YWx0OmF1dG87bWFyZ2luLWxlZnQ6LjVpbiI+DQpBcmUgcGVvcGxlIGFjdHVhbGx5IGdvaW5nIHRv IHVzZSBoeWJyaWQgZW5jcnlwdGlvbiBwb3N0IE5JU1Q/IFRoZSBhY3R1YWwgZGVwbG95bWVudHMg dG9kYXkmbmJzcDsgZm9yIGV4cGVyaW1lbnQgaGF2ZSBhbGwgZml0IG9wdGlvbiAyIGFuZCBoeWJy aWRzIGFyZSB1bmxpa2VseSBpbiB0aGUgZnV0dXJlLiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFs dDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0Oi41aW4iPg0KJm5i c3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87 bWFyZ2luLWxlZnQ6LjVpbiI+DQpNeSBvYmplY3Rpb24gdG8gMSBpcyBpdCBnZXRzIHZlcnkgbWVz c3kuIERvIHdlIHVzZSBvbmx5IHRoZSBoeWJyaWRzIHdlIGJvdGggc3VwcG9ydD8gV2hhdCBpZiBJ IHRocm93IGEgYnVuY2ggb2YgZXhwZW5zaXZlIHRoaW5ncyB0b2dldGhlcj8gTm8gcmVhc29uIHdl IG5lZWQgYSBoeWJyaWQgc2NoZW1lISZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21z by1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0Oi41aW4iPg0KJm5ic3A7PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRl cjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowaW4gMGluIDBp biA2LjBwdDttYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1yaWdodDowaW47bWFyZ2luLWJvdHRvbTo1 LjBwdDttYXJnaW4tbGVmdDo0Li44cHQiPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0 OmF1dG87bWFyZ2luLWxlZnQ6LjVpbiI+DQo8c3BhbiBsYW5nPSJFTi1HQiI+SXQgc2VlbWRzIHJl YXNvbmFibGUgdG8gbWUgdGhhdCB0aGUgY29tYmluYXRpb24gb2YgdGhlc2UgdHdvIGZhY3RvcnMg YXJlIGxpa2VseSB0byBjYXVzZSB1cyAoc2hvdWxkIHdlIHNlbGVjdCBvcHRpb24gMikgdG8gZGVm aW5lIGEgdmVyeSBsYXJnZSBudW1iZXIgb2YgY29kZSBwb2ludHMgdG8gY292ZXIgYWxsIHRoZSB2 YXJpb3VzIG9wdGlvbnMgdGhhdCBwZW9wbGUgbmVlZC48L3NwYW4+PG86cD48L286cD48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1h cmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6LjVpbiI+DQo8c3BhbiBsYW5nPSJFTi1H QiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21h cmdpbi1sZWZ0Oi41aW4iPg0KPHNwYW4gbGFuZz0iRU4tR0IiPk5vdywgdGhpcyBpcyBiYXNlZCBv biBzcGVjdWxhdGlvbiAoYm90aCBvZiB0aGUgTklTVCBwcm9jZXNzLCBhbmQgYWRkaXRpb25hbCBw cmltaXRpdmVzIHRoYXQgd2lsbCBiZSBhZGRlZCB0byB0aGUgcHJvdG9jb2wpLCBhbmQgb25lIG9i amVjdGlvbiBJ4oCZdmUgaGVhcmQgaXMg4oCcd2UgZG9u4oCZdCBrbm93IHdoYXTigJlzIGdvaW5n IHRvIGhhcHBlbiwgYW5kIHNvIHdoeSB3b3VsZCB3ZSBtYWtlIGRlY2lzaW9ucyBiYXNlZCBvbg0K IHRoaXMgc3BlY3VsYXRpb24/4oCdJm5ic3A7IEkgYWdyZWUgdGhhdCB3ZSBoYXZlIGxhY2sgb2Yg a25vd2xlZGdlOyBob3dldmVyIGl0IHNlZW1zIHRvIG1lIHRoYXQgYSBsYWNrIG9mIGtub3dsZWRn ZSBpcyBhbiBhcmd1bWVudCBpbiBmYXZvciBvZiBzZWxlY3RpbmcgdGhlIG1vcmUgZmxleGlibGUg b3B0aW9uICh3aGljaCwgaW4gbXkgb3BpbmlvbiwgaXMgb3B0aW9uIDEsIGFzIGl0IGFsbG93cyB0 aGUgbmVnb3RpYXRpb24gb2YgY29tYmluYXRpb25zIG9mIGtleQ0KIGV4Y2hhbmdlcyB0aGF0IHRo ZSBXRyBoYXMgbm90IGFudGljaXBhdGVkKS48L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1i b3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6LjVpbiI+DQombmJzcDs8bzpwPjwvbzpwPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28t bWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDouNWluIj4NCk15IHBsZWE6IGxldHMg bm90IHJlcGVhdCB0aGUgVExTIDEuMiBjaXBoZXJzdWl0ZSBtZXNzOyBsZXRzIGFkZCBhbiBleHRl bnNpb24gdGhhdCBrZWVwcyB0aGUgbnVtYmVyIG9mIGNvZGUgcG9pbnRzIHdlIG5lZWQgdG8gYSBy ZWFzb25hYmxlIGJvdW5kLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21h cmdpbi1sZWZ0Oi41aW4iPg0KJm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0 OmF1dG87bWFyZ2luLWxlZnQ6LjVpbiI+DQpUaGUgY29zdHMgb2Ygb3B0aW9uIDE/PG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbTY3MDI1MzY2NDQxMjMyNjE3MzBnbWFpbC1tLTc5MDg5 NzI2NTQ2MzcxOTM5ODRnbWFpbC1tNDk0NDg1Njk3NzY5NTY5ODYyOGdtYWlsLW00NDYwODA5MjAx OTIyOTEwMTEyZ21haWwtbTE2NzM2OTQxNzU1NTc5NTg3MTFtNTAxMjExMjg4NjcxMTIxMjg5MG1z b2xpc3RwYXJhZ3JhcGgiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbjt0ZXh0LWluZGVudDotLjI1 aW47bXNvLWxpc3Q6bDEgbGV2ZWwxIGxmbzQiPg0KPCFbaWYgIXN1cHBvcnRMaXN0c10+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6U3ltYm9sIj48c3BhbiBzdHlsZT0i bXNvLWxpc3Q6SWdub3JlIj7CtzxzcGFuIHN0eWxlPSJmb250OjcuMHB0ICZxdW90O1RpbWVzIE5l dyBSb21hbiZxdW90OyI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7DQo8L3NwYW4+PC9zcGFuPjwvc3Bhbj48IVtlbmRpZl0+SXQgZG9lcyBpbmNyZWFzZSB0 aGUgY29tcGxleGl0eSBvbiB0aGUgc2VydmVyIGEgc21hbGwgYW1vdW50IChJ4oCZbSBub3QgYSBU TFMgaW1wbGVtZW50b3IsIGhvd2V2ZXIgaXQgd291bGQgc2VlbSB0byBtZSB0byBiZSBvbmx5IGEg ZmFpcmx5IHNtYWxsIGFtb3VudCk8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tNjcw MjUzNjY0NDEyMzI2MTczMGdtYWlsLW0tNzkwODk3MjY1NDYzNzE5Mzk4NGdtYWlsLW00OTQ0ODU2 OTc3Njk1Njk4NjI4Z21haWwtbTQ0NjA4MDkyMDE5MjI5MTAxMTJnbWFpbC1tMTY3MzY5NDE3NTU1 Nzk1ODcxMW01MDEyMTEyODg2NzExMjEyODkwbXNvbGlzdHBhcmFncmFwaCIgc3R5bGU9Im1hcmdp bi1sZWZ0OjEuMGluO3RleHQtaW5kZW50Oi0uMjVpbjttc28tbGlzdDpsMSBsZXZlbDEgbGZvNCI+ DQo8IVtpZiAhc3VwcG9ydExpc3RzXT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250 LWZhbWlseTpTeW1ib2wiPjxzcGFuIHN0eWxlPSJtc28tbGlzdDpJZ25vcmUiPsK3PHNwYW4gc3R5 bGU9ImZvbnQ6Ny4wcHQgJnF1b3Q7VGltZXMgTmV3IFJvbWFuJnF1b3Q7Ij4mbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsNCjwvc3Bhbj48L3NwYW4+PC9zcGFu PjwhW2VuZGlmXT5JdCBtYXkgaW5jcmVhc2UgdGhlIHNpemUgb2YgdGhlIGNsaWVudCBoZWxsbyBh IHNtYWxsIGFtb3VudCAob24gdGhlIG90aGVyIGhhbmQsIGJlY2F1c2UgaXQgYWxsb3dzIHVzIHRv IGF2b2lkIHNlbmRpbmcgZHVwbGljYXRlIGtleSBzaGFyZXMsIGl0IGNhbiBhbHNvIHJlZHVjZSB0 aGUgc2l6ZSBvZiB0aGUgY2xpZW50IGhlbGxvIGFzIHdlbGwsIGRlcGVuZGluZyBvbiB3aGF04oCZ cyBhY3R1YWxseQ0KIG5lZ290aWF0ZWQpPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0 OmF1dG87bWFyZ2luLWxlZnQ6LjVpbiI+DQpJTUhPLCB0aGUgc21hbGwgaW5jcmVhc2UgaW4gY29t cGxleGl0eSBpcyB3b3J0aCB0aGUgbGFjayBvZiBjb21wbGV4aXR5IGluIHRoZSBjb2RlIHBvaW50 IHRhYmxlLCBhbmQgdGhlIGFkZGl0aW9uYWwgZmxleGliaWxpdHkgaXQgZ2l2ZXMuPG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1t YXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0 Oi41aW4iPg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX188 YnI+DQpUTFMgbWFpbGluZyBsaXN0PGJyPg0KPGEgaHJlZj0ibWFpbHRvOlRMU0BpZXRmLm9yZyIg dGFyZ2V0PSJfYmxhbmsiPlRMU0BpZXRmLm9yZzwvYT48YnI+DQo8YSBocmVmPSJodHRwczovL25h bTA2LnNhZmVsaW5rcy5wcm90ZWN0aW9uLm91dGxvb2suY29tLz91cmw9aHR0cHMlM0ElMkYlMkZ3 d3cuaWV0Zi5vcmclMkZtYWlsbWFuJTJGbGlzdGluZm8lMkZ0bHMmYW1wO2RhdGE9MDIlN0MwMSU3 Q0FuZHJlaS5Qb3BvdiU0MG1pY3Jvc29mdC5jb20lN0M0NmZjYTdmYWI5MWM0ZDg3NWMzYzA4ZDcx NTIxZjQxMyU3QzcyZjk4OGJmODZmMTQxYWY5MWFiMmQ3Y2QwMTFkYjQ3JTdDMSU3QzAlN0M2Mzcw MDExMDc5MTkwNjQ3MDYmYW1wO3NkYXRhPUNuWjFOcVVjUVNJRThScW5wUEY4alkwb05wJTJGRiUy QmdiSTdqV0I3UmFMc3JBJTNEJmFtcDtyZXNlcnZlZD0wIiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6 Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby90bHM8L2E+PG86cD48L286cD48L3A+DQo8 L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1 dG87bWFyZ2luLWxlZnQ6LjVpbiI+DQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fXzxicj4NClRMUyBtYWlsaW5nIGxpc3Q8YnI+DQo8YSBocmVmPSJtYWlsdG86 VExTQGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+VExTQGlldGYub3JnPC9hPjxicj4NCjxhIGhy ZWY9Imh0dHBzOi8vbmFtMDYuc2FmZWxpbmtzLnByb3RlY3Rpb24ub3V0bG9vay5jb20vP3VybD1o dHRwcyUzQSUyRiUyRnd3dy5pZXRmLm9yZyUyRm1haWxtYW4lMkZsaXN0aW5mbyUyRnRscyZhbXA7 ZGF0YT0wMiU3QzAxJTdDQW5kcmVpLlBvcG92JTQwbWljcm9zb2Z0LmNvbSU3QzQ2ZmNhN2ZhYjkx YzRkODc1YzNjMDhkNzE1MjFmNDEzJTdDNzJmOTg4YmY4NmYxNDFhZjkxYWIyZDdjZDAxMWRiNDcl N0MxJTdDMCU3QzYzNzAwMTEwNzkxOTA2NDcwNiZhbXA7c2RhdGE9Q25aMU5xVWNRU0lFOFJxbnBQ RjhqWTBvTnAlMkZGJTJCZ2JJN2pXQjdSYUxzckElM0QmYW1wO3Jlc2VydmVkPTAiIHRhcmdldD0i X2JsYW5rIj5odHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3RsczwvYT48bzpw PjwvbzpwPjwvcD4NCjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2 Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_DM5PR2101MB0917BFF8B79FA4D1823F6C4C8CDC0DM5PR2101MB0917_-- From nobody Tue Jul 30 12:44:25 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6BF0E12001E for ; Tue, 30 Jul 2019 12:44:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.399 X-Spam-Level: X-Spam-Status: No, score=-14.399 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=0.1, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=ZvTomwGj; dkim=pass (1024-bit key) header.d=cisco.onmicrosoft.com header.b=MgTtwnpU Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FR1-qdaSM1YQ for ; Tue, 30 Jul 2019 12:44:18 -0700 (PDT) Received: from rcdn-iport-4.cisco.com (rcdn-iport-4.cisco.com [173.37.86.75]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4FF5312010F for ; Tue, 30 Jul 2019 12:44:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=54000; q=dns/txt; s=iport; t=1564515858; x=1565725458; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=mPRs9u7k+iRiS+jOQ8UCaSJWxx718ShhAqBXSB/Y+vg=; b=ZvTomwGjJRfQqszZ1lP2UYWScDAbDz/HqpUZEQSHxwbuy+ZLNakd3xe0 d63he0M6+UcukAGiguwBNuWfBOukveZ0BeHC4sO6mRxgITLQCAHq/PeOL pY4ta8W+bTF7OygacsaC2Ialx0VvBFU8QcjREyt6/5GfEIxy/ZujbxBoe c=; IronPort-PHdr: =?us-ascii?q?9a23=3AoutylRWI1WkeS8uS5kAun+99WM/V8LGuZFwc94?= =?us-ascii?q?YnhrRSc6+q45XlOgnF6O5wiEPSA9yJ8OpK3uzRta2oGXcN55qMqjgjSNRNTF?= =?us-ascii?q?dE7KdehAk8GIiAAEz/IuTtankhEsBfVEVo5VmwMFNeH4D1YFiB6nA=3D?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0BTAABunUBd/4cNJK1lGQEBAQEBAQE?= =?us-ascii?q?BAQEBAQcBAQEBAQGBZ4EVL1ADbVUgBAsqCoQUg0cDjQWCW36IVo4AglIDUAQ?= =?us-ascii?q?JAQEBDAEBGAEJCwIBAYEFXYJeAheCKyM4EwEDAQEEAQECAQZthR4MhUoBAQE?= =?us-ascii?q?BAwEBEAgJChMBASwLAQ8CAQgRBAEBIQEGAwICAh8GCxQJCAEBBAENBQgagns?= =?us-ascii?q?EAoEdTQMdAQ6hSwKBOIhgcYEygnoBAQWBMgGDWAMKC4ITAwaBNIFbigUXgUA?= =?us-ascii?q?/ZitGghcHLj6CGkcBAQIYgTEYFRYJglUygiaMBTIhgiaFAJYWLUAJAoIahlu?= =?us-ascii?q?JRIQSmBGNPYlBjhkCBAIEBQIOAQEFgWchDYFLcBU7gmwTggskCQIBF4NOhRS?= =?us-ascii?q?FP3IBAQEBgSWMLAExbwEB?= X-IronPort-AV: E=Sophos;i="5.64,327,1559520000"; d="scan'208,217";a="607765755" Received: from alln-core-2.cisco.com ([173.36.13.135]) by rcdn-iport-4.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 30 Jul 2019 19:44:16 +0000 Received: from XCH-RCD-017.cisco.com (xch-rcd-017.cisco.com [173.37.102.27]) by alln-core-2.cisco.com (8.15.2/8.15.2) with ESMTPS id x6UJiGAa009319 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL); Tue, 30 Jul 2019 19:44:16 GMT Received: from xhs-rcd-001.cisco.com (173.37.227.246) by XCH-RCD-017.cisco.com (173.37.102.27) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Tue, 30 Jul 2019 14:44:15 -0500 Received: from xhs-rtp-002.cisco.com (64.101.210.229) by xhs-rcd-001.cisco.com (173.37.227.246) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Tue, 30 Jul 2019 14:44:15 -0500 Received: from NAM02-SN1-obe.outbound.protection.outlook.com (64.101.32.56) by xhs-rtp-002.cisco.com (64.101.210.229) with Microsoft SMTP Server (TLS) id 15.0.1473.3 via Frontend Transport; Tue, 30 Jul 2019 15:44:14 -0400 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=hzA8ue47MjItMFiZzLWUKxbEQ7isvGdavQ6OMiHx2HYcPiImZElMSLA3ZsCKtH/qdkSk8bY3smAFfh2jOB6vyR/WVTgv/x2cOFfq/oeDbSfiKkOR7jTCZ+W0SZ2PACDPpQoJ6JLSyG7xjXYaW/krKkBihVkYyMvOzCiM8aZz7DtGS9+qjROx2uZPTTokrzL+l/V0Mpz4b28OZYd3i14DY6MX9mpe/czwQKd5Rc4Y+/g+FrRNpQ9vfQbLk0OmUcnL3U27F6FM9UKsbdil817EjAmsR3UqgwU+NptnrPshlX+HAuYtDSJEFg98klR+U1+wJhUjirrwRHevtHSTEKiZqQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=mPRs9u7k+iRiS+jOQ8UCaSJWxx718ShhAqBXSB/Y+vg=; b=EoXQpGXlGJ9vNFF4JAgIs0/+H+8u9WlIpwi+UYcw5+FxJiLnrLIs01yNC59cQqtdjdzWbSkvvAzSzsnTklD8+HGvgIpCHOmFqYqo6D5/o9kY2xk4lf8LOWpk5psVt0/eQtMdq7Oj71xQ6giU/6a+WH31dK6G8ajsWjWO7uO2i6xrNGd/dhasPfyJ+6E947rH+iOp+nyJTZzfzuxIZRsuRI+oY1tDzP10woBmMKef9v3GkyswpN3cRABeCA3T2EMWf6B3RpvN21NCpFNBU+9rXLs2WjxFFpG6UrgaJ3zEQVGpHLIRKWJGeA9tySErwUI5S82yu+YcGLmtpU2EsybcqA== ARC-Authentication-Results: i=1; mx.microsoft.com 1;spf=pass smtp.mailfrom=cisco.com;dmarc=pass action=none header.from=cisco.com;dkim=pass header.d=cisco.com;arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector2-cisco-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=mPRs9u7k+iRiS+jOQ8UCaSJWxx718ShhAqBXSB/Y+vg=; b=MgTtwnpUZc/qVo7B7A+0FY2dZl+++EUCh2etAYJd3z8yKVNWtm1Yj1kPuupsijZfgHdiybxE1UUGi2DwpV6rqQDN3N6he2vGM6L3qbDRVKJ6J689ucWXruj8T7cvJNd0YPffTQzmAjjyvUB6QYiwMj4kewB3Ale0sTfzB54jgyo= Received: from MN2PR11MB3871.namprd11.prod.outlook.com (10.255.180.204) by MN2PR11MB4383.namprd11.prod.outlook.com (52.135.36.156) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2115.10; Tue, 30 Jul 2019 19:44:13 +0000 Received: from MN2PR11MB3871.namprd11.prod.outlook.com ([fe80::4c5:965:c7b7:387b]) by MN2PR11MB3871.namprd11.prod.outlook.com ([fe80::4c5:965:c7b7:387b%3]) with mapi id 15.20.2115.005; Tue, 30 Jul 2019 19:44:13 +0000 From: "Scott Fluhrer (sfluhrer)" To: Andrei Popov , David Benjamin , Watson Ladd CC: TLS List Thread-Topic: [TLS] Options for negotiating hybrid key exchanges for postquantum Thread-Index: AdVG1haOE+yO4N1wQQSyYtQ5VKKSwAAHEKmAAARkcYAAAMUecAAB4O5A Date: Tue, 30 Jul 2019 19:44:13 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=sfluhrer@cisco.com; x-originating-ip: [173.38.117.65] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: fc811111-4888-4757-5838-08d715264cc4 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:MN2PR11MB4383; x-ms-traffictypediagnostic: MN2PR11MB4383: x-ms-exchange-purlcount: 3 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:7691; x-forefront-prvs: 0114FF88F6 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(4636009)(346002)(136003)(396003)(376002)(366004)(39860400002)(15404003)(199004)(189003)(66476007)(14444005)(71200400001)(64756008)(102836004)(110136005)(66946007)(66556008)(11346002)(5070765005)(486006)(446003)(476003)(76116006)(5660300002)(606006)(52536014)(76176011)(99286004)(966005)(26005)(7736002)(53546011)(6506007)(7696005)(66446008)(186003)(6246003)(229853002)(68736007)(6436002)(3846002)(55016002)(25786009)(8936002)(81166006)(561944003)(478600001)(74316002)(4326008)(33656002)(8676002)(6116002)(2906002)(256004)(81156014)(86362001)(316002)(236005)(790700001)(66066001)(9686003)(54896002)(6306002)(71190400001)(53936002)(14454004); DIR:OUT; SFP:1101; SCL:1; SRVR:MN2PR11MB4383; H:MN2PR11MB3871.namprd11.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: cisco.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: 9iJ0EHg8p3QBS3LGPP6mkgO/2lCFcuvytHqidGQpzcD1d78tuVr1/Z7ArN5w1dkUmDDC8iEUB3C2maaCt+mOnlpA8wpPPhgnW2Z9VCiCCD4hboeLcZ8VJLX2OGOLk3bzNzBjf37vo6vX+rhlWTVKafwYdXEDmw4+a4+tDT5W6G+PyUHQhbZvCrUfX3AMhqjq22spu/TjY1b2GXdkCy9M5N7s94rCbIgtRfAZY2oe8YD4N/zVpSp0Mn3a5cyRcYcyAIlmRtnStpvkQDjNdHBy3DiQ0t0HrAAGCS7AU2Jt+bzbaVjeiVSH8iW81zV2JBU7218rz/B9onQGlmMAgQ1e8krLewbzWvE0nAjcaVnEam/8TavY31bDBsV7M9rFI4a/r9LE4YgGk3q/aiQP83qCveFaZT1DAGmKdR4m0ixdv+k= Content-Type: multipart/alternative; boundary="_000_MN2PR11MB387187D8FEEF1A16DD8483BAC1DC0MN2PR11MB3871namp_" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: fc811111-4888-4757-5838-08d715264cc4 X-MS-Exchange-CrossTenant-originalarrivaltime: 30 Jul 2019 19:44:13.5302 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: sfluhrer@cisco.com X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN2PR11MB4383 X-OriginatorOrg: cisco.com X-Outbound-SMTP-Client: 173.37.102.27, xch-rcd-017.cisco.com X-Outbound-Node: alln-core-2.cisco.com Archived-At: Subject: Re: [TLS] Options for negotiating hybrid key exchanges for postquantum X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 30 Jul 2019 19:44:24 -0000 --_000_MN2PR11MB387187D8FEEF1A16DD8483BAC1DC0MN2PR11MB3871namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SSBiZWxpZXZlIHRoYXQgb25lIGltcG9ydGFudCBwcm9wZXJ0eSAob2YgZWl0aGVyIG9mIHRoZSBv cHRpb25zIEkgbGlzdGVkKSBpcyBhIG5pY2UgZmFsbGJhY2sgaWYgYW4gZW5oYW5jZWQgY2xpZW50 IHRhbGtzIHRvIGFuIG9sZGVyIHNlcnZlci4gIEluIGJvdGggY2FzZXMsIHRoZSBzZXJ2ZXIgd2ls bCBzZWUgYSBzZXJpZXMgb2YgbmFtZWQgZ3JvdXBzIHRoYXQgaXQgZG9lc27igJl0IGtub3cgKHdo aWNoIGl0IHdpbGwgaWdub3JlKSwgYW5kIHBvc3NpYmlsaXR5IGFuIGV4dGVuc2lvbiBpdCBkb2Vz buKAmXQga25vdyAod2hpY2ggaXQgd2lsbCBpZ25vcmUpOyB0aGUgc2VydmVyIHdpbGwgYWNjZXB0 IGVpdGhlciBhIG5hbWVkIGdyb3VwIHRoYXQgaXQgZG9lcyB1bmRlcnN0YW5kIChpZiB0aGUgY2xp ZW50IGRpZCBwcm9wb3NlIGEgdHJhZGl0aW9uYWwgZ3JvdXAgYXMgYSBmYWxsIGJhY2spLCBvciBp dCB3aWxsIGNvbWUgdG8gdGhlIGNvcnJlY3QgY29uY2x1c2lvbiB0aGF0IHRoZSB0d28gc2lkZXMg aGF2ZSBubyBtdXR1YWxseSBhY2NlcHRhYmxlIHNlY3VyaXR5IHBvbGljeS4NCg0KSXQgaXMgbm90 IGNsZWFyIGlmIHRoZSBwcm9wb3NhbCB5b3Ugb3V0bGluZWQgc2hhcmUgdGhpcyBwcm9wZXJ0eTsg ZG8geW91IGR1cGxpY2F0ZSBhIHBheWxvYWQgdGhhdCBhbiB1bmVuaGFuY2VkIHNlcnZlciB3b3Vs ZCBhc3N1bWUgb25seSBvY2N1cnMgb25jZT8NCg0KRnJvbTogVExTIDx0bHMtYm91bmNlc0BpZXRm Lm9yZz4gT24gQmVoYWxmIE9mIEFuZHJlaSBQb3Bvdg0KU2VudDogVHVlc2RheSwgSnVseSAzMCwg MjAxOSAyOjQ4IFBNDQpUbzogRGF2aWQgQmVuamFtaW4gPGRhdmlkYmVuQGNocm9taXVtLm9yZz47 IFdhdHNvbiBMYWRkIDx3YXRzb25ibGFkZEBnbWFpbC5jb20+DQpDYzogVExTIExpc3QgPHRsc0Bp ZXRmLm9yZz4NClN1YmplY3Q6IFJlOiBbVExTXSBPcHRpb25zIGZvciBuZWdvdGlhdGluZyBoeWJy aWQga2V5IGV4Y2hhbmdlcyBmb3IgcG9zdHF1YW50dW0NCg0KR2l2ZW4gdGhlc2Ugb3B0aW9ucywg SSBhbHNvIHByZWZlciBvcHRpb24gMiwgZm9yIHNvbWUgb2YgdGhlIHNhbWUgcmVhc29ucy4NCg0K Rm9yIG15IHVuZGVyc3RhbmRpbmcgdGhvdWdoLCB3aHkgbm90IGhhdmUgdGhlIGNsaWVudCBhZHZl cnRpc2Ugc3VwcG9ydCBmb3IgaHlicmlkLWtleS1leGNoYW5nZSAoZS5nLiB2aWEgYSDigJxmbGFn 4oCdIGV4dGVuc2lvbikgYW5kIHRoZW4gS2V5U2hhcmVTZXJ2ZXJIZWxsbyBjYW4gY29udGFpbiB0 d28gS2V5U2hhcmVFbnRyaWVzIChlc3NlbnRpYWxseSwgdXNpbmcgdGhlIHNhbWUgZm9ybWF0IGFz IEtleVNoYXJlQ2xpZW50SGVsbG8/IFRoaXMgd291bGQgc29sdmUgdGhlIENhcnRlc2lhbiBwcm9k dWN0IGlzc3VlLg0KDQpDaGVlcnMsDQoNCkFuZHJlaQ0KDQpGcm9tOiBUTFMgPHRscy1ib3VuY2Vz QGlldGYub3JnPG1haWx0bzp0bHMtYm91bmNlc0BpZXRmLm9yZz4+IE9uIEJlaGFsZiBPZiBEYXZp ZCBCZW5qYW1pbg0KU2VudDogVHVlc2RheSwgSnVseSAzMCwgMjAxOSAxMToyNCBBTQ0KVG86IFdh dHNvbiBMYWRkIDx3YXRzb25ibGFkZEBnbWFpbC5jb208bWFpbHRvOndhdHNvbmJsYWRkQGdtYWls LmNvbT4+DQpDYzogVExTIExpc3QgPHRsc0BpZXRmLm9yZzxtYWlsdG86dGxzQGlldGYub3JnPj4N ClN1YmplY3Q6IFJlOiBbVExTXSBPcHRpb25zIGZvciBuZWdvdGlhdGluZyBoeWJyaWQga2V5IGV4 Y2hhbmdlcyBmb3IgcG9zdHF1YW50dW0NCg0KSSB0aGluayB0aGlzIHVuZGVyZXN0aW1hdGVzIHRo ZSBjb21wbGV4aXR5IGNvc3Qgb2Ygb3B0aW9uIDEgdG8gdGhlIHByb3RvY29sIGFuZCBpbXBsZW1l bnRhdGlvbnMuIE9wdGlvbiAxIG1lYW5zIGdyb3VwIG5lZ290aWF0aW9uIGluY2x1ZGVzIGVudGly ZSBjb2RlcG9pbnRzIHdob3NlIG1lYW5pbmcgY2Fubm90IGJlIGRldGVybWluZWQgd2l0aG91dCBh IHBhcmFsbGVsIGV4dGVuc2lvbi4gVGhpcyBjb21wb3VuZHMgYWNyb3NzIGV2ZXJ5dGhpbmcgd2hp Y2ggaW50ZXJhY3RzIHdpdGggbmFtZWQgZ3JvdXBzLCBpbXBhY3RpbmcgZXZlcnl0aGluZyBmcm9t IEFQSXMgdG8gY29uZmlnIGZpbGUgZm9ybWF0cyB0byBldmVuIFVJIHN1cmZhY2VzLiBPdGhlciB1 c2VzIG9mIE5hbWVkR3JvdXBzIGFyZSBpbXBhY3RlZCB0b28uIEZvciBpbnN0YW5jZSwgb3B0aW9u IDIgZml0cyBpbnRvIGRyYWZ0LWlldGYtdGxzLWVzbmkgYXMtaXMuIE9wdGlvbiAxIHJlcXVpcmVz IGluamVjdGluZyBoeWJyaWRfZXh0ZW5zaW9uIGludG8gRVNOSSBzb21laG93LiBBbmFseXNpcyBt dXN0IGZ1cnRoZXIgY2hlY2sgZXZlcnkgdXNlLCBzYXksIGluY29ycG9yYXRlcyB0aGlzIHBhcmFs bGVsIGxvb2t1cCB0YWJsZSBpbnRvIHRyYW5zY3JpcHQtbGlrZSBtZWFzdXJlcy4NCg0KVGhlIGxl c3NvbiBmcm9tIFRMUyAxLjIgY29kZSBwb2ludHMgaXMgbm90IGNvbWJpbmVkIGNvZGVwb2ludHMg dnMuIHNwbGl0IG9uZXMuIFJhdGhlciwgdGhlIGxlc3NvbiBpcyB0byBhdm9pZCBpbnRlcmRlcGVu ZGVudCBkZWNpc2lvbnM6DQoNCiogU2lnbmF0dXJlIGFsZ29yaXRobXMgaW4gVExTIDEuMiB3ZXJl IGEgbWVzcyBiZWNhdXNlIHRoZSBFQ0RTQSBjb2RlcG9pbnRzIHJlcXVpcmVkIGNyb3NzLXJlZmVy ZW5jaW5nIGFnYWluc3QgdGhlIHN1cHBvcnRlZCBjdXJ2ZXMgbGlzdC4gVGhlIHZlcmlmaWVyIGNv dWxkIG5vdCBleHByZXNzIHNvbWUgcHJlZmVyZW5jZXMgKHNpZ25pbmcgU0hBLTUxMiB3aXRoIFAt MjU2IGlzIHNpbGx5LCBhbmQgbWl4aW5nIGhhc2grY3VydmUgcGFpcnMgaW4gRUNEU0EgaXMgc2xp Z2h0bHkgb2ZmIGluIGdlbmVyYWwpLiBBcyBhbmFsb2d5IHRvIG9wdGlvbiAxJ3MgRVNOSSBwcm9i bGVtLCB3ZSBldmVuIGZvcmdvdCB0byBhbGxvdyB0aGUgc2VydmVyIHRvIGV4cHJlc3MgY3VydmUg cHJlZmVyZW5jZXMuIFRMUyAxLjMgY29tYmluZWQgc2lnbmF0dXJlIGFsZ29yaXRobSBjb25zaWRl cmF0aW9ucyBpbnRvIGEgc2luZ2xlIGNvZGVwb2ludCB0byBhZGRyZXNzIGFsbCB0aGlzLg0KDQoq IENpcGhlciBzdWl0ZXMgaW4gVExTIDEuMiB3ZXJlIGEgbWVzcyBiZWNhdXNlIHRoZXkgd2VyZSBo YWxmLWNvbWJpbmVkIGFuZCBoYWxmLXNwbGl0LiBUTFNfRUNESEVfRUNEU0FfV0lUSF9BRVNfMTI4 X0dDTV9TSEEyNTYgc2FpZCB0byB1c2Ugc29tZSBFQ0RIRSBrZXkgZXhjaGFuZ2UsIGJ1dCB5b3Ug bmVlZCB0byBjaGVjayBpZiB5b3UgaGF2ZSBhIE5hbWVkR3JvdXAgaW4gY29tbW9uIGZpcnN0LiBJ dCBzYWlkIHRvIHVzZSBFQ0RTQSwgYnV0IHlvdSBuZWVkIHRvIGNoZWNrIHNpZ25hdHVyZSBhbGdv cml0aG1zICh3aGljaCB0aGVtc2VsdmVzIGNyb3NzLXJlZmVyZW5jZSBjdXJ2ZXMpIGZpcnN0LiBF YXJseSBkcmFmdHMgb2YgVExTIDEuMyBoYWQgaXQgZXZlbiB3b3JzZSwgd2hlcmUgYSBUTFNfRUNE SEVfRUNEU0FfV0lUSF9BRVNfMTI4X0dDTV9TSEEyNTYgZnVsbCBoYW5kc2hha2UgbW9ycGhlZCBp bnRvIFRMU19FQ0RIRV9QU0tfV0lUSF9BRVNfMTI4X0dDTV9TSEEyNTYgb24gcmVzdW1wdGlvbi4g VGh1cywgVExTIDEuMyBjaXBoZXIgc3VpdGVzIG5lZ290aWF0ZSBzb2xlbHkgQUVBRCArIFBSRiBo YXNoLg0KDQpJbiBmYWlybmVzcyB0byBUTFMgMS4yLCBzb21lIG9mIHRoaXMgd2FzIGEgY29uc2Vx dWVuY2Ugb2YgVExTIDEuMidzIGV2b2x1dGlvbiBvdmVyIHRpbWUgYXMgaW5jcmVtZW50YWwgZXh0 ZW5zaW9ucyBvdmVyIFNTTCAzLjAuIEFuZCBzb21ldGltZXMgd2UgZG8gbmVlZCB0byBwYXkgY29z dHMgbGlrZSB0aGVzZS4gQnV0IGh5YnJpZCBrZXkgZXhjaGFuZ2VzIGZpdCBpbnRvIHRoZSBOYW1l ZEdyb3VwICJBUEkiIGp1c3QgZmluZSwgc28gb3B0aW9uIDIgaXMgdGhlIGNsZWFyIGFuc3dlci4g Q29kZSBwb2ludHMgYXJlIGNoZWFwLiBQcm90b2NvbCBjb21wbGV4aXR5IGlzIG11Y2ggbW9yZSBl eHBlbnNpdmUuDQoNCkl0J3MgdHJ1ZSB0aGF0IHN0YW5kYXJkcyBhcmUgb2Z0ZW4gdW5kZXJzcGVj aWZpZWQuIFRoaXMgbWVhbnMgdGhlIElFVEYgc2hvdWxkIGZpbmlzaCB0aGUgam9iLCBub3QgcGFz cyBhbGwgdmFyaWF0aW9ucyB0aHJvdWdoLiBSU0EtUFNTIGlzIGEgY2xlYXIgZXhhbXBsZSBvZiB3 aGF0IHRvIGF2b2lkLiBJdCB0YWtlcyBtb3JlIGJ5dGVzIHRvIG1lcmVseSB1dHRlciAiUlNBLVBT UyB3aXRoIFNIQS0yNTYgYW5kIHVzdWFsIHBhcmFtZXRlcnMiIGluIFguNTA5IHRoYW4gdG8gZW5j b2RlIGFuIGVudGlyZSBFQ0RTQSBzaWduYXR1cmUhIFdlIHNob3VsZCBub3QgZGVmaW5lIG1vcmUg dGhhbiBhIGhhbmRmdWwgb2Ygb3B0aW9ucywgcmVnYXJkbGVzcyBvZiB0aGUgZW5jb2RpbmcuLg0K DQpPbiBUdWUsIEp1bCAzMCwgMjAxOSBhdCAxMjoxOCBQTSBXYXRzb24gTGFkZCA8d2F0c29uYmxh ZGRAZ21haWwuY29tPG1haWx0bzp3YXRzb25ibGFkZEBnbWFpbC5jb20+PiB3cm90ZToNCg0KT24g VHVlLCBKdWwgMzAsIDIwMTksIDg6MjEgQU0gU2NvdHQgRmx1aHJlciAoc2ZsdWhyZXIpIDxzZmx1 aHJlckBjaXNjby5jb208bWFpbHRvOnNmbHVocmVyQGNpc2NvLmNvbT4+IHdyb3RlOg0KRHVyaW5n IHRoZSBwaHlzaWNhbCBtZWV0aW5nIGluIE1vbnRyZWFsLCB3ZSBoYWQgYSBkaXNjdXNzaW9uIGFi b3V0IHBvc3RxdWFudHVtIHNlY3VyaXR5LCBhbmQgaW4gcGFydGljdWxhciwgb24gaG93IG9uZSBt aWdodCB3YW50IHRvIG5lZ290aWF0ZSBzZXZlcmFsIGRpZmZlcmVudCDigJhncm91cHPigJkgc2lt dWx0YW5lb3VzbHkgKGJlY2F1c2UgdGhlcmUgbWlnaHQgbm90IGJlIG9uZSBncm91cCB0aGF0IGlz IGVudGlyZWx5IHRydXN0ZWQsIGFuZCBJIHB1dCDigJhncm91cHPigJkgaW4gc2NhcmVxdW90ZXMg YmVjYXVzZSBwb3N0cXVhbnR1bSBrZXkgZXhjaGFuZ2VzIGFyZSB0eXBpY2FsbHkgbm90IGZvcm1l ZCBmcm9tIGEgRGlmZmllLUhlbGxtYW4gZ3JvdXApLg0KDQpBdCB0aGUgbWVldGluZywgdGhlcmUg d2VyZSB0d28gb3B0aW9ucyBwcmVzZW50ZWQ6DQoNCk9wdGlvbiAxOiBhcyB0aGUgc3VwcG9ydGVk IGdyb3VwLCB3ZSBpbnNlcnQgYSDigJhoeWJyaWQgbWFya2Vy4oCZIChhbmQgaW5jbHVkZSBhbiBl eHRlbnNpb24gdGhhdCBtYXAgbGlzdHMgd2hpY2ggY29tYmluYXRpb24gdGhlIGh5YnJpZCBtYXJr ZXIgc3RhbmRzIGZvcikNCiAgICAgICAgICAgICAgICBGb3IgZXhhbXBsZSwgdGhlIGNsaWVudCBt aWdodCBsaXN0IGluIGhpcyBzdXBwb3J0ZWQgZ3JvdXBzIGh5YnJpZF9tYXJrZXJfMCBhbmQgaHli cmlkX21hcmtlcl8xLCBhbmQgdGhlcmUgd291bGQgYmUgYSBzZXBhcmF0ZSBleHRlbnNpb24gdGhh dCBsaXN0cyBoeWJyaWRfbWFya2VyXzAgPSBYMjU1MTkgKyBTSUtFcDQzNCBhbmQgaHlicmlkX21h cmtlcl8xID0gWDI1NTE5ICsgTlRSVVBSNjUzLiAgVGhlIHNlcnZlciB3b3VsZCB0aGVuIGxvb2sg dXAgdGhlIG1lYW5pbmdzIG9mIGh5YnJpZF9tYXJrZXJfMCBhbmQgMSBpbiB0aGUgZXh0ZW5zaW9u LCBhbmQgdGhlbiBjb21wYXJlIHRoYXQgYWdhaW5zdCBoaXMgc2VjdXJpdHkgcG9saWN5Lg0KSW4g dGhpcyBvcHRpb24sIHdlIHdvdWxkIGFzayBJQU5BIHRvIGFsbG9jYXRlIGNvZGUgcG9pbnRzIGZv ciB0aGUgdmFyaW91cyBpbmRpdmlkdWFsIHBvc3RxdWFudHVtIGtleSBleGNoYW5nZXMgKGluIHRo aXMgZXhhbXBsZSwgU0lLRXA0MzQgYW5kIE5UUlVQUjY1MyksIGFzIHdlbGwgYSByYW5nZSBvZiBj b2RlIHBvaW50cyBmb3IgdGhlIHZhcmlvdXMgaHlicmlkX21hcmtlcnMuDQoNCk9wdGlvbiAyOiB3 ZSBoYXZlIGNvZGUgcG9pbnRzIGZvciBhbGwgdGhlIHZhcmlvdXMgY29tYmluYXRpb25zIHRoYXQg d2UgbWF5IHdhbnQgdG8gc3VwcG9ydDsgaGVuY2UgSUFOQSBtaWdodCBhbGxvY2F0ZSBhIGNvZGUg cG9pbnQgWDI1NTE5X1NJS0VwNDM0IGFuZCBhbm90aGVyIGNvZGUgcG9pbnQgZm9yIFgyNTUxOV9O VFJVUFI2NTMuICBXaXRoIHRoaXMgb3B0aW9uLCB0aGUgY2xpZW50IHdvdWxkIGxpc3QgWDI1NTE5 X1NJS0VwNDM0IGFuZCBYMjU1MTlfTlRSVVBSNjUzIGluIHRoZWlyIHN1cHBvcnRlZCBncm91cHMu DQogICAgICAgICAgICAgICAgSW4gdGhpcyBvcHRpb24sIHdlIHdvdWxkIGFzayBJQU5BIHRvIGFs bG9jYXRlIGNvZGUgcG9pbnRzIGZvciBhbGwgdGhlIHZhcmlvdXMgY29tYmluYXRpb25zIHRoYXQg d2Ugd2FudCBhbGxvdyB0byBiZSBuZWdvdGlhdGVkLg0KDQpJIHdvdWxkIGxpa2UgdG8gbWFrZSBh biBhcmd1bWVudCBpbiBmYXZvciBvZiBvcHRpb24gMToNCg0KDQogICogICBJdCBpcyBsaWtlbHkg dGhhdCBub3QgZXZlcnlvbmUgd2lsbCBiZSBzYXRpc2lmaWVkIHdpdGgg4oCcWDI1NTE5IHBsdXMg b25lIG9mIGEgaGFuZGZ1bCBvZiBzcGVjaWZpYyBwb3N0cXVhbnR1bSBhbGdvcml0aG1z4oCdOyBz b21lIG1heSBwcmVmZXIgYW5vdGhlciBlbGxpcHRpYyBjdXJ2ZSAoZm9yIGV4YW1wbGUsIHg0NDgp LCBvciBwZXJoYXBzIGV2ZW4gYSBNT0RQIGdyb3VwOyBJIGhhdmUgdGFsa2VkIHRvIHBlb3BsZSB3 aG8gZG8gbm90IHRydXN0IEVDQyk7IGluIGFkZGl0aW9uLCBvdGhlciBwZW9wbGUgbWlnaHQgbm90 IHRydXN0IGEgc2luZ2xlIHBvc3RxdWFudHVtIGFsZ29yaXRobSwgYW5kIG1heSB3YW50IHRvIHJl bHkgb24gYm90aCAoZm9yIGV4YW1wbGUpIFNJS0UgYW5kIE5ld0hvcGUgKHdoaWNoIGFyZSBiYXNl ZCBvbiB2ZXJ5IGRpZmZlcmVudCBoYXJkIHByb2JsZW1zKS4gIFdpdGggb3B0aW9uIDIsIHdlIGNv dWxkIHRyeSB0byBhbnRpY2lwYXRlIGFsbCB0aGUgY29tbW9uIGNvbWJpbnRhdGlvbnMgKHN1Y2gg YXMgUDM4NF9TSUtFcDQzNF9ORVdIT1BFNTEyQ0NBKSwgaG93ZXZlciB0aGF0IGNvdWxkIHZlcnkg d2VsbCBlbmQgdXAgYXMgYSBsb3Qgb2YgY29tYmluYXRpb25zLg0KICAqICAgVGhlcmUgYXJlIGxp a2VseSB0byBiZSBzZXZlcmFsIE5JU1QtYXBwcm92ZWQgcG9zdHF1YW50dW0ga2V5IGV4Y2hhbmdl cywgYW5kIGVhY2ggb2YgdGhvc2Uga2V5IGV4Y2hhbmdlcyBhcmUgbGlrZWx5IHRvIGhhdmUgYSBu dW1iZXIgb2Ygc3VwcG9ydGVkIHBhcmFtZXRlciBzZXRzIChpZiB3ZSB0YWtlIHRoZSBzcGVjaWZp YyBwb3N0cXVhbnR1bSBrZXkgZXhjaGFuZ2UgYXMgYW5hbG9nb3VzIHRvIHRoIEVDREggcHJvdG9j b29sLCB0aGUg4oCccGFyYW1ldGVyIHNldOKAnSBjb3VsZCBiZSB0aG91Z2h0IG9mIGFuIGFuYWxv Z291cyB0byB0aGUgc3BlY2lmaWMgZWxsaXB0dWMgY3VydmUsIGFuZCBpdCBtb2RpZmllcyB0aGUg a2V5IHNoYXJlIHNpemUsIHRoZSBwZXJmb3JtYW5jZSBhbmQgc29tZXRpbWVzIHRoZSBzZWN1cml0 eSBwcm9wZXJ0aWVzKS4gIEluIGZhY3QsIG9uZSBvZiB0aGUgTklTVCBzdWJtaXNzb2lucyBjdXJy ZW50bHkgaGFzIDMwIHBhcmFtZXRlciBzZXRzIGRlZmluZWQuICBIZW5jZSwgZXZlbiBpZiBOSVNU IGRvZXNu4oCZdCBhcHByb3ZlIGFsbCB0aGUgcGFyYW1ldGVyIHNldHMgKG9yIHNvbWUgb2YgdGhl bSBkbyBub3QgbWFrZSBzZW5zZSBmb3IgVExTIGluIGFueSBzY2VuYXJpbyksIHdlIG1pZ2h0IGVu ZCB1cCB3aXRoIDIwIG9yIG1vcmUgZGlmZmVyZW50IGtleSBleGNoYW5nZS9wYXJhbWV0ZXIgc2V0 IGNvbWJpbmF0aW9ucyB0aGF0IGRvIG1ha2Ugc2Vuc2UgZm9yIHNvbWUgc2NlbmFyaW8gdGhhdCB1 c2VzIHRMUyAoYmUgaXQgaW4gYSB0cmFuZGl0aW9uYWwgUEMgY2xpZW50L3NlcnZlciwgYSB3aXJl bGVzcyBjbGllbnQsIHR3byBjbG91ZCBkZXZpY2VzIGNvbW11bmljYXRpbmcgb3IgYW4gSU9UIGRl dmljZSkuDQogICogICBJbiBhZGRpdGlvbiwgd2UgYXJlIGxpa2VseSB0byBzdXBwb3J0IGFkZGl0 aW9uYWwgcHJpbWl0aXZlcyBpbiB0aGUgZnV0dXJlOyBwb3NzaWJseSBOYXRpb25hbCBjdXJ2ZXMg KGUuZy4gQnJhaW5wb29sKSwgb3IgYWRkaXRpb25hbCBQb3N0cXVhbnR1bSBhbGdvcml0aG1zIChv ciBhZGRpdGlvbmFsIHBhcmFtZXRlciBzZXRzIHRvIGV4aXN0aW5nIG9uZXMpLiAgT2YgY291cnNl LCBvbmNlIHdlIGFkZCB0aGF0IGNvZGUgcG9pbnQsIHdl4oCZbGwgbmVlZCB0byBhZGQgdGhlIGFk ZGl0aW9uYWwgY29kZSBwb2ludHMgZm9yIGFsbCB0aGUgY29tYmluYXRpb25zIHRoYXQgaXTigJls bCBtYWtlIHNlbnNlIGluICh2ZXJ5IG11Y2ggbGlrZSB3ZSBoYWQgdG8gYWRkIGEgbnVtYmVyIG9m IGNpcGhlcnN1aXRlcyB3aGVuZXZlciB3ZSBhZGRlZCBhIG5ldyBlbmNyeXB0aW9uIGFsZ29yaXRo bSBpbnRvIFRMUyAxLjIpLg0KDQoNCkFyZSBwZW9wbGUgYWN0dWFsbHkgZ29pbmcgdG8gdXNlIGh5 YnJpZCBlbmNyeXB0aW9uIHBvc3QgTklTVD8gVGhlIGFjdHVhbCBkZXBsb3ltZW50cyB0b2RheSAg Zm9yIGV4cGVyaW1lbnQgaGF2ZSBhbGwgZml0IG9wdGlvbiAyIGFuZCBoeWJyaWRzIGFyZSB1bmxp a2VseSBpbiB0aGUgZnV0dXJlLg0KDQpNeSBvYmplY3Rpb24gdG8gMSBpcyBpdCBnZXRzIHZlcnkg bWVzc3kuIERvIHdlIHVzZSBvbmx5IHRoZSBoeWJyaWRzIHdlIGJvdGggc3VwcG9ydD8gV2hhdCBp ZiBJIHRocm93IGEgYnVuY2ggb2YgZXhwZW5zaXZlIHRoaW5ncyB0b2dldGhlcj8gTm8gcmVhc29u IHdlIG5lZWQgYSBoeWJyaWQgc2NoZW1lIQ0KDQpJdCBzZWVtZHMgcmVhc29uYWJsZSB0byBtZSB0 aGF0IHRoZSBjb21iaW5hdGlvbiBvZiB0aGVzZSB0d28gZmFjdG9ycyBhcmUgbGlrZWx5IHRvIGNh dXNlIHVzIChzaG91bGQgd2Ugc2VsZWN0IG9wdGlvbiAyKSB0byBkZWZpbmUgYSB2ZXJ5IGxhcmdl IG51bWJlciBvZiBjb2RlIHBvaW50cyB0byBjb3ZlciBhbGwgdGhlIHZhcmlvdXMgb3B0aW9ucyB0 aGF0IHBlb3BsZSBuZWVkLg0KDQpOb3csIHRoaXMgaXMgYmFzZWQgb24gc3BlY3VsYXRpb24gKGJv dGggb2YgdGhlIE5JU1QgcHJvY2VzcywgYW5kIGFkZGl0aW9uYWwgcHJpbWl0aXZlcyB0aGF0IHdp bGwgYmUgYWRkZWQgdG8gdGhlIHByb3RvY29sKSwgYW5kIG9uZSBvYmplY3Rpb24gSeKAmXZlIGhl YXJkIGlzIOKAnHdlIGRvbuKAmXQga25vdyB3aGF04oCZcyBnb2luZyB0byBoYXBwZW4sIGFuZCBz byB3aHkgd291bGQgd2UgbWFrZSBkZWNpc2lvbnMgYmFzZWQgb24gdGhpcyBzcGVjdWxhdGlvbj/i gJ0gIEkgYWdyZWUgdGhhdCB3ZSBoYXZlIGxhY2sgb2Yga25vd2xlZGdlOyBob3dldmVyIGl0IHNl ZW1zIHRvIG1lIHRoYXQgYSBsYWNrIG9mIGtub3dsZWRnZSBpcyBhbiBhcmd1bWVudCBpbiBmYXZv ciBvZiBzZWxlY3RpbmcgdGhlIG1vcmUgZmxleGlibGUgb3B0aW9uICh3aGljaCwgaW4gbXkgb3Bp bmlvbiwgaXMgb3B0aW9uIDEsIGFzIGl0IGFsbG93cyB0aGUgbmVnb3RpYXRpb24gb2YgY29tYmlu YXRpb25zIG9mIGtleSBleGNoYW5nZXMgdGhhdCB0aGUgV0cgaGFzIG5vdCBhbnRpY2lwYXRlZCku DQoNCk15IHBsZWE6IGxldHMgbm90IHJlcGVhdCB0aGUgVExTIDEuMiBjaXBoZXJzdWl0ZSBtZXNz OyBsZXRzIGFkZCBhbiBleHRlbnNpb24gdGhhdCBrZWVwcyB0aGUgbnVtYmVyIG9mIGNvZGUgcG9p bnRzIHdlIG5lZWQgdG8gYSByZWFzb25hYmxlIGJvdW5kLg0KDQpUaGUgY29zdHMgb2Ygb3B0aW9u IDE/DQoNCiAgKiAgIEl0IGRvZXMgaW5jcmVhc2UgdGhlIGNvbXBsZXhpdHkgb24gdGhlIHNlcnZl ciBhIHNtYWxsIGFtb3VudCAoSeKAmW0gbm90IGEgVExTIGltcGxlbWVudG9yLCBob3dldmVyIGl0 IHdvdWxkIHNlZW0gdG8gbWUgdG8gYmUgb25seSBhIGZhaXJseSBzbWFsbCBhbW91bnQpDQogICog ICBJdCBtYXkgaW5jcmVhc2UgdGhlIHNpemUgb2YgdGhlIGNsaWVudCBoZWxsbyBhIHNtYWxsIGFt b3VudCAob24gdGhlIG90aGVyIGhhbmQsIGJlY2F1c2UgaXQgYWxsb3dzIHVzIHRvIGF2b2lkIHNl bmRpbmcgZHVwbGljYXRlIGtleSBzaGFyZXMsIGl0IGNhbiBhbHNvIHJlZHVjZSB0aGUgc2l6ZSBv ZiB0aGUgY2xpZW50IGhlbGxvIGFzIHdlbGwsIGRlcGVuZGluZyBvbiB3aGF04oCZcyBhY3R1YWxs eSBuZWdvdGlhdGVkKQ0KSU1ITywgdGhlIHNtYWxsIGluY3JlYXNlIGluIGNvbXBsZXhpdHkgaXMg d29ydGggdGhlIGxhY2sgb2YgY29tcGxleGl0eSBpbiB0aGUgY29kZSBwb2ludCB0YWJsZSwgYW5k IHRoZSBhZGRpdGlvbmFsIGZsZXhpYmlsaXR5IGl0IGdpdmVzLg0KX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX18NClRMUyBtYWlsaW5nIGxpc3QNClRMU0BpZXRm Lm9yZzxtYWlsdG86VExTQGlldGYub3JnPg0KaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9s aXN0aW5mby90bHM8aHR0cHM6Ly9uYW0wNi5zYWZlbGlua3MucHJvdGVjdGlvbi5vdXRsb29rLmNv bS8/dXJsPWh0dHBzJTNBJTJGJTJGd3d3LmlldGYub3JnJTJGbWFpbG1hbiUyRmxpc3RpbmZvJTJG dGxzJmRhdGE9MDIlN0MwMSU3Q0FuZHJlaS5Qb3BvdiU0MG1pY3Jvc29mdC5jb20lN0M4YjQ1NzQw ZjA4MWY0NDgyMGE0YzA4ZDcxNTFiMzBlMyU3QzcyZjk4OGJmODZmMTQxYWY5MWFiMmQ3Y2QwMTFk YjQ3JTdDMSU3QzAlN0M2MzcwMDEwNzkwMDM4NDkwNDImc2RhdGE9c3dCNTJrSCUyRng3RHZMTmFY OUVBeUhjTmY3VnVpWFJSVXN4JTJGdGRuMGUxUzQlM0QmcmVzZXJ2ZWQ9MD4NCl9fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQpUTFMgbWFpbGluZyBsaXN0DQpU TFNAaWV0Zi5vcmc8bWFpbHRvOlRMU0BpZXRmLm9yZz4NCmh0dHBzOi8vd3d3LmlldGYub3JnL21h aWxtYW4vbGlzdGluZm8vdGxzPGh0dHBzOi8vbmFtMDYuc2FmZWxpbmtzLnByb3RlY3Rpb24ub3V0 bG9vay5jb20vP3VybD1odHRwcyUzQSUyRiUyRnd3dy5pZXRmLm9yZyUyRm1haWxtYW4lMkZsaXN0 aW5mbyUyRnRscyZkYXRhPTAyJTdDMDElN0NBbmRyZWkuUG9wb3YlNDBtaWNyb3NvZnQuY29tJTdD OGI0NTc0MGYwODFmNDQ4MjBhNGMwOGQ3MTUxYjMwZTMlN0M3MmY5ODhiZjg2ZjE0MWFmOTFhYjJk N2NkMDExZGI0NyU3QzElN0MwJTdDNjM3MDAxMDc5MDAzODU5MDM1JnNkYXRhPU9IRXdDNml0bXdi cnFUMVRwQnlLb3l0T3VoS09JZ2hpeDdTek1rUGRYdlElM0QmcmVzZXJ2ZWQ9MD4NCg== --_000_MN2PR11MB387187D8FEEF1A16DD8483BAC1DC0MN2PR11MB3871namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQph OmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xv cjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1z b0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpwdXJw bGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLm1zb25vcm1hbDAsIGxpLm1zb25v cm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCgltc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4tYm90 dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZv bnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnAuZ21haWwtbTE2NzM2OTQxNzU1NTc5 NTg3MTFtNTAxMjExMjg4NjcxMTIxMjg5MG1zb2xpc3RwYXJhZ3JhcGgsIGxpLmdtYWlsLW0xNjcz Njk0MTc1NTU3OTU4NzExbTUwMTIxMTI4ODY3MTEyMTI4OTBtc29saXN0cGFyYWdyYXBoLCBkaXYu Z21haWwtbTE2NzM2OTQxNzU1NTc5NTg3MTFtNTAxMjExMjg4NjcxMTIxMjg5MG1zb2xpc3RwYXJh Z3JhcGgNCgl7bXNvLXN0eWxlLW5hbWU6Z21haWwtbV8xNjczNjk0MTc1NTU3OTU4NzExbV81MDEy MTEyODg2NzExMjEyODkwbXNvbGlzdHBhcmFncmFwaDsNCgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0 bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0KCW1h cmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJp IixzYW5zLXNlcmlmO30NCnNwYW4uRW1haWxTdHlsZTE5DQoJe21zby1zdHlsZS10eXBlOnBlcnNv bmFsOw0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOndpbmRvd3Rl eHQ7fQ0Kc3Bhbi5FbWFpbFN0eWxlMjENCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwtcmVwbHk7 DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6d2luZG93dGV4dDt9 DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LXNp emU6MTAuMHB0O30NCkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjguNWluIDExLjBpbjsNCglt YXJnaW46MS4waW4gMS4waW4gMS4waW4gMS4waW47fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdl OldvcmRTZWN0aW9uMTt9DQovKiBMaXN0IERlZmluaXRpb25zICovDQpAbGlzdCBsMA0KCXttc28t bGlzdC1pZDo3MjYyMjgwMzM7DQoJbXNvLWxpc3QtdGVtcGxhdGUtaWRzOi0xMjczNzYxOTY7fQ0K QGxpc3QgbDA6bGV2ZWwxDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28t bGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOi41aW47DQoJbXNvLWxldmVsLW51 bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250 LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMDpsZXZlbDINCgl7 bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCglt c28tbGV2ZWwtdGFiLXN0b3A6MS4waW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0 Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZv bnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMDpsZXZlbDMNCgl7bXNvLWxldmVsLW51bWJlci1m b3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6 MS41aW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0u MjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9 DQpAbGlzdCBsMDpsZXZlbDQNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1z by1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6Mi4waW47DQoJbXNvLWxldmVs LW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1m b250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMDpsZXZlbDUN Cgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsN Cgltc28tbGV2ZWwtdGFiLXN0b3A6Mi41aW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjps ZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0K CWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMDpsZXZlbDYNCgl7bXNvLWxldmVsLW51bWJl ci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0 b3A6My4waW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50 Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OlN5bWJv bDt9DQpAbGlzdCBsMDpsZXZlbDcNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0K CW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6My41aW47DQoJbXNvLWxl dmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5z aS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMDpsZXZl bDgNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+C tzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6NC4waW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlv bjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0 Ow0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMDpsZXZlbDkNCgl7bXNvLWxldmVsLW51 bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFi LXN0b3A6NC41aW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5k ZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OlN5 bWJvbDt9DQpAbGlzdCBsMQ0KCXttc28tbGlzdC1pZDoxMzE0Nzk3MTY0Ow0KCW1zby1saXN0LXRl bXBsYXRlLWlkczotMTI1MjkwNDUyO30NCkBsaXN0IGwxOmxldmVsMQ0KCXttc28tbGV2ZWwtbnVt YmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWIt c3RvcDouNWluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVu dDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpTeW1i b2w7fQ0KQGxpc3QgbDE6bGV2ZWwyDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsN Cgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjEuMGluOw0KCW1zby1s ZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFu c2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDE6bGV2 ZWwzDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrv grc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjEuNWluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRp b246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBw dDsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDE6bGV2ZWw0DQoJe21zby1sZXZlbC1u dW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRh Yi1zdG9wOjIuMGluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWlu ZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpT eW1ib2w7fQ0KQGxpc3QgbDE6bGV2ZWw1DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxl dDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjIuNWluOw0KCW1z by1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNv LWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDE6 bGV2ZWw2DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4 dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjMuMGluOw0KCW1zby1sZXZlbC1udW1iZXItcG9z aXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEw LjBwdDsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDE6bGV2ZWw3DQoJe21zby1sZXZl bC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVs LXRhYi1zdG9wOjMuNWluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0 LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWls eTpTeW1ib2w7fQ0KQGxpc3QgbDE6bGV2ZWw4DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1 bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjQuMGluOw0K CW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJ bXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3Qg bDE6bGV2ZWw5DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwt dGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjQuNWluOw0KCW1zby1sZXZlbC1udW1iZXIt cG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXpl OjEwLjBwdDsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDINCgl7bXNvLWxpc3QtaWQ6 MTYxOTEzODkyMjsNCgltc28tbGlzdC10ZW1wbGF0ZS1pZHM6MTg3OTM2MjEzODt9DQpAbGlzdCBs MjpsZXZlbDENCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10 ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6LjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBv c2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZTox MC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwyOmxldmVsMg0KCXttc28tbGV2 ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZl bC10YWItc3RvcDoxLjBpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4 dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1p bHk6U3ltYm9sO30NCkBsaXN0IGwyOmxldmVsMw0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpi dWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDoxLjVpbjsN Cgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0K CW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0 IGwyOmxldmVsNA0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVs LXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDoyLjBpbjsNCgltc28tbGV2ZWwtbnVtYmVy LXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6 ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwyOmxldmVsNQ0KCXttc28t bGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1s ZXZlbC10YWItc3RvcDoyLjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJ dGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1m YW1pbHk6U3ltYm9sO30NCkBsaXN0IGwyOmxldmVsNg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1h dDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDozLjBp bjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWlu Ow0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBs aXN0IGwyOmxldmVsNw0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxl dmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDozLjVpbjsNCgltc28tbGV2ZWwtbnVt YmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQt c2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwyOmxldmVsOA0KCXtt c28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1z by1sZXZlbC10YWItc3RvcDo0LjBpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7 DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9u dC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwyOmxldmVsOQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZv cm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDo0 LjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4y NWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30N CkBsaXN0IGwzDQoJe21zby1saXN0LWlkOjE2Mzk2NDk5Mjc7DQoJbXNvLWxpc3QtdGVtcGxhdGUt aWRzOi0yNTA3Mjk3NjQ7fQ0KQGxpc3QgbDM6bGV2ZWwxDQoJe21zby1sZXZlbC1udW1iZXItZm9y bWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOi41 aW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVp bjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpA bGlzdCBsMzpsZXZlbDINCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1s ZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6MS4waW47DQoJbXNvLWxldmVsLW51 bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250 LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMzpsZXZlbDMNCgl7 bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCglt c28tbGV2ZWwtdGFiLXN0b3A6MS41aW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0 Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZv bnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMzpsZXZlbDQNCgl7bXNvLWxldmVsLW51bWJlci1m b3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6 Mi4waW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0u MjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9 DQpAbGlzdCBsMzpsZXZlbDUNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1z by1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6Mi41aW47DQoJbXNvLWxldmVs LW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1m b250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMzpsZXZlbDYN Cgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsN Cgltc28tbGV2ZWwtdGFiLXN0b3A6My4waW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjps ZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0K CWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMzpsZXZlbDcNCgl7bXNvLWxldmVsLW51bWJl ci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0 b3A6My41aW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50 Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OlN5bWJv bDt9DQpAbGlzdCBsMzpsZXZlbDgNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0K CW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6NC4waW47DQoJbXNvLWxl dmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5z aS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMzpsZXZl bDkNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+C tzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6NC41aW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlv bjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0 Ow0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpvbA0KCXttYXJnaW4tYm90dG9tOjBpbjt9DQp1bA0K CXttYXJnaW4tYm90dG9tOjBpbjt9DQotLT48L3N0eWxlPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1s Pg0KPG86c2hhcGVkZWZhdWx0cyB2OmV4dD0iZWRpdCIgc3BpZG1heD0iMTAyNiIgLz4NCjwveG1s PjwhW2VuZGlmXS0tPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVsYXlvdXQgdjpl eHQ9ImVkaXQiPg0KPG86aWRtYXAgdjpleHQ9ImVkaXQiIGRhdGE9IjEiIC8+DQo8L286c2hhcGVs YXlvdXQ+PC94bWw+PCFbZW5kaWZdLS0+DQo8L2hlYWQ+DQo8Ym9keSBsYW5nPSJFTi1VUyIgbGlu az0iYmx1ZSIgdmxpbms9InB1cnBsZSI+DQo8ZGl2IGNsYXNzPSJXb3JkU2VjdGlvbjEiPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+SSBiZWxpZXZlIHRoYXQgb25lIGltcG9ydGFudCBwcm9wZXJ0eSAo b2YgZWl0aGVyIG9mIHRoZSBvcHRpb25zIEkgbGlzdGVkKSBpcyBhIG5pY2UgZmFsbGJhY2sgaWYg YW4gZW5oYW5jZWQgY2xpZW50IHRhbGtzIHRvIGFuIG9sZGVyIHNlcnZlci4mbmJzcDsgSW4gYm90 aCBjYXNlcywgdGhlIHNlcnZlciB3aWxsIHNlZSBhIHNlcmllcyBvZiBuYW1lZCBncm91cHMgdGhh dCBpdCBkb2VzbuKAmXQga25vdyAod2hpY2ggaXQgd2lsbA0KIGlnbm9yZSksIGFuZCBwb3NzaWJp bGl0eSBhbiBleHRlbnNpb24gaXQgZG9lc27igJl0IGtub3cgKHdoaWNoIGl0IHdpbGwgaWdub3Jl KTsgdGhlIHNlcnZlciB3aWxsIGFjY2VwdCBlaXRoZXIgYSBuYW1lZCBncm91cCB0aGF0IGl0IGRv ZXMgdW5kZXJzdGFuZCAoaWYgdGhlIGNsaWVudCBkaWQgcHJvcG9zZSBhIHRyYWRpdGlvbmFsIGdy b3VwIGFzIGEgZmFsbCBiYWNrKSwgb3IgaXQgd2lsbCBjb21lIHRvIHRoZSBjb3JyZWN0IGNvbmNs dXNpb24gdGhhdA0KIHRoZSB0d28gc2lkZXMgaGF2ZSBubyBtdXR1YWxseSBhY2NlcHRhYmxlIHNl Y3VyaXR5IHBvbGljeS48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SXQgaXMgbm90IGNsZWFyIGlm IHRoZSBwcm9wb3NhbCB5b3Ugb3V0bGluZWQgc2hhcmUgdGhpcyBwcm9wZXJ0eTsgZG8geW91IGR1 cGxpY2F0ZSBhIHBheWxvYWQgdGhhdCBhbiB1bmVuaGFuY2VkIHNlcnZlciB3b3VsZCBhc3N1bWUg b25seSBvY2N1cnMgb25jZT88bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxv OnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6 c29saWQgYmx1ZSAxLjVwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDQuMHB0Ij4NCjxkaXY+DQo8ZGl2 IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNFMUUxRTEgMS4wcHQ7cGFkZGlu ZzozLjBwdCAwaW4gMGluIDBpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj5Gcm9tOjwvYj4g VExTICZsdDt0bHMtYm91bmNlc0BpZXRmLm9yZyZndDsgPGI+T24gQmVoYWxmIE9mIDwvYj4NCkFu ZHJlaSBQb3Bvdjxicj4NCjxiPlNlbnQ6PC9iPiBUdWVzZGF5LCBKdWx5IDMwLCAyMDE5IDI6NDgg UE08YnI+DQo8Yj5Ubzo8L2I+IERhdmlkIEJlbmphbWluICZsdDtkYXZpZGJlbkBjaHJvbWl1bS5v cmcmZ3Q7OyBXYXRzb24gTGFkZCAmbHQ7d2F0c29uYmxhZGRAZ21haWwuY29tJmd0Ozxicj4NCjxi PkNjOjwvYj4gVExTIExpc3QgJmx0O3Rsc0BpZXRmLm9yZyZndDs8YnI+DQo8Yj5TdWJqZWN0Ojwv Yj4gUmU6IFtUTFNdIE9wdGlvbnMgZm9yIG5lZ290aWF0aW5nIGh5YnJpZCBrZXkgZXhjaGFuZ2Vz IGZvciBwb3N0cXVhbnR1bTxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ R2l2ZW4gdGhlc2Ugb3B0aW9ucywgSSBhbHNvIHByZWZlciBvcHRpb24gMiwgZm9yIHNvbWUgb2Yg dGhlIHNhbWUgcmVhc29ucy48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxv OnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Rm9yIG15IHVuZGVyc3Rh bmRpbmcgdGhvdWdoLCB3aHkgbm90IGhhdmUgdGhlIGNsaWVudCBhZHZlcnRpc2Ugc3VwcG9ydCBm b3IgaHlicmlkLWtleS1leGNoYW5nZSAoZS5nLiB2aWEgYSDigJxmbGFn4oCdIGV4dGVuc2lvbikg YW5kIHRoZW4gS2V5U2hhcmVTZXJ2ZXJIZWxsbyBjYW4gY29udGFpbiB0d28gS2V5U2hhcmVFbnRy aWVzIChlc3NlbnRpYWxseSwgdXNpbmcgdGhlIHNhbWUgZm9ybWF0IGFzIEtleVNoYXJlQ2xpZW50 SGVsbG8/DQogVGhpcyB3b3VsZCBzb2x2ZSB0aGUgQ2FydGVzaWFuIHByb2R1Y3QgaXNzdWUuPG86 cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPkNoZWVycyw8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+QW5k cmVpPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPkZyb206PC9iPiBUTFMgJmx0OzxhIGhyZWY9 Im1haWx0bzp0bHMtYm91bmNlc0BpZXRmLm9yZyI+dGxzLWJvdW5jZXNAaWV0Zi5vcmc8L2E+Jmd0 Ow0KPGI+T24gQmVoYWxmIE9mIDwvYj5EYXZpZCBCZW5qYW1pbjxicj4NCjxiPlNlbnQ6PC9iPiBU dWVzZGF5LCBKdWx5IDMwLCAyMDE5IDExOjI0IEFNPGJyPg0KPGI+VG86PC9iPiBXYXRzb24gTGFk ZCAmbHQ7PGEgaHJlZj0ibWFpbHRvOndhdHNvbmJsYWRkQGdtYWlsLmNvbSI+d2F0c29uYmxhZGRA Z21haWwuY29tPC9hPiZndDs8YnI+DQo8Yj5DYzo8L2I+IFRMUyBMaXN0ICZsdDs8YSBocmVmPSJt YWlsdG86dGxzQGlldGYub3JnIj50bHNAaWV0Zi5vcmc8L2E+Jmd0Ozxicj4NCjxiPlN1YmplY3Q6 PC9iPiBSZTogW1RMU10gT3B0aW9ucyBmb3IgbmVnb3RpYXRpbmcgaHlicmlkIGtleSBleGNoYW5n ZXMgZm9yIHBvc3RxdWFudHVtPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ SSB0aGluayB0aGlzIHVuZGVyZXN0aW1hdGVzIHRoZSBjb21wbGV4aXR5IGNvc3Qgb2Ygb3B0aW9u IDEgdG8gdGhlIHByb3RvY29sIGFuZCBpbXBsZW1lbnRhdGlvbnMuIE9wdGlvbiAxIG1lYW5zIGdy b3VwIG5lZ290aWF0aW9uIGluY2x1ZGVzIGVudGlyZSBjb2RlcG9pbnRzIHdob3NlIG1lYW5pbmcg Y2Fubm90IGJlIGRldGVybWluZWQgd2l0aG91dCBhIHBhcmFsbGVsIGV4dGVuc2lvbi4gVGhpcyBj b21wb3VuZHMNCiBhY3Jvc3MgZXZlcnl0aGluZyB3aGljaCBpbnRlcmFjdHMgd2l0aCBuYW1lZCBn cm91cHMsIGltcGFjdGluZyBldmVyeXRoaW5nIGZyb20gQVBJcyB0byBjb25maWcgZmlsZSBmb3Jt YXRzIHRvIGV2ZW4gVUkgc3VyZmFjZXMuIE90aGVyIHVzZXMgb2YgTmFtZWRHcm91cHMgYXJlIGlt cGFjdGVkIHRvby4gRm9yIGluc3RhbmNlLCBvcHRpb24gMiBmaXRzIGludG8gZHJhZnQtaWV0Zi10 bHMtZXNuaSBhcy1pcy4gT3B0aW9uIDEgcmVxdWlyZXMgaW5qZWN0aW5nJm5ic3A7aHlicmlkX2V4 dGVuc2lvbg0KIGludG8gRVNOSSBzb21laG93LiBBbmFseXNpcyBtdXN0IGZ1cnRoZXIgY2hlY2sg ZXZlcnkgdXNlLCBzYXksIGluY29ycG9yYXRlcyB0aGlzIHBhcmFsbGVsIGxvb2t1cCB0YWJsZSBp bnRvIHRyYW5zY3JpcHQtbGlrZSBtZWFzdXJlcy48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+VGhlIGxlc3NvbiBmcm9tIFRMUyAxLjIgY29kZSBw b2ludHMgaXMgbm90IGNvbWJpbmVkIGNvZGVwb2ludHMgdnMuIHNwbGl0IG9uZXMuIFJhdGhlciwg dGhlIGxlc3NvbiBpcyB0byBhdm9pZCBpbnRlcmRlcGVuZGVudCBkZWNpc2lvbnM6PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwv bzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiogU2lnbmF0dXJl IGFsZ29yaXRobXMgaW4gVExTIDEuMiB3ZXJlIGEgbWVzcyBiZWNhdXNlIHRoZSBFQ0RTQSBjb2Rl cG9pbnRzIHJlcXVpcmVkIGNyb3NzLXJlZmVyZW5jaW5nIGFnYWluc3QgdGhlIHN1cHBvcnRlZCBj dXJ2ZXMgbGlzdC4gVGhlIHZlcmlmaWVyIGNvdWxkIG5vdCBleHByZXNzIHNvbWUgcHJlZmVyZW5j ZXMgKHNpZ25pbmcgU0hBLTUxMiB3aXRoIFAtMjU2IGlzIHNpbGx5LCBhbmQgbWl4aW5nIGhhc2gm IzQzO2N1cnZlDQogcGFpcnMgaW4gRUNEU0EgaXMgc2xpZ2h0bHkgb2ZmIGluIGdlbmVyYWwpLiBB cyBhbmFsb2d5IHRvIG9wdGlvbiAxJ3MgRVNOSSBwcm9ibGVtLCB3ZSBldmVuIGZvcmdvdCB0byBh bGxvdyB0aGUgc2VydmVyIHRvIGV4cHJlc3MgY3VydmUgcHJlZmVyZW5jZXMuIFRMUyAxLjMgY29t YmluZWQgc2lnbmF0dXJlIGFsZ29yaXRobSBjb25zaWRlcmF0aW9ucyBpbnRvIGEgc2luZ2xlIGNv ZGVwb2ludCB0byBhZGRyZXNzIGFsbCB0aGlzLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4qIENpcGhlciBzdWl0ZXMgaW4gVExTIDEuMiB3ZXJl IGEgbWVzcyBiZWNhdXNlIHRoZXkgd2VyZSBoYWxmLWNvbWJpbmVkIGFuZCBoYWxmLXNwbGl0LiBU TFNfRUNESEVfRUNEU0FfV0lUSF9BRVNfMTI4X0dDTV9TSEEyNTYgc2FpZCB0byB1c2Ugc29tZSBF Q0RIRSBrZXkgZXhjaGFuZ2UsIGJ1dCB5b3UgbmVlZCB0byBjaGVjayBpZiB5b3UgaGF2ZSBhIE5h bWVkR3JvdXAgaW4gY29tbW9uIGZpcnN0LiBJdCBzYWlkDQogdG8gdXNlIEVDRFNBLCBidXQgeW91 IG5lZWQgdG8gY2hlY2sgc2lnbmF0dXJlIGFsZ29yaXRobXMgKHdoaWNoIHRoZW1zZWx2ZXMgY3Jv c3MtcmVmZXJlbmNlIGN1cnZlcykgZmlyc3QuIEVhcmx5IGRyYWZ0cyBvZiBUTFMgMS4zIGhhZCBp dCBldmVuIHdvcnNlLCB3aGVyZSBhJm5ic3A7VExTX0VDREhFX0VDRFNBX1dJVEhfQUVTXzEyOF9H Q01fU0hBMjU2IGZ1bGwgaGFuZHNoYWtlIG1vcnBoZWQgaW50byZuYnNwO1RMU19FQ0RIRV9QU0tf V0lUSF9BRVNfMTI4X0dDTV9TSEEyNTYNCiBvbiByZXN1bXB0aW9uLiBUaHVzLCBUTFMgMS4zIGNp cGhlciBzdWl0ZXMgbmVnb3RpYXRlIHNvbGVseSBBRUFEJm5ic3A7JiM0MzsgUFJGIGhhc2guPG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZu YnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkluIGZh aXJuZXNzIHRvIFRMUyAxLjIsIHNvbWUgb2YgdGhpcyB3YXMgYSBjb25zZXF1ZW5jZSBvZiBUTFMg MS4yJ3MgZXZvbHV0aW9uIG92ZXIgdGltZSBhcyBpbmNyZW1lbnRhbCBleHRlbnNpb25zIG92ZXIg U1NMIDMuMC4gQW5kIHNvbWV0aW1lcyB3ZSBkbyBuZWVkIHRvIHBheSBjb3N0cyBsaWtlIHRoZXNl LiBCdXQgaHlicmlkIGtleSBleGNoYW5nZXMgZml0IGludG8gdGhlIE5hbWVkR3JvdXAgJnF1b3Q7 QVBJJnF1b3Q7IGp1c3QNCiBmaW5lLCBzbyBvcHRpb24gMiBpcyB0aGUgY2xlYXIgYW5zd2VyLiBD b2RlIHBvaW50cyBhcmUgY2hlYXAuIFByb3RvY29sIGNvbXBsZXhpdHkgaXMgbXVjaCBtb3JlIGV4 cGVuc2l2ZS48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+SXQncyB0cnVlIHRoYXQgc3RhbmRhcmRzIGFyZSBvZnRlbiB1bmRlcnNwZWNpZmllZC4g VGhpcyBtZWFucyB0aGUgSUVURiBzaG91bGQgZmluaXNoIHRoZSBqb2IsIG5vdCBwYXNzIGFsbCB2 YXJpYXRpb25zIHRocm91Z2guIFJTQS1QU1MgaXMgYSBjbGVhciBleGFtcGxlIG9mIHdoYXQgdG8g YXZvaWQuIEl0IHRha2VzIG1vcmUgYnl0ZXMgdG8gbWVyZWx5IHV0dGVyICZxdW90O1JTQS1QU1Mg d2l0aCBTSEEtMjU2IGFuZCB1c3VhbA0KIHBhcmFtZXRlcnMmcXVvdDsgaW4gWC41MDkgdGhhbiB0 byBlbmNvZGUgYW4gZW50aXJlIEVDRFNBIHNpZ25hdHVyZSEgV2Ugc2hvdWxkIG5vdCBkZWZpbmUg bW9yZSB0aGFuIGEgaGFuZGZ1bCBvZiBvcHRpb25zLCByZWdhcmRsZXNzIG9mIHRoZSBlbmNvZGlu Zy4uPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5i c3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5PbiBUdWUs IEp1bCAzMCwgMjAxOSBhdCAxMjoxOCBQTSBXYXRzb24gTGFkZCAmbHQ7PGEgaHJlZj0ibWFpbHRv OndhdHNvbmJsYWRkQGdtYWlsLmNvbSI+d2F0c29uYmxhZGRAZ21haWwuY29tPC9hPiZndDsgd3Jv dGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6bm9u ZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNi4w cHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tcmlnaHQ6MGluO21h cmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibWFyZ2luLWJvdHRvbToxMi4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5PbiBUdWUsIEp1bCAzMCwgMjAxOSwgODoyMSBB TSBTY290dCBGbHVocmVyIChzZmx1aHJlcikgJmx0OzxhIGhyZWY9Im1haWx0bzpzZmx1aHJlckBj aXNjby5jb20iIHRhcmdldD0iX2JsYW5rIj5zZmx1aHJlckBjaXNjby5jb208L2E+Jmd0OyB3cm90 ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25l O2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowaW4gMGluIDBpbiA2LjBw dDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1yaWdodDowaW47bWFy Z2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+ RHVyaW5nIHRoZSBwaHlzaWNhbCBtZWV0aW5nIGluIE1vbnRyZWFsLCB3ZSBoYWQgYSBkaXNjdXNz aW9uIGFib3V0IHBvc3RxdWFudHVtIHNlY3VyaXR5LCBhbmQgaW4gcGFydGljdWxhciwgb24gaG93 IG9uZSBtaWdodCB3YW50IHRvIG5lZ290aWF0ZSBzZXZlcmFsIGRpZmZlcmVudCDigJhncm91cHPi gJkgc2ltdWx0YW5lb3VzbHkNCiAoYmVjYXVzZSB0aGVyZSBtaWdodCBub3QgYmUgb25lIGdyb3Vw IHRoYXQgaXMgZW50aXJlbHkgdHJ1c3RlZCwgYW5kIEkgcHV0IOKAmGdyb3Vwc+KAmSBpbiBzY2Fy ZXF1b3RlcyBiZWNhdXNlIHBvc3RxdWFudHVtIGtleSBleGNoYW5nZXMgYXJlIHR5cGljYWxseSBu b3QgZm9ybWVkIGZyb20gYSBEaWZmaWUtSGVsbG1hbiBncm91cCkuPG86cD48L286cD48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1h cmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIGxhbmc9IkVOLUdCIj4mbmJzcDs8L3NwYW4+PG86 cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3At YWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIGxhbmc9IkVOLUdCIj5B dCB0aGUgbWVldGluZywgdGhlcmUgd2VyZSB0d28gb3B0aW9ucyBwcmVzZW50ZWQ6PC9zcGFuPjxv OnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9w LWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBsYW5nPSJFTi1HQiI+ Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3Bh biBsYW5nPSJFTi1HQiI+T3B0aW9uIDE6IGFzIHRoZSBzdXBwb3J0ZWQgZ3JvdXAsIHdlIGluc2Vy dCBhIOKAmGh5YnJpZCBtYXJrZXLigJkgKGFuZCBpbmNsdWRlIGFuIGV4dGVuc2lvbiB0aGF0IG1h cCBsaXN0cyB3aGljaCBjb21iaW5hdGlvbiB0aGUgaHlicmlkIG1hcmtlciBzdGFuZHMgZm9yKTwv c3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFy Z2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gbGFuZz0i RU4tR0IiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBGb3IgZXhhbXBsZSwgdGhl IGNsaWVudCBtaWdodCBsaXN0IGluIGhpcyBzdXBwb3J0ZWQgZ3JvdXBzIGh5YnJpZF9tYXJrZXJf MCBhbmQgaHlicmlkX21hcmtlcl8xLCBhbmQgdGhlcmUgd291bGQgYmUgYSBzZXBhcmF0ZSBleHRl bnNpb24gdGhhdCBsaXN0cw0KIGh5YnJpZF9tYXJrZXJfMCA9IFgyNTUxOSAmIzQzOyBTSUtFcDQz NCBhbmQgaHlicmlkX21hcmtlcl8xID0gWDI1NTE5ICYjNDM7IE5UUlVQUjY1My4mbmJzcDsgVGhl IHNlcnZlciB3b3VsZCB0aGVuIGxvb2sgdXAgdGhlIG1lYW5pbmdzIG9mIGh5YnJpZF9tYXJrZXJf MCBhbmQgMSBpbiB0aGUgZXh0ZW5zaW9uLCBhbmQgdGhlbiBjb21wYXJlIHRoYXQgYWdhaW5zdCBo aXMgc2VjdXJpdHkgcG9saWN5Ljwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1h bHQ6YXV0bzt0ZXh0LWluZGVudDouNWluIj4NCjxzcGFuIGxhbmc9IkVOLUdCIj5JbiB0aGlzIG9w dGlvbiwgd2Ugd291bGQgYXNrIElBTkEgdG8gYWxsb2NhdGUgY29kZSBwb2ludHMgZm9yIHRoZSB2 YXJpb3VzIGluZGl2aWR1YWwgcG9zdHF1YW50dW0ga2V5IGV4Y2hhbmdlcyAoaW4gdGhpcyBleGFt cGxlLCBTSUtFcDQzNCBhbmQgTlRSVVBSNjUzKSwgYXMgd2VsbCBhIHJhbmdlIG9mIGNvZGUgcG9p bnRzIGZvciB0aGUgdmFyaW91cyBoeWJyaWRfbWFya2Vycy48L3NwYW4+PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8 ZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICND Q0NDQ0MgMS4wcHQ7cGFkZGluZzowaW4gMGluIDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDtt YXJnaW4tdG9wOjUuMHB0O21hcmdpbi1yaWdodDowaW47bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8 ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1h bHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gbGFuZz0iRU4tR0IiPiZu YnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt c28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4g bGFuZz0iRU4tR0IiPk9wdGlvbiAyOiB3ZSBoYXZlIGNvZGUgcG9pbnRzIGZvciBhbGwgdGhlIHZh cmlvdXMgY29tYmluYXRpb25zIHRoYXQgd2UgbWF5IHdhbnQgdG8gc3VwcG9ydDsgaGVuY2UgSUFO QSBtaWdodCBhbGxvY2F0ZSBhIGNvZGUgcG9pbnQgWDI1NTE5X1NJS0VwNDM0IGFuZCBhbm90aGVy DQogY29kZSBwb2ludCBmb3IgWDI1NTE5X05UUlVQUjY1My4mbmJzcDsgV2l0aCB0aGlzIG9wdGlv biwgdGhlIGNsaWVudCB3b3VsZCBsaXN0IFgyNTUxOV9TSUtFcDQzNCBhbmQgWDI1NTE5X05UUlVQ UjY1MyBpbiB0aGVpciBzdXBwb3J0ZWQgZ3JvdXBzLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFy Z2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gbGFuZz0iRU4tR0IiPiZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyBJbiB0aGlzIG9wdGlvbiwgd2Ugd291bGQgYXNrIElBTkEgdG8gYWxs b2NhdGUgY29kZSBwb2ludHMgZm9yIGFsbCB0aGUgdmFyaW91cyBjb21iaW5hdGlvbnMgdGhhdCB3 ZSB3YW50IGFsbG93IHRvIGJlIG5lZ290aWF0ZWQuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJn aW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBsYW5nPSJFTi1HQiI+Jm5ic3A7PC9zcGFuPjxvOnA+ PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFs dDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBsYW5nPSJFTi1HQiI+SSB3 b3VsZCBsaWtlIHRvIG1ha2UgYW4gYXJndW1lbnQgaW4gZmF2b3Igb2Ygb3B0aW9uIDE6PC9zcGFu PjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4t dG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBsYW5nPSJFTi1H QiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHVsIHR5cGU9ImRpc2MiPg0KPGxpIGNs YXNzPSJnbWFpbC1tMTY3MzY5NDE3NTU1Nzk1ODcxMW01MDEyMTEyODg2NzExMjEyODkwbXNvbGlz dHBhcmFncmFwaCIgc3R5bGU9Im1zby1saXN0OmwwIGxldmVsMSBsZm8zIj4NCjxzcGFuIGxhbmc9 IkVOLUdCIj5JdCBpcyBsaWtlbHkgdGhhdCBub3QgZXZlcnlvbmUgd2lsbCBiZSBzYXRpc2lmaWVk IHdpdGgg4oCcWDI1NTE5IHBsdXMgb25lIG9mIGEgaGFuZGZ1bCBvZiBzcGVjaWZpYyBwb3N0cXVh bnR1bSBhbGdvcml0aG1z4oCdOyBzb21lIG1heSBwcmVmZXIgYW5vdGhlciBlbGxpcHRpYyBjdXJ2 ZSAoZm9yIGV4YW1wbGUsIHg0NDgpLCBvciBwZXJoYXBzIGV2ZW4gYSBNT0RQIGdyb3VwOyBJIGhh dmUgdGFsa2VkIHRvIHBlb3BsZSB3aG8NCiBkbyBub3QgdHJ1c3QgRUNDKTsgaW4gYWRkaXRpb24s IG90aGVyIHBlb3BsZSBtaWdodCBub3QgdHJ1c3QgYSBzaW5nbGUgcG9zdHF1YW50dW0gYWxnb3Jp dGhtLCBhbmQgbWF5IHdhbnQgdG8gcmVseSBvbiBib3RoIChmb3IgZXhhbXBsZSkgU0lLRSBhbmQg TmV3SG9wZSAod2hpY2ggYXJlIGJhc2VkIG9uIHZlcnkgZGlmZmVyZW50IGhhcmQgcHJvYmxlbXMp LiZuYnNwOyBXaXRoIG9wdGlvbiAyLCB3ZSBjb3VsZCB0cnkgdG8gYW50aWNpcGF0ZSBhbGwgdGhl IGNvbW1vbg0KIGNvbWJpbnRhdGlvbnMgKHN1Y2ggYXMgUDM4NF9TSUtFcDQzNF9ORVdIT1BFNTEy Q0NBKSwgaG93ZXZlciB0aGF0IGNvdWxkIHZlcnkgd2VsbCBlbmQgdXAgYXMgYSBsb3Qgb2YgY29t YmluYXRpb25zLjwvc3Bhbj48bzpwPjwvbzpwPjwvbGk+PGxpIGNsYXNzPSJnbWFpbC1tMTY3MzY5 NDE3NTU1Nzk1ODcxMW01MDEyMTEyODg2NzExMjEyODkwbXNvbGlzdHBhcmFncmFwaCIgc3R5bGU9 Im1zby1saXN0OmwwIGxldmVsMSBsZm8zIj4NCjxzcGFuIGxhbmc9IkVOLUdCIj5UaGVyZSBhcmUg bGlrZWx5IHRvIGJlIHNldmVyYWwgTklTVC1hcHByb3ZlZCBwb3N0cXVhbnR1bSBrZXkgZXhjaGFu Z2VzLCBhbmQgZWFjaCBvZiB0aG9zZSBrZXkgZXhjaGFuZ2VzIGFyZSBsaWtlbHkgdG8gaGF2ZSBh IG51bWJlciBvZiBzdXBwb3J0ZWQgcGFyYW1ldGVyIHNldHMgKGlmIHdlIHRha2UgdGhlIHNwZWNp ZmljIHBvc3RxdWFudHVtIGtleSBleGNoYW5nZSBhcyBhbmFsb2dvdXMgdG8gdGggRUNESCBwcm90 b2Nvb2wsDQogdGhlIOKAnHBhcmFtZXRlciBzZXTigJ0gY291bGQgYmUgdGhvdWdodCBvZiBhbiBh bmFsb2dvdXMgdG8gdGhlIHNwZWNpZmljIGVsbGlwdHVjIGN1cnZlLCBhbmQgaXQgbW9kaWZpZXMg dGhlIGtleSBzaGFyZSBzaXplLCB0aGUgcGVyZm9ybWFuY2UgYW5kIHNvbWV0aW1lcyB0aGUgc2Vj dXJpdHkgcHJvcGVydGllcykuJm5ic3A7IEluIGZhY3QsIG9uZSBvZiB0aGUgTklTVCBzdWJtaXNz b2lucyBjdXJyZW50bHkgaGFzIDMwIHBhcmFtZXRlciBzZXRzIGRlZmluZWQuJm5ic3A7DQogSGVu Y2UsIGV2ZW4gaWYgTklTVCBkb2VzbuKAmXQgYXBwcm92ZSBhbGwgdGhlIHBhcmFtZXRlciBzZXRz IChvciBzb21lIG9mIHRoZW0gZG8gbm90IG1ha2Ugc2Vuc2UgZm9yIFRMUyBpbiBhbnkgc2NlbmFy aW8pLCB3ZSBtaWdodCBlbmQgdXAgd2l0aCAyMCBvciBtb3JlIGRpZmZlcmVudCBrZXkgZXhjaGFu Z2UvcGFyYW1ldGVyIHNldCBjb21iaW5hdGlvbnMgdGhhdCBkbyBtYWtlIHNlbnNlIGZvciBzb21l IHNjZW5hcmlvIHRoYXQgdXNlcyB0TFMgKGJlDQogaXQgaW4gYSB0cmFuZGl0aW9uYWwgUEMgY2xp ZW50L3NlcnZlciwgYSB3aXJlbGVzcyBjbGllbnQsIHR3byBjbG91ZCBkZXZpY2VzIGNvbW11bmlj YXRpbmcgb3IgYW4gSU9UIGRldmljZSkuPC9zcGFuPjxvOnA+PC9vOnA+PC9saT48bGkgY2xhc3M9 ImdtYWlsLW0xNjczNjk0MTc1NTU3OTU4NzExbTUwMTIxMTI4ODY3MTEyMTI4OTBtc29saXN0cGFy YWdyYXBoIiBzdHlsZT0ibXNvLWxpc3Q6bDAgbGV2ZWwxIGxmbzMiPg0KPHNwYW4gbGFuZz0iRU4t R0IiPkluIGFkZGl0aW9uLCB3ZSBhcmUgbGlrZWx5IHRvIHN1cHBvcnQgYWRkaXRpb25hbCBwcmlt aXRpdmVzIGluIHRoZSBmdXR1cmU7IHBvc3NpYmx5IE5hdGlvbmFsIGN1cnZlcyAoZS5nLiBCcmFp bnBvb2wpLCBvciBhZGRpdGlvbmFsIFBvc3RxdWFudHVtIGFsZ29yaXRobXMgKG9yIGFkZGl0aW9u YWwgcGFyYW1ldGVyIHNldHMgdG8gZXhpc3Rpbmcgb25lcykuJm5ic3A7IE9mIGNvdXJzZSwgb25j ZSB3ZSBhZGQgdGhhdCBjb2RlDQogcG9pbnQsIHdl4oCZbGwgbmVlZCB0byBhZGQgdGhlIGFkZGl0 aW9uYWwgY29kZSBwb2ludHMgZm9yIGFsbCB0aGUgY29tYmluYXRpb25zIHRoYXQgaXTigJlsbCBt YWtlIHNlbnNlIGluICh2ZXJ5IG11Y2ggbGlrZSB3ZSBoYWQgdG8gYWRkIGEgbnVtYmVyIG9mIGNp cGhlcnN1aXRlcyB3aGVuZXZlciB3ZSBhZGRlZCBhIG5ldyBlbmNyeXB0aW9uIGFsZ29yaXRobSBp bnRvIFRMUyAxLjIpLjwvc3Bhbj48bzpwPjwvbzpwPjwvbGk+PC91bD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1h bHQ6YXV0byI+PHNwYW4gbGFuZz0iRU4tR0IiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+QXJlIHBlb3BsZSBhY3R1YWxseSBnb2luZyB0byB1c2UgaHli cmlkIGVuY3J5cHRpb24gcG9zdCBOSVNUPyBUaGUgYWN0dWFsIGRlcGxveW1lbnRzIHRvZGF5Jm5i c3A7IGZvciBleHBlcmltZW50IGhhdmUgYWxsIGZpdCBvcHRpb24gMiBhbmQgaHlicmlkcyBhcmUg dW5saWtlbHkgaW4gdGhlIGZ1dHVyZS4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+TXkgb2JqZWN0aW9uIHRvIDEgaXMgaXQgZ2V0cyB2 ZXJ5IG1lc3N5LiBEbyB3ZSB1c2Ugb25seSB0aGUgaHlicmlkcyB3ZSBib3RoIHN1cHBvcnQ/IFdo YXQgaWYgSSB0aHJvdyBhIGJ1bmNoIG9mIGV4cGVuc2l2ZSB0aGluZ3MgdG9nZXRoZXI/IE5vIHJl YXNvbiB3ZSBuZWVkIGEgaHlicmlkIHNjaGVtZSEmbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPGRpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXIt bGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2lu LWxlZnQ6NC44cHQ7bWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tcmlnaHQ6MGluO21hcmdpbi1ib3R0 b206NS4wcHQiPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNv LW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIGxh bmc9IkVOLUdCIj5JdCBzZWVtZHMgcmVhc29uYWJsZSB0byBtZSB0aGF0IHRoZSBjb21iaW5hdGlv biBvZiB0aGVzZSB0d28gZmFjdG9ycyBhcmUgbGlrZWx5IHRvIGNhdXNlIHVzIChzaG91bGQgd2Ug c2VsZWN0IG9wdGlvbiAyKSB0byBkZWZpbmUgYSB2ZXJ5IGxhcmdlIG51bWJlciBvZiBjb2RlDQog cG9pbnRzIHRvIGNvdmVyIGFsbCB0aGUgdmFyaW91cyBvcHRpb25zIHRoYXQgcGVvcGxlIG5lZWQu PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1t YXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBsYW5n PSJFTi1HQiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDph dXRvIj48c3BhbiBsYW5nPSJFTi1HQiI+Tm93LCB0aGlzIGlzIGJhc2VkIG9uIHNwZWN1bGF0aW9u IChib3RoIG9mIHRoZSBOSVNUIHByb2Nlc3MsIGFuZCBhZGRpdGlvbmFsIHByaW1pdGl2ZXMgdGhh dCB3aWxsIGJlIGFkZGVkIHRvIHRoZSBwcm90b2NvbCksIGFuZCBvbmUgb2JqZWN0aW9uIEnigJl2 ZSBoZWFyZCBpcyDigJx3ZQ0KIGRvbuKAmXQga25vdyB3aGF04oCZcyBnb2luZyB0byBoYXBwZW4s IGFuZCBzbyB3aHkgd291bGQgd2UgbWFrZSBkZWNpc2lvbnMgYmFzZWQgb24gdGhpcyBzcGVjdWxh dGlvbj/igJ0mbmJzcDsgSSBhZ3JlZSB0aGF0IHdlIGhhdmUgbGFjayBvZiBrbm93bGVkZ2U7IGhv d2V2ZXIgaXQgc2VlbXMgdG8gbWUgdGhhdCBhIGxhY2sgb2Yga25vd2xlZGdlIGlzIGFuIGFyZ3Vt ZW50IGluIGZhdm9yIG9mIHNlbGVjdGluZyB0aGUgbW9yZSBmbGV4aWJsZSBvcHRpb24gKHdoaWNo LA0KIGluIG15IG9waW5pb24sIGlzIG9wdGlvbiAxLCBhcyBpdCBhbGxvd3MgdGhlIG5lZ290aWF0 aW9uIG9mIGNvbWJpbmF0aW9ucyBvZiBrZXkgZXhjaGFuZ2VzIHRoYXQgdGhlIFdHIGhhcyBub3Qg YW50aWNpcGF0ZWQpLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0 byI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNv LW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPk15IHBsZWE6 IGxldHMgbm90IHJlcGVhdCB0aGUgVExTIDEuMiBjaXBoZXJzdWl0ZSBtZXNzOyBsZXRzIGFkZCBh biBleHRlbnNpb24gdGhhdCBrZWVwcyB0aGUgbnVtYmVyIG9mIGNvZGUgcG9pbnRzIHdlIG5lZWQg dG8gYSByZWFzb25hYmxlIGJvdW5kLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDph dXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt c28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+VGhlIGNv c3RzIG9mIG9wdGlvbiAxPzxvOnA+PC9vOnA+PC9wPg0KPHVsIHR5cGU9ImRpc2MiPg0KPGxpIGNs YXNzPSJnbWFpbC1tMTY3MzY5NDE3NTU1Nzk1ODcxMW01MDEyMTEyODg2NzExMjEyODkwbXNvbGlz dHBhcmFncmFwaCIgc3R5bGU9Im1zby1saXN0OmwzIGxldmVsMSBsZm82Ij4NCkl0IGRvZXMgaW5j cmVhc2UgdGhlIGNvbXBsZXhpdHkgb24gdGhlIHNlcnZlciBhIHNtYWxsIGFtb3VudCAoSeKAmW0g bm90IGEgVExTIGltcGxlbWVudG9yLCBob3dldmVyIGl0IHdvdWxkIHNlZW0gdG8gbWUgdG8gYmUg b25seSBhIGZhaXJseSBzbWFsbCBhbW91bnQpPG86cD48L286cD48L2xpPjxsaSBjbGFzcz0iZ21h aWwtbTE2NzM2OTQxNzU1NTc5NTg3MTFtNTAxMjExMjg4NjcxMTIxMjg5MG1zb2xpc3RwYXJhZ3Jh cGgiIHN0eWxlPSJtc28tbGlzdDpsMyBsZXZlbDEgbGZvNiI+DQpJdCBtYXkgaW5jcmVhc2UgdGhl IHNpemUgb2YgdGhlIGNsaWVudCBoZWxsbyBhIHNtYWxsIGFtb3VudCAob24gdGhlIG90aGVyIGhh bmQsIGJlY2F1c2UgaXQgYWxsb3dzIHVzIHRvIGF2b2lkIHNlbmRpbmcgZHVwbGljYXRlIGtleSBz aGFyZXMsIGl0IGNhbiBhbHNvIHJlZHVjZSB0aGUgc2l6ZSBvZiB0aGUgY2xpZW50IGhlbGxvIGFz IHdlbGwsIGRlcGVuZGluZyBvbiB3aGF04oCZcyBhY3R1YWxseSBuZWdvdGlhdGVkKTxvOnA+PC9v OnA+PC9saT48L3VsPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9w LWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj5JTUhPLCB0aGUgc21hbGwgaW5j cmVhc2UgaW4gY29tcGxleGl0eSBpcyB3b3J0aCB0aGUgbGFjayBvZiBjb21wbGV4aXR5IGluIHRo ZSBjb2RlIHBvaW50IHRhYmxlLCBhbmQgdGhlIGFkZGl0aW9uYWwgZmxleGliaWxpdHkgaXQgZ2l2 ZXMuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX188YnI+DQpUTFMg bWFpbGluZyBsaXN0PGJyPg0KPGEgaHJlZj0ibWFpbHRvOlRMU0BpZXRmLm9yZyIgdGFyZ2V0PSJf YmxhbmsiPlRMU0BpZXRmLm9yZzwvYT48YnI+DQo8YSBocmVmPSJodHRwczovL25hbTA2LnNhZmVs aW5rcy5wcm90ZWN0aW9uLm91dGxvb2suY29tLz91cmw9aHR0cHMlM0ElMkYlMkZ3d3cuaWV0Zi5v cmclMkZtYWlsbWFuJTJGbGlzdGluZm8lMkZ0bHMmYW1wO2RhdGE9MDIlN0MwMSU3Q0FuZHJlaS5Q b3BvdiU0MG1pY3Jvc29mdC5jb20lN0M4YjQ1NzQwZjA4MWY0NDgyMGE0YzA4ZDcxNTFiMzBlMyU3 QzcyZjk4OGJmODZmMTQxYWY5MWFiMmQ3Y2QwMTFkYjQ3JTdDMSU3QzAlN0M2MzcwMDEwNzkwMDM4 NDkwNDImYW1wO3NkYXRhPXN3QjUya0glMkZ4N0R2TE5hWDlFQXlIY05mN1Z1aVhSUlVzeCUyRnRk bjBlMVM0JTNEJmFtcDtyZXNlcnZlZD0wIiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly93d3cuaWV0 Zi5vcmcvbWFpbG1hbi9saXN0aW5mby90bHM8L2E+PG86cD48L286cD48L3A+DQo8L2Jsb2NrcXVv dGU+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXzxicj4NClRMUyBtYWlsaW5n IGxpc3Q8YnI+DQo8YSBocmVmPSJtYWlsdG86VExTQGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+ VExTQGlldGYub3JnPC9hPjxicj4NCjxhIGhyZWY9Imh0dHBzOi8vbmFtMDYuc2FmZWxpbmtzLnBy b3RlY3Rpb24ub3V0bG9vay5jb20vP3VybD1odHRwcyUzQSUyRiUyRnd3dy5pZXRmLm9yZyUyRm1h aWxtYW4lMkZsaXN0aW5mbyUyRnRscyZhbXA7ZGF0YT0wMiU3QzAxJTdDQW5kcmVpLlBvcG92JTQw bWljcm9zb2Z0LmNvbSU3QzhiNDU3NDBmMDgxZjQ0ODIwYTRjMDhkNzE1MWIzMGUzJTdDNzJmOTg4 YmY4NmYxNDFhZjkxYWIyZDdjZDAxMWRiNDclN0MxJTdDMCU3QzYzNzAwMTA3OTAwMzg1OTAzNSZh bXA7c2RhdGE9T0hFd0M2aXRtd2JycVQxVHBCeUtveXRPdWhLT0lnaGl4N1N6TWtQZFh2USUzRCZh bXA7cmVzZXJ2ZWQ9MCIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxt YW4vbGlzdGluZm8vdGxzPC9hPjxvOnA+PC9vOnA+PC9wPg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+ DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_MN2PR11MB387187D8FEEF1A16DD8483BAC1DC0MN2PR11MB3871namp_-- From nobody Tue Jul 30 12:51:23 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6D2B31200B7 for ; Tue, 30 Jul 2019 12:51:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xpPy0QsUsjWK for ; Tue, 30 Jul 2019 12:51:15 -0700 (PDT) Received: from NAM01-BY2-obe.outbound.protection.outlook.com (mail-eopbgr810094.outbound.protection.outlook.com [40.107.81.94]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 05A6C12001E for ; Tue, 30 Jul 2019 12:51:14 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=DkEr6aSzfXXZvqgqsUGPp7JaOg3v64MKtkVpDqAbSBvCBaL/t5YAJ2zYLCAFJr39zLJUgfJfcek5qdO7yA3yzpTvfT1VqnnsppujqG+XWcbDAvD2SNZcLl71yVjE4PuAHTVRXgvZ05rjo8XfvRL3NJeMk5SyT2h9RCoUR2ROhyo9g87pioqWsdmhrs5lj2WdFnQusUiL8c0JbWK1xecoLehZ6DvAq2spl7vKXWuWDGek5revtZkIzP8WKOx3jNm1X87RrAteWA9pb8nxwFnPXQw93I9AZLgNAxygVjIgCXXkoho+jZeoSLfUouidm6v4Z27RLx56O3Fk9af3JUIcVw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=grW7LNf+/i1IF/mRjR3swuZ8F4//VSRaQbKvj70Zyr0=; b=WdjClHLVrF4UuyD168jrpA1xx96vU1i4onKnriHJWBUk7vkSFwJOKQvgDF81ehY5wFz6ha5tQDxb7AnzXTUuLpFyqGelrKxQpqxXEKto331xQHMWxip3XSSkmKzPxcB18wuapsXV1V01d6NMvPtdDxi1S1epJsHOI/8X/LQDYxab/o2Hg2uIED+tcgBiLl7su/pYTJdDvsOi3d/5CpZCIAXsRJ9JbnKwLuiXNmZn9yf+4G3uhw41H13wawTxu1hUpZ5kIRClDQ8Yfow7qmzwfYgkBwheO44FVSyheeyNw0cw0f4cuPnRbPoWUT0Sftyx+frm81T0MAcEqBDDptMEog== ARC-Authentication-Results: i=1; mx.microsoft.com 1;spf=pass smtp.mailfrom=microsoft.com;dmarc=pass action=none header.from=microsoft.com;dkim=pass header.d=microsoft.com;arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=grW7LNf+/i1IF/mRjR3swuZ8F4//VSRaQbKvj70Zyr0=; b=mWcmSsZ+Wuq1NL6yt43ZzCfuuUPJaKvljTND3wC4POXxvibVwdBujG5fru5RxsCABp2HAu67LciVwRYIumlvrEH/hYzUWmfLnw6b88YoZFedGnQ9vtmQD1drn1CMfQGaM1Ca7PnbWXYmGUeosqJLC1fxDuk22m+8lm9lCg0MgR4= Received: from DM5PR2101MB0917.namprd21.prod.outlook.com (52.132.132.162) by DM5PR2101MB0871.namprd21.prod.outlook.com (10.167.110.167) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2136.6; Tue, 30 Jul 2019 19:51:13 +0000 Received: from DM5PR2101MB0917.namprd21.prod.outlook.com ([fe80::6cee:c549:a46c:9e5c]) by DM5PR2101MB0917.namprd21.prod.outlook.com ([fe80::6cee:c549:a46c:9e5c%7]) with mapi id 15.20.2157.001; Tue, 30 Jul 2019 19:51:13 +0000 From: Andrei Popov To: "Scott Fluhrer (sfluhrer)" , David Benjamin , Watson Ladd CC: TLS List Thread-Topic: [TLS] Options for negotiating hybrid key exchanges for postquantum Thread-Index: AdVG1haOE+yO4N1wQQSyYtQ5VKKSwAAHEKmAAARkcYAAAMUecAAB4O5AAAA43tA= Date: Tue, 30 Jul 2019 19:51:13 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Andrei.Popov@microsoft.com; x-originating-ip: [2001:4898:80e8:a:28b3:a023:971b:e42c] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 0036dda7-ca63-405d-f399-08d7152746fc x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(4618075)(2017052603328)(7193020); SRVR:DM5PR2101MB0871; x-ms-traffictypediagnostic: DM5PR2101MB0871: x-ms-exchange-purlcount: 3 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:7691; x-forefront-prvs: 0114FF88F6 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(4636009)(39860400002)(376002)(136003)(396003)(346002)(366004)(199004)(189003)(15404003)(229853002)(68736007)(71190400001)(446003)(25786009)(66476007)(66446008)(6506007)(561944003)(14454004)(55016002)(102836004)(76176011)(486006)(7696005)(110136005)(9686003)(53546011)(6246003)(7736002)(46003)(33656002)(54896002)(8990500004)(10090500001)(316002)(66556008)(64756008)(66946007)(236005)(256004)(476003)(22452003)(53936002)(14444005)(8676002)(52536014)(2906002)(4326008)(5660300002)(86362001)(81156014)(11346002)(6436002)(186003)(966005)(76116006)(790700001)(6116002)(30864003)(74316002)(478600001)(71200400001)(6306002)(10290500003)(5070765005)(8936002)(99286004)(81166006)(606006); DIR:OUT; SFP:1102; SCL:1; SRVR:DM5PR2101MB0871; H:DM5PR2101MB0917.namprd21.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: XpZVln1uJkxQoILeEcjQU0fq3+uoVKkWAECi0EwxQ8Fxbh6K3u4exlOr/ka+oHM8j6lLgC2bfvwO/uD/EL+OkbWzxCj7ixF4JsiQ6pDo89pL5duBkxu51Ab8Amg4PaUbTGMlpnkKJeCWTOsCJtJxvftbz5wrmiu76RfLMgDLjtjz4JUNH6OVcfUrPyVxZNX/n7kxjRV859abiLOgZdh8QqyNeiMEc7t7Fhd5gywO8lif//i6yWdkNqXF423YFmJIvhGfJmIPF+uPflhb5KK8c8sW/ndAJrlylDor5myV42YKS7t7ztM7ut9IunpDt8JXZFMCPHlbjYzd98FceYbO1YWItVfS7MKJsv9Hq+UgBwgZWgx2bQiS92+ZBnColdIxd30wWYfZU+O6eMGzVgaVe9GTMjoEFgySGrjEGlmQQTc= x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_DM5PR2101MB09178A1D1192D045A1FF76F78CDC0DM5PR2101MB0917_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: 0036dda7-ca63-405d-f399-08d7152746fc X-MS-Exchange-CrossTenant-originalarrivaltime: 30 Jul 2019 19:51:13.3156 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: cFnWbyJbrlN9+ngMvALoPngW3FDnQ4e/nC3PPeUhpZZtQiXzf3X8PuDQkvb6WYrXdMBZCQjiNd9Q6meyU0JjYA== X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM5PR2101MB0871 Archived-At: Subject: Re: [TLS] Options for negotiating hybrid key exchanges for postquantum X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 30 Jul 2019 19:51:22 -0000 --_000_DM5PR2101MB09178A1D1192D045A1FF76F78CDC0DM5PR2101MB0917_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 PiBJdCBpcyBub3QgY2xlYXIgaWYgdGhlIHByb3Bvc2FsIHlvdSBvdXRsaW5lZCBzaGFyZSB0aGlz IHByb3BlcnR5OyBkbyB5b3UgZHVwbGljYXRlIGEgcGF5bG9hZCB0aGF0IGFuIHVuZW5oYW5jZWQg c2VydmVyIHdvdWxkIGFzc3VtZSBvbmx5IG9jY3VycyBvbmNlPw0KSSB0aGluayB0aGlzIHByb3Bl cnR5IGlzIHByZXNlcnZlZDogb25seSBhIHNlcnZlciB0aGF0IGtub3dzIHRoZSBoeWJyaWQta2V5 LWV4Y2hhbmdlIGV4dGVuc2lvbiAob3IgcGVyaGFwcywgYSBtb3JlIHNwZWNpZmljIG9uZS10cmFk aXRpb25hbC1hbmQtb25lLVBRIGV4dGVuc2lvbikgd2lsbCBzZW5kIEtleVNoYXJlU2VydmVySGVs bG8gd2l0aCB0d28gS2V5U2hhcmVFbnRyaWVzLg0KQW4g4oCcdW5lbmhhbmNlZOKAnSBzZXJ2ZXIg d2lsbCBzZW5kIG9ubHkgb25lIEtleVNoYXJlRW50cnkuIFdl4oCZZCBuZWVkIHRvIHRoaW5rIGFi b3V0IGhvdyB0aGUg4oCcZW5oYW5jZWTigJ0gY2xpZW50IGNhbiBkaXN0aW5ndWlzaCB0aGUgdHdv IEtleVNoYXJlU2VydmVySGVsbG8gZm9ybWF0cywgYnV0IHRoZXJlIGFyZSBlYXN5IHNvbHV0aW9u cyB0byB0aGlzLCBJIHRoaW5rLg0KDQpGcm9tOiBTY290dCBGbHVocmVyIChzZmx1aHJlcikgPHNm bHVocmVyQGNpc2NvLmNvbT4NClNlbnQ6IFR1ZXNkYXksIEp1bHkgMzAsIDIwMTkgMTI6NDQgUE0N ClRvOiBBbmRyZWkgUG9wb3YgPEFuZHJlaS5Qb3BvdkBtaWNyb3NvZnQuY29tPjsgRGF2aWQgQmVu amFtaW4gPGRhdmlkYmVuQGNocm9taXVtLm9yZz47IFdhdHNvbiBMYWRkIDx3YXRzb25ibGFkZEBn bWFpbC5jb20+DQpDYzogVExTIExpc3QgPHRsc0BpZXRmLm9yZz4NClN1YmplY3Q6IFJFOiBbVExT XSBPcHRpb25zIGZvciBuZWdvdGlhdGluZyBoeWJyaWQga2V5IGV4Y2hhbmdlcyBmb3IgcG9zdHF1 YW50dW0NCg0KSSBiZWxpZXZlIHRoYXQgb25lIGltcG9ydGFudCBwcm9wZXJ0eSAob2YgZWl0aGVy IG9mIHRoZSBvcHRpb25zIEkgbGlzdGVkKSBpcyBhIG5pY2UgZmFsbGJhY2sgaWYgYW4gZW5oYW5j ZWQgY2xpZW50IHRhbGtzIHRvIGFuIG9sZGVyIHNlcnZlci4gIEluIGJvdGggY2FzZXMsIHRoZSBz ZXJ2ZXIgd2lsbCBzZWUgYSBzZXJpZXMgb2YgbmFtZWQgZ3JvdXBzIHRoYXQgaXQgZG9lc27igJl0 IGtub3cgKHdoaWNoIGl0IHdpbGwgaWdub3JlKSwgYW5kIHBvc3NpYmlsaXR5IGFuIGV4dGVuc2lv biBpdCBkb2VzbuKAmXQga25vdyAod2hpY2ggaXQgd2lsbCBpZ25vcmUpOyB0aGUgc2VydmVyIHdp bGwgYWNjZXB0IGVpdGhlciBhIG5hbWVkIGdyb3VwIHRoYXQgaXQgZG9lcyB1bmRlcnN0YW5kIChp ZiB0aGUgY2xpZW50IGRpZCBwcm9wb3NlIGEgdHJhZGl0aW9uYWwgZ3JvdXAgYXMgYSBmYWxsIGJh Y2spLCBvciBpdCB3aWxsIGNvbWUgdG8gdGhlIGNvcnJlY3QgY29uY2x1c2lvbiB0aGF0IHRoZSB0 d28gc2lkZXMgaGF2ZSBubyBtdXR1YWxseSBhY2NlcHRhYmxlIHNlY3VyaXR5IHBvbGljeS4NCg0K SXQgaXMgbm90IGNsZWFyIGlmIHRoZSBwcm9wb3NhbCB5b3Ugb3V0bGluZWQgc2hhcmUgdGhpcyBw cm9wZXJ0eTsgZG8geW91IGR1cGxpY2F0ZSBhIHBheWxvYWQgdGhhdCBhbiB1bmVuaGFuY2VkIHNl cnZlciB3b3VsZCBhc3N1bWUgb25seSBvY2N1cnMgb25jZT8NCg0KRnJvbTogVExTIDx0bHMtYm91 bmNlc0BpZXRmLm9yZzxtYWlsdG86dGxzLWJvdW5jZXNAaWV0Zi5vcmc+PiBPbiBCZWhhbGYgT2Yg QW5kcmVpIFBvcG92DQpTZW50OiBUdWVzZGF5LCBKdWx5IDMwLCAyMDE5IDI6NDggUE0NClRvOiBE YXZpZCBCZW5qYW1pbiA8ZGF2aWRiZW5AY2hyb21pdW0ub3JnPG1haWx0bzpkYXZpZGJlbkBjaHJv bWl1bS5vcmc+PjsgV2F0c29uIExhZGQgPHdhdHNvbmJsYWRkQGdtYWlsLmNvbTxtYWlsdG86d2F0 c29uYmxhZGRAZ21haWwuY29tPj4NCkNjOiBUTFMgTGlzdCA8dGxzQGlldGYub3JnPG1haWx0bzp0 bHNAaWV0Zi5vcmc+Pg0KU3ViamVjdDogUmU6IFtUTFNdIE9wdGlvbnMgZm9yIG5lZ290aWF0aW5n IGh5YnJpZCBrZXkgZXhjaGFuZ2VzIGZvciBwb3N0cXVhbnR1bQ0KDQpHaXZlbiB0aGVzZSBvcHRp b25zLCBJIGFsc28gcHJlZmVyIG9wdGlvbiAyLCBmb3Igc29tZSBvZiB0aGUgc2FtZSByZWFzb25z Lg0KDQpGb3IgbXkgdW5kZXJzdGFuZGluZyB0aG91Z2gsIHdoeSBub3QgaGF2ZSB0aGUgY2xpZW50 IGFkdmVydGlzZSBzdXBwb3J0IGZvciBoeWJyaWQta2V5LWV4Y2hhbmdlIChlLmcuIHZpYSBhIOKA nGZsYWfigJ0gZXh0ZW5zaW9uKSBhbmQgdGhlbiBLZXlTaGFyZVNlcnZlckhlbGxvIGNhbiBjb250 YWluIHR3byBLZXlTaGFyZUVudHJpZXMgKGVzc2VudGlhbGx5LCB1c2luZyB0aGUgc2FtZSBmb3Jt YXQgYXMgS2V5U2hhcmVDbGllbnRIZWxsbz8gVGhpcyB3b3VsZCBzb2x2ZSB0aGUgQ2FydGVzaWFu IHByb2R1Y3QgaXNzdWUuDQoNCkNoZWVycywNCg0KQW5kcmVpDQoNCkZyb206IFRMUyA8dGxzLWJv dW5jZXNAaWV0Zi5vcmc8bWFpbHRvOnRscy1ib3VuY2VzQGlldGYub3JnPj4gT24gQmVoYWxmIE9m IERhdmlkIEJlbmphbWluDQpTZW50OiBUdWVzZGF5LCBKdWx5IDMwLCAyMDE5IDExOjI0IEFNDQpU bzogV2F0c29uIExhZGQgPHdhdHNvbmJsYWRkQGdtYWlsLmNvbTxtYWlsdG86d2F0c29uYmxhZGRA Z21haWwuY29tPj4NCkNjOiBUTFMgTGlzdCA8dGxzQGlldGYub3JnPG1haWx0bzp0bHNAaWV0Zi5v cmc+Pg0KU3ViamVjdDogUmU6IFtUTFNdIE9wdGlvbnMgZm9yIG5lZ290aWF0aW5nIGh5YnJpZCBr ZXkgZXhjaGFuZ2VzIGZvciBwb3N0cXVhbnR1bQ0KDQpJIHRoaW5rIHRoaXMgdW5kZXJlc3RpbWF0 ZXMgdGhlIGNvbXBsZXhpdHkgY29zdCBvZiBvcHRpb24gMSB0byB0aGUgcHJvdG9jb2wgYW5kIGlt cGxlbWVudGF0aW9ucy4gT3B0aW9uIDEgbWVhbnMgZ3JvdXAgbmVnb3RpYXRpb24gaW5jbHVkZXMg ZW50aXJlIGNvZGVwb2ludHMgd2hvc2UgbWVhbmluZyBjYW5ub3QgYmUgZGV0ZXJtaW5lZCB3aXRo b3V0IGEgcGFyYWxsZWwgZXh0ZW5zaW9uLiBUaGlzIGNvbXBvdW5kcyBhY3Jvc3MgZXZlcnl0aGlu ZyB3aGljaCBpbnRlcmFjdHMgd2l0aCBuYW1lZCBncm91cHMsIGltcGFjdGluZyBldmVyeXRoaW5n IGZyb20gQVBJcyB0byBjb25maWcgZmlsZSBmb3JtYXRzIHRvIGV2ZW4gVUkgc3VyZmFjZXMuIE90 aGVyIHVzZXMgb2YgTmFtZWRHcm91cHMgYXJlIGltcGFjdGVkIHRvby4gRm9yIGluc3RhbmNlLCBv cHRpb24gMiBmaXRzIGludG8gZHJhZnQtaWV0Zi10bHMtZXNuaSBhcy1pcy4gT3B0aW9uIDEgcmVx dWlyZXMgaW5qZWN0aW5nIGh5YnJpZF9leHRlbnNpb24gaW50byBFU05JIHNvbWVob3cuIEFuYWx5 c2lzIG11c3QgZnVydGhlciBjaGVjayBldmVyeSB1c2UsIHNheSwgaW5jb3Jwb3JhdGVzIHRoaXMg cGFyYWxsZWwgbG9va3VwIHRhYmxlIGludG8gdHJhbnNjcmlwdC1saWtlIG1lYXN1cmVzLg0KDQpU aGUgbGVzc29uIGZyb20gVExTIDEuMiBjb2RlIHBvaW50cyBpcyBub3QgY29tYmluZWQgY29kZXBv aW50cyB2cy4gc3BsaXQgb25lcy4gUmF0aGVyLCB0aGUgbGVzc29uIGlzIHRvIGF2b2lkIGludGVy ZGVwZW5kZW50IGRlY2lzaW9uczoNCg0KKiBTaWduYXR1cmUgYWxnb3JpdGhtcyBpbiBUTFMgMS4y IHdlcmUgYSBtZXNzIGJlY2F1c2UgdGhlIEVDRFNBIGNvZGVwb2ludHMgcmVxdWlyZWQgY3Jvc3Mt cmVmZXJlbmNpbmcgYWdhaW5zdCB0aGUgc3VwcG9ydGVkIGN1cnZlcyBsaXN0LiBUaGUgdmVyaWZp ZXIgY291bGQgbm90IGV4cHJlc3Mgc29tZSBwcmVmZXJlbmNlcyAoc2lnbmluZyBTSEEtNTEyIHdp dGggUC0yNTYgaXMgc2lsbHksIGFuZCBtaXhpbmcgaGFzaCtjdXJ2ZSBwYWlycyBpbiBFQ0RTQSBp cyBzbGlnaHRseSBvZmYgaW4gZ2VuZXJhbCkuIEFzIGFuYWxvZ3kgdG8gb3B0aW9uIDEncyBFU05J IHByb2JsZW0sIHdlIGV2ZW4gZm9yZ290IHRvIGFsbG93IHRoZSBzZXJ2ZXIgdG8gZXhwcmVzcyBj dXJ2ZSBwcmVmZXJlbmNlcy4gVExTIDEuMyBjb21iaW5lZCBzaWduYXR1cmUgYWxnb3JpdGhtIGNv bnNpZGVyYXRpb25zIGludG8gYSBzaW5nbGUgY29kZXBvaW50IHRvIGFkZHJlc3MgYWxsIHRoaXMu DQoNCiogQ2lwaGVyIHN1aXRlcyBpbiBUTFMgMS4yIHdlcmUgYSBtZXNzIGJlY2F1c2UgdGhleSB3 ZXJlIGhhbGYtY29tYmluZWQgYW5kIGhhbGYtc3BsaXQuIFRMU19FQ0RIRV9FQ0RTQV9XSVRIX0FF U18xMjhfR0NNX1NIQTI1NiBzYWlkIHRvIHVzZSBzb21lIEVDREhFIGtleSBleGNoYW5nZSwgYnV0 IHlvdSBuZWVkIHRvIGNoZWNrIGlmIHlvdSBoYXZlIGEgTmFtZWRHcm91cCBpbiBjb21tb24gZmly c3QuIEl0IHNhaWQgdG8gdXNlIEVDRFNBLCBidXQgeW91IG5lZWQgdG8gY2hlY2sgc2lnbmF0dXJl IGFsZ29yaXRobXMgKHdoaWNoIHRoZW1zZWx2ZXMgY3Jvc3MtcmVmZXJlbmNlIGN1cnZlcykgZmly c3QuIEVhcmx5IGRyYWZ0cyBvZiBUTFMgMS4zIGhhZCBpdCBldmVuIHdvcnNlLCB3aGVyZSBhIFRM U19FQ0RIRV9FQ0RTQV9XSVRIX0FFU18xMjhfR0NNX1NIQTI1NiBmdWxsIGhhbmRzaGFrZSBtb3Jw aGVkIGludG8gVExTX0VDREhFX1BTS19XSVRIX0FFU18xMjhfR0NNX1NIQTI1NiBvbiByZXN1bXB0 aW9uLiBUaHVzLCBUTFMgMS4zIGNpcGhlciBzdWl0ZXMgbmVnb3RpYXRlIHNvbGVseSBBRUFEICsg UFJGIGhhc2guDQoNCkluIGZhaXJuZXNzIHRvIFRMUyAxLjIsIHNvbWUgb2YgdGhpcyB3YXMgYSBj b25zZXF1ZW5jZSBvZiBUTFMgMS4yJ3MgZXZvbHV0aW9uIG92ZXIgdGltZSBhcyBpbmNyZW1lbnRh bCBleHRlbnNpb25zIG92ZXIgU1NMIDMuMC4gQW5kIHNvbWV0aW1lcyB3ZSBkbyBuZWVkIHRvIHBh eSBjb3N0cyBsaWtlIHRoZXNlLiBCdXQgaHlicmlkIGtleSBleGNoYW5nZXMgZml0IGludG8gdGhl IE5hbWVkR3JvdXAgIkFQSSIganVzdCBmaW5lLCBzbyBvcHRpb24gMiBpcyB0aGUgY2xlYXIgYW5z d2VyLiBDb2RlIHBvaW50cyBhcmUgY2hlYXAuIFByb3RvY29sIGNvbXBsZXhpdHkgaXMgbXVjaCBt b3JlIGV4cGVuc2l2ZS4NCg0KSXQncyB0cnVlIHRoYXQgc3RhbmRhcmRzIGFyZSBvZnRlbiB1bmRl cnNwZWNpZmllZC4gVGhpcyBtZWFucyB0aGUgSUVURiBzaG91bGQgZmluaXNoIHRoZSBqb2IsIG5v dCBwYXNzIGFsbCB2YXJpYXRpb25zIHRocm91Z2guIFJTQS1QU1MgaXMgYSBjbGVhciBleGFtcGxl IG9mIHdoYXQgdG8gYXZvaWQuIEl0IHRha2VzIG1vcmUgYnl0ZXMgdG8gbWVyZWx5IHV0dGVyICJS U0EtUFNTIHdpdGggU0hBLTI1NiBhbmQgdXN1YWwgcGFyYW1ldGVycyIgaW4gWC41MDkgdGhhbiB0 byBlbmNvZGUgYW4gZW50aXJlIEVDRFNBIHNpZ25hdHVyZSEgV2Ugc2hvdWxkIG5vdCBkZWZpbmUg bW9yZSB0aGFuIGEgaGFuZGZ1bCBvZiBvcHRpb25zLCByZWdhcmRsZXNzIG9mIHRoZSBlbmNvZGlu Zy4uDQoNCk9uIFR1ZSwgSnVsIDMwLCAyMDE5IGF0IDEyOjE4IFBNIFdhdHNvbiBMYWRkIDx3YXRz b25ibGFkZEBnbWFpbC5jb208bWFpbHRvOndhdHNvbmJsYWRkQGdtYWlsLmNvbT4+IHdyb3RlOg0K DQpPbiBUdWUsIEp1bCAzMCwgMjAxOSwgODoyMSBBTSBTY290dCBGbHVocmVyIChzZmx1aHJlcikg PHNmbHVocmVyQGNpc2NvLmNvbTxtYWlsdG86c2ZsdWhyZXJAY2lzY28uY29tPj4gd3JvdGU6DQpE dXJpbmcgdGhlIHBoeXNpY2FsIG1lZXRpbmcgaW4gTW9udHJlYWwsIHdlIGhhZCBhIGRpc2N1c3Np b24gYWJvdXQgcG9zdHF1YW50dW0gc2VjdXJpdHksIGFuZCBpbiBwYXJ0aWN1bGFyLCBvbiBob3cg b25lIG1pZ2h0IHdhbnQgdG8gbmVnb3RpYXRlIHNldmVyYWwgZGlmZmVyZW50IOKAmGdyb3Vwc+KA mSBzaW11bHRhbmVvdXNseSAoYmVjYXVzZSB0aGVyZSBtaWdodCBub3QgYmUgb25lIGdyb3VwIHRo YXQgaXMgZW50aXJlbHkgdHJ1c3RlZCwgYW5kIEkgcHV0IOKAmGdyb3Vwc+KAmSBpbiBzY2FyZXF1 b3RlcyBiZWNhdXNlIHBvc3RxdWFudHVtIGtleSBleGNoYW5nZXMgYXJlIHR5cGljYWxseSBub3Qg Zm9ybWVkIGZyb20gYSBEaWZmaWUtSGVsbG1hbiBncm91cCkuDQoNCkF0IHRoZSBtZWV0aW5nLCB0 aGVyZSB3ZXJlIHR3byBvcHRpb25zIHByZXNlbnRlZDoNCg0KT3B0aW9uIDE6IGFzIHRoZSBzdXBw b3J0ZWQgZ3JvdXAsIHdlIGluc2VydCBhIOKAmGh5YnJpZCBtYXJrZXLigJkgKGFuZCBpbmNsdWRl IGFuIGV4dGVuc2lvbiB0aGF0IG1hcCBsaXN0cyB3aGljaCBjb21iaW5hdGlvbiB0aGUgaHlicmlk IG1hcmtlciBzdGFuZHMgZm9yKQ0KICAgICAgICAgICAgICAgIEZvciBleGFtcGxlLCB0aGUgY2xp ZW50IG1pZ2h0IGxpc3QgaW4gaGlzIHN1cHBvcnRlZCBncm91cHMgaHlicmlkX21hcmtlcl8wIGFu ZCBoeWJyaWRfbWFya2VyXzEsIGFuZCB0aGVyZSB3b3VsZCBiZSBhIHNlcGFyYXRlIGV4dGVuc2lv biB0aGF0IGxpc3RzIGh5YnJpZF9tYXJrZXJfMCA9IFgyNTUxOSArIFNJS0VwNDM0IGFuZCBoeWJy aWRfbWFya2VyXzEgPSBYMjU1MTkgKyBOVFJVUFI2NTMuICBUaGUgc2VydmVyIHdvdWxkIHRoZW4g bG9vayB1cCB0aGUgbWVhbmluZ3Mgb2YgaHlicmlkX21hcmtlcl8wIGFuZCAxIGluIHRoZSBleHRl bnNpb24sIGFuZCB0aGVuIGNvbXBhcmUgdGhhdCBhZ2FpbnN0IGhpcyBzZWN1cml0eSBwb2xpY3ku DQpJbiB0aGlzIG9wdGlvbiwgd2Ugd291bGQgYXNrIElBTkEgdG8gYWxsb2NhdGUgY29kZSBwb2lu dHMgZm9yIHRoZSB2YXJpb3VzIGluZGl2aWR1YWwgcG9zdHF1YW50dW0ga2V5IGV4Y2hhbmdlcyAo aW4gdGhpcyBleGFtcGxlLCBTSUtFcDQzNCBhbmQgTlRSVVBSNjUzKSwgYXMgd2VsbCBhIHJhbmdl IG9mIGNvZGUgcG9pbnRzIGZvciB0aGUgdmFyaW91cyBoeWJyaWRfbWFya2Vycy4NCg0KT3B0aW9u IDI6IHdlIGhhdmUgY29kZSBwb2ludHMgZm9yIGFsbCB0aGUgdmFyaW91cyBjb21iaW5hdGlvbnMg dGhhdCB3ZSBtYXkgd2FudCB0byBzdXBwb3J0OyBoZW5jZSBJQU5BIG1pZ2h0IGFsbG9jYXRlIGEg Y29kZSBwb2ludCBYMjU1MTlfU0lLRXA0MzQgYW5kIGFub3RoZXIgY29kZSBwb2ludCBmb3IgWDI1 NTE5X05UUlVQUjY1My4gIFdpdGggdGhpcyBvcHRpb24sIHRoZSBjbGllbnQgd291bGQgbGlzdCBY MjU1MTlfU0lLRXA0MzQgYW5kIFgyNTUxOV9OVFJVUFI2NTMgaW4gdGhlaXIgc3VwcG9ydGVkIGdy b3Vwcy4NCiAgICAgICAgICAgICAgICBJbiB0aGlzIG9wdGlvbiwgd2Ugd291bGQgYXNrIElBTkEg dG8gYWxsb2NhdGUgY29kZSBwb2ludHMgZm9yIGFsbCB0aGUgdmFyaW91cyBjb21iaW5hdGlvbnMg dGhhdCB3ZSB3YW50IGFsbG93IHRvIGJlIG5lZ290aWF0ZWQuDQoNCkkgd291bGQgbGlrZSB0byBt YWtlIGFuIGFyZ3VtZW50IGluIGZhdm9yIG9mIG9wdGlvbiAxOg0KDQoNCiAgKiAgIEl0IGlzIGxp a2VseSB0aGF0IG5vdCBldmVyeW9uZSB3aWxsIGJlIHNhdGlzaWZpZWQgd2l0aCDigJxYMjU1MTkg cGx1cyBvbmUgb2YgYSBoYW5kZnVsIG9mIHNwZWNpZmljIHBvc3RxdWFudHVtIGFsZ29yaXRobXPi gJ07IHNvbWUgbWF5IHByZWZlciBhbm90aGVyIGVsbGlwdGljIGN1cnZlIChmb3IgZXhhbXBsZSwg eDQ0OCksIG9yIHBlcmhhcHMgZXZlbiBhIE1PRFAgZ3JvdXA7IEkgaGF2ZSB0YWxrZWQgdG8gcGVv cGxlIHdobyBkbyBub3QgdHJ1c3QgRUNDKTsgaW4gYWRkaXRpb24sIG90aGVyIHBlb3BsZSBtaWdo dCBub3QgdHJ1c3QgYSBzaW5nbGUgcG9zdHF1YW50dW0gYWxnb3JpdGhtLCBhbmQgbWF5IHdhbnQg dG8gcmVseSBvbiBib3RoIChmb3IgZXhhbXBsZSkgU0lLRSBhbmQgTmV3SG9wZSAod2hpY2ggYXJl IGJhc2VkIG9uIHZlcnkgZGlmZmVyZW50IGhhcmQgcHJvYmxlbXMpLiAgV2l0aCBvcHRpb24gMiwg d2UgY291bGQgdHJ5IHRvIGFudGljaXBhdGUgYWxsIHRoZSBjb21tb24gY29tYmludGF0aW9ucyAo c3VjaCBhcyBQMzg0X1NJS0VwNDM0X05FV0hPUEU1MTJDQ0EpLCBob3dldmVyIHRoYXQgY291bGQg dmVyeSB3ZWxsIGVuZCB1cCBhcyBhIGxvdCBvZiBjb21iaW5hdGlvbnMuDQogICogICBUaGVyZSBh cmUgbGlrZWx5IHRvIGJlIHNldmVyYWwgTklTVC1hcHByb3ZlZCBwb3N0cXVhbnR1bSBrZXkgZXhj aGFuZ2VzLCBhbmQgZWFjaCBvZiB0aG9zZSBrZXkgZXhjaGFuZ2VzIGFyZSBsaWtlbHkgdG8gaGF2 ZSBhIG51bWJlciBvZiBzdXBwb3J0ZWQgcGFyYW1ldGVyIHNldHMgKGlmIHdlIHRha2UgdGhlIHNw ZWNpZmljIHBvc3RxdWFudHVtIGtleSBleGNoYW5nZSBhcyBhbmFsb2dvdXMgdG8gdGggRUNESCBw cm90b2Nvb2wsIHRoZSDigJxwYXJhbWV0ZXIgc2V04oCdIGNvdWxkIGJlIHRob3VnaHQgb2YgYW4g YW5hbG9nb3VzIHRvIHRoZSBzcGVjaWZpYyBlbGxpcHR1YyBjdXJ2ZSwgYW5kIGl0IG1vZGlmaWVz IHRoZSBrZXkgc2hhcmUgc2l6ZSwgdGhlIHBlcmZvcm1hbmNlIGFuZCBzb21ldGltZXMgdGhlIHNl Y3VyaXR5IHByb3BlcnRpZXMpLiAgSW4gZmFjdCwgb25lIG9mIHRoZSBOSVNUIHN1Ym1pc3NvaW5z IGN1cnJlbnRseSBoYXMgMzAgcGFyYW1ldGVyIHNldHMgZGVmaW5lZC4gIEhlbmNlLCBldmVuIGlm IE5JU1QgZG9lc27igJl0IGFwcHJvdmUgYWxsIHRoZSBwYXJhbWV0ZXIgc2V0cyAob3Igc29tZSBv ZiB0aGVtIGRvIG5vdCBtYWtlIHNlbnNlIGZvciBUTFMgaW4gYW55IHNjZW5hcmlvKSwgd2UgbWln aHQgZW5kIHVwIHdpdGggMjAgb3IgbW9yZSBkaWZmZXJlbnQga2V5IGV4Y2hhbmdlL3BhcmFtZXRl ciBzZXQgY29tYmluYXRpb25zIHRoYXQgZG8gbWFrZSBzZW5zZSBmb3Igc29tZSBzY2VuYXJpbyB0 aGF0IHVzZXMgdExTIChiZSBpdCBpbiBhIHRyYW5kaXRpb25hbCBQQyBjbGllbnQvc2VydmVyLCBh IHdpcmVsZXNzIGNsaWVudCwgdHdvIGNsb3VkIGRldmljZXMgY29tbXVuaWNhdGluZyBvciBhbiBJ T1QgZGV2aWNlKS4NCiAgKiAgIEluIGFkZGl0aW9uLCB3ZSBhcmUgbGlrZWx5IHRvIHN1cHBvcnQg YWRkaXRpb25hbCBwcmltaXRpdmVzIGluIHRoZSBmdXR1cmU7IHBvc3NpYmx5IE5hdGlvbmFsIGN1 cnZlcyAoZS5nLiBCcmFpbnBvb2wpLCBvciBhZGRpdGlvbmFsIFBvc3RxdWFudHVtIGFsZ29yaXRo bXMgKG9yIGFkZGl0aW9uYWwgcGFyYW1ldGVyIHNldHMgdG8gZXhpc3Rpbmcgb25lcykuICBPZiBj b3Vyc2UsIG9uY2Ugd2UgYWRkIHRoYXQgY29kZSBwb2ludCwgd2XigJlsbCBuZWVkIHRvIGFkZCB0 aGUgYWRkaXRpb25hbCBjb2RlIHBvaW50cyBmb3IgYWxsIHRoZSBjb21iaW5hdGlvbnMgdGhhdCBp dOKAmWxsIG1ha2Ugc2Vuc2UgaW4gKHZlcnkgbXVjaCBsaWtlIHdlIGhhZCB0byBhZGQgYSBudW1i ZXIgb2YgY2lwaGVyc3VpdGVzIHdoZW5ldmVyIHdlIGFkZGVkIGEgbmV3IGVuY3J5cHRpb24gYWxn b3JpdGhtIGludG8gVExTIDEuMikuDQoNCg0KQXJlIHBlb3BsZSBhY3R1YWxseSBnb2luZyB0byB1 c2UgaHlicmlkIGVuY3J5cHRpb24gcG9zdCBOSVNUPyBUaGUgYWN0dWFsIGRlcGxveW1lbnRzIHRv ZGF5ICBmb3IgZXhwZXJpbWVudCBoYXZlIGFsbCBmaXQgb3B0aW9uIDIgYW5kIGh5YnJpZHMgYXJl IHVubGlrZWx5IGluIHRoZSBmdXR1cmUuDQoNCk15IG9iamVjdGlvbiB0byAxIGlzIGl0IGdldHMg dmVyeSBtZXNzeS4gRG8gd2UgdXNlIG9ubHkgdGhlIGh5YnJpZHMgd2UgYm90aCBzdXBwb3J0PyBX aGF0IGlmIEkgdGhyb3cgYSBidW5jaCBvZiBleHBlbnNpdmUgdGhpbmdzIHRvZ2V0aGVyPyBObyBy ZWFzb24gd2UgbmVlZCBhIGh5YnJpZCBzY2hlbWUhDQoNCkl0IHNlZW1kcyByZWFzb25hYmxlIHRv IG1lIHRoYXQgdGhlIGNvbWJpbmF0aW9uIG9mIHRoZXNlIHR3byBmYWN0b3JzIGFyZSBsaWtlbHkg dG8gY2F1c2UgdXMgKHNob3VsZCB3ZSBzZWxlY3Qgb3B0aW9uIDIpIHRvIGRlZmluZSBhIHZlcnkg bGFyZ2UgbnVtYmVyIG9mIGNvZGUgcG9pbnRzIHRvIGNvdmVyIGFsbCB0aGUgdmFyaW91cyBvcHRp b25zIHRoYXQgcGVvcGxlIG5lZWQuDQoNCk5vdywgdGhpcyBpcyBiYXNlZCBvbiBzcGVjdWxhdGlv biAoYm90aCBvZiB0aGUgTklTVCBwcm9jZXNzLCBhbmQgYWRkaXRpb25hbCBwcmltaXRpdmVzIHRo YXQgd2lsbCBiZSBhZGRlZCB0byB0aGUgcHJvdG9jb2wpLCBhbmQgb25lIG9iamVjdGlvbiBJ4oCZ dmUgaGVhcmQgaXMg4oCcd2UgZG9u4oCZdCBrbm93IHdoYXTigJlzIGdvaW5nIHRvIGhhcHBlbiwg YW5kIHNvIHdoeSB3b3VsZCB3ZSBtYWtlIGRlY2lzaW9ucyBiYXNlZCBvbiB0aGlzIHNwZWN1bGF0 aW9uP+KAnSAgSSBhZ3JlZSB0aGF0IHdlIGhhdmUgbGFjayBvZiBrbm93bGVkZ2U7IGhvd2V2ZXIg aXQgc2VlbXMgdG8gbWUgdGhhdCBhIGxhY2sgb2Yga25vd2xlZGdlIGlzIGFuIGFyZ3VtZW50IGlu IGZhdm9yIG9mIHNlbGVjdGluZyB0aGUgbW9yZSBmbGV4aWJsZSBvcHRpb24gKHdoaWNoLCBpbiBt eSBvcGluaW9uLCBpcyBvcHRpb24gMSwgYXMgaXQgYWxsb3dzIHRoZSBuZWdvdGlhdGlvbiBvZiBj b21iaW5hdGlvbnMgb2Yga2V5IGV4Y2hhbmdlcyB0aGF0IHRoZSBXRyBoYXMgbm90IGFudGljaXBh dGVkKS4NCg0KTXkgcGxlYTogbGV0cyBub3QgcmVwZWF0IHRoZSBUTFMgMS4yIGNpcGhlcnN1aXRl IG1lc3M7IGxldHMgYWRkIGFuIGV4dGVuc2lvbiB0aGF0IGtlZXBzIHRoZSBudW1iZXIgb2YgY29k ZSBwb2ludHMgd2UgbmVlZCB0byBhIHJlYXNvbmFibGUgYm91bmQuDQoNClRoZSBjb3N0cyBvZiBv cHRpb24gMT8NCg0KICAqICAgSXQgZG9lcyBpbmNyZWFzZSB0aGUgY29tcGxleGl0eSBvbiB0aGUg c2VydmVyIGEgc21hbGwgYW1vdW50IChJ4oCZbSBub3QgYSBUTFMgaW1wbGVtZW50b3IsIGhvd2V2 ZXIgaXQgd291bGQgc2VlbSB0byBtZSB0byBiZSBvbmx5IGEgZmFpcmx5IHNtYWxsIGFtb3VudCkN CiAgKiAgIEl0IG1heSBpbmNyZWFzZSB0aGUgc2l6ZSBvZiB0aGUgY2xpZW50IGhlbGxvIGEgc21h bGwgYW1vdW50IChvbiB0aGUgb3RoZXIgaGFuZCwgYmVjYXVzZSBpdCBhbGxvd3MgdXMgdG8gYXZv aWQgc2VuZGluZyBkdXBsaWNhdGUga2V5IHNoYXJlcywgaXQgY2FuIGFsc28gcmVkdWNlIHRoZSBz aXplIG9mIHRoZSBjbGllbnQgaGVsbG8gYXMgd2VsbCwgZGVwZW5kaW5nIG9uIHdoYXTigJlzIGFj dHVhbGx5IG5lZ290aWF0ZWQpDQpJTUhPLCB0aGUgc21hbGwgaW5jcmVhc2UgaW4gY29tcGxleGl0 eSBpcyB3b3J0aCB0aGUgbGFjayBvZiBjb21wbGV4aXR5IGluIHRoZSBjb2RlIHBvaW50IHRhYmxl LCBhbmQgdGhlIGFkZGl0aW9uYWwgZmxleGliaWxpdHkgaXQgZ2l2ZXMuDQpfX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KVExTIG1haWxpbmcgbGlzdA0KVExT QGlldGYub3JnPG1haWx0bzpUTFNAaWV0Zi5vcmc+DQpodHRwczovL3d3dy5pZXRmLm9yZy9tYWls bWFuL2xpc3RpbmZvL3RsczxodHRwczovL25hbTA2LnNhZmVsaW5rcy5wcm90ZWN0aW9uLm91dGxv b2suY29tLz91cmw9aHR0cHMlM0ElMkYlMkZ3d3cuaWV0Zi5vcmclMkZtYWlsbWFuJTJGbGlzdGlu Zm8lMkZ0bHMmZGF0YT0wMiU3QzAxJTdDQW5kcmVpLlBvcG92JTQwbWljcm9zb2Z0LmNvbSU3QzM0 MWU0NzNiNmE0YjQ3NGEzYWJhMDhkNzE1MjY1MzI4JTdDNzJmOTg4YmY4NmYxNDFhZjkxYWIyZDdj ZDAxMWRiNDclN0MxJTdDMCU3QzYzNzAwMTEyNjY2MzYwODEyNyZzZGF0YT1qSmRCOWtXUGZBUlln NkI3aWlITlprM2N1M09lZzVtOWlJWUtacktlT3BBJTNEJnJlc2VydmVkPTA+DQpfX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KVExTIG1haWxpbmcgbGlzdA0K VExTQGlldGYub3JnPG1haWx0bzpUTFNAaWV0Zi5vcmc+DQpodHRwczovL3d3dy5pZXRmLm9yZy9t YWlsbWFuL2xpc3RpbmZvL3RsczxodHRwczovL25hbTA2LnNhZmVsaW5rcy5wcm90ZWN0aW9uLm91 dGxvb2suY29tLz91cmw9aHR0cHMlM0ElMkYlMkZ3d3cuaWV0Zi5vcmclMkZtYWlsbWFuJTJGbGlz dGluZm8lMkZ0bHMmZGF0YT0wMiU3QzAxJTdDQW5kcmVpLlBvcG92JTQwbWljcm9zb2Z0LmNvbSU3 QzM0MWU0NzNiNmE0YjQ3NGEzYWJhMDhkNzE1MjY1MzI4JTdDNzJmOTg4YmY4NmYxNDFhZjkxYWIy ZDdjZDAxMWRiNDclN0MxJTdDMCU3QzYzNzAwMTEyNjY2MzYxODEyNCZzZGF0YT1FcEk3TyUyQkt6 YndwT01yaHhEcTZWUG0wcnV5cTVLNHU3ZHc0ZnMlMkZTdW9TUSUzRCZyZXNlcnZlZD0wPg0K --_000_DM5PR2101MB09178A1D1192D045A1FF76F78CDC0DM5PR2101MB0917_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQph OmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xv cjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1z b0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpwdXJw bGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLm1zb25vcm1hbDAsIGxpLm1zb25v cm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCgltc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4tYm90 dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZv bnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnAuZ21haWwtbTE2NzM2OTQxNzU1NTc5 NTg3MTFtNTAxMjExMjg4NjcxMTIxMjg5MG1zb2xpc3RwYXJhZ3JhcGgsIGxpLmdtYWlsLW0xNjcz Njk0MTc1NTU3OTU4NzExbTUwMTIxMTI4ODY3MTEyMTI4OTBtc29saXN0cGFyYWdyYXBoLCBkaXYu Z21haWwtbTE2NzM2OTQxNzU1NTc5NTg3MTFtNTAxMjExMjg4NjcxMTIxMjg5MG1zb2xpc3RwYXJh Z3JhcGgNCgl7bXNvLXN0eWxlLW5hbWU6Z21haWwtbV8xNjczNjk0MTc1NTU3OTU4NzExbV81MDEy MTEyODg2NzExMjEyODkwbXNvbGlzdHBhcmFncmFwaDsNCgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0 bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0KCW1h cmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJp IixzYW5zLXNlcmlmO30NCnNwYW4uRW1haWxTdHlsZTE5DQoJe21zby1zdHlsZS10eXBlOnBlcnNv bmFsOw0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOndpbmRvd3Rl eHQ7fQ0Kc3Bhbi5FbWFpbFN0eWxlMjANCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWw7DQoJZm9u dC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6d2luZG93dGV4dDt9DQpzcGFu LkVtYWlsU3R5bGUyMg0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1yZXBseTsNCglmb250LWZh bWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjp3aW5kb3d0ZXh0O30NCi5Nc29DaHBE ZWZhdWx0DQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7 fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBp biAxLjBpbiAxLjBpbiAxLjBpbjt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rp b24xO30NCi8qIExpc3QgRGVmaW5pdGlvbnMgKi8NCkBsaXN0IGwwDQoJe21zby1saXN0LWlkOjI1 NjUxOTg3MjsNCgltc28tbGlzdC10ZW1wbGF0ZS1pZHM6MTY2MjA1MjM0ODt9DQpAbGlzdCBsMDps ZXZlbDENCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0 Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6LjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0 aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4w cHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwwOmxldmVsMg0KCXttc28tbGV2ZWwt bnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10 YWItc3RvcDoxLjBpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1p bmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6 U3ltYm9sO30NCkBsaXN0IGwwOmxldmVsMw0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxs ZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDoxLjVpbjsNCglt c28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1z by1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGww OmxldmVsNA0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRl eHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDoyLjBpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBv c2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZTox MC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwwOmxldmVsNQ0KCXttc28tbGV2 ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZl bC10YWItc3RvcDoyLjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4 dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1p bHk6U3ltYm9sO30NCkBsaXN0IGwwOmxldmVsNg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpi dWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDozLjBpbjsN Cgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0K CW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0 IGwwOmxldmVsNw0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVs LXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDozLjVpbjsNCgltc28tbGV2ZWwtbnVtYmVy LXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6 ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwwOmxldmVsOA0KCXttc28t bGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1s ZXZlbC10YWItc3RvcDo0LjBpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJ dGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1m YW1pbHk6U3ltYm9sO30NCkBsaXN0IGwwOmxldmVsOQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1h dDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDo0LjVp bjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWlu Ow0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBs aXN0IGwxDQoJe21zby1saXN0LWlkOjcyNjIyODAzMzsNCgltc28tbGlzdC10ZW1wbGF0ZS1pZHM6 LTEyNzM3NjE5Njt9DQpAbGlzdCBsMTpsZXZlbDENCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6 YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6LjVpbjsN Cgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0K CW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0 IGwxOmxldmVsMg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVs LXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDoxLjBpbjsNCgltc28tbGV2ZWwtbnVtYmVy LXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6 ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwxOmxldmVsMw0KCXttc28t bGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1s ZXZlbC10YWItc3RvcDoxLjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJ dGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1m YW1pbHk6U3ltYm9sO30NCkBsaXN0IGwxOmxldmVsNA0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1h dDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDoyLjBp bjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWlu Ow0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBs aXN0IGwxOmxldmVsNQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxl dmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDoyLjVpbjsNCgltc28tbGV2ZWwtbnVt YmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQt c2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwxOmxldmVsNg0KCXtt c28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1z by1sZXZlbC10YWItc3RvcDozLjBpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7 DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9u dC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwxOmxldmVsNw0KCXttc28tbGV2ZWwtbnVtYmVyLWZv cm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDoz LjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4y NWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30N CkBsaXN0IGwxOmxldmVsOA0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNv LWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDo0LjBpbjsNCgltc28tbGV2ZWwt bnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZv bnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwxOmxldmVsOQ0K CXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0K CW1zby1sZXZlbC10YWItc3RvcDo0LjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxl ZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJ Zm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwyDQoJe21zby1saXN0LWlkOjc5OTM3NDk2MTsN Cgltc28tbGlzdC10ZW1wbGF0ZS1pZHM6MjI4Mzc3MTg7fQ0KQGxpc3QgbDI6bGV2ZWwxDQoJe21z by1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNv LWxldmVsLXRhYi1zdG9wOi41aW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0K CXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQt ZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMjpsZXZlbDINCgl7bXNvLWxldmVsLW51bWJlci1mb3Jt YXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6MS4w aW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVp bjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpA bGlzdCBsMjpsZXZlbDMNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1s ZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6MS41aW47DQoJbXNvLWxldmVsLW51 bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250 LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMjpsZXZlbDQNCgl7 bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCglt c28tbGV2ZWwtdGFiLXN0b3A6Mi4waW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0 Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZv bnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMjpsZXZlbDUNCgl7bXNvLWxldmVsLW51bWJlci1m b3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6 Mi41aW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0u MjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9 DQpAbGlzdCBsMjpsZXZlbDYNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1z by1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6My4waW47DQoJbXNvLWxldmVs LW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1m b250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMjpsZXZlbDcN Cgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsN Cgltc28tbGV2ZWwtdGFiLXN0b3A6My41aW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjps ZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0K CWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMjpsZXZlbDgNCgl7bXNvLWxldmVsLW51bWJl ci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0 b3A6NC4waW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50 Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OlN5bWJv bDt9DQpAbGlzdCBsMjpsZXZlbDkNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0K CW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6NC41aW47DQoJbXNvLWxl dmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5z aS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMw0KCXtt c28tbGlzdC1pZDoxNjM5NjQ5OTI3Ow0KCW1zby1saXN0LXRlbXBsYXRlLWlkczotMjUwNzI5NzY0 O30NCkBsaXN0IGwzOmxldmVsMQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJ bXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDouNWluOw0KCW1zby1sZXZl bC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2kt Zm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDM6bGV2ZWwy DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7 DQoJbXNvLWxldmVsLXRhYi1zdG9wOjEuMGluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246 bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsN Cglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDM6bGV2ZWwzDQoJe21zby1sZXZlbC1udW1i ZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1z dG9wOjEuNWluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVu dDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpTeW1i b2w7fQ0KQGxpc3QgbDM6bGV2ZWw0DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsN Cgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjIuMGluOw0KCW1zby1s ZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFu c2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDM6bGV2 ZWw1DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrv grc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjIuNWluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRp b246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBw dDsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDM6bGV2ZWw2DQoJe21zby1sZXZlbC1u dW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRh Yi1zdG9wOjMuMGluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWlu ZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpT eW1ib2w7fQ0KQGxpc3QgbDM6bGV2ZWw3DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxl dDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjMuNWluOw0KCW1z by1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNv LWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDM6 bGV2ZWw4DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4 dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjQuMGluOw0KCW1zby1sZXZlbC1udW1iZXItcG9z aXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEw LjBwdDsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDM6bGV2ZWw5DQoJe21zby1sZXZl bC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVs LXRhYi1zdG9wOjQuNWluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0 LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWls eTpTeW1ib2w7fQ0Kb2wNCgl7bWFyZ2luLWJvdHRvbTowaW47fQ0KdWwNCgl7bWFyZ2luLWJvdHRv bTowaW47fQ0KLS0+PC9zdHlsZT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlZGVm YXVsdHMgdjpleHQ9ImVkaXQiIHNwaWRtYXg9IjEwMjYiIC8+DQo8L3htbD48IVtlbmRpZl0tLT48 IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlbGF5b3V0IHY6ZXh0PSJlZGl0Ij4NCjxv OmlkbWFwIHY6ZXh0PSJlZGl0IiBkYXRhPSIxIiAvPg0KPC9vOnNoYXBlbGF5b3V0PjwveG1sPjwh W2VuZGlmXS0tPg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0iRU4tVVMiIGxpbms9ImJsdWUiIHZsaW5r PSJwdXJwbGUiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPiZndDsgSXQgaXMgbm90IGNsZWFyIGlmIHRoZSBwcm9wb3NhbCB5b3Ugb3V0bGluZWQgc2hh cmUgdGhpcyBwcm9wZXJ0eTsgZG8geW91IGR1cGxpY2F0ZSBhIHBheWxvYWQgdGhhdCBhbiB1bmVu aGFuY2VkIHNlcnZlciB3b3VsZCBhc3N1bWUgb25seSBvY2N1cnMgb25jZT88bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkkgdGhpbmsgdGhpcyBwcm9wZXJ0eSBpcyBwcmVzZXJ2 ZWQ6IG9ubHkgYSBzZXJ2ZXIgdGhhdCBrbm93cyB0aGUgaHlicmlkLWtleS1leGNoYW5nZSBleHRl bnNpb24gKG9yIHBlcmhhcHMsIGEgbW9yZSBzcGVjaWZpYyBvbmUtdHJhZGl0aW9uYWwtYW5kLW9u ZS1QUSBleHRlbnNpb24pIHdpbGwgc2VuZCBLZXlTaGFyZVNlcnZlckhlbGxvIHdpdGggdHdvIEtl eVNoYXJlRW50cmllcy48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkFuIOKA nHVuZW5oYW5jZWTigJ0gc2VydmVyIHdpbGwgc2VuZCBvbmx5IG9uZSBLZXlTaGFyZUVudHJ5LiBX ZeKAmWQgbmVlZCB0byB0aGluayBhYm91dCBob3cgdGhlIOKAnGVuaGFuY2Vk4oCdIGNsaWVudCBj YW4gZGlzdGluZ3Vpc2ggdGhlIHR3byBLZXlTaGFyZVNlcnZlckhlbGxvIGZvcm1hdHMsIGJ1dCB0 aGVyZSBhcmUgZWFzeSBzb2x1dGlvbnMgdG8gdGhpcywgSSB0aGluay48bzpwPjwvbzpwPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXYg c3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0UxRTFFMSAxLjBwdDtwYWRkaW5n OjMuMHB0IDBpbiAwaW4gMGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPkZyb206PC9iPiBT Y290dCBGbHVocmVyIChzZmx1aHJlcikgJmx0O3NmbHVocmVyQGNpc2NvLmNvbSZndDsgPGJyPg0K PGI+U2VudDo8L2I+IFR1ZXNkYXksIEp1bHkgMzAsIDIwMTkgMTI6NDQgUE08YnI+DQo8Yj5Ubzo8 L2I+IEFuZHJlaSBQb3BvdiAmbHQ7QW5kcmVpLlBvcG92QG1pY3Jvc29mdC5jb20mZ3Q7OyBEYXZp ZCBCZW5qYW1pbiAmbHQ7ZGF2aWRiZW5AY2hyb21pdW0ub3JnJmd0OzsgV2F0c29uIExhZGQgJmx0 O3dhdHNvbmJsYWRkQGdtYWlsLmNvbSZndDs8YnI+DQo8Yj5DYzo8L2I+IFRMUyBMaXN0ICZsdDt0 bHNAaWV0Zi5vcmcmZ3Q7PGJyPg0KPGI+U3ViamVjdDo8L2I+IFJFOiBbVExTXSBPcHRpb25zIGZv ciBuZWdvdGlhdGluZyBoeWJyaWQga2V5IGV4Y2hhbmdlcyBmb3IgcG9zdHF1YW50dW08bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNw OzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkkgYmVsaWV2ZSB0aGF0IG9uZSBpbXBv cnRhbnQgcHJvcGVydHkgKG9mIGVpdGhlciBvZiB0aGUgb3B0aW9ucyBJIGxpc3RlZCkgaXMgYSBu aWNlIGZhbGxiYWNrIGlmIGFuIGVuaGFuY2VkIGNsaWVudCB0YWxrcyB0byBhbiBvbGRlciBzZXJ2 ZXIuJm5ic3A7IEluIGJvdGggY2FzZXMsIHRoZSBzZXJ2ZXIgd2lsbCBzZWUgYSBzZXJpZXMgb2Yg bmFtZWQgZ3JvdXBzIHRoYXQgaXQgZG9lc27igJl0IGtub3cgKHdoaWNoIGl0IHdpbGwNCiBpZ25v cmUpLCBhbmQgcG9zc2liaWxpdHkgYW4gZXh0ZW5zaW9uIGl0IGRvZXNu4oCZdCBrbm93ICh3aGlj aCBpdCB3aWxsIGlnbm9yZSk7IHRoZSBzZXJ2ZXIgd2lsbCBhY2NlcHQgZWl0aGVyIGEgbmFtZWQg Z3JvdXAgdGhhdCBpdCBkb2VzIHVuZGVyc3RhbmQgKGlmIHRoZSBjbGllbnQgZGlkIHByb3Bvc2Ug YSB0cmFkaXRpb25hbCBncm91cCBhcyBhIGZhbGwgYmFjayksIG9yIGl0IHdpbGwgY29tZSB0byB0 aGUgY29ycmVjdCBjb25jbHVzaW9uIHRoYXQNCiB0aGUgdHdvIHNpZGVzIGhhdmUgbm8gbXV0dWFs bHkgYWNjZXB0YWJsZSBzZWN1cml0eSBwb2xpY3kuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkl0 IGlzIG5vdCBjbGVhciBpZiB0aGUgcHJvcG9zYWwgeW91IG91dGxpbmVkIHNoYXJlIHRoaXMgcHJv cGVydHk7IGRvIHlvdSBkdXBsaWNhdGUgYSBwYXlsb2FkIHRoYXQgYW4gdW5lbmhhbmNlZCBzZXJ2 ZXIgd291bGQgYXNzdW1lIG9ubHkgb2NjdXJzIG9uY2U/PG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXYgc3R5bGU9ImJvcmRlcjpu b25lO2JvcmRlci1sZWZ0OnNvbGlkIGJsdWUgMS41cHQ7cGFkZGluZzowaW4gMGluIDBpbiA0LjBw dCI+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjRTFF MUUxIDEuMHB0O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PGI+RnJvbTo8L2I+IFRMUyAmbHQ7PGEgaHJlZj0ibWFpbHRvOnRscy1ib3VuY2VzQGlldGYu b3JnIj50bHMtYm91bmNlc0BpZXRmLm9yZzwvYT4mZ3Q7DQo8Yj5PbiBCZWhhbGYgT2YgPC9iPkFu ZHJlaSBQb3Bvdjxicj4NCjxiPlNlbnQ6PC9iPiBUdWVzZGF5LCBKdWx5IDMwLCAyMDE5IDI6NDgg UE08YnI+DQo8Yj5Ubzo8L2I+IERhdmlkIEJlbmphbWluICZsdDs8YSBocmVmPSJtYWlsdG86ZGF2 aWRiZW5AY2hyb21pdW0ub3JnIj5kYXZpZGJlbkBjaHJvbWl1bS5vcmc8L2E+Jmd0OzsgV2F0c29u IExhZGQgJmx0OzxhIGhyZWY9Im1haWx0bzp3YXRzb25ibGFkZEBnbWFpbC5jb20iPndhdHNvbmJs YWRkQGdtYWlsLmNvbTwvYT4mZ3Q7PGJyPg0KPGI+Q2M6PC9iPiBUTFMgTGlzdCAmbHQ7PGEgaHJl Zj0ibWFpbHRvOnRsc0BpZXRmLm9yZyI+dGxzQGlldGYub3JnPC9hPiZndDs8YnI+DQo8Yj5TdWJq ZWN0OjwvYj4gUmU6IFtUTFNdIE9wdGlvbnMgZm9yIG5lZ290aWF0aW5nIGh5YnJpZCBrZXkgZXhj aGFuZ2VzIGZvciBwb3N0cXVhbnR1bTxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+R2l2ZW4gdGhlc2Ugb3B0aW9ucywgSSBhbHNvIHByZWZlciBvcHRpb24gMiwgZm9yIHNv bWUgb2YgdGhlIHNhbWUgcmVhc29ucy48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Rm9yIG15IHVu ZGVyc3RhbmRpbmcgdGhvdWdoLCB3aHkgbm90IGhhdmUgdGhlIGNsaWVudCBhZHZlcnRpc2Ugc3Vw cG9ydCBmb3IgaHlicmlkLWtleS1leGNoYW5nZSAoZS5nLiB2aWEgYSDigJxmbGFn4oCdIGV4dGVu c2lvbikgYW5kIHRoZW4gS2V5U2hhcmVTZXJ2ZXJIZWxsbyBjYW4gY29udGFpbiB0d28gS2V5U2hh cmVFbnRyaWVzIChlc3NlbnRpYWxseSwgdXNpbmcgdGhlIHNhbWUgZm9ybWF0IGFzIEtleVNoYXJl Q2xpZW50SGVsbG8/DQogVGhpcyB3b3VsZCBzb2x2ZSB0aGUgQ2FydGVzaWFuIHByb2R1Y3QgaXNz dWUuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkNoZWVycyw8bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+QW5kcmVpPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNw OzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPkZyb206PC9iPiBUTFMgJmx0Ozxh IGhyZWY9Im1haWx0bzp0bHMtYm91bmNlc0BpZXRmLm9yZyI+dGxzLWJvdW5jZXNAaWV0Zi5vcmc8 L2E+Jmd0Ow0KPGI+T24gQmVoYWxmIE9mIDwvYj5EYXZpZCBCZW5qYW1pbjxicj4NCjxiPlNlbnQ6 PC9iPiBUdWVzZGF5LCBKdWx5IDMwLCAyMDE5IDExOjI0IEFNPGJyPg0KPGI+VG86PC9iPiBXYXRz b24gTGFkZCAmbHQ7PGEgaHJlZj0ibWFpbHRvOndhdHNvbmJsYWRkQGdtYWlsLmNvbSI+d2F0c29u YmxhZGRAZ21haWwuY29tPC9hPiZndDs8YnI+DQo8Yj5DYzo8L2I+IFRMUyBMaXN0ICZsdDs8YSBo cmVmPSJtYWlsdG86dGxzQGlldGYub3JnIj50bHNAaWV0Zi5vcmc8L2E+Jmd0Ozxicj4NCjxiPlN1 YmplY3Q6PC9iPiBSZTogW1RMU10gT3B0aW9ucyBmb3IgbmVnb3RpYXRpbmcgaHlicmlkIGtleSBl eGNoYW5nZXMgZm9yIHBvc3RxdWFudHVtPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+SSB0aGluayB0aGlzIHVuZGVyZXN0aW1hdGVzIHRoZSBjb21wbGV4aXR5IGNvc3Qgb2Yg b3B0aW9uIDEgdG8gdGhlIHByb3RvY29sIGFuZCBpbXBsZW1lbnRhdGlvbnMuIE9wdGlvbiAxIG1l YW5zIGdyb3VwIG5lZ290aWF0aW9uIGluY2x1ZGVzIGVudGlyZSBjb2RlcG9pbnRzIHdob3NlIG1l YW5pbmcgY2Fubm90IGJlIGRldGVybWluZWQgd2l0aG91dCBhIHBhcmFsbGVsIGV4dGVuc2lvbi4g VGhpcyBjb21wb3VuZHMNCiBhY3Jvc3MgZXZlcnl0aGluZyB3aGljaCBpbnRlcmFjdHMgd2l0aCBu YW1lZCBncm91cHMsIGltcGFjdGluZyBldmVyeXRoaW5nIGZyb20gQVBJcyB0byBjb25maWcgZmls ZSBmb3JtYXRzIHRvIGV2ZW4gVUkgc3VyZmFjZXMuIE90aGVyIHVzZXMgb2YgTmFtZWRHcm91cHMg YXJlIGltcGFjdGVkIHRvby4gRm9yIGluc3RhbmNlLCBvcHRpb24gMiBmaXRzIGludG8gZHJhZnQt aWV0Zi10bHMtZXNuaSBhcy1pcy4gT3B0aW9uIDEgcmVxdWlyZXMgaW5qZWN0aW5nJm5ic3A7aHli cmlkX2V4dGVuc2lvbg0KIGludG8gRVNOSSBzb21laG93LiBBbmFseXNpcyBtdXN0IGZ1cnRoZXIg Y2hlY2sgZXZlcnkgdXNlLCBzYXksIGluY29ycG9yYXRlcyB0aGlzIHBhcmFsbGVsIGxvb2t1cCB0 YWJsZSBpbnRvIHRyYW5zY3JpcHQtbGlrZSBtZWFzdXJlcy48bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+VGhlIGxlc3NvbiBmcm9tIFRMUyAxLjIg Y29kZSBwb2ludHMgaXMgbm90IGNvbWJpbmVkIGNvZGVwb2ludHMgdnMuIHNwbGl0IG9uZXMuIFJh dGhlciwgdGhlIGxlc3NvbiBpcyB0byBhdm9pZCBpbnRlcmRlcGVuZGVudCBkZWNpc2lvbnM6PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZu YnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiogU2ln bmF0dXJlIGFsZ29yaXRobXMgaW4gVExTIDEuMiB3ZXJlIGEgbWVzcyBiZWNhdXNlIHRoZSBFQ0RT QSBjb2RlcG9pbnRzIHJlcXVpcmVkIGNyb3NzLXJlZmVyZW5jaW5nIGFnYWluc3QgdGhlIHN1cHBv cnRlZCBjdXJ2ZXMgbGlzdC4gVGhlIHZlcmlmaWVyIGNvdWxkIG5vdCBleHByZXNzIHNvbWUgcHJl ZmVyZW5jZXMgKHNpZ25pbmcgU0hBLTUxMiB3aXRoIFAtMjU2IGlzIHNpbGx5LCBhbmQgbWl4aW5n IGhhc2gmIzQzO2N1cnZlDQogcGFpcnMgaW4gRUNEU0EgaXMgc2xpZ2h0bHkgb2ZmIGluIGdlbmVy YWwpLiBBcyBhbmFsb2d5IHRvIG9wdGlvbiAxJ3MgRVNOSSBwcm9ibGVtLCB3ZSBldmVuIGZvcmdv dCB0byBhbGxvdyB0aGUgc2VydmVyIHRvIGV4cHJlc3MgY3VydmUgcHJlZmVyZW5jZXMuIFRMUyAx LjMgY29tYmluZWQgc2lnbmF0dXJlIGFsZ29yaXRobSBjb25zaWRlcmF0aW9ucyBpbnRvIGEgc2lu Z2xlIGNvZGVwb2ludCB0byBhZGRyZXNzIGFsbCB0aGlzLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4qIENpcGhlciBzdWl0ZXMgaW4gVExTIDEu MiB3ZXJlIGEgbWVzcyBiZWNhdXNlIHRoZXkgd2VyZSBoYWxmLWNvbWJpbmVkIGFuZCBoYWxmLXNw bGl0LiBUTFNfRUNESEVfRUNEU0FfV0lUSF9BRVNfMTI4X0dDTV9TSEEyNTYgc2FpZCB0byB1c2Ug c29tZSBFQ0RIRSBrZXkgZXhjaGFuZ2UsIGJ1dCB5b3UgbmVlZCB0byBjaGVjayBpZiB5b3UgaGF2 ZSBhIE5hbWVkR3JvdXAgaW4gY29tbW9uIGZpcnN0LiBJdCBzYWlkDQogdG8gdXNlIEVDRFNBLCBi dXQgeW91IG5lZWQgdG8gY2hlY2sgc2lnbmF0dXJlIGFsZ29yaXRobXMgKHdoaWNoIHRoZW1zZWx2 ZXMgY3Jvc3MtcmVmZXJlbmNlIGN1cnZlcykgZmlyc3QuIEVhcmx5IGRyYWZ0cyBvZiBUTFMgMS4z IGhhZCBpdCBldmVuIHdvcnNlLCB3aGVyZSBhJm5ic3A7VExTX0VDREhFX0VDRFNBX1dJVEhfQUVT XzEyOF9HQ01fU0hBMjU2IGZ1bGwgaGFuZHNoYWtlIG1vcnBoZWQgaW50byZuYnNwO1RMU19FQ0RI RV9QU0tfV0lUSF9BRVNfMTI4X0dDTV9TSEEyNTYNCiBvbiByZXN1bXB0aW9uLiBUaHVzLCBUTFMg MS4zIGNpcGhlciBzdWl0ZXMgbmVnb3RpYXRlIHNvbGVseSBBRUFEJm5ic3A7JiM0MzsgUFJGIGhh c2guPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PkluIGZhaXJuZXNzIHRvIFRMUyAxLjIsIHNvbWUgb2YgdGhpcyB3YXMgYSBjb25zZXF1ZW5jZSBv ZiBUTFMgMS4yJ3MgZXZvbHV0aW9uIG92ZXIgdGltZSBhcyBpbmNyZW1lbnRhbCBleHRlbnNpb25z IG92ZXIgU1NMIDMuMC4gQW5kIHNvbWV0aW1lcyB3ZSBkbyBuZWVkIHRvIHBheSBjb3N0cyBsaWtl IHRoZXNlLiBCdXQgaHlicmlkIGtleSBleGNoYW5nZXMgZml0IGludG8gdGhlIE5hbWVkR3JvdXAg JnF1b3Q7QVBJJnF1b3Q7IGp1c3QNCiBmaW5lLCBzbyBvcHRpb24gMiBpcyB0aGUgY2xlYXIgYW5z d2VyLiBDb2RlIHBvaW50cyBhcmUgY2hlYXAuIFByb3RvY29sIGNvbXBsZXhpdHkgaXMgbXVjaCBt b3JlIGV4cGVuc2l2ZS48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+SXQncyB0cnVlIHRoYXQgc3RhbmRhcmRzIGFyZSBvZnRlbiB1bmRlcnNwZWNp ZmllZC4gVGhpcyBtZWFucyB0aGUgSUVURiBzaG91bGQgZmluaXNoIHRoZSBqb2IsIG5vdCBwYXNz IGFsbCB2YXJpYXRpb25zIHRocm91Z2guIFJTQS1QU1MgaXMgYSBjbGVhciBleGFtcGxlIG9mIHdo YXQgdG8gYXZvaWQuIEl0IHRha2VzIG1vcmUgYnl0ZXMgdG8gbWVyZWx5IHV0dGVyICZxdW90O1JT QS1QU1Mgd2l0aCBTSEEtMjU2IGFuZCB1c3VhbA0KIHBhcmFtZXRlcnMmcXVvdDsgaW4gWC41MDkg dGhhbiB0byBlbmNvZGUgYW4gZW50aXJlIEVDRFNBIHNpZ25hdHVyZSEgV2Ugc2hvdWxkIG5vdCBk ZWZpbmUgbW9yZSB0aGFuIGEgaGFuZGZ1bCBvZiBvcHRpb25zLCByZWdhcmRsZXNzIG9mIHRoZSBl bmNvZGluZy4uPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxv OnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5P biBUdWUsIEp1bCAzMCwgMjAxOSBhdCAxMjoxOCBQTSBXYXRzb24gTGFkZCAmbHQ7PGEgaHJlZj0i bWFpbHRvOndhdHNvbmJsYWRkQGdtYWlsLmNvbSI+d2F0c29uYmxhZGRAZ21haWwuY29tPC9hPiZn dDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJib3Jk ZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGluIDBpbiAw aW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tcmlnaHQ6 MGluO21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibWFyZ2luLWJvdHRvbToxMi4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0K PGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5PbiBUdWUsIEp1bCAzMCwgMjAxOSwg ODoyMSBBTSBTY290dCBGbHVocmVyIChzZmx1aHJlcikgJmx0OzxhIGhyZWY9Im1haWx0bzpzZmx1 aHJlckBjaXNjby5jb20iIHRhcmdldD0iX2JsYW5rIj5zZmx1aHJlckBjaXNjby5jb208L2E+Jmd0 OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRl cjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowaW4gMGluIDBp biA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1yaWdodDow aW47bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6 YXV0byI+RHVyaW5nIHRoZSBwaHlzaWNhbCBtZWV0aW5nIGluIE1vbnRyZWFsLCB3ZSBoYWQgYSBk aXNjdXNzaW9uIGFib3V0IHBvc3RxdWFudHVtIHNlY3VyaXR5LCBhbmQgaW4gcGFydGljdWxhciwg b24gaG93IG9uZSBtaWdodCB3YW50IHRvIG5lZ290aWF0ZSBzZXZlcmFsIGRpZmZlcmVudCDigJhn cm91cHPigJkgc2ltdWx0YW5lb3VzbHkNCiAoYmVjYXVzZSB0aGVyZSBtaWdodCBub3QgYmUgb25l IGdyb3VwIHRoYXQgaXMgZW50aXJlbHkgdHJ1c3RlZCwgYW5kIEkgcHV0IOKAmGdyb3Vwc+KAmSBp biBzY2FyZXF1b3RlcyBiZWNhdXNlIHBvc3RxdWFudHVtIGtleSBleGNoYW5nZXMgYXJlIHR5cGlj YWxseSBub3QgZm9ybWVkIGZyb20gYSBEaWZmaWUtSGVsbG1hbiBncm91cCkuPG86cD48L286cD48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87 bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIGxhbmc9IkVOLUdCIj4mbmJzcDs8L3Nw YW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdp bi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIGxhbmc9IkVO LUdCIj5BdCB0aGUgbWVldGluZywgdGhlcmUgd2VyZSB0d28gb3B0aW9ucyBwcmVzZW50ZWQ6PC9z cGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJn aW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBsYW5nPSJF Ti1HQiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRv Ij48c3BhbiBsYW5nPSJFTi1HQiI+T3B0aW9uIDE6IGFzIHRoZSBzdXBwb3J0ZWQgZ3JvdXAsIHdl IGluc2VydCBhIOKAmGh5YnJpZCBtYXJrZXLigJkgKGFuZCBpbmNsdWRlIGFuIGV4dGVuc2lvbiB0 aGF0IG1hcCBsaXN0cyB3aGljaCBjb21iaW5hdGlvbiB0aGUgaHlicmlkIG1hcmtlciBzdGFuZHMg Zm9yKTwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt c28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4g bGFuZz0iRU4tR0IiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBGb3IgZXhhbXBs ZSwgdGhlIGNsaWVudCBtaWdodCBsaXN0IGluIGhpcyBzdXBwb3J0ZWQgZ3JvdXBzIGh5YnJpZF9t YXJrZXJfMCBhbmQgaHlicmlkX21hcmtlcl8xLCBhbmQgdGhlcmUgd291bGQgYmUgYSBzZXBhcmF0 ZSBleHRlbnNpb24gdGhhdCBsaXN0cw0KIGh5YnJpZF9tYXJrZXJfMCA9IFgyNTUxOSAmIzQzOyBT SUtFcDQzNCBhbmQgaHlicmlkX21hcmtlcl8xID0gWDI1NTE5ICYjNDM7IE5UUlVQUjY1My4mbmJz cDsgVGhlIHNlcnZlciB3b3VsZCB0aGVuIGxvb2sgdXAgdGhlIG1lYW5pbmdzIG9mIGh5YnJpZF9t YXJrZXJfMCBhbmQgMSBpbiB0aGUgZXh0ZW5zaW9uLCBhbmQgdGhlbiBjb21wYXJlIHRoYXQgYWdh aW5zdCBoaXMgc2VjdXJpdHkgcG9saWN5Ljwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJv dHRvbS1hbHQ6YXV0bzt0ZXh0LWluZGVudDouNWluIj4NCjxzcGFuIGxhbmc9IkVOLUdCIj5JbiB0 aGlzIG9wdGlvbiwgd2Ugd291bGQgYXNrIElBTkEgdG8gYWxsb2NhdGUgY29kZSBwb2ludHMgZm9y IHRoZSB2YXJpb3VzIGluZGl2aWR1YWwgcG9zdHF1YW50dW0ga2V5IGV4Y2hhbmdlcyAoaW4gdGhp cyBleGFtcGxlLCBTSUtFcDQzNCBhbmQgTlRSVVBSNjUzKSwgYXMgd2VsbCBhIHJhbmdlIG9mIGNv ZGUgcG9pbnRzIGZvciB0aGUgdmFyaW91cyBoeWJyaWRfbWFya2Vycy48L3NwYW4+PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8L2Rpdj4NCjxk aXY+DQo8ZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNv bGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowaW4gMGluIDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0 LjhwdDttYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1yaWdodDowaW47bWFyZ2luLWJvdHRvbTo1LjBw dCI+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2lu LXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gbGFuZz0iRU4t R0IiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+ PHNwYW4gbGFuZz0iRU4tR0IiPk9wdGlvbiAyOiB3ZSBoYXZlIGNvZGUgcG9pbnRzIGZvciBhbGwg dGhlIHZhcmlvdXMgY29tYmluYXRpb25zIHRoYXQgd2UgbWF5IHdhbnQgdG8gc3VwcG9ydDsgaGVu Y2UgSUFOQSBtaWdodCBhbGxvY2F0ZSBhIGNvZGUgcG9pbnQgWDI1NTE5X1NJS0VwNDM0IGFuZCBh bm90aGVyDQogY29kZSBwb2ludCBmb3IgWDI1NTE5X05UUlVQUjY1My4mbmJzcDsgV2l0aCB0aGlz IG9wdGlvbiwgdGhlIGNsaWVudCB3b3VsZCBsaXN0IFgyNTUxOV9TSUtFcDQzNCBhbmQgWDI1NTE5 X05UUlVQUjY1MyBpbiB0aGVpciBzdXBwb3J0ZWQgZ3JvdXBzLjwvc3Bhbj48bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bztt c28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gbGFuZz0iRU4tR0IiPiZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBJbiB0aGlzIG9wdGlvbiwgd2Ugd291bGQgYXNrIElBTkEg dG8gYWxsb2NhdGUgY29kZSBwb2ludHMgZm9yIGFsbCB0aGUgdmFyaW91cyBjb21iaW5hdGlvbnMg dGhhdCB3ZSB3YW50IGFsbG93IHRvIGJlIG5lZ290aWF0ZWQuPC9zcGFuPjxvOnA+PC9vOnA+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21z by1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBsYW5nPSJFTi1HQiI+Jm5ic3A7PC9zcGFu PjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4t dG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBsYW5nPSJFTi1H QiI+SSB3b3VsZCBsaWtlIHRvIG1ha2UgYW4gYXJndW1lbnQgaW4gZmF2b3Igb2Ygb3B0aW9uIDE6 PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1t YXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBsYW5n PSJFTi1HQiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHVsIHR5cGU9ImRpc2MiPg0K PGxpIGNsYXNzPSJnbWFpbC1tMTY3MzY5NDE3NTU1Nzk1ODcxMW01MDEyMTEyODg2NzExMjEyODkw bXNvbGlzdHBhcmFncmFwaCIgc3R5bGU9Im1zby1saXN0OmwxIGxldmVsMSBsZm8zIj4NCjxzcGFu IGxhbmc9IkVOLUdCIj5JdCBpcyBsaWtlbHkgdGhhdCBub3QgZXZlcnlvbmUgd2lsbCBiZSBzYXRp c2lmaWVkIHdpdGgg4oCcWDI1NTE5IHBsdXMgb25lIG9mIGEgaGFuZGZ1bCBvZiBzcGVjaWZpYyBw b3N0cXVhbnR1bSBhbGdvcml0aG1z4oCdOyBzb21lIG1heSBwcmVmZXIgYW5vdGhlciBlbGxpcHRp YyBjdXJ2ZSAoZm9yIGV4YW1wbGUsIHg0NDgpLCBvciBwZXJoYXBzIGV2ZW4gYSBNT0RQIGdyb3Vw OyBJIGhhdmUgdGFsa2VkIHRvIHBlb3BsZSB3aG8NCiBkbyBub3QgdHJ1c3QgRUNDKTsgaW4gYWRk aXRpb24sIG90aGVyIHBlb3BsZSBtaWdodCBub3QgdHJ1c3QgYSBzaW5nbGUgcG9zdHF1YW50dW0g YWxnb3JpdGhtLCBhbmQgbWF5IHdhbnQgdG8gcmVseSBvbiBib3RoIChmb3IgZXhhbXBsZSkgU0lL RSBhbmQgTmV3SG9wZSAod2hpY2ggYXJlIGJhc2VkIG9uIHZlcnkgZGlmZmVyZW50IGhhcmQgcHJv YmxlbXMpLiZuYnNwOyBXaXRoIG9wdGlvbiAyLCB3ZSBjb3VsZCB0cnkgdG8gYW50aWNpcGF0ZSBh bGwgdGhlIGNvbW1vbg0KIGNvbWJpbnRhdGlvbnMgKHN1Y2ggYXMgUDM4NF9TSUtFcDQzNF9ORVdI T1BFNTEyQ0NBKSwgaG93ZXZlciB0aGF0IGNvdWxkIHZlcnkgd2VsbCBlbmQgdXAgYXMgYSBsb3Qg b2YgY29tYmluYXRpb25zLjwvc3Bhbj48bzpwPjwvbzpwPjwvbGk+PGxpIGNsYXNzPSJnbWFpbC1t MTY3MzY5NDE3NTU1Nzk1ODcxMW01MDEyMTEyODg2NzExMjEyODkwbXNvbGlzdHBhcmFncmFwaCIg c3R5bGU9Im1zby1saXN0OmwxIGxldmVsMSBsZm8zIj4NCjxzcGFuIGxhbmc9IkVOLUdCIj5UaGVy ZSBhcmUgbGlrZWx5IHRvIGJlIHNldmVyYWwgTklTVC1hcHByb3ZlZCBwb3N0cXVhbnR1bSBrZXkg ZXhjaGFuZ2VzLCBhbmQgZWFjaCBvZiB0aG9zZSBrZXkgZXhjaGFuZ2VzIGFyZSBsaWtlbHkgdG8g aGF2ZSBhIG51bWJlciBvZiBzdXBwb3J0ZWQgcGFyYW1ldGVyIHNldHMgKGlmIHdlIHRha2UgdGhl IHNwZWNpZmljIHBvc3RxdWFudHVtIGtleSBleGNoYW5nZSBhcyBhbmFsb2dvdXMgdG8gdGggRUNE SCBwcm90b2Nvb2wsDQogdGhlIOKAnHBhcmFtZXRlciBzZXTigJ0gY291bGQgYmUgdGhvdWdodCBv ZiBhbiBhbmFsb2dvdXMgdG8gdGhlIHNwZWNpZmljIGVsbGlwdHVjIGN1cnZlLCBhbmQgaXQgbW9k aWZpZXMgdGhlIGtleSBzaGFyZSBzaXplLCB0aGUgcGVyZm9ybWFuY2UgYW5kIHNvbWV0aW1lcyB0 aGUgc2VjdXJpdHkgcHJvcGVydGllcykuJm5ic3A7IEluIGZhY3QsIG9uZSBvZiB0aGUgTklTVCBz dWJtaXNzb2lucyBjdXJyZW50bHkgaGFzIDMwIHBhcmFtZXRlciBzZXRzIGRlZmluZWQuJm5ic3A7 DQogSGVuY2UsIGV2ZW4gaWYgTklTVCBkb2VzbuKAmXQgYXBwcm92ZSBhbGwgdGhlIHBhcmFtZXRl ciBzZXRzIChvciBzb21lIG9mIHRoZW0gZG8gbm90IG1ha2Ugc2Vuc2UgZm9yIFRMUyBpbiBhbnkg c2NlbmFyaW8pLCB3ZSBtaWdodCBlbmQgdXAgd2l0aCAyMCBvciBtb3JlIGRpZmZlcmVudCBrZXkg ZXhjaGFuZ2UvcGFyYW1ldGVyIHNldCBjb21iaW5hdGlvbnMgdGhhdCBkbyBtYWtlIHNlbnNlIGZv ciBzb21lIHNjZW5hcmlvIHRoYXQgdXNlcyB0TFMgKGJlDQogaXQgaW4gYSB0cmFuZGl0aW9uYWwg UEMgY2xpZW50L3NlcnZlciwgYSB3aXJlbGVzcyBjbGllbnQsIHR3byBjbG91ZCBkZXZpY2VzIGNv bW11bmljYXRpbmcgb3IgYW4gSU9UIGRldmljZSkuPC9zcGFuPjxvOnA+PC9vOnA+PC9saT48bGkg Y2xhc3M9ImdtYWlsLW0xNjczNjk0MTc1NTU3OTU4NzExbTUwMTIxMTI4ODY3MTEyMTI4OTBtc29s aXN0cGFyYWdyYXBoIiBzdHlsZT0ibXNvLWxpc3Q6bDEgbGV2ZWwxIGxmbzMiPg0KPHNwYW4gbGFu Zz0iRU4tR0IiPkluIGFkZGl0aW9uLCB3ZSBhcmUgbGlrZWx5IHRvIHN1cHBvcnQgYWRkaXRpb25h bCBwcmltaXRpdmVzIGluIHRoZSBmdXR1cmU7IHBvc3NpYmx5IE5hdGlvbmFsIGN1cnZlcyAoZS5n LiBCcmFpbnBvb2wpLCBvciBhZGRpdGlvbmFsIFBvc3RxdWFudHVtIGFsZ29yaXRobXMgKG9yIGFk ZGl0aW9uYWwgcGFyYW1ldGVyIHNldHMgdG8gZXhpc3Rpbmcgb25lcykuJm5ic3A7IE9mIGNvdXJz ZSwgb25jZSB3ZSBhZGQgdGhhdCBjb2RlDQogcG9pbnQsIHdl4oCZbGwgbmVlZCB0byBhZGQgdGhl IGFkZGl0aW9uYWwgY29kZSBwb2ludHMgZm9yIGFsbCB0aGUgY29tYmluYXRpb25zIHRoYXQgaXTi gJlsbCBtYWtlIHNlbnNlIGluICh2ZXJ5IG11Y2ggbGlrZSB3ZSBoYWQgdG8gYWRkIGEgbnVtYmVy IG9mIGNpcGhlcnN1aXRlcyB3aGVuZXZlciB3ZSBhZGRlZCBhIG5ldyBlbmNyeXB0aW9uIGFsZ29y aXRobSBpbnRvIFRMUyAxLjIpLjwvc3Bhbj48bzpwPjwvbzpwPjwvbGk+PC91bD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJv dHRvbS1hbHQ6YXV0byI+PHNwYW4gbGFuZz0iRU4tR0IiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+QXJlIHBlb3BsZSBhY3R1YWxseSBnb2luZyB0byB1 c2UgaHlicmlkIGVuY3J5cHRpb24gcG9zdCBOSVNUPyBUaGUgYWN0dWFsIGRlcGxveW1lbnRzIHRv ZGF5Jm5ic3A7IGZvciBleHBlcmltZW50IGhhdmUgYWxsIGZpdCBvcHRpb24gMiBhbmQgaHlicmlk cyBhcmUgdW5saWtlbHkgaW4gdGhlIGZ1dHVyZS4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+TXkgb2JqZWN0aW9uIHRvIDEgaXMgaXQg Z2V0cyB2ZXJ5IG1lc3N5LiBEbyB3ZSB1c2Ugb25seSB0aGUgaHlicmlkcyB3ZSBib3RoIHN1cHBv cnQ/IFdoYXQgaWYgSSB0aHJvdyBhIGJ1bmNoIG9mIGV4cGVuc2l2ZSB0aGluZ3MgdG9nZXRoZXI/ IE5vIHJlYXNvbiB3ZSBuZWVkIGEgaHlicmlkIHNjaGVtZSEmbmJzcDs8bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6bm9uZTti b3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNi4wcHQ7 bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tcmlnaHQ6MGluO21hcmdp bi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxz cGFuIGxhbmc9IkVOLUdCIj5JdCBzZWVtZHMgcmVhc29uYWJsZSB0byBtZSB0aGF0IHRoZSBjb21i aW5hdGlvbiBvZiB0aGVzZSB0d28gZmFjdG9ycyBhcmUgbGlrZWx5IHRvIGNhdXNlIHVzIChzaG91 bGQgd2Ugc2VsZWN0IG9wdGlvbiAyKSB0byBkZWZpbmUgYSB2ZXJ5IGxhcmdlIG51bWJlciBvZiBj b2RlDQogcG9pbnRzIHRvIGNvdmVyIGFsbCB0aGUgdmFyaW91cyBvcHRpb25zIHRoYXQgcGVvcGxl IG5lZWQuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3Bh biBsYW5nPSJFTi1HQiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9t LWFsdDphdXRvIj48c3BhbiBsYW5nPSJFTi1HQiI+Tm93LCB0aGlzIGlzIGJhc2VkIG9uIHNwZWN1 bGF0aW9uIChib3RoIG9mIHRoZSBOSVNUIHByb2Nlc3MsIGFuZCBhZGRpdGlvbmFsIHByaW1pdGl2 ZXMgdGhhdCB3aWxsIGJlIGFkZGVkIHRvIHRoZSBwcm90b2NvbCksIGFuZCBvbmUgb2JqZWN0aW9u IEnigJl2ZSBoZWFyZCBpcyDigJx3ZQ0KIGRvbuKAmXQga25vdyB3aGF04oCZcyBnb2luZyB0byBo YXBwZW4sIGFuZCBzbyB3aHkgd291bGQgd2UgbWFrZSBkZWNpc2lvbnMgYmFzZWQgb24gdGhpcyBz cGVjdWxhdGlvbj/igJ0mbmJzcDsgSSBhZ3JlZSB0aGF0IHdlIGhhdmUgbGFjayBvZiBrbm93bGVk Z2U7IGhvd2V2ZXIgaXQgc2VlbXMgdG8gbWUgdGhhdCBhIGxhY2sgb2Yga25vd2xlZGdlIGlzIGFu IGFyZ3VtZW50IGluIGZhdm9yIG9mIHNlbGVjdGluZyB0aGUgbW9yZSBmbGV4aWJsZSBvcHRpb24g KHdoaWNoLA0KIGluIG15IG9waW5pb24sIGlzIG9wdGlvbiAxLCBhcyBpdCBhbGxvd3MgdGhlIG5l Z290aWF0aW9uIG9mIGNvbWJpbmF0aW9ucyBvZiBrZXkgZXhjaGFuZ2VzIHRoYXQgdGhlIFdHIGhh cyBub3QgYW50aWNpcGF0ZWQpLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1h bHQ6YXV0byI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPk15 IHBsZWE6IGxldHMgbm90IHJlcGVhdCB0aGUgVExTIDEuMiBjaXBoZXJzdWl0ZSBtZXNzOyBsZXRz IGFkZCBhbiBleHRlbnNpb24gdGhhdCBrZWVwcyB0aGUgbnVtYmVyIG9mIGNvZGUgcG9pbnRzIHdl IG5lZWQgdG8gYSByZWFzb25hYmxlIGJvdW5kLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9t LWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+ VGhlIGNvc3RzIG9mIG9wdGlvbiAxPzxvOnA+PC9vOnA+PC9wPg0KPHVsIHR5cGU9ImRpc2MiPg0K PGxpIGNsYXNzPSJnbWFpbC1tMTY3MzY5NDE3NTU1Nzk1ODcxMW01MDEyMTEyODg2NzExMjEyODkw bXNvbGlzdHBhcmFncmFwaCIgc3R5bGU9Im1zby1saXN0OmwzIGxldmVsMSBsZm82Ij4NCkl0IGRv ZXMgaW5jcmVhc2UgdGhlIGNvbXBsZXhpdHkgb24gdGhlIHNlcnZlciBhIHNtYWxsIGFtb3VudCAo SeKAmW0gbm90IGEgVExTIGltcGxlbWVudG9yLCBob3dldmVyIGl0IHdvdWxkIHNlZW0gdG8gbWUg dG8gYmUgb25seSBhIGZhaXJseSBzbWFsbCBhbW91bnQpPG86cD48L286cD48L2xpPjxsaSBjbGFz cz0iZ21haWwtbTE2NzM2OTQxNzU1NTc5NTg3MTFtNTAxMjExMjg4NjcxMTIxMjg5MG1zb2xpc3Rw YXJhZ3JhcGgiIHN0eWxlPSJtc28tbGlzdDpsMyBsZXZlbDEgbGZvNiI+DQpJdCBtYXkgaW5jcmVh c2UgdGhlIHNpemUgb2YgdGhlIGNsaWVudCBoZWxsbyBhIHNtYWxsIGFtb3VudCAob24gdGhlIG90 aGVyIGhhbmQsIGJlY2F1c2UgaXQgYWxsb3dzIHVzIHRvIGF2b2lkIHNlbmRpbmcgZHVwbGljYXRl IGtleSBzaGFyZXMsIGl0IGNhbiBhbHNvIHJlZHVjZSB0aGUgc2l6ZSBvZiB0aGUgY2xpZW50IGhl bGxvIGFzIHdlbGwsIGRlcGVuZGluZyBvbiB3aGF04oCZcyBhY3R1YWxseSBuZWdvdGlhdGVkKTxv OnA+PC9vOnA+PC9saT48L3VsPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJn aW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj5JTUhPLCB0aGUgc21h bGwgaW5jcmVhc2UgaW4gY29tcGxleGl0eSBpcyB3b3J0aCB0aGUgbGFjayBvZiBjb21wbGV4aXR5 IGluIHRoZSBjb2RlIHBvaW50IHRhYmxlLCBhbmQgdGhlIGFkZGl0aW9uYWwgZmxleGliaWxpdHkg aXQgZ2l2ZXMuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX188YnI+ DQpUTFMgbWFpbGluZyBsaXN0PGJyPg0KPGEgaHJlZj0ibWFpbHRvOlRMU0BpZXRmLm9yZyIgdGFy Z2V0PSJfYmxhbmsiPlRMU0BpZXRmLm9yZzwvYT48YnI+DQo8YSBocmVmPSJodHRwczovL25hbTA2 LnNhZmVsaW5rcy5wcm90ZWN0aW9uLm91dGxvb2suY29tLz91cmw9aHR0cHMlM0ElMkYlMkZ3d3cu aWV0Zi5vcmclMkZtYWlsbWFuJTJGbGlzdGluZm8lMkZ0bHMmYW1wO2RhdGE9MDIlN0MwMSU3Q0Fu ZHJlaS5Qb3BvdiU0MG1pY3Jvc29mdC5jb20lN0MzNDFlNDczYjZhNGI0NzRhM2FiYTA4ZDcxNTI2 NTMyOCU3QzcyZjk4OGJmODZmMTQxYWY5MWFiMmQ3Y2QwMTFkYjQ3JTdDMSU3QzAlN0M2MzcwMDEx MjY2NjM2MDgxMjcmYW1wO3NkYXRhPWpKZEI5a1dQZkFSWWc2QjdpaUhOWmszY3UzT2VnNW05aUlZ S1pyS2VPcEElM0QmYW1wO3Jlc2VydmVkPTAiIHRhcmdldD0iX2JsYW5rIj5odHRwczovL3d3dy5p ZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3RsczwvYT48bzpwPjwvbzpwPjwvcD4NCjwvYmxvY2tx dW90ZT4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPl9fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fPGJyPg0KVExTIG1haWxp bmcgbGlzdDxicj4NCjxhIGhyZWY9Im1haWx0bzpUTFNAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5r Ij5UTFNAaWV0Zi5vcmc8L2E+PGJyPg0KPGEgaHJlZj0iaHR0cHM6Ly9uYW0wNi5zYWZlbGlua3Mu cHJvdGVjdGlvbi5vdXRsb29rLmNvbS8/dXJsPWh0dHBzJTNBJTJGJTJGd3d3LmlldGYub3JnJTJG bWFpbG1hbiUyRmxpc3RpbmZvJTJGdGxzJmFtcDtkYXRhPTAyJTdDMDElN0NBbmRyZWkuUG9wb3Yl NDBtaWNyb3NvZnQuY29tJTdDMzQxZTQ3M2I2YTRiNDc0YTNhYmEwOGQ3MTUyNjUzMjglN0M3MmY5 ODhiZjg2ZjE0MWFmOTFhYjJkN2NkMDExZGI0NyU3QzElN0MwJTdDNjM3MDAxMTI2NjYzNjE4MTI0 JmFtcDtzZGF0YT1FcEk3TyUyQkt6YndwT01yaHhEcTZWUG0wcnV5cTVLNHU3ZHc0ZnMlMkZTdW9T USUzRCZhbXA7cmVzZXJ2ZWQ9MCIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vd3d3LmlldGYub3Jn L21haWxtYW4vbGlzdGluZm8vdGxzPC9hPjxvOnA+PC9vOnA+PC9wPg0KPC9ibG9ja3F1b3RlPg0K PC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_DM5PR2101MB09178A1D1192D045A1FF76F78CDC0DM5PR2101MB0917_-- From nobody Tue Jul 30 12:53:06 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2BEB71200B7 for ; Tue, 30 Jul 2019 12:53:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OH127WwfJpCI for ; Tue, 30 Jul 2019 12:53:00 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5EC3A12001E for ; Tue, 30 Jul 2019 12:53:00 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 1DB53BE3E; Tue, 30 Jul 2019 20:52:59 +0100 (IST) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yPeGixxS5fR2; Tue, 30 Jul 2019 20:52:57 +0100 (IST) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 8DD2BBE24; Tue, 30 Jul 2019 20:52:57 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1564516377; bh=nQs9I62WJmiv8SicZhuyMoEbBaGwOTsdCoe2srJuCCg=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=Kveymb8rIDtlLT/jRhG4m4eLAb93aCVl6dcZeOZna74RyXm6B3aWYcoXZ89hGfpoZ M6EV+BKOcWQvxYjc51nB6QZPxx9wK5KBYnb4gU523IEI759o7LeD9lIutHJnqrv6kj yn1bgZ/2ABYwfIKkSOhUaSlml9l/rbiwYI4b9yvU= To: "Scott Fluhrer (sfluhrer)" , Watson Ladd Cc: TLS List References: From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <663791e0-1a2a-27cd-f1c7-20658eb0b9f5@cs.tcd.ie> Date: Tue, 30 Jul 2019 20:52:56 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="uZaSsaIXH00lrFOisD4IfBrFzfaGYpZr6" Archived-At: Subject: Re: [TLS] Options for negotiating hybrid key exchanges for postquantum X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 30 Jul 2019 19:53:03 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --uZaSsaIXH00lrFOisD4IfBrFzfaGYpZr6 Content-Type: multipart/mixed; boundary="y9r6D8lNtiW2rxhmlUZIrnRblmi3LIpHR"; protected-headers="v1" From: Stephen Farrell To: "Scott Fluhrer (sfluhrer)" , Watson Ladd Cc: TLS List Message-ID: <663791e0-1a2a-27cd-f1c7-20658eb0b9f5@cs.tcd.ie> Subject: Re: [TLS] Options for negotiating hybrid key exchanges for postquantum References: In-Reply-To: --y9r6D8lNtiW2rxhmlUZIrnRblmi3LIpHR Content-Type: multipart/mixed; boundary="------------0FEA3AB63EE215DB8814D8BC" Content-Language: en-GB This is a multi-part message in MIME format. --------------0FEA3AB63EE215DB8814D8BC Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable I'm neutral as to how we represent this stuff for the moment as I think it's too early to tell until we get closer to the end of the algorithms competition. That said, I do want to second this... On 30/07/2019 19:41, Scott Fluhrer (sfluhrer) wrote: > Here is one opinion (mine, but I'm pretty sure it is shared by > others): the various NIST candidates are based on hard problems that > were only recently studied (e.g. supersingular isogenies, Quasicyclic > codes), or have cryptanalytic methods that are quite difficult to > fully assess (e.g. Lattices). Even after NIST and CFRG have blessed > one or more of them, it would seem reasonable to me that we wouldn't > want to place all our security eggs in that one basket. We currently > place all our trust in DH or ECDH; however those have been studied > for 30+ years - we are not there yet for most of the postquantum > algorithms. >=20 > Hence, it seems reasonable to me that we give users the option of > being able to rely on multiple methods. The only person with whom I've spoken who said he'd plan to deploy some of this soon is a VPN operator who explicitly wanted to start early and use >1 PQ scheme (3-4 is what he said) plus a current scheme. His expectation was that that'd settle down to one PQ scheme, or one PQ and a current one, in time, but that time may be a decade after he'd like to start. So, to the extent it matters, count me as a +1 for supporting that. Cheers, S. --------------0FEA3AB63EE215DB8814D8BC Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------0FEA3AB63EE215DB8814D8BC-- --y9r6D8lNtiW2rxhmlUZIrnRblmi3LIpHR-- --uZaSsaIXH00lrFOisD4IfBrFzfaGYpZr6 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAl1AoBgACgkQWrL68XsX K+pZeQ/+PGef7Ts6GjpsmL/sdaPL0TNLXLEPsP7Se+38fsq8lnEgbHFmkgBW1YDH eYJ7di1zUbct2VTHn0nRAg5Pdf4LBWuG5cjE15w7cVJ3yzzAJKWhci0UUDTaVibq hO/QS0NFEwAdpJHLoVAEDtRtC99csnL911owtip63mJjKw/fx4VXZGnFcXPqBxEL 1hqUH52/yVBGOErq2z2PIJlIKFn2ua0BnKU1vdEoSYhm/Gg1v3sbbXCS4Jn4bb/I V6AJGBQgvJIIaNbFw4ZG7c34PtvU6GOZTjpm9YF1bDYFvYFrcrKkJsEzHCLzD1iA 4zfocYEbGca6q+wXhdznmQt2nYchQpMrPE5Pt12/zwgWYKGXnkOSSTgV13ick5oy 9XHcf/T6qDhkHbHRBoEZahdPH6cKND3QIbsEsHR5eUZ7JSrgA9kjjYfw4+s/iCnz 9Rketz4grFJVE7f4/NtKsFCnBxCyWm7xhdkOh6FIiNx0GrbSbweZpovDDK+8ewzK D/Tqh9ktE3WKaukYHoPKstcuK+Ti/vWwZq8F9sZcwEzOyfCLQXF3n8Z4zTL80bzI DsR3GpYt3AphiDpQqKrzRsROmSar3UhvFbtEYKaFAiVkjtbz1MQqp84VVIqMIm8b KbwRwlYefteVLAgQz4FYo1I/SFqwPHIovN0yed5b5zlq3z7eFY4= =p4G+ -----END PGP SIGNATURE----- --uZaSsaIXH00lrFOisD4IfBrFzfaGYpZr6-- From nobody Tue Jul 30 13:03:27 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1C04A12001E for ; Tue, 30 Jul 2019 13:03:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jDXhTqSLAkBp for ; Tue, 30 Jul 2019 13:03:24 -0700 (PDT) Received: from mail-lj1-x22e.google.com (mail-lj1-x22e.google.com [IPv6:2a00:1450:4864:20::22e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6910C12001A for ; Tue, 30 Jul 2019 13:03:23 -0700 (PDT) Received: by mail-lj1-x22e.google.com with SMTP id i21so63309248ljj.3 for ; Tue, 30 Jul 2019 13:03:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=KAR9jJY042a42hx+A+kSpyWjMssoZDkg5AQTIBbtuRo=; b=GUGCpjnUlMRWqTMaUyzEf5EmayqY9NhIseP9syoJfGw/881i0oywru7cgTD+xRy3Np 0UXetwSMRp9P/BSaUK+JO8ylM5DQ2PiDLU5T1cWQIkSX1saoZR6y+ES+4gj4YQbui4P5 +KOY+/14xckAfzlUogVli4yROxg6bkHZ/UftzQD69rSEAzX5dbXMCi3ycd04W5ux4e5u TG/ypP+rnctlMWAfgLOv521rdbMAI4h/IaGonI7DST9S6ahsR06RYfC+cECfjACJ9uOH 0YaDaTYV68WHK1ypt5V0IfzCmP5hIE3b4tR5hSMDCXmV1IQ2fpALRq6z36V78mVr9pmu 2W8w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=KAR9jJY042a42hx+A+kSpyWjMssoZDkg5AQTIBbtuRo=; b=rthZ6SMW5vc09YSfHHdXvEqeT9C80vaIPsVTJLGo8jLvwmM/DhavMExzldq+Heqkh2 OFRIL7fnq5xMRWFXcCOb4G2CGf3YJP151KF1mR6F6cEQB4cgQnQuKZQq7h6krmJWFVSv r/vr8RdMc/kPjAd/FfqG0ksXSEbE/7atymvr24MLrqQoBAG5xfnAUPf0Hm3klLOB7tHj IDdB26uChrhuYUzl3iiLInUTizQS7/QJqCO4A+l7oxAGvIXUN9MVz7jVbOk468dGOuc8 ClC8njbWiU41QdMToGEoh3w/QiwsrAgyajfIuOXfZFzKi0vs2PYLEk0y5s7e7yy7hUeu hT+g== X-Gm-Message-State: APjAAAUpMnewEjy9FeF+L488SydryQqqDmxCkyt/+uvnSEPuHcTeWTjV uBP/hrN3xEzU77/GlLCtxt6gaHVJrrDbIW3d4DE= X-Google-Smtp-Source: APXvYqzoIw030c7fo3/s2dDkcIrlJDB/WDybkor1UmqHpFcrYq+TZEc5eT/dIfLdLVJlXYLteUNRpJGYHPrWRsca6qw= X-Received: by 2002:a2e:7c15:: with SMTP id x21mr62362363ljc.55.1564517001517; Tue, 30 Jul 2019 13:03:21 -0700 (PDT) MIME-Version: 1.0 References: <663791e0-1a2a-27cd-f1c7-20658eb0b9f5@cs.tcd.ie> In-Reply-To: <663791e0-1a2a-27cd-f1c7-20658eb0b9f5@cs.tcd.ie> From: Watson Ladd Date: Tue, 30 Jul 2019 13:03:09 -0700 Message-ID: To: Stephen Farrell Cc: "Scott Fluhrer (sfluhrer)" , TLS List Content-Type: multipart/alternative; boundary="0000000000001ee144058eeb8051" Archived-At: Subject: Re: [TLS] Options for negotiating hybrid key exchanges for postquantum X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 30 Jul 2019 20:03:26 -0000 --0000000000001ee144058eeb8051 Content-Type: text/plain; charset="UTF-8" On Tue, Jul 30, 2019, 12:52 PM Stephen Farrell wrote: > > I'm neutral as to how we represent this stuff for the moment > as I think it's too early to tell until we get closer to the > end of the algorithms competition. > Part of the input being provided is deployability experiments happening now in TLS. > > That said, I do want to second this... > > On 30/07/2019 19:41, Scott Fluhrer (sfluhrer) wrote: > > Here is one opinion (mine, but I'm pretty sure it is shared by > > others): the various NIST candidates are based on hard problems that > > were only recently studied (e.g. supersingular isogenies, Quasicyclic > > codes), or have cryptanalytic methods that are quite difficult to > > fully assess (e.g. Lattices). Even after NIST and CFRG have blessed > > one or more of them, it would seem reasonable to me that we wouldn't > > want to place all our security eggs in that one basket. We currently > > place all our trust in DH or ECDH; however those have been studied > > for 30+ years - we are not there yet for most of the postquantum > > algorithms. > > > > Hence, it seems reasonable to me that we give users the option of > > being able to rely on multiple methods. > The only person with whom I've spoken who said he'd plan to > deploy some of this soon is a VPN operator who explicitly > wanted to start early and use >1 PQ scheme (3-4 is what he > said) plus a current scheme. His expectation was that that'd > settle down to one PQ scheme, or one PQ and a current one, > in time, but that time may be a decade after he'd like to > start. > > So, to the extent it matters, count me as a +1 for supporting > that. > > Cheers, > S. > > --0000000000001ee144058eeb8051 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


On Tue, Jul 30, 2019, 12:52 PM Stephen Farrell <stephen.farrell@cs.tcd.ie>= wrote:

I'm neutral as to how we represent this stuff for the moment
as I think it's too early to tell until we get closer to the
end of the algorithms competition.

Part of the input being provided is deplo= yability experiments happening now in TLS.

That said, I do want to second this...

On 30/07/2019 19:41, Scott Fluhrer (sfluhrer) wrote:
> Here is one opinion (mine, but I'm pretty sure it is shared by
> others): the various NIST candidates are based on hard problems that > were only recently studied (e.g. supersingular isogenies, Quasicyclic<= br> > codes), or have cryptanalytic methods that are quite difficult to
> fully assess (e.g. Lattices).=C2=A0 Even after NIST and CFRG have bles= sed
> one or more of them, it would seem reasonable to me that we wouldn'= ;t
> want to place all our security eggs in that one basket.=C2=A0 We curre= ntly
> place all our trust in DH or ECDH; however those have been studied
> for 30+ years - we are not there yet for most of the postquantum
> algorithms.
>
> Hence, it seems reasonable to me that we give users the option of
> being able to rely on multiple methods.
The only person with whom I've spoken who said he'd plan to
deploy some of this soon is a VPN operator who explicitly
wanted to start early and use >1 PQ scheme (3-4 is what he
said) plus a current scheme. His expectation was that that'd
settle down to one PQ scheme, or one PQ and a current one,
in time, but that time may be a decade after he'd like to
start.

So, to the extent it matters, count me as a +1 for supporting
that.

Cheers,
S.

--0000000000001ee144058eeb8051-- From nobody Tue Jul 30 13:10:25 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9132D120254 for ; Tue, 30 Jul 2019 13:10:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.499 X-Spam-Level: X-Spam-Status: No, score=-14.499 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=g+hxrV4e; dkim=pass (1024-bit key) header.d=cisco.onmicrosoft.com header.b=fktPB6rd Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rRNssOuuuW0M for ; Tue, 30 Jul 2019 13:10:09 -0700 (PDT) Received: from rcdn-iport-4.cisco.com (rcdn-iport-4.cisco.com [173.37.86.75]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EC81412001A for ; Tue, 30 Jul 2019 13:10:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=39534; q=dns/txt; s=iport; t=1564517408; x=1565727008; h=from:to:subject:date:message-id:mime-version; bh=dXpFHZ+GYoKFKaOwljfyUSWq8/yXlAzowu/4+Cpng5o=; b=g+hxrV4e8NPsvjyhaqYpdMWS/UcgkffQnDQFVtg7Mxkc0FxVRJRfD/Sr Ogydk/JBmY9sfubIAWAAdF2Q2idpW1A0b3Qb+6mmFglN7mON9PlwKOyIl QeJQ0MFTcbhxk9z/E/6LvjBdeajupRpX+55VCzMy+yBiQ6/THArnrrmb7 U=; IronPort-PHdr: =?us-ascii?q?9a23=3AmBYRHBXWveAjD/eoYiubgXoNHPnV8LGuZFwc94?= =?us-ascii?q?YnhrRSc6+q45XlOgnF6O5wiEPSA9yJ8OpK3uzRta2oGXcN55qMqjgjSNRNTF?= =?us-ascii?q?dE7KdehAk8GIiAAEz/IuTtankhEsBfVEVo5VmwMFNeH4D1YFiB6nA=3D?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0CmAgBEo0Bd/49dJa1lDg0BAQEBAwE?= =?us-ascii?q?BAQcDAQEBgWeBFS9QA21VIAQLKgqEFINHA40GTIMNllaCUgNUCQEBAQwBAS0?= =?us-ascii?q?CAQGEQAIXgisjOBMBAwEBBAEBAgEGbYUeDIVKAQEXEQoTAQErDREBGQMBAQE?= =?us-ascii?q?hBwMCBDAUCQkBBAESCBqDAYEdTQMdAaFWAoE4iGBxgTKCegEBBYUIGIITCYE?= =?us-ascii?q?0i2AXgUA/gRFGghcHgkCCWhgVCRaCVTKCJowFgnmFAJYWbQkCghqUMZgRjT2?= =?us-ascii?q?XWgIEAgQFAg4BAQWBZyGBWHAVO4JsgkI3gzqKGDtygSmMLAGBIAEB?= X-IronPort-AV: E=Sophos;i="5.64,327,1559520000"; d="scan'208,217";a="607783815" Received: from rcdn-core-7.cisco.com ([173.37.93.143]) by rcdn-iport-4.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 30 Jul 2019 20:10:07 +0000 Received: from XCH-RCD-001.cisco.com (xch-rcd-001.cisco.com [173.37.102.11]) by rcdn-core-7.cisco.com (8.15.2/8.15.2) with ESMTPS id x6UKA10J001997 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL); Tue, 30 Jul 2019 20:10:05 GMT Received: from xhs-aln-003.cisco.com (173.37.135.120) by XCH-RCD-001.cisco.com (173.37.102.11) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Tue, 30 Jul 2019 15:10:01 -0500 Received: from xhs-rtp-001.cisco.com (64.101.210.228) by xhs-aln-003.cisco.com (173.37.135.120) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Tue, 30 Jul 2019 15:10:00 -0500 Received: from NAM04-CO1-obe.outbound.protection.outlook.com (64.101.32.56) by xhs-rtp-001.cisco.com (64.101.210.228) with Microsoft SMTP Server (TLS) id 15.0.1473.3 via Frontend Transport; Tue, 30 Jul 2019 16:10:00 -0400 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=OQgRF2RR7BjPck1LdAhOJMcFn8gGE/qju8gxtrfLxjn9kBXPSgjx14cYDnvrEuxGsYv3ERb/w7GzjUdyB0Xg2KN1ugehEhx+UWBr/n5QYojfHBNoZWSy146Kvsx4N+Aw/8agNtOnvr3t+Kdoclo64mGIZtntT8XixUi7475sT385wwKtGL3C+Lmzwxz1vpXi6IDgObcjqmy0lgnJ6Ru8AY9NH2ultTmBlvwsjhir8OpNYqqrwEeGRy/T8lcYh3f9o4Bm0l+1GOY9G99DDAFpyuMBVOcCeZ4oKpQEv/7NNezWsviHb4KM6IdvhjzATCma56OU285muRmV4UlFcw5RkQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=dXpFHZ+GYoKFKaOwljfyUSWq8/yXlAzowu/4+Cpng5o=; b=InxpWwG3e8+3RRvTerBk6Bt21nsIfmhtWwX9BZjFoHIpapE2vKwNyQQxyN8Lp/6G0O6UMKY5OI5zj/bvrDg0ik9A0fGGAaMTsLTlJak3NgZ7Pv2Mmr69d0oRE47CpldiQumsV4MhS41pF0nYAPK02SSZXnT1CGb5KNSJ+KeOHwSuOkS7s8kswJBIp/FR/4pRb46LnypsJ1zr7yCJ6D7QlKU+OSP0k6rXT1jooV1APZeObPnn1kXG2vwdQlKmj5qgszpjQiufJbaWaARSQmG7pY3uXcEe9alc+1Ixy/X8Sl7c5Q35b89K9eFQd7e2wTkVk/b7EkKhRXB7XqGQormOXQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1;spf=pass smtp.mailfrom=cisco.com;dmarc=pass action=none header.from=cisco.com;dkim=pass header.d=cisco.com;arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector2-cisco-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=dXpFHZ+GYoKFKaOwljfyUSWq8/yXlAzowu/4+Cpng5o=; b=fktPB6rdd0mh2/inOZ3/oHq6FTy8t74ygokuer/+ePI1RVHyvJ38K8y1nhHVC8rvIDO+XHJsMF/K/bA/bDCwqKySO9ijGJjCWApLOmRlUG4TOv56WXXtFsJAHgweawcyXXXmF90b0xk+UiMWRjuA3KFEcKcYjXvwsmC+ue+FH4g= Received: from MN2PR11MB3871.namprd11.prod.outlook.com (10.255.180.204) by MN2PR11MB3773.namprd11.prod.outlook.com (20.178.253.160) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2115.15; Tue, 30 Jul 2019 20:09:59 +0000 Received: from MN2PR11MB3871.namprd11.prod.outlook.com ([fe80::4c5:965:c7b7:387b]) by MN2PR11MB3871.namprd11.prod.outlook.com ([fe80::4c5:965:c7b7:387b%3]) with mapi id 15.20.2115.005; Tue, 30 Jul 2019 20:09:59 +0000 From: "Scott Fluhrer (sfluhrer)" To: "Blumenthal, Uri - 0553 - MITLL" , "Panos Kampanakis (pkampana)" , "" Thread-Topic: SIKE vs SIDH (was [TLS] Options for negotiating hybrid key exchanges for postquantum) Thread-Index: AdVHEsEgT0uoLMAbRZaLZj90U2vN3w== Date: Tue, 30 Jul 2019 20:09:58 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=sfluhrer@cisco.com; x-originating-ip: [173.38.117.65] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: c80da205-6dbf-49bd-8756-08d71529e5db x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:MN2PR11MB3773; x-ms-traffictypediagnostic: MN2PR11MB3773: x-ms-exchange-purlcount: 2 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-forefront-prvs: 0114FF88F6 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(4636009)(136003)(396003)(366004)(346002)(376002)(39860400002)(15404003)(189003)(199004)(68736007)(14444005)(14454004)(316002)(2906002)(33656002)(256004)(478600001)(8676002)(6436002)(81156014)(81166006)(476003)(236005)(52536014)(25786009)(86362001)(7736002)(74316002)(8936002)(64756008)(486006)(66446008)(53546011)(6506007)(5660300002)(66066001)(76116006)(99286004)(54896002)(790700001)(6116002)(66574012)(55016002)(66556008)(66476007)(71190400001)(102836004)(3846002)(71200400001)(53936002)(9686003)(6306002)(110136005)(2171002)(66946007)(7696005)(26005)(186003)(491001); DIR:OUT; SFP:1101; SCL:1; SRVR:MN2PR11MB3773; H:MN2PR11MB3871.namprd11.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: cisco.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: cdbYIKFUhCdci78RXTrQ7wd48dcLxLOH+iByD6zGY5fmHdDLPmNRS297y1MU16G5j3H4RYX7AhaafosEmoJtGS8hoINDzJRJvSmNiEGeMyQXTJrQDWBQutgysy1KRRQ3FpXJEd5s/TT68g4VO2hbAKkns8Ub71RaVMRk8YMHwXi8fj4iG1AkLJDvdOJ88U04RBvXRXByDGkrMxcHB0rA4s38aXiihhVJSowt1w5j5mhG1N9wry9i7QpKQIKhGREIa51MP8CuDsDemwaRvmIo2/h4jXuPjvly0nL0lsuZg86FtlZEu9EBvJKNN4/lOmzWm57R0C3LiYfwrll37Mjqh+O/Wj27frfkO/yTNhjoBfzcqGWz6TXvuKAC753/+mo4kJV5uZ3Ol5qziydYHHfC/rR3m9coQlbqRkLWkpDLYCU= Content-Type: multipart/alternative; boundary="_000_MN2PR11MB3871499BC2DFB34F6064299BC1DC0MN2PR11MB3871namp_" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: c80da205-6dbf-49bd-8756-08d71529e5db X-MS-Exchange-CrossTenant-originalarrivaltime: 30 Jul 2019 20:09:58.8537 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: sfluhrer@cisco.com X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN2PR11MB3773 X-OriginatorOrg: cisco.com X-Outbound-SMTP-Client: 173.37.102.11, xch-rcd-001.cisco.com X-Outbound-Node: rcdn-core-7.cisco.com Archived-At: Subject: [TLS] SIKE vs SIDH (was Options for negotiating hybrid key exchanges for postquantum) X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 30 Jul 2019 20:10:18 -0000 --_000_MN2PR11MB3871499BC2DFB34F6064299BC1DC0MN2PR11MB3871namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 VGhpcyBpcyBhIHNpZGUgaXNzdWUgKHdl4oCZcmUgcHJvYmFibHkgbm90IGdvaW5nIHRvIHRhbGsg YWJvdXQgd2hpY2ggcG9zdHF1YW50dW0gcHJpbWl0aXZlcyB0byB1c2UgZm9yIGFub3RoZXIgdHdv IHllYXJzKSwgYnV0Og0KDQoNCiAgKiAgIFdoYXQgZG8geW91IHNlZSBhcyB0aGUgYWR2YW50YWdl IG9mIFNJREg/ICBUaGUgc2VydmVyIGNhbuKAmXQgYXJiaXRyYXJpbHkgc2VsZWN0IHRoZSBzaGFy ZWQgc2VjcmV0IChhdCBsZWFzdCwgaWYgd2Ugc2VsZWN0IHRoZSBLRU0gdmVyc2lvbiBvZiBTSUtF KTsgd2hhdCBzcGVjaWZpYyBhZHZhbnRhZ2Ugd2VyZSB5b3UgdGhpbmtpbmcgb2YuDQogICogICBU aGUgc2VjdXJpdHkgcHJvb2Ygb2YgVExTIDEuMyAoYXQgbGVhc3QsIHRoZSBvbmVzIEnigJl2ZSBz ZWVuKSBhc3N1bWUgdGhhdCB0aGUga2V5IGV4Y2hhbmdlIGlzIENDQSBzZWN1cmUgWzFdLiAgU0lE SCBpcyBub3Q7IEkgd291bGQgcHJlZmVyIHRvIHN0YXkgd2l0aCBhIGtleSBleGNoYW5nZSB0aGF0 IG1lZXRzIHRoZSBhc3N1bXB0aW9ucyBvZiB0aGUgcHJvb2YsIGFuZCBiYXJyaW5nIGFuIGltcHJv dmVkIHNlY3VyaXR5IHByb29mIHRoYXQgbWFrZXMgd2Vha2VyIGFzc3VtcHRpb25zLCB0aGF0IG1l YW5zIFNJS0UgcmF0aGVyIHRoYW4gU0lESC4NCg0KWzFdIEZvciBwZW9wbGUgd2l0aCByZWFsIGxp dmVzIGFuZCB3aG8gZG8gbm90IG9ic2VzcyBvdmVyIHRoZSBtaW51dGlhZSBvZiBjcnlwdG9ncmFw aHksIENDQSBmb3IgYSBrZXkgZXhjaGFuZ2UgbWVhbnMgdGhhdCB0aGUgcHJpdmF0ZSBrZXkgaXMg c2VjdXJlLCBldmVuIGlmIHRoZSBhdHRhY2tlciBpcyBhbGxvd2VkIHRvIHN1Ym1pdCBhbiBhcmJp dHJhcnkgKHBvc3NpYmx5IG1hbGZvcm1lZCkga2V5IHNoYXJlLiAgVGhlIGNvbnZlbnRpb25hbCB3 aXNkb20gaXMgdGhhdCB5b3UgZG9u4oCZdCBuZWVkIHRvIHRoaXMgbGV2ZWwgb2YgcHJvdGVjdGlv biBmb3IgZXBoZW1lcmFsIGtleSBleGNoYW5nZXMgKHdoZXJlIHdlIGdlbmVyYXRlIGEgZnJlc2gg cHJpdmF0ZSBrZXkgZm9yIGVhY2ggZXhjaGFuZ2U7IHdlIGFsbG93IGhpbSB0byBsZWFybiB0aGUg c2hhcmVkIHNlY3JldCBmb3IgdGhlIGV4Y2hhbmdlIGhlIGlzIGEgcGFydHkgb2YsIGFuZCBsZWFy bmluZyB0aGUgcHJpdmF0ZSBrZXkgZm9yIHRoaXMgZXhjaGFuZ2UgdGVsbHMgaGltIG5vdGhpbmcg YWJvdXQgYW55IG90aGVyIGV4Y2hhbmdlKTsgaG93ZXZlciB0aGUgY3VycmVudCBwcm9vZnMgZm9y IFRMUyAxLjMgbWFrZSB0aGlzIGFzc3VtcHRpb24sIGV2ZW4gaWYgeW91IHVzZSBhIHByaXZhdGUg a2V5IG9ubHkgb25jZS4NCg0KRnJvbTogQmx1bWVudGhhbCwgVXJpIC0gMDU1MyAtIE1JVExMIDx1 cmlAbGwubWl0LmVkdT4NClNlbnQ6IFR1ZXNkYXksIEp1bHkgMzAsIDIwMTkgMzo0MSBQTQ0KVG86 IFBhbm9zIEthbXBhbmFraXMgKHBrYW1wYW5hKSA8cGthbXBhbmFAY2lzY28uY29tPjsgU2NvdHQg Rmx1aHJlciAoc2ZsdWhyZXIpIDxzZmx1aHJlckBjaXNjby5jb20+OyA8dGxzQGlldGYub3JnPiA8 dGxzQGlldGYub3JnPg0KU3ViamVjdDogUmU6IFtUTFNdIE9wdGlvbnMgZm9yIG5lZ290aWF0aW5n IGh5YnJpZCBrZXkgZXhjaGFuZ2VzIGZvciBwb3N0cXVhbnR1bQ0KDQpPbmUgbW9yZSB0aGluZzog SSB3b3VsZCBleHBlY3QgdG8gdXNlIFNJREggcmF0aGVyIHRoYW4gU0lLRS4NCg0KQmVjYXVzZSB0 byBlbXVsYXRlIHRoZSBzZWN1cml0eSBhZHZhbnRhZ2VzIG9mIERILCB5b3XigJlkIGhhdmUgdG8g cnVuIHR3byBTSUtF4oCZcyDigJMgb25lIGluIGVhY2ggZGlyZWN0aW9uLg0KDQoNCkZyb206IFRM UyA8dGxzLWJvdW5jZXNAaWV0Zi5vcmc8bWFpbHRvOnRscy1ib3VuY2VzQGlldGYub3JnPj4gb24g YmVoYWxmIG9mICJQYW5vcyBLYW1wYW5ha2lzIChwa2FtcGFuYSkiIDxwa2FtcGFuYUBjaXNjby5j b208bWFpbHRvOnBrYW1wYW5hQGNpc2NvLmNvbT4+DQpEYXRlOiBUdWVzZGF5LCBKdWx5IDMwLCAy MDE5IGF0IDM6MzcgUE0NClRvOiAiU2NvdHQgRmx1aHJlciAoc2ZsdWhyZXIpIiA8c2ZsdWhyZXJA Y2lzY28uY29tPG1haWx0bzpzZmx1aHJlckBjaXNjby5jb20+PiwgIjx0bHNAaWV0Zi5vcmc8bWFp bHRvOnRsc0BpZXRmLm9yZz4+IiA8dGxzQGlldGYub3JnPG1haWx0bzp0bHNAaWV0Zi5vcmc+Pg0K U3ViamVjdDogUmU6IFtUTFNdIE9wdGlvbnMgZm9yIG5lZ290aWF0aW5nIGh5YnJpZCBrZXkgZXhj aGFuZ2VzIGZvciBwb3N0cXVhbnR1bQ0KDQorMSBmb3Igb3B0aW9uIDIuIFRoZSBjb21iaW5hdG9y aWMgZXhwbG9zaW9uIGFuZCBjb21wbGV4aXR5IG9mIDEgaXMgdW5uZWNlc3NhcnkuIEkgZXhwZWN0 IHRoYXQganVzdCBhIGZldywgY29uc2VydmF0aXZlLCBhY2NlcHRhYmx5IGVmZmljaWVudCwgY2xh c3NpY2FsK1BRIGNvbWJpbmF0aW9ucyBuZWVkIHRvIGJlIHN0YW5kYXJkaXplZCBhbmQgdXNlZC4g Q29tYmluaW5nIGEgY2xhc3NpY2FsIGFsZ28gd2l0aCBtb3JlIHRoYW4gb25lIHBvc3RxdWFudHVt IGFsZ29yaXRobXMgaW4gYSBrZXkgZXhjaGFuZ2UgZG9lcyBub3Qgc2VlbSBwcmFjdGljYWwgYmFz ZWQgb24gdGhlIFBRIGNhbmRpZGF0ZXMga2V5IHNpemVzIGFuZCBwZXJmb3JtYW5jZS4NCg0KUGFu b3MNCg0KDQpGcm9tOiBUTFMgPHRscy1ib3VuY2VzQGlldGYub3JnPG1haWx0bzp0bHMtYm91bmNl c0BpZXRmLm9yZz4+IE9uIEJlaGFsZiBPZiBTY290dCBGbHVocmVyIChzZmx1aHJlcikNClNlbnQ6 IFR1ZXNkYXksIEp1bHkgMzAsIDIwMTkgMTE6MjEgQU0NClRvOiA8dGxzQGlldGYub3JnPG1haWx0 bzp0bHNAaWV0Zi5vcmc+PiA8dGxzQGlldGYub3JnPG1haWx0bzp0bHNAaWV0Zi5vcmc+Pg0KU3Vi amVjdDogW1RMU10gT3B0aW9ucyBmb3IgbmVnb3RpYXRpbmcgaHlicmlkIGtleSBleGNoYW5nZXMg Zm9yIHBvc3RxdWFudHVtDQoNCkR1cmluZyB0aGUgcGh5c2ljYWwgbWVldGluZyBpbiBNb250cmVh bCwgd2UgaGFkIGEgZGlzY3Vzc2lvbiBhYm91dCBwb3N0cXVhbnR1bSBzZWN1cml0eSwgYW5kIGlu IHBhcnRpY3VsYXIsIG9uIGhvdyBvbmUgbWlnaHQgd2FudCB0byBuZWdvdGlhdGUgc2V2ZXJhbCBk aWZmZXJlbnQg4oCYZ3JvdXBz4oCZIHNpbXVsdGFuZW91c2x5IChiZWNhdXNlIHRoZXJlIG1pZ2h0 IG5vdCBiZSBvbmUgZ3JvdXAgdGhhdCBpcyBlbnRpcmVseSB0cnVzdGVkLCBhbmQgSSBwdXQg4oCY Z3JvdXBz4oCZIGluIHNjYXJlcXVvdGVzIGJlY2F1c2UgcG9zdHF1YW50dW0ga2V5IGV4Y2hhbmdl cyBhcmUgdHlwaWNhbGx5IG5vdCBmb3JtZWQgZnJvbSBhIERpZmZpZS1IZWxsbWFuIGdyb3VwKS4N Cg0KQXQgdGhlIG1lZXRpbmcsIHRoZXJlIHdlcmUgdHdvIG9wdGlvbnMgcHJlc2VudGVkOg0KDQpP cHRpb24gMTogYXMgdGhlIHN1cHBvcnRlZCBncm91cCwgd2UgaW5zZXJ0IGEg4oCYaHlicmlkIG1h cmtlcuKAmSAoYW5kIGluY2x1ZGUgYW4gZXh0ZW5zaW9uIHRoYXQgbWFwIGxpc3RzIHdoaWNoIGNv bWJpbmF0aW9uIHRoZSBoeWJyaWQgbWFya2VyIHN0YW5kcyBmb3IpDQogICAgICAgICAgICAgICAg Rm9yIGV4YW1wbGUsIHRoZSBjbGllbnQgbWlnaHQgbGlzdCBpbiBoaXMgc3VwcG9ydGVkIGdyb3Vw cyBoeWJyaWRfbWFya2VyXzAgYW5kIGh5YnJpZF9tYXJrZXJfMSwgYW5kIHRoZXJlIHdvdWxkIGJl IGEgc2VwYXJhdGUgZXh0ZW5zaW9uIHRoYXQgbGlzdHMgaHlicmlkX21hcmtlcl8wID0gWDI1NTE5 ICsgU0lLRXA0MzQgYW5kIGh5YnJpZF9tYXJrZXJfMSA9IFgyNTUxOSArIE5UUlVQUjY1My4gIFRo ZSBzZXJ2ZXIgd291bGQgdGhlbiBsb29rIHVwIHRoZSBtZWFuaW5ncyBvZiBoeWJyaWRfbWFya2Vy XzAgYW5kIDEgaW4gdGhlIGV4dGVuc2lvbiwgYW5kIHRoZW4gY29tcGFyZSB0aGF0IGFnYWluc3Qg aGlzIHNlY3VyaXR5IHBvbGljeS4NCkluIHRoaXMgb3B0aW9uLCB3ZSB3b3VsZCBhc2sgSUFOQSB0 byBhbGxvY2F0ZSBjb2RlIHBvaW50cyBmb3IgdGhlIHZhcmlvdXMgaW5kaXZpZHVhbCBwb3N0cXVh bnR1bSBrZXkgZXhjaGFuZ2VzIChpbiB0aGlzIGV4YW1wbGUsIFNJS0VwNDM0IGFuZCBOVFJVUFI2 NTMpLCBhcyB3ZWxsIGEgcmFuZ2Ugb2YgY29kZSBwb2ludHMgZm9yIHRoZSB2YXJpb3VzIGh5YnJp ZF9tYXJrZXJzLg0KDQpPcHRpb24gMjogd2UgaGF2ZSBjb2RlIHBvaW50cyBmb3IgYWxsIHRoZSB2 YXJpb3VzIGNvbWJpbmF0aW9ucyB0aGF0IHdlIG1heSB3YW50IHRvIHN1cHBvcnQ7IGhlbmNlIElB TkEgbWlnaHQgYWxsb2NhdGUgYSBjb2RlIHBvaW50IFgyNTUxOV9TSUtFcDQzNCBhbmQgYW5vdGhl ciBjb2RlIHBvaW50IGZvciBYMjU1MTlfTlRSVVBSNjUzLiAgV2l0aCB0aGlzIG9wdGlvbiwgdGhl IGNsaWVudCB3b3VsZCBsaXN0IFgyNTUxOV9TSUtFcDQzNCBhbmQgWDI1NTE5X05UUlVQUjY1MyBp biB0aGVpciBzdXBwb3J0ZWQgZ3JvdXBzLg0KICAgICAgICAgICAgICAgIEluIHRoaXMgb3B0aW9u LCB3ZSB3b3VsZCBhc2sgSUFOQSB0byBhbGxvY2F0ZSBjb2RlIHBvaW50cyBmb3IgYWxsIHRoZSB2 YXJpb3VzIGNvbWJpbmF0aW9ucyB0aGF0IHdlIHdhbnQgYWxsb3cgdG8gYmUgbmVnb3RpYXRlZC4N Cg0KSSB3b3VsZCBsaWtlIHRvIG1ha2UgYW4gYXJndW1lbnQgaW4gZmF2b3Igb2Ygb3B0aW9uIDE6 DQoNCg0KLSAgICAgICAgICBJdCBpcyBsaWtlbHkgdGhhdCBub3QgZXZlcnlvbmUgd2lsbCBiZSBz YXRpc2lmaWVkIHdpdGgg4oCcWDI1NTE5IHBsdXMgb25lIG9mIGEgaGFuZGZ1bCBvZiBzcGVjaWZp YyBwb3N0cXVhbnR1bSBhbGdvcml0aG1z4oCdOyBzb21lIG1heSBwcmVmZXIgYW5vdGhlciBlbGxp cHRpYyBjdXJ2ZSAoZm9yIGV4YW1wbGUsIHg0NDgpLCBvciBwZXJoYXBzIGV2ZW4gYSBNT0RQIGdy b3VwOyBJIGhhdmUgdGFsa2VkIHRvIHBlb3BsZSB3aG8gZG8gbm90IHRydXN0IEVDQyk7IGluIGFk ZGl0aW9uLCBvdGhlciBwZW9wbGUgbWlnaHQgbm90IHRydXN0IGEgc2luZ2xlIHBvc3RxdWFudHVt IGFsZ29yaXRobSwgYW5kIG1heSB3YW50IHRvIHJlbHkgb24gYm90aCAoZm9yIGV4YW1wbGUpIFNJ S0UgYW5kIE5ld0hvcGUgKHdoaWNoIGFyZSBiYXNlZCBvbiB2ZXJ5IGRpZmZlcmVudCBoYXJkIHBy b2JsZW1zKS4gIFdpdGggb3B0aW9uIDIsIHdlIGNvdWxkIHRyeSB0byBhbnRpY2lwYXRlIGFsbCB0 aGUgY29tbW9uIGNvbWJpbnRhdGlvbnMgKHN1Y2ggYXMgUDM4NF9TSUtFcDQzNF9ORVdIT1BFNTEy Q0NBKSwgaG93ZXZlciB0aGF0IGNvdWxkIHZlcnkgd2VsbCBlbmQgdXAgYXMgYSBsb3Qgb2YgY29t YmluYXRpb25zLg0KDQotICAgICAgICAgIFRoZXJlIGFyZSBsaWtlbHkgdG8gYmUgc2V2ZXJhbCBO SVNULWFwcHJvdmVkIHBvc3RxdWFudHVtIGtleSBleGNoYW5nZXMsIGFuZCBlYWNoIG9mIHRob3Nl IGtleSBleGNoYW5nZXMgYXJlIGxpa2VseSB0byBoYXZlIGEgbnVtYmVyIG9mIHN1cHBvcnRlZCBw YXJhbWV0ZXIgc2V0cyAoaWYgd2UgdGFrZSB0aGUgc3BlY2lmaWMgcG9zdHF1YW50dW0ga2V5IGV4 Y2hhbmdlIGFzIGFuYWxvZ291cyB0byB0aCBFQ0RIIHByb3RvY29vbCwgdGhlIOKAnHBhcmFtZXRl ciBzZXTigJ0gY291bGQgYmUgdGhvdWdodCBvZiBhbiBhbmFsb2dvdXMgdG8gdGhlIHNwZWNpZmlj IGVsbGlwdHVjIGN1cnZlLCBhbmQgaXQgbW9kaWZpZXMgdGhlIGtleSBzaGFyZSBzaXplLCB0aGUg cGVyZm9ybWFuY2UgYW5kIHNvbWV0aW1lcyB0aGUgc2VjdXJpdHkgcHJvcGVydGllcykuICBJbiBm YWN0LCBvbmUgb2YgdGhlIE5JU1Qgc3VibWlzc29pbnMgY3VycmVudGx5IGhhcyAzMCBwYXJhbWV0 ZXIgc2V0cyBkZWZpbmVkLiAgSGVuY2UsIGV2ZW4gaWYgTklTVCBkb2VzbuKAmXQgYXBwcm92ZSBh bGwgdGhlIHBhcmFtZXRlciBzZXRzIChvciBzb21lIG9mIHRoZW0gZG8gbm90IG1ha2Ugc2Vuc2Ug Zm9yIFRMUyBpbiBhbnkgc2NlbmFyaW8pLCB3ZSBtaWdodCBlbmQgdXAgd2l0aCAyMCBvciBtb3Jl IGRpZmZlcmVudCBrZXkgZXhjaGFuZ2UvcGFyYW1ldGVyIHNldCBjb21iaW5hdGlvbnMgdGhhdCBk byBtYWtlIHNlbnNlIGZvciBzb21lIHNjZW5hcmlvIHRoYXQgdXNlcyB0TFMgKGJlIGl0IGluIGEg dHJhbmRpdGlvbmFsIFBDIGNsaWVudC9zZXJ2ZXIsIGEgd2lyZWxlc3MgY2xpZW50LCB0d28gY2xv dWQgZGV2aWNlcyBjb21tdW5pY2F0aW5nIG9yIGFuIElPVCBkZXZpY2UpLg0KDQotICAgICAgICAg IEluIGFkZGl0aW9uLCB3ZSBhcmUgbGlrZWx5IHRvIHN1cHBvcnQgYWRkaXRpb25hbCBwcmltaXRp dmVzIGluIHRoZSBmdXR1cmU7IHBvc3NpYmx5IE5hdGlvbmFsIGN1cnZlcyAoZS5nLiBCcmFpbnBv b2wpLCBvciBhZGRpdGlvbmFsIFBvc3RxdWFudHVtIGFsZ29yaXRobXMgKG9yIGFkZGl0aW9uYWwg cGFyYW1ldGVyIHNldHMgdG8gZXhpc3Rpbmcgb25lcykuICBPZiBjb3Vyc2UsIG9uY2Ugd2UgYWRk IHRoYXQgY29kZSBwb2ludCwgd2XigJlsbCBuZWVkIHRvIGFkZCB0aGUgYWRkaXRpb25hbCBjb2Rl IHBvaW50cyBmb3IgYWxsIHRoZSBjb21iaW5hdGlvbnMgdGhhdCBpdOKAmWxsIG1ha2Ugc2Vuc2Ug aW4gKHZlcnkgbXVjaCBsaWtlIHdlIGhhZCB0byBhZGQgYSBudW1iZXIgb2YgY2lwaGVyc3VpdGVz IHdoZW5ldmVyIHdlIGFkZGVkIGEgbmV3IGVuY3J5cHRpb24gYWxnb3JpdGhtIGludG8gVExTIDEu MikuDQoNCkl0IHNlZW1kcyByZWFzb25hYmxlIHRvIG1lIHRoYXQgdGhlIGNvbWJpbmF0aW9uIG9m IHRoZXNlIHR3byBmYWN0b3JzIGFyZSBsaWtlbHkgdG8gY2F1c2UgdXMgKHNob3VsZCB3ZSBzZWxl Y3Qgb3B0aW9uIDIpIHRvIGRlZmluZSBhIHZlcnkgbGFyZ2UgbnVtYmVyIG9mIGNvZGUgcG9pbnRz IHRvIGNvdmVyIGFsbCB0aGUgdmFyaW91cyBvcHRpb25zIHRoYXQgcGVvcGxlIG5lZWQuDQoNCk5v dywgdGhpcyBpcyBiYXNlZCBvbiBzcGVjdWxhdGlvbiAoYm90aCBvZiB0aGUgTklTVCBwcm9jZXNz LCBhbmQgYWRkaXRpb25hbCBwcmltaXRpdmVzIHRoYXQgd2lsbCBiZSBhZGRlZCB0byB0aGUgcHJv dG9jb2wpLCBhbmQgb25lIG9iamVjdGlvbiBJ4oCZdmUgaGVhcmQgaXMg4oCcd2UgZG9u4oCZdCBr bm93IHdoYXTigJlzIGdvaW5nIHRvIGhhcHBlbiwgYW5kIHNvIHdoeSB3b3VsZCB3ZSBtYWtlIGRl Y2lzaW9ucyBiYXNlZCBvbiB0aGlzIHNwZWN1bGF0aW9uP+KAnSAgSSBhZ3JlZSB0aGF0IHdlIGhh dmUgbGFjayBvZiBrbm93bGVkZ2U7IGhvd2V2ZXIgaXQgc2VlbXMgdG8gbWUgdGhhdCBhIGxhY2sg b2Yga25vd2xlZGdlIGlzIGFuIGFyZ3VtZW50IGluIGZhdm9yIG9mIHNlbGVjdGluZyB0aGUgbW9y ZSBmbGV4aWJsZSBvcHRpb24gKHdoaWNoLCBpbiBteSBvcGluaW9uLCBpcyBvcHRpb24gMSwgYXMg aXQgYWxsb3dzIHRoZSBuZWdvdGlhdGlvbiBvZiBjb21iaW5hdGlvbnMgb2Yga2V5IGV4Y2hhbmdl cyB0aGF0IHRoZSBXRyBoYXMgbm90IGFudGljaXBhdGVkKS4NCg0KTXkgcGxlYTogbGV0cyBub3Qg cmVwZWF0IHRoZSBUTFMgMS4yIGNpcGhlcnN1aXRlIG1lc3M7IGxldHMgYWRkIGFuIGV4dGVuc2lv biB0aGF0IGtlZXBzIHRoZSBudW1iZXIgb2YgY29kZSBwb2ludHMgd2UgbmVlZCB0byBhIHJlYXNv bmFibGUgYm91bmQuDQoNClRoZSBjb3N0cyBvZiBvcHRpb24gMT8NCg0KLSAgICAgICAgICBJdCBk b2VzIGluY3JlYXNlIHRoZSBjb21wbGV4aXR5IG9uIHRoZSBzZXJ2ZXIgYSBzbWFsbCBhbW91bnQg KEnigJltIG5vdCBhIFRMUyBpbXBsZW1lbnRvciwgaG93ZXZlciBpdCB3b3VsZCBzZWVtIHRvIG1l IHRvIGJlIG9ubHkgYSBmYWlybHkgc21hbGwgYW1vdW50KQ0KDQotICAgICAgICAgIEl0IG1heSBp bmNyZWFzZSB0aGUgc2l6ZSBvZiB0aGUgY2xpZW50IGhlbGxvIGEgc21hbGwgYW1vdW50IChvbiB0 aGUgb3RoZXIgaGFuZCwgYmVjYXVzZSBpdCBhbGxvd3MgdXMgdG8gYXZvaWQgc2VuZGluZyBkdXBs aWNhdGUga2V5IHNoYXJlcywgaXQgY2FuIGFsc28gcmVkdWNlIHRoZSBzaXplIG9mIHRoZSBjbGll bnQgaGVsbG8gYXMgd2VsbCwgZGVwZW5kaW5nIG9uIHdoYXTigJlzIGFjdHVhbGx5IG5lZ290aWF0 ZWQpDQpJTUhPLCB0aGUgc21hbGwgaW5jcmVhc2UgaW4gY29tcGxleGl0eSBpcyB3b3J0aCB0aGUg bGFjayBvZiBjb21wbGV4aXR5IGluIHRoZSBjb2RlIHBvaW50IHRhYmxlLCBhbmQgdGhlIGFkZGl0 aW9uYWwgZmxleGliaWxpdHkgaXQgZ2l2ZXMuDQo= --_000_MN2PR11MB3871499BC2DFB34F6064299BC1DC0MN2PR11MB3871namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 V2luZ2RpbmdzOw0KCXBhbm9zZS0xOjUgMCAwIDAgMCAwIDAgMCAwIDA7fQ0KQGZvbnQtZmFjZQ0K CXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2IDMg MiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1 IDUgMiAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWws IGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0 b206LjAwMDFwdDsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixz YW5zLXNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXByaW9y aXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQphOnZp c2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5 Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnAuTXNvTGlz dFBhcmFncmFwaCwgbGkuTXNvTGlzdFBhcmFncmFwaCwgZGl2Lk1zb0xpc3RQYXJhZ3JhcGgNCgl7 bXNvLXN0eWxlLXByaW9yaXR5OjM0Ow0KCW1hcmdpbi10b3A6MGluOw0KCW1hcmdpbi1yaWdodDow aW47DQoJbWFyZ2luLWJvdHRvbTowaW47DQoJbWFyZ2luLWxlZnQ6LjVpbjsNCgltYXJnaW4tYm90 dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIs c2Fucy1zZXJpZjt9DQpwLm1zb25vcm1hbDAsIGxpLm1zb25vcm1hbDAsIGRpdi5tc29ub3JtYWww DQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsN CgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0KCW1hcmdp bi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixz YW5zLXNlcmlmO30NCnNwYW4uRW1haWxTdHlsZTE5DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFs Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7 fQ0Kc3Bhbi5FbWFpbFN0eWxlMjANCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWw7DQoJZm9udC1m YW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6IzFGNDk3RDsNCglmb250LXdlaWdo dDpub3JtYWw7DQoJZm9udC1zdHlsZTpub3JtYWw7DQoJdGV4dC1kZWNvcmF0aW9uOm5vbmUgbm9u ZTt9DQpzcGFuLkVtYWlsU3R5bGUyMQ0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbDsNCglmb250 LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjp3aW5kb3d0ZXh0O30NCnNwYW4u RW1haWxTdHlsZTIzDQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFt aWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0KLk1zb0NocERl ZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1zaXplOjEwLjBwdDt9 DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo4LjVpbiAxMS4waW47DQoJbWFyZ2luOjEuMGlu IDEuMGluIDEuMGluIDEuMGluO30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7cGFnZTpXb3JkU2VjdGlv bjE7fQ0KLyogTGlzdCBEZWZpbml0aW9ucyAqLw0KQGxpc3QgbDANCgl7bXNvLWxpc3QtaWQ6NDAw NjM5NjExOw0KCW1zby1saXN0LXR5cGU6aHlicmlkOw0KCW1zby1saXN0LXRlbXBsYXRlLWlkczoy MDY1ODQ1NjIwIC0xMDQ1NTE0NDQwIDY3Njk4NjkxIDY3Njk4NjkzIDY3Njk4Njg5IDY3Njk4Njkx IDY3Njk4NjkzIDY3Njk4Njg5IDY3Njk4NjkxIDY3Njk4NjkzO30NCkBsaXN0IGwwOmxldmVsMQ0K CXttc28tbGV2ZWwtc3RhcnQtYXQ6MDsNCgltc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7 DQoJbXNvLWxldmVsLXRleHQ6LTsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2 ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFt aWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCW1zby1mYXJlYXN0LWZvbnQtZmFtaWx5OiJUaW1l cyBOZXcgUm9tYW4iO30NCkBsaXN0IGwwOmxldmVsMg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1h dDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6bzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsN Cgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0K CWZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyI7fQ0KQGxpc3QgbDA6bGV2ZWwzDQoJe21zby1sZXZl bC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVs LXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQt aW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDA6bGV2ZWw0 DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7 DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjps ZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3Qg bDA6bGV2ZWw1DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwt dGV4dDpvOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9z aXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIg TmV3Ijt9DQpAbGlzdCBsMDpsZXZlbDYNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0 Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28t bGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQt ZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMDpsZXZlbDcNCgl7bXNvLWxldmVsLW51bWJlci1m b3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6 bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4y NWluOw0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMDpsZXZlbDgNCgl7bXNvLWxldmVs LW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Om87DQoJbXNvLWxldmVsLXRh Yi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5k ZW50Oi0uMjVpbjsNCglmb250LWZhbWlseToiQ291cmllciBOZXciO30NCkBsaXN0IGwwOmxldmVs OQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674Kn Ow0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246 bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBs aXN0IGwxDQoJe21zby1saXN0LWlkOjIwOTAwNzcyMDY7DQoJbXNvLWxpc3QtdHlwZTpoeWJyaWQ7 DQoJbXNvLWxpc3QtdGVtcGxhdGUtaWRzOi00MDkwNTgyMzggMTA1ODMwMjI0NCA2NzY5ODY5MSA2 NzY5ODY5MyA2NzY5ODY4OSA2NzY5ODY5MSA2NzY5ODY5MyA2NzY5ODY4OSA2NzY5ODY5MSA2NzY5 ODY5Mzt9DQpAbGlzdCBsMTpsZXZlbDENCgl7bXNvLWxldmVsLXN0YXJ0LWF0OjA7DQoJbXNvLWxl dmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Oi07DQoJbXNvLWxldmVs LXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQt aW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgltc28t ZmFyZWFzdC1mb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIjt9DQpAbGlzdCBsMTpsZXZlbDIN Cgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Om87DQoJ bXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0 Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseToiQ291cmllciBOZXciO30NCkBs aXN0IGwxOmxldmVsMw0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxl dmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1i ZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6V2lu Z2RpbmdzO30NCkBsaXN0IGwxOmxldmVsNA0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxs ZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1z by1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9u dC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwxOmxldmVsNQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZv cm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6bzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9u ZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWlu Ow0KCWZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyI7fQ0KQGxpc3QgbDE6bGV2ZWw2DQoJe21zby1s ZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxl dmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRl eHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDE6bGV2 ZWw3DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrv grc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlv bjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxp c3QgbDE6bGV2ZWw4DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2 ZWwtdGV4dDpvOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXIt cG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6IkNvdXJp ZXIgTmV3Ijt9DQpAbGlzdCBsMTpsZXZlbDkNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVs bGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCglt c28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZv bnQtZmFtaWx5OldpbmdkaW5nczt9DQpvbA0KCXttYXJnaW4tYm90dG9tOjBpbjt9DQp1bA0KCXtt YXJnaW4tYm90dG9tOjBpbjt9DQotLT48L3N0eWxlPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0K PG86c2hhcGVkZWZhdWx0cyB2OmV4dD0iZWRpdCIgc3BpZG1heD0iMTAyNiIgLz4NCjwveG1sPjwh W2VuZGlmXS0tPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVsYXlvdXQgdjpleHQ9 ImVkaXQiPg0KPG86aWRtYXAgdjpleHQ9ImVkaXQiIGRhdGE9IjEiIC8+DQo8L286c2hhcGVsYXlv dXQ+PC94bWw+PCFbZW5kaWZdLS0+DQo8L2hlYWQ+DQo8Ym9keSBsYW5nPSJFTi1VUyIgbGluaz0i Ymx1ZSIgdmxpbms9InB1cnBsZSI+DQo8ZGl2IGNsYXNzPSJXb3JkU2VjdGlvbjEiPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+VGhpcyBpcyBhIHNpZGUgaXNzdWUgKHdl4oCZcmUgcHJvYmFibHkgbm90 IGdvaW5nIHRvIHRhbGsgYWJvdXQgd2hpY2ggcG9zdHF1YW50dW0gcHJpbWl0aXZlcyB0byB1c2Ug Zm9yIGFub3RoZXIgdHdvIHllYXJzKSwgYnV0OjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4N Cjx1bCBzdHlsZT0ibWFyZ2luLXRvcDowaW4iIHR5cGU9ImRpc2MiPg0KPGxpIGNsYXNzPSJNc29M aXN0UGFyYWdyYXBoIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MGluO21zby1saXN0OmwxIGxldmVsMSBs Zm8zIj48c3BhbiBsYW5nPSJFTi1HQiI+V2hhdCBkbyB5b3Ugc2VlIGFzIHRoZSBhZHZhbnRhZ2Ug b2YgU0lESD8mbmJzcDsgVGhlIHNlcnZlciBjYW7igJl0IGFyYml0cmFyaWx5IHNlbGVjdCB0aGUg c2hhcmVkIHNlY3JldCAoYXQgbGVhc3QsIGlmIHdlIHNlbGVjdCB0aGUgS0VNIHZlcnNpb24gb2Yg U0lLRSk7IHdoYXQgc3BlY2lmaWMNCiBhZHZhbnRhZ2Ugd2VyZSB5b3UgdGhpbmtpbmcgb2YuPG86 cD48L286cD48L3NwYW4+PC9saT48bGkgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJt YXJnaW4tbGVmdDowaW47bXNvLWxpc3Q6bDEgbGV2ZWwxIGxmbzMiPjxzcGFuIGxhbmc9IkVOLUdC Ij5UaGUgc2VjdXJpdHkgcHJvb2Ygb2YgVExTIDEuMyAoYXQgbGVhc3QsIHRoZSBvbmVzIEnigJl2 ZSBzZWVuKSBhc3N1bWUgdGhhdCB0aGUga2V5IGV4Y2hhbmdlIGlzIENDQSBzZWN1cmUgWzFdLiZu YnNwOyBTSURIIGlzIG5vdDsgSSB3b3VsZCBwcmVmZXIgdG8gc3RheSB3aXRoIGEga2V5IGV4Y2hh bmdlDQogdGhhdCBtZWV0cyB0aGUgYXNzdW1wdGlvbnMgb2YgdGhlIHByb29mLCBhbmQgYmFycmlu ZyBhbiBpbXByb3ZlZCBzZWN1cml0eSBwcm9vZiB0aGF0IG1ha2VzIHdlYWtlciBhc3N1bXB0aW9u cywgdGhhdCBtZWFucyBTSUtFIHJhdGhlciB0aGFuIFNJREguPG86cD48L286cD48L3NwYW4+PC9s aT48L3VsPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj5bMV0gRm9yIHBlb3BsZSB3aXRoIHJlYWwgbGl2ZXMgYW5kIHdobyBk byBub3Qgb2JzZXNzIG92ZXIgdGhlIG1pbnV0aWFlIG9mIGNyeXB0b2dyYXBoeSwgQ0NBIGZvciBh IGtleSBleGNoYW5nZSBtZWFucyB0aGF0IHRoZSBwcml2YXRlIGtleSBpcyBzZWN1cmUsIGV2ZW4g aWYgdGhlIGF0dGFja2VyIGlzIGFsbG93ZWQgdG8gc3VibWl0IGFuIGFyYml0cmFyeSAocG9zc2li bHkgbWFsZm9ybWVkKSBrZXkgc2hhcmUuJm5ic3A7DQogVGhlIGNvbnZlbnRpb25hbCB3aXNkb20g aXMgdGhhdCB5b3UgZG9u4oCZdCBuZWVkIHRvIHRoaXMgbGV2ZWwgb2YgcHJvdGVjdGlvbiBmb3Ig ZXBoZW1lcmFsIGtleSBleGNoYW5nZXMgKHdoZXJlIHdlIGdlbmVyYXRlIGEgZnJlc2ggcHJpdmF0 ZSBrZXkgZm9yIGVhY2ggZXhjaGFuZ2U7IHdlIGFsbG93IGhpbSB0byBsZWFybiB0aGUgc2hhcmVk IHNlY3JldCBmb3IgdGhlIGV4Y2hhbmdlIGhlIGlzIGEgcGFydHkgb2YsIGFuZCBsZWFybmluZyB0 aGUgcHJpdmF0ZQ0KIGtleSBmb3IgdGhpcyBleGNoYW5nZSB0ZWxscyBoaW0gbm90aGluZyBhYm91 dCBhbnkgb3RoZXIgZXhjaGFuZ2UpOyBob3dldmVyIHRoZSBjdXJyZW50IHByb29mcyBmb3IgVExT IDEuMyBtYWtlIHRoaXMgYXNzdW1wdGlvbiwgZXZlbiBpZiB5b3UgdXNlIGEgcHJpdmF0ZSBrZXkg b25seSBvbmNlLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJz cDs8L286cD48L3A+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCBi bHVlIDEuNXB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNC4wcHQiPg0KPGRpdj4NCjxkaXYgc3R5bGU9 ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0UxRTFFMSAxLjBwdDtwYWRkaW5nOjMuMHB0 IDBpbiAwaW4gMGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPkZyb206PC9iPiBCbHVtZW50 aGFsLCBVcmkgLSAwNTUzIC0gTUlUTEwgJmx0O3VyaUBsbC5taXQuZWR1Jmd0Ow0KPGJyPg0KPGI+ U2VudDo8L2I+IFR1ZXNkYXksIEp1bHkgMzAsIDIwMTkgMzo0MSBQTTxicj4NCjxiPlRvOjwvYj4g UGFub3MgS2FtcGFuYWtpcyAocGthbXBhbmEpICZsdDtwa2FtcGFuYUBjaXNjby5jb20mZ3Q7OyBT Y290dCBGbHVocmVyIChzZmx1aHJlcikgJmx0O3NmbHVocmVyQGNpc2NvLmNvbSZndDs7ICZsdDt0 bHNAaWV0Zi5vcmcmZ3Q7ICZsdDt0bHNAaWV0Zi5vcmcmZ3Q7PGJyPg0KPGI+U3ViamVjdDo8L2I+ IFJlOiBbVExTXSBPcHRpb25zIGZvciBuZWdvdGlhdGluZyBoeWJyaWQga2V5IGV4Y2hhbmdlcyBm b3IgcG9zdHF1YW50dW08bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk9u ZSBtb3JlIHRoaW5nOiBJIHdvdWxkIGV4cGVjdCB0byB1c2UgU0lESCByYXRoZXIgdGhhbiBTSUtF Lg0KPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkJlY2F1c2UgdG8gZW11bGF0ZSB0aGUgc2VjdXJp dHkgYWR2YW50YWdlcyBvZiBESCwgeW914oCZZCBoYXZlIHRvIHJ1bg0KPHU+dHdvPC91PiBTSUtF 4oCZcyDigJMgb25lIGluIGVhY2ggZGlyZWN0aW9uLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6 c29saWQgI0I1QzRERiAxLjBwdDtwYWRkaW5nOjMuMHB0IDBpbiAwaW4gMGluIj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48Yj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjEyLjBwdDtjb2xvcjpibGFjayI+RnJvbToNCjwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMi4wcHQ7Y29sb3I6YmxhY2siPlRMUyAmbHQ7PGEgaHJlZj0ibWFpbHRvOnRs cy1ib3VuY2VzQGlldGYub3JnIj50bHMtYm91bmNlc0BpZXRmLm9yZzwvYT4mZ3Q7IG9uIGJlaGFs ZiBvZiAmcXVvdDtQYW5vcyBLYW1wYW5ha2lzIChwa2FtcGFuYSkmcXVvdDsgJmx0OzxhIGhyZWY9 Im1haWx0bzpwa2FtcGFuYUBjaXNjby5jb20iPnBrYW1wYW5hQGNpc2NvLmNvbTwvYT4mZ3Q7PGJy Pg0KPGI+RGF0ZTogPC9iPlR1ZXNkYXksIEp1bHkgMzAsIDIwMTkgYXQgMzozNyBQTTxicj4NCjxi PlRvOiA8L2I+JnF1b3Q7U2NvdHQgRmx1aHJlciAoc2ZsdWhyZXIpJnF1b3Q7ICZsdDs8YSBocmVm PSJtYWlsdG86c2ZsdWhyZXJAY2lzY28uY29tIj5zZmx1aHJlckBjaXNjby5jb208L2E+Jmd0Oywg JnF1b3Q7Jmx0OzxhIGhyZWY9Im1haWx0bzp0bHNAaWV0Zi5vcmciPnRsc0BpZXRmLm9yZzwvYT4m Z3Q7JnF1b3Q7ICZsdDs8YSBocmVmPSJtYWlsdG86dGxzQGlldGYub3JnIj50bHNAaWV0Zi5vcmc8 L2E+Jmd0Ozxicj4NCjxiPlN1YmplY3Q6IDwvYj5SZTogW1RMU10gT3B0aW9ucyBmb3IgbmVnb3Rp YXRpbmcgaHlicmlkIGtleSBleGNoYW5nZXMgZm9yIHBvc3RxdWFudHVtPG86cD48L286cD48L3Nw YW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdp bi1sZWZ0Oi41aW4iPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PHNwYW4gc3R5bGU9ImNvbG9yOiMxRjQ5 N0QiPiYjNDM7MSBmb3Igb3B0aW9uIDIuIFRoZSBjb21iaW5hdG9yaWMgZXhwbG9zaW9uIGFuZCBj b21wbGV4aXR5IG9mIDEgaXMgdW5uZWNlc3NhcnkuIEkgZXhwZWN0IHRoYXQganVzdCBhIGZldywg Y29uc2VydmF0aXZlLCBhY2NlcHRhYmx5IGVmZmljaWVudCwgY2xhc3NpY2FsJiM0MztQUSBjb21i aW5hdGlvbnMgbmVlZCB0byBiZSBzdGFuZGFyZGl6ZWQNCiBhbmQgdXNlZC4gQ29tYmluaW5nIGEg Y2xhc3NpY2FsIGFsZ28gd2l0aCBtb3JlIHRoYW4gb25lIHBvc3RxdWFudHVtIGFsZ29yaXRobXMg aW4gYSBrZXkgZXhjaGFuZ2UgZG9lcyBub3Qgc2VlbSBwcmFjdGljYWwgYmFzZWQgb24gdGhlIFBR IGNhbmRpZGF0ZXMga2V5IHNpemVzIGFuZCBwZXJmb3JtYW5jZS48L3NwYW4+PG86cD48L286cD48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PHNwYW4g c3R5bGU9ImNvbG9yOiMxRjQ5N0QiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48c3BhbiBzdHlsZT0iY29s b3I6IzFGNDk3RCI+UGFub3M8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PHNwYW4gc3R5bGU9ImNvbG9yOiMxRjQ5N0Qi PiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtYXJnaW4tbGVmdDouNWluIj48c3BhbiBzdHlsZT0iY29sb3I6IzFGNDk3RCI+Jm5ic3A7PC9z cGFuPjxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRl ci10b3A6c29saWQgI0UxRTFFMSAxLjBwdDtwYWRkaW5nOjMuMHB0IDBpbiAwaW4gMGluIj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48Yj5Gcm9tOjwvYj4g VExTICZsdDs8YSBocmVmPSJtYWlsdG86dGxzLWJvdW5jZXNAaWV0Zi5vcmciPnRscy1ib3VuY2Vz QGlldGYub3JnPC9hPiZndDsNCjxiPk9uIEJlaGFsZiBPZiA8L2I+U2NvdHQgRmx1aHJlciAoc2Zs dWhyZXIpPGJyPg0KPGI+U2VudDo8L2I+IFR1ZXNkYXksIEp1bHkgMzAsIDIwMTkgMTE6MjEgQU08 YnI+DQo8Yj5Ubzo8L2I+ICZsdDs8YSBocmVmPSJtYWlsdG86dGxzQGlldGYub3JnIj50bHNAaWV0 Zi5vcmc8L2E+Jmd0OyAmbHQ7PGEgaHJlZj0ibWFpbHRvOnRsc0BpZXRmLm9yZyI+dGxzQGlldGYu b3JnPC9hPiZndDs8YnI+DQo8Yj5TdWJqZWN0OjwvYj4gW1RMU10gT3B0aW9ucyBmb3IgbmVnb3Rp YXRpbmcgaHlicmlkIGtleSBleGNoYW5nZXMgZm9yIHBvc3RxdWFudHVtPG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0 Oi41aW4iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1hcmdpbi1sZWZ0Oi41aW4iPkR1cmluZyB0aGUgcGh5c2ljYWwgbWVldGluZyBpbiBNb250cmVh bCwgd2UgaGFkIGEgZGlzY3Vzc2lvbiBhYm91dCBwb3N0cXVhbnR1bSBzZWN1cml0eSwgYW5kIGlu IHBhcnRpY3VsYXIsIG9uIGhvdyBvbmUgbWlnaHQgd2FudCB0byBuZWdvdGlhdGUgc2V2ZXJhbCBk aWZmZXJlbnQg4oCYZ3JvdXBz4oCZIHNpbXVsdGFuZW91c2x5IChiZWNhdXNlIHRoZXJlIG1pZ2h0 IG5vdCBiZQ0KIG9uZSBncm91cCB0aGF0IGlzIGVudGlyZWx5IHRydXN0ZWQsIGFuZCBJIHB1dCDi gJhncm91cHPigJkgaW4gc2NhcmVxdW90ZXMgYmVjYXVzZSBwb3N0cXVhbnR1bSBrZXkgZXhjaGFu Z2VzIGFyZSB0eXBpY2FsbHkgbm90IGZvcm1lZCBmcm9tIGEgRGlmZmllLUhlbGxtYW4gZ3JvdXAp LjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0 Oi41aW4iPjxzcGFuIGxhbmc9IkVOLUdCIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PHNwYW4gbGFuZz0i RU4tR0IiPkF0IHRoZSBtZWV0aW5nLCB0aGVyZSB3ZXJlIHR3byBvcHRpb25zIHByZXNlbnRlZDo8 L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2lu LWxlZnQ6LjVpbiI+PHNwYW4gbGFuZz0iRU4tR0IiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48c3BhbiBs YW5nPSJFTi1HQiI+T3B0aW9uIDE6IGFzIHRoZSBzdXBwb3J0ZWQgZ3JvdXAsIHdlIGluc2VydCBh IOKAmGh5YnJpZCBtYXJrZXLigJkgKGFuZCBpbmNsdWRlIGFuIGV4dGVuc2lvbiB0aGF0IG1hcCBs aXN0cyB3aGljaCBjb21iaW5hdGlvbiB0aGUgaHlicmlkIG1hcmtlciBzdGFuZHMgZm9yKTwvc3Bh bj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVm dDouNWluIj48c3BhbiBsYW5nPSJFTi1HQiI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7IEZvciBleGFtcGxlLCB0aGUgY2xpZW50IG1pZ2h0IGxpc3QgaW4gaGlzIHN1cHBvcnRlZCBn cm91cHMgaHlicmlkX21hcmtlcl8wIGFuZCBoeWJyaWRfbWFya2VyXzEsIGFuZCB0aGVyZSB3b3Vs ZCBiZSBhIHNlcGFyYXRlIGV4dGVuc2lvbiB0aGF0IGxpc3RzIGh5YnJpZF9tYXJrZXJfMCA9IFgy NTUxOSAmIzQzOyBTSUtFcDQzNA0KIGFuZCBoeWJyaWRfbWFya2VyXzEgPSBYMjU1MTkgJiM0Mzsg TlRSVVBSNjUzLiZuYnNwOyBUaGUgc2VydmVyIHdvdWxkIHRoZW4gbG9vayB1cCB0aGUgbWVhbmlu Z3Mgb2YgaHlicmlkX21hcmtlcl8wIGFuZCAxIGluIHRoZSBleHRlbnNpb24sIGFuZCB0aGVuIGNv bXBhcmUgdGhhdCBhZ2FpbnN0IGhpcyBzZWN1cml0eSBwb2xpY3kuPC9zcGFuPjxvOnA+PC9vOnA+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW47dGV4dC1p bmRlbnQ6LjVpbiI+PHNwYW4gbGFuZz0iRU4tR0IiPkluIHRoaXMgb3B0aW9uLCB3ZSB3b3VsZCBh c2sgSUFOQSB0byBhbGxvY2F0ZSBjb2RlIHBvaW50cyBmb3IgdGhlIHZhcmlvdXMgaW5kaXZpZHVh bCBwb3N0cXVhbnR1bSBrZXkgZXhjaGFuZ2VzIChpbiB0aGlzIGV4YW1wbGUsIFNJS0VwNDM0IGFu ZCBOVFJVUFI2NTMpLCBhcyB3ZWxsIGEgcmFuZ2Ugb2YgY29kZQ0KIHBvaW50cyBmb3IgdGhlIHZh cmlvdXMgaHlicmlkX21hcmtlcnMuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxzcGFuIGxhbmc9IkVOLUdCIj4mbmJz cDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFy Z2luLWxlZnQ6LjVpbiI+PHNwYW4gbGFuZz0iRU4tR0IiPk9wdGlvbiAyOiB3ZSBoYXZlIGNvZGUg cG9pbnRzIGZvciBhbGwgdGhlIHZhcmlvdXMgY29tYmluYXRpb25zIHRoYXQgd2UgbWF5IHdhbnQg dG8gc3VwcG9ydDsgaGVuY2UgSUFOQSBtaWdodCBhbGxvY2F0ZSBhIGNvZGUgcG9pbnQgWDI1NTE5 X1NJS0VwNDM0IGFuZCBhbm90aGVyIGNvZGUgcG9pbnQgZm9yIFgyNTUxOV9OVFJVUFI2NTMuJm5i c3A7DQogV2l0aCB0aGlzIG9wdGlvbiwgdGhlIGNsaWVudCB3b3VsZCBsaXN0IFgyNTUxOV9TSUtF cDQzNCBhbmQgWDI1NTE5X05UUlVQUjY1MyBpbiB0aGVpciBzdXBwb3J0ZWQgZ3JvdXBzLjwvc3Bh bj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVm dDouNWluIj48c3BhbiBsYW5nPSJFTi1HQiI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7IEluIHRoaXMgb3B0aW9uLCB3ZSB3b3VsZCBhc2sgSUFOQSB0byBhbGxvY2F0ZSBjb2RlIHBv aW50cyBmb3IgYWxsIHRoZSB2YXJpb3VzIGNvbWJpbmF0aW9ucyB0aGF0IHdlIHdhbnQgYWxsb3cg dG8gYmUgbmVnb3RpYXRlZC48L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PHNwYW4gbGFuZz0iRU4tR0IiPiZuYnNwOzwv c3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4t bGVmdDouNWluIj48c3BhbiBsYW5nPSJFTi1HQiI+SSB3b3VsZCBsaWtlIHRvIG1ha2UgYW4gYXJn dW1lbnQgaW4gZmF2b3Igb2Ygb3B0aW9uIDE6PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxzcGFuIGxhbmc9IkVOLUdC Ij4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTGlzdFBhcmFncmFw aCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluO3RleHQtaW5kZW50Oi0uMjVpbjttc28tbGlzdDps MCBsZXZlbDEgbGZvMiI+DQo8IVtpZiAhc3VwcG9ydExpc3RzXT48c3BhbiBzdHlsZT0ibXNvLWxp c3Q6SWdub3JlIj4tPHNwYW4gc3R5bGU9ImZvbnQ6Ny4wcHQgJnF1b3Q7VGltZXMgTmV3IFJvbWFu JnF1b3Q7Ij4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsNCjwvc3Bhbj48L3NwYW4+PCFbZW5kaWZdPjxzcGFuIGxhbmc9IkVOLUdCIj5JdCBpcyBs aWtlbHkgdGhhdCBub3QgZXZlcnlvbmUgd2lsbCBiZSBzYXRpc2lmaWVkIHdpdGgg4oCcWDI1NTE5 IHBsdXMgb25lIG9mIGEgaGFuZGZ1bCBvZiBzcGVjaWZpYyBwb3N0cXVhbnR1bSBhbGdvcml0aG1z 4oCdOyBzb21lIG1heSBwcmVmZXIgYW5vdGhlciBlbGxpcHRpYyBjdXJ2ZSAoZm9yIGV4YW1wbGUs IHg0NDgpLCBvciBwZXJoYXBzIGV2ZW4gYSBNT0RQIGdyb3VwOyBJDQogaGF2ZSB0YWxrZWQgdG8g cGVvcGxlIHdobyBkbyBub3QgdHJ1c3QgRUNDKTsgaW4gYWRkaXRpb24sIG90aGVyIHBlb3BsZSBt aWdodCBub3QgdHJ1c3QgYSBzaW5nbGUgcG9zdHF1YW50dW0gYWxnb3JpdGhtLCBhbmQgbWF5IHdh bnQgdG8gcmVseSBvbiBib3RoIChmb3IgZXhhbXBsZSkgU0lLRSBhbmQgTmV3SG9wZSAod2hpY2gg YXJlIGJhc2VkIG9uIHZlcnkgZGlmZmVyZW50IGhhcmQgcHJvYmxlbXMpLiZuYnNwOyBXaXRoIG9w dGlvbiAyLCB3ZSBjb3VsZCB0cnkNCiB0byBhbnRpY2lwYXRlIGFsbCB0aGUgY29tbW9uIGNvbWJp bnRhdGlvbnMgKHN1Y2ggYXMgUDM4NF9TSUtFcDQzNF9ORVdIT1BFNTEyQ0NBKSwgaG93ZXZlciB0 aGF0IGNvdWxkIHZlcnkgd2VsbCBlbmQgdXAgYXMgYSBsb3Qgb2YgY29tYmluYXRpb25zLjwvc3Bh bj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBoIiBzdHlsZT0ibWFy Z2luLWxlZnQ6MS4waW47dGV4dC1pbmRlbnQ6LS4yNWluO21zby1saXN0OmwwIGxldmVsMSBsZm8y Ij4NCjwhW2lmICFzdXBwb3J0TGlzdHNdPjxzcGFuIHN0eWxlPSJtc28tbGlzdDpJZ25vcmUiPi08 c3BhbiBzdHlsZT0iZm9udDo3LjBwdCAmcXVvdDtUaW1lcyBOZXcgUm9tYW4mcXVvdDsiPiZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOw0KPC9zcGFu Pjwvc3Bhbj48IVtlbmRpZl0+PHNwYW4gbGFuZz0iRU4tR0IiPlRoZXJlIGFyZSBsaWtlbHkgdG8g YmUgc2V2ZXJhbCBOSVNULWFwcHJvdmVkIHBvc3RxdWFudHVtIGtleSBleGNoYW5nZXMsIGFuZCBl YWNoIG9mIHRob3NlIGtleSBleGNoYW5nZXMgYXJlIGxpa2VseSB0byBoYXZlIGEgbnVtYmVyIG9m IHN1cHBvcnRlZCBwYXJhbWV0ZXIgc2V0cyAoaWYgd2UgdGFrZSB0aGUgc3BlY2lmaWMgcG9zdHF1 YW50dW0ga2V5IGV4Y2hhbmdlIGFzIGFuYWxvZ291cw0KIHRvIHRoIEVDREggcHJvdG9jb29sLCB0 aGUg4oCccGFyYW1ldGVyIHNldOKAnSBjb3VsZCBiZSB0aG91Z2h0IG9mIGFuIGFuYWxvZ291cyB0 byB0aGUgc3BlY2lmaWMgZWxsaXB0dWMgY3VydmUsIGFuZCBpdCBtb2RpZmllcyB0aGUga2V5IHNo YXJlIHNpemUsIHRoZSBwZXJmb3JtYW5jZSBhbmQgc29tZXRpbWVzIHRoZSBzZWN1cml0eSBwcm9w ZXJ0aWVzKS4mbmJzcDsgSW4gZmFjdCwgb25lIG9mIHRoZSBOSVNUIHN1Ym1pc3NvaW5zIGN1cnJl bnRseSBoYXMgMzAgcGFyYW1ldGVyDQogc2V0cyBkZWZpbmVkLiZuYnNwOyBIZW5jZSwgZXZlbiBp ZiBOSVNUIGRvZXNu4oCZdCBhcHByb3ZlIGFsbCB0aGUgcGFyYW1ldGVyIHNldHMgKG9yIHNvbWUg b2YgdGhlbSBkbyBub3QgbWFrZSBzZW5zZSBmb3IgVExTIGluIGFueSBzY2VuYXJpbyksIHdlIG1p Z2h0IGVuZCB1cCB3aXRoIDIwIG9yIG1vcmUgZGlmZmVyZW50IGtleSBleGNoYW5nZS9wYXJhbWV0 ZXIgc2V0IGNvbWJpbmF0aW9ucyB0aGF0IGRvIG1ha2Ugc2Vuc2UgZm9yIHNvbWUgc2NlbmFyaW8g dGhhdA0KIHVzZXMgdExTIChiZSBpdCBpbiBhIHRyYW5kaXRpb25hbCBQQyBjbGllbnQvc2VydmVy LCBhIHdpcmVsZXNzIGNsaWVudCwgdHdvIGNsb3VkIGRldmljZXMgY29tbXVuaWNhdGluZyBvciBh biBJT1QgZGV2aWNlKS48L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTGlzdFBh cmFncmFwaCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluO3RleHQtaW5kZW50Oi0uMjVpbjttc28t bGlzdDpsMCBsZXZlbDEgbGZvMiI+DQo8IVtpZiAhc3VwcG9ydExpc3RzXT48c3BhbiBzdHlsZT0i bXNvLWxpc3Q6SWdub3JlIj4tPHNwYW4gc3R5bGU9ImZvbnQ6Ny4wcHQgJnF1b3Q7VGltZXMgTmV3 IFJvbWFuJnF1b3Q7Ij4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsNCjwvc3Bhbj48L3NwYW4+PCFbZW5kaWZdPjxzcGFuIGxhbmc9IkVOLUdCIj5J biBhZGRpdGlvbiwgd2UgYXJlIGxpa2VseSB0byBzdXBwb3J0IGFkZGl0aW9uYWwgcHJpbWl0aXZl cyBpbiB0aGUgZnV0dXJlOyBwb3NzaWJseSBOYXRpb25hbCBjdXJ2ZXMgKGUuZy4gQnJhaW5wb29s KSwgb3IgYWRkaXRpb25hbCBQb3N0cXVhbnR1bSBhbGdvcml0aG1zIChvciBhZGRpdGlvbmFsIHBh cmFtZXRlciBzZXRzIHRvIGV4aXN0aW5nIG9uZXMpLiZuYnNwOyBPZiBjb3Vyc2UsDQogb25jZSB3 ZSBhZGQgdGhhdCBjb2RlIHBvaW50LCB3ZeKAmWxsIG5lZWQgdG8gYWRkIHRoZSBhZGRpdGlvbmFs IGNvZGUgcG9pbnRzIGZvciBhbGwgdGhlIGNvbWJpbmF0aW9ucyB0aGF0IGl04oCZbGwgbWFrZSBz ZW5zZSBpbiAodmVyeSBtdWNoIGxpa2Ugd2UgaGFkIHRvIGFkZCBhIG51bWJlciBvZiBjaXBoZXJz dWl0ZXMgd2hlbmV2ZXIgd2UgYWRkZWQgYSBuZXcgZW5jcnlwdGlvbiBhbGdvcml0aG0gaW50byBU TFMgMS4yKS48L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PHNwYW4gbGFuZz0iRU4tR0IiPiZuYnNwOzwvc3Bhbj48bzpw PjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWlu Ij48c3BhbiBsYW5nPSJFTi1HQiI+SXQgc2VlbWRzIHJlYXNvbmFibGUgdG8gbWUgdGhhdCB0aGUg Y29tYmluYXRpb24gb2YgdGhlc2UgdHdvIGZhY3RvcnMgYXJlIGxpa2VseSB0byBjYXVzZSB1cyAo c2hvdWxkIHdlIHNlbGVjdCBvcHRpb24gMikgdG8gZGVmaW5lIGEgdmVyeSBsYXJnZSBudW1iZXIg b2YgY29kZSBwb2ludHMgdG8gY292ZXIgYWxsIHRoZSB2YXJpb3VzIG9wdGlvbnMNCiB0aGF0IHBl b3BsZSBuZWVkLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtYXJnaW4tbGVmdDouNWluIj48c3BhbiBsYW5nPSJFTi1HQiI+Jm5ic3A7PC9zcGFuPjxv OnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41 aW4iPjxzcGFuIGxhbmc9IkVOLUdCIj5Ob3csIHRoaXMgaXMgYmFzZWQgb24gc3BlY3VsYXRpb24g KGJvdGggb2YgdGhlIE5JU1QgcHJvY2VzcywgYW5kIGFkZGl0aW9uYWwgcHJpbWl0aXZlcyB0aGF0 IHdpbGwgYmUgYWRkZWQgdG8gdGhlIHByb3RvY29sKSwgYW5kIG9uZSBvYmplY3Rpb24gSeKAmXZl IGhlYXJkIGlzIOKAnHdlIGRvbuKAmXQga25vdyB3aGF04oCZcyBnb2luZyB0byBoYXBwZW4sDQog YW5kIHNvIHdoeSB3b3VsZCB3ZSBtYWtlIGRlY2lzaW9ucyBiYXNlZCBvbiB0aGlzIHNwZWN1bGF0 aW9uP+KAnSZuYnNwOyBJIGFncmVlIHRoYXQgd2UgaGF2ZSBsYWNrIG9mIGtub3dsZWRnZTsgaG93 ZXZlciBpdCBzZWVtcyB0byBtZSB0aGF0IGEgbGFjayBvZiBrbm93bGVkZ2UgaXMgYW4gYXJndW1l bnQgaW4gZmF2b3Igb2Ygc2VsZWN0aW5nIHRoZSBtb3JlIGZsZXhpYmxlIG9wdGlvbiAod2hpY2gs IGluIG15IG9waW5pb24sIGlzIG9wdGlvbiAxLCBhcyBpdA0KIGFsbG93cyB0aGUgbmVnb3RpYXRp b24gb2YgY29tYmluYXRpb25zIG9mIGtleSBleGNoYW5nZXMgdGhhdCB0aGUgV0cgaGFzIG5vdCBh bnRpY2lwYXRlZCkuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPk15IHBsZWE6IGxldHMgbm90IHJl cGVhdCB0aGUgVExTIDEuMiBjaXBoZXJzdWl0ZSBtZXNzOyBsZXRzIGFkZCBhbiBleHRlbnNpb24g dGhhdCBrZWVwcyB0aGUgbnVtYmVyIG9mIGNvZGUgcG9pbnRzIHdlIG5lZWQgdG8gYSByZWFzb25h YmxlIGJvdW5kLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1h cmdpbi1sZWZ0Oi41aW4iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPlRoZSBjb3N0cyBvZiBvcHRpb24gMT88bzpwPjwv bzpwPjwvcD4NCjxwIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBoIiBzdHlsZT0ibWFyZ2luLWxlZnQ6 MS4waW47dGV4dC1pbmRlbnQ6LS4yNWluO21zby1saXN0OmwwIGxldmVsMSBsZm8yIj4NCjwhW2lm ICFzdXBwb3J0TGlzdHNdPjxzcGFuIHN0eWxlPSJtc28tbGlzdDpJZ25vcmUiPi08c3BhbiBzdHls ZT0iZm9udDo3LjBwdCAmcXVvdDtUaW1lcyBOZXcgUm9tYW4mcXVvdDsiPiZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOw0KPC9zcGFuPjwvc3Bhbj48 IVtlbmRpZl0+SXQgZG9lcyBpbmNyZWFzZSB0aGUgY29tcGxleGl0eSBvbiB0aGUgc2VydmVyIGEg c21hbGwgYW1vdW50IChJ4oCZbSBub3QgYSBUTFMgaW1wbGVtZW50b3IsIGhvd2V2ZXIgaXQgd291 bGQgc2VlbSB0byBtZSB0byBiZSBvbmx5IGEgZmFpcmx5IHNtYWxsIGFtb3VudCk8bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBoIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4w aW47dGV4dC1pbmRlbnQ6LS4yNWluO21zby1saXN0OmwwIGxldmVsMSBsZm8yIj4NCjwhW2lmICFz dXBwb3J0TGlzdHNdPjxzcGFuIHN0eWxlPSJtc28tbGlzdDpJZ25vcmUiPi08c3BhbiBzdHlsZT0i Zm9udDo3LjBwdCAmcXVvdDtUaW1lcyBOZXcgUm9tYW4mcXVvdDsiPiZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOw0KPC9zcGFuPjwvc3Bhbj48IVtl bmRpZl0+SXQgbWF5IGluY3JlYXNlIHRoZSBzaXplIG9mIHRoZSBjbGllbnQgaGVsbG8gYSBzbWFs bCBhbW91bnQgKG9uIHRoZSBvdGhlciBoYW5kLCBiZWNhdXNlIGl0IGFsbG93cyB1cyB0byBhdm9p ZCBzZW5kaW5nIGR1cGxpY2F0ZSBrZXkgc2hhcmVzLCBpdCBjYW4gYWxzbyByZWR1Y2UgdGhlIHNp emUgb2YgdGhlIGNsaWVudCBoZWxsbyBhcyB3ZWxsLCBkZXBlbmRpbmcgb24gd2hhdOKAmXMgYWN0 dWFsbHkgbmVnb3RpYXRlZCk8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtYXJnaW4tbGVmdDouNWluIj5JTUhPLCB0aGUgc21hbGwgaW5jcmVhc2UgaW4gY29tcGxl eGl0eSBpcyB3b3J0aCB0aGUgbGFjayBvZiBjb21wbGV4aXR5IGluIHRoZSBjb2RlIHBvaW50IHRh YmxlLCBhbmQgdGhlIGFkZGl0aW9uYWwgZmxleGliaWxpdHkgaXQgZ2l2ZXMuPG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ib2R5Pg0KPC9odG1sPg0K --_000_MN2PR11MB3871499BC2DFB34F6064299BC1DC0MN2PR11MB3871namp_-- From nobody Tue Jul 30 13:20:14 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CEFB3120024 for ; Tue, 30 Jul 2019 13:20:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.5 X-Spam-Level: X-Spam-Status: No, score=-14.5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=QAjekeK1; dkim=pass (1024-bit key) header.d=cisco.onmicrosoft.com header.b=MCF3bOso Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iHsk32wRRYu8 for ; Tue, 30 Jul 2019 13:20:10 -0700 (PDT) Received: from rcdn-iport-4.cisco.com (rcdn-iport-4.cisco.com [173.37.86.75]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 094C312001A for ; Tue, 30 Jul 2019 13:20:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=3516; q=dns/txt; s=iport; t=1564518009; x=1565727609; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-transfer-encoding:mime-version; bh=QLf24tAcri98XNCSBHgYfGD0ZxpZDZY9vqEdr/MYhZA=; b=QAjekeK1BU7dMFy5g0JXbMwqbZJQ7cnOWRvjaHaHMlODNTieieOSPQk2 f1MQxN8rlj2SIXGTBzGXMtqbAimuoojPLEdYKIYk0eQCHI966YBOAuWe6 y30Y0KUDmHLB3FYZ2mCM97dwi6BoGe9vi0LX1jEvjfJyuMBvYv2UOFp8c w=; IronPort-PHdr: =?us-ascii?q?9a23=3A1/+9jRdo+JFWIDNl75WBJ9WBlGMj4e+mNxMJ6p?= =?us-ascii?q?chl7NFe7ii+JKnJkHE+PFxlwGQD57D5adCjOzb++D7VGoM7IzJkUhKcYcEFn?= =?us-ascii?q?pnwd4TgxRmBceEDUPhK/u/dCI+AcRYWUVN9HCgOk8TE8H7NBXf?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0B8AAC2pUBd/5NdJa1lGQEBAQEBAQE?= =?us-ascii?q?BAQEBAQcBAQEBAQGBZ4FEUAOBQiAECyoKhBSDRwONBoJbfohWjgCCUgNUCQE?= =?us-ascii?q?BAQwBAS0CAQGEQAIXgisjOBMBAwEBBAEBAgEGbYUeDIVKAQEBAQIBEhERDAE?= =?us-ascii?q?BNwELBAIBCBEEAQEBAgImAgICHxEVCAgBAQQBDQUIGoRrAw4PAaFeAoE4iGB?= =?us-ascii?q?xgTKCegEBBYUJDQuCEwmBDCiLYBeBQD+BEUaCFwcuPoIagiwVgnQygiaOfpt?= =?us-ascii?q?DQAkCghqLCYUWhBKYEY09iUGOGQIEAgQFAg4BAQWBZyGBWHAVO4JsgkIMBRK?= =?us-ascii?q?DTopTcoEpjCwBgSABAQ?= X-IronPort-AV: E=Sophos;i="5.64,327,1559520000"; d="scan'208";a="607790101" Received: from rcdn-core-11.cisco.com ([173.37.93.147]) by rcdn-iport-4.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 30 Jul 2019 20:20:04 +0000 Received: from XCH-ALN-008.cisco.com (xch-aln-008.cisco.com [173.36.7.18]) by rcdn-core-11.cisco.com (8.15.2/8.15.2) with ESMTPS id x6UKK2Sa006147 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL); Tue, 30 Jul 2019 20:20:03 GMT Received: from xhs-rcd-002.cisco.com (173.37.227.247) by XCH-ALN-008.cisco.com (173.36.7.18) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Tue, 30 Jul 2019 15:20:01 -0500 Received: from xhs-aln-003.cisco.com (173.37.135.120) by xhs-rcd-002.cisco.com (173.37.227.247) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Tue, 30 Jul 2019 15:20:01 -0500 Received: from NAM02-SN1-obe.outbound.protection.outlook.com (173.37.151.57) by xhs-aln-003.cisco.com (173.37.135.120) with Microsoft SMTP Server (TLS) id 15.0.1473.3 via Frontend Transport; Tue, 30 Jul 2019 15:20:01 -0500 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=aU1BR42PpwczBsmJQtOmZg57Dndv5dQm1NbkIyvvLzdZXJiug6vWav+hKWLlNFruHsByrS2ZpEUehwx+EhPjG26XFWUmCb7pQgNqjhzTmnL7dFaxLa1Q1Wf1vzDeGs/pSewlmcuZBD+JJBhrz5v+PLsmXgX9pHgmSzPZiyNIQMJlfLvczKXVkdNBD7zJMRCvqpCooSKajS8K+kOl80e8WFfd5R6WANQVfUAlXHJ61yAegrAWLZ4KZer6eT3JdWwj8bQt2uiq6RLTjluvW2iFIA0v9pjyu7eNZDjb6vgr0S6JfMd9IilcfUdWPmhvbr/vt3OAD5wnfg0IV7/ZWE+bTg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=QLf24tAcri98XNCSBHgYfGD0ZxpZDZY9vqEdr/MYhZA=; b=gwaThj2x481ci565heK49zt26DzvmMngYQhj9f3eqS8kRcVpPxSspEEot04JtJD/PicaQJa8DMd1L8bAS34fyzbIiiBhTItPCDcBsA2vrn97OxYZGG87HUdA7VqMPXZ8kLCMssYSPel+3JFscfQOHMX2YFrZYEuAyMA09TKZGpmbc6FTB7c2KzvTOBWx01A6qh8mTMlZqxLYOKfe7P1EKZpkFEFPyaClWP64i3OSjKTkBZkumP9ffb5ar5/3Mdm1sBeLYutmYX4GK80SK5cBS7KdhaEYSGAn96cmCVsYDKLypWkt3ZqGZmM6BeUTdUve3F1+c8FhC/UGQ5+iOBb3mA== ARC-Authentication-Results: i=1; mx.microsoft.com 1;spf=pass smtp.mailfrom=cisco.com;dmarc=pass action=none header.from=cisco.com;dkim=pass header.d=cisco.com;arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector2-cisco-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=QLf24tAcri98XNCSBHgYfGD0ZxpZDZY9vqEdr/MYhZA=; b=MCF3bOsoKiGmI73P6Hk5n1qq7u61PajoBoDzYZ7r3wdv/+m0iHG5ZG+XZJ+dtn6G0iuaTdbSt6GYOPx6V4qe+mz/68EajE1j3jccVGCVDV17qGR/50vu8YcyU9A3Iq2vLZp6C75vg3MU5Pa26IqwaQwe+T0g6HsDT9um0kr1WbU= Received: from MN2PR11MB3871.namprd11.prod.outlook.com (10.255.180.204) by MN2PR11MB4125.namprd11.prod.outlook.com (20.179.150.150) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2115.13; Tue, 30 Jul 2019 20:19:59 +0000 Received: from MN2PR11MB3871.namprd11.prod.outlook.com ([fe80::4c5:965:c7b7:387b]) by MN2PR11MB3871.namprd11.prod.outlook.com ([fe80::4c5:965:c7b7:387b%3]) with mapi id 15.20.2115.005; Tue, 30 Jul 2019 20:19:59 +0000 From: "Scott Fluhrer (sfluhrer)" To: Stephen Farrell , Watson Ladd CC: TLS List Thread-Topic: [TLS] Options for negotiating hybrid key exchanges for postquantum Thread-Index: AdVG1haOE+yO4N1wQQSyYtQ5VKKSwAAHEKmAAAOq4EAAA9c6AAAAqcNw Date: Tue, 30 Jul 2019 20:19:59 +0000 Message-ID: References: <663791e0-1a2a-27cd-f1c7-20658eb0b9f5@cs.tcd.ie> In-Reply-To: <663791e0-1a2a-27cd-f1c7-20658eb0b9f5@cs.tcd.ie> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=sfluhrer@cisco.com; x-originating-ip: [173.38.117.65] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: d64522e9-8595-4299-877a-08d7152b4bfe x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:MN2PR11MB4125; x-ms-traffictypediagnostic: MN2PR11MB4125: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-forefront-prvs: 0114FF88F6 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(4636009)(396003)(366004)(39860400002)(136003)(376002)(346002)(189003)(199004)(13464003)(4326008)(81166006)(66556008)(486006)(33656002)(6436002)(81156014)(9686003)(6116002)(55016002)(6246003)(2906002)(110136005)(66066001)(53936002)(478600001)(476003)(99286004)(8936002)(26005)(5660300002)(14444005)(8676002)(7696005)(66446008)(256004)(53546011)(52536014)(186003)(229853002)(316002)(3846002)(102836004)(14454004)(71190400001)(86362001)(76176011)(66476007)(296002)(25786009)(76116006)(305945005)(6506007)(68736007)(446003)(64756008)(71200400001)(66946007)(74316002)(11346002)(7736002); DIR:OUT; SFP:1101; SCL:1; SRVR:MN2PR11MB4125; H:MN2PR11MB3871.namprd11.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: cisco.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: DUnaz3ByS8tsiSmj4Qry2cBMg8Aqx/SQOverAl/dU4Uchq4grQla9DQ1tJJbxLqep2Wa2taLB0Oi7YTGwWsXb+O+IaQjWQpZPrt963yuP+nhM2D4MkzmcrsXjyYOSOSy4rgLw8XV7Y9kOmn/q3tQWRlUSO8Oo/KkRRbhdPLywaOisige/X+DCSzrkQl7rCOyTjzgAyUTMlIc1SqLABw9J+YqVHqKGszUK89dfIJupIG6wwSEwRdhLFvjFDb77x9twb7K7S1x4VlhEsg46MSthF+SrZ2TmD0Ee3bjtdcVy22FkhV85yvmLuPxhnh7Qbo2Si8jaiitxcmyYA3mE8uPpEDE2/1hNb9z0B7x5YIU72FCLVYm5iPaNGR7w34NeX+KfULtZXOTwILuB5IUzDL0zXwrQ/89oyNWcTDNLORL83M= Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: d64522e9-8595-4299-877a-08d7152b4bfe X-MS-Exchange-CrossTenant-originalarrivaltime: 30 Jul 2019 20:19:59.6814 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: sfluhrer@cisco.com X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN2PR11MB4125 X-OriginatorOrg: cisco.com X-Outbound-SMTP-Client: 173.36.7.18, xch-aln-008.cisco.com X-Outbound-Node: rcdn-core-11.cisco.com Archived-At: Subject: Re: [TLS] Options for negotiating hybrid key exchanges for postquantum X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 30 Jul 2019 20:20:12 -0000 PiAtLS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0tLQ0KPiBGcm9tOiBTdGVwaGVuIEZhcnJlbGwgPHN0 ZXBoZW4uZmFycmVsbEBjcy50Y2QuaWU+DQo+IFNlbnQ6IFR1ZXNkYXksIEp1bHkgMzAsIDIwMTkg Mzo1MyBQTQ0KPiBUbzogU2NvdHQgRmx1aHJlciAoc2ZsdWhyZXIpIDxzZmx1aHJlckBjaXNjby5j b20+OyBXYXRzb24gTGFkZA0KPiA8d2F0c29uYmxhZGRAZ21haWwuY29tPg0KPiBDYzogVExTIExp c3QgPHRsc0BpZXRmLm9yZz4NCj4gU3ViamVjdDogUmU6IFtUTFNdIE9wdGlvbnMgZm9yIG5lZ290 aWF0aW5nIGh5YnJpZCBrZXkgZXhjaGFuZ2VzIGZvcg0KPiBwb3N0cXVhbnR1bQ0KPiANCj4gDQo+ IEknbSBuZXV0cmFsIGFzIHRvIGhvdyB3ZSByZXByZXNlbnQgdGhpcyBzdHVmZiBmb3IgdGhlIG1v bWVudCBhcyBJIHRoaW5rIGl0J3MNCj4gdG9vIGVhcmx5IHRvIHRlbGwgdW50aWwgd2UgZ2V0IGNs b3NlciB0byB0aGUgZW5kIG9mIHRoZSBhbGdvcml0aG1zIGNvbXBldGl0aW9uLg0KDQpJJ20gb2Yg dGhlIG9wcG9zaXRlIG9waW5pb247IEkgdGhpbmsgaXQgaXMgaW1wb3J0YW50IHRvIGdldCB0aGlz IHNldHRsZWQgYmVmb3JlIChvciBhdCB0aGUgdGltZSkgdGhlIGFsZ29yaXRobSBjb21wZXRpdGlv biBlbmRzLiAgSSByZWFsbHkgd291bGRuJ3Qgd2FudCB0byBzZWUgdXMgd2FpdCBmb3IgTklTVCB0 byBzZXR0bGUgb24gKHNheSkgU0lLRSBhbmQgTmV3SG9wZSwgYW5kIHRoZW4gaGF2ZSB1cyBzcGVu ZCBhbm90aGVyIHllYXIgb3IgdHdvIGRlYmF0aW5nIG9uIGhvdyB0byBpbnRlZ3JhdGUgdGhlbSBp bnRvIG91ciBwcm90b2NvbHMuICBJbnN0ZWFkLCBJIHdvdWxkIHJhdGhlciBzcGVuZCB0aGUgeWVh ciBvciB0d28gbm93ICh3aGVuIHdlJ3JlIG5vdCBvbiB0aGUgY3JpdGljYWwgcGF0aCkuDQoNCk5v dywgdGhlcmUgYXJlIGNlcnRhaW5seSB0aGluZ3Mgd2UgZG9uJ3Qga25vdyB5ZXQgYWJvdXQgdGhl IHJlc3VsdHMgb2YgdGhlIGNvbXBldGl0aW9uIChob3cgbWFueSBhbGdvcml0aG1zLCB3aGF0IHR5 cGVzIG9mIHBhcmFtZXRlciBzZXRzLCB3aGF0IHNpemVzIG9mIGtleSBzaGFyZXMgZG8gdGhleSBo YXZlKTsgaG93ZXZlciAoYmFzZWQgb24gdGhlIGN1cnJlbnQgcm91bmQgMiBzdWJtaXNzaW9ucykg d2UgY2FuIGNlcnRhaW5seSBoYXZlIHNvbWUgaW5mb3JtZWQgc3VzcGljaW9ucy4uLg0KDQo+IA0K PiBUaGF0IHNhaWQsIEkgZG8gd2FudCB0byBzZWNvbmQgdGhpcy4uLg0KPiANCj4gT24gMzAvMDcv MjAxOSAxOTo0MSwgU2NvdHQgRmx1aHJlciAoc2ZsdWhyZXIpIHdyb3RlOg0KPiA+IEhlcmUgaXMg b25lIG9waW5pb24gKG1pbmUsIGJ1dCBJJ20gcHJldHR5IHN1cmUgaXQgaXMgc2hhcmVkIGJ5DQo+ ID4gb3RoZXJzKTogdGhlIHZhcmlvdXMgTklTVCBjYW5kaWRhdGVzIGFyZSBiYXNlZCBvbiBoYXJk IHByb2JsZW1zIHRoYXQNCj4gPiB3ZXJlIG9ubHkgcmVjZW50bHkgc3R1ZGllZCAoZS5nLiBzdXBl cnNpbmd1bGFyIGlzb2dlbmllcywgUXVhc2ljeWNsaWMNCj4gPiBjb2RlcyksIG9yIGhhdmUgY3J5 cHRhbmFseXRpYyBtZXRob2RzIHRoYXQgYXJlIHF1aXRlIGRpZmZpY3VsdCB0bw0KPiA+IGZ1bGx5 IGFzc2VzcyAoZS5nLiBMYXR0aWNlcykuICBFdmVuIGFmdGVyIE5JU1QgYW5kIENGUkcgaGF2ZSBi bGVzc2VkDQo+ID4gb25lIG9yIG1vcmUgb2YgdGhlbSwgaXQgd291bGQgc2VlbSByZWFzb25hYmxl IHRvIG1lIHRoYXQgd2Ugd291bGRuJ3QNCj4gPiB3YW50IHRvIHBsYWNlIGFsbCBvdXIgc2VjdXJp dHkgZWdncyBpbiB0aGF0IG9uZSBiYXNrZXQuICBXZSBjdXJyZW50bHkNCj4gPiBwbGFjZSBhbGwg b3VyIHRydXN0IGluIERIIG9yIEVDREg7IGhvd2V2ZXIgdGhvc2UgaGF2ZSBiZWVuIHN0dWRpZWQg Zm9yDQo+ID4gMzArIHllYXJzIC0gd2UgYXJlIG5vdCB0aGVyZSB5ZXQgZm9yIG1vc3Qgb2YgdGhl IHBvc3RxdWFudHVtDQo+ID4gYWxnb3JpdGhtcy4NCj4gPg0KPiA+IEhlbmNlLCBpdCBzZWVtcyBy ZWFzb25hYmxlIHRvIG1lIHRoYXQgd2UgZ2l2ZSB1c2VycyB0aGUgb3B0aW9uIG9mDQo+ID4gYmVp bmcgYWJsZSB0byByZWx5IG9uIG11bHRpcGxlIG1ldGhvZHMuDQo+IFRoZSBvbmx5IHBlcnNvbiB3 aXRoIHdob20gSSd2ZSBzcG9rZW4gd2hvIHNhaWQgaGUnZCBwbGFuIHRvIGRlcGxveSBzb21lDQo+ IG9mIHRoaXMgc29vbiBpcyBhIFZQTiBvcGVyYXRvciB3aG8gZXhwbGljaXRseSB3YW50ZWQgdG8g c3RhcnQgZWFybHkgYW5kIHVzZSA+MQ0KPiBQUSBzY2hlbWUgKDMtNCBpcyB3aGF0IGhlDQo+IHNh aWQpIHBsdXMgYSBjdXJyZW50IHNjaGVtZS4gSGlzIGV4cGVjdGF0aW9uIHdhcyB0aGF0IHRoYXQn ZCBzZXR0bGUgZG93biB0bw0KPiBvbmUgUFEgc2NoZW1lLCBvciBvbmUgUFEgYW5kIGEgY3VycmVu dCBvbmUsIGluIHRpbWUsIGJ1dCB0aGF0IHRpbWUgbWF5IGJlIGENCj4gZGVjYWRlIGFmdGVyIGhl J2QgbGlrZSB0byBzdGFydC4NCj4gDQo+IFNvLCB0byB0aGUgZXh0ZW50IGl0IG1hdHRlcnMsIGNv dW50IG1lIGFzIGEgKzEgZm9yIHN1cHBvcnRpbmcgdGhhdC4NCj4gDQo+IENoZWVycywNCj4gUy4N Cg0K From nobody Tue Jul 30 13:20:48 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5C9CF12022A for ; Tue, 30 Jul 2019 13:20:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=akamai.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GTnHphNQEavq for ; Tue, 30 Jul 2019 13:20:40 -0700 (PDT) Received: from mx0a-00190b01.pphosted.com (mx0a-00190b01.pphosted.com [IPv6:2620:100:9001:583::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0CC1D12026D for ; Tue, 30 Jul 2019 13:20:39 -0700 (PDT) Received: from pps.filterd (m0122333.ppops.net [127.0.0.1]) by mx0a-00190b01.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id x6UKHOPX031609; Tue, 30 Jul 2019 21:20:33 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=akamai.com; h=date : from : to : cc : subject : message-id : references : mime-version : content-type : content-transfer-encoding : in-reply-to; s=jan2016.eng; bh=E+KfUowO/1Dm1aE0LFEAiKUotROKBFmGozqAQ46S5jY=; b=WN7W9MI9kAP5TJKUUoiil/s+GLgTSrMnFzKOzf9FC6vagp+oBtG/eCQbZ5Dv5HFJmjFb APFmgJ+m7/qvLn38AQ4Bx0T6PqX8imDOUNZqPfgAIbO6Or9ZMc2FCItU+ByE2kiW5vxE vgaNXwBf2J15iqxt9ltGrl5AELswr0mLIenA0fjUGYCQ+HR8Bg+6xa2eEGiO2BsXUytb qIyjwqIsWNQoXihGASIWHNTHvn0X3NuSs7x6Uy0po8erEkg2npGUGP9UR9YDyJSx83RB izwdzptaMqK2cDt5jkXt4/59HabkAjWW8c07GEKVYKgYnnxp7u6j44ovx2zw25f0dblT 5w== Received: from prod-mail-ppoint3 (prod-mail-ppoint3.akamai.com [96.6.114.86] (may be forged)) by mx0a-00190b01.pphosted.com with ESMTP id 2u0dv65tq2-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 30 Jul 2019 21:20:33 +0100 Received: from pps.filterd (prod-mail-ppoint3.akamai.com [127.0.0.1]) by prod-mail-ppoint3.akamai.com (8.16.0.27/8.16.0.27) with SMTP id x6UKHnVV010795; Tue, 30 Jul 2019 16:20:32 -0400 Received: from prod-mail-relay14.akamai.com ([172.27.17.39]) by prod-mail-ppoint3.akamai.com with ESMTP id 2u0hy0f836-1; Tue, 30 Jul 2019 16:20:31 -0400 Received: from bos-lpczi.kendall.corp.akamai.com (bos-lpczi.kendall.corp.akamai.com [172.19.17.86]) by prod-mail-relay14.akamai.com (Postfix) with ESMTP id 5766181422; Tue, 30 Jul 2019 20:20:26 +0000 (GMT) Received: from bkaduk by bos-lpczi.kendall.corp.akamai.com with local (Exim 4.86_2) (envelope-from ) id 1hsYbg-0008KQ-FU; Tue, 30 Jul 2019 15:20:24 -0500 Date: Tue, 30 Jul 2019 15:20:24 -0500 From: Benjamin Kaduk To: "Scott Fluhrer (sfluhrer)" Cc: Andrei Popov , David Benjamin , Watson Ladd , TLS List Message-ID: <20190730202023.GB21846@akamai.com> References: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: User-Agent: Mutt/1.5.24 (2015-08-30) X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-07-30_10:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 mlxscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1906280000 definitions=main-1907300206 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:5.22.84,1.0.8 definitions=2019-07-30_10:2019-07-29,2019-07-30 signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 clxscore=1011 lowpriorityscore=0 mlxscore=0 suspectscore=0 bulkscore=0 mlxlogscore=999 malwarescore=0 adultscore=0 priorityscore=1501 spamscore=0 phishscore=0 impostorscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-1906280000 definitions=main-1907300206 Archived-At: Subject: Re: [TLS] Options for negotiating hybrid key exchanges for postquantum X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 30 Jul 2019 20:20:47 -0000 On Tue, Jul 30, 2019 at 07:44:13PM +0000, Scott Fluhrer (sfluhrer) wrote: > I believe that one important property (of either of the options I listed) is a nice fallback if an enhanced client talks to an older server. In both cases, the server will see a series of named groups that it doesn’t know (which it will ignore), and possibility an extension it doesn’t know (which it will ignore); the server will accept either a named group that it does understand (if the client did propose a traditional group as a fall back), or it will come to the correct conclusion that the two sides have no mutually acceptable security policy. > > It is not clear if the proposal you outlined share this property; do you duplicate a payload that an unenhanced server would assume only occurs once? It's clear that anything we do needs to preserve compat with all four possibilities in the interop matrix for (old, enhanced) (client, server). Your closing note about duplicating payloads is something of a different creature, though, and perhaps should be considered more explicitly. Trying to uplevel a bit, option 1 is essentially introducing another layer of indirection, with the need to carry the additional lookup table on the side. This has the disadvantages of both needing the extra layer of indirection and also can have unfortunate impact from needing the extra table on the side in more places than is immediately obvious (i.e., the ESNI case that David mentioned). The perceived benefit is that we allocate fewer codepoints, avoid duplicating some KeyShare information, and maybe get increased flexibility about how we combine schemes. In contrast, option 2 is more smoothly integrated into the existing negotiation mechanism, but has the potential costs of allocating more codepoints and duplicating some KeyShare information. But, what are the KeyShare bits that will get duplicated? If we're just doing "X25519 plus one post-quantum", only the X25519 share gets duplicated, even if we want to do several different post-quantum options in "X25519 plus one post-quantum" form. And X25519 shares are pretty small, all things considered! I'd find the concern about duplicated KeyShares more compelling if we think we're going to end up needing to negotiate between (X25519 plus PQ1 plus PQ2) and (X25519 plus PQ2 plus PQ3) and (X25519 plus PQ1 plus PQ2 plus PQ3), where the PS shares add up fast. It's not clear that the ecosystem will end up in a place where we need to do the latter. -Ben From nobody Tue Jul 30 15:37:03 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B197212007C for ; Tue, 30 Jul 2019 15:37:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.25 X-Spam-Level: X-Spam-Status: No, score=-9.25 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.249, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_SPF_WL=-7.5] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=chromium.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SWUaw6kfPCpt for ; Tue, 30 Jul 2019 15:37:00 -0700 (PDT) Received: from mail-qt1-x834.google.com (mail-qt1-x834.google.com [IPv6:2607:f8b0:4864:20::834]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 618C712006F for ; Tue, 30 Jul 2019 15:37:00 -0700 (PDT) Received: by mail-qt1-x834.google.com with SMTP id a15so64597295qtn.7 for ; Tue, 30 Jul 2019 15:37:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=48jT7V+3I8/uspIXB5RxmiU1PFh8QQs2AbVF3VSs3EI=; b=CmNkmptKVCIA/SfHafb9HkvaxaW/b1tSWUMg4yrExYmC70cgemFQ/tBXOF0i2FGOBC kTMghXwFEZ8qqPr4x0Aw3nCPKvEjqlkYfTO2HYncgrnQKZutFI+fcy7eG2tduIfQj/RQ /U3xZnhfbZjcukAaox47N6hCdVDzMMGmgov6w= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=48jT7V+3I8/uspIXB5RxmiU1PFh8QQs2AbVF3VSs3EI=; b=ndV8kekeqDfC9sCa52DiWYkNGwC33UN4A0CZCxPFvKAsEopwgua05sTQ3Sc059rg3s zKoBq9PBlaZH0kUG4EZcHK5yT9Z4K0u6V/v4r1Xqi07YP/J5KU+xnrGClsgX2HScWQKf +AH1sCf5IVcp3ndh5SQ126ry6teUStzJ0mTZn37I+2WGDzMY0Lf///TJk7wPH29cl9p8 vcROxfFzA68ujeB3MCQFPoHG4Me2EORmwEjC5p2oNScI92ys4Qmn4+0y1lvl1hVOtFDV PTs7FNSj2ceNVGYO2rLVLGamCUuxbA11N6fD8h6X0RvjyINSJofVFSmatk+SlscZ8JDr t+yg== X-Gm-Message-State: APjAAAUN0bvJkYc3N/eOXeHuDqobSp8VSdrtMCydDcAvqUXQa9hsRvuz TuXXQXce49J+zX8YTEvo+o3ndsNTwKqqieI/2kfBa0g= X-Google-Smtp-Source: APXvYqwwd4AAWDeJZGyk39XDjtWmW0YoUkgDcqdMktSH5oN5NXQHASuz0pErAlqAFiQnhWLzb5p6hD8oF9tWEYeV560= X-Received: by 2002:a0c:b786:: with SMTP id l6mr85360034qve.148.1564526219251; Tue, 30 Jul 2019 15:36:59 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: David Benjamin Date: Tue, 30 Jul 2019 18:36:43 -0400 Message-ID: To: Chris Inacio Cc: "TLS@ietf.org" Content-Type: multipart/alternative; boundary="0000000000008ac388058eeda564" Archived-At: Subject: Re: [TLS] Adoption call for draft-lvelvindron-tls-md5-sha1-deprecate X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 30 Jul 2019 22:37:03 -0000 --0000000000008ac388058eeda564 Content-Type: text/plain; charset="UTF-8" I'm in favor of adoption. On Wed, Jul 24, 2019 at 11:28 AM Chris Inacio wrote: > Favor of adoption. > > > > On July 24, 2019 at 8:49:22 AM, Christopher Wood (caw@heapingbits.net) > wrote: > > At TLS@IETF105, there was interest in the room to adopt > draft-lvelvindron-tls-md5-sha1-deprecate as a WG item. The draft can be > found here: > > https://datatracker.ietf.org/doc/draft-lvelvindron-tls-md5-sha1-deprecate/ > > This email starts the call for adoption. It will run until August 7, 2019. > Please indicate whether or not you would like to see this draft adopted. > > Best, > Chris, on behalf of the chairs > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > --0000000000008ac388058eeda564 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
I'm in favor of adoption.

On Wed, Jul 24, 2019 at 11:28= AM Chris Inacio <inacio@cert.org= > wrote:
Favor of adoption= .



On July 24, 2019 at 8:4= 9:22 AM, Christopher Wood (caw@heapingbits.net) wrote:

At TLS@IETF105, there was interest in the room to adopt draft-lvelvind= ron-tls-md5-sha1-deprecate as a WG item. The draft can be found here:

https://datatracker.ietf.org/doc/draft-lvelvi= ndron-tls-md5-sha1-deprecate/

This email starts the call for adoption. It will run until August 7, 2019. = Please indicate whether or not you would like to see this draft adopted.

Best,
Chris, on behalf of the chairs

_______________________________________________
TLS mailing list
TLS@ietf.org
htt= ps://www.ietf.org/mailman/listinfo/tls
_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls
--0000000000008ac388058eeda564-- From nobody Tue Jul 30 17:31:51 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 90D2312011B for ; Tue, 30 Jul 2019 17:31:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=lowentropy.net header.b=Hn+bB7IA; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=M/ssZSXw Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id H3mfdicmbYF0 for ; Tue, 30 Jul 2019 17:31:48 -0700 (PDT) Received: from wout5-smtp.messagingengine.com (wout5-smtp.messagingengine.com [64.147.123.21]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EC5F512008B for ; Tue, 30 Jul 2019 17:31:47 -0700 (PDT) Received: from compute1.internal (compute1.nyi.internal [10.202.2.41]) by mailout.west.internal (Postfix) with ESMTP id 2F7DE569 for ; Tue, 30 Jul 2019 20:31:47 -0400 (EDT) Received: from imap2 ([10.202.2.52]) by compute1.internal (MEProxy); Tue, 30 Jul 2019 20:31:47 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lowentropy.net; h=mime-version:message-id:in-reply-to:references:date:from:to :subject:content-type; s=fm2; bh=ipMojqy3iyGFqpzKf6cT+eeRJqjWJr4 2oSobUs594ks=; b=Hn+bB7IAeAfyek7zTodkTx1HNirqvqokRvOLiyEEpNleeFh JVTbrLfo7k0wAI+6DhnFNnbVXRYgcObp5SEuWnDumpHkCZWA5yeRw57sFSev/ySC eBD3dqGyiWIJsSRyofOudNChcoR0OSewVyM0UaGOUl7fkHGEFhrCtztTBwI9yFJA 4nqIKVrxZvbflbWA8zeRolK4KAIa1Zb1oaL97MDnFcCnE8IsAIixLevc9hLDnAQy NZnxUmd7NyBNu7lstNna1IDnSa2bDzMPe37/FZwlOGmti/8VrP6OlcNjnfMCMpJr dqhWwSWTjM4fJ/aphUaRX2fJrvLlnemuuGeo96g== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-proxy :x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm3; bh=ipMojq y3iyGFqpzKf6cT+eeRJqjWJr42oSobUs594ks=; b=M/ssZSXwGWH3TEodWi31lz z83VehYGWWroF4JNHu0HLUgHq2m4qkb5KFIe0EnzlURwHol6bvCTvVrcsqmFsuX5 VTYvm+B4sBa301r/0kHnCKWwkGTeDxrhPqRrlvuPrT4GhHaNd5/EV9t+BH9LPo2u ORwQV+IWR+V9wt7qQI6heLyd0dkTrcVMRPHUo1X1l/utDZzltxvT5ueYREuapEst +e5mOusMUicjaUsZaJNOeFX2B+O83itKK5+5gKKiADprXI6HjPuEOxnnH/hwkKm3 IX9w0xB+VbLzJ3RvOnxhM+cSXNu0z9PMW5FghouOSPppxofiSNS0izqUMQ9id8+Q == X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeduvddrleeggdefiecutefuodetggdotefrodftvf curfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfghnecu uegrihhlohhuthemuceftddtnecunecujfgurhepofgfggfkjghffffhvffutgesthdtre dtreerjeenucfhrhhomhepfdforghrthhinhcuvfhhohhmshhonhdfuceomhhtsehlohif vghnthhrohhphidrnhgvtheqnecurfgrrhgrmhepmhgrihhlfhhrohhmpehmtheslhhofi gvnhhtrhhophihrdhnvghtnecuvehluhhsthgvrhfuihiivgeptd X-ME-Proxy: Received: by mailuser.nyi.internal (Postfix, from userid 501) id 445FFE00A7; Tue, 30 Jul 2019 20:31:46 -0400 (EDT) X-Mailer: MessagingEngine.com Webmail Interface User-Agent: Cyrus-JMAP/3.1.6-799-g925e343-fmstable-20190729v1 Mime-Version: 1.0 Message-Id: <681b10d7-f404-4573-a60f-22d9239ccb0c@www.fastmail.com> In-Reply-To: <20190730202023.GB21846@akamai.com> References: <20190730202023.GB21846@akamai.com> Date: Wed, 31 Jul 2019 10:31:47 +1000 From: "Martin Thomson" To: tls@ietf.org Content-Type: text/plain Archived-At: Subject: Re: [TLS] =?utf-8?q?Options_for_negotiating_hybrid_key_exchanges_for?= =?utf-8?q?_postquantum?= X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 31 Jul 2019 00:31:50 -0000 On Wed, Jul 31, 2019, at 06:21, Benjamin Kaduk wrote: > It's clear that anything we do needs to preserve compat with all four > possibilities in the interop matrix for (old, enhanced) (client, > server). Your closing note about duplicating payloads is something of a > different creature, though, and perhaps should be considered more > explicitly. Adam directly addressed that concern at the meeting; and others agreed. 25519 shares are small enough that worrying about duplication isn't necessary. The delta is tiny when considering the need to additionally signal combinatorics in the scheme imagined by Option 1. So I'd like to add my voice to those in support of buttoning down a single scheme (i.e., Option 2). The cost of the added indirection is significant. I'll take the addition of a few bytes to the ClientHello over that any time. The other arguments all assume that we'll fail to narrow the parameter set or number of options. My view is that deciding on a single parameter set is not just desirable, but necessary. My experience suggests that clients won't want to expend the resources necessary to create and send two PQ shares. No PQ scheme that I've seen are close enough in terms of efficiency - bytes or CPU - to allow for multiple shares to be offered. Option 2 also allows us to defer the combination method. While I imagine that concatenation will be injective for most schemes, which might be sufficient, we might want to change the combination method as we learn more. Option 2 allows us to include a definition for how secrets produced by each scheme are merged into the key schedule for each combination. From nobody Tue Jul 30 20:54:48 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CDE0C12008A for ; Tue, 30 Jul 2019 20:54:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.5 X-Spam-Level: X-Spam-Status: No, score=-17.5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ihaK5cjnrSnZ for ; Tue, 30 Jul 2019 20:54:44 -0700 (PDT) Received: from mail-io1-xd35.google.com (mail-io1-xd35.google.com [IPv6:2607:f8b0:4864:20::d35]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 65D7412002E for ; Tue, 30 Jul 2019 20:54:44 -0700 (PDT) Received: by mail-io1-xd35.google.com with SMTP id m24so133255474ioo.2 for ; Tue, 30 Jul 2019 20:54:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=WuqyGS8+ab6dorTAhUW8EHs8lwJvRUv+lCCekE/38GY=; b=ARZ17mFW0A8TrBA8ABMJ5HHElbgbEShfhXrPOExi/lTtSTt01K28HxsWiL8mtfm9wI gWMkksTqXAh5uQxd/ktAjNL40t7/f7qluQuDBMw4Y2jiQSRmR/ZXww49gXPhqwI1t7kD u9mxk9LpRlkip9kurCcg5Z47GrNqexj82liYbw2X2YC4wQghB+A3k4RZzeZCkxI7UoX/ khccd8uy0vvIeroPKRiMdKX8Ui409R7eHBLsWzT/hWicTWmPIlXJHsD98Q/r3bV3zyns pSXmHKBas2ZVntHIhfCmhXOTRq3onSjg5HWFbKqlwVl3df8gFPaVFSDT/kASuEH3FFpk o56Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=WuqyGS8+ab6dorTAhUW8EHs8lwJvRUv+lCCekE/38GY=; b=tM1dFCTk9xZeYeiyzFwnxIkjucX9gYZ+Tdsn6ig0D5dNpFUKJuWFlrCMoSw6PdWam7 PLSjM/64QqBTDW7Z4V6631gP7nQzygGPpbUADagowPRP4Qvvg81jXCcnULgianUfheQK ekm+ds4P4VhBnnZOsKJ43XSlCiNBWH/dEaFO3Zp/B+28WCN/gPyVDpl3UNEDUbYa/RBT u0EEf2sYVV09DeIPkWXAYr1xLJ8jxWjNdU68OAmRgK4t95sPtzW7DfX0oSeAqoHxQnaC uhAe6NmnkFUgkjXAcQ5miNSNGT3ZE/6KNTKXCFTBXiSKa1zeCw9IVhp2cBr5PJJdbSZc /X8A== X-Gm-Message-State: APjAAAV5qsH9Y4YP0mf9Cs8hKLIshlHI8sZSyyeRDlfH0Y2aveY9h7lb c0ltzlxCbNdwljP+XzYqF3wjL2RCMeJ6J1tPvNG1Gw== X-Google-Smtp-Source: APXvYqwHfkgqcnvfuOVR0WL5qwr2w1zfOvndXNENQuLr5L0FjRpVO21wMhMqpysIf95P9c+uuCk1ZDNB39C6W8uqwkY= X-Received: by 2002:a6b:5a17:: with SMTP id o23mr3295324iob.41.1564545283273; Tue, 30 Jul 2019 20:54:43 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Ben Schwartz Date: Tue, 30 Jul 2019 23:54:30 -0400 Message-ID: To: David Benjamin Cc: "" Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="000000000000e0c6ac058ef21528" Archived-At: Subject: Re: [TLS] Drafts for batch signing and PKCS#1 v1.5 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 31 Jul 2019 03:54:47 -0000 --000000000000e0c6ac058ef21528 Content-Type: multipart/alternative; boundary="000000000000d8b50b058ef215a6" --000000000000d8b50b058ef215a6 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable The batch signing idea is very cool. I'm not entirely sure I understand the intended use case, though. The intro suggests that this motivated by DoS defense, but presumably an attacker who controls their own TLS client stack could simply omit support for these signature schemes. Do you envision a future where servers can safely omit support for all the non-batch signature schemes? Or are you thinking of attackers who don't control the TLS client stack? Minor question: in the tree diagrams, m2 goes to t04. Is there any reason it couldn't go directly to t12? That would seem more natural to me. On Tue, Jul 30, 2019 at 3:09 PM David Benjamin wrote: > Oops. draft-davidben-tls-batch-signing-00 cites > draft-davidben-http2-tls13-00. That should be > draft-davidben-tls13-pkcs1-00. (The XML file took a really long time to b= e > created, so I manually tried to recreate it based on another file and > forgot to update one of the fields..) I'll fix this in -01. > > On Mon, Jul 29, 2019 at 8:15 PM David Benjamin > wrote: > >> Hi all, >> >> I=E2=80=99ve just uploaded a pair of drafts relating to signatures in TL= S 1.3. >> https://tools.ietf.org/html/draft-davidben-tls13-pkcs1-00 >> https://tools.ietf.org/html/draft-davidben-tls-batch-signing-00 >> >> The first introduces optional legacy codepoints for PKCS#1 v1.5 >> signatures with client certificates. This is unfortunate, but I think we >> should do it. On the Chrome side, we=E2=80=99ve encountered some headach= es with the >> TLS 1.3 PSS requirement which are unique to client certificates. The >> document describes the motivations in detail. >> >> The second describes a batch signing mechanism for TLS using Merkle >> trees. It allows TLS clients and servers to better handle signing load. = I >> think it could be beneficial for a number of DoS and remote key scenario= s. >> >> Thoughts? >> >> David >> > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > --000000000000d8b50b058ef215a6 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
The batch signing idea is very cool.=C2=A0 I'm not ent= irely sure I understand the intended use case, though.=C2=A0 The intro sugg= ests that this motivated by DoS defense, but presumably an attacker who con= trols their own TLS client stack could simply omit support for these signat= ure schemes.=C2=A0 Do you envision a future where servers can safely omit s= upport for all the non-batch signature schemes?=C2=A0 Or are you thinking o= f attackers who don't control the TLS client stack?

= Minor question: in the tree diagrams, m2 goes to t04.=C2=A0 Is there any re= ason it couldn't go directly to t12?=C2=A0 That would seem more natural= to me.

On Tue, Jul 30, 2019 at 3:09 PM David Benjamin <davidben@chromium.org> wrote:
Oops. d= raft-davidben-tls-batch-signing-00=C2=A0cites draft-davidben-http2-tls13-00= . That should be draft-davidben-tls13-pkcs1-00. (The XML file took a really= long time to=C2=A0be created, so I manually tried to recreate it based on = another file and forgot to update one of the fields..) I'll fix this in= -01.

On Mon, Jul 29, 2019 at 8:15 PM David Benjamin <davidben@chromium.org> w= rote:
Hi all,

I=E2=80=99ve just uploaded a pair of drafts relatin= g to signatures in TLS 1.3.
https://tools.ietf.org/html/dra= ft-davidben-tls13-pkcs1-00
https://tools.ietf.org= /html/draft-davidben-tls-batch-signing-00

The first introduces o= ptional legacy codepoints for PKCS#1 v1.5 signatures with client certificat= es. This is unfortunate, but I think we should do it. On the Chrome side, w= e=E2=80=99ve encountered some headaches with the TLS 1.3 PSS requirement wh= ich are unique to client certificates. The document describes the motivatio= ns in detail.

The second describes a batch signing mechanism for TLS= using Merkle trees. It allows TLS clients and servers to better handle sig= ning load. I think it could be beneficial for a number of DoS and remote ke= y scenarios.

Thoughts?

David
_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls
--000000000000d8b50b058ef215a6-- --000000000000e0c6ac058ef21528 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIIS5wYJKoZIhvcNAQcCoIIS2DCCEtQCAQExDzANBglghkgBZQMEAgEFADALBgkqhkiG9w0BBwGg ghBNMIIEXDCCA0SgAwIBAgIOSBtqDm4P/739RPqw/wcwDQYJKoZIhvcNAQELBQAwZDELMAkGA1UE BhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVy c29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hBMjU2IC0gRzIwHhcNMTYwNjE1MDAwMDAwWhcNMjEw NjE1MDAwMDAwWjBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xvYmFsU2lnbiBudi1zYTEiMCAG A1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC AQoCggEBALR23lKtjlZW/17kthzYcMHHKFgywfc4vLIjfq42NmMWbXkNUabIgS8KX4PnIFsTlD6F GO2fqnsTygvYPFBSMX4OCFtJXoikP2CQlEvO7WooyE94tqmqD+w0YtyP2IB5j4KvOIeNv1Gbnnes BIUWLFxs1ERvYDhmk+OrvW7Vd8ZfpRJj71Rb+QQsUpkyTySaqALXnyztTDp1L5d1bABJN/bJbEU3 Hf5FLrANmognIu+Npty6GrA6p3yKELzTsilOFmYNWg7L838NS2JbFOndl+ce89gM36CW7vyhszi6 6LqqzJL8MsmkP53GGhf11YMP9EkmawYouMDP/PwQYhIiUO0CAwEAAaOCASIwggEeMA4GA1UdDwEB /wQEAwIBBjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwEgYDVR0TAQH/BAgwBgEB/wIB ADAdBgNVHQ4EFgQUyzgSsMeZwHiSjLMhleb0JmLA4D8wHwYDVR0jBBgwFoAUJiSSix/TRK+xsBtt r+500ox4AAMwSwYDVR0fBEQwQjBAoD6gPIY6aHR0cDovL2NybC5nbG9iYWxzaWduLmNvbS9ncy9n c3BlcnNvbmFsc2lnbnB0bnJzc2hhMmcyLmNybDBMBgNVHSAERTBDMEEGCSsGAQQBoDIBKDA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzANBgkqhkiG 9w0BAQsFAAOCAQEACskdySGYIOi63wgeTmljjA5BHHN9uLuAMHotXgbYeGVrz7+DkFNgWRQ/dNse Qa4e+FeHWq2fu73SamhAQyLigNKZF7ZzHPUkSpSTjQqVzbyDaFHtRBAwuACuymaOWOWPePZXOH9x t4HPwRQuur57RKiEm1F6/YJVQ5UTkzAyPoeND/y1GzXS4kjhVuoOQX3GfXDZdwoN8jMYBZTO0H5h isymlIl6aot0E5KIKqosW6mhupdkS1ZZPp4WXR4frybSkLejjmkTYCTUmh9DuvKEQ1Ge7siwsWgA NS1Ln+uvIuObpbNaeAyMZY0U5R/OyIDaq+m9KXPYvrCZ0TCLbcKuRzCCBB4wggMGoAMCAQICCwQA AAAAATGJxkCyMA0GCSqGSIb3DQEBCwUAMEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAt IFIzMRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWduMB4XDTExMDgwMjEw MDAwMFoXDTI5MDMyOTEwMDAwMFowZDELMAkGA1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24g bnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVyc29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hB MjU2IC0gRzIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCg/hRKosYAGP+P7mIdq5NB Kr3J0tg+8lPATlgp+F6W9CeIvnXRGUvdniO+BQnKxnX6RsC3AnE0hUUKRaM9/RDDWldYw35K+sge C8fWXvIbcYLXxWkXz+Hbxh0GXG61Evqux6i2sKeKvMr4s9BaN09cqJ/wF6KuP9jSyWcyY+IgL6u2 52my5UzYhnbf7D7IcC372bfhwM92n6r5hJx3r++rQEMHXlp/G9J3fftgsD1bzS7J/uHMFpr4MXua eoiMLV5gdmo0sQg23j4pihyFlAkkHHn4usPJ3EePw7ewQT6BUTFyvmEB+KDoi7T4RCAZDstgfpzD rR/TNwrK8/FXoqnFAgMBAAGjgegwgeUwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8C AQEwHQYDVR0OBBYEFCYkkosf00SvsbAbba/udNKMeAADMEcGA1UdIARAMD4wPAYEVR0gADA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzA2BgNVHR8E LzAtMCugKaAnhiVodHRwOi8vY3JsLmdsb2JhbHNpZ24ubmV0L3Jvb3QtcjMuY3JsMB8GA1UdIwQY MBaAFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQACAFVjHihZCV/IqJYt 7Nig/xek+9g0dmv1oQNGYI1WWeqHcMAV1h7cheKNr4EOANNvJWtAkoQz+076Sqnq0Puxwymj0/+e oQJ8GRODG9pxlSn3kysh7f+kotX7pYX5moUa0xq3TCjjYsF3G17E27qvn8SJwDsgEImnhXVT5vb7 qBYKadFizPzKPmwsJQDPKX58XmPxMcZ1tG77xCQEXrtABhYC3NBhu8+c5UoinLpBQC1iBnNpNwXT Lmd4nQdf9HCijG1e8myt78VP+QSwsaDT7LVcLT2oDPVggjhVcwljw3ePDwfGP9kNrR+lc8XrfClk WbrdhC2o4Ui28dtIVHd3MIIDXzCCAkegAwIBAgILBAAAAAABIVhTCKIwDQYJKoZIhvcNAQELBQAw TDEgMB4GA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjMxEzARBgNVBAoTCkdsb2JhbFNpZ24x EzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDkwMzE4MTAwMDAwWhcNMjkwMzE4MTAwMDAwWjBMMSAw HgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMzETMBEGA1UEChMKR2xvYmFsU2lnbjETMBEG A1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMwldpB5Bngi FvXAg7aEyiie/QV2EcWtiHL8RgJDx7KKnQRfJMsuS+FggkbhUqsMgUdwbN1k0ev1LKMPgj0MK66X 17YUhhB5uzsTgHeMCOFJ0mpiLx9e+pZo34knlTifBtc+ycsmWQ1z3rDI6SYOgxXG71uL0gRgykmm KPZpO/bLyCiR5Z2KYVc3rHQU3HTgOu5yLy6c+9C7v/U9AOEGM+iCK65TpjoWc4zdQQ4gOsC0p6Hp sk+QLjJg6VfLuQSSaGjlOCZgdbKfd/+RFO+uIEn8rUAVSNECMWEZXriX7613t2Saer9fwRPvm2L7 DWzgVGkWqQPabumDk3F2xmmFghcCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQF MAMBAf8wHQYDVR0OBBYEFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQBL QNvAUKr+yAzv95ZURUm7lgAJQayzE4aGKAczymvmdLm6AC2upArT9fHxD4q/c2dKg8dEe3jgr25s bwMpjjM5RcOO5LlXbKr8EpbsU8Yt5CRsuZRj+9xTaGdWPoO4zzUhw8lo/s7awlOqzJCK6fBdRoyV 3XpYKBovHd7NADdBj+1EbddTKJd+82cEHhXXipa0095MJ6RMG3NzdvQXmcIfeg7jLQitChws/zyr VQ4PkX4268NXSb7hLi18YIvDQVETI53O9zJrlAGomecsMx86OyXShkDOOyyGeMlhLxS67ttVb9+E 7gUJTb0o2HLO02JQZR7rkpeDMdmztcpHWD9fMIIEZDCCA0ygAwIBAgIMB/CJK1MgpV83jiIZMA0G CSqGSIb3DQEBCwUAMEwxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMSIw IAYDVQQDExlHbG9iYWxTaWduIEhWIFMvTUlNRSBDQSAxMB4XDTE5MDMxMzA4MjIxOVoXDTE5MDkw OTA4MjIxOVowIjEgMB4GCSqGSIb3DQEJAQwRYmVtYXNjQGdvb2dsZS5jb20wggEiMA0GCSqGSIb3 DQEBAQUAA4IBDwAwggEKAoIBAQCsphkGEsCh0fF4+6Wsi1u40JxI6W6Izew+dLGK4b93LCRAuJ8y g9wSnwGAtk9/23VmtKwBrMaJD5j9SVZpscvLAjrWwADl/THU22uTW0MsUE2fPOPv2s4hE+vMgRmK P2E+xpI6n0gFvn8qrUHO1dm6PJaP5SWa+zdB/Ja1LgMJTpevQqjK4LKjWmHFPR6CplS4RImjGk7U 0I6invTyQnL5p583t5PI7FcM5UyjAqxGEETdAuc7N4IqjNETvPwL0wLIzxPDA5PMqcWPSzg7sBAB LVUQRYNIAJPlVpUdg1IeAjil5BaaWBjEeCLBSGDFX3WaWfMNzQvRZr4i6oJxzV+1AgMBAAGjggFu MIIBajAcBgNVHREEFTATgRFiZW1hc2NAZ29vZ2xlLmNvbTBQBggrBgEFBQcBAQREMEIwQAYIKwYB BQUHMAKGNGh0dHA6Ly9zZWN1cmUuZ2xvYmFsc2lnbi5jb20vY2FjZXJ0L2dzaHZzbWltZWNhMS5j cnQwHQYDVR0OBBYEFFSy8ovdLNSQc8aqxOgKS7sBOm/UMB8GA1UdIwQYMBaAFMs4ErDHmcB4koyz IZXm9CZiwOA/MEwGA1UdIARFMEMwQQYJKwYBBAGgMgEoMDQwMgYIKwYBBQUHAgEWJmh0dHBzOi8v d3d3Lmdsb2JhbHNpZ24uY29tL3JlcG9zaXRvcnkvMDsGA1UdHwQ0MDIwMKAuoCyGKmh0dHA6Ly9j cmwuZ2xvYmFsc2lnbi5jb20vZ3NodnNtaW1lY2ExLmNybDAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0l BBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMA0GCSqGSIb3DQEBCwUAA4IBAQCbQ++Znz6xh85ZlZEN Y/vAF0vn111O0c2houe4LlLQkoQ1QS4fH5EYcBx/393FTq5n08ezWYVtmeQ6W15e34CqjYNop1Vh mihZ+3J6+LL/6YNi91cp5yMFgxOP9aI/Y8IaIWZJAY2e8yHbYSq0z8kka0H6S4VvFjwtRogkWW95 0SStEwo/8viJ02BwpmVj4YIA6Fva1ZbeN2TnUMCAHJAlKWOGlpHxpcdcWckED0XbSY9w6bllMw1T tsbiUwQxDeO++Y8NfS8rieZgfv3RlobKihE8xbIVGRHIq1gup4nXv6XDwHDYyGhafIfUD4Ix00Wk gnODGb+jPwoQlDX0X64qMYICXjCCAloCAQEwXDBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xv YmFsU2lnbiBudi1zYTEiMCAGA1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMQIMB/CJK1Mg pV83jiIZMA0GCWCGSAFlAwQCAQUAoIHUMC8GCSqGSIb3DQEJBDEiBCCQ748a8wC7/VYPTmxWtHsC Orvh5Xu4THfyfhumj+3RbTAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEP Fw0xOTA3MzEwMzU0NDNaMGkGCSqGSIb3DQEJDzFcMFowCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQB FjALBglghkgBZQMEAQIwCgYIKoZIhvcNAwcwCwYJKoZIhvcNAQEKMAsGCSqGSIb3DQEBBzALBglg hkgBZQMEAgEwDQYJKoZIhvcNAQEBBQAEggEAEg6tHh+sFbu4NlLpNKnLGlEnGgHcx9AfoLq4XOR7 oD/OflqAofiPddjf/5N86xCX2DcLyIez+sWwYT6cE7N68r88chHEfSQ0g/G5JS1ldYt+sFbwOKw8 LHn+hcviVXp21bKDXIYCwz7w2vcWWZ6VEdFuRsTKy6wxXuhhK4mKv2B8jGvvlypH+MXX/KLG/0ML LEtPmMn/Oj4GJPB9fH1N8/V0eIZ/FKjVWNeK+dva8SgPn6qZ4cllLjSqYOSs4jLRY5u2uVQLHUNS fuXiH1H5XcgeFt7hDvMwxAXYlKuy2lmyFuds1p7KuCV2CW70Qw87E6PPb9S/hqaHtfq2eBSdLA== --000000000000e0c6ac058ef21528-- From nobody Tue Jul 30 20:59:34 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 36C6712002E for ; Tue, 30 Jul 2019 20:59:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=lowentropy.net header.b=SCeo42nO; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=xqVBUCZ3 Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BuNEnEltF86g for ; Tue, 30 Jul 2019 20:59:30 -0700 (PDT) Received: from wout2-smtp.messagingengine.com (wout2-smtp.messagingengine.com [64.147.123.25]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B1FA512008A for ; Tue, 30 Jul 2019 20:59:30 -0700 (PDT) Received: from compute1.internal (compute1.nyi.internal [10.202.2.41]) by mailout.west.internal (Postfix) with ESMTP id DBA69679 for ; Tue, 30 Jul 2019 23:59:29 -0400 (EDT) Received: from imap2 ([10.202.2.52]) by compute1.internal (MEProxy); Tue, 30 Jul 2019 23:59:29 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lowentropy.net; h=mime-version:message-id:in-reply-to:references:date:from:to :subject:content-type; s=fm2; bh=5t4+y3fdI4STFEskpGRIYatTpKetonp HsihnDKtGId4=; b=SCeo42nOecwDCvGw/WaF7YB0bf+yZl+anEZvh4qfAf5U8Bj 65jU9x/wPEGY1QTtc5bJf/NrYr1umgXPb2+3Fk7LrsNg7JfQYVH3v6VHveAu0LAy 4rO6qhhX8loZ7k/TV2PmvMZX+4v97+xioj/E7wrYjgRjV9nOv6jjsKjbW9NDUtQq iLxhL1BhC3JoURIM4M7/JjBgi+ESpwPOpXVPKoY3G6q+fnEeq2PaMIzcGDwokZ9d oP2JMOkGZbRCvlBv7lzVAU8aQEKudztbb8FAW9EZ0s0QjoSJLxzbJW+dyKJ30hCU KEVKRcN0OIsup5TtsitwJ4DIRhgFrvUySfvCmUA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-proxy :x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm3; bh=5t4+y3 fdI4STFEskpGRIYatTpKetonpHsihnDKtGId4=; b=xqVBUCZ30d6ALTtM+vmaJJ JgjXNGR/KsEDTMN9IMNZCkANT6NgL2KC2ekJOXNuFO7BSBZueRCFSw/1mAlAAPoj D/yCGjOFGlfGUS/hfMWUnl9HqpYOJ7kLlwYirxT8YEtowm7Uu7GeihwkVzpK7C+8 iiNe7k/U/buBmsPUhLCj7KRvj139//xKLWLmb1C2zL5wZwDMk8Pt5J9tkR9ImY2+ 5xoni1n8+DjSs592n7qw2iuJYQ8B9uDjI7044O76sLoXOt/rw4HkGA1zWdtwuFN9 7pj7mbrsVyz/6r/uJrL0Zq5hw7WONyrxTE7lsIiYvikma+4t7wxXykQDn3HTHUMA == X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeduvddrleeggdejkecutefuodetggdotefrodftvf curfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfghnecu uegrihhlohhuthemuceftddtnecunecujfgurhepofgfggfkjghffffhvffutgesthdtre dtreertdenucfhrhhomhepfdforghrthhinhcuvfhhohhmshhonhdfuceomhhtsehlohif vghnthhrohhphidrnhgvtheqnecurfgrrhgrmhepmhgrihhlfhhrohhmpehmtheslhhofi gvnhhtrhhophihrdhnvghtnecuvehluhhsthgvrhfuihiivgeptd X-ME-Proxy: Received: by mailuser.nyi.internal (Postfix, from userid 501) id 11DB4E00A2; Tue, 30 Jul 2019 23:59:29 -0400 (EDT) X-Mailer: MessagingEngine.com Webmail Interface User-Agent: Cyrus-JMAP/3.1.6-799-g925e343-fmstable-20190729v1 Mime-Version: 1.0 Message-Id: <19909dab-34bf-442e-9e67-9aef459d472c@www.fastmail.com> In-Reply-To: References: Date: Wed, 31 Jul 2019 13:59:29 +1000 From: "Martin Thomson" To: tls@ietf.org Content-Type: text/plain Archived-At: Subject: Re: [TLS] Drafts for batch signing and PKCS#1 v1.5 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 31 Jul 2019 03:59:33 -0000 On Wed, Jul 31, 2019, at 13:54, Ben Schwartz wrote: > The batch signing idea is very cool. I'm not entirely sure I understand > the intended use case, though. The intro suggests that this motivated > by DoS defense, but presumably an attacker who controls their own TLS > client stack could simply omit support for these signature schemes. Do > you envision a future where servers can safely omit support for all the > non-batch signature schemes? Or are you thinking of attackers who don't > control the TLS client stack? The usual trick when under duress is to attempt to process some requests, and lowering the cost of handling those requests enables higher tolerance to attack and better continuity of service. A server might choose not to serve clients that don't offer batching if it is stressed. > Minor question: in the tree diagrams, m2 goes to t04. Is there any > reason it couldn't go directly to t12? That would seem more natural to > me. The blinding process is explained in Section 4.3. From nobody Tue Jul 30 21:12:17 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 78A25120075 for ; Tue, 30 Jul 2019 21:12:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.251 X-Spam-Level: X-Spam-Status: No, score=-9.251 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.249, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, USER_IN_DEF_SPF_WL=-7.5] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=chromium.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id M_BGy6U0xVEV for ; Tue, 30 Jul 2019 21:12:12 -0700 (PDT) Received: from mail-qk1-x732.google.com (mail-qk1-x732.google.com [IPv6:2607:f8b0:4864:20::732]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 003D512002E for ; Tue, 30 Jul 2019 21:12:11 -0700 (PDT) Received: by mail-qk1-x732.google.com with SMTP id t8so48244008qkt.1 for ; Tue, 30 Jul 2019 21:12:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=lMvD0ARNJuPnrJsjxEXoy4u7MH+680wes9+PsTXwUyg=; b=RBpVILdtlNwj3Hb19uuYAJ8V2fidroy01IWQ9ooWaxpe9ZQOL/M60H1A0fNnCk/d48 SOtVyjpL8hnOvIL6Za0vxopRRS2zgNst6/AfnwYsA/iZcNlilujOsXIlZKYuPq0dy9Jl mWBVzklv3VvvJH3xUEmsaJs4ziy3E+xljV3p4= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=lMvD0ARNJuPnrJsjxEXoy4u7MH+680wes9+PsTXwUyg=; b=ecjRDv1fGyabxgTTIlkKFpv0sP98KBFqzTt186YvMdC2dy9Jn93LBj73Hv5aU/GwBQ uvoia2d7HpSEgPad9j7AY8elmjSlSHPil6VZT5wvmCJJEscZIF0wt3H7JWvYrr746aSR PsWMz+HzWsApRU+Mfao3c2obTtj7WxQnr84Id88YVtkJne2J9HLQLBBx2xwE+M3N6P9L eZML+VGqnA1K1Bk9yx5wXkl2ZedUFjgNS+L/nGLK8kFClpIkYo++4FLO5zUDwRpJ3GTs ItKIwGxkbDlbe0skw4TfxgwP7dMurhvestrIqOeVzY7xWsGQUN52hi1Mgmc48Q+zD33B QgQw== X-Gm-Message-State: APjAAAW8IDmvFSv4CQ7J+oiE0gF6KyKYoM0xMJVVAELWWlzd9cHQsldE MlQKO9dMimcgXJjPQJLUA7IKK3BfduYCJGSUXfVTgtjs6Q== X-Google-Smtp-Source: APXvYqyaxD4ytdp+AzRslowkYkRILiHAdCf+1q0l9MbmAt9aR4Mp5b4KfW2GvP6SU2aCceq2XS2LkiCCj+OnEtAuMho= X-Received: by 2002:ae9:ea0b:: with SMTP id f11mr77720363qkg.142.1564546330732; Tue, 30 Jul 2019 21:12:10 -0700 (PDT) MIME-Version: 1.0 References: <19909dab-34bf-442e-9e67-9aef459d472c@www.fastmail.com> In-Reply-To: <19909dab-34bf-442e-9e67-9aef459d472c@www.fastmail.com> From: David Benjamin Date: Wed, 31 Jul 2019 00:11:54 -0400 Message-ID: To: Martin Thomson Cc: "" Content-Type: multipart/alternative; boundary="000000000000478b70058ef25478" Archived-At: Subject: Re: [TLS] Drafts for batch signing and PKCS#1 v1.5 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 31 Jul 2019 04:12:14 -0000 --000000000000478b70058ef25478 Content-Type: text/plain; charset="UTF-8" On Tue, Jul 30, 2019 at 11:59 PM Martin Thomson wrote: > On Wed, Jul 31, 2019, at 13:54, Ben Schwartz wrote: > > The batch signing idea is very cool. I'm not entirely sure I understand > > the intended use case, though. The intro suggests that this motivated > > by DoS defense, but presumably an attacker who controls their own TLS > > client stack could simply omit support for these signature schemes. Do > > you envision a future where servers can safely omit support for all the > > non-batch signature schemes? Or are you thinking of attackers who don't > > control the TLS client stack? > > The usual trick when under duress is to attempt to process some requests, > and lowering the cost of handling those requests enables higher tolerance > to attack and better continuity of service. A server might choose not to > serve clients that don't offer batching if it is stressed. > Yup. The signing cost of a batch-capable client is effectively zero. (I expect it's already common to preferentially serve ECDSA-capable clients when under load.) Also, if many clients implement this, serving load under normal operation goes down, which is also valuable. > > Minor question: in the tree diagrams, m2 goes to t04. Is there any > > reason it couldn't go directly to t12? That would seem more natural to > > me. > > The blinding process is explained in Section 4.3. > I think Ben is asking why the tree doesn't put m2 a level higher (like CT does), instead of adding the padding nodes. That would work too. I chose this one because I found it more straightforward, and it doesn't particularly matter. Also it's what Roughtime did and I cribbed the construction from Roughtime. :-) In principle, the signer could pick any tree strategy as long as it produced valid paths for each message. But I think it's probably better for the draft to be opinionated, rather than risk implementers mess things up. David --000000000000478b70058ef25478 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Tue, Jul 30, 2019 at 11:59 PM Martin T= homson <mt@lowentropy.net> w= rote:
On Wed, Jul 31, 2019, at 13:54, Ben Schwartz wrote:
> The batch signing idea is very cool. I'm not entirely sure I under= stand
> the intended use case, though. The intro suggests that this motivated =
> by DoS defense, but presumably an attacker who controls their own TLS =
> client stack could simply omit support for these signature schemes. Do=
> you envision a future where servers can safely omit support for all th= e
> non-batch signature schemes? Or are you thinking of attackers who don&= #39;t
> control the TLS client stack?

The usual trick when under duress is to attempt to process some requests, a= nd lowering the cost of handling those requests enables higher tolerance to= attack and better continuity of service.=C2=A0 A server might choose not t= o serve clients that don't offer batching if it is stressed.

Yup. The signing cost of a batch-capable client i= s effectively zero. (I expect it's already common to preferentially ser= ve ECDSA-capable clients when under load.) Also, if many clients implement = this, serving load under normal operation goes down, which is also valuable= .
=C2=A0
> Minor question: in the tree diagrams, m2 goes to t04. Is there any > reason it couldn't go directly to t12? That would seem more natura= l to
> me.

The blinding process is explained in Section 4.3.

=
I think Ben is asking why the tree doesn't put m2 a level hi= gher (like CT does), instead of adding the padding nodes. That would work t= oo. I chose this one because I found it more straightforward, and it doesn&= #39;t particularly matter. Also it's what Roughtime did and I cribbed t= he construction from Roughtime. :-)

In principle, = the signer could pick any tree strategy as long as it produced valid paths = for each message. But I think it's probably better for the draft to be = opinionated, rather than risk implementers mess things up.

David
--000000000000478b70058ef25478-- From nobody Tue Jul 30 23:36:29 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 659BD120088 for ; Tue, 30 Jul 2019 23:36:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=comcastmailservice.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5fBAeuLlT5eR for ; Tue, 30 Jul 2019 23:36:25 -0700 (PDT) Received: from resqmta-po-12v.sys.comcast.net (resqmta-po-12v.sys.comcast.net [IPv6:2001:558:fe16:19:96:114:154:171]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9324112007C for ; Tue, 30 Jul 2019 23:36:25 -0700 (PDT) Received: from resomta-po-02v.sys.comcast.net ([96.114.154.226]) by resqmta-po-12v.sys.comcast.net with ESMTP id siAkh9qTkTbnXsiDohuQZ3; Wed, 31 Jul 2019 06:36:24 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=comcastmailservice.net; s=20180828_2048; t=1564554984; bh=k5ecv+Pxl0Ngn1e9fXt/7r8Q7nL3E/0hHHkNnAyaPug=; h=Received:Received:Subject:To:From:Message-ID:Date:MIME-Version: Content-Type; b=LHIl9wzzJnZ8Q0Ig67P/JRp+qweetSzbAcI8KGsyN167d1XeYVVv9QeYFigKIEW4G ofV1meWrHa2l33SJdG5BzdnYW3r//vkbUJFekJ3bHaUmNvkuTDYWz0VX4AXCKeqmxV VeD1hut/yT3mxM2rfebBMBCfK6GXTrhICDEFMHjHZMQ3UUPzEsB4bgA3fopCm06VZG DcPMKeqNsddg9adCct71/nwvyG0TBCv4mUoPKHtE+Sl2n6YBNmkeWBh8tO3e4nTV+P lOFO6Bb+n4bw21QdAxMD/jicCNAljw3cpFBUmUw8NgwyGYprVAmqub9f7DkOogLiN2 PQzUgxJ/aUsGg== Received: from [192.168.0.10] ([73.222.32.57]) by resomta-po-02v.sys.comcast.net with ESMTPSA id siDnhT6oxobG3siDnhOnao; Wed, 31 Jul 2019 06:36:24 +0000 X-Xfinity-VAAS: gggruggvucftvghtrhhoucdtuddrgeduvddrleeggdduuddtucetufdoteggodetrfdotffvucfrrhhofhhilhgvmecuvehomhgtrghsthdqtfgvshhipdfqfgfvpdfpqffurfetoffkrfenuceurghilhhouhhtmecufedttdenucenucfjughrpefuvfhfhffkffgfgggjtgfgsehtkeertddtfeejnecuhfhrohhmpeetnhgurhgvhiculfhivhhsohhvuceotghrhihpthhosegsrhgrihhnhhhusgdrohhrgheqnecuffhomhgrihhnpehivghtfhdrohhrghenucfkphepjeefrddvvddvrdefvddrheejnecurfgrrhgrmhephhgvlhhopegludelvddrudeikedrtddruddtngdpihhnvghtpeejfedrvddvvddrfedvrdehjedpmhgrihhlfhhrohhmpegtrhihphhtohessghrrghinhhhuhgsrdhorhhgpdhrtghpthhtohepthhlshesihgvthhfrdhorhhgnecuvehluhhsthgvrhfuihiivgeptd X-Xfinity-VMeta: sc=0;st=legit To: tls@ietf.org References: From: Andrey Jivsov Message-ID: <990ade67-4727-a533-9f94-65383f9f285a@brainhub.org> Date: Tue, 30 Jul 2019 23:36:23 -0700 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.4.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [TLS] Drafts for batch signing and PKCS#1 v1.5 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 31 Jul 2019 06:36:28 -0000 Regarding PKCS 1.5 in TLS 1.3, please also see slide 4 for a year 2015 version of the same motivation https://www.ietf.org/proceedings/94/slides/slides-94-tls-4.pdf . On 7/29/19 5:15 PM, David Benjamin wrote: > Hi all, > > I’ve just uploaded a pair of drafts relating to signatures in TLS 1.3. > https://tools.ietf.org/html/draft-davidben-tls13-pkcs1-00 > https://tools.ietf.org/html/draft-davidben-tls-batch-signing-00 > > The first introduces optional legacy codepoints for PKCS#1 v1.5 > signatures with client certificates. This is unfortunate, but I think we > should do it. On the Chrome side, we’ve encountered some headaches with > the TLS 1.3 PSS requirement which are unique to client certificates. The > document describes the motivations in detail. > > The second describes a batch signing mechanism for TLS using Merkle > trees. It allows TLS clients and servers to better handle signing load. > I think it could be beneficial for a number of DoS and remote key scenarios. > > Thoughts? > > David > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > From nobody Wed Jul 31 00:35:08 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3D5341200C5 for ; Wed, 31 Jul 2019 00:35:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.598 X-Spam-Level: X-Spam-Status: No, score=-2.598 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Hl8TCXdj28Ad for ; Wed, 31 Jul 2019 00:35:05 -0700 (PDT) Received: from welho-filter3.welho.com (welho-filter3.welho.com [83.102.41.25]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E85D31200C1 for ; Wed, 31 Jul 2019 00:35:04 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by welho-filter3.welho.com (Postfix) with ESMTP id 5FF5E1489 for ; Wed, 31 Jul 2019 10:35:02 +0300 (EEST) X-Virus-Scanned: Debian amavisd-new at pp.htv.fi Received: from welho-smtp1.welho.com ([IPv6:::ffff:83.102.41.84]) by localhost (welho-filter3.welho.com [::ffff:83.102.41.25]) (amavisd-new, port 10024) with ESMTP id IejIV6b-5jeM for ; Wed, 31 Jul 2019 10:35:01 +0300 (EEST) Received: from LK-Perkele-VII (87-100-246-37.bb.dnainternet.fi [87.100.246.37]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by welho-smtp1.welho.com (Postfix) with ESMTPSA id B60157A for ; Wed, 31 Jul 2019 10:35:00 +0300 (EEST) Date: Wed, 31 Jul 2019 10:35:00 +0300 From: Ilari Liusvaara To: "" Message-ID: <20190731073500.GA10363@LK-Perkele-VII> References: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: User-Agent: Mutt/1.10.1 (2018-07-13) Sender: ilariliusvaara@welho.com Archived-At: Subject: Re: [TLS] Drafts for batch signing and PKCS#1 v1.5 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 31 Jul 2019 07:35:07 -0000 On Mon, Jul 29, 2019 at 08:15:44PM -0400, David Benjamin wrote: > Hi all, > > I’ve just uploaded a pair of drafts relating to signatures in TLS 1..3. > https://tools.ietf.org/html/draft-davidben-tls13-pkcs1-00 > https://tools.ietf.org/html/draft-davidben-tls-batch-signing-00 > > The second describes a batch signing mechanism for TLS using Merkle trees. > It allows TLS clients and servers to better handle signing load. I think it > could be beneficial for a number of DoS and remote key scenarios. Why is the context string same for clients and servers? The base TLS 1.3 signatures use different context strings for client and server. What is the hash length of SHAKE256 in Ed448_batch? 512 bits (64 octets) required to saturate the collision resistance? "to a random byte of string of" in section 3.1, should that be "to a random byte string of"? -Ilari From nobody Wed Jul 31 00:42:27 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D4EBC120098 for ; Wed, 31 Jul 2019 00:42:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=thomwiggers.nl Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FmwZSCviEcQy for ; Wed, 31 Jul 2019 00:42:23 -0700 (PDT) Received: from mail-wr1-x42b.google.com (mail-wr1-x42b.google.com [IPv6:2a00:1450:4864:20::42b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 30616120048 for ; Wed, 31 Jul 2019 00:42:23 -0700 (PDT) Received: by mail-wr1-x42b.google.com with SMTP id z1so68471462wru.13 for ; Wed, 31 Jul 2019 00:42:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=thomwiggers.nl; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=yOl8VSqXVlyQnuBGh1x2bibnhsHVe4Jfs84zpRSwiBM=; b=PAbbdZCBEmy1Qnigdw4JAzpean3UTzYRYilsFlbqUtNlQrge2U3vSbAdUBCkvlRd5d HxaQ+UDuHU5W/H79VitANd7t8NHm2JJ+xEUGF2Xow5eu9S7bwJqkaJIGzzO3Y5JQDtYn XN+d4hI6MQ6OomZiX+6sqxr7FdFyzy9eEhT6Y= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=yOl8VSqXVlyQnuBGh1x2bibnhsHVe4Jfs84zpRSwiBM=; b=BKx9qyqM5jiK1s/fhbsOt1qZbXrWfN3fwQWM6CqoWjGnkUghFz7ZT65UaXea8glrV4 sAIkm7YTC1tnpssLFuqdv5UIXrCP+y5VB17Xm5Iu/YQgHYJMMUtxFOPraVQ6AE0Wj5Mr M/fGtHqF2nGzMFbC9XsyUJuh0xdZ9mhpjTYFoXK2Hir/Kx7vBSNE4g4xpAgD4ivsXZ1Y R/AphQqhBnjaXrmk8IF/1y1UtpvM60FcLuS1etNh7T9avy0YukV4ecFyRYpXSbLgsvDm dp7B5PGwOfGFPdDKGrHi0BjQaZqbkkBfNCPTj7ZkOY+03dvFh7Fk067oddJiIUWhDTsv 1mug== X-Gm-Message-State: APjAAAXI2kMJKDUT8x51ylFAZzNPp5QovIopcLSfMUTqZ2WLzbYapi/N SFrHvhR0KuhtLxn7NY+kiOJk8aHW3JeKIOtQQ4w= X-Google-Smtp-Source: APXvYqz8hDIlIN98xVx185iK3/+FnTW45a6i5tToklVVrEVEW/UNUD1ma07IIPhfPgW2uzfIyFc9ruV2+2po1TzGEeI= X-Received: by 2002:adf:ec0c:: with SMTP id x12mr56691710wrn.342.1564558941331; Wed, 31 Jul 2019 00:42:21 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Thom Wiggers Date: Wed, 31 Jul 2019 09:42:09 +0200 Message-ID: To: David Benjamin Cc: "" Content-Type: multipart/alternative; boundary="000000000000edbd5d058ef54383" Archived-At: Subject: Re: [TLS] Drafts for batch signing and PKCS#1 v1.5 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 31 Jul 2019 07:42:26 -0000 --000000000000edbd5d058ef54383 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi David, I've found some small textual issues (I'm looking at the PDF version): In section 3.1 in step 1 (on PDF page 4): "element 2*i+1 to a random byte of string of Hash.length bytes." This sentence is slightly puzzling. A random bytestring? Section 4.2, first paragraph, last sentence: "so batch signing inherits preserves separation" This sentence contains two verbs. It looks like an interesting proposition, which could also be interesting in the context of some of the post-quantum signing algorithms. Cheers, Thom Op di 30 jul. 2019 om 02:16 schreef David Benjamin : > Hi all, > > I=E2=80=99ve just uploaded a pair of drafts relating to signatures in TLS= 1.3. > https://tools.ietf.org/html/draft-davidben-tls13-pkcs1-00 > https://tools.ietf.org/html/draft-davidben-tls-batch-signing-00 > > The first introduces optional legacy codepoints for PKCS#1 v1.5 signature= s > with client certificates. This is unfortunate, but I think we should do i= t. > On the Chrome side, we=E2=80=99ve encountered some headaches with the TLS= 1.3 PSS > requirement which are unique to client certificates. The document describ= es > the motivations in detail. > > The second describes a batch signing mechanism for TLS using Merkle trees= . > It allows TLS clients and servers to better handle signing load. I think = it > could be beneficial for a number of DoS and remote key scenarios. > > Thoughts? > > David > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > --000000000000edbd5d058ef54383 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi David,

I've found some small tex= tual issues (I'm looking at the PDF version):

= In section 3.1 in step 1 (on PDF page 4):

&quo= t;element 2*i+1 to a random byte of string of Hash.length bytes."

This sentence is slightly puzzling. A random bytestrin= g?

Section 4.2, first paragraph, last sentence:

"so batch signing inherits preserves separation= "

This sentence contains two verbs.

It looks like an interesting proposition, which could also = be interesting in the context of some of the post-quantum signing algorithm= s.

Cheers,

Thom

Op d= i 30 jul. 2019 om 02:16 schreef David Benjamin <davidben@chromium.org>:
Hi all,

I=E2=80=99= ve just uploaded a pair of drafts relating to signatures in TLS 1.3.
https://tools.ietf.org/html/draft-davidben-tls13-pkcs1-00https://tools.ietf.org/html/draft-davidben-tls-batch-s= igning-00

The first introduces optional legacy codepoints for PK= CS#1 v1.5 signatures with client certificates. This is unfortunate, but I t= hink we should do it. On the Chrome side, we=E2=80=99ve encountered some he= adaches with the TLS 1.3 PSS requirement which are unique to client certifi= cates. The document describes the motivations in detail.

The second = describes a batch signing mechanism for TLS using Merkle trees. It allows T= LS clients and servers to better handle signing load. I think it could be b= eneficial for a number of DoS and remote key scenarios.

Thoughts?
David
_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls
--000000000000edbd5d058ef54383-- From nobody Wed Jul 31 02:38:39 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B4EE5120159 for ; Wed, 31 Jul 2019 02:38:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.901 X-Spam-Level: X-Spam-Status: No, score=-6.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OFMKkxbi_kIL for ; Wed, 31 Jul 2019 02:38:35 -0700 (PDT) Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 73C4D12003F for ; Wed, 31 Jul 2019 02:38:35 -0700 (PDT) Received: from smtp.corp.redhat.com (int-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 16983C05FBC0; Wed, 31 Jul 2019 09:38:35 +0000 (UTC) Received: from pintsize.usersys.redhat.com (ovpn-200-49.brq.redhat.com [10.40.200.49]) by smtp.corp.redhat.com (Postfix) with ESMTP id 458D3600CC; Wed, 31 Jul 2019 09:38:34 +0000 (UTC) From: Hubert Kario To: tls@ietf.org Date: Wed, 31 Jul 2019 11:38:22 +0200 Message-ID: <4008547.fcu2ex3RBq@pintsize.usersys.redhat.com> In-Reply-To: References: MIME-Version: 1.0 Content-Type: multipart/signed; boundary="nextPart2321546.XbuWvo8xsM"; micalg="pgp-sha512"; protocol="application/pgp-signature" X-Scanned-By: MIMEDefang 2.79 on 10.5.11.11 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.32]); Wed, 31 Jul 2019 09:38:35 +0000 (UTC) Archived-At: Subject: Re: [TLS] Options for negotiating hybrid key exchanges for postquantum X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 31 Jul 2019 09:38:38 -0000 --nextPart2321546.XbuWvo8xsM Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="UTF-8" On Tuesday, 30 July 2019 17:21:05 CEST Scott Fluhrer (sfluhrer) wrote: > During the physical meeting in Montreal, we had a discussion about > postquantum security, and in particular, on how one might want to negotia= te > several different 'groups' simultaneously (because there might not be one > group that is entirely trusted, and I put 'groups' in scarequotes because > postquantum key exchanges are typically not formed from a Diffie-Hellman > group). >=20 > At the meeting, there were two options presented: >=20 > Option 1: as the supported group, we insert a 'hybrid marker' (and include > an extension that map lists which combination the hybrid marker stands fo= r) > For example, the client might list in his supported groups hybrid_marker_0 > and hybrid_marker_1, and there would be a separate extension that lists > hybrid_marker_0 =3D X25519 + SIKEp434 and hybrid_marker_1 =3D X25519 + > NTRUPR653. The server would then look up the meanings of hybrid_marker_0 > and 1 in the extension, and then compare that against his security policy. > In this option, we would ask IANA to allocate code points for the various > individual postquantum key exchanges (in this example, SIKEp434 and > NTRUPR653), as well a range of code points for the various hybrid_markers. >=20 > Option 2: we have code points for all the various combinations that we may > want to support; hence IANA might allocate a code point X25519_SIKEp434 a= nd > another code point for X25519_NTRUPR653. With this option, the client > would list X25519_SIKEp434 and X25519_NTRUPR653 in their supported groups. > In this option, we would ask IANA to allocate code points for all the > various combinations that we want allow to be negotiated. yes, option 1 sounds like a safer bet given the number of unknowns we have = to=20 work with (though the exact proposed mechanism is a bit clunky) both leave open the question how the secrets should be combined =E2=80=93 s= ome kind of=20 concatenation scheme or another round of Derive-Secret =E2=86=92 HKDF-Extra= ct =2D-=20 Regards, Hubert Kario Senior Quality Engineer, QE BaseOS Security team Web: www.cz.redhat.com Red Hat Czech s.r.o., Purky=C5=88ova 115, 612 00 Brno, Czech Republic --nextPart2321546.XbuWvo8xsM Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part. Content-Transfer-Encoding: 7Bit -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEYeeuxEU+3unL/K+dkqjRuAHS9fUFAl1BYY4ACgkQkqjRuAHS 9fUMDBAAkD4o+hYxYgR+7kM7jQ4UDgYrXvTUiJj5NepU83v1kZ6sesHZVWUePhwa Lfi9w0yu49MV1uuTZZueCTq7qYSc/zA0Kok9aqCXatMX+a0/xqnGAJjHQRoksUDH ijO7FjICf0KE0PykMxMs4ju4ZK0cKCH4ReJEdV4Y3ixF/8vOPUuTA4t77BXsKi2A 4nvl+XQubSAC8vmpGYigfBTQ9klIhhSFL9wbgGh6kxEEyoG79PP/jHJfomMnV9AH FvDqok1b+hBzf2A6+ixYZJtShlVegRo/Z0J36G+I9g1mf1d8tdU0oe/CenlpxeIB ZBNlQi9/pugUo14+HFiBR+WLpi8yOl0zkdKefv/crv05EsP+sNwwlLd0msWZsVFs 1izsjCjc7CpWDAPSaZWPbtqHLBXLk6eBzNMtrxFjLM99IZHRM49ZOHZ+HXC1w9q9 CMyXk1i38g3i6/LmW1YJTKF3OFEC8JsxIJebGTDqkiPFZ0fmfrDTcnxHsDO/dDdg DlRT+h9HxR0M+4wNnwdJ0BAvqV7/HzafrWkEDhLhtX14QlzLXqfYnSycVq2gQtuB bd+9jty4anF7OCzqhLWJ90gsT285+aTxhqNsBXD1Zno8GioPXUzgLz+IvKIibH52 O6jgZOhBcqEMCF0O1bPRUpideUPZG9qIR4MPkhkwacBuzSADxgw= =1sly -----END PGP SIGNATURE----- --nextPart2321546.XbuWvo8xsM-- From nobody Wed Jul 31 05:01:51 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CBA35120145 for ; Wed, 31 Jul 2019 05:01:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.5 X-Spam-Level: X-Spam-Status: No, score=-17.5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zmxTJ6WoQGML for ; Wed, 31 Jul 2019 05:01:44 -0700 (PDT) Received: from mail-io1-xd32.google.com (mail-io1-xd32.google.com [IPv6:2607:f8b0:4864:20::d32]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 466E51200F6 for ; Wed, 31 Jul 2019 05:01:44 -0700 (PDT) Received: by mail-io1-xd32.google.com with SMTP id q22so15833699iog.4 for ; Wed, 31 Jul 2019 05:01:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=rmEvwFiwIQXEBGM3CTiVtRF+9kCRcWBSSKc2/Y4YbSE=; b=sKAocFNMVu5vivmcw7Z6/FIKA6VA39odMedoa/GWf6g77+Z2NAFBxlsUkSu0qUTwOe bfR/jQEIFicuUP6b/YpJ0JboIG4mBrdiNmgqU5jXqDIiwaWZESdqsRUsHQUxkGIA9yBL K74kkyAI3HTXiulglWqzbZqifkeZ7KQKcxvl16DuhJ2qcPuhprzab/cHqq7DMNSycZL+ C8j3FD8tVabUQw4nkGMILCihF4eiJPlD7uT8iCsXSiWTaDozy50fpSs3GvksKYaODSY0 AYBAzyR3AkPCV4/ObYBR3Y5YOqUGs/A6RE/56++CoRxN4evZVvxpOfqEgcV9cI1TKc48 4sSQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=rmEvwFiwIQXEBGM3CTiVtRF+9kCRcWBSSKc2/Y4YbSE=; b=A2k2rk28sCh7jeLthN6hmUaqY9Kg+JfkOCCdizvcOF2wNzb6bgjGOKcG4Pg+2QWuwv 7NQ3W8LW1Dj7unZZDYBBy4qndSss//Xmm9AGOc1EfhdvtnC+d2kMQcl6Vi1I9V523PBz 692nYnF2UHO7tBktE03Fv2P7FVQ+aLJwxlX0mYBeQ7out7nuWUHEF8r6oetdjWcsNM0w U39gD/Prkzw4mKV4ohsRj83G4iFAWFoT/QaDNoqQgMDCzks+yn5bYGwwH4nX30jVC1Xt IlEnglha2AAsDG1pYYDSB7T4zSP0bfymrXU02Fan5GxWXP3AlNrZazyF7N4U6ykP4jZp hu+Q== X-Gm-Message-State: APjAAAVnvRVZTz9yJSAkhtKSzsFl9Cvi0o1UxQduBxLj6Cl9cH6foWnh AQz1xNjpH6G1m4Aw3WnaHlmcFHpDxeIdMSlUhC12sQ== X-Google-Smtp-Source: APXvYqyzwKO7ciJMLV3K3HrhVmJ0zXOBa7ZBpZpzYLJBewKmuG+2AsGiPwfubd9w3iNMPTkJ1pLFXD7Y0tAVAv9kYvk= X-Received: by 2002:a02:c550:: with SMTP id g16mr123998613jaj.49.1564574501064; Wed, 31 Jul 2019 05:01:41 -0700 (PDT) MIME-Version: 1.0 References: <19909dab-34bf-442e-9e67-9aef459d472c@www.fastmail.com> In-Reply-To: From: Ben Schwartz Date: Wed, 31 Jul 2019 08:01:28 -0400 Message-ID: To: David Benjamin Cc: Martin Thomson , "" Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="00000000000064faf1058ef8e3e5" Archived-At: Subject: Re: [TLS] Drafts for batch signing and PKCS#1 v1.5 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 31 Jul 2019 12:01:47 -0000 --00000000000064faf1058ef8e3e5 Content-Type: multipart/alternative; boundary="0000000000005ca595058ef8e34b" --0000000000005ca595058ef8e34b Content-Type: text/plain; charset="UTF-8" On Wed, Jul 31, 2019 at 12:12 AM David Benjamin wrote: > On Tue, Jul 30, 2019 at 11:59 PM Martin Thomson wrote: > >> On Wed, Jul 31, 2019, at 13:54, Ben Schwartz wrote: >> > The batch signing idea is very cool. I'm not entirely sure I understand >> > the intended use case, though. The intro suggests that this motivated >> > by DoS defense, but presumably an attacker who controls their own TLS >> > client stack could simply omit support for these signature schemes. Do >> > you envision a future where servers can safely omit support for all the >> > non-batch signature schemes? Or are you thinking of attackers who don't >> > control the TLS client stack? >> >> The usual trick when under duress is to attempt to process some requests, >> and lowering the cost of handling those requests enables higher tolerance >> to attack and better continuity of service. A server might choose not to >> serve clients that don't offer batching if it is stressed. >> > > Yup. The signing cost of a batch-capable client is effectively zero. (I > expect it's already common to preferentially serve ECDSA-capable clients > when under load.) Also, if many clients implement this, serving load under > normal operation goes down, which is also valuable.. > OK. I think it would be good to clarify the motivation in the intro. (For me, defending against DDoS attackers who don't control the TLS client stack is also a compelling use case.) > > >> > Minor question: in the tree diagrams, m2 goes to t04. Is there any >> > reason it couldn't go directly to t12? That would seem more natural to >> > me. >> >> The blinding process is explained in Section 4.3. >> > > I think Ben is asking why the tree doesn't put m2 a level higher (like CT > does), instead of adding the padding nodes. That would work too. I chose > this one because I found it more straightforward, and it doesn't > particularly matter. Also it's what Roughtime did and I cribbed the > construction from Roughtime. :-) > OK, thanks for the explanation. My main reason to favor the CT-style tree structure is that it avoids load spikes. In this structure, incrementally processing message mk requires k hashes when k is a power of 2, as opposed to O(1) hashes for each message in a CT-style tree. In principle, the signer could pick any tree strategy as long as it > produced valid paths for each message. But I think it's probably better for > the draft to be opinionated, rather than risk implementers mess things up. > A SHOULD-strength recommendation for a particular approach seems fine, but I think sophisticated implementers might want to use different structures depending on their needs. David > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > --0000000000005ca595058ef8e34b Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Wed, Jul 31, 2019 at 12:12 AM Davi= d Benjamin <davidben@chromium.o= rg> wrote:
On Tue, Jul 30, 2019 at 11:59 PM Martin= Thomson <mt@lowe= ntropy.net> wrote:
On Wed, Jul 31, 2019, at 13:54, Ben Sc= hwartz wrote:
> The batch signing idea is very cool. I'm not entirely sure I under= stand
> the intended use case, though. The intro suggests that this motivated =
> by DoS defense, but presumably an attacker who controls their own TLS =
> client stack could simply omit support for these signature schemes. Do=
> you envision a future where servers can safely omit support for all th= e
> non-batch signature schemes? Or are you thinking of attackers who don&= #39;t
> control the TLS client stack?

The usual trick when under duress is to attempt to process some requests, a= nd lowering the cost of handling those requests enables higher tolerance to= attack and better continuity of service.=C2=A0 A server might choose not t= o serve clients that don't offer batching if it is stressed.

Yup. The signing cost of a batch-capable client i= s effectively zero. (I expect it's already common to preferentially ser= ve ECDSA-capable clients when under load.) Also, if many clients implement = this, serving load under normal operation goes down, which is also valuable= ..

OK.=C2=A0 I think it w= ould be good to clarify the motivation in the intro.=C2=A0 (For me, defendi= ng against DDoS attackers who don't control the TLS client stack is als= o a compelling use case.)=C2=A0
=C2=A0
> Minor question: in the tree diagrams, m2 goes to t04. Is there any > reason it couldn't go directly to t12? That would seem more natura= l to
> me.

The blinding process is explained in Section 4.3.

=
I think Ben is asking why the tree doesn't put m2 a level hi= gher (like CT does), instead of adding the padding nodes. That would work t= oo. I chose this one because I found it more straightforward, and it doesn&= #39;t particularly matter. Also it's what Roughtime did and I cribbed t= he construction from Roughtime. :-)

=
OK, thanks for the explanation.=C2=A0 My main reason to favor th= e CT-style tree structure is that it avoids load spikes.=C2=A0 In this stru= cture, incrementally processing message mk requires k hashes when k is a po= wer of 2, as opposed to O(1) hashes for each message in a CT-style tree.

In principle, the signer could pi= ck any tree strategy as long as it produced valid paths for each message. B= ut I think it's probably better for the draft to be opinionated, rather= than risk implementers mess things up.
=
A SHOULD-strength=C2=A0recommendation for a particular appro= ach seems fine, but I think sophisticated implementers might want to use di= fferent structures depending on their needs.

David
_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls
--0000000000005ca595058ef8e34b-- --00000000000064faf1058ef8e3e5 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIIS5wYJKoZIhvcNAQcCoIIS2DCCEtQCAQExDzANBglghkgBZQMEAgEFADALBgkqhkiG9w0BBwGg ghBNMIIEXDCCA0SgAwIBAgIOSBtqDm4P/739RPqw/wcwDQYJKoZIhvcNAQELBQAwZDELMAkGA1UE BhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVy c29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hBMjU2IC0gRzIwHhcNMTYwNjE1MDAwMDAwWhcNMjEw NjE1MDAwMDAwWjBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xvYmFsU2lnbiBudi1zYTEiMCAG A1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC AQoCggEBALR23lKtjlZW/17kthzYcMHHKFgywfc4vLIjfq42NmMWbXkNUabIgS8KX4PnIFsTlD6F GO2fqnsTygvYPFBSMX4OCFtJXoikP2CQlEvO7WooyE94tqmqD+w0YtyP2IB5j4KvOIeNv1Gbnnes BIUWLFxs1ERvYDhmk+OrvW7Vd8ZfpRJj71Rb+QQsUpkyTySaqALXnyztTDp1L5d1bABJN/bJbEU3 Hf5FLrANmognIu+Npty6GrA6p3yKELzTsilOFmYNWg7L838NS2JbFOndl+ce89gM36CW7vyhszi6 6LqqzJL8MsmkP53GGhf11YMP9EkmawYouMDP/PwQYhIiUO0CAwEAAaOCASIwggEeMA4GA1UdDwEB /wQEAwIBBjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwEgYDVR0TAQH/BAgwBgEB/wIB ADAdBgNVHQ4EFgQUyzgSsMeZwHiSjLMhleb0JmLA4D8wHwYDVR0jBBgwFoAUJiSSix/TRK+xsBtt r+500ox4AAMwSwYDVR0fBEQwQjBAoD6gPIY6aHR0cDovL2NybC5nbG9iYWxzaWduLmNvbS9ncy9n c3BlcnNvbmFsc2lnbnB0bnJzc2hhMmcyLmNybDBMBgNVHSAERTBDMEEGCSsGAQQBoDIBKDA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzANBgkqhkiG 9w0BAQsFAAOCAQEACskdySGYIOi63wgeTmljjA5BHHN9uLuAMHotXgbYeGVrz7+DkFNgWRQ/dNse Qa4e+FeHWq2fu73SamhAQyLigNKZF7ZzHPUkSpSTjQqVzbyDaFHtRBAwuACuymaOWOWPePZXOH9x t4HPwRQuur57RKiEm1F6/YJVQ5UTkzAyPoeND/y1GzXS4kjhVuoOQX3GfXDZdwoN8jMYBZTO0H5h isymlIl6aot0E5KIKqosW6mhupdkS1ZZPp4WXR4frybSkLejjmkTYCTUmh9DuvKEQ1Ge7siwsWgA NS1Ln+uvIuObpbNaeAyMZY0U5R/OyIDaq+m9KXPYvrCZ0TCLbcKuRzCCBB4wggMGoAMCAQICCwQA AAAAATGJxkCyMA0GCSqGSIb3DQEBCwUAMEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAt IFIzMRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWduMB4XDTExMDgwMjEw MDAwMFoXDTI5MDMyOTEwMDAwMFowZDELMAkGA1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24g bnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVyc29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hB MjU2IC0gRzIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCg/hRKosYAGP+P7mIdq5NB Kr3J0tg+8lPATlgp+F6W9CeIvnXRGUvdniO+BQnKxnX6RsC3AnE0hUUKRaM9/RDDWldYw35K+sge C8fWXvIbcYLXxWkXz+Hbxh0GXG61Evqux6i2sKeKvMr4s9BaN09cqJ/wF6KuP9jSyWcyY+IgL6u2 52my5UzYhnbf7D7IcC372bfhwM92n6r5hJx3r++rQEMHXlp/G9J3fftgsD1bzS7J/uHMFpr4MXua eoiMLV5gdmo0sQg23j4pihyFlAkkHHn4usPJ3EePw7ewQT6BUTFyvmEB+KDoi7T4RCAZDstgfpzD rR/TNwrK8/FXoqnFAgMBAAGjgegwgeUwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8C AQEwHQYDVR0OBBYEFCYkkosf00SvsbAbba/udNKMeAADMEcGA1UdIARAMD4wPAYEVR0gADA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzA2BgNVHR8E LzAtMCugKaAnhiVodHRwOi8vY3JsLmdsb2JhbHNpZ24ubmV0L3Jvb3QtcjMuY3JsMB8GA1UdIwQY MBaAFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQACAFVjHihZCV/IqJYt 7Nig/xek+9g0dmv1oQNGYI1WWeqHcMAV1h7cheKNr4EOANNvJWtAkoQz+076Sqnq0Puxwymj0/+e oQJ8GRODG9pxlSn3kysh7f+kotX7pYX5moUa0xq3TCjjYsF3G17E27qvn8SJwDsgEImnhXVT5vb7 qBYKadFizPzKPmwsJQDPKX58XmPxMcZ1tG77xCQEXrtABhYC3NBhu8+c5UoinLpBQC1iBnNpNwXT Lmd4nQdf9HCijG1e8myt78VP+QSwsaDT7LVcLT2oDPVggjhVcwljw3ePDwfGP9kNrR+lc8XrfClk WbrdhC2o4Ui28dtIVHd3MIIDXzCCAkegAwIBAgILBAAAAAABIVhTCKIwDQYJKoZIhvcNAQELBQAw TDEgMB4GA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjMxEzARBgNVBAoTCkdsb2JhbFNpZ24x EzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDkwMzE4MTAwMDAwWhcNMjkwMzE4MTAwMDAwWjBMMSAw HgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMzETMBEGA1UEChMKR2xvYmFsU2lnbjETMBEG A1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMwldpB5Bngi FvXAg7aEyiie/QV2EcWtiHL8RgJDx7KKnQRfJMsuS+FggkbhUqsMgUdwbN1k0ev1LKMPgj0MK66X 17YUhhB5uzsTgHeMCOFJ0mpiLx9e+pZo34knlTifBtc+ycsmWQ1z3rDI6SYOgxXG71uL0gRgykmm KPZpO/bLyCiR5Z2KYVc3rHQU3HTgOu5yLy6c+9C7v/U9AOEGM+iCK65TpjoWc4zdQQ4gOsC0p6Hp sk+QLjJg6VfLuQSSaGjlOCZgdbKfd/+RFO+uIEn8rUAVSNECMWEZXriX7613t2Saer9fwRPvm2L7 DWzgVGkWqQPabumDk3F2xmmFghcCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQF MAMBAf8wHQYDVR0OBBYEFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQBL QNvAUKr+yAzv95ZURUm7lgAJQayzE4aGKAczymvmdLm6AC2upArT9fHxD4q/c2dKg8dEe3jgr25s bwMpjjM5RcOO5LlXbKr8EpbsU8Yt5CRsuZRj+9xTaGdWPoO4zzUhw8lo/s7awlOqzJCK6fBdRoyV 3XpYKBovHd7NADdBj+1EbddTKJd+82cEHhXXipa0095MJ6RMG3NzdvQXmcIfeg7jLQitChws/zyr VQ4PkX4268NXSb7hLi18YIvDQVETI53O9zJrlAGomecsMx86OyXShkDOOyyGeMlhLxS67ttVb9+E 7gUJTb0o2HLO02JQZR7rkpeDMdmztcpHWD9fMIIEZDCCA0ygAwIBAgIMB/CJK1MgpV83jiIZMA0G CSqGSIb3DQEBCwUAMEwxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMSIw IAYDVQQDExlHbG9iYWxTaWduIEhWIFMvTUlNRSBDQSAxMB4XDTE5MDMxMzA4MjIxOVoXDTE5MDkw OTA4MjIxOVowIjEgMB4GCSqGSIb3DQEJAQwRYmVtYXNjQGdvb2dsZS5jb20wggEiMA0GCSqGSIb3 DQEBAQUAA4IBDwAwggEKAoIBAQCsphkGEsCh0fF4+6Wsi1u40JxI6W6Izew+dLGK4b93LCRAuJ8y g9wSnwGAtk9/23VmtKwBrMaJD5j9SVZpscvLAjrWwADl/THU22uTW0MsUE2fPOPv2s4hE+vMgRmK P2E+xpI6n0gFvn8qrUHO1dm6PJaP5SWa+zdB/Ja1LgMJTpevQqjK4LKjWmHFPR6CplS4RImjGk7U 0I6invTyQnL5p583t5PI7FcM5UyjAqxGEETdAuc7N4IqjNETvPwL0wLIzxPDA5PMqcWPSzg7sBAB LVUQRYNIAJPlVpUdg1IeAjil5BaaWBjEeCLBSGDFX3WaWfMNzQvRZr4i6oJxzV+1AgMBAAGjggFu MIIBajAcBgNVHREEFTATgRFiZW1hc2NAZ29vZ2xlLmNvbTBQBggrBgEFBQcBAQREMEIwQAYIKwYB BQUHMAKGNGh0dHA6Ly9zZWN1cmUuZ2xvYmFsc2lnbi5jb20vY2FjZXJ0L2dzaHZzbWltZWNhMS5j cnQwHQYDVR0OBBYEFFSy8ovdLNSQc8aqxOgKS7sBOm/UMB8GA1UdIwQYMBaAFMs4ErDHmcB4koyz IZXm9CZiwOA/MEwGA1UdIARFMEMwQQYJKwYBBAGgMgEoMDQwMgYIKwYBBQUHAgEWJmh0dHBzOi8v d3d3Lmdsb2JhbHNpZ24uY29tL3JlcG9zaXRvcnkvMDsGA1UdHwQ0MDIwMKAuoCyGKmh0dHA6Ly9j cmwuZ2xvYmFsc2lnbi5jb20vZ3NodnNtaW1lY2ExLmNybDAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0l BBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMA0GCSqGSIb3DQEBCwUAA4IBAQCbQ++Znz6xh85ZlZEN Y/vAF0vn111O0c2houe4LlLQkoQ1QS4fH5EYcBx/393FTq5n08ezWYVtmeQ6W15e34CqjYNop1Vh mihZ+3J6+LL/6YNi91cp5yMFgxOP9aI/Y8IaIWZJAY2e8yHbYSq0z8kka0H6S4VvFjwtRogkWW95 0SStEwo/8viJ02BwpmVj4YIA6Fva1ZbeN2TnUMCAHJAlKWOGlpHxpcdcWckED0XbSY9w6bllMw1T tsbiUwQxDeO++Y8NfS8rieZgfv3RlobKihE8xbIVGRHIq1gup4nXv6XDwHDYyGhafIfUD4Ix00Wk gnODGb+jPwoQlDX0X64qMYICXjCCAloCAQEwXDBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xv YmFsU2lnbiBudi1zYTEiMCAGA1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMQIMB/CJK1Mg pV83jiIZMA0GCWCGSAFlAwQCAQUAoIHUMC8GCSqGSIb3DQEJBDEiBCC2sznwMUk5ytMvfd/DiZgA rf6Q2F7BRzkT3rLydEmgcDAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEP Fw0xOTA3MzExMjAxNDFaMGkGCSqGSIb3DQEJDzFcMFowCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQB FjALBglghkgBZQMEAQIwCgYIKoZIhvcNAwcwCwYJKoZIhvcNAQEKMAsGCSqGSIb3DQEBBzALBglg hkgBZQMEAgEwDQYJKoZIhvcNAQEBBQAEggEAdHxI8mvE0X8QNOBoNpotmliQxCGcXVXJHnETE91D v68WrnlaSgHIq+ZDPrq56HJiUxR2sh32PJCb0/Muv00O4lsAtQicd6izZJoLPbxSP0cWCGjfrRld 7CKfxgtpfoVsAS0DlY9y+Pi8CsvXMY76bwJIGm2UmoZnUroeXyzbhpiAiubHVD6/7R4gALcZzbmo P5tyspaiOn8RULVPB7MVp6LEzZvhd4gN5oDFFJYfWfhRiDKiucT2fUaTpVJzvl7kit1VdxFFbrpv o81J6m2Jgd6oWDYa1z3Xhs3/IwXxDgzaBBucdxvkLM9FwvzlFpvAJxIRrmrOyzCW++IKFCHUCg== --00000000000064faf1058ef8e3e5-- From nobody Wed Jul 31 10:17:24 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EA9661203D6 for ; Wed, 31 Jul 2019 10:17:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.251 X-Spam-Level: X-Spam-Status: No, score=-9.251 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.249, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, USER_IN_DEF_SPF_WL=-7.5] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=chromium.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GTJy_4lQiBmm for ; Wed, 31 Jul 2019 10:17:20 -0700 (PDT) Received: from mail-qt1-x82a.google.com (mail-qt1-x82a.google.com [IPv6:2607:f8b0:4864:20::82a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 52CBE12034D for ; Wed, 31 Jul 2019 10:17:20 -0700 (PDT) Received: by mail-qt1-x82a.google.com with SMTP id w17so23035496qto.10 for ; Wed, 31 Jul 2019 10:17:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=9JZ5SSliMNoKR8O20HmcQGR3cCirrI9uUW4E6RY8KQc=; b=Viwwq5VLJz6kKGcDS/GI5iUz5OxP0un5vg21sgRs+an7kmceNpLCp9zldiSFesRuFQ kU1q//qM3oK9YRISRV7TEIzbfKiPDJkxt4k91jhmYRctsYgu8zkLMOdAxatYyDOwY0YC F54CZw9uXJNycNu2KNP5s220Em9SQq9WvLs1I= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=9JZ5SSliMNoKR8O20HmcQGR3cCirrI9uUW4E6RY8KQc=; b=Mj1cUzl2s1SzfpgnKWJn334caJx1zKfAWPMFDUPRx1N+2CgXBXg/a/WUvAEPz88yRR Pvj/35JGD2c+tMsDA8cOcrjhzWcpGfAbFLHRhgEMAm3ViKKqMVw7AFb+BvkXUEBlUfKE +fiOeM/3zuAyyybdLFZVg82qc66fLrvBjmOfsWbFi+RRLQDMOeQM3rVSj0WG8k0mL1Pm CmEcD7C5cIbbsInHqo0wBliZqC/91V/fAb4u3w2pXYNYHZIu0dlAWFBGjvb0zYISVS9K 9eKSFugCh8U+Rz94jXZxYTjWIl2OcugWzG6JEWtSXerVXDDO4eZgGVt9BwNbeMPT+owU UUdw== X-Gm-Message-State: APjAAAWRaQ1sWxHiTEp5th+Cu4skmeock/XObxMbB7xtZxCwrscBfwmP /a3vefTBOd729FUNdM4nOogMu21oAjiS7wpgfV3x X-Google-Smtp-Source: APXvYqze4Uh9JwKegOuCd8S4vFKQpYUP6J+/24Hk3PIj3efYagMhz60bWu7ztYLiHmMq1yHF7522kRsqgo4enzm4hZQ= X-Received: by 2002:a0c:b786:: with SMTP id l6mr89112899qve.148.1564593439210; Wed, 31 Jul 2019 10:17:19 -0700 (PDT) MIME-Version: 1.0 References: <20190731073500.GA10363@LK-Perkele-VII> In-Reply-To: <20190731073500.GA10363@LK-Perkele-VII> From: David Benjamin Date: Wed, 31 Jul 2019 13:17:03 -0400 Message-ID: To: Ilari Liusvaara Cc: "" Content-Type: multipart/alternative; boundary="00000000000029e3ad058efd4c2f" Archived-At: Subject: Re: [TLS] Drafts for batch signing and PKCS#1 v1.5 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 31 Jul 2019 17:17:22 -0000 --00000000000029e3ad058efd4c2f Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Wed, Jul 31, 2019 at 3:35 AM Ilari Liusvaara wrote: > On Mon, Jul 29, 2019 at 08:15:44PM -0400, David Benjamin wrote: > > Hi all, > > > > I=E2=80=99ve just uploaded a pair of drafts relating to signatures in T= LS 1..3. > > https://tools.ietf.org/html/draft-davidben-tls13-pkcs1-00 > > https://tools.ietf.org/html/draft-davidben-tls-batch-signing-00 > > > > The second describes a batch signing mechanism for TLS using Merkle > trees. > > It allows TLS clients and servers to better handle signing load. I thin= k > it > > could be beneficial for a number of DoS and remote key scenarios. > > Why is the context string same for clients and servers? The base TLS > 1.3 signatures use different context strings for client and server. > I don't think it's necessary here. The existing separation between client and server in the base TLS 1.3 signatures is preserved here because the input messages include their respective context strings. And if we do TLS 1.4 with its own context string, that'll get picked up too. > What is the hash length of SHAKE256 in Ed448_batch? 512 bits (64 > octets) required to saturate the collision resistance? > Ah, right. Yeah, let's say 512 bits / 64 bytes. I'll incorporate that into the next version of the draft. > "to a random byte of string of" in section 3.1, should that be > "to a random byte string of"? > Oops, thanks! Fixed in local copy. David --00000000000029e3ad058efd4c2f Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Wed, Jul 31, 2019 at 3:35 AM Ilari Liu= svaara <ilariliusvaara@welho= .com> wrote:
On Mon, Jul 29, 2019 at 08:15:44PM -0400, = David Benjamin wrote:
> Hi all,
>
> I=E2=80=99ve just uploaded a pair of drafts relating to signatures in = TLS 1..3.
> https://tools.ietf.org/html/draft-davi= dben-tls13-pkcs1-00
> https://tools.ietf.org/html/draf= t-davidben-tls-batch-signing-00
>
> The second describes a batch signing mechanism for TLS using Merkle tr= ees.
> It allows TLS clients and servers to better handle signing load. I thi= nk it
> could be beneficial for a number of DoS and remote key scenarios.

Why is the context string same for clients and servers? The base TLS
1.3 signatures use different context strings for client and server.

I don't think it's necessary here. The= existing separation between client and server in the base TLS 1.3 signatur= es is preserved here because the input messages include their respective co= ntext strings. And if we do TLS 1.4 with its own context string, that'l= l get picked up too.
=C2=A0
What is the hash length of SHAKE256 in Ed448_batch? 512 bits (64
octets) required to saturate the collision resistance?

Ah, right. Yeah, let's say 512 bits / 64 bytes. I'l= l incorporate that into the next version of the draft.
=C2=A0
"to a random byte of string of" in section 3.1, should that be "to a random byte string of"?

Oops, thanks! Fixed in local copy.

David=C2=A0
--00000000000029e3ad058efd4c2f-- From nobody Wed Jul 31 10:23:06 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 17AA9120480 for ; Wed, 31 Jul 2019 10:23:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.251 X-Spam-Level: X-Spam-Status: No, score=-9.251 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.249, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, USER_IN_DEF_SPF_WL=-7.5] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=chromium.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id X4fVXVmxw-d0 for ; Wed, 31 Jul 2019 10:23:03 -0700 (PDT) Received: from mail-qk1-x731.google.com (mail-qk1-x731.google.com [IPv6:2607:f8b0:4864:20::731]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1AA04120477 for ; Wed, 31 Jul 2019 10:22:47 -0700 (PDT) Received: by mail-qk1-x731.google.com with SMTP id r6so49859016qkc.0 for ; Wed, 31 Jul 2019 10:22:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=srkGQ+vQag8YzYiwOoNYiLeSUjU/Py2eplnhUKoBEzg=; b=dslCE822nBeSoBFbAyF0V4kB1uWnaeXJpIISV3dP2U/gbhHR3ySCxRK4Wq1gqhzesT iZlHY+vmtzlQX7qb0OLggpJgvffecmr69mZN7whw6pQogG63bh1MIp+FZ6N3SYM4hvoE zEfKYCpwMjteanoCiFl1d52aK5HTTlxJdRsMo= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=srkGQ+vQag8YzYiwOoNYiLeSUjU/Py2eplnhUKoBEzg=; b=uedkr+UO3kGSS4kqGd6Qplyja1R8umDgvb3ZX02Rire/3b2xPs4dQ30ynfJkBMV4Dd OKPJPVLGvi0z+aSA7oylEIZXRXCvgYHN8ojMcYj+f/9gWkkBfACsj/seqm3PmLGkWDrg 1acK7Eq01ddtLenUC2pS5EYbVQ2ncF1YLlu3pLZQ6Kc6D0IJGnAoJJWBcTimnbzdr6bv c8Gg5AAmZxlfg4IteK3zoDftFDgpu5edWMk4ZqB17tSSy1J5suJytuyUuYXxqUytE1cZ Ni9VABICZkfrBHvAx1qV8XRCO0I8P9W+JTXu8Uwqc9QUOUVAF7NOexXWzxuu1bd6AKsp Hc1g== X-Gm-Message-State: APjAAAXVoW+WYvnWobZZAQUZ4I9+CTzhjIPAA0isGpiBozQukjxA1G+b bYJCR5h7KFhJeiV09kiE/E9NarwUSeCnx4dJQPIn8iGpgg== X-Google-Smtp-Source: APXvYqzq8JxUflPk5689qLP3xs0L44hhSd1nyONYNfrpOYkq2nIbYGPCAQhtI5xfk11dUFoycLfi/7OFuCSh+oJkb4k= X-Received: by 2002:a37:a14e:: with SMTP id k75mr83153569qke.65.1564593765997; Wed, 31 Jul 2019 10:22:45 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: David Benjamin Date: Wed, 31 Jul 2019 13:22:28 -0400 Message-ID: To: Thom Wiggers Cc: "" Content-Type: multipart/alternative; boundary="000000000000a45515058efd5fdc" Archived-At: Subject: Re: [TLS] Drafts for batch signing and PKCS#1 v1.5 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 31 Jul 2019 17:23:05 -0000 --000000000000a45515058efd5fdc Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Thanks! I've applied those fixes to my local copy. They fixes will be in the -01 revision. On Wed, Jul 31, 2019 at 3:42 AM Thom Wiggers wrote: > Hi David, > > I've found some small textual issues (I'm looking at the PDF version): > > In section 3.1 in step 1 (on PDF page 4): > > "element 2*i+1 to a random byte of string of Hash.length bytes." > > This sentence is slightly puzzling. A random bytestring? > > Section 4.2, first paragraph, last sentence: > > "so batch signing inherits preserves separation" > > This sentence contains two verbs. > I also apparently never finished that sentence. Oops. :-) In my local copy, this paragraph now reads: Signatures made by the same key in different contexts should be separated t= o avoid potential cross-protocol attacks. Inputs to the batch signing algorithm include any existing context strings, such as TLS 1.3's distinct client and server labels or new labels that may be allocated by future versions of TLS= . By signing over those labels, batch signing preserves separation between those inputs. > It looks like an interesting proposition, which could also be interesting > in the context of some of the post-quantum signing algorithms. > > Cheers, > > Thom > > Op di 30 jul. 2019 om 02:16 schreef David Benjamin >: > >> Hi all, >> >> I=E2=80=99ve just uploaded a pair of drafts relating to signatures in TL= S 1.3. >> https://tools.ietf.org/html/draft-davidben-tls13-pkcs1-00 >> https://tools.ietf.org/html/draft-davidben-tls-batch-signing-00 >> >> The first introduces optional legacy codepoints for PKCS#1 v1.5 >> signatures with client certificates. This is unfortunate, but I think we >> should do it. On the Chrome side, we=E2=80=99ve encountered some headach= es with the >> TLS 1.3 PSS requirement which are unique to client certificates. The >> document describes the motivations in detail. >> >> The second describes a batch signing mechanism for TLS using Merkle >> trees. It allows TLS clients and servers to better handle signing load. = I >> think it could be beneficial for a number of DoS and remote key scenario= s. >> >> Thoughts? >> >> David >> _______________________________________________ >> TLS mailing list >> TLS@ietf.org >> https://www.ietf.org/mailman/listinfo/tls >> > --000000000000a45515058efd5fdc Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Thanks! I've applied those fixes to my local copy= . They fixes will be in the -01 revision.

On Wed, Jul 31, 2019 at 3:42 AM Th= om Wiggers <thom@thomwiggers.nl> wrote:
Hi David,

I've found some small textu= al issues (I'm looking at the PDF version):

In= section 3.1 in step 1 (on PDF page 4):

"= element 2*i+1 to a random byte of string of Hash.length bytes."
<= div>

=

I also apparently never finished that sent= ence. Oops. :-) In my local copy, this paragraph now reads:

<= /div>
Signatures made by the same key in different contexts should be s= eparated to
avoid potential cross-protocol attacks. Inputs to the batch = signing algorithm
include any existing context strings, such as TLS 1.3&= #39;s distinct client and
server labels or new labels that may be alloca= ted by future versions of TLS.
By signing over those labels, batch signi= ng preserves separation between those
inputs.
=C2=A0
=
It = looks like an interesting proposition, which could also be interesting in t= he context of some of the post-quantum signing algorithms.

Cheers,

Thom

Op di 30 jul. 2019 om 0= 2:16 schreef David Benjamin <davidben@chromium.org>:
Hi all,

I=E2=80=99= ve just uploaded a pair of drafts relating to signatures in TLS 1.3.
https://tools.ietf.org/html/draft-davidben-tls13-pkcs1-00https://tools.ietf.org/html/draft-davidben-tls-batch-s= igning-00

The first introduces optional legacy codepoints for PK= CS#1 v1.5 signatures with client certificates. This is unfortunate, but I t= hink we should do it. On the Chrome side, we=E2=80=99ve encountered some he= adaches with the TLS 1.3 PSS requirement which are unique to client certifi= cates. The document describes the motivations in detail.

The second = describes a batch signing mechanism for TLS using Merkle trees. It allows T= LS clients and servers to better handle signing load. I think it could be b= eneficial for a number of DoS and remote key scenarios.

Thoughts?
David
_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls
--000000000000a45515058efd5fdc-- From nobody Wed Jul 31 10:40:54 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8A6491201ED for ; Wed, 31 Jul 2019 10:40:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.251 X-Spam-Level: X-Spam-Status: No, score=-9.251 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.249, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, USER_IN_DEF_SPF_WL=-7.5] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=chromium.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oR1OJl1DzYJe for ; Wed, 31 Jul 2019 10:40:51 -0700 (PDT) Received: from mail-qt1-x835.google.com (mail-qt1-x835.google.com [IPv6:2607:f8b0:4864:20::835]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DCC3912015C for ; Wed, 31 Jul 2019 10:40:50 -0700 (PDT) Received: by mail-qt1-x835.google.com with SMTP id y26so67429196qto.4 for ; Wed, 31 Jul 2019 10:40:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=O4ClpOV1BzjA7cQmTwcjBxKdIrH4di+wYtZNpUMBl8U=; b=QBTbaNnPWvKqaKmvTgD0wVUm016FpNmRHn4AwRdy0F1srKpCrcEF2LAdTnGtFdolhZ 3IBPGfsH43YJzsG0HyKdqk0XgdQ1wdDRQ6s232+n7j+SzExbwe+P8IPpIDoQrWle4pjF qKuQe+aHnvakKK7ZsqgZkhGIu4Sn28BoEBSqM= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=O4ClpOV1BzjA7cQmTwcjBxKdIrH4di+wYtZNpUMBl8U=; b=W67qu2+9xNLjk1X65jfR2WVxD1agGU2lVeUddDY2aCv+wUou+lhocmHZt5f2ZKPYu/ Nwx0bS83FYHPBpJT/gF1irw1GwDr0OloHWRfUccXAWN0N+juCTrS5sRn/GpTrkZ8gK5Q e2ibxyeqx6L1vIqDwKWVMU6L8ZakXa0gfAMnwDopd2x/B+Gs/wbcqrAwPNZwczsIapSA ZM/pCP9eCKgb77Wn1+qBMWdylDgVcGyX5CFQax8cIhSFJAVg0Ga85ApXMxDlRPAiOHOQ OxHf1VBGTPXx1R309Y3k0cJuO+ugQEtHb1K6taug3u5MSHejhJO9azyo0297dTCmEAv9 Q7XQ== X-Gm-Message-State: APjAAAXRZPg73t1zfG5JL9SGUN16xMj3j29hWXvn6nA363eThEMobaZG WJuRvttsGFr5MVOsTqQGsCOFeeSex/yBjM9Qn0lf X-Google-Smtp-Source: APXvYqxq6ndVK+07F/i+oEMQXVRoJi7kWWND0tN4LA/u545DDNqegcnjdtlE6ETPJG1d7Qi0Mwh3p46LQwPBjt/ajXs= X-Received: by 2002:a0c:b786:: with SMTP id l6mr89168339qve.148.1564594849670; Wed, 31 Jul 2019 10:40:49 -0700 (PDT) MIME-Version: 1.0 References: <19909dab-34bf-442e-9e67-9aef459d472c@www.fastmail.com> In-Reply-To: From: David Benjamin Date: Wed, 31 Jul 2019 13:40:33 -0400 Message-ID: To: Ben Schwartz Cc: Martin Thomson , "" Content-Type: multipart/alternative; boundary="0000000000003bab79058efda073" Archived-At: Subject: Re: [TLS] Drafts for batch signing and PKCS#1 v1.5 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 31 Jul 2019 17:40:52 -0000 --0000000000003bab79058efda073 Content-Type: text/plain; charset="UTF-8" On Wed, Jul 31, 2019 at 8:01 AM Ben Schwartz wrote: > > > On Wed, Jul 31, 2019 at 12:12 AM David Benjamin > wrote: > >> On Tue, Jul 30, 2019 at 11:59 PM Martin Thomson >> wrote: >> >>> On Wed, Jul 31, 2019, at 13:54, Ben Schwartz wrote: >>> > The batch signing idea is very cool. I'm not entirely sure I >>> understand >>> > the intended use case, though. The intro suggests that this motivated >>> > by DoS defense, but presumably an attacker who controls their own TLS >>> > client stack could simply omit support for these signature schemes. Do >>> > you envision a future where servers can safely omit support for all >>> the >>> > non-batch signature schemes? Or are you thinking of attackers who >>> don't >>> > control the TLS client stack? >>> >>> The usual trick when under duress is to attempt to process some >>> requests, and lowering the cost of handling those requests enables higher >>> tolerance to attack and better continuity of service. A server might >>> choose not to serve clients that don't offer batching if it is stressed. >>> >> >> Yup. The signing cost of a batch-capable client is effectively zero. (I >> expect it's already common to preferentially serve ECDSA-capable clients >> when under load.) Also, if many clients implement this, serving load under >> normal operation goes down, which is also valuable.. >> > > OK. I think it would be good to clarify the motivation in the intro. > (For me, defending against DDoS attackers who don't control the TLS client > stack is also a compelling use case.) > Added to the intro "A server under load could, for instance, preferentially serve batch-capable clients as part of its DoS strategy.". > > Minor question: in the tree diagrams, m2 goes to t04. Is there any >>> > reason it couldn't go directly to t12? That would seem more natural to >>> > me. >>> >>> The blinding process is explained in Section 4.3. >>> >> >> I think Ben is asking why the tree doesn't put m2 a level higher (like CT >> does), instead of adding the padding nodes. That would work too. I chose >> this one because I found it more straightforward, and it doesn't >> particularly matter. Also it's what Roughtime did and I cribbed the >> construction from Roughtime. :-) >> > > OK, thanks for the explanation. My main reason to favor the CT-style tree > structure is that it avoids load spikes. In this structure, incrementally > processing message mk requires k hashes when k is a power of 2, as opposed > to O(1) hashes for each message in a CT-style tree. > I'm not sure I understand the concern. In both constructions, the cost of processing N messages is O(N) total hashes, one signature, and then O(lg N) copies of the hash per message. I'm envisioning the signer just queues up hashed inputs and then builds the tree at signing time. Were you thinking some other pattern? Complete trees are nice because they can be stored in a single contiguous buffer, and the tree construction itself is just a couple of straightforward loops. > In principle, the signer could pick any tree strategy as long as it >> produced valid paths for each message. But I think it's probably better for >> the draft to be opinionated, rather than risk implementers mess things up. >> > > A SHOULD-strength recommendation for a particular approach seems fine, but > I think sophisticated implementers might want to use different structures > depending on their needs. > Flexibility is the enemy of security. ECDSA and EdDSA's verification algorithms will accept manner of nonce generation strategies, but that doesn't mean all of them are fine. I don't think there are enough valuable variations in this space to justify the flexibility. --0000000000003bab79058efda073 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Wed, Jul 31, 2019 at 8:01 AM Ben Schwa= rtz <bemasc@googl= e.com> wrote:


On W= ed, Jul 31, 2019 at 12:12 AM David Benjamin <davidben@chromium.org> wrote:
On Tue, Jul 30, 2019 at 11:59 PM Martin Thomson <mt@lowentropy.net> wrote= :
On Wed, Jul 31, 2019, at 13:54, Ben Schwartz wrote:
> The batch signing idea is very cool. I'm not entirely sure I under= stand
> the intended use case, though. The intro suggests that this motivated =
> by DoS defense, but presumably an attacker who controls their own TLS =
> client stack could simply omit support for these signature schemes. Do=
> you envision a future where servers can safely omit support for all th= e
> non-batch signature schemes? Or are you thinking of attackers who don&= #39;t
> control the TLS client stack?

The usual trick when under duress is to attempt to process some requests, a= nd lowering the cost of handling those requests enables higher tolerance to= attack and better continuity of service.=C2=A0 A server might choose not t= o serve clients that don't offer batching if it is stressed.

Yup. The signing cost of a batch-capable client i= s effectively zero. (I expect it's already common to preferentially ser= ve ECDSA-capable clients when under load.) Also, if many clients implement = this, serving load under normal operation goes down, which is also valuable= ..

OK.=C2=A0 I think it w= ould be good to clarify the motivation in the intro.=C2=A0 (For me, defendi= ng against DDoS attackers who don't control the TLS client stack is als= o a compelling use case.)=C2=A0

Added to the intro "A server under load could, for instance, pr= eferentially serve batch-capable clients as part of its DoS strategy."= .
=C2=A0
<= div dir=3D"ltr">
> Minor question: in the tree diagrams, m2 goes to t04. Is there any > reason it couldn't go directly to t12? That would seem more natura= l to
> me.

The blinding process is explained in Section 4.3.

=
I think Ben is asking why the tree doesn't put m2 a level hi= gher (like CT does), instead of adding the padding nodes. That would work t= oo. I chose this one because I found it more straightforward, and it doesn&= #39;t particularly matter. Also it's what Roughtime did and I cribbed t= he construction from Roughtime. :-)

=
OK, thanks for the explanation.=C2=A0 My main reason to favor th= e CT-style tree structure is that it avoids load spikes.=C2=A0 In this stru= cture, incrementally processing message mk requires k hashes when k is a po= wer of 2, as opposed to O(1) hashes for each message in a CT-style tree.

I'm not sure I understa= nd the concern. In both constructions, the cost of processing N messages is= O(N) total hashes, one signature, and then O(lg N) copies of the hash per = message. I'm envisioning the signer just queues up hashed inputs and th= en builds the tree at signing time. Were you thinking some other pattern?

Complete trees are nice because they can be stored = in a single contiguous buffer, and the tree construction itself is just a c= ouple of straightforward loops.
=C2=A0
In principle, the signer could pick any tree strategy= as long as it produced valid paths for each message. But I think it's = probably better for the draft to be opinionated, rather than risk implement= ers mess things up.

A SHO= ULD-strength=C2=A0recommendation for a particular approach seems fine, but = I think sophisticated implementers might want to use different structures d= epending on their needs.

= Flexibility is the enemy of security. ECDSA and EdDSA's verification al= gorithms will accept manner of nonce generation strategies, but that doesn&= #39;t mean all of them are fine. I don't think there are enough valuabl= e variations in this space to justify the flexibility.
--0000000000003bab79058efda073-- From nobody Wed Jul 31 11:27:04 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E55B81206CC for ; Wed, 31 Jul 2019 11:26:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.5 X-Spam-Level: X-Spam-Status: No, score=-17.5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id E-csre-1zWm8 for ; Wed, 31 Jul 2019 11:26:57 -0700 (PDT) Received: from mail-io1-xd34.google.com (mail-io1-xd34.google.com [IPv6:2607:f8b0:4864:20::d34]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 395F31206C5 for ; Wed, 31 Jul 2019 11:26:57 -0700 (PDT) Received: by mail-io1-xd34.google.com with SMTP id k20so138400962ios.10 for ; Wed, 31 Jul 2019 11:26:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=Jujx+wAKCMT/a0PmYQputNV36pRgWoCLaC6nXx2HGXM=; b=eQ1zx+HXkdwADxJScJoxG52C11o2FWBCXJw6xyyPkRgXKjfXuDXs5PY36sg+tN5/O6 52czEZavNxSnudlr/S0Ngg2CRuTfJX9KdB5cfpWwoZbnG9QQSjdiYBVYgrxXtqogzCFo hdSh/YYFYmtUanzH6togv3HcBW0P3nXJLyNAmcqF0Xi+pBBAR506rUHnJW3PkpMDXx/v +jLtPBojJB0pskgAOTjlhGBbzBUCBIoZ303NogBtavzsa7cxs1o/eX1QCffp/VRK6iVE dVoZkgzHJ2CMUeAIQICG8pw3ix/k0q0n5T4Obaz9LWRtn3Gv4rSYYiNCXXczENIQfB3v IbwA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=Jujx+wAKCMT/a0PmYQputNV36pRgWoCLaC6nXx2HGXM=; b=HItFy2++TYUDtc6Fhw488QyTwHlekyXtjY5vDgMTAsZ3RAjhXHZXpG3H9onIJRIAkx yfjIyd+acittj1MWLUkfBkbgIt8meCp2rl/d3Dx1ReJcuUG1GYzITkxVi2bAOEU8MoiG iuGQmS7dTQ9kpAd107xrcSmTt1Z4JN1Pamls9QdBoMp4IqrMoTeL6fiFOv4Kta0kebE8 kqitZcrykB2Cpwp39tZj9vBTirT+grxRcPeYH2ypaK8ipxv+TnLxviPm5hedqrqjGJ3C G8d/7CWDUG77JIK8LXTW1tYjaGYZG0IDOvk0HIRuJOjB4T6mlf1OHstxoH7gHvcMK3xt ud9A== X-Gm-Message-State: APjAAAXc5uogCm9TxtpVIQA9K3mnQZ5Xix2yqK/ap91w//ox7VIZXY/w qFtFy5XjZ0QuGa2KeJArrG4GNs3C+30OsjUMIHVAXw== X-Google-Smtp-Source: APXvYqxt5b6GsbE+Z3NkJU1l5Ra89Y1BHYyQGvd3IV508kTPzoifGAKsixm3z8MhMqemQCGYrDQQ3NMBA/aySGyB6AE= X-Received: by 2002:a02:cc8e:: with SMTP id s14mr39050391jap.142.1564597614878; Wed, 31 Jul 2019 11:26:54 -0700 (PDT) MIME-Version: 1.0 References: <19909dab-34bf-442e-9e67-9aef459d472c@www.fastmail.com> In-Reply-To: From: Ben Schwartz Date: Wed, 31 Jul 2019 14:26:41 -0400 Message-ID: To: David Benjamin Cc: Martin Thomson , "" Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="00000000000029204f058efe4587" Archived-At: Subject: Re: [TLS] Drafts for batch signing and PKCS#1 v1.5 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 31 Jul 2019 18:27:04 -0000 --00000000000029204f058efe4587 Content-Type: multipart/alternative; boundary="0000000000000d9a65058efe45d0" --0000000000000d9a65058efe45d0 Content-Type: text/plain; charset="UTF-8" On Wed, Jul 31, 2019 at 1:40 PM David Benjamin wrote: > On Wed, Jul 31, 2019 at 8:01 AM Ben Schwartz wrote: > >> >> >> On Wed, Jul 31, 2019 at 12:12 AM David Benjamin >> wrote: >> >>> On Tue, Jul 30, 2019 at 11:59 PM Martin Thomson >>> wrote: >>> >>>> On Wed, Jul 31, 2019, at 13:54, Ben Schwartz wrote: >>>> > The batch signing idea is very cool. I'm not entirely sure I >>>> understand >>>> > the intended use case, though. The intro suggests that this motivated >>>> > by DoS defense, but presumably an attacker who controls their own TLS >>>> > client stack could simply omit support for these signature schemes. >>>> Do >>>> > you envision a future where servers can safely omit support for all >>>> the >>>> > non-batch signature schemes? Or are you thinking of attackers who >>>> don't >>>> > control the TLS client stack? >>>> >>>> The usual trick when under duress is to attempt to process some >>>> requests, and lowering the cost of handling those requests enables higher >>>> tolerance to attack and better continuity of service. A server might >>>> choose not to serve clients that don't offer batching if it is stressed. >>>> >>> >>> Yup. The signing cost of a batch-capable client is effectively zero. (I >>> expect it's already common to preferentially serve ECDSA-capable clients >>> when under load.) Also, if many clients implement this, serving load under >>> normal operation goes down, which is also valuable.. >>> >> >> OK. I think it would be good to clarify the motivation in the intro. >> (For me, defending against DDoS attackers who don't control the TLS client >> stack is also a compelling use case.) >> > > Added to the intro "A server under load could, for instance, > preferentially serve batch-capable clients as part of its DoS strategy.". > > >> > Minor question: in the tree diagrams, m2 goes to t04. Is there any >>>> > reason it couldn't go directly to t12? That would seem more natural >>>> to >>>> > me. >>>> >>>> The blinding process is explained in Section 4.3. >>>> >>> >>> I think Ben is asking why the tree doesn't put m2 a level higher (like >>> CT does), instead of adding the padding nodes. That would work too. I chose >>> this one because I found it more straightforward, and it doesn't >>> particularly matter. Also it's what Roughtime did and I cribbed the >>> construction from Roughtime. :-) >>> >> >> OK, thanks for the explanation. My main reason to favor the CT-style >> tree structure is that it avoids load spikes. In this structure, >> incrementally processing message mk requires k hashes when k is a power of >> 2, as opposed to O(1) hashes for each message in a CT-style tree. >> > > I'm not sure I understand the concern. In both constructions, the cost of > processing N messages is O(N) total hashes, one signature, and then O(lg N) > copies of the hash per message. I'm envisioning the signer just queues up > hashed inputs and then builds the tree at signing time. Were you thinking > some other pattern? > Yes, I was thinking about a signer who builds the tree incrementally while waiting for the "RSA unit" to signal that it is ready. Building the tree at signing time prevents hashes and signatures from running in parallel. That said, I think your construction is actually fine for this purpose. I misinterpreted your diagram to indicate that rows >=1 should have full power-of-2 size. The text makes clear that this is not the intention. Complete trees are nice because they can be stored in a single contiguous > buffer, and the tree construction itself is just a couple of > straightforward loops. > > >> In principle, the signer could pick any tree strategy as long as it >>> produced valid paths for each message. But I think it's probably better for >>> the draft to be opinionated, rather than risk implementers mess things up. >>> >> >> A SHOULD-strength recommendation for a particular approach seems fine, >> but I think sophisticated implementers might want to use different >> structures depending on their needs. >> > > Flexibility is the enemy of security. ECDSA and EdDSA's verification > algorithms will accept manner of nonce generation strategies, but that > doesn't mean all of them are fine. I don't think there are enough valuable > variations in this space to justify the flexibility. > --0000000000000d9a65058efe45d0 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Wed, Jul 31, 2019 at 1:40 PM David= Benjamin <davidben@chromium.or= g> wrote:
On Wed, Jul 31, 2019 at 8:01 AM Ben Schw= artz <bemasc@goog= le.com> wrote:


On W= ed, Jul 31, 2019 at 12:12 AM David Benjamin <davidben@chromium.org> wrote:
On Tue, Jul 30, 2019 at 11:59 PM Martin Thomson <mt@lowentropy.net> wrote= :
On Wed, Jul 31, 2019, at 13:54, Ben Schwartz wrote:
> The batch signing idea is very cool. I'm not entirely sure I under= stand
> the intended use case, though. The intro suggests that this motivated =
> by DoS defense, but presumably an attacker who controls their own TLS =
> client stack could simply omit support for these signature schemes. Do=
> you envision a future where servers can safely omit support for all th= e
> non-batch signature schemes? Or are you thinking of attackers who don&= #39;t
> control the TLS client stack?

The usual trick when under duress is to attempt to process some requests, a= nd lowering the cost of handling those requests enables higher tolerance to= attack and better continuity of service.=C2=A0 A server might choose not t= o serve clients that don't offer batching if it is stressed.

Yup. The signing cost of a batch-capable client i= s effectively zero. (I expect it's already common to preferentially ser= ve ECDSA-capable clients when under load.) Also, if many clients implement = this, serving load under normal operation goes down, which is also valuable= ..

OK.=C2=A0 I think it w= ould be good to clarify the motivation in the intro.=C2=A0 (For me, defendi= ng against DDoS attackers who don't control the TLS client stack is als= o a compelling use case.)=C2=A0

Added to the intro "A server under load could, for instance, pr= eferentially serve batch-capable clients as part of its DoS strategy."= .
=C2=A0
<= div dir=3D"ltr">
> Minor question: in the tree diagrams, m2 goes to t04. Is there any > reason it couldn't go directly to t12? That would seem more natura= l to
> me.

The blinding process is explained in Section 4.3.

=
I think Ben is asking why the tree doesn't put m2 a level hi= gher (like CT does), instead of adding the padding nodes. That would work t= oo. I chose this one because I found it more straightforward, and it doesn&= #39;t particularly matter. Also it's what Roughtime did and I cribbed t= he construction from Roughtime. :-)

=
OK, thanks for the explanation.=C2=A0 My main reason to favor th= e CT-style tree structure is that it avoids load spikes.=C2=A0 In this stru= cture, incrementally processing message mk requires k hashes when k is a po= wer of 2, as opposed to O(1) hashes for each message in a CT-style tree.

I'm not sure I understa= nd the concern. In both constructions, the cost of processing N messages is= O(N) total hashes, one signature, and then O(lg N) copies of the hash per = message. I'm envisioning the signer just queues up hashed inputs and th= en builds the tree at signing time. Were you thinking some other pattern?

Yes, I was thinking about = a signer who builds the tree incrementally while waiting for the "RSA = unit" to signal that it is ready.=C2=A0 Building the tree at signing t= ime prevents hashes and signatures from running in parallel.

=
That said, I think your construction is actually fine for this p= urpose.=C2=A0 I misinterpreted your diagram to indicate that rows >=3D1 = should have full power-of-2 size.=C2=A0 The text makes clear that this is n= ot the intention.

Complete tree= s are nice because they can be stored in a single contiguous buffer, and th= e tree construction itself is just a couple of straightforward loops.
=
=C2=A0
In principle, t= he signer could pick any tree strategy as long as it produced valid paths f= or each message. But I think it's probably better for the draft to be o= pinionated, rather than risk implementers mess things up.
=

A SHOULD-strength=C2=A0recommendation for = a particular approach seems fine, but I think sophisticated implementers mi= ght want to use different structures depending on their needs.
<= /div>

Flexibility is the enemy of security.= ECDSA and EdDSA's verification algorithms will accept manner of nonce = generation strategies, but that doesn't mean all of them are fine. I do= n't think there are enough valuable variations in this space to justify= the flexibility.
--0000000000000d9a65058efe45d0-- --00000000000029204f058efe4587 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIIS5wYJKoZIhvcNAQcCoIIS2DCCEtQCAQExDzANBglghkgBZQMEAgEFADALBgkqhkiG9w0BBwGg ghBNMIIEXDCCA0SgAwIBAgIOSBtqDm4P/739RPqw/wcwDQYJKoZIhvcNAQELBQAwZDELMAkGA1UE BhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVy c29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hBMjU2IC0gRzIwHhcNMTYwNjE1MDAwMDAwWhcNMjEw NjE1MDAwMDAwWjBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xvYmFsU2lnbiBudi1zYTEiMCAG A1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC AQoCggEBALR23lKtjlZW/17kthzYcMHHKFgywfc4vLIjfq42NmMWbXkNUabIgS8KX4PnIFsTlD6F GO2fqnsTygvYPFBSMX4OCFtJXoikP2CQlEvO7WooyE94tqmqD+w0YtyP2IB5j4KvOIeNv1Gbnnes BIUWLFxs1ERvYDhmk+OrvW7Vd8ZfpRJj71Rb+QQsUpkyTySaqALXnyztTDp1L5d1bABJN/bJbEU3 Hf5FLrANmognIu+Npty6GrA6p3yKELzTsilOFmYNWg7L838NS2JbFOndl+ce89gM36CW7vyhszi6 6LqqzJL8MsmkP53GGhf11YMP9EkmawYouMDP/PwQYhIiUO0CAwEAAaOCASIwggEeMA4GA1UdDwEB /wQEAwIBBjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwEgYDVR0TAQH/BAgwBgEB/wIB ADAdBgNVHQ4EFgQUyzgSsMeZwHiSjLMhleb0JmLA4D8wHwYDVR0jBBgwFoAUJiSSix/TRK+xsBtt r+500ox4AAMwSwYDVR0fBEQwQjBAoD6gPIY6aHR0cDovL2NybC5nbG9iYWxzaWduLmNvbS9ncy9n c3BlcnNvbmFsc2lnbnB0bnJzc2hhMmcyLmNybDBMBgNVHSAERTBDMEEGCSsGAQQBoDIBKDA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzANBgkqhkiG 9w0BAQsFAAOCAQEACskdySGYIOi63wgeTmljjA5BHHN9uLuAMHotXgbYeGVrz7+DkFNgWRQ/dNse Qa4e+FeHWq2fu73SamhAQyLigNKZF7ZzHPUkSpSTjQqVzbyDaFHtRBAwuACuymaOWOWPePZXOH9x t4HPwRQuur57RKiEm1F6/YJVQ5UTkzAyPoeND/y1GzXS4kjhVuoOQX3GfXDZdwoN8jMYBZTO0H5h isymlIl6aot0E5KIKqosW6mhupdkS1ZZPp4WXR4frybSkLejjmkTYCTUmh9DuvKEQ1Ge7siwsWgA NS1Ln+uvIuObpbNaeAyMZY0U5R/OyIDaq+m9KXPYvrCZ0TCLbcKuRzCCBB4wggMGoAMCAQICCwQA AAAAATGJxkCyMA0GCSqGSIb3DQEBCwUAMEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAt IFIzMRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWduMB4XDTExMDgwMjEw MDAwMFoXDTI5MDMyOTEwMDAwMFowZDELMAkGA1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24g bnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVyc29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hB MjU2IC0gRzIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCg/hRKosYAGP+P7mIdq5NB Kr3J0tg+8lPATlgp+F6W9CeIvnXRGUvdniO+BQnKxnX6RsC3AnE0hUUKRaM9/RDDWldYw35K+sge C8fWXvIbcYLXxWkXz+Hbxh0GXG61Evqux6i2sKeKvMr4s9BaN09cqJ/wF6KuP9jSyWcyY+IgL6u2 52my5UzYhnbf7D7IcC372bfhwM92n6r5hJx3r++rQEMHXlp/G9J3fftgsD1bzS7J/uHMFpr4MXua eoiMLV5gdmo0sQg23j4pihyFlAkkHHn4usPJ3EePw7ewQT6BUTFyvmEB+KDoi7T4RCAZDstgfpzD rR/TNwrK8/FXoqnFAgMBAAGjgegwgeUwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8C AQEwHQYDVR0OBBYEFCYkkosf00SvsbAbba/udNKMeAADMEcGA1UdIARAMD4wPAYEVR0gADA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzA2BgNVHR8E LzAtMCugKaAnhiVodHRwOi8vY3JsLmdsb2JhbHNpZ24ubmV0L3Jvb3QtcjMuY3JsMB8GA1UdIwQY MBaAFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQACAFVjHihZCV/IqJYt 7Nig/xek+9g0dmv1oQNGYI1WWeqHcMAV1h7cheKNr4EOANNvJWtAkoQz+076Sqnq0Puxwymj0/+e oQJ8GRODG9pxlSn3kysh7f+kotX7pYX5moUa0xq3TCjjYsF3G17E27qvn8SJwDsgEImnhXVT5vb7 qBYKadFizPzKPmwsJQDPKX58XmPxMcZ1tG77xCQEXrtABhYC3NBhu8+c5UoinLpBQC1iBnNpNwXT Lmd4nQdf9HCijG1e8myt78VP+QSwsaDT7LVcLT2oDPVggjhVcwljw3ePDwfGP9kNrR+lc8XrfClk WbrdhC2o4Ui28dtIVHd3MIIDXzCCAkegAwIBAgILBAAAAAABIVhTCKIwDQYJKoZIhvcNAQELBQAw TDEgMB4GA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjMxEzARBgNVBAoTCkdsb2JhbFNpZ24x EzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDkwMzE4MTAwMDAwWhcNMjkwMzE4MTAwMDAwWjBMMSAw HgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMzETMBEGA1UEChMKR2xvYmFsU2lnbjETMBEG A1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMwldpB5Bngi FvXAg7aEyiie/QV2EcWtiHL8RgJDx7KKnQRfJMsuS+FggkbhUqsMgUdwbN1k0ev1LKMPgj0MK66X 17YUhhB5uzsTgHeMCOFJ0mpiLx9e+pZo34knlTifBtc+ycsmWQ1z3rDI6SYOgxXG71uL0gRgykmm KPZpO/bLyCiR5Z2KYVc3rHQU3HTgOu5yLy6c+9C7v/U9AOEGM+iCK65TpjoWc4zdQQ4gOsC0p6Hp sk+QLjJg6VfLuQSSaGjlOCZgdbKfd/+RFO+uIEn8rUAVSNECMWEZXriX7613t2Saer9fwRPvm2L7 DWzgVGkWqQPabumDk3F2xmmFghcCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQF MAMBAf8wHQYDVR0OBBYEFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQBL QNvAUKr+yAzv95ZURUm7lgAJQayzE4aGKAczymvmdLm6AC2upArT9fHxD4q/c2dKg8dEe3jgr25s bwMpjjM5RcOO5LlXbKr8EpbsU8Yt5CRsuZRj+9xTaGdWPoO4zzUhw8lo/s7awlOqzJCK6fBdRoyV 3XpYKBovHd7NADdBj+1EbddTKJd+82cEHhXXipa0095MJ6RMG3NzdvQXmcIfeg7jLQitChws/zyr VQ4PkX4268NXSb7hLi18YIvDQVETI53O9zJrlAGomecsMx86OyXShkDOOyyGeMlhLxS67ttVb9+E 7gUJTb0o2HLO02JQZR7rkpeDMdmztcpHWD9fMIIEZDCCA0ygAwIBAgIMB/CJK1MgpV83jiIZMA0G CSqGSIb3DQEBCwUAMEwxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMSIw IAYDVQQDExlHbG9iYWxTaWduIEhWIFMvTUlNRSBDQSAxMB4XDTE5MDMxMzA4MjIxOVoXDTE5MDkw OTA4MjIxOVowIjEgMB4GCSqGSIb3DQEJAQwRYmVtYXNjQGdvb2dsZS5jb20wggEiMA0GCSqGSIb3 DQEBAQUAA4IBDwAwggEKAoIBAQCsphkGEsCh0fF4+6Wsi1u40JxI6W6Izew+dLGK4b93LCRAuJ8y g9wSnwGAtk9/23VmtKwBrMaJD5j9SVZpscvLAjrWwADl/THU22uTW0MsUE2fPOPv2s4hE+vMgRmK P2E+xpI6n0gFvn8qrUHO1dm6PJaP5SWa+zdB/Ja1LgMJTpevQqjK4LKjWmHFPR6CplS4RImjGk7U 0I6invTyQnL5p583t5PI7FcM5UyjAqxGEETdAuc7N4IqjNETvPwL0wLIzxPDA5PMqcWPSzg7sBAB LVUQRYNIAJPlVpUdg1IeAjil5BaaWBjEeCLBSGDFX3WaWfMNzQvRZr4i6oJxzV+1AgMBAAGjggFu MIIBajAcBgNVHREEFTATgRFiZW1hc2NAZ29vZ2xlLmNvbTBQBggrBgEFBQcBAQREMEIwQAYIKwYB BQUHMAKGNGh0dHA6Ly9zZWN1cmUuZ2xvYmFsc2lnbi5jb20vY2FjZXJ0L2dzaHZzbWltZWNhMS5j cnQwHQYDVR0OBBYEFFSy8ovdLNSQc8aqxOgKS7sBOm/UMB8GA1UdIwQYMBaAFMs4ErDHmcB4koyz IZXm9CZiwOA/MEwGA1UdIARFMEMwQQYJKwYBBAGgMgEoMDQwMgYIKwYBBQUHAgEWJmh0dHBzOi8v d3d3Lmdsb2JhbHNpZ24uY29tL3JlcG9zaXRvcnkvMDsGA1UdHwQ0MDIwMKAuoCyGKmh0dHA6Ly9j cmwuZ2xvYmFsc2lnbi5jb20vZ3NodnNtaW1lY2ExLmNybDAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0l BBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMA0GCSqGSIb3DQEBCwUAA4IBAQCbQ++Znz6xh85ZlZEN Y/vAF0vn111O0c2houe4LlLQkoQ1QS4fH5EYcBx/393FTq5n08ezWYVtmeQ6W15e34CqjYNop1Vh mihZ+3J6+LL/6YNi91cp5yMFgxOP9aI/Y8IaIWZJAY2e8yHbYSq0z8kka0H6S4VvFjwtRogkWW95 0SStEwo/8viJ02BwpmVj4YIA6Fva1ZbeN2TnUMCAHJAlKWOGlpHxpcdcWckED0XbSY9w6bllMw1T tsbiUwQxDeO++Y8NfS8rieZgfv3RlobKihE8xbIVGRHIq1gup4nXv6XDwHDYyGhafIfUD4Ix00Wk gnODGb+jPwoQlDX0X64qMYICXjCCAloCAQEwXDBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xv YmFsU2lnbiBudi1zYTEiMCAGA1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMQIMB/CJK1Mg pV83jiIZMA0GCWCGSAFlAwQCAQUAoIHUMC8GCSqGSIb3DQEJBDEiBCBRhEIvRztKs26crItJsKaZ 8bjyUbD8XULlMhv7/zH0YjAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEP Fw0xOTA3MzExODI2NTZaMGkGCSqGSIb3DQEJDzFcMFowCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQB FjALBglghkgBZQMEAQIwCgYIKoZIhvcNAwcwCwYJKoZIhvcNAQEKMAsGCSqGSIb3DQEBBzALBglg hkgBZQMEAgEwDQYJKoZIhvcNAQEBBQAEggEApzdmcm3S8u2i+QhXZoKb+LjqHCqqnpG7xjn+P8kV dOeajpXZZSPph9jI+KpODANuWgpEuSO494eQhsk9OciOOSMXpG75XA5V8WutbaTNqGQA+rc6JW5r oPYl5qsBEtMYi8N+7UagTKy5pe4YGPdAbTjN4uP3tLRBgnRVNt2yV7aSJzC55yMLFtD3JQ2/YGQj MW+9znZ1wXlruFW2QL/GP7tRJhVNn9odeDajWIQP8yUXmiu4ufzsDCkjOZPczNd5Aie8OHgCXKM7 ynvgjDgYQacBdXZyBAJDc9V7bk3zUlLCBCVLGRR+s6a7BtwfIzMbeRq9CvlKZOemeNS+GZyYew== --00000000000029204f058efe4587--