From nobody Mon Jun 17 06:52:06 2019 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B28A81200F7; Mon, 17 Jun 2019 06:51:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=comodoca.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YQEa35NJQOWs; Mon, 17 Jun 2019 06:51:53 -0700 (PDT) Received: from NAM04-CO1-obe.outbound.protection.outlook.com (mail-eopbgr690043.outbound.protection.outlook.com [40.107.69.43]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8896D1200B2; Mon, 17 Jun 2019 06:51:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=comodoca.onmicrosoft.com; s=selector1-comodoca-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=dUQHsvepD44uDbwrFhADXjlHy3D+BpXNfl08xU0pmuo=; b=EsSbv4mpF3UlCQ4qirUwY2tDDX9tZ61YqvzWGZP5FM94BGawZ0lvU5oItDh5oaVlLG3vESkIJZmPqGLmsUirWnBz1GIDdliqMKiRhVvivCCigFcexQngmVtmSioLhwWWtlFGwAmi97w2LDI7OuozlqEry8TQpMVwG3uAk0TUOP0= Received: from DM6PR17MB2251.namprd17.prod.outlook.com (20.176.92.149) by DM6PR17MB3049.namprd17.prod.outlook.com (20.178.228.156) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1987.11; Mon, 17 Jun 2019 13:51:51 +0000 Received: from DM6PR17MB2251.namprd17.prod.outlook.com ([fe80::f96d:65b0:2e92:c71a]) by DM6PR17MB2251.namprd17.prod.outlook.com ([fe80::f96d:65b0:2e92:c71a%5]) with mapi id 15.20.1987.014; Mon, 17 Jun 2019 13:51:51 +0000 From: Rob Stradling To: Alissa Cooper via Datatracker , The IESG CC: "draft-ietf-trans-rfc6962-bis@ietf.org" , Paul Wouters , "trans-chairs@ietf.org" , "trans@ietf.org" Thread-Topic: Alissa Cooper's Discuss on draft-ietf-trans-rfc6962-bis-31: (with DISCUSS and COMMENT) Thread-Index: AQHU2bqhuxa6xQXvdkSjDBkaFqj6fqagdCMA Date: Mon, 17 Jun 2019 13:51:50 +0000 Message-ID: <9af2fff4-d060-facf-87c0-5de96651b2ba@sectigo.com> References: <155249486456.28074.9608101501013163742.idtracker@ietfa.amsl.com> In-Reply-To: <155249486456.28074.9608101501013163742.idtracker@ietfa.amsl.com> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-clientproxiedby: LO2P265CA0120.GBRP265.PROD.OUTLOOK.COM (2603:10a6:600:c::36) To DM6PR17MB2251.namprd17.prod.outlook.com (2603:10b6:5:b9::21) authentication-results: spf=none (sender IP is ) smtp.mailfrom=rob@sectigo.com; x-ms-exchange-messagesentrepresentingtype: 1 x-originating-ip: [2a0e:ac00:25d:300:f68e:38ff:fe7a:a226] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 9c7779e9-051b-4988-3615-08d6f32af2c0 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:DM6PR17MB3049; x-ms-traffictypediagnostic: DM6PR17MB3049: x-ms-exchange-purlcount: 3 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-forefront-prvs: 0071BFA85B x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(39850400004)(396003)(376002)(346002)(136003)(366004)(189003)(199004)(6512007)(5660300002)(86362001)(6306002)(73956011)(186003)(25786009)(4326008)(6116002)(102836004)(8936002)(7736002)(53936002)(6246003)(110136005)(2906002)(81166006)(81156014)(8676002)(305945005)(68736007)(31686004)(54906003)(478600001)(966005)(14444005)(256004)(316002)(6486002)(229853002)(36756003)(76176011)(66476007)(64756008)(66446008)(99286004)(446003)(52116002)(66556008)(66946007)(11346002)(486006)(71200400001)(71190400001)(6436002)(386003)(6506007)(476003)(2616005)(53546011)(14454004)(46003)(31696002); DIR:OUT; SFP:1101; SCL:1; SRVR:DM6PR17MB3049; H:DM6PR17MB2251.namprd17.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: sectigo.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: /XP3SMtRmoSp+6UB2xr0JmcK+XWODS09HLLTDyz8/lKCD5NajzBPWczeatYcpct+nIWoDdKUmZhIy/K5je3EbNM/SRohV+/zLWau8IstsrRjTRUh80QdNAF/0AzsNcqVlRBzWYS9ZwLQOiSTZB513/TQtfLL4xUhiV0Y58OsbJNniGIUtHf0AYxRt2Oou4LnjwYpLxvHE/Zy1DTSq/kPoJ8kpWTxy75dMV8lP90UPXzazU7v/e+is+SeQH0bwJrVxj1SJLtVXXA3nREwzqtC68e/F1p17v9eVwLL4GXFTpHrtTytnIC4lWusM/DOam5iILo+G/xeQnCViz/sltNYn/Vg91GYvKCJjXk5phh9gaVXPlNusPnJK1+wBI55ovGTVVtHV/oXnA+5gjch6bWfQU0SWkiTY9S76o2rdJdQ/r4= Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: sectigo.com X-MS-Exchange-CrossTenant-Network-Message-Id: 9c7779e9-051b-4988-3615-08d6f32af2c0 X-MS-Exchange-CrossTenant-originalarrivaltime: 17 Jun 2019 13:51:50.9471 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 0e9c4894-6caa-465d-9660-4b6968b49fb7 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: robs@comodoca.net X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR17MB3049 Archived-At: Subject: Re: [Trans] Alissa Cooper's Discuss on draft-ietf-trans-rfc6962-bis-31: (with DISCUSS and COMMENT) X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 17 Jun 2019 13:51:57 -0000 QWxpc3NhLCB0aGFua3MgZm9yIHlvdXIgcmV2aWV3LCBhbmQgSSBhcG9sb2dpemUgdGhhdCBub25l IG9mIHRoaXMgDQpkb2N1bWVudCdzIGF1dGhvcnMgaGF2ZSBiZWVuIGF2YWlsYWJsZSB0byByZXNw b25kIHVudGlsIG5vdy4NCg0KSSBoYXZlIGZpbGVkIA0KaHR0cHM6Ly9naXRodWIuY29tL2dvb2ds ZS9jZXJ0aWZpY2F0ZS10cmFuc3BhcmVuY3ktcmZjcy9wdWxsLzMwOSwgd2hpY2ggDQpJIGJlbGll dmUgYWRkcmVzc2VzIGFsbCBvZiB5b3VyIGNvbmNlcm5zLg0KDQpPbiAxMy8wMy8yMDE5IDE2OjM0 LCBBbGlzc2EgQ29vcGVyIHZpYSBEYXRhdHJhY2tlciB3cm90ZToNCj4gQWxpc3NhIENvb3BlciBo YXMgZW50ZXJlZCB0aGUgZm9sbG93aW5nIGJhbGxvdCBwb3NpdGlvbiBmb3INCj4gZHJhZnQtaWV0 Zi10cmFucy1yZmM2OTYyLWJpcy0zMTogRGlzY3Vzcw0KPiANCj4gV2hlbiByZXNwb25kaW5nLCBw bGVhc2Uga2VlcCB0aGUgc3ViamVjdCBsaW5lIGludGFjdCBhbmQgcmVwbHkgdG8gYWxsDQo+IGVt YWlsIGFkZHJlc3NlcyBpbmNsdWRlZCBpbiB0aGUgVG8gYW5kIENDIGxpbmVzLiAoRmVlbCBmcmVl IHRvIGN1dCB0aGlzDQo+IGludHJvZHVjdG9yeSBwYXJhZ3JhcGgsIGhvd2V2ZXIuKQ0KPiANCj4g DQo+IFBsZWFzZSByZWZlciB0byBodHRwczovL3d3dy5pZXRmLm9yZy9pZXNnL3N0YXRlbWVudC9k aXNjdXNzLWNyaXRlcmlhLmh0bWwNCj4gZm9yIG1vcmUgaW5mb3JtYXRpb24gYWJvdXQgSUVTRyBE SVNDVVNTIGFuZCBDT01NRU5UIHBvc2l0aW9ucy4NCj4gDQo+IA0KPiBUaGUgZG9jdW1lbnQsIGFs b25nIHdpdGggb3RoZXIgYmFsbG90IHBvc2l0aW9ucywgY2FuIGJlIGZvdW5kIGhlcmU6DQo+IGh0 dHBzOi8vZGF0YXRyYWNrZXIuaWV0Zi5vcmcvZG9jL2RyYWZ0LWlldGYtdHJhbnMtcmZjNjk2Mi1i aXMvDQo+IA0KPiANCj4gDQo+IC0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCj4gRElTQ1VTUzoNCj4gLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLQ0KPiANCj4gR2xhZCB0byBzZWUgdGhpcyByZXZpc2lvbiBvZiB0aGUgcHJvdG9jb2wuIE15 IGNvbW1lbnRzIGFuZCBxdWVzdGlvbnMgc2hvdWxkIGJlDQo+IGVhc3kgdG8gYWRkcmVzcy4NCj4g DQo+ID0gU2VjdGlvbiAxMC4yLCAxMC40LCAxMC41ID0NCj4gDQo+IEEgU3BlY2lmaWNhdGlvbiBS ZXF1aXJlZCByZWdpc3RyeSBwb2xpY3kgaW1wbGllcyBleHBlcnQgcmV2aWV3LiBTbyBhIHJlZ2lz dHJ5DQo+IHBvbGljeSBvZiAiU3BlY2lmaWNhdGlvbiBSZXF1aXJlZCBhbmQgRXhwZXJ0IFJldmll dyIgaXMgZHVwbGljYXRpdmU7IGl0IHNob3VsZA0KPiBqdXN0IHNheSAiU3BlY2lmaWNhdGlvbiBS ZXF1aXJlZC4iIEkga25vdyB0aGlzIHNlZW1zIHRyaXZpYWwgYnV0IHRoZXJlIGhhcyBiZWVuDQo+ IHNvIG11Y2ggY29uZnVzaW9uIGFib3V0IHRoaXMgdGhyb3VnaCB0aGUgeWVhcnMgdGhhdCBpdCBp cyBpbXBvcnRhbnQgdG8gYmUNCj4gcHJlY2lzZS4NCj4gDQo+ID0gU2VjdGlvbiAxMC4zID0NCj4g DQo+IFRoaXMgc2VjdGlvbiBuZWVkcyB0byBzdGF0ZSB3aGF0IHRoZSByZWdpc3RyeSBwb2xpY3kg aXMgZm9yIHRoZSBjb2RlIHBvaW50cyBub3QNCj4gYWxyZWFkeSByZWdpc3RlcmVkIChwcmVzdW1h Ymx5IEV4cGVydCBSZXZpZXcgZ2l2ZW4gMTAuMy4xLCBidXQgaXQgbmVlZHMgdG8gYmUNCj4gZXhw bGljaXQpLg0KPiANCj4gPSBTZWN0aW9uIDEwLjYuMSA9DQo+IA0KPiBVc2luZyB0aGUgdGVybSAi UGFyYW1ldGVycyBSZXF1aXJlZCIgYXMgYSBjYXBpdGFsaXplZCB0ZXJtIGlzIGNvbmZ1c2luZy4g RkNGUw0KPiByZWdpc3RyaWVzIGJ5IGRlZmluaXRpb24gY2FuIHJlcXVpcmUgYWRkaXRpb25hbCBp bmZvcm1hdGlvbiB0byBiZSBwcm92aWRlZCBpbg0KPiBvcmRlciB0byBnZXQgc29tZXRoaW5nIHJl Z2lzdGVyZWQuIEZvciBhdm9pZGFuY2Ugb2YgY29uZnVzaW9uIEkgdGhpbmsgdGhlDQo+IGFzc2ln bm1lbnQgcG9saWN5IHNob3VsZCBiZSBsaXN0ZWQgYXMgRmlyc3QgQ29tZSBGaXJzdCBTZXJ2ZWQg YW5kIHRoZQ0KPiByZXF1aXJlbWVudCB0aGF0IHBhcmFtZXRlcnMgYmUgaW5jbHVkZWQgaW4gdGhl IGFwcGxpY2F0aW9uIGNhbiB1c2UgYSBub3JtYXRpdmUNCj4gTVVTVCBpbiB0aGUgbGFzdCBwYXJh Z3JhcGggaWYgdGhlcmUgaXMgY29uY2VybiB0aGF0IHRoZSBwYXJhbWV0ZXJzIHdvbid0IGJlDQo+ IHN1cHBsaWVkLg0KPiANCj4gSG93ZXZlciwgSSBhbHNvIHdvbmRlciB3aGF0IHdpbGwgYmUgZG9u ZSB3aXRoIHRoZSBwYXJhbWV0ZXJzIHRoYXQgYXJlIHN1cHBsaWVkLg0KPiBJcyBJQU5BIGV4cGVj dGVkIHRvIGp1c3QgbWFpbnRhaW4gdGhlbSBwcml2YXRlbHksIG9yIHRvIHB1Ymxpc2ggdGhlbT8N Cj4gDQo+IFdoYXQgaXMgZXhwZWN0ZWQgdG8gYXBwZWFyIGluIHRoZSAnTG9nJyBjb2x1bW4gaW4g dGhlIHJlZ2lzdHJ5Pw0KPiANCj4gDQo+IC0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCj4gQ09NTUVOVDoNCj4gLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLQ0KPiANCj4gSW4gU2VjdGlvbiAxLjEsIHBsZWFzZSB1c2UgdGhlIFJGQyA4MTc0 IGJvaWxlcnBsYXRlIGluIGxpZXUgb2YgdGhlIFJGQyAyMTE5IGJvaWxlcnBsYXRlLg0KPiANCj4g DQoNCi0tIA0KUm9iIFN0cmFkbGluZw0KU2VuaW9yIFJlc2VhcmNoICYgRGV2ZWxvcG1lbnQgU2Np ZW50aXN0DQpFbWFpbDogcm9iQHNlY3RpZ28uY29tDQpCcmFkZm9yZCwgVUsNCk9mZmljZTogKzQ0 MTI3NDAyNDcwNw0KU2VjdGlnbyBMaW1pdGVkDQoNClRoaXMgbWVzc2FnZSBhbmQgYW55IGZpbGVz IGFzc29jaWF0ZWQgd2l0aCBpdCBtYXkgY29udGFpbiBsZWdhbGx5IA0KcHJpdmlsZWdlZCwgY29u ZmlkZW50aWFsLCBvciBwcm9wcmlldGFyeSBpbmZvcm1hdGlvbi4gSWYgeW91IGFyZSBub3QgdGhl IA0KaW50ZW5kZWQgcmVjaXBpZW50LCB5b3UgYXJlIG5vdCBwZXJtaXR0ZWQgdG8gdXNlLCBjb3B5 LCBvciBmb3J3YXJkIGl0LCANCmluIHdob2xlIG9yIGluIHBhcnQgd2l0aG91dCB0aGUgZXhwcmVz cyBjb25zZW50IG9mIHRoZSBzZW5kZXIuIFBsZWFzZSANCm5vdGlmeSB0aGUgc2VuZGVyIGJ5IHJl cGx5IGVtYWlsLCBkaXNyZWdhcmQgdGhlIGZvcmVnb2luZyBtZXNzYWdlcywgYW5kIA0KZGVsZXRl IGl0IGltbWVkaWF0ZWx5Lg0K From nobody Tue Jun 18 02:50:53 2019 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 95052120118; Tue, 18 Jun 2019 02:50:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=comodoca.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JLPmiV43K0rf; Tue, 18 Jun 2019 02:50:49 -0700 (PDT) Received: from NAM02-BL2-obe.outbound.protection.outlook.com (mail-eopbgr750078.outbound.protection.outlook.com [40.107.75.78]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1032B1200BA; Tue, 18 Jun 2019 02:50:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=comodoca.onmicrosoft.com; s=selector1-comodoca-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=EfJq+uiWnLsVkI0In0uNzW3sd/7EdW9z16X155yJw3s=; b=TXZ6QWjMMAejGLuaVp58i95yC2g1MXzYEQD9++4mDEoRfqdSrwBGsUz2nqL+CvCPl4A4bA6lpnviP8D1BYrAYkNVzApLwz8jLlZCmmUgNdFudE2+nSxzWT9meJQJs16qGLHnr3sp4k+/ewp0oeYOJbJEXvT+RMK7rTw5XaVjDKY= Received: from DM6PR17MB2251.namprd17.prod.outlook.com (20.176.92.149) by DM6SPR01MB0025.namprd17.prod.outlook.com (20.176.116.76) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1987.12; Tue, 18 Jun 2019 09:50:46 +0000 Received: from DM6PR17MB2251.namprd17.prod.outlook.com ([fe80::f96d:65b0:2e92:c71a]) by DM6PR17MB2251.namprd17.prod.outlook.com ([fe80::f96d:65b0:2e92:c71a%5]) with mapi id 15.20.1987.014; Tue, 18 Jun 2019 09:50:46 +0000 From: Rob Stradling To: Adam Roach CC: Alexey Melnikov , Eric Rescorla , "draft-ietf-trans-rfc6962-bis@ietf.org" , Paul Wouters , Trans , The IESG , "trans-chairs@ietf.org" Thread-Topic: Adam Roach's Discuss on draft-ietf-trans-rfc6962-bis-31: (with DISCUSS and COMMENT) Thread-Index: AQHU2Wch53aa+rMxm0GatE3OyKQHD6YJjl4AgABCe4CAADnJAICXuSIA Date: Tue, 18 Jun 2019 09:50:46 +0000 Message-ID: References: <155245900142.5466.15600148045977298644.idtracker@ietfa.amsl.com> In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-clientproxiedby: LO2P265CA0186.GBRP265.PROD.OUTLOOK.COM (2603:10a6:600:a::30) To DM6PR17MB2251.namprd17.prod.outlook.com (2603:10b6:5:b9::21) authentication-results: spf=none (sender IP is ) smtp.mailfrom=rob@sectigo.com; x-ms-exchange-messagesentrepresentingtype: 1 x-originating-ip: [2a0e:ac00:25d:300:f68e:38ff:fe7a:a226] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 0ced5964-8f17-468b-a596-08d6f3d26fb3 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:DM6SPR01MB0025; x-ms-traffictypediagnostic: DM6SPR01MB0025: x-ms-exchange-purlcount: 1 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-forefront-prvs: 007271867D x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(346002)(39860400002)(396003)(376002)(366004)(136003)(51444003)(54164003)(199004)(189003)(186003)(561944003)(6506007)(966005)(66574012)(66446008)(66556008)(66476007)(386003)(66946007)(64756008)(52116002)(73956011)(53546011)(25786009)(5660300002)(71200400001)(71190400001)(86362001)(99286004)(7736002)(305945005)(53936002)(446003)(68736007)(102836004)(11346002)(76176011)(14444005)(476003)(31696002)(2616005)(486006)(478600001)(36756003)(2906002)(6116002)(8936002)(81166006)(81156014)(6246003)(256004)(46003)(31686004)(8676002)(6512007)(6486002)(6436002)(229853002)(6306002)(6916009)(4326008)(14454004)(316002)(54906003); DIR:OUT; SFP:1101; SCL:1; SRVR:DM6SPR01MB0025; H:DM6PR17MB2251.namprd17.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: sectigo.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: D+xdWSuOyGQWtZ8NCNMlaKPxbsM1FqOr70SpVH6A7ByBMrsjSlV2wxUgsMA8EBHnbE2f//sDw/20h69//uTQmVRd6t5Dz4YLw3WZUTn3wdlEPPfL1gsBF7/IfmhgXhOKnmkCN/gefgpsndYsWrDa5OSenPUh5cYDN/2tKpNxFep87gExEcbqDPlnjDIiM14xhkbcku0Z3tVtN21W9Lnew1Q/OugbkwL33chpoasfFhZHG/K82nsVo/9FYxEuIO7FelnbUXn2+LdC36F3rww6f8v6lBbINEgxWGjjPjRmwybxkU+iTQzVhhNc+ab5I8aFv1GYpQS+K7X0qzG/GVCCTnNG97Md43FTYBGmnrJl4Zak5IQXr82UI4DYhBzTZzojrkptrrTfOfCl1CWTEEUx2DxaUxeuNuc6pyqHT1YH3AQ= Content-Type: text/plain; charset="utf-8" Content-ID: <8B957F3E4E883249AAECAA48005D18EC@namprd17.prod.outlook.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: sectigo.com X-MS-Exchange-CrossTenant-Network-Message-Id: 0ced5964-8f17-468b-a596-08d6f3d26fb3 X-MS-Exchange-CrossTenant-originalarrivaltime: 18 Jun 2019 09:50:46.4858 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 0e9c4894-6caa-465d-9660-4b6968b49fb7 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: robs@comodoca.net X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6SPR01MB0025 Archived-At: Subject: Re: [Trans] Adam Roach's Discuss on draft-ietf-trans-rfc6962-bis-31: (with DISCUSS and COMMENT) X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 18 Jun 2019 09:50:53 -0000 QWRhbSwgdGhhbmtzIGZvciB5b3VyIHJldmlldywgYW5kIEkgYXBvbG9naXplIHRoYXQgbm9uZSBv ZiB0aGlzDQpkb2N1bWVudCdzIGF1dGhvcnMgaGF2ZSBiZWVuIGF2YWlsYWJsZSB0byByZXNwb25k IHVudGlsIG5vdy4NCg0KSSBoYXZlIGZpbGVkDQpodHRwczovL2dpdGh1Yi5jb20vZ29vZ2xlL2Nl cnRpZmljYXRlLXRyYW5zcGFyZW5jeS1yZmNzL3B1bGwvMzEwLCB3aGljaA0KSSBiZWxpZXZlIGFk ZHJlc3NlcyBhbGwgb2YgeW91ciBjb25jZXJucy4NCg0KT24gMTMvMDMvMjAxOSAyMDo1MiwgQWxl eGV5IE1lbG5pa292IHdyb3RlOg0KPiBPbiBXZWQsIE1hciAxMywgMjAxOSwgYXQgNToyNiBQTSwg QWRhbSBSb2FjaCB3cm90ZToNCj4+IE9uIDMvMTMvMTkgODoyOCBBTSwgRXJpYyBSZXNjb3JsYSB3 cm90ZToNCj4+Pg0KPj4+IE9uIFR1ZSwgTWFyIDEyLCAyMDE5IGF0IDExOjM2IFBNIEFkYW0gUm9h Y2ggdmlhIERhdGF0cmFja2VyIA0KPj4+IDxub3JlcGx5QGlldGYuLm9yZyA8bWFpbHRvOm5vcmVw bHlAaWV0Zi5vcmc+PiB3cm90ZToNCj4+Pg0KPj4+DQo+Pj4gICAgIC0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCj4+ PiAgICAgRElTQ1VTUzoNCj4+PiAgICAgLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0KPj4+DQo+Pj4gICAgIFRoYW5r cyB0byBldmVyeW9uZSB3aG8gd29ya2VkIG9uIHVwZGF0aW5nIHRoaXMgcHJvdG9jb2wgdG8NCj4+ PiAgICAgcmVmbGVjdCBleHBlcmllbmNlDQo+Pj4gICAgIGdhdGhlcmVkIGZyb20gdGhlIGluaXRp YWwgQ1QgcHJvdG9jb2wuIEkgaGF2ZSBvbmUgYmxvY2tpbmcNCj4+PiAgICAgY29tbWVudCwgYW5k IGEgc21hbGwNCj4+PiAgICAgbnVtYmVyIG9mIGVkaXRvcmlhbCBzdWdnZXN0aW9ucy4NCj4+Pg0K Pj4+ICAgICAtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCj4+Pg0KPj4+ICAgICDCpzU6DQo+Pj4NCj4+PiAg ICAgPsKgIENsaWVudHMgYXJlIGNvbmZpZ3VyZWQgd2l0aCBhIGJhc2UgVVJMIGZvciBhIGxvZyBh bmQgY29uc3RydWN0DQo+Pj4gICAgIFVSTHMNCj4+PiAgICAgPsKgIGZvciByZXF1ZXN0cyBieSBh cHBlbmRpbmcgc3VmZml4ZXMgdG8gdGhpcyBiYXNlIFVSTC4gVGhpcw0KPj4+ICAgICBzdHJ1Y3R1 cmUNCj4+PiAgICAgPsKgIHBsYWNlcyBzb21lIGRlZ3JlZSBvZiByZXN0cmljdGlvbiBvbiBob3cg bG9nIG9wZXJhdG9ycyBjYW4gZGVwbG95DQo+Pj4gICAgID7CoCB0aGVzZSBzZXJ2aWNlcywgYXMg bm90ZWQgaW4gW1JGQzczMjBdLsKgIEhvd2V2ZXIsIG9wZXJhdGlvbmFsDQo+Pj4gICAgID7CoCBl eHBlcmllbmNlIHdpdGggdmVyc2lvbiAxIG9mIHRoaXMgcHJvdG9jb2wgaGFzIG5vdCBpbmRpY2F0 ZWQgdGhhdA0KPj4+ICAgICA+wqAgdGhlc2UgcmVzdHJpY3Rpb25zIGFyZSBhIHByb2JsZW0gaW4g cHJhY3RpY2UuDQo+Pj4NCj4+PiAgICAgVGhlIHN5bnRoZXNpcyBvZiBVUkxzIGJ5IGEgcHJvdG9j b2wgaW4gdGhpcyBmYXNoaW9uIGlzIHByb2hpYml0ZWQNCj4+PiAgICAgYnkgQkNQIDE5MDoNCj4+ Pg0KPj4+ICAgICDCoCDCoFNjaGVtZSBkZWZpbml0aW9ucyBkZWZpbmUgdGhlIHByZXNlbmNlLCBm b3JtYXQsIGFuZCBzZW1hbnRpY3Mgb2YgYQ0KPj4+ICAgICDCoCDCoHBhdGggY29tcG9uZW50IGlu IFVSSXM7IGFsbCBvdGhlciBzcGVjaWZpY2F0aW9ucyBNVVNUIE5PVA0KPj4+ICAgICBjb25zdHJh aW4sDQo+Pj4gICAgIMKgIMKgb3IgZGVmaW5lIHRoZSBzdHJ1Y3R1cmUgb3IgdGhlIHNlbWFudGlj cyBmb3IgYW55IHBhdGggY29tcG9uZW50Lg0KPj4+DQo+Pj4gICAgIFVubGVzcyB0aGUgaW50ZW50 aW9uIG9mIHRoaXMgZG9jdW1lbnQgaXMgdG8gdXBkYXRlIEJDUCAxOTAgdG8NCj4+PiAgICAgY2hh bmdlIHRoaXMNCj4+PiAgICAgbm9ybWF0aXZlIHJlcXVpcmVtZW50LCB3ZSBjYW4ndCBwdWJsaXNo IGl0IGluIGl0cyBjdXJyZW50IGZvcm0uDQo+Pj4gICAgIE5vdGUgdGhhdCBkb2luZw0KPj4+ICAg ICBzbyB3b3VsZCByZXF1aXJlIGEgY2hhbmdlIG9mIHZlbnVlLCBhcyB1cGRhdGVzIHRvIEJDUCAx OTAgd291bGQNCj4+PiAgICAgbm90IGJlIGNvdmVyZWQNCj4+PiAgICAgYnkgdGhlIGN1cnJlbnQg VFJBTlMgY2hhcnRlci4NCj4+Pg0KPj4+ICAgICBQbGVhc2Ugc2VlIEJDUCAxOTAgc2VjdGlvbiAz IGZvciBhbHRlcm5hdGUgYXBwcm9hY2hlcy4gQWxsIHRocmVlDQo+Pj4gICAgIGFwcHJvYWNoZXMN Cj4+PiAgICAgY291bGQgYmUgbWFkZSB0byB3b3JrIGZvciBDVCwgYW5kIEkgd291bGQgYmUgaGFw cHkgdG8gZXhwbGFpbiBob3cNCj4+PiAgICAgdG8gZG8gc28gaWYNCj4+PiAgICAgY2xhcmlmaWNh dGlvbiBpcyBkZXNpcmVkLg0KPj4+DQo+Pj4NCj4+PiBXaGlsZSBJIGFncmVlIHRoYXQgdGhpcyBp cyBmb3JiaWRkZW4gYnkgQkNQIDE5MCwgdGhpcyBzdHJ1Y3R1cmUgaXMgDQo+Pj4gaW5oZXJpdGVk IGZyb20NCj4+PiBSRkMgNjk2Miwgd2hpY2ggcHJlZGF0ZWQgNzMyMCwgc28gbWFraW5nIHRoYXQg Y2hhbmdlIHNlZW1zIGxpa2UgaXQncyANCj4+PiBnb2luZw0KPj4+IHRvIGJlIGZhaXJseSBkaXNy dXB0aXZlLiBUaGlzIHNlZW1zIGxpa2UgaXQgaXMgZmFsbGluZyBpbnRvIG91ciANCj4+PiBkaXNj dXNzaW9uIHRoZSBvdGhlcg0KPj4+IGRheSBhYm91dCB3aGF0IG11c3QgYmUgY2hhbmdlZCBpbiAt YmlzIGRvY3VtZW50cy4NCj4+DQo+PiBJIHRoaW5rIHRoZSB0aW1pbmcgb2YgdGhpcyBkb2N1bWVu dCBpcyBmb3J0dWl0b3VzLCBpbiB0aGF0IGl0IGNhbiBoZWxwIA0KPj4gaW5mb3JtIHRoYXQgY29u dmVyc2F0aW9uLiBJbiBwYXJ0aWN1bGFyLCB0aGlzIHNpdHVhdGlvbiBoZWxwcyBtZSANCj4+IGJl dHRlciB1bmRlcnN0YW5kIHdoeSBib3RoIHlvdSBhbmQgQmVuamFtaW4gcmFpc2VkIG9iamVjdGlv bnMgdG8gdGhlIA0KPj4gaGlnaC1sZXZlbCBwcm9wb3NhbCB0aGF0IHVuY2hhbmdlZCBwYXJ0cyBv ZiAtYmlzIGRvY3VtZW50cyBzaG91bGRuJ3QgDQo+PiBiZSBzdWJqZWN0IHRvIERJU0NVU1MgcG9z aXRpb25zLiBUaGUgdGFrZS1hd2F5IHRoYXQgSSBwbGFuIHRvIGJyaW5nIHRvIA0KPj4gdGhhdCBj b252ZXJzYXRpb24gaXMgdGhhdCBzdWNoIGEgZGVjaXNpb24gbmVlZHMgdG8gYmUgaW5mb3JtZWQg YnkgKGEpIA0KPj4gc2NvcGUgb2YgY2hhbmdlcyBiZXR3ZWVuIGEgZG9jdW1lbnQgYW5kIGl0cyAt YmlzLCBhbmQgKGIpIHNjb3BlIG9mIA0KPj4gY2hhbmdlcyByZXF1aXJlZCB0byBzYXRpc2Z5IGEg cG90ZW50aWFsIERJU0NVU1MgcG9zaXRpb24uDQo+Pg0KPj4gSW4gY2FzZXMgbGlrZSB0aGlzIG9u ZSwgd2hlcmUgYSBub3QtZXZlbi1yZW1vdGVseS1iYWNrd2FyZHMtY29tcGF0aWJsZSANCj4+IHN1 aXRlIG9mIHByb3RvY29sIGNoYW5nZXMgaXMgYmVpbmcgbWFkZSB0byBhIHByb3RvY29sIGluIGEg ZG9jdW1lbnQgDQo+PiB1cGRhdGUgd2hvc2UgZGlmZiBbMV0gaXMgYmFzaWNhbGx5IHRoZSBlbnRp cmUgZG9jdW1lbnQsIEkgZG9uJ3QgdGhpbmsgDQo+PiB0aGUgcHJpbmNpcGxlIG9mIGlnbm9yaW5n IGV4aXN0aW5nIGZsYXdzIGluIGEgcHJldmlvdXMgZG9jdW1lbnQgcmVhbGx5IA0KPj4gYXBwbGll cy4gSSBnZXQgdGhhdCBib3RoIG9mIHRob3NlIHByZWRpY2F0ZXMgYXJlIHNvbWV3aGF0IHN1Ympl Y3RpdmUgDQo+PiBldmFsdWF0aW9ucywgYW5kIHRoYXQgZHJhd2luZyBhIGxpbmUgaW4gYSBwcm9j ZXNzIGRvY3VtZW50IG1pZ2h0IGJlIA0KPj4gZGlmZmljdWx0OyBidXQgSSB0aGluayB0aGF0IGFu eSBzdGFuZGFyZCwgaG93ZXZlciBzdWJqZWN0aXZlLCB0aGF0IHlvdSANCj4+IHdvdWxkIGJlIHdp bGxpbmcgdG8gc2lnbiBvbiB0byB3b3VsZCBwbGFjZSB0aGlzIGRvY3VtZW50IG91dHNpZGUgdGhl IA0KPj4gY2F0ZWdvcnkgb2YgImJpcyB2ZXJzaW9ucyB0aGF0IGFyZSBtYWtpbmcgc21hbGwsIGlu Y3JlbWVudGFsIGNoYW5nZXMgDQo+PiB0byBleGlzdGluZyBkb2N1bWVudHMuIg0KPj4NCj4+IElm IHRoZSByZW1lZHkgZm9yIHRoZSBmbGF3IHdlcmUgYSBtYWpvciBvdmVyaGF1bCByYXRoZXIgdGhh biBhIA0KPj4gcmVsYXRpdmVseSBtaW5vciB0d2VhaywgaXQgd291bGQgYWdhaW4gc2hpZnQgdGhl IGV2YWx1YXRpb24gYSBiaXQ7IA0KPj4gaG93ZXZlciwgdGhlIG5hw692ZSBiYW5kLWFpZCBzb2x1 dGlvbiBvZiBtb3ZpbmcgQ1QgZW5kcG9pbnRzIHRvIGxpdmUgDQo+PiB1bmRlciAiLy53ZWxsLWtu b3duL2N0IiBpcyBhIHRyaXZpYWwgY2hhbmdlLCBib3RoIGZvciB0aGlzIGRvY3VtZW50IA0KPj4g YW5kIGZvciBpbXBsZW1lbnRhdGlvbnMgKGluIGZhY3QsIGZvciBpbXBsZW1lbnRhdGlvbnMsIGl0 IGNhbiANCj4+IGdlbmVyYWxseSBiZSBhY2NvbXBsaXNoZWQgd2l0aCBhIGNvbmZpZ3VyYXRpb24g dHdlYWsgcmF0aGVyIHRoYW4gDQo+PiB3cml0aW5nIG5ldyBjb2RlKS4gVG8gYmUgY2xlYXIsIHRo aXMgaXMgYSB0ZXh0Ym9vayBleGFtcGxlIG9mIHRoZSBraW5kIA0KPj4gb2Ygc2l0dWF0aW9uIFVS SSB0ZW1wbGF0ZXMgd2VyZSBkZXNpZ25lZCBmb3IsIGJ1dCB0aGF0IHdvdWxkIHJlcXVpcmUgDQo+ PiBzdWJzdGFudGlhbGx5IG1vcmUgd29yayB0aGFuIHNpbXBseSBtb3ZpbmcgaXQgaW50byB0aGUg LndlbGwta25vd24gDQo+PiB0cmVlLiBFaXRoZXIgYXBwcm9hY2ggd291bGQgYWRkcmVzcyB0aGUg VVJJIG93bmVyc2hpcCBpc3N1ZS4NCj4+DQo+IEkgYW0gaW4gZnVsbCBhZ3JlZW1lbnQgd2l0aCB0 aGlzLg0KPiANCg0KLS0gDQpSb2IgU3RyYWRsaW5nDQpTZW5pb3IgUmVzZWFyY2ggJiBEZXZlbG9w bWVudCBTY2llbnRpc3QNCkVtYWlsOiByb2JAc2VjdGlnby5jb20NCkJyYWRmb3JkLCBVSw0KT2Zm aWNlOiArNDQxMjc0MDI0NzA3DQpTZWN0aWdvIExpbWl0ZWQNCg0KVGhpcyBtZXNzYWdlIGFuZCBh bnkgZmlsZXMgYXNzb2NpYXRlZCB3aXRoIGl0IG1heSBjb250YWluIGxlZ2FsbHkgDQpwcml2aWxl Z2VkLCBjb25maWRlbnRpYWwsIG9yIHByb3ByaWV0YXJ5IGluZm9ybWF0aW9uLiBJZiB5b3UgYXJl IG5vdCB0aGUgDQppbnRlbmRlZCByZWNpcGllbnQsIHlvdSBhcmUgbm90IHBlcm1pdHRlZCB0byB1 c2UsIGNvcHksIG9yIGZvcndhcmQgaXQsIA0KaW4gd2hvbGUgb3IgaW4gcGFydCB3aXRob3V0IHRo ZSBleHByZXNzIGNvbnNlbnQgb2YgdGhlIHNlbmRlci4gUGxlYXNlIA0Kbm90aWZ5IHRoZSBzZW5k ZXIgYnkgcmVwbHkgZW1haWwsIGRpc3JlZ2FyZCB0aGUgZm9yZWdvaW5nIG1lc3NhZ2VzLCBhbmQg DQpkZWxldGUgaXQgaW1tZWRpYXRlbHkuDQo= From nobody Wed Jun 19 15:15:39 2019 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D99A112029F; Wed, 19 Jun 2019 15:15:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.01 X-Spam-Level: X-Spam-Status: No, score=-2.01 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QPrKhYfR_lZY; Wed, 19 Jun 2019 15:15:35 -0700 (PDT) Received: from NAM04-SN1-obe.outbound.protection.outlook.com (mail-eopbgr700126.outbound.protection.outlook.com [40.107.70.126]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 87E49120052; Wed, 19 Jun 2019 15:15:35 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=testarcselector01; d=microsoft.com; cv=none; b=UJrtisI0IDGvf6t5mL3uirTw+jFILKgppWzk6clBr3NjySiygPr5cgr7aQsMI4n2QHIG+qAB/ybujbtWOJPlHokkUwrFYglVK1fRPTpII9p3k0zB3gFUUK8djODVcBY3LqdfK+zcNi1pXdNnfDhFjiDDKp/cNyD/KwEeeHVyBdM= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=testarcselector01; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=B6Rq0Trw0O35BZH5CjmARqz8TEFBNOgJRgCiHhAq9DY=; b=KwExpXH3YNJq/eTJtit139LFsNpFYxwb+c2lCaequVVNKcFVZHxeGUgng2T/4fi8NUUgpGAg+2mof+Jo7WsdDIkpBO5x52vBUsTy/RWqKJXd6EuWmV/3qhVd0ufKMZIynGjrXACFGRJ8+ci/1q4iATYSD8IcBE6luAUFn+mWGPQ= ARC-Authentication-Results: i=1; test.office365.com 1;spf=none;dmarc=none;dkim=none;arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=B6Rq0Trw0O35BZH5CjmARqz8TEFBNOgJRgCiHhAq9DY=; b=BB2t2qUXnwCfIiNuLkJx1VxR4dvybbXl1WyXVUQccOhBwdyV4CMgQv1n04/+aZ2H5DuYVRvryC+qW3h0U03VbuPl9hezXWK41QLSY3Kw5iSK0NiZam3k7WB2ge3L/ZgJaKgJKxSFQraKKAWx0cuGe6NQ5cHFtdshRxGQ1ISpZtI= Received: from MWHPR21MB0846.namprd21.prod.outlook.com (2603:10b6:300:77::12) by MWHPR21MB0288.namprd21.prod.outlook.com (2603:10b6:300:7a::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2008.4; Wed, 19 Jun 2019 22:15:34 +0000 Received: from MWHPR21MB0846.namprd21.prod.outlook.com ([fe80::7494:1d1:dd28:75fc]) by MWHPR21MB0846.namprd21.prod.outlook.com ([fe80::7494:1d1:dd28:75fc%3]) with mapi id 15.20.2008.007; Wed, 19 Jun 2019 22:15:34 +0000 From: Rashmi Jha To: "trans@ietf.org" CC: "draft-ietf-trans-rfc6962-bis@ietf.org" , "benl@google.com" , "agl@google.com" , "ekasper@google.com" , "rob@sectigo.com" Thread-Topic: draft-ietf-trans-rfc6962-bis-31 Thread-Index: AdUm63nX6SEEUQM9QPCVcL3rkFMn6w== Importance: high X-Priority: 1 Date: Wed, 19 Jun 2019 22:15:33 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=True; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Owner=rashmij@microsoft.com; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2019-06-19T22:15:32.0885132Z; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Name=General; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Application=Microsoft Azure Information Protection; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ActionId=af73b2cf-e319-4fda-b462-a1b48dd78ee0; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Extended_MSFT_Method=Automatic authentication-results: spf=none (sender IP is ) smtp.mailfrom=rashmij@microsoft.com; x-originating-ip: [167.220.104.235] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 7289d131-d16b-4233-1b21-08d6f503a620 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(5600148)(711020)(4605104)(1401327)(4618075)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(2017052603328)(7193020); SRVR:MWHPR21MB0288; x-ms-traffictypediagnostic: MWHPR21MB0288: x-ms-exchange-purlcount: 2 x-o365-sonar-daas-pilot: True x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-forefront-prvs: 0073BFEF03 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(366004)(136003)(376002)(346002)(396003)(39860400002)(189003)(199004)(2906002)(6506007)(8990500004)(4326008)(316002)(4744005)(6916009)(5660300002)(33656002)(53936002)(256004)(81686011)(26005)(102836004)(8936002)(7736002)(2501003)(14454004)(186003)(3846002)(52396003)(6116002)(10090500001)(99286004)(86362001)(54906003)(478600001)(68736007)(74316002)(14444005)(76116006)(73956011)(8676002)(66946007)(52536014)(790700001)(64756008)(10290500003)(22452003)(66446008)(66476007)(66066001)(66556008)(236005)(5640700003)(55016002)(71190400001)(6306002)(54896002)(6436002)(476003)(7696005)(2351001)(25786009)(1730700003)(71200400001)(486006)(81156014)(9686003)(81166006); DIR:OUT; SFP:1102; SCL:1; SRVR:MWHPR21MB0288; H:MWHPR21MB0846.namprd21.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: SuXOYbUfw0a+ftSYRDMQO2AtZvJ0nFaS8YFC/URwTTH3GuQfim2zzF9+X9vL241ypNZPtTjMNJa0U6j/WudzvbaNP66b37l3AsEOzazHiSHOqpcikHovIMyKVd4WB1UWMmQOGaEaEnriT65qA7NgKuM4T05D26n3ATzKfF2lU3nvize4Ty5OPvJvE7sdZYtwrptl9qRQOSi3VEFy3j7hacwtmVuslAI/kwHQEiSjmLUt/TszCFem8DUco6RSdqBos1tIGB9AZt0UXU3mJJfS4Elxxlt5Zfl4KF5IKvfn9UFskaPZ/TTq22w2yRmK736p2JCx5HtOLGe9dbt7so7SVLFoacTB/4UEoke+AHr3R1oz8URGbFO6oM8QIpZri6XdixjcapLuYomDbG7Kn0caF0kjzkuFeGIhqrTrnOpPpgA= Content-Type: multipart/alternative; boundary="_000_MWHPR21MB0846D2C92633AE28A7B012EAA7E50MWHPR21MB0846namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: 7289d131-d16b-4233-1b21-08d6f503a620 X-MS-Exchange-CrossTenant-originalarrivaltime: 19 Jun 2019 22:15:33.9143 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: rashmij@microsoft.com X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR21MB0288 Archived-At: Subject: [Trans] draft-ietf-trans-rfc6962-bis-31 X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 19 Jun 2019 22:15:38 -0000 --_000_MWHPR21MB0846D2C92633AE28A7B012EAA7E50MWHPR21MB0846namp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Have you looked into the options of not requiring CT for CAs which are cons= trained to a brief list of domains ? I understand this was considered in th= e past but couldn't find details why this was not accepted. Named constraint by default provide the assurance as to what domains they w= ill issue. CT becomes an additional network call in in issuance of certific= ate which can be prevented. Opinions ? Could you assist to forward it to the right email aliases if thi= s isn't one? Thanks, Rashmi Jha. Azure Security Program Manager Microsoft Corporation rashmij@microsoft.com --_000_MWHPR21MB0846D2C92633AE28A7B012EAA7E50MWHPR21MB0846namp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Have you looked into the options of not requiring CT= for CAs which are constrained to a brief list of domains ? I understand th= is was considered in the past but couldn’t find details why this was = not accepted.

 

Named constraint by default provide the assurance as= to what domains they will issue. CT becomes an additional network call in = in issuance of certificate which can be prevented.  

 

Opinions ? Could you assist to forward it to the rig= ht email aliases if this isn’t one?

 

Thanks, Rashmi Jha.

Azure Security Program Manager

Microsoft Corporation

rashmij@mic= rosoft.com

--_000_MWHPR21MB0846D2C92633AE28A7B012EAA7E50MWHPR21MB0846namp_-- From nobody Wed Jun 19 16:43:51 2019 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CBE871200F7 for ; Wed, 19 Jun 2019 16:43:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nohats.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IX6a-Wi6TZ8r for ; Wed, 19 Jun 2019 16:43:48 -0700 (PDT) Received: from mx.nohats.ca (mx.nohats.ca [193.110.157.68]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D991412012A for ; Wed, 19 Jun 2019 16:43:47 -0700 (PDT) Received: from localhost (localhost [IPv6:::1]) by mx.nohats.ca (Postfix) with ESMTP id 45ThNd3Lftz3Bb; Thu, 20 Jun 2019 01:43:45 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nohats.ca; s=default; t=1560987825; bh=LeORfeX5BNTIABaJ/sBUCQTcswo4lknzN8dG6yPwwYQ=; h=Date:From:To:cc:Subject:In-Reply-To:References; b=StE6O13lNmpzu2/o9XRrBJCwFuxXbSMyfiDZCfdmC8TcVY3TSjrIJrEfLkuZuxRdw g9nndzm/u/JcAH5zbdB7L6vbtYkxsDH6xKSeRdeZGRJ8uofTJeL7Td/wLAfcD902EH wu/qoXWzLjKhc/BOKRNocwNIHgRbbaHZ2xIlw0ug= X-Virus-Scanned: amavisd-new at mx.nohats.ca Received: from mx.nohats.ca ([IPv6:::1]) by localhost (mx.nohats.ca [IPv6:::1]) (amavisd-new, port 10024) with ESMTP id ePiunVS1mdFU; Thu, 20 Jun 2019 01:43:43 +0200 (CEST) Received: from bofh.nohats.ca (bofh.nohats.ca [76.10.157.69]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx.nohats.ca (Postfix) with ESMTPS; Thu, 20 Jun 2019 01:43:43 +0200 (CEST) Received: by bofh.nohats.ca (Postfix, from userid 1000) id 1F3BB393509; Wed, 19 Jun 2019 19:43:42 -0400 (EDT) DKIM-Filter: OpenDKIM Filter v2.11.0 bofh.nohats.ca 1F3BB393509 Received: from localhost (localhost [127.0.0.1]) by bofh.nohats.ca (Postfix) with ESMTP id 123AA4009E7F; Wed, 19 Jun 2019 19:43:42 -0400 (EDT) Date: Wed, 19 Jun 2019 19:43:42 -0400 (EDT) From: Paul Wouters To: Rashmi Jha cc: "trans@ietf.org" In-Reply-To: Message-ID: References: User-Agent: Alpine 2.21 (LRH 202 2017-01-01) MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset=ISO-8859-7 Content-Transfer-Encoding: 8BIT Archived-At: Subject: Re: [Trans] draft-ietf-trans-rfc6962-bis-31 X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 19 Jun 2019 23:43:50 -0000 On Wed, 19 Jun 2019, Rashmi Jha wrote: > Have you looked into the options of not requiring CT for CAs which are constrained to a brief list of domains ? I understand this was considered in the past but couldn˘t find details why this was not > accepted. Whether or not to require CT is not part of the document. This seems more like a question to browser vendors. The draft only states: In addition, if TLS clients will not accept unlogged certificates, then site owners will have a greater incentive to submit certificates to logs, possibly with the assistance of their CA, increasing the overall transparency of the system. The "if" there is important. It is not a decision made in this document or this Working Group. The draft only lists the requirements and formats for when CT is used. > Named constraint by default provide the assurance as to what domains they will issue. CT becomes an additional network call in in issuance of certificate which can be prevented.   Not "assurance", but "expectation". CT is there to confirm this expectation. Surely, you want CT logs to show captured certificates that were signed by a CA outside of that CA's own Named constraint policy? Additionally, if you skip accepting certificates within a named constraint, what do you do when some CA claims ".com" as their named constraint? Paul From nobody Thu Jun 20 03:10:04 2019 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 984481201E4 for ; Thu, 20 Jun 2019 03:10:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.509 X-Spam-Level: X-Spam-Status: No, score=-17.509 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_DKIMWL_WL_MED=-0.01, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TOLkMFCXK71H for ; Thu, 20 Jun 2019 03:10:00 -0700 (PDT) Received: from mail-yw1-xc2f.google.com (mail-yw1-xc2f.google.com [IPv6:2607:f8b0:4864:20::c2f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B37E512003F for ; Thu, 20 Jun 2019 03:10:00 -0700 (PDT) Received: by mail-yw1-xc2f.google.com with SMTP id l79so920364ywe.11 for ; Thu, 20 Jun 2019 03:10:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=93koxKBO7uppo/DGhoG5Qefyy9sXZCrZKxSsVlcGi10=; b=aqnwxt/Fk9OkSU0wqfJeqTMJmZdkqFWmc4ue2vdAuxXY2aaFqAycnAmtQc8hcQKjnP WvVpFG8vqwRJ2je7ciqNcMWwXWnihsTITShv4uKuRJ7z7EBcxRR4fPOw6qbmbHr8zkbZ 7AWJJ6Mzon5Sdbo9qvD/9idBjWvoMOcoCnuvoeHog5JjByjHdet6ZZptCAGm+SwZh9T7 E3SxTy01DbzaSAUpg7uOJhiKK3wBOUtlE/oJkAEb2FEXXWXoV+ur7jGZrieLGlqvXFxu HGmBTcSuFBb5VsDb1qE9DM5vZpCtb5a5PbSrxF83T+37/vOYSqFjNLJIoZSKihDThE4W plsw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=93koxKBO7uppo/DGhoG5Qefyy9sXZCrZKxSsVlcGi10=; b=Mwr0sVQwKbgLgPUZ1f9lkyMzDtFE5w4vVDn5qN7sen31chRq5Y2mOWGYghAWfXkn8G WiRoJrBNF8WrLkx/wQsYcvZDx+qdrw65XVnmC3belOS3UiumQ8EX61C7zK86/ar3y+Tk Qv1bXFlee1myMEnwrc9HStgIPX2HNK2FK7hyKa2GsDweEUZqiDIQCSZqlMPAhmCKzQKb 45SH9XBcKuRBSTmN4D1l8irtZoXRvsLcwoaFP+qW+MPgeLLtntr8Mxf9hPq8W5XONu0S rAXrf47qXCoPbTatwVV9NWJl2UC5kRzkqWp5dLRL6lG9PEEapDTVOBR1JXbupkd21Qmj FnLA== X-Gm-Message-State: APjAAAWHwNtE9Kt1gj2u6si0KVjrHzLEpqc46FB4xs4TiNgP7pFFc17X IFRw1CoL/v7u8tGGRZqklOv3mmXjVoiy/X1e1BGWRQ== X-Google-Smtp-Source: APXvYqz76Ci3DglGf2vYOnfzRhzNkruApPmTuO33BA55A0Li4sIREV0toGKl9/12ykGEXl9TagB5uv7Rj+YCfRNsMkk= X-Received: by 2002:a81:35c9:: with SMTP id c192mr64990285ywa.193.1561025399602; Thu, 20 Jun 2019 03:09:59 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Eran Messeri Date: Thu, 20 Jun 2019 11:09:33 +0100 Message-ID: To: Paul Wouters Cc: Rashmi Jha , "trans@ietf.org" Content-Type: multipart/alternative; boundary="0000000000006e1589058bbe8c81" Archived-At: Subject: Re: [Trans] draft-ietf-trans-rfc6962-bis-31 X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 20 Jun 2019 10:10:03 -0000 --0000000000006e1589058bbe8c81 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Paul made the point quite accurately - CT is orthogonal to name-constraining a CA, and can be used to validate the CA has adhered to the constrained names. Additionally, there's no way to signal to a user agent that such a CA would be "exempt" from CT (some user agents have Enterprise controls to allow instances managed by the organization to not require CT for certain domains, though). On Thu, Jun 20, 2019 at 12:44 AM Paul Wouters wrote: > On Wed, 19 Jun 2019, Rashmi Jha wrote: > > > Have you looked into the options of not requiring CT for CAs which are > constrained to a brief list of domains ? I understand this was considered > in the past but couldn=E2=80=99t find details why this was not > > accepted. > > Whether or not to require CT is not part of the document. This seems > more like a question to browser vendors. The draft only states: > > > In addition, if TLS clients will not accept unlogged certificates, > then site owners will have a greater incentive to submit certificates > to logs, possibly with the assistance of their CA, increasing the > overall transparency of the system. > > The "if" there is important. It is not a decision made in this document > or this Working Group. > > The draft only lists the requirements and formats for when CT is used. > > > Named constraint by default provide the assurance as to what domains > they will issue. CT becomes an additional network call in in issuance of > certificate which can be prevented. > > Not "assurance", but "expectation". CT is there to confirm this > expectation. Surely, you want CT logs to show captured certificates that > were signed by a CA outside of that CA's own Named constraint policy? > > Additionally, if you skip accepting certificates within a named > constraint, what do you do when some CA claims ".com" as their > named constraint? > > Paul > > _______________________________________________ > Trans mailing list > Trans@ietf.org > https://www.ietf.org/mailman/listinfo/trans > --0000000000006e1589058bbe8c81 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Paul made the point quite accurately - CT is orthogonal to= name-constraining a CA, and can be used to validate the CA has adhered to = the constrained names.

Additionally, there's no way = to signal to a user agent that=C2=A0 such a CA would be "exempt" = from CT (some user agents have Enterprise controls to allow instances manag= ed by the organization to not require CT for certain domains, though).

On Thu, Jun 20, 2019 at 12:44 AM Paul Wouters <paul@nohats.ca> wrote:
On Wed, 19 Jun 2019, Rashmi Jha wrote:

> Have you looked into the options of not requiring CT for CAs which are= constrained to a brief list of domains ? I understand this was considered = in the past but couldn=E2=80=99t find details why this was not
> accepted.

Whether or not to require CT is not part of the document. This seems
more like a question to browser vendors. The draft only states:


=C2=A0 =C2=A0 In addition, if TLS clients will not accept unlogged certific= ates,
=C2=A0 =C2=A0 then site owners will have a greater incentive to submit cert= ificates
=C2=A0 =C2=A0 to logs, possibly with the assistance of their CA, increasing= the
=C2=A0 =C2=A0 overall transparency of the system.

The "if" there is important. It is not a decision made in this do= cument
or this Working Group.

The draft only lists the requirements and formats for when CT is used.

> Named constraint by default provide the assurance as to what domains t= hey will issue. CT becomes an additional network call in in issuance of cer= tificate which can be prevented. =C2=A0

Not "assurance", but "expectation". CT is there to conf= irm this
expectation. Surely, you want CT logs to show captured certificates that were signed by a CA outside of that CA's own Named constraint policy?
Additionally, if you skip accepting certificates within a named
constraint, what do you do when some CA claims ".com" as their named constraint?

Paul

_______________________________________________
Trans mailing list
Trans@ietf.org
https://www.ietf.org/mailman/listinfo/trans
--0000000000006e1589058bbe8c81-- From nobody Thu Jun 20 10:17:05 2019 Return-Path: X-Original-To: trans@ietf.org Delivered-To: trans@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 2B37912000E; Thu, 20 Jun 2019 10:16:57 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: trans@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.98.0 Auto-Submitted: auto-generated Precedence: bulk Reply-To: trans@ietf.org Message-ID: <156105101711.2952.6403253771078447536@ietfa.amsl.com> Date: Thu, 20 Jun 2019 10:16:57 -0700 Archived-At: Subject: [Trans] I-D Action: draft-ietf-trans-rfc6962-bis-32.txt X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.29 List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 20 Jun 2019 17:16:57 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Public Notary Transparency WG of the IETF. Title : Certificate Transparency Version 2.0 Authors : Ben Laurie Adam Langley Emilia Kasper Eran Messeri Rob Stradling Filename : draft-ietf-trans-rfc6962-bis-32.txt Pages : 55 Date : 2019-06-20 Abstract: This document describes version 2.0 of the Certificate Transparency (CT) protocol for publicly logging the existence of Transport Layer Security (TLS) server certificates as they are issued or observed, in a manner that allows anyone to audit certification authority (CA) activity and notice the issuance of suspect certificates as well as to audit the certificate logs themselves. The intent is that eventually clients would refuse to honor certificates that do not appear in a log, effectively forcing CAs to add all issued certificates to the logs. This document obsoletes RFC 6962. It also specifies a new TLS extension that is used to send various CT log artifacts. Logs are network services that implement the protocol operations for submissions and queries that are defined in this document. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-trans-rfc6962-bis/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-trans-rfc6962-bis-32 https://datatracker.ietf.org/doc/html/draft-ietf-trans-rfc6962-bis-32 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-trans-rfc6962-bis-32 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Thu Jun 20 10:18:48 2019 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D24AB1200B6; Thu, 20 Jun 2019 10:18:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=comodoca.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VBgcwVVoP1aj; Thu, 20 Jun 2019 10:18:37 -0700 (PDT) Received: from NAM01-SN1-obe.outbound.protection.outlook.com (mail-eopbgr820071.outbound.protection.outlook.com [40.107.82.71]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A755F12000E; Thu, 20 Jun 2019 10:18:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=comodoca.onmicrosoft.com; s=selector1-comodoca-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=iyPwO4cy4ycJ5RBVwkavuB/FHEs9xEio7982EFrecHY=; b=K1oRsbp0vMmTkZcfJAO0n6YoaKb5dufPYk7oEz2eon7myNpM8RndUDqbtc0VfLD678fjwV2loS3CtDpR1nBxMwGYl3T8u8Jqw7+gFhrkHjJpkYNv6b5PLXyXZxP2n+Ib0SaixVomAhPU61+eb5xR95MWiyBK8Kav5CCzO+imAMQ= Received: from DM6PR17MB2251.namprd17.prod.outlook.com (20.176.92.149) by DM6PR17MB2091.namprd17.prod.outlook.com (20.176.91.157) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1987.15; Thu, 20 Jun 2019 17:18:29 +0000 Received: from DM6PR17MB2251.namprd17.prod.outlook.com ([fe80::f96d:65b0:2e92:c71a]) by DM6PR17MB2251.namprd17.prod.outlook.com ([fe80::f96d:65b0:2e92:c71a%5]) with mapi id 15.20.1987.014; Thu, 20 Jun 2019 17:18:29 +0000 From: Rob Stradling To: "wellknown-uri-review@ietf.org" CC: "trans-chairs@ietf.org" , "draft-ietf-trans-rfc6962-bis.authors@ietf.org" , "trans@ietf.org" Thread-Topic: Request for well-known URI: ct Thread-Index: AQHVJ4wtn0cZQGHLfkqlZ2g3NxQysA== Date: Thu, 20 Jun 2019 17:18:29 +0000 Message-ID: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-clientproxiedby: LO2P265CA0248.GBRP265.PROD.OUTLOOK.COM (2603:10a6:600:8a::20) To DM6PR17MB2251.namprd17.prod.outlook.com (2603:10b6:5:b9::21) authentication-results: spf=none (sender IP is ) smtp.mailfrom=rob@sectigo.com; x-ms-exchange-messagesentrepresentingtype: 1 x-originating-ip: [2a0e:ac00:25d:300:f68e:38ff:fe7a:a226] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: ac332d4b-d6da-4bca-6ba4-08d6f5a3501d x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:DM6PR17MB2091; x-ms-traffictypediagnostic: DM6PR17MB2091: x-ms-exchange-purlcount: 1 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:7691; x-forefront-prvs: 0074BBE012 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(396003)(366004)(136003)(376002)(39850400004)(346002)(199004)(189003)(64756008)(73956011)(256004)(6436002)(316002)(71200400001)(7736002)(14454004)(71190400001)(66946007)(31696002)(6916009)(86362001)(305945005)(4326008)(54906003)(36756003)(2906002)(8676002)(6116002)(52116002)(46003)(486006)(53936002)(6306002)(2351001)(81166006)(966005)(99286004)(4744005)(14444005)(450100002)(68736007)(81156014)(386003)(102836004)(478600001)(186003)(6506007)(2501003)(8936002)(66446008)(66556008)(25786009)(476003)(31686004)(5640700003)(66476007)(6486002)(5660300002)(6512007)(2616005); DIR:OUT; SFP:1101; SCL:1; SRVR:DM6PR17MB2091; H:DM6PR17MB2251.namprd17.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:3; received-spf: None (protection.outlook.com: sectigo.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: 9s7aypEQOjdiXtaPYGnhtjVb4UruKuqbSLWlQXFSr6UtQKLuE5ANJOungU7iIhrVi0njoy/ENmlCqYHgq++hbb1U1WL98R7Oe2f29gVJ8a3uiJBraMzTM3q/SR8xPP+geyu2xcrugbW+K5QOI+CUZ+IIEZ9EZOwqm+xVIt/Tti23gYl72AovNYoi6wZTzxpXUtIgw8vu9eKRYSYS+rvHqcoMnHKt7gWessxeyx8rvTA677/BprmcJA+pcOgBDnuUaOx6AfQVKJIISlUJ87nmAb0+XOiFQJ95rCzbB2J0VtLp5BBxl46Tozlqoji8xAFYuJ+VyyMH8R33nTnybcNsrvMlJYfHiVhMHXZPHNOlb4r23xF5OAfnVEnX9sUNdXfeUjrZUqCXvrEWmZK5ZdHW+TFcNKRy0DBA804Y3kaCEmo= Content-Type: text/plain; charset="utf-8" Content-ID: <0739C946A572284DACF3742FCBAFF9D3@namprd17.prod.outlook.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: sectigo.com X-MS-Exchange-CrossTenant-Network-Message-Id: ac332d4b-d6da-4bca-6ba4-08d6f5a3501d X-MS-Exchange-CrossTenant-originalarrivaltime: 20 Jun 2019 17:18:29.4991 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 0e9c4894-6caa-465d-9660-4b6968b49fb7 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: robs@comodoca.net X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR17MB2091 Archived-At: Subject: [Trans] Request for well-known URI: ct X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 20 Jun 2019 17:18:40 -0000 V2VsbC1rbm93biBVUkkgUmV2aWV3ZXJzLA0KDQpUaGlzIHJlcXVlc3QsIHNlbnQgb24gYmVoYWxm IG9mIHRoZSBUUkFOUyBXb3JraW5nIEdyb3VwLCByZWxhdGVzIHRvIHRoZSANCkNlcnRpZmljYXRl IFRyYW5zcGFyZW5jeSAoQ1QpIHYyIHNwZWNpZmljYXRpb24gKDY5NjItYmlzKS4gIENUIHYxIA0K KFJGQzY5NjIpIGRlZmluZWQgQ1QgTG9nIGVuZHBvaW50IFVSTHMgaW4gYSBtYW5uZXIgc2luY2Ug cHJvaGliaXRlZCBieSANCkJDUCAxOTAuICBBIGJsb2NraW5nIGNvbW1lbnQgZHVyaW5nIElFU0cg TGFzdCBDYWxsIGZvciA2OTYyLWJpcyByZXF1aXJlcyANCnVzIHRvIG1ha2UgY2hhbmdlcyBzbyB0 aGF0IENUIHYyICh3aGVuIHB1Ymxpc2hlZCkgaXMgY29tcGxpYW50IHdpdGggQkNQIA0KMTkwLCBz byB0aGVyZWZvcmUgd2Ugd291bGQgbGlrZSB0byByZWdpc3RlciB0aGUgZm9sbG93aW5nIC53ZWxs LWtub3duIFVSSToNCg0KVVJJIHN1ZmZpeDoNCiAgIGN0DQoNCkNoYW5nZSBjb250cm9sbGVyOg0K ICAgSUVURg0KDQpTcGVjaWZpY2F0aW9uIGRvY3VtZW50KHMpOg0KICAgaHR0cHM6Ly9kYXRhdHJh Y2tlci5pZXRmLm9yZy9kb2MvZHJhZnQtaWV0Zi10cmFucy1yZmM2OTYyLWJpcy8NCiAgIChzZWUg c2VjdGlvbiA0LjEpDQoNClJlbGF0ZWQgaW5mb3JtYXRpb246DQogICBOb25lDQoNCi0tIA0KUm9i IFN0cmFkbGluZw0KU2VuaW9yIFJlc2VhcmNoICYgRGV2ZWxvcG1lbnQgU2NpZW50aXN0DQpTZWN0 aWdvIExpbWl0ZWQNCg0K From nobody Thu Jun 20 15:33:30 2019 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8E35B1201D7 for ; Thu, 20 Jun 2019 15:33:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7.426 X-Spam-Level: X-Spam-Status: No, score=-7.426 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H2=-0.415, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=eff.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9oFEeVq7f0Eo for ; Thu, 20 Jun 2019 15:33:27 -0700 (PDT) Received: from mail2.eff.org (mail2.eff.org [173.239.79.204]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BE8CF1202A5 for ; Thu, 20 Jun 2019 15:33:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=eff.org; s=mail2; h=Content-Transfer-Encoding:Content-Type:MIME-Version:Date: Message-ID:Subject:From:To:Sender:Reply-To:Cc:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=KxC/Rp/WLMCB3w4M17ikPJqWaYdWcPsI3e8YCMBGiOs=; b=uHh733rjS7+vEhmBNJB9eYiiWe o1OUDaT2+U7qVNfDI/G8X8RRiRvMOFvtwwNZfMwW9Db+womxw8lIhlXaAeqFzgNB0XcLVEKtNOt1z +JqUJlKRolgYzCDfn0CMgc5RcTbOgJZrRHCzM+OYo2unCvvhYoaFSNF4JbHpDrQiRETs=; Received: ; Thu, 20 Jun 2019 15:33:27 -0700 To: "trans@ietf.org" From: Jacob Hoffman-Andrews Message-ID: <0d5e05fc-8f1e-54b5-536d-231153e7baf7@eff.org> Date: Thu, 20 Jun 2019 15:33:26 -0700 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.7.0 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Content-Language: en-US Archived-At: Subject: [Trans] Directory instead of .well-known for URL structure X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 20 Jun 2019 22:33:29 -0000 The latest draft adopts a /.well-known/ path for CT as a way to get around BCP 190 (URI Design and Ownership: https://tools.ietf.org/html/bcp190#section-3). Personally I think BCP 190 makes it needlessly painful to specify HTTP-based APIs using techniques that are very common among practitioners. However, given that it is still considered best practice for IETF documents, I propose that CT should use a different workaround, one used very successfully by ACME: Directory URLs. In ACME, a CA defines one URL, a Directory, which provides a JSON dictionary showing where to find the other URLs. For instance: $ curl https://acme-v01.api.letsencrypt.org/directory {   "fUKGu3pAntw": "https://community.letsencrypt.org/t/adding-random-entries-to-the-directory/33417",   "key-change": "https://acme-v01.api.letsencrypt.org/acme/key-change",   "meta": {     "caaIdentities": [       "letsencrypt.org"     ],     "terms-of-service": "https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf",     "website": "https://letsencrypt.org"   },   "new-authz": "https://acme-v01.api.letsencrypt.org/acme/new-authz",   "new-cert": "https://acme-v01.api.letsencrypt.org/acme/new-cert",   "new-reg": "https://acme-v01.api.letsencrypt.org/acme/new-reg",   "revoke-cert": "https://acme-v01.api.letsencrypt.org/acme/revoke-cert" } To use an ACME CA, rather than configuring a base URL, an ACME client configures a directory URL. All other URLs can be found by looking up fields in the directory. Adding a directory to rfc6962-bis provides the most minimally invasive way to satisfy BCP 190. Well-known URLs aren't really meant for this type of application. To quote RFC 5785 (https://tools.ietf.org/html/rfc5785#section-1.1): 1.1.  Appropriate Use of Well-Known URIs    There are a number of possible ways that applications could use Well-    known URIs.  However, in keeping with the Architecture of the World-    Wide Web [W3C.REC-webarch-20041215], *well-known URIs are not intended** **   for general information retrieval or establishment of large URI** **   namespaces* on the Web.  Rather, they are designed to facilitate    discovery of information on a site when it isn't practical to use    other mechanisms; for example, when discovering policy that needs to    be evaluated before a resource is accessed, or when using multiple    round-trips is judged detrimental to performance.    As such, the well-known URI space was created with the expectation    that it will be used to make site-wide policy information and other    metadata available directly (if sufficiently concise), or provide    references to other URIs that provide such metadata. (emphasis mine) Beyond that, requiring log operators to organize their log under /.well-known/ would pose unnecessary difficulties. Service providers intentionally restrict the /.well-known/ URL space. Depending on deployment model, log operators might have to bypass such restrictions or get special exemptions. Thanks, Jacob From nobody Sun Jun 23 16:28:33 2019 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 41378120253 for ; Sun, 23 Jun 2019 16:28:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=lowentropy.net header.b=GVzfMPdD; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=LEmjZlJD Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IJIbnMoTBAE5 for ; Sun, 23 Jun 2019 16:28:29 -0700 (PDT) Received: from out1-smtp.messagingengine.com (out1-smtp.messagingengine.com [66.111.4.25]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 06F4D1200B8 for ; Sun, 23 Jun 2019 16:28:28 -0700 (PDT) Received: from compute1.internal (compute1.nyi.internal [10.202.2.41]) by mailout.nyi.internal (Postfix) with ESMTP id 06D6920D7C for ; Sun, 23 Jun 2019 19:28:28 -0400 (EDT) Received: from imap2 ([10.202.2.52]) by compute1.internal (MEProxy); Sun, 23 Jun 2019 19:28:28 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lowentropy.net; h=mime-version:message-id:in-reply-to:references:date:from:to :subject:content-type:content-transfer-encoding; s=fm2; bh=gx7hv iILPjmjQ/ONYTKBGSFfKYb+pRNm3occBRL5tpY=; b=GVzfMPdD1Vce9PJ37KDXa Kc8RucGgJSZmGgvqJtk3PE3NrMfS8l9j03bjRjBvu/kxVIaenG1KPnyLG49yzxCe kIoFiLSwXTa8VwYvsoUo5kIYfQJObHmg8ocaGwykJm+BfabBbyBWNUro7E/sNqRJ F0LOiD8/4Ej9EqxFKubM+L8KdcCl3qy6JyVwKVCmRghI1nU2zQxxVmHKKzVHsyDy XzN4kAn9X4GovZ/yEIuLJKWd2jkJtbZoe9Dx/E61q5gVcdsBPjV+VYJ5hPGF5QCQ OD1+vAO2KPrNjwhmfSfv4u2CCmZM/rZZHoAa3q0XZ0A1Xm67yGT28TPtA0FovSD9 g== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-transfer-encoding:content-type :date:from:in-reply-to:message-id:mime-version:references :subject:to:x-me-proxy:x-me-proxy:x-me-sender:x-me-sender :x-sasl-enc; s=fm3; bh=gx7hviILPjmjQ/ONYTKBGSFfKYb+pRNm3occBRL5t pY=; b=LEmjZlJDHHNvlmLt6pMMvUs9WaJJvaDb/4YIQksHshDJ3W4wzeIgIU4fT 2Gzad/07oZ5J/U+90xmHGysybcejZm7KFXO9nZ1cpT6cy8WNjPo4hDvc7xvak0i1 4XEToUnMvx8kR0bhHLKl7Vz3XCnIQhBPwowbJ2ENsOvlqfj+HECdmWB24xMm45kd lgW1kN7aNimk7Eb9tj5ym967jYPRJLsf2PewcOaq/tW0TjrorRFij6pOMVYZ58tB 7BnbMlb+TRRFvYYgAK42bs26+yYIJA7+K+b0PhAcYFpJz+o83RSxRRTahElm8Lj4 rV8uFk73/uFXLfRrMAP5qaVN/U//A== X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeduvddruddugddvvdcutefuodetggdotefrodftvf curfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfghnecu uegrihhlohhuthemuceftddtnecunecujfgurhepofgfggfkjghffffhvffutgfgsehtqh ertderreejnecuhfhrohhmpedfofgrrhhtihhnucfvhhhomhhsohhnfdcuoehmtheslhho figvnhhtrhhophihrdhnvghtqeenucffohhmrghinheplhgvthhsvghntghrhihpthdroh hrghdpihgvthhfrdhorhhgnecurfgrrhgrmhepmhgrihhlfhhrohhmpehmtheslhhofigv nhhtrhhophihrdhnvghtnecuvehluhhsthgvrhfuihiivgeptd X-ME-Proxy: Received: by mailuser.nyi.internal (Postfix, from userid 501) id 6E0CBE00A1; Sun, 23 Jun 2019 19:28:27 -0400 (EDT) X-Mailer: MessagingEngine.com Webmail Interface User-Agent: Cyrus-JMAP/3.1.6-730-g63f2c3b-fmstable-20190622v1 Mime-Version: 1.0 Message-Id: <48a31dcd-71d9-42c8-9ec3-6104939a59ab@www.fastmail.com> In-Reply-To: <0d5e05fc-8f1e-54b5-536d-231153e7baf7@eff.org> References: <0d5e05fc-8f1e-54b5-536d-231153e7baf7@eff.org> Date: Mon, 24 Jun 2019 09:28:26 +1000 From: "Martin Thomson" To: trans@ietf.org Content-Type: text/plain;charset=utf-8 Content-Transfer-Encoding: quoted-printable Archived-At: Subject: Re: [Trans] Directory instead of .well-known for URL structure X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 23 Jun 2019 23:28:31 -0000 I agree with Jacob here. As I have expressed in the past, I believe that= this is a better design than the well-known prefix. On Fri, Jun 21, 2019, at 08:33, Jacob Hoffman-Andrews wrote: > The latest draft adopts a /.well-known/ path for CT as a way to get=20= > around BCP 190 (URI Design and Ownership:=20 > https://tools.ietf.org/html/bcp190#section-3). >=20 > Personally I think BCP 190 makes it needlessly painful to specify=20 > HTTP-based APIs using techniques that are very common among=20 > practitioners. However, given that it is still considered best practic= e=20 > for IETF documents, I propose that CT should use a different workaroun= d,=20 > one used very successfully by ACME: Directory URLs. >=20 > In ACME, a CA defines one URL, a Directory, which provides a JSON=20 > dictionary showing where to find the other URLs. For instance: >=20 > $ curl https://acme-v01.api.letsencrypt.org/directory > { > =C2=A0 "fUKGu3pAntw":=20 > "https://community.letsencrypt.org/t/adding-random-entries-to-the-dire= ctory/33417", > =C2=A0 "key-change": "https://acme-v01.api.letsencrypt.org/acme/key-c= hange", > =C2=A0 "meta": { > =C2=A0=C2=A0=C2=A0 "caaIdentities": [ > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 "letsencrypt.org" > =C2=A0=C2=A0=C2=A0 ], > =C2=A0=C2=A0=C2=A0 "terms-of-service":=20 > "https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf", > =C2=A0=C2=A0=C2=A0 "website": "https://letsencrypt.org" > =C2=A0 }, > =C2=A0 "new-authz": "https://acme-v01.api.letsencrypt.org/acme/new-au= thz", > =C2=A0 "new-cert": "https://acme-v01.api.letsencrypt.org/acme/new-cer= t", > =C2=A0 "new-reg": "https://acme-v01.api.letsencrypt.org/acme/new-reg"= , > =C2=A0 "revoke-cert":=20 > "https://acme-v01.api.letsencrypt.org/acme/revoke-cert" > } >=20 > To use an ACME CA, rather than configuring a base URL, an ACME client=20= > configures a directory URL. All other URLs can be found by looking up=20= > fields in the directory. >=20 > Adding a directory to rfc6962-bis provides the most minimally invasive= =20 > way to satisfy BCP 190. Well-known URLs aren't really meant for this=20= > type of application. To quote RFC 5785=20 > (https://tools.ietf.org/html/rfc5785#section-1.1): >=20 > 1.1.=C2=A0 Appropriate Use of Well-Known URIs >=20 > =C2=A0=C2=A0 There are a number of possible ways that application= s could use > Well- > =C2=A0=C2=A0 known URIs.=C2=A0 However, in keeping with the Archi= tecture of the World- > =C2=A0=C2=A0 Wide Web [W3C.REC-webarch-20041215], *well-known URI= s are not > intended** > **=C2=A0=C2=A0 for general information retrieval or establishment = of large URI** > **=C2=A0=C2=A0 namespaces* on the Web.=C2=A0 Rather, they are desi= gned to facilitate > =C2=A0=C2=A0 discovery of information on a site when it isn't pra= ctical to use > =C2=A0=C2=A0 other mechanisms; for example, when discovering poli= cy that needs to > =C2=A0=C2=A0 be evaluated before a resource is accessed, or when = using multiple > =C2=A0=C2=A0 round-trips is judged detrimental to performance. >=20 > =C2=A0=C2=A0 As such, the well-known URI space was created with t= he expectation > =C2=A0=C2=A0 that it will be used to make site-wide policy inform= ation and other > =C2=A0=C2=A0 metadata available directly (if sufficiently concise= ), or provide > =C2=A0=C2=A0 references to other URIs that provide such metadata.= >=20 > (emphasis mine) >=20 > Beyond that, requiring log operators to organize their log under=20 > /.well-known/ would pose unnecessary difficulties. Service providers=20= > intentionally restrict the /.well-known/ URL space. Depending on=20 > deployment model, log operators might have to bypass such restrictions= =20 > or get special exemptions. >=20 > Thanks, > Jacob >=20 > _______________________________________________ > Trans mailing list > Trans@ietf.org > https://www.ietf.org/mailman/listinfo/trans > From nobody Sun Jun 23 17:05:35 2019 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1E4941200F1 for ; Sun, 23 Jun 2019 17:05:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LejhIr85xcp2 for ; Sun, 23 Jun 2019 17:05:31 -0700 (PDT) Received: from mail-pf1-x434.google.com (mail-pf1-x434.google.com [IPv6:2607:f8b0:4864:20::434]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 22ECD120047 for ; Sun, 23 Jun 2019 17:05:30 -0700 (PDT) Received: by mail-pf1-x434.google.com with SMTP id 19so6444613pfa.4 for ; Sun, 23 Jun 2019 17:05:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:references:from:message-id:date:user-agent:mime-version :in-reply-to:content-language:content-transfer-encoding; bh=3nbs6eHtrqbhuXiSWbA45ly36+83xIS2NLvlHXTD0nA=; b=BLM5aml552Z+xNgvmirN75KWL64c7SmDBkzgvFPl6VJ4CvCkuyf7TP4bVZM93Yvurd 3SjaxwuI86N4yCxxUxMZHzHbfaMi7ntETKsCByTSncTXlX49nWL1IAcSoM1SxGZCcy7B u/yVRLwmPMrH9Cy6VR5m+r7AjQyC95cD1BAoGKquJFiZgUXsFrkGW6DtqsBSin0YKq7c 9pkUILZVqglTAYSkHYALo8O8AJh0W7wdM/GLnfpMnyzg0ub/P2hs0mRfmDMJummG7Has N5i2wENAQDvATQttEnG5LODLcHsWC3NRT5nNRgErZmT1V4MX+ZQMoLg18167dqrsO7zy i75w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=3nbs6eHtrqbhuXiSWbA45ly36+83xIS2NLvlHXTD0nA=; b=Jyw5+E980/sty72nSRqanJ3Mg5qdEMJdtzV/cqXuhuVqZdhp07G4dX0mQjXcNv1QCm DnV8rtJpeVpIKltqZyXHPWYz23fGWEDWfrsYY3jfLtSzvzSbvYeGD8auwT4p7ODnmJ94 5SIP22U4wVdu5QQD1I1CZbpoHg/pLj7kWD8ZABTqwpa2KV8FzPTjY0yYWfrHYYkQySjq s0xuNNOTXhJa6aicXGuK1EmDARHL0D8fm+dGi6OeJR8RhSiScOorfkADVdbFGFKYEhl9 NCg8uT6xaDFG+6UnIeamQGA4i1o3wDLBhIMseCi8Ut+DR+r1AedXbO2wlWozhxMIDDwT sSew== X-Gm-Message-State: APjAAAWbY2wQ7Mn4lltkiFaCGcB+Mv8eN27KsxJ92vox9yfp/QPaM6Sg fhtyaap0hsJA9wUMFETkWB0GEMRf X-Google-Smtp-Source: APXvYqzX+Gq0Tyz2WB9tw//Jr0//AG5PX09dGClndoUPpGfxnA3/tIdvCTPyU7zW5cREsD4a1q6jMQ== X-Received: by 2002:a17:90a:2488:: with SMTP id i8mr20870816pje.123.1561334729719; Sun, 23 Jun 2019 17:05:29 -0700 (PDT) Received: from aspen.local ([63.140.70.85]) by smtp.gmail.com with ESMTPSA id o2sm7607368pgp.74.2019.06.23.17.05.28 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sun, 23 Jun 2019 17:05:29 -0700 (PDT) To: trans@ietf.org References: <0d5e05fc-8f1e-54b5-536d-231153e7baf7@eff.org> <48a31dcd-71d9-42c8-9ec3-6104939a59ab@www.fastmail.com> From: Melinda Shore Message-ID: <7161898d-a58d-1625-a041-2e93961e71a2@gmail.com> Date: Sun, 23 Jun 2019 16:05:27 -0800 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:60.0) Gecko/20100101 Thunderbird/60.7.2 MIME-Version: 1.0 In-Reply-To: <48a31dcd-71d9-42c8-9ec3-6104939a59ab@www.fastmail.com> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [Trans] Directory instead of .well-known for URL structure X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 24 Jun 2019 00:05:33 -0000 On 6/23/19 3:28 PM, Martin Thomson wrote: > I agree with Jacob here. As I have expressed in the past, I believe > that this is a better design than the well-known prefix. > On Fri, Jun 21, 2019, at 08:33, Jacob Hoffman-Andrews wrote: >> The latest draft adopts a /.well-known/ path for CT as a way to get >> around BCP 190 (URI Design and Ownership: >> https://tools.ietf.org/html/bcp190#section-3). >> >> Personally I think BCP 190 makes it needlessly painful to specify >> HTTP-based APIs using techniques that are very common among >> practitioners. However, given that it is still considered best >> practice for IETF documents, I propose that CT should use a >> different workaround, one used very successfully by ACME: Directory >> URLs. I have a fairly profound dislike for BCP 190, to be honest, and am in agreement with the proposal. Melinda -- Melinda Shore melinda.shore@gmail.com Software longa, hardware brevis From nobody Mon Jun 24 07:15:53 2019 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E9BDF120151 for ; Mon, 24 Jun 2019 07:15:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=comodoca.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Vf5XVaoYaWEy for ; Mon, 24 Jun 2019 07:15:49 -0700 (PDT) Received: from NAM02-CY1-obe.outbound.protection.outlook.com (mail-eopbgr760043.outbound.protection.outlook.com [40.107.76.43]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9F77A12012B for ; Mon, 24 Jun 2019 07:15:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=comodoca.onmicrosoft.com; s=selector1-comodoca-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=4+2B7AmNbTF5mA/pcmMeLnzbr3MySaf3I0oyfTBAXc8=; b=hUTaPVTffPmL4wNCO7REnvXSHoGxrUmMVmOHQSyGm/Bk+kKs5ZmO9IqP1Kl5FQSej+AktlgiDVv9KOU+GSkO/KLfZ7+ordX9dtYZvs71MqMWCGQROKpcjgRdziLV9HwwdK4AgLvXELVewKOLtVoal1xbogoeQHvwb+CkpC7mahk= Received: from DM5PR17MB1211.namprd17.prod.outlook.com (10.173.132.148) by DM5PR17MB1068.namprd17.prod.outlook.com (10.168.118.145) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2008.16; Mon, 24 Jun 2019 14:15:47 +0000 Received: from DM5PR17MB1211.namprd17.prod.outlook.com ([fe80::b556:345c:94cf:7258]) by DM5PR17MB1211.namprd17.prod.outlook.com ([fe80::b556:345c:94cf:7258%6]) with mapi id 15.20.2008.017; Mon, 24 Jun 2019 14:15:47 +0000 From: Rob Stradling To: Melinda Shore , "trans@ietf.org" Thread-Topic: [Trans] Directory instead of .well-known for URL structure Thread-Index: AQHVJ7g3xV77fgqjj0ive+Voenofmqap50UAgAAKWICAAO2MAA== Date: Mon, 24 Jun 2019 14:15:47 +0000 Message-ID: References: <0d5e05fc-8f1e-54b5-536d-231153e7baf7@eff.org> <48a31dcd-71d9-42c8-9ec3-6104939a59ab@www.fastmail.com> <7161898d-a58d-1625-a041-2e93961e71a2@gmail.com> In-Reply-To: <7161898d-a58d-1625-a041-2e93961e71a2@gmail.com> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-clientproxiedby: DB6PR0202CA0020.eurprd02.prod.outlook.com (2603:10a6:4:29::30) To DM5PR17MB1211.namprd17.prod.outlook.com (2603:10b6:3:8b::20) authentication-results: spf=none (sender IP is ) smtp.mailfrom=rob@sectigo.com; x-ms-exchange-messagesentrepresentingtype: 1 x-originating-ip: [82.109.38.206] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 955a9ae9-2d1f-4bab-1b95-08d6f8ae73c5 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:DM5PR17MB1068; x-ms-traffictypediagnostic: DM5PR17MB1068: x-ms-exchange-purlcount: 1 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8882; x-forefront-prvs: 007814487B x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(396003)(39850400004)(366004)(136003)(346002)(376002)(199004)(189003)(66066001)(36756003)(26005)(8936002)(81166006)(81156014)(102836004)(71200400001)(71190400001)(2501003)(8676002)(186003)(386003)(6506007)(478600001)(2906002)(66446008)(64756008)(66556008)(66946007)(31686004)(53546011)(305945005)(7736002)(73956011)(14454004)(6246003)(31696002)(66476007)(99286004)(6116002)(76176011)(561944003)(6512007)(3846002)(52116002)(25786009)(86362001)(256004)(14444005)(316002)(68736007)(5660300002)(486006)(110136005)(476003)(6436002)(6486002)(2616005)(229853002)(53936002)(6306002)(446003)(966005)(11346002)(142923001); DIR:OUT; SFP:1101; SCL:1; SRVR:DM5PR17MB1068; H:DM5PR17MB1211.namprd17.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: sectigo.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: b9pD/Oop0x2VX4chmkcbz0XNcZpBw5saXbNBNYy9WGeS55gb38AzyD2GVxlETjBA88m0tz4qJ/xDr6NViKZsLr+uN36LOcXI3U3v+/ixQccQCVZuJVwp0HtS11WudUgqfXFTLFoa1u8NZHrrqC/RvbTDtS2Lg9ipUMcUuChRjgPqDYu105CQcP/wHbFJ4phy65oeVFegvFOL9bQSmPIhF1ccMJ6jozIzC9nRQUuoKQBkRDvtrVDq0/vJFIpIiiRYoxvEFxaifmkEfwIm0izGuB5yEPrOkiRPi9QhLv3lxRmByuWuLRHN9B4UnHh0GHbszZhTPOl3NnQqHpIfm9xm+EDMVs1z681ClMsm/b0vJandU3gYPR1r7rvhDyoNk+ZG1wJ5Lk6hAvsu4pFWdmXmf45TLodxM3kwSh8S0gjMcac= Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: sectigo.com X-MS-Exchange-CrossTenant-Network-Message-Id: 955a9ae9-2d1f-4bab-1b95-08d6f8ae73c5 X-MS-Exchange-CrossTenant-originalarrivaltime: 24 Jun 2019 14:15:47.2971 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 0e9c4894-6caa-465d-9660-4b6968b49fb7 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: robs@comodoca.net X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM5PR17MB1068 Archived-At: Subject: Re: [Trans] Directory instead of .well-known for URL structure X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 24 Jun 2019 14:15:52 -0000 VGhpcyBzb3VuZHMgdW5hbmltb3VzLiAgOi0pDQoNCkknbGwgZ28gYWhlYWQgYW5kIG1ha2UgdGhp cyBjaGFuZ2UsIGFuZCBJJ2xsIGNhbmNlbCB0aGUgcmVnaXN0cmF0aW9uIA0KcHJvY2VzcyBmb3Ig ImN0IiBhcyBhIC53ZWxsLWtub3duIFVSSSBzdWZmaXguDQoNCk9uIDI0LzA2LzIwMTkgMDE6MDUs IE1lbGluZGEgU2hvcmUgd3JvdGU6DQo+IE9uIDYvMjMvMTkgMzoyOCBQTSwgTWFydGluIFRob21z b24gd3JvdGU6DQo+PiBJIGFncmVlIHdpdGggSmFjb2IgaGVyZS4gQXMgSSBoYXZlIGV4cHJlc3Nl ZCBpbiB0aGUgcGFzdCwgSSBiZWxpZXZlDQo+PiB0aGF0IHRoaXMgaXMgYSBiZXR0ZXIgZGVzaWdu IHRoYW4gdGhlIHdlbGwta25vd24gcHJlZml4Lg0KPiANCj4+IE9uIEZyaSwgSnVuIDIxLCAyMDE5 LCBhdCAwODozMywgSmFjb2IgSG9mZm1hbi1BbmRyZXdzIHdyb3RlOg0KPj4+IFRoZSBsYXRlc3Qg ZHJhZnQgYWRvcHRzIGEgLy53ZWxsLWtub3duLyBwYXRoIGZvciBDVCBhcyBhIHdheSB0byBnZXQN Cj4+PiAgIGFyb3VuZCBCQ1AgMTkwIChVUkkgRGVzaWduIGFuZCBPd25lcnNoaXA6DQo+Pj4gaHR0 cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL2JjcDE5MCNzZWN0aW9uLTMpLg0KPj4+DQo+Pj4gUGVy c29uYWxseSBJIHRoaW5rIEJDUCAxOTAgbWFrZXMgaXQgbmVlZGxlc3NseSBwYWluZnVsIHRvIHNw ZWNpZnkNCj4+PiBIVFRQLWJhc2VkIEFQSXMgdXNpbmcgdGVjaG5pcXVlcyB0aGF0IGFyZSB2ZXJ5 IGNvbW1vbiBhbW9uZw0KPj4+IHByYWN0aXRpb25lcnMuIEhvd2V2ZXIsIGdpdmVuIHRoYXQgaXQg aXMgc3RpbGwgY29uc2lkZXJlZCBiZXN0DQo+Pj4gcHJhY3RpY2UgZm9yIElFVEYgZG9jdW1lbnRz LCBJIHByb3Bvc2UgdGhhdCBDVCBzaG91bGQgdXNlIGENCj4+PiBkaWZmZXJlbnQgd29ya2Fyb3Vu ZCwgb25lIHVzZWQgdmVyeSBzdWNjZXNzZnVsbHkgYnkgQUNNRTogRGlyZWN0b3J5DQo+Pj4gVVJM cy4NCj4gDQo+IEkgaGF2ZSBhIGZhaXJseSBwcm9mb3VuZCBkaXNsaWtlIGZvciBCQ1AgMTkwLCB0 byBiZSBob25lc3QsDQo+IGFuZCBhbSBpbiBhZ3JlZW1lbnQgd2l0aCB0aGUgcHJvcG9zYWwuDQo+ IA0KPiBNZWxpbmRhDQo+IA0KDQotLSANClJvYiBTdHJhZGxpbmcNClNlbmlvciBSZXNlYXJjaCAm IERldmVsb3BtZW50IFNjaWVudGlzdA0KRW1haWw6IHJvYkBzZWN0aWdvLmNvbQ0KQnJhZGZvcmQs IFVLDQpPZmZpY2U6ICs0NDEyNzQwMjQ3MDcNClNlY3RpZ28gTGltaXRlZA0KDQpUaGlzIG1lc3Nh Z2UgYW5kIGFueSBmaWxlcyBhc3NvY2lhdGVkIHdpdGggaXQgbWF5IGNvbnRhaW4gbGVnYWxseSAN CnByaXZpbGVnZWQsIGNvbmZpZGVudGlhbCwgb3IgcHJvcHJpZXRhcnkgaW5mb3JtYXRpb24uIElm IHlvdSBhcmUgbm90IHRoZSANCmludGVuZGVkIHJlY2lwaWVudCwgeW91IGFyZSBub3QgcGVybWl0 dGVkIHRvIHVzZSwgY29weSwgb3IgZm9yd2FyZCBpdCwgDQppbiB3aG9sZSBvciBpbiBwYXJ0IHdp dGhvdXQgdGhlIGV4cHJlc3MgY29uc2VudCBvZiB0aGUgc2VuZGVyLiBQbGVhc2UgDQpub3RpZnkg dGhlIHNlbmRlciBieSByZXBseSBlbWFpbCwgZGlzcmVnYXJkIHRoZSBmb3JlZ29pbmcgbWVzc2Fn ZXMsIGFuZCANCmRlbGV0ZSBpdCBpbW1lZGlhdGVseS4NCg== From nobody Mon Jun 24 07:17:42 2019 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0CEE3120151; Mon, 24 Jun 2019 07:17:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=comodoca.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id deQ7bDOTwHne; Mon, 24 Jun 2019 07:17:30 -0700 (PDT) Received: from NAM05-DM3-obe.outbound.protection.outlook.com (mail-dm3nam05on0629.outbound.protection.outlook.com [IPv6:2a01:111:f400:fe51::629]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AAD18120074; Mon, 24 Jun 2019 07:17:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=comodoca.onmicrosoft.com; s=selector1-comodoca-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=mhtGkDKWFjdfpR84k1gWIcWbq1b/5P2TPJU4KQwCk9k=; b=XwBWkh1r1dFPaBs7xrOv6ek49rEMvd9OKsLcOjjOARpP1OSLbVonYXs/m5Kio9Y82nnUM7PzScZHrE7BShxI5j6J6MxUXMB6iuDApe/+9OWUg/isnUXtXPZZQ4oxF2CWCMte4+7mCp2pNbPxRqGcfbNgQsmNs+kcojV5xBzHcAU= Received: from DM5PR17MB1211.namprd17.prod.outlook.com (10.173.132.148) by DM5PR17MB1210.namprd17.prod.outlook.com (10.173.133.145) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2008.13; Mon, 24 Jun 2019 14:17:28 +0000 Received: from DM5PR17MB1211.namprd17.prod.outlook.com ([fe80::b556:345c:94cf:7258]) by DM5PR17MB1211.namprd17.prod.outlook.com ([fe80::b556:345c:94cf:7258%6]) with mapi id 15.20.2008.017; Mon, 24 Jun 2019 14:17:28 +0000 From: Rob Stradling To: "wellknown-uri-review@ietf.org" CC: "trans-chairs@ietf.org" , "draft-ietf-trans-rfc6962-bis.authors@ietf.org" , "trans@ietf.org" Thread-Topic: Request for well-known URI: ct Thread-Index: AQHVJ4wtn0cZQGHLfkqlZ2g3NxQysKaq3/yA Date: Mon, 24 Jun 2019 14:17:28 +0000 Message-ID: <7bf15271-45f6-dc7e-1e6e-59edb87cdaa8@sectigo.com> References: In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-clientproxiedby: DB7PR05CA0036.eurprd05.prod.outlook.com (2603:10a6:10:36::49) To DM5PR17MB1211.namprd17.prod.outlook.com (2603:10b6:3:8b::20) authentication-results: spf=none (sender IP is ) smtp.mailfrom=rob@sectigo.com; x-ms-exchange-messagesentrepresentingtype: 1 x-originating-ip: [82.109.38.206] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 19983330-a49a-4498-b550-08d6f8aeb031 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:DM5PR17MB1210; x-ms-traffictypediagnostic: DM5PR17MB1210: x-ms-exchange-purlcount: 1 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8882; x-forefront-prvs: 007814487B x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(396003)(376002)(346002)(136003)(39850400004)(366004)(189003)(199004)(54906003)(31696002)(5640700003)(6512007)(52116002)(53546011)(6506007)(4326008)(71200400001)(71190400001)(14444005)(14454004)(2501003)(966005)(476003)(450100002)(25786009)(6246003)(6916009)(305945005)(11346002)(2616005)(316002)(446003)(486006)(478600001)(7736002)(5660300002)(6486002)(6306002)(6436002)(76176011)(68736007)(86362001)(386003)(73956011)(8936002)(8676002)(256004)(81156014)(81166006)(36756003)(2351001)(66476007)(66556008)(64756008)(66446008)(31686004)(229853002)(66946007)(2906002)(186003)(102836004)(26005)(66066001)(53936002)(99286004)(6116002)(3846002); DIR:OUT; SFP:1101; SCL:1; SRVR:DM5PR17MB1210; H:DM5PR17MB1211.namprd17.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: sectigo.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: j5/jQN2Ex+0hsE9jLFdOngoSQ7TM7Vstp+NIAiN0H+T/qgvTMP07L4GfPwbJDF46itssqEgF3qCR6iYIxSedg7DjFHo4WvAR3+onV2E3SoigI8iQ7ZkcX+Z6OsTv4OlhBDvEcEgptcOpDUAELSaQB8N6JWX5CSRjum9C0KCy0iXLyf9oNqUNlcLIEb4quY5pH/RIfHVbNar94lTKn6Hv+05J6/kIxaAh6wuV0MtUO2vloiQLmWHZQOo7nrUpKsQCTeKkB2fQzt+IBaRiWuVjAJQR6EoJxB07gLLeW0C1h0Ckf2rRfaTQZSjHHtjvOv9XfCqJwCcqhAHh5CWb5fuXNO9ZiJ2ThZQNubf/NYChgj9UjWSHlNhBqUC34+bMpxoxyKdn692B2om/CND6Mhus75aurjOxqUPbVUtV+dD57hU= Content-Type: text/plain; charset="utf-8" Content-ID: <62D842F79399A64BBFDD071896076DD4@namprd17.prod.outlook.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: sectigo.com X-MS-Exchange-CrossTenant-Network-Message-Id: 19983330-a49a-4498-b550-08d6f8aeb031 X-MS-Exchange-CrossTenant-originalarrivaltime: 24 Jun 2019 14:17:28.6672 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 0e9c4894-6caa-465d-9660-4b6968b49fb7 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: robs@comodoca.net X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM5PR17MB1210 Archived-At: Subject: Re: [Trans] Request for well-known URI: ct X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 24 Jun 2019 14:17:33 -0000 SGkgYWdhaW4uICBQbGVhc2UgZGlzcmVnYXJkIHRoaXMgcmVxdWVzdC4gIEFmdGVyIGZ1cnRoZXIg ZGlzY3Vzc2lvbiBvbiANCnRoZSBUUkFOUyBXRyBtYWlsaW5nIGxpc3QsIHdlJ3ZlIGRlY2lkZWQg dG8gdGFrZSBhIGRpZmZlcmVudCBhcHByb2FjaC4NCg0KT24gMjAvMDYvMjAxOSAxODoxOCwgUm9i IFN0cmFkbGluZyB3cm90ZToNCj4gV2VsbC1rbm93biBVUkkgUmV2aWV3ZXJzLA0KPiANCj4gVGhp cyByZXF1ZXN0LCBzZW50IG9uIGJlaGFsZiBvZiB0aGUgVFJBTlMgV29ya2luZyBHcm91cCwgcmVs YXRlcyB0byB0aGUNCj4gQ2VydGlmaWNhdGUgVHJhbnNwYXJlbmN5IChDVCkgdjIgc3BlY2lmaWNh dGlvbiAoNjk2Mi1iaXMpLiAgQ1QgdjENCj4gKFJGQzY5NjIpIGRlZmluZWQgQ1QgTG9nIGVuZHBv aW50IFVSTHMgaW4gYSBtYW5uZXIgc2luY2UgcHJvaGliaXRlZCBieQ0KPiBCQ1AgMTkwLiAgQSBi bG9ja2luZyBjb21tZW50IGR1cmluZyBJRVNHIExhc3QgQ2FsbCBmb3IgNjk2Mi1iaXMgcmVxdWly ZXMNCj4gdXMgdG8gbWFrZSBjaGFuZ2VzIHNvIHRoYXQgQ1QgdjIgKHdoZW4gcHVibGlzaGVkKSBp cyBjb21wbGlhbnQgd2l0aCBCQ1ANCj4gMTkwLCBzbyB0aGVyZWZvcmUgd2Ugd291bGQgbGlrZSB0 byByZWdpc3RlciB0aGUgZm9sbG93aW5nIC53ZWxsLWtub3duIFVSSToNCj4gDQo+IFVSSSBzdWZm aXg6DQo+ICAgICBjdA0KPiANCj4gQ2hhbmdlIGNvbnRyb2xsZXI6DQo+ICAgICBJRVRGDQo+IA0K PiBTcGVjaWZpY2F0aW9uIGRvY3VtZW50KHMpOg0KPiAgICAgaHR0cHM6Ly9kYXRhdHJhY2tlci5p ZXRmLm9yZy9kb2MvZHJhZnQtaWV0Zi10cmFucy1yZmM2OTYyLWJpcy8NCj4gICAgIChzZWUgc2Vj dGlvbiA0LjEpDQo+IA0KPiBSZWxhdGVkIGluZm9ybWF0aW9uOg0KPiAgICAgTm9uZQ0KPiANCg0K LS0gDQpSb2IgU3RyYWRsaW5nDQpTZW5pb3IgUmVzZWFyY2ggJiBEZXZlbG9wbWVudCBTY2llbnRp c3QNCkVtYWlsOiByb2JAc2VjdGlnby5jb20NCkJyYWRmb3JkLCBVSw0KT2ZmaWNlOiArNDQxMjc0 MDI0NzA3DQpTZWN0aWdvIExpbWl0ZWQNCg0KVGhpcyBtZXNzYWdlIGFuZCBhbnkgZmlsZXMgYXNz b2NpYXRlZCB3aXRoIGl0IG1heSBjb250YWluIGxlZ2FsbHkgDQpwcml2aWxlZ2VkLCBjb25maWRl bnRpYWwsIG9yIHByb3ByaWV0YXJ5IGluZm9ybWF0aW9uLiBJZiB5b3UgYXJlIG5vdCB0aGUgDQpp bnRlbmRlZCByZWNpcGllbnQsIHlvdSBhcmUgbm90IHBlcm1pdHRlZCB0byB1c2UsIGNvcHksIG9y IGZvcndhcmQgaXQsIA0KaW4gd2hvbGUgb3IgaW4gcGFydCB3aXRob3V0IHRoZSBleHByZXNzIGNv bnNlbnQgb2YgdGhlIHNlbmRlci4gUGxlYXNlIA0Kbm90aWZ5IHRoZSBzZW5kZXIgYnkgcmVwbHkg ZW1haWwsIGRpc3JlZ2FyZCB0aGUgZm9yZWdvaW5nIG1lc3NhZ2VzLCBhbmQgDQpkZWxldGUgaXQg aW1tZWRpYXRlbHkuDQo= From nobody Mon Jun 24 17:45:19 2019 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5EE711200F3 for ; Mon, 24 Jun 2019 17:45:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=team.telstra.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OwaeFV7LA3Hf for ; Mon, 24 Jun 2019 17:45:08 -0700 (PDT) Received: from ipxcvo.tcif.telstra.com.au (ipxcvo.tcif.telstra.com.au [203.35.135.208]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8AF4E120165 for ; Mon, 24 Jun 2019 17:45:07 -0700 (PDT) X-IronPort-AV: E=Sophos;i="5.63,413,1557151200"; d="scan'208";a="200021952" X-Amp-Result: SKIPPED(no attachment in message) Received: from unknown (HELO ipcavi.tcif.telstra.com.au) ([10.97.217.200]) by ipocvi.tcif.telstra.com.au with ESMTP; 25 Jun 2019 10:44:49 +1000 Received: from wsmsg3702.srv.dir.telstra.com ([172.49.40.170]) by ipcavi.tcif.telstra.com.au with ESMTP; 25 Jun 2019 10:44:49 +1000 Received: from wsapp5584.srv.dir.telstra.com (10.75.131.20) by wsmsg3702.srv.dir.telstra.com (172.49.40.170) with Microsoft SMTP Server (TLS) id 8.3.485.1; Tue, 25 Jun 2019 10:42:57 +1000 Received: from wsapp5584.srv.dir.telstra.com (10.75.131.20) by wsapp5584.srv.dir.telstra.com (10.75.131.20) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Tue, 25 Jun 2019 10:42:57 +1000 Received: from AUS01-SY3-obe.outbound.protection.outlook.com (10.172.229.126) by wsapp5584.srv.dir.telstra.com (10.75.131.20) with Microsoft SMTP Server (TLS) id 15.0.1395.4 via Frontend Transport; Tue, 25 Jun 2019 10:42:57 +1000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=team.telstra.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=BZ4EVxhNBhAfonP9fDzl8xy7SEPqSuBJd6Ulz36l/OE=; b=WqpDnORVBjQMUiBtQx4Xzp7UY8Uq5SLV0ibZ564sBehiVMHlb5ObJhmJk12uHaFU/g6s7aWbhnwcuqNVk0ePVD38pXo2mi9GcQBtKGRqms/cRzsliFh6GoU6LtsUqBMCz6LbU0nLMIs0v/5Jgv+fTDtS9xE1jkupcYI2QoO1sRg= Received: from SY2PR01MB2764.ausprd01.prod.outlook.com (52.134.190.138) by SY2PR01MB2332.ausprd01.prod.outlook.com (52.134.169.143) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2008.16; Tue, 25 Jun 2019 00:42:56 +0000 Received: from SY2PR01MB2764.ausprd01.prod.outlook.com ([fe80::ad81:55b8:5070:b4a6]) by SY2PR01MB2764.ausprd01.prod.outlook.com ([fe80::ad81:55b8:5070:b4a6%7]) with mapi id 15.20.2008.014; Tue, 25 Jun 2019 00:42:56 +0000 From: "Manger, James" To: Rob Stradling , "trans@ietf.org" Thread-Topic: [Trans] Directory instead of .well-known for URL structure Thread-Index: AQHVJ7hG+ux4uZr19UqDBEb3y0EQUaap50UAgAAKWICAAO2VgIAAqeKw Date: Tue, 25 Jun 2019 00:42:56 +0000 Message-ID: References: <0d5e05fc-8f1e-54b5-536d-231153e7baf7@eff.org> <48a31dcd-71d9-42c8-9ec3-6104939a59ab@www.fastmail.com> <7161898d-a58d-1625-a041-2e93961e71a2@gmail.com> In-Reply-To: Accept-Language: en-AU, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: dlp-product: dlpe-windows dlp-version: 11.1.100.23 dlp-reaction: no-action authentication-results: spf=none (sender IP is ) smtp.mailfrom=James.H.Manger@team.telstra.com; x-originating-ip: [203.41.142.253] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: dcd8c662-7e9d-458c-0b5a-08d6f90610c5 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(5600148)(711020)(4605104)(1401327)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(2017052603328)(7193020); SRVR:SY2PR01MB2332; x-ms-traffictypediagnostic: SY2PR01MB2332: x-ms-exchange-purlcount: 3 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:6790; x-forefront-prvs: 0079056367 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(346002)(136003)(396003)(39860400002)(376002)(366004)(199004)(189003)(13464003)(66066001)(68736007)(5660300002)(74316002)(9686003)(55016002)(6306002)(6436002)(486006)(64756008)(446003)(14444005)(476003)(11346002)(256004)(229853002)(66946007)(6116002)(66446008)(2501003)(73956011)(66476007)(3846002)(25786009)(478600001)(66556008)(86362001)(76176011)(7696005)(99286004)(305945005)(7736002)(14454004)(26005)(71190400001)(8936002)(186003)(53936002)(6246003)(2906002)(52536014)(76116006)(966005)(72206003)(8676002)(53546011)(561944003)(33656002)(6506007)(81166006)(81156014)(102836004)(316002)(71200400001)(110136005)(142923001); DIR:OUT; SFP:1102; SCL:1; SRVR:SY2PR01MB2332; H:SY2PR01MB2764.ausprd01.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:0; MX:1; received-spf: None (protection.outlook.com: team.telstra.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: 6gc0BU6QW51+TjgXbfHg8YAMR0AK2VcwHlbK+6pPZ23ASnLRcvzh7gbZHpksAqh9oXc9HkLW94Sgwx8tujsHK5vqmTpBaYg0sEeF/rB+enr7c5ExqtKrvW3N/LlyT9hrechU5U6ag7u3DiH6cPGjKAZrq/22+8V19ftC964ngkpEC60k02w/drKszAKvwQavOSavYOWd8c9FD7taxCewF3ak8izoDj36NZp6wNib15w9uSbrCYpi64aOzIXtGxgo56mhk7a+n4wPpJN5ZRpV86tp7tkBhR32BtvnWIHjnxrU2VJQhrBsy6fjDdkPubtccYir81Wof1jM9g8c155MSyaAchqPM8VKd3iptxvhtFWaGsDbrG8nYuFWN5Vl5UXM7QUKxq7/iqCcuhvP4idavhy4krCl9skJ3NR70FNQiFM= Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: dcd8c662-7e9d-458c-0b5a-08d6f90610c5 X-MS-Exchange-CrossTenant-originalarrivaltime: 25 Jun 2019 00:42:56.5682 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 49dfc6a3-5fb7-49f4-adea-c54e725bb854 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: James.H.Manger@team.telstra.com X-MS-Exchange-Transport-CrossTenantHeadersStamped: SY2PR01MB2332 X-OriginatorOrg: team.telstra.com Archived-At: Subject: Re: [Trans] Directory instead of .well-known for URL structure X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 25 Jun 2019 00:45:11 -0000 Would it be sufficient to provide a URL template for each log, instead of a= directory URL? Possible text: The address of a log is defined by a URL template [RFC6570] that MUST inc= lude the following variables: action, first, second, hash, start, end. 'action' identifies the client message, such as 'submit-entry' or 'get-st= h'. 'first' and 'second' are tree sizes. 'hash' is a base64-encoded v2 leaf h= ash. 'start' and 'end' are 0-based entry indicies. Example: https://log.example.net/ct/v2/red/{action}{?first}{?second}{?has= h}{?start}{?end} -- James Manger -----Original Message----- From: Trans On Behalf Of Rob Stradling Sent: Tuesday, 25 June 2019 12:16 AM To: Melinda Shore ; trans@ietf.org Subject: Re: [Trans] Directory instead of .well-known for URL structure This sounds unanimous. :-) I'll go ahead and make this change, and I'll cancel the registration proces= s for "ct" as a .well-known URI suffix. On 24/06/2019 01:05, Melinda Shore wrote: > On 6/23/19 3:28 PM, Martin Thomson wrote: >> I agree with Jacob here. As I have expressed in the past, I believe=20 >> that this is a better design than the well-known prefix. >=20 >> On Fri, Jun 21, 2019, at 08:33, Jacob Hoffman-Andrews wrote: >>> The latest draft adopts a /.well-known/ path for CT as a way to get >>> around BCP 190 (URI Design and Ownership: >>> https://tools.ietf.org/html/bcp190#section-3). >>> >>> Personally I think BCP 190 makes it needlessly painful to specify=20 >>> HTTP-based APIs using techniques that are very common among=20 >>> practitioners. However, given that it is still considered best=20 >>> practice for IETF documents, I propose that CT should use a=20 >>> different workaround, one used very successfully by ACME: Directory=20 >>> URLs. >=20 > I have a fairly profound dislike for BCP 190, to be honest, and am in=20 > agreement with the proposal. >=20 > Melinda >=20 -- Rob Stradling Senior Research & Development Scientist Email: rob@sectigo.com Bradford, UK Office: +441274024707 Sectigo Limited This message and any files associated with it may contain legally privilege= d, confidential, or proprietary information. If you are not the intended re= cipient, you are not permitted to use, copy, or forward it, in whole or in = part without the express consent of the sender. Please notify the sender by= reply email, disregard the foregoing messages, and delete it immediately. _______________________________________________ Trans mailing list Trans@ietf.org https://www.ietf.org/mailman/listinfo/trans From nobody Tue Jun 25 03:12:35 2019 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4443F1203E9 for ; Tue, 25 Jun 2019 03:12:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.499 X-Spam-Level: X-Spam-Status: No, score=-17.499 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nbf4RZ04Vqha for ; Tue, 25 Jun 2019 03:12:32 -0700 (PDT) Received: from mail-yb1-xb2f.google.com (mail-yb1-xb2f.google.com [IPv6:2607:f8b0:4864:20::b2f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3837D12024D for ; Tue, 25 Jun 2019 03:12:32 -0700 (PDT) Received: by mail-yb1-xb2f.google.com with SMTP id y67so3674187yba.8 for ; Tue, 25 Jun 2019 03:12:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=G7RZOVahFHir9iJfSltgZjTDnUXP40TCs0aAzYvbGis=; b=hHROkv5c4sB+DA55CBryl2w9YjJ8QrAxmOColKmZPrwYqbT5wx4pvaGl6MtXIBYGhX KG+WsUm1fuS03jGIZ5fK2/qcCpnBi2cc1GelMFzASGVyPjfUX/l5e+bnRCOPZdaUkpcZ OlJzK6WSK4nDfNbnckQqqQIaX+4sOJFsNAqIvhe+uE5g0BtLaLIKKTdMXtYaVrVHNw82 uGA/LHLUhppzMCaBNa1hFBL90XpWpbNzPjXunes9JCrJ7Vy42Byt8AAM5c2lPcB7Kerr 4+fyS3ukDm2uuHOUyGimaxmvtPh9RDHajRnguRE/MGGsCHhvtYdEb2tn53ZrFzmfmz3C aFow== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=G7RZOVahFHir9iJfSltgZjTDnUXP40TCs0aAzYvbGis=; b=l9FNAVpCZMJJe6V+VJcOVGbmGbCqeT9zHMCY2IIxgsc5nLYfgn4VamoPmBdr8uFIM1 aqXV/oyGmKKMMK2CTHV/d0/HDJM5bgMX5bEO3f7d/PJQ9k8CahU+HCJJYYnZdvI684Tq s59lLrVcht68gNqzLzQhXATGfbyfzkT5VdZSSXNcpDBM3Hf4u3s0yWhtcIO8aUhWUHPP AQpcGF3M3vRP6XltA+LCYs45kf28umzRsB8qUTE0O80XUG02XL/OGnuhBZgs68x5qJ/d i31zv+Cy54QjXZeAhmprzlbe4CkfzdZJ8u++nIUUQttVawkInevxp2SQge81ma+u6/os trkA== X-Gm-Message-State: APjAAAWw7WxvU30mFZ6fQjUDakW0sIcbXNy5kWB/aF3gU7dry5TAELaV C+GALM3B8cAwAdoTyrcIMHpRoFyI8HwBTelrXBL2HQ== X-Google-Smtp-Source: APXvYqwKzbXcg41uL9Wesif0IeM6My03+XwpOjTn5pA0EiZltTqL6r+TS4rbo1hlIJF+zLw4yo3ffEsY/1FF0bcKRE0= X-Received: by 2002:a25:bdcf:: with SMTP id g15mr78960091ybk.419.1561457551041; Tue, 25 Jun 2019 03:12:31 -0700 (PDT) MIME-Version: 1.0 References: <0d5e05fc-8f1e-54b5-536d-231153e7baf7@eff.org> <48a31dcd-71d9-42c8-9ec3-6104939a59ab@www.fastmail.com> <7161898d-a58d-1625-a041-2e93961e71a2@gmail.com> In-Reply-To: From: Eran Messeri Date: Tue, 25 Jun 2019 11:12:04 +0100 Message-ID: To: "Manger, James" Cc: Rob Stradling , "trans@ietf.org" Content-Type: multipart/alternative; boundary="000000000000a9bbf4058c232acf" Archived-At: Subject: Re: [Trans] Directory instead of .well-known for URL structure X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 25 Jun 2019 10:12:34 -0000 --000000000000a9bbf4058c232acf Content-Type: text/plain; charset="UTF-8" Can you clarify if you mean a single template to cover all possible actions or separate one for each action? The former would, I think, be tricky to define as different actions have different parameters. The latter is what we had, and is not in compliance with BCP190. Either way, the issue here is compliance with BCP190, so if your proposal is in compliance with BCP190 it's worth highlighting why (as it's not clear to me personally). Thanks, Eran On Tue, Jun 25, 2019 at 1:45 AM Manger, James < James.H.Manger@team.telstra.com> wrote: > Would it be sufficient to provide a URL template for each log, instead of > a directory URL? > Possible text: > > The address of a log is defined by a URL template [RFC6570] that MUST > include > the following variables: action, first, second, hash, start, end. > > 'action' identifies the client message, such as 'submit-entry' or > 'get-sth'. > 'first' and 'second' are tree sizes. 'hash' is a base64-encoded v2 leaf > hash. > 'start' and 'end' are 0-based entry indicies. > > Example: > https://log.example.net/ct/v2/red/{action}{?first}{?second}{?hash}{?start}{?end} > > -- > James Manger > > -----Original Message----- > From: Trans On Behalf Of Rob Stradling > Sent: Tuesday, 25 June 2019 12:16 AM > To: Melinda Shore ; trans@ietf.org > Subject: Re: [Trans] Directory instead of .well-known for URL structure > > This sounds unanimous. :-) > > I'll go ahead and make this change, and I'll cancel the registration > process for "ct" as a .well-known URI suffix. > > On 24/06/2019 01:05, Melinda Shore wrote: > > On 6/23/19 3:28 PM, Martin Thomson wrote: > >> I agree with Jacob here. As I have expressed in the past, I believe > >> that this is a better design than the well-known prefix. > > > >> On Fri, Jun 21, 2019, at 08:33, Jacob Hoffman-Andrews wrote: > >>> The latest draft adopts a /.well-known/ path for CT as a way to get > >>> around BCP 190 (URI Design and Ownership: > >>> https://tools.ietf.org/html/bcp190#section-3). > >>> > >>> Personally I think BCP 190 makes it needlessly painful to specify > >>> HTTP-based APIs using techniques that are very common among > >>> practitioners. However, given that it is still considered best > >>> practice for IETF documents, I propose that CT should use a > >>> different workaround, one used very successfully by ACME: Directory > >>> URLs. > > > > I have a fairly profound dislike for BCP 190, to be honest, and am in > > agreement with the proposal. > > > > Melinda > > > > -- > Rob Stradling > Senior Research & Development Scientist > Email: rob@sectigo.com > Bradford, UK > Office: +441274024707 > Sectigo Limited > > This message and any files associated with it may contain legally > privileged, confidential, or proprietary information. If you are not the > intended recipient, you are not permitted to use, copy, or forward it, in > whole or in part without the express consent of the sender. Please notify > the sender by reply email, disregard the foregoing messages, and delete it > immediately. > _______________________________________________ > Trans mailing list > Trans@ietf.org > https://www.ietf.org/mailman/listinfo/trans > > _______________________________________________ > Trans mailing list > Trans@ietf.org > https://www.ietf.org/mailman/listinfo/trans > --000000000000a9bbf4058c232acf Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Can you clarify if you mean a single template to cover all= possible actions or separate one for each action?

The f= ormer would, I think, be tricky to define as different actions have differe= nt parameters.
The latter is what we had, and is not in complianc= e with BCP190.

Either way, the issue here is c= ompliance with BCP190, so if your proposal is in compliance with BCP190 it&= #39;s worth highlighting why (as it's not clear to me personally).

Thanks,
Eran

On Tue, Jun 25, 2019 at 1:= 45 AM Manger, James <= James.H.Manger@team.telstra.com> wrote:
Would it be sufficient to provide a URL te= mplate for each log, instead of a directory URL?
Possible text:

=C2=A0 The address of a log is defined by a URL template [RFC6570] that MUS= T include
=C2=A0 the following variables: action, first, second, hash, start, end.
=C2=A0 'action' identifies the client message, such as 'submit-= entry' or 'get-sth'.
=C2=A0 'first' and 'second' are tree sizes. 'hash' = is a base64-encoded v2 leaf hash.
=C2=A0 'start' and 'end' are 0-based entry indicies.

=C2=A0 Example: https://log.example.net/ct/v2/red/{action}{?first}{?sec= ond}{?hash}{?start}{?end}

--
James Manger

-----Original Message-----
From: Trans <trans-bounces@ietf.org> On Behalf Of Rob Stradling
Sent: Tuesday, 25 June 2019 12:16 AM
To: Melinda Shore <melinda.shore@gmail.com>; trans@ietf.org
Subject: Re: [Trans] Directory instead of .well-known for URL structure

This sounds unanimous.=C2=A0 :-)

I'll go ahead and make this change, and I'll cancel the registratio= n process for "ct" as a .well-known URI suffix.

On 24/06/2019 01:05, Melinda Shore wrote:
> On 6/23/19 3:28 PM, Martin Thomson wrote:
>> I agree with Jacob here. As I have expressed in the past, I believ= e
>> that this is a better design than the well-known prefix.
>
>> On Fri, Jun 21, 2019, at 08:33, Jacob Hoffman-Andrews wrote:
>>> The latest draft adopts a /.well-known/ path for CT as a way t= o get
>>>=C2=A0 =C2=A0around BCP 190 (URI Design and Ownership:
>>> https://tools.ietf.org/html/bcp190#sectio= n-3).
>>>
>>> Personally I think BCP 190 makes it needlessly painful to spec= ify
>>> HTTP-based APIs using techniques that are very common among >>> practitioners. However, given that it is still considered best=
>>> practice for IETF documents, I propose that CT should use a >>> different workaround, one used very successfully by ACME: Dire= ctory
>>> URLs.
>
> I have a fairly profound dislike for BCP 190, to be honest, and am in =
> agreement with the proposal.
>
> Melinda
>

--
Rob Stradling
Senior Research & Development Scientist
Email: rob@sectigo.com=
Bradford, UK
Office: +441274024707
Sectigo Limited

This message and any files associated with it may contain legally privilege= d, confidential, or proprietary information. If you are not the intended re= cipient, you are not permitted to use, copy, or forward it, in whole or in = part without the express consent of the sender. Please notify the sender by= reply email, disregard the foregoing messages, and delete it immediately.<= br> _______________________________________________
Trans mailing list
Trans@ietf.org
https://www.ietf.org/mailman/listinfo/trans

_______________________________________________
Trans mailing list
Trans@ietf.org
https://www.ietf.org/mailman/listinfo/trans
--000000000000a9bbf4058c232acf-- From nobody Tue Jun 25 10:21:41 2019 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5966712090A; Tue, 25 Jun 2019 10:21:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.679 X-Spam-Level: X-Spam-Status: No, score=-1.679 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_INVALID=0.1, DKIM_SIGNED=0.1, T_SPF_HELO_PERMERROR=0.01, T_SPF_PERMERROR=0.01, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=nostrum.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wmvMhHnf8pZQ; Tue, 25 Jun 2019 10:21:31 -0700 (PDT) Received: from nostrum.com (raven-v6.nostrum.com [IPv6:2001:470:d:1130::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 43A3F1208E8; Tue, 25 Jun 2019 10:21:17 -0700 (PDT) Received: from MacBook-Pro.roach.at (99-152-146-228.lightspeed.dllstx.sbcglobal.net [99.152.146.228]) (authenticated bits=0) by nostrum.com (8.15.2/8.15.2) with ESMTPSA id x5PHL5f6057012 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO); Tue, 25 Jun 2019 12:21:11 -0500 (CDT) (envelope-from adam@nostrum.com) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=nostrum.com; s=default; t=1561483273; bh=AGgKzNb7Kytl7L7jL0EJoD6CUGOOhT/bpdcUw3QiyxA=; h=Subject:To:Cc:References:From:Date:In-Reply-To; b=LkSxS4LBWUgYvSvj6AJPnmMxMgRA3XPdsjRSnfcNjgO43oi4Jei6r5vsVQkTxjx1c lvgHvGdCdLC4U64kOHnoxGSgRZ/4axjPQj97B+P2LsGEnYeskPI0YnvUdYf9RwRZpP TlVsLTk5RsA72hVlnpOGkuLEkBhURTmYj1tJrHr8= X-Authentication-Warning: raven.nostrum.com: Host 99-152-146-228.lightspeed.dllstx.sbcglobal.net [99.152.146.228] claimed to be MacBook-Pro.roach.at To: Rob Stradling Cc: Eric Rescorla , Trans , Alexey Melnikov , "draft-ietf-trans-rfc6962-bis@ietf.org" , "trans-chairs@ietf.org" , The IESG , Paul Wouters References: <155245900142.5466.15600148045977298644.idtracker@ietfa.amsl.com> From: Adam Roach Message-ID: <943a0e44-faab-28f0-f677-b41faa870558@nostrum.com> Date: Tue, 25 Jun 2019 12:21:00 -0500 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:60.0) Gecko/20100101 Thunderbird/60.7.2 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Content-Language: en-US Archived-At: Subject: Re: [Trans] Adam Roach's Discuss on draft-ietf-trans-rfc6962-bis-31: (with DISCUSS and COMMENT) X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 25 Jun 2019 17:21:34 -0000 On 6/18/19 4:50 AM, Rob Stradling wrote: > Adam, thanks for your review, and I apologize that none of this > document's authors have been available to respond until now. > > I have filed > https://github.com/google/certificate-transparency-rfcs/pull/310, which > I believe addresses all of your concerns. Thanks! This looks good, although you'll also need to register "ct" in the Well-Known URIs registry [1]. See [2] for the registration template, and [3] for an example of it in use. I'll clear my discuss as soon as a new version is available in the internet-drafts repository. /a ____ [1] https://www.iana.org/assignments/well-known-uris/well-known-uris.xhtml [2] https://tools.ietf.org/html/rfc5785#section-5.1.1 [3] https://tools.ietf.org/html/rfc7033#section-10.1 > > On 13/03/2019 20:52, Alexey Melnikov wrote: >> On Wed, Mar 13, 2019, at 5:26 PM, Adam Roach wrote: >>> On 3/13/19 8:28 AM, Eric Rescorla wrote: >>>> On Tue, Mar 12, 2019 at 11:36 PM Adam Roach via Datatracker >>>> > wrote: >>>> >>>> >>>> ---------------------------------------------------------------------- >>>> DISCUSS: >>>> ---------------------------------------------------------------------- >>>> >>>> Thanks to everyone who worked on updating this protocol to >>>> reflect experience >>>> gathered from the initial CT protocol. I have one blocking >>>> comment, and a small >>>> number of editorial suggestions. >>>> >>>> --------------------------------------------------------------------------- >>>> >>>> §5: >>>> >>>> >  Clients are configured with a base URL for a log and construct >>>> URLs >>>> >  for requests by appending suffixes to this base URL. This >>>> structure >>>> >  places some degree of restriction on how log operators can deploy >>>> >  these services, as noted in [RFC7320].  However, operational >>>> >  experience with version 1 of this protocol has not indicated that >>>> >  these restrictions are a problem in practice. >>>> >>>> The synthesis of URLs by a protocol in this fashion is prohibited >>>> by BCP 190: >>>> >>>>    Scheme definitions define the presence, format, and semantics of a >>>>    path component in URIs; all other specifications MUST NOT >>>> constrain, >>>>    or define the structure or the semantics for any path component. >>>> >>>> Unless the intention of this document is to update BCP 190 to >>>> change this >>>> normative requirement, we can't publish it in its current form. >>>> Note that doing >>>> so would require a change of venue, as updates to BCP 190 would >>>> not be covered >>>> by the current TRANS charter. >>>> >>>> Please see BCP 190 section 3 for alternate approaches. All three >>>> approaches >>>> could be made to work for CT, and I would be happy to explain how >>>> to do so if >>>> clarification is desired. >>>> >>>> >>>> While I agree that this is forbidden by BCP 190, this structure is >>>> inherited from >>>> RFC 6962, which predated 7320, so making that change seems like it's >>>> going >>>> to be fairly disruptive. This seems like it is falling into our >>>> discussion the other >>>> day about what must be changed in -bis documents. >>> I think the timing of this document is fortuitous, in that it can help >>> inform that conversation. In particular, this situation helps me >>> better understand why both you and Benjamin raised objections to the >>> high-level proposal that unchanged parts of -bis documents shouldn't >>> be subject to DISCUSS positions. The take-away that I plan to bring to >>> that conversation is that such a decision needs to be informed by (a) >>> scope of changes between a document and its -bis, and (b) scope of >>> changes required to satisfy a potential DISCUSS position. >>> >>> In cases like this one, where a not-even-remotely-backwards-compatible >>> suite of protocol changes is being made to a protocol in a document >>> update whose diff [1] is basically the entire document, I don't think >>> the principle of ignoring existing flaws in a previous document really >>> applies. I get that both of those predicates are somewhat subjective >>> evaluations, and that drawing a line in a process document might be >>> difficult; but I think that any standard, however subjective, that you >>> would be willing to sign on to would place this document outside the >>> category of "bis versions that are making small, incremental changes >>> to existing documents." >>> >>> If the remedy for the flaw were a major overhaul rather than a >>> relatively minor tweak, it would again shift the evaluation a bit; >>> however, the naïve band-aid solution of moving CT endpoints to live >>> under "/.well-known/ct" is a trivial change, both for this document >>> and for implementations (in fact, for implementations, it can >>> generally be accomplished with a configuration tweak rather than >>> writing new code). To be clear, this is a textbook example of the kind >>> of situation URI templates were designed for, but that would require >>> substantially more work than simply moving it into the .well-known >>> tree. Either approach would address the URI ownership issue. >>> >> I am in full agreement with this. >> From nobody Tue Jun 25 18:50:51 2019 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A889A120152 for ; Tue, 25 Jun 2019 18:50:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=0.1, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BVJQJQ11TZTk for ; Tue, 25 Jun 2019 18:50:44 -0700 (PDT) Received: from NAM04-CO1-obe.outbound.protection.outlook.com (mail-co1nam04on070b.outbound.protection.outlook.com [IPv6:2a01:111:f400:fe4d::70b]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 55171120041 for ; Tue, 25 Jun 2019 18:50:44 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=c7wFtjTCKYPhOpCmsLLl4Dhkb2ZHryfp2GOL4U64R+/ByuOAghsi8rhuc1Dw7ZG0RsSsegm9nRRwpLaEvZ2qdJZVMH6aW4Se03boAW1OPZmUBnlzpZab0lNtSm4XORnRJwd6v5RhH2gN3rlekH1fEA2coo/dCBG+Ey/A3huuuFsC2OYSFc306WvLsKva4OfrDNDrMLjOS/YXB/316Z8XIPenPuwdnNR6ktG9wJ1fsiE+zsKLKwg9EVcbT+2puTuEdvopR0abtQ8m+0hwx0Tw4X/TMqFbAhWc/erQTniKuGQlEG9DmE9LzRVhe1v1QKncnBGO9VvasSLx8EgGuF8H6Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=G+vow/tx1n6IbstXiHaQE6OhJ4bIrvlS4qHjdKniDQM=; b=mihICQSulJCdZdJnHhsxsU/0Go7lHECk1krS2GffELXgXSUsRJzTPCdVenfTa4mZ7JoU1+X5lEhZ0BKGUXSzrf3LdYg8PywLpGo8r6QBeTLy3+j/2zzYwGoOxGJuL02vrPLm9+vcB2mW6SMQPMvR7Op3rpDCSB1CulXXRTC4wUAWxj46pa+W9jhSlA63aWCAI/QRyrbFcVrvOAk57GmvZStcEM7VtNJ2PK2JLMP2720/An9pMlz8OKSP8PTimNOTcs6p545iLjZdQvKZjvxjV8xkohqTlo3ukjqDzP6UN8b1HzAl7ryGuxTZe7/26lTEkko+HUFyII80Dc0UtTYkaw== ARC-Authentication-Results: i=1; mx.microsoft.com 1;spf=pass smtp.mailfrom=microsoft.com;dmarc=pass action=none header.from=microsoft.com;dkim=pass header.d=microsoft.com;arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=G+vow/tx1n6IbstXiHaQE6OhJ4bIrvlS4qHjdKniDQM=; b=o8/JzhNe6qrx56Z7nb1u7bbpAUbS+EJoaXotIPUVFjGAJRCADLCEtZNMCdfrHlOR8xgNKFQG6TUWlsa8besBDIujcJhvBXKIqw14t+Bo7bvne6dfI0/JKraNgUjQbLhI+H8mVPBCTZnVR/DMhqO4T6ImefLGjUHyrA8roH8fY/c= Received: from MWHPR21MB0846.namprd21.prod.outlook.com (2603:10b6:300:77::12) by MWHPR21MB0784.namprd21.prod.outlook.com (2603:10b6:300:77::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2052.3; Wed, 26 Jun 2019 01:50:43 +0000 Received: from MWHPR21MB0846.namprd21.prod.outlook.com ([fe80::7494:1d1:dd28:75fc]) by MWHPR21MB0846.namprd21.prod.outlook.com ([fe80::7494:1d1:dd28:75fc%3]) with mapi id 15.20.2008.017; Wed, 26 Jun 2019 01:50:43 +0000 From: Rashmi Jha To: Eran Messeri , Paul Wouters , "trans@ietf.org" Thread-Topic: [Trans] draft-ietf-trans-rfc6962-bis-31 Thread-Index: AdUm63nX6SEEUQM9QPCVcL3rkFMn6wADVmwAABXbiYABG3cTYA== Date: Wed, 26 Jun 2019 01:50:42 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=True; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Owner=rashmij@microsoft.com; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2019-06-26T01:50:41.2493254Z; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Name=General; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Application=Microsoft Azure Information Protection; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ActionId=6a47b796-ce9b-4d26-84b0-912b6c948928; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Extended_MSFT_Method=Automatic authentication-results: spf=none (sender IP is ) smtp.mailfrom=rashmij@microsoft.com; x-originating-ip: [2001:4898:80e8:0:1a3:6d3a:6ebd:fdbe] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: d552194a-3196-431d-05ac-08d6f9d8b303 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(4618075)(2017052603328)(7193020); SRVR:MWHPR21MB0784; x-ms-traffictypediagnostic: MWHPR21MB0784: x-ms-exchange-purlcount: 3 x-microsoft-antispam-prvs: x-o365-sonar-daas-pilot: True x-ms-oob-tlc-oobclassifiers: OLM:10000; x-forefront-prvs: 00808B16F3 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(396003)(346002)(136003)(376002)(39860400002)(366004)(199004)(189003)(64756008)(9686003)(10290500003)(790700001)(54896002)(46003)(53546011)(8936002)(7736002)(74316002)(476003)(99286004)(478600001)(6436002)(6306002)(236005)(6506007)(7696005)(81166006)(6116002)(81156014)(52536014)(102836004)(2906002)(6246003)(8676002)(53936002)(55016002)(110136005)(33656002)(10090500001)(68736007)(8990500004)(316002)(966005)(25786009)(76176011)(14454004)(22452003)(66574012)(14444005)(606006)(66476007)(66556008)(2501003)(52396003)(66946007)(229853002)(73956011)(76116006)(486006)(256004)(11346002)(446003)(71200400001)(71190400001)(86362001)(5660300002)(66446008)(186003); DIR:OUT; SFP:1102; SCL:1; SRVR:MWHPR21MB0784; H:MWHPR21MB0846.namprd21.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: p89yZ1+XhRwLrVz/BjxK+oy/dj2bUIz1LHIOpmTBc2PdTd3m3+ZnBZ9ZJaBvZH1lFHQoOs7LCZ5V78vOIxkFKVYkxF/p55fE1f/9v41rAMaJIBnMg+8X39Q7KWR12FTMDLrbUN6p6SxqyweSzSmN7C5A2ETP7MMyB0zACyfmHqHMPhZm7Lre7Kl3hPFnN6bKoObHg54Mdusi/wx24fkpVRNU77P0EUL+erjyl8LvtQ5FJAQgXqgRrMOT/9x9+DBavzd9NN1j1hMN7BaK6jpKokGjw2rT2HJA79EtceQol4U6rI5tTu/aC5/FrpwjaDCvfiaz1XNjPsycAC4U7MTRNgoBTc2ZrTfCdtvko/zz7MCGtpbjfj6Nyp8X/i/w9vLv4h/voHn9/SpLdWraijd5MDY+a8DfIB17olXTQZjVRdw= Content-Type: multipart/alternative; boundary="_000_MWHPR21MB084622793C06701F9A7CCD8CA7E20MWHPR21MB0846namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: d552194a-3196-431d-05ac-08d6f9d8b303 X-MS-Exchange-CrossTenant-originalarrivaltime: 26 Jun 2019 01:50:42.9316 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: rashmij@microsoft.com X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR21MB0784 Archived-At: Subject: Re: [Trans] draft-ietf-trans-rfc6962-bis-31 X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 26 Jun 2019 01:50:49 -0000 --_000_MWHPR21MB084622793C06701F9A7CCD8CA7E20MWHPR21MB0846namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 TmFtZSBjb25zdHJhaW50cyBpdHNlbGYgaWYgb3J0aG9nb25hbCB0byBDVCBidXQgYm90aCBvZiB0 aGVzZSBhY2hpZXZlIHRoZSBzYW1lIGdvYWwuICBSZXN0cmljdCBhIENBIHRvIGlzc3VlIGNlcnRz IGZvciB0aGUgZG9tYWlucyB0aGV5IGFyZSBzdXBwb3NlIHRvLiBUaGUgZGlmZmVyZW5jZSBpcyBm b2xsb3dpbmcgOg0KDQogICogICBJbiBDVCwgeW91IGxvZyB0aGUgY2VydCBpbnRvIENUIGxvZ3Mg YXQgdGhlIHRpbWUgb2YgaXNzdWFuY2Ugb2YgZWFjaCBjZXJ0DQogICogICBOYW1lIGNvbnN0cmFp bmVkIGlzIHVwZnJvbnQgd2hlcmUgQ0EgZGVjbGFyZXMgdGhhdCBJIGFtIGdvaW5nIHRvIGlzc3Vl IGNlcnRzIG9ubHkgZm9yIGZvcmQuY29tLCBqYWd1YXIuY29tIChoeXBvdGhldGljYWxseSkgYW5k IHRoYXTigJlzIGl0Lg0KDQpOYW1lZCBjb25zdHJhaW50cyBDQSBzaG91bGRu4oCZdCBuZWVkIHRv IGxvZyBlYWNoIHRpbWUgd2hlbiBhIGNlcnQgaXMgaXNzdWVkLiAgQmVjYXVzZSB0aGUgdmVyaWZp Y2F0aW9uIGFuZCBtb25pdG9yIG9mIHdoZXRoZXIgdGhlIENBIGhhcyBjb21wbGllZCB3aXRoIHRo ZSBnb2FsIGlzIGRvbmUgb2ZmbGluZSBvciBhIGRpZmZlcmVudCB0aW1lIGluIGJvdGggdGhlIHNj ZW5hcmlvcy4NCg0KVGhlIGRyYWZ0IGRvZXNu4oCZdCBhZGRyZXNzIHdoYXQgc2hvdWxkIGJlIGFu IGFsdGVybmF0aXZlIGZvciBmb2xrcyB3aG8gZG9u4oCZdCB3YW50IENUDQoNCiAgKiAgIENUIGFk ZHMgYnVyZGVuIGZvciBlYWNoIGNlcnRpZmljYXRlIGlzc3VhbmNlLiBJdCBhZGRzIH43c2Vjb25k cyB0byBldmVyeSBjZXJ0IGlzc3VhbmNlIGFuZCBpdCBhZGRzIGEgbmV3IGZhaWx1cmUgZW5kcG9p bnQgaW4gdGhlIHBhdGguDQogICogICBDVCBoYXMgMCBhbHRlcm5hdGl2ZXMuIFRoZXJlIGlzIG5v IG1lY2hhbmlzbSBmb3IgcmVkYWN0aW9uLg0KKFRoZSBvbmx5IGFsdGVybmF0aXZlIHRvIGhhdmUg c3ViZG9tYWluIGxldmVsIHJlZGFjdGlvbiBpcyB0byB1c2Ugd2lsZGNhcmQgd2hpY2ggaXMganVz dCBmcm9tIHRoZSBsaXN0IG9mIOKAmHdoYXQgbm90IHRvIGRv4oCZc+KAmSBpbiBQS0kuICkNCg0K Q1QgZHJpdmVzIGFuIGltcG9ydGFudCBpbmR1c3RyeS13aWRlIGdvYWwuIFRoZXJlIGFyZSBvdGhl ciB3YXlzIHRvIGFjaGlldmUgdGhlIHNhbWUgZ29hbC4gQW5kIGZvciBvcmdhbml6YXRpb25zIHdo ZXJlIGVhY2ggbWlsbGlzZWNvbmQgbWF0dGVycywgdGhlIHVzZXIgYWdlbnQgc2hvdWxkIHN1cHBv cnQgYW4gYWx0ZXJuYXRpdmUgcmF0aGVyIHRoYW4gYWRkIGxvYWQgYW5kIGZhaWx1cmUgcG9pbnQg YXQgdGhlaXIgY3JpdGljYWwgcGF0aCBvZiBpc3N1YW5jZS4gIE5hbWVkIGNvbnN0cmFpbnRzIGlz IHdpdGhpbiB0aGUgYm9va3Mgb2YgUEtJLiAgQSBDQSBjYW4gYmUgaGVsZCBhY2NvdW50YWJsZSBs aWtlIGFueSBvdGhlciBDQS9Ccm93c2VyIGJhc2VsaW5lIHJlcXVpcmVtZW50cyB0aGF0IGlmIHRo ZXkgaXNzdWUgY2VydHMgb3V0c2lkZSBvZiB0aGVpciBjb25zdHJhaW50cyB0aGVuIHRoZXkgc2hv dWxkIHRha2UgaW1tZWRpYXRlIGFjdGlvbiBvciBnZXQgZGlzdHJ1c3RlZC4gSXQgd29u4oCZdCBi ZSBhbnkgZGlmZmVyZW50IGZyb20gYSBDQSBkb2luZyBhIHdyb25nIHRoaW5nIGFuZCBnb3QgY2F1 Z2h0IHZpYSBDVCBtb25pdG9ycy4NCg0KVGhpcyBkcmFmdCBzaG91bGQgcHJlc2NyaWJlIGFuIGFs dGVybmF0aXZlIHRvIGFjaGlldmUgdGhlIHNhbWUgZ29hbCB3aGljaCBpcyBhY2hpZXZlZCBieSBD VCBhbmQgdGhlIGRldGFpbHMgb24gdGhhdCBhbHRlcm5hdGl2ZSBjYW4gYmUgY292ZXJlZCBzb21l d2hlcmUgZWxzZS4NCg0KVGhhbmtzLCBSYXNobWkgSmhhLg0KDQpGcm9tOiBFcmFuIE1lc3Nlcmkg PGVyYW5tPTQwZ29vZ2xlLmNvbUBkbWFyYy5pZXRmLm9yZz4NClNlbnQ6IFRodXJzZGF5LCBKdW5l IDIwLCAyMDE5IDM6MTAgQU0NClRvOiBQYXVsIFdvdXRlcnMgPHBhdWxAbm9oYXRzLmNhPg0KQ2M6 IFJhc2htaSBKaGEgPHJhc2htaWpAbWljcm9zb2Z0LmNvbT47IHRyYW5zQGlldGYub3JnDQpTdWJq ZWN0OiBSZTogW1RyYW5zXSBkcmFmdC1pZXRmLXRyYW5zLXJmYzY5NjItYmlzLTMxDQoNClBhdWwg bWFkZSB0aGUgcG9pbnQgcXVpdGUgYWNjdXJhdGVseSAtIENUIGlzIG9ydGhvZ29uYWwgdG8gbmFt ZS1jb25zdHJhaW5pbmcgYSBDQSwgYW5kIGNhbiBiZSB1c2VkIHRvIHZhbGlkYXRlIHRoZSBDQSBo YXMgYWRoZXJlZCB0byB0aGUgY29uc3RyYWluZWQgbmFtZXMuDQoNCkFkZGl0aW9uYWxseSwgdGhl cmUncyBubyB3YXkgdG8gc2lnbmFsIHRvIGEgdXNlciBhZ2VudCB0aGF0ICBzdWNoIGEgQ0Egd291 bGQgYmUgImV4ZW1wdCIgZnJvbSBDVCAoc29tZSB1c2VyIGFnZW50cyBoYXZlIEVudGVycHJpc2Ug Y29udHJvbHMgdG8gYWxsb3cgaW5zdGFuY2VzIG1hbmFnZWQgYnkgdGhlIG9yZ2FuaXphdGlvbiB0 byBub3QgcmVxdWlyZSBDVCBmb3IgY2VydGFpbiBkb21haW5zLCB0aG91Z2gpLg0KDQpPbiBUaHUs IEp1biAyMCwgMjAxOSBhdCAxMjo0NCBBTSBQYXVsIFdvdXRlcnMgPHBhdWxAbm9oYXRzLmNhPG1h aWx0bzpwYXVsQG5vaGF0cy5jYT4+IHdyb3RlOg0KT24gV2VkLCAxOSBKdW4gMjAxOSwgUmFzaG1p IEpoYSB3cm90ZToNCg0KPiBIYXZlIHlvdSBsb29rZWQgaW50byB0aGUgb3B0aW9ucyBvZiBub3Qg cmVxdWlyaW5nIENUIGZvciBDQXMgd2hpY2ggYXJlIGNvbnN0cmFpbmVkIHRvIGEgYnJpZWYgbGlz dCBvZiBkb21haW5zID8gSSB1bmRlcnN0YW5kIHRoaXMgd2FzIGNvbnNpZGVyZWQgaW4gdGhlIHBh c3QgYnV0IGNvdWxkbuKAmXQgZmluZCBkZXRhaWxzIHdoeSB0aGlzIHdhcyBub3QNCj4gYWNjZXB0 ZWQuDQoNCldoZXRoZXIgb3Igbm90IHRvIHJlcXVpcmUgQ1QgaXMgbm90IHBhcnQgb2YgdGhlIGRv Y3VtZW50LiBUaGlzIHNlZW1zDQptb3JlIGxpa2UgYSBxdWVzdGlvbiB0byBicm93c2VyIHZlbmRv cnMuIFRoZSBkcmFmdCBvbmx5IHN0YXRlczoNCg0KDQogICAgSW4gYWRkaXRpb24sIGlmIFRMUyBj bGllbnRzIHdpbGwgbm90IGFjY2VwdCB1bmxvZ2dlZCBjZXJ0aWZpY2F0ZXMsDQogICAgdGhlbiBz aXRlIG93bmVycyB3aWxsIGhhdmUgYSBncmVhdGVyIGluY2VudGl2ZSB0byBzdWJtaXQgY2VydGlm aWNhdGVzDQogICAgdG8gbG9ncywgcG9zc2libHkgd2l0aCB0aGUgYXNzaXN0YW5jZSBvZiB0aGVp ciBDQSwgaW5jcmVhc2luZyB0aGUNCiAgICBvdmVyYWxsIHRyYW5zcGFyZW5jeSBvZiB0aGUgc3lz dGVtLg0KDQpUaGUgImlmIiB0aGVyZSBpcyBpbXBvcnRhbnQuIEl0IGlzIG5vdCBhIGRlY2lzaW9u IG1hZGUgaW4gdGhpcyBkb2N1bWVudA0Kb3IgdGhpcyBXb3JraW5nIEdyb3VwLg0KDQpUaGUgZHJh ZnQgb25seSBsaXN0cyB0aGUgcmVxdWlyZW1lbnRzIGFuZCBmb3JtYXRzIGZvciB3aGVuIENUIGlz IHVzZWQuDQoNCj4gTmFtZWQgY29uc3RyYWludCBieSBkZWZhdWx0IHByb3ZpZGUgdGhlIGFzc3Vy YW5jZSBhcyB0byB3aGF0IGRvbWFpbnMgdGhleSB3aWxsIGlzc3VlLiBDVCBiZWNvbWVzIGFuIGFk ZGl0aW9uYWwgbmV0d29yayBjYWxsIGluIGluIGlzc3VhbmNlIG9mIGNlcnRpZmljYXRlIHdoaWNo IGNhbiBiZSBwcmV2ZW50ZWQuDQoNCk5vdCAiYXNzdXJhbmNlIiwgYnV0ICJleHBlY3RhdGlvbiIu IENUIGlzIHRoZXJlIHRvIGNvbmZpcm0gdGhpcw0KZXhwZWN0YXRpb24uIFN1cmVseSwgeW91IHdh bnQgQ1QgbG9ncyB0byBzaG93IGNhcHR1cmVkIGNlcnRpZmljYXRlcyB0aGF0DQp3ZXJlIHNpZ25l ZCBieSBhIENBIG91dHNpZGUgb2YgdGhhdCBDQSdzIG93biBOYW1lZCBjb25zdHJhaW50IHBvbGlj eT8NCg0KQWRkaXRpb25hbGx5LCBpZiB5b3Ugc2tpcCBhY2NlcHRpbmcgY2VydGlmaWNhdGVzIHdp dGhpbiBhIG5hbWVkDQpjb25zdHJhaW50LCB3aGF0IGRvIHlvdSBkbyB3aGVuIHNvbWUgQ0EgY2xh aW1zICIuY29tIiBhcyB0aGVpcg0KbmFtZWQgY29uc3RyYWludD8NCg0KUGF1bA0KDQpfX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KVHJhbnMgbWFpbGluZyBs aXN0DQpUcmFuc0BpZXRmLm9yZzxtYWlsdG86VHJhbnNAaWV0Zi5vcmc+DQpodHRwczovL3d3dy5p ZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3RyYW5zPGh0dHBzOi8vbmFtMDYuc2FmZWxpbmtzLnBy b3RlY3Rpb24ub3V0bG9vay5jb20vP3VybD1odHRwcyUzQSUyRiUyRnd3dy5pZXRmLm9yZyUyRm1h aWxtYW4lMkZsaXN0aW5mbyUyRnRyYW5zJmRhdGE9MDIlN0MwMSU3Q3Jhc2htaWolNDBtaWNyb3Nv ZnQuY29tJTdDYWU0NzRkYTk4MmI1NGJhMzM1NzIwOGQ2ZjU2Nzc3OTQlN0M3MmY5ODhiZjg2ZjE0 MWFmOTFhYjJkN2NkMDExZGI0NyU3QzElN0MwJTdDNjM2OTY2MjIyMDc5NjA1NzQwJnNkYXRhPWNZ ZlAyZ0ZrZVk4UGRtJTJCRWFITnYlMkJYZm9BVjAwJTJCU1VsTXZhaUF3OGVlMW8lM0QmcmVzZXJ2 ZWQ9MD4NCg== --_000_MWHPR21MB084622793C06701F9A7CCD8CA7E20MWHPR21MB0846namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 V2luZ2RpbmdzOw0KCXBhbm9zZS0xOjUgMCAwIDAgMCAwIDAgMCAwIDA7fQ0KQGZvbnQtZmFjZQ0K CXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2IDMg MiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1 IDUgMiAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWws IGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0 b206LjAwMDFwdDsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixz YW5zLXNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXByaW9y aXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQphOnZp c2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5 Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnAuTXNvTGlz dFBhcmFncmFwaCwgbGkuTXNvTGlzdFBhcmFncmFwaCwgZGl2Lk1zb0xpc3RQYXJhZ3JhcGgNCgl7 bXNvLXN0eWxlLXByaW9yaXR5OjM0Ow0KCW1hcmdpbi10b3A6MGluOw0KCW1hcmdpbi1yaWdodDow aW47DQoJbWFyZ2luLWJvdHRvbTowaW47DQoJbWFyZ2luLWxlZnQ6LjVpbjsNCgltYXJnaW4tYm90 dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIs c2Fucy1zZXJpZjt9DQpwLm1zb25vcm1hbDAsIGxpLm1zb25vcm1hbDAsIGRpdi5tc29ub3JtYWww DQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsN CgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0KCW1hcmdp bi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixz YW5zLXNlcmlmO30NCnNwYW4uRW1haWxTdHlsZTE4DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFs LXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOndpbmRv d3RleHQ7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJ Zm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJ e3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBpbiAxLjBpbiAxLjBpbjt9DQpk aXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi8qIExpc3QgRGVmaW5pdGlv bnMgKi8NCkBsaXN0IGwwDQoJe21zby1saXN0LWlkOjIwNDY2MzQyMzk7DQoJbXNvLWxpc3QtdHlw ZTpoeWJyaWQ7DQoJbXNvLWxpc3QtdGVtcGxhdGUtaWRzOi0xNzI4NzE0NTggMTA0MjgwOTU0NCA2 NzY5ODY5MSA2NzY5ODY5MyA2NzY5ODY4OSA2NzY5ODY5MSA2NzY5ODY5MyA2NzY5ODY4OSA2NzY5 ODY5MSA2NzY5ODY5Mzt9DQpAbGlzdCBsMDpsZXZlbDENCgl7bXNvLWxldmVsLW51bWJlci1mb3Jt YXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9u ZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWlu Ow0KCWZvbnQtZmFtaWx5OlN5bWJvbDsNCgltc28tZmFyZWFzdC1mb250LWZhbWlseTpDYWxpYnJp Ow0KCW1zby1iaWRpLWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iO30NCkBsaXN0IGwwOmxl dmVsMg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6 bzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9u OmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyI7 fQ0KQGxpc3QgbDA6bGV2ZWwzDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCglt c28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVs LW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWls eTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDA6bGV2ZWw0DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0 OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7 DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsN Cglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDA6bGV2ZWw1DQoJe21zby1sZXZlbC1udW1i ZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDpvOw0KCW1zby1sZXZlbC10YWItc3Rv cDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDot LjI1aW47DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3Ijt9DQpAbGlzdCBsMDpsZXZlbDYNCgl7 bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCglt c28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7 DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBs MDpsZXZlbDcNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10 ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBv c2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9 DQpAbGlzdCBsMDpsZXZlbDgNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1z by1sZXZlbC10ZXh0Om87DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51 bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseToi Q291cmllciBOZXciO30NCkBsaXN0IGwwOmxldmVsOQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1h dDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25l Ow0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47 DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCm9sDQoJe21hcmdpbi1ib3R0b206MGluO30NCnVs DQoJe21hcmdpbi1ib3R0b206MGluO30NCi0tPjwvc3R5bGU+PCEtLVtpZiBndGUgbXNvIDldPjx4 bWw+DQo8bzpzaGFwZWRlZmF1bHRzIHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2IiAvPg0KPC94 bWw+PCFbZW5kaWZdLS0+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWxheW91dCB2 OmV4dD0iZWRpdCI+DQo8bzppZG1hcCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4NCjwvbzpzaGFw ZWxheW91dD48L3htbD48IVtlbmRpZl0tLT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9IkVOLVVTIiBs aW5rPSJibHVlIiB2bGluaz0icHVycGxlIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj5OYW1lIGNvbnN0cmFpbnRzIGl0c2VsZiBpZiBvcnRob2dvbmFs IHRvIENUIGJ1dCBib3RoIG9mIHRoZXNlIGFjaGlldmUNCjxiPjx1PnRoZSBzYW1lIGdvYWw8L3U+ PC9iPi4mbmJzcDsgUmVzdHJpY3QgYSBDQSB0byBpc3N1ZSBjZXJ0cyBmb3IgdGhlIGRvbWFpbnMg dGhleSBhcmUgc3VwcG9zZSB0by4gVGhlIGRpZmZlcmVuY2UgaXMgZm9sbG93aW5nIDoNCjxvOnA+ PC9vOnA+PC9wPg0KPHVsIHN0eWxlPSJtYXJnaW4tdG9wOjBpbiIgdHlwZT0iZGlzYyI+DQo8bGkg Y2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJtYXJnaW4tbGVmdDowaW47bXNvLWxpc3Q6 bDAgbGV2ZWwxIGxmbzEiPkluIENULCB5b3UgbG9nIHRoZSBjZXJ0IGludG8gQ1QgbG9ncyBhdCB0 aGUgdGltZSBvZiBpc3N1YW5jZSBvZiBlYWNoIGNlcnQgJm5ic3A7PG86cD48L286cD48L2xpPjxs aSBjbGFzcz0iTXNvTGlzdFBhcmFncmFwaCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjBpbjttc28tbGlz dDpsMCBsZXZlbDEgbGZvMSI+TmFtZSBjb25zdHJhaW5lZCBpcyB1cGZyb250IHdoZXJlIENBIGRl Y2xhcmVzIHRoYXQgSSBhbSBnb2luZyB0byBpc3N1ZSBjZXJ0cyBvbmx5IGZvciBmb3JkLmNvbSwg amFndWFyLmNvbSAoaHlwb3RoZXRpY2FsbHkpIGFuZCB0aGF04oCZcyBpdC4gJm5ic3A7PG86cD48 L286cD48L2xpPjwvdWw+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk5hbWVkIGNvbnN0cmFpbnRzIENBIHNob3VsZG7igJl0 IG5lZWQgdG8gbG9nIGVhY2ggdGltZSB3aGVuIGEgY2VydCBpcyBpc3N1ZWQuJm5ic3A7IEJlY2F1 c2UgdGhlIHZlcmlmaWNhdGlvbiBhbmQgbW9uaXRvciBvZiB3aGV0aGVyIHRoZSBDQSBoYXMgY29t cGxpZWQNCjxiPjx1PndpdGggdGhlIGdvYWw8L3U+PC9iPiBpcyBkb25lIG9mZmxpbmUgb3IgYSBk aWZmZXJlbnQgdGltZSBpbiBib3RoIHRoZSBzY2VuYXJpb3MuDQo8bzpwPjwvbzpwPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+VGhlIGRyYWZ0IGRvZXNu4oCZdCBhZGRyZXNzIHdoYXQgc2hvdWxkIGJlIGFuIGFsdGVy bmF0aXZlIGZvciBmb2xrcyB3aG8gZG9u4oCZdCB3YW50IENUPG86cD48L286cD48L3A+DQo8dWwg c3R5bGU9Im1hcmdpbi10b3A6MGluIiB0eXBlPSJkaXNjIj4NCjxsaSBjbGFzcz0iTXNvTGlzdFBh cmFncmFwaCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjBpbjttc28tbGlzdDpsMCBsZXZlbDEgbGZvMSI+ Q1QgYWRkcyBidXJkZW4gZm9yIGVhY2ggY2VydGlmaWNhdGUgaXNzdWFuY2UuIEl0IGFkZHMgfjdz ZWNvbmRzIHRvIGV2ZXJ5IGNlcnQgaXNzdWFuY2UgYW5kIGl0IGFkZHMgYSBuZXcgZmFpbHVyZSBl bmRwb2ludCBpbiB0aGUgcGF0aC4NCjxvOnA+PC9vOnA+PC9saT48bGkgY2xhc3M9Ik1zb0xpc3RQ YXJhZ3JhcGgiIHN0eWxlPSJtYXJnaW4tbGVmdDowaW47bXNvLWxpc3Q6bDAgbGV2ZWwxIGxmbzEi PkNUIGhhcyAwIGFsdGVybmF0aXZlcy4gVGhlcmUgaXMgbm8gbWVjaGFuaXNtIGZvciByZWRhY3Rp b24uDQo8bzpwPjwvbzpwPjwvbGk+PC91bD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJ0 ZXh0LWluZGVudDouNWluIj4oVGhlIG9ubHkgYWx0ZXJuYXRpdmUgdG8gaGF2ZSBzdWJkb21haW4g bGV2ZWwgcmVkYWN0aW9uIGlzIHRvIHVzZSB3aWxkY2FyZCB3aGljaCBpcyBqdXN0IGZyb20gdGhl IGxpc3Qgb2Yg4oCYd2hhdCBub3QgdG8gZG/igJlz4oCZIGluIFBLSS4gKTxvOnA+PC9vOnA+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj5DVCBkcml2ZXMgYW4gaW1wb3J0YW50IGluZHVzdHJ5LXdpZGUgZ29hbC4gVGhl cmUgYXJlIG90aGVyIHdheXMgdG8gYWNoaWV2ZSB0aGUgc2FtZSBnb2FsLiBBbmQgZm9yIG9yZ2Fu aXphdGlvbnMgd2hlcmUgZWFjaCBtaWxsaXNlY29uZCBtYXR0ZXJzLCB0aGUgdXNlciBhZ2VudCBz aG91bGQgc3VwcG9ydCBhbiBhbHRlcm5hdGl2ZSByYXRoZXIgdGhhbiBhZGQgbG9hZCBhbmQgZmFp bHVyZSBwb2ludCBhdCB0aGVpcg0KIGNyaXRpY2FsIHBhdGggb2YgaXNzdWFuY2UuICZuYnNwO05h bWVkIGNvbnN0cmFpbnRzIGlzIHdpdGhpbiB0aGUgYm9va3Mgb2YgUEtJLiAmbmJzcDtBIENBIGNh biBiZSBoZWxkIGFjY291bnRhYmxlIGxpa2UgYW55IG90aGVyIENBL0Jyb3dzZXIgYmFzZWxpbmUg cmVxdWlyZW1lbnRzIHRoYXQgaWYgdGhleSBpc3N1ZSBjZXJ0cyBvdXRzaWRlIG9mIHRoZWlyIGNv bnN0cmFpbnRzIHRoZW4gdGhleSBzaG91bGQgdGFrZSBpbW1lZGlhdGUgYWN0aW9uIG9yIGdldCBk aXN0cnVzdGVkLg0KIEl0IHdvbuKAmXQgYmUgYW55IGRpZmZlcmVudCBmcm9tIGEgQ0EgZG9pbmcg YSB3cm9uZyB0aGluZyBhbmQgZ290IGNhdWdodCB2aWEgQ1QgbW9uaXRvcnMuDQo8bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+VGhpcyBkcmFmdCBzaG91bGQgcHJlc2NyaWJlIGFuIGFsdGVybmF0aXZl IHRvIGFjaGlldmUgPGI+PHU+dGhlIHNhbWUgZ29hbDwvdT48L2I+IHdoaWNoIGlzIGFjaGlldmVk IGJ5IENUIGFuZCB0aGUgZGV0YWlscyBvbiB0aGF0IGFsdGVybmF0aXZlIGNhbiBiZSBjb3ZlcmVk IHNvbWV3aGVyZSBlbHNlLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86 cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5UaGFua3MsIFJhc2htaSBK aGEuIDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj5Gcm9tOjwvYj4gRXJhbiBNZXNzZXJpICZs dDtlcmFubT00MGdvb2dsZS5jb21AZG1hcmMuaWV0Zi5vcmcmZ3Q7DQo8YnI+DQo8Yj5TZW50Ojwv Yj4gVGh1cnNkYXksIEp1bmUgMjAsIDIwMTkgMzoxMCBBTTxicj4NCjxiPlRvOjwvYj4gUGF1bCBX b3V0ZXJzICZsdDtwYXVsQG5vaGF0cy5jYSZndDs8YnI+DQo8Yj5DYzo8L2I+IFJhc2htaSBKaGEg Jmx0O3Jhc2htaWpAbWljcm9zb2Z0LmNvbSZndDs7IHRyYW5zQGlldGYub3JnPGJyPg0KPGI+U3Vi amVjdDo8L2I+IFJlOiBbVHJhbnNdIGRyYWZ0LWlldGYtdHJhbnMtcmZjNjk2Mi1iaXMtMzE8bzpw PjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlBhdWwgbWFkZSB0aGUgcG9pbnQgcXVpdGUgYWNj dXJhdGVseSAtIENUIGlzIG9ydGhvZ29uYWwgdG8gbmFtZS1jb25zdHJhaW5pbmcgYSBDQSwgYW5k IGNhbiBiZSB1c2VkIHRvIHZhbGlkYXRlIHRoZSBDQSBoYXMgYWRoZXJlZCB0byB0aGUgY29uc3Ry YWluZWQgbmFtZXMuPG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij5BZGRpdGlvbmFsbHksIHRoZXJlJ3Mgbm8gd2F5IHRvIHNpZ25hbCB0byBhIHVzZXIgYWdlbnQg dGhhdCZuYnNwOyBzdWNoIGEgQ0Egd291bGQgYmUgJnF1b3Q7ZXhlbXB0JnF1b3Q7IGZyb20gQ1Qg KHNvbWUgdXNlciBhZ2VudHMgaGF2ZSBFbnRlcnByaXNlIGNvbnRyb2xzIHRvIGFsbG93IGluc3Rh bmNlcyBtYW5hZ2VkIGJ5IHRoZSBvcmdhbml6YXRpb24gdG8gbm90IHJlcXVpcmUgQ1QgZm9yIGNl cnRhaW4gZG9tYWlucywgdGhvdWdoKS48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+T24gVGh1LCBKdW4gMjAsIDIwMTkgYXQgMTI6NDQgQU0gUGF1 bCBXb3V0ZXJzICZsdDs8YSBocmVmPSJtYWlsdG86cGF1bEBub2hhdHMuY2EiPnBhdWxAbm9oYXRz LmNhPC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0 eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6 MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXJpZ2h0OjBpbiI+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj5PbiBXZWQsIDE5IEp1biAyMDE5LCBSYXNobWkgSmhhIHdyb3Rl Ojxicj4NCjxicj4NCiZndDsgSGF2ZSB5b3UgbG9va2VkIGludG8gdGhlIG9wdGlvbnMgb2Ygbm90 IHJlcXVpcmluZyBDVCBmb3IgQ0FzIHdoaWNoIGFyZSBjb25zdHJhaW5lZCB0byBhIGJyaWVmIGxp c3Qgb2YgZG9tYWlucyA/IEkgdW5kZXJzdGFuZCB0aGlzIHdhcyBjb25zaWRlcmVkIGluIHRoZSBw YXN0IGJ1dCBjb3VsZG7igJl0IGZpbmQgZGV0YWlscyB3aHkgdGhpcyB3YXMgbm90PGJyPg0KJmd0 OyBhY2NlcHRlZC48YnI+DQo8YnI+DQpXaGV0aGVyIG9yIG5vdCB0byByZXF1aXJlIENUIGlzIG5v dCBwYXJ0IG9mIHRoZSBkb2N1bWVudC4gVGhpcyBzZWVtczxicj4NCm1vcmUgbGlrZSBhIHF1ZXN0 aW9uIHRvIGJyb3dzZXIgdmVuZG9ycy4gVGhlIGRyYWZ0IG9ubHkgc3RhdGVzOjxicj4NCjxicj4N Cjxicj4NCiZuYnNwOyAmbmJzcDsgSW4gYWRkaXRpb24sIGlmIFRMUyBjbGllbnRzIHdpbGwgbm90 IGFjY2VwdCB1bmxvZ2dlZCBjZXJ0aWZpY2F0ZXMsPGJyPg0KJm5ic3A7ICZuYnNwOyB0aGVuIHNp dGUgb3duZXJzIHdpbGwgaGF2ZSBhIGdyZWF0ZXIgaW5jZW50aXZlIHRvIHN1Ym1pdCBjZXJ0aWZp Y2F0ZXM8YnI+DQombmJzcDsgJm5ic3A7IHRvIGxvZ3MsIHBvc3NpYmx5IHdpdGggdGhlIGFzc2lz dGFuY2Ugb2YgdGhlaXIgQ0EsIGluY3JlYXNpbmcgdGhlPGJyPg0KJm5ic3A7ICZuYnNwOyBvdmVy YWxsIHRyYW5zcGFyZW5jeSBvZiB0aGUgc3lzdGVtLjxicj4NCjxicj4NClRoZSAmcXVvdDtpZiZx dW90OyB0aGVyZSBpcyBpbXBvcnRhbnQuIEl0IGlzIG5vdCBhIGRlY2lzaW9uIG1hZGUgaW4gdGhp cyBkb2N1bWVudDxicj4NCm9yIHRoaXMgV29ya2luZyBHcm91cC48YnI+DQo8YnI+DQpUaGUgZHJh ZnQgb25seSBsaXN0cyB0aGUgcmVxdWlyZW1lbnRzIGFuZCBmb3JtYXRzIGZvciB3aGVuIENUIGlz IHVzZWQuPGJyPg0KPGJyPg0KJmd0OyBOYW1lZCBjb25zdHJhaW50IGJ5IGRlZmF1bHQgcHJvdmlk ZSB0aGUgYXNzdXJhbmNlIGFzIHRvIHdoYXQgZG9tYWlucyB0aGV5IHdpbGwgaXNzdWUuIENUIGJl Y29tZXMgYW4gYWRkaXRpb25hbCBuZXR3b3JrIGNhbGwgaW4gaW4gaXNzdWFuY2Ugb2YgY2VydGlm aWNhdGUgd2hpY2ggY2FuIGJlIHByZXZlbnRlZC4gJm5ic3A7PGJyPg0KPGJyPg0KTm90ICZxdW90 O2Fzc3VyYW5jZSZxdW90OywgYnV0ICZxdW90O2V4cGVjdGF0aW9uJnF1b3Q7LiBDVCBpcyB0aGVy ZSB0byBjb25maXJtIHRoaXM8YnI+DQpleHBlY3RhdGlvbi4gU3VyZWx5LCB5b3Ugd2FudCBDVCBs b2dzIHRvIHNob3cgY2FwdHVyZWQgY2VydGlmaWNhdGVzIHRoYXQ8YnI+DQp3ZXJlIHNpZ25lZCBi eSBhIENBIG91dHNpZGUgb2YgdGhhdCBDQSdzIG93biBOYW1lZCBjb25zdHJhaW50IHBvbGljeT88 YnI+DQo8YnI+DQpBZGRpdGlvbmFsbHksIGlmIHlvdSBza2lwIGFjY2VwdGluZyBjZXJ0aWZpY2F0 ZXMgd2l0aGluIGEgbmFtZWQ8YnI+DQpjb25zdHJhaW50LCB3aGF0IGRvIHlvdSBkbyB3aGVuIHNv bWUgQ0EgY2xhaW1zICZxdW90Oy5jb20mcXVvdDsgYXMgdGhlaXI8YnI+DQpuYW1lZCBjb25zdHJh aW50Pzxicj4NCjxicj4NClBhdWw8YnI+DQo8YnI+DQpfX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fXzxicj4NClRyYW5zIG1haWxpbmcgbGlzdDxicj4NCjxhIGhy ZWY9Im1haWx0bzpUcmFuc0BpZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPlRyYW5zQGlldGYub3Jn PC9hPjxicj4NCjxhIGhyZWY9Imh0dHBzOi8vbmFtMDYuc2FmZWxpbmtzLnByb3RlY3Rpb24ub3V0 bG9vay5jb20vP3VybD1odHRwcyUzQSUyRiUyRnd3dy5pZXRmLm9yZyUyRm1haWxtYW4lMkZsaXN0 aW5mbyUyRnRyYW5zJmFtcDtkYXRhPTAyJTdDMDElN0NyYXNobWlqJTQwbWljcm9zb2Z0LmNvbSU3 Q2FlNDc0ZGE5ODJiNTRiYTMzNTcyMDhkNmY1Njc3Nzk0JTdDNzJmOTg4YmY4NmYxNDFhZjkxYWIy ZDdjZDAxMWRiNDclN0MxJTdDMCU3QzYzNjk2NjIyMjA3OTYwNTc0MCZhbXA7c2RhdGE9Y1lmUDJn RmtlWThQZG0lMkJFYUhOdiUyQlhmb0FWMDAlMkJTVWxNdmFpQXc4ZWUxbyUzRCZhbXA7cmVzZXJ2 ZWQ9MCIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGlu Zm8vdHJhbnM8L2E+PG86cD48L286cD48L3A+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjwvZGl2 Pg0KPC9ib2R5Pg0KPC9odG1sPg0K --_000_MWHPR21MB084622793C06701F9A7CCD8CA7E20MWHPR21MB0846namp_-- From nobody Tue Jun 25 18:56:13 2019 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1C4211201CE for ; Tue, 25 Jun 2019 18:56:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uCyooqdPDar9 for ; Tue, 25 Jun 2019 18:56:09 -0700 (PDT) Received: from mail-lj1-x22e.google.com (mail-lj1-x22e.google.com [IPv6:2a00:1450:4864:20::22e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2EE6A120163 for ; Tue, 25 Jun 2019 18:56:09 -0700 (PDT) Received: by mail-lj1-x22e.google.com with SMTP id v24so422620ljg.13 for ; Tue, 25 Jun 2019 18:56:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc:content-transfer-encoding; bh=r1yk6fb6btxxYkLDpKcGQbyZVWokBA/dM6vgz245luA=; b=RypobZuci03O/k7DCZJroFalXJG8njPPa/8wj3V2ZY+kgODyXAlaIpci7lGl0RdyJn JqlBMWsIPhLXVYk3AL+t/TayUOkaRsJkJUqTyF91Lanb0+B6PUWEBdqqPC9Inw1gk4tE lsz4heO7WQsXh5lgNGovk/cZ9EoX00pmwHJofdrWh1pQuaoSiBgcMdowme7Ib7OC9ddL vbi5UU5hYDYvxxBEBxCXYgU2kddvA3eqCbiR02revktooAtXMq6QQrShf+gGg7QNWc1C oZ83rnDlHrZaOzvv2pKyld7DS6bOIkJQeQ2OfU/Gwc4qt6/ZFy5wvmb3vWIXQYBSZ357 u8wg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc:content-transfer-encoding; bh=r1yk6fb6btxxYkLDpKcGQbyZVWokBA/dM6vgz245luA=; b=dAlFwuDwyBFKUTc75cromeEyImGLUW4kAIC1heZ+LL3o2Q6+T/M62uyKAsWyvSwwVW As8qVLQt5Nw6FHW3Di83qYFkxZJzWjG6cwpkFzVLFhjEVJm7dSSNSy56Ny7HAHlrKL05 5LQKA/RXqs7XzP8tuavhbFnM+7s09H4wleNrFatJ+eNgC75jt4BX7pbuEHC8jjgE9bg4 7r1zByN38QNyL6H/6bjPGct3SFZgDnZPxn32Ce9ujY83r1hEBH/w+WvQIQ3vRcL/wRis yl/pqM5sJe0AbeIIut7UoMv8AgrIv2WVxaOee7AhXm6CujPNxz6WHCaMZtrCTWG9eZAW 8Eeg== X-Gm-Message-State: APjAAAU4J10hvWN6VE6trIKEdWuEP6UUPIMdEX1hq7pbX6hmE8E9zO1v baoyT31vPoG+7izduh406bAdJ+cWAAfyPf+bouhHdGOK X-Google-Smtp-Source: APXvYqy1UIS6b7IAVqQuOH6uAjfVz2khcjY7APSV30NW2ekACPYpYHdyH4R4LNuaC4Rz24voPp6QXAnTjsdgOYX3JPQ= X-Received: by 2002:a2e:8602:: with SMTP id a2mr903309lji.206.1561514167238; Tue, 25 Jun 2019 18:56:07 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Watson Ladd Date: Tue, 25 Jun 2019 18:55:55 -0700 Message-ID: To: Rashmi Jha Cc: Eran Messeri , Paul Wouters , "trans@ietf.org" Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Archived-At: Subject: Re: [Trans] draft-ietf-trans-rfc6962-bis-31 X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 26 Jun 2019 01:56:12 -0000 On Tue, Jun 25, 2019 at 6:51 PM Rashmi Jha wrote: > > Name constraints itself if orthogonal to CT but both of these achieve the= same goal. Restrict a CA to issue certs for the domains they are suppose = to. The difference is following : > > In CT, you log the cert into CT logs at the time of issuance of each cert > Name constrained is upfront where CA declares that I am going to issue ce= rts only for ford.com, jaguar.com (hypothetically) and that=E2=80=99s it. Criticial name constraints are I think still a nonstarter. > > > > Named constraints CA shouldn=E2=80=99t need to log each time when a cert = is issued. Because the verification and monitor of whether the CA has comp= lied with the goal is done offline or a different time in both the scenario= s. Are we talking about roots are are we talking about intermediates? Because the following fun can happen: 1: Honest Achmed's trusted CA isues Dubious Constrained Intermediate with name constraints for "example.com" 2: Dubious Constrained Intermediate issues cert for example.com Crucially Honest Achmed isn't actually honest and that cert is going to do terrible things. CT catches the issuance, name constraints do not. > > > > The draft doesn=E2=80=99t address what should be an alternative for folks= who don=E2=80=99t want CT > > CT adds burden for each certificate issuance. It adds ~7seconds to every = cert issuance and it adds a new failure endpoint in the path. What application has this delay be a problem and requires trust by browsers? (Which again this WG doesn't deal with). > CT has 0 alternatives. There is no mechanism for redaction. > > (The only alternative to have subdomain level redaction is to use wildcar= d which is just from the list of =E2=80=98what not to do=E2=80=99s=E2=80=99= in PKI. ) Wildcards are supported just fine. What's the application where this is a problem? > > > > CT drives an important industry-wide goal. There are other ways to achiev= e the same goal. And for organizations where each millisecond matters, the = user agent should support an alternative rather than add load and failure p= oint at their critical path of issuance. Named constraints is within the b= ooks of PKI. A CA can be held accountable like any other CA/Browser baseli= ne requirements that if they issue certs outside of their constraints then = they should take immediate action or get distrusted. It won=E2=80=99t be an= y different from a CA doing a wrong thing and got caught via CT monitors. > > > > This draft should prescribe an alternative to achieve the same goal which= is achieved by CT and the details on that alternative can be covered somew= here else. > > > > Thanks, Rashmi Jha. > > > > From: Eran Messeri > Sent: Thursday, June 20, 2019 3:10 AM > To: Paul Wouters > Cc: Rashmi Jha ; trans@ietf.org > Subject: Re: [Trans] draft-ietf-trans-rfc6962-bis-31 > > > > Paul made the point quite accurately - CT is orthogonal to name-constrain= ing a CA, and can be used to validate the CA has adhered to the constrained= names. > > > > Additionally, there's no way to signal to a user agent that such a CA wo= uld be "exempt" from CT (some user agents have Enterprise controls to allow= instances managed by the organization to not require CT for certain domain= s, though). > > > > On Thu, Jun 20, 2019 at 12:44 AM Paul Wouters wrote: > > On Wed, 19 Jun 2019, Rashmi Jha wrote: > > > Have you looked into the options of not requiring CT for CAs which are = constrained to a brief list of domains ? I understand this was considered i= n the past but couldn=E2=80=99t find details why this was not > > accepted. > > Whether or not to require CT is not part of the document. This seems > more like a question to browser vendors. The draft only states: > > > In addition, if TLS clients will not accept unlogged certificates, > then site owners will have a greater incentive to submit certificates > to logs, possibly with the assistance of their CA, increasing the > overall transparency of the system. > > The "if" there is important. It is not a decision made in this document > or this Working Group. > > The draft only lists the requirements and formats for when CT is used. > > > Named constraint by default provide the assurance as to what domains th= ey will issue. CT becomes an additional network call in in issuance of cert= ificate which can be prevented. > > Not "assurance", but "expectation". CT is there to confirm this > expectation. Surely, you want CT logs to show captured certificates that > were signed by a CA outside of that CA's own Named constraint policy? > > Additionally, if you skip accepting certificates within a named > constraint, what do you do when some CA claims ".com" as their > named constraint? > > Paul > > _______________________________________________ > Trans mailing list > Trans@ietf.org > https://www.ietf.org/mailman/listinfo/trans > > _______________________________________________ > Trans mailing list > Trans@ietf.org > https://www.ietf.org/mailman/listinfo/trans --=20 "Man is born free, but everywhere he is in chains". --Rousseau. From nobody Tue Jun 25 19:28:04 2019 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 090C412007C for ; Tue, 25 Jun 2019 19:28:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rvN8nnyOL5Sk for ; Tue, 25 Jun 2019 19:27:59 -0700 (PDT) Received: from NAM02-SN1-obe.outbound.protection.outlook.com (mail-eopbgr770118.outbound.protection.outlook.com [40.107.77.118]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6B8AC120047 for ; Tue, 25 Jun 2019 19:27:59 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=SXGovdcFKPpmCuwShO6nsxTkyYVE+s9EJ/AU2zIBXGr0DcffXfcrk1Sp0QnVt4/DkSOB7hm3YtrpuwiYluEt+eaaTbXzihzCoaF37AYZksMyYZ2lzxLCc+0MQOiL3jIXUihOLkJO9EZh9nVQzvW4a4K9XiZsq6o9V/VMFXxwMvHItSKWoTFG5gZvxHU0+BN4u7ed94RiTMsQRZHJQ8F8h1P3zxnW5ey06OyxVFI+B/MrRbOuIkEuxB5FoGFyBNUiTpzobIDYFUbyuVtTKgQSRq3u2OmtZhthfgnOeG/+ZTVZ3DKE7FB9xc8khuT6Vb7LUofE/F/+2X+2ts/wAea+vw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=cCRr0nhvj+gMcwRAYkG3aBTfuZXrlWn1n8iCNfTdjjk=; b=IHXrmwotOcaed1sVyZqjDx2ocppYsudUz+EO3Ut4M5lEbbYeXL7EyS9suxFU/lbedJGgDxYvy1Ag8Pyv+rC+NGnsLMU6xlLRXvso7oE3r4fUgJub/BkLIn+ZsO3iEAZ5wahli+mklgDHoZQa45fUwubvI9qkReNFoKnynrcsZv9SRKhUbEY/JwxnEm0YAOgLSAfJZ4w2QRHS55v8xIsQu7XTuJamuP7FpOrUFA0z9Aatiind0EDDahc9nSic2/BgRvpj6RcW0tc6WsUW4bxlW91FYmXuVYnH8yurR7IKZC6hkjB6JqkKbA+N6HyURcrush7Md0IrLH+vjYyv8s+RNg== ARC-Authentication-Results: i=1; mx.microsoft.com 1;spf=pass smtp.mailfrom=microsoft.com;dmarc=pass action=none header.from=microsoft.com;dkim=pass header.d=microsoft.com;arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=cCRr0nhvj+gMcwRAYkG3aBTfuZXrlWn1n8iCNfTdjjk=; b=LNK+ObhUXWPuRr4B3rURiuAo2DxnEO3DnR6W4ZT5Dr0pCtJ/oIrno+3Jb4vubgXgj8sEe5Glr1UUYsAoM4AVg9n8vQ36yDyg+qSli54GpbgnntZvESAqTVd7q6i+BJ2KGEeTtFlrfEHAxqWTukfDqpG+v5xNReaCuOdqSCZevo8= Received: from MWHPR21MB0846.namprd21.prod.outlook.com (2603:10b6:300:77::12) by MWHPR21MB0159.namprd21.prod.outlook.com (2603:10b6:300:78::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2052.4; Wed, 26 Jun 2019 02:27:57 +0000 Received: from MWHPR21MB0846.namprd21.prod.outlook.com ([fe80::7494:1d1:dd28:75fc]) by MWHPR21MB0846.namprd21.prod.outlook.com ([fe80::7494:1d1:dd28:75fc%3]) with mapi id 15.20.2008.017; Wed, 26 Jun 2019 02:27:57 +0000 From: Rashmi Jha To: Watson Ladd CC: Eran Messeri , Paul Wouters , "trans@ietf.org" Thread-Topic: [Trans] draft-ietf-trans-rfc6962-bis-31 Thread-Index: AdUm63nX6SEEUQM9QPCVcL3rkFMn6wADVmwAABXbiYABG3cTYAABCx+AAAB4q7A= Date: Wed, 26 Jun 2019 02:27:57 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=True; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Owner=rashmij@microsoft.com; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2019-06-26T02:27:55.1635475Z; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Name=General; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Application=Microsoft Azure Information Protection; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ActionId=0130d2c4-7efd-45af-9b70-2e2f10bbd295; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Extended_MSFT_Method=Automatic authentication-results: spf=none (sender IP is ) smtp.mailfrom=rashmij@microsoft.com; x-originating-ip: [2001:4898:80e8:0:1a3:6d3a:6ebd:fdbe] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: e4b4218c-59fe-4b13-da49-08d6f9dde6d9 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(4618075)(2017052603328)(7193020); SRVR:MWHPR21MB0159; x-ms-traffictypediagnostic: MWHPR21MB0159: x-ms-exchange-purlcount: 1 x-microsoft-antispam-prvs: x-o365-sonar-daas-pilot: True x-ms-oob-tlc-oobclassifiers: OLM:10000; x-forefront-prvs: 00808B16F3 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(39860400002)(346002)(366004)(136003)(376002)(396003)(13464003)(199004)(189003)(8936002)(6116002)(5660300002)(81166006)(25786009)(966005)(10290500003)(14444005)(66574012)(256004)(8990500004)(316002)(4326008)(64756008)(66446008)(2906002)(11346002)(68736007)(6306002)(54906003)(73956011)(66476007)(478600001)(486006)(76116006)(66556008)(446003)(22452003)(476003)(33656002)(14454004)(52536014)(8676002)(55016002)(81156014)(66946007)(1411001)(86362001)(10090500001)(99286004)(71190400001)(71200400001)(53936002)(9686003)(102836004)(52396003)(6246003)(305945005)(7736002)(6916009)(76176011)(7696005)(74316002)(53546011)(6506007)(186003)(229853002)(46003)(6436002); DIR:OUT; SFP:1102; SCL:1; SRVR:MWHPR21MB0159; H:MWHPR21MB0846.namprd21.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: 5BEvr4waQqnc/Ni1sNNB5DB2lBvvQGfV14DvcM1SlW4nOIHUiRp/OGZCZfc2WPCexv8EZ2QPWxkhvXardVkBX8vadbh5kRrqWTaw36qlffmE0Zgbc6hgQ6/GJsj89WNUEDGFQvCebwz07sAGTzWQTJmS+B+w/5ERHbCOc0QYMxPbaXeCOgQ3pn85Pd+sbwQVHfkcIQxdBKXbKynJtxRjw0UnFhHNoE8Q6Irs4kQl9g+4QOrKcHv5215uFRnWOK3ADYW1n7v5XrNqURQKxzDPYSE9w1UPznaXwM6tt3fFL6gh7fssF3vllbddyJw3W4/fbaTpAl3lI+N5lT7JzcTgJd/LMBatff0cApEvsSoG5EZmmYtGLQ9iCPTNJCQrlb3PD616dVdf6AU0N9gw1mNSDSWIS4mAOzaBfpsWw5vpPR8= Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: e4b4218c-59fe-4b13-da49-08d6f9dde6d9 X-MS-Exchange-CrossTenant-originalarrivaltime: 26 Jun 2019 02:27:57.4130 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: rashmij@microsoft.com X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR21MB0159 Archived-At: Subject: Re: [Trans] draft-ietf-trans-rfc6962-bis-31 X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 26 Jun 2019 02:28:03 -0000 VGhhbmtzIFdhdHNvbi4gIEFwcHJlY2lhdGUgdGhlIHJlc3BvbnNlLiANCg0KMS4gV2UgY2FuIHN1 cmVseSBhcmd1ZSBjcml0aWNhbCBvciBub24tY3JpdGljYWwuICBOYW1lZCBjb25zdHJhaW50cyBj YW4gYmUgY3JpdGljYWwgb3Igbm9uLWNyaXRpY2FsDQoyLiBDb25zdHJhaW50cyBhcmUgZGVmaW5l ZCBvbiBJc3N1aW5nIENBIGFzIHBlciBSRkMgNTI4MC4gIFNlZSBiZWxvdyBSRkMgZXh0cmFjdC4N CjMuIE9uZSBvZiB0aGUgQ1QgaXNzdWUgaXMgdGhhdCB0aGUgcGVyc29uYSB1c2VkIHRvIGJ1aWxk IHRoZSBzb2x1dGlvbiBpcyB0aGlua2luZyBvZiBvbmx5IGFuIGFwcGxpY2F0aW9uIGRldmVsb3Bl ciwgc2l0ZSBvcGVyYXRvci4gVGhlIGNsb3VkIHNjZW5hcmlvIGlzIGEgbWlzcyAtIFRoZSBzY2Vu YXJpbyBpcyB0aGF0IEkgd2FudCB0byBkZXBsb3kgbXkgYXBwbGljYXRpb24gaW4gfjEwMCByZWdp b25zIHdvcmxkd2lkZS4gSSB3YW50IHRvIGRlcGxveSBteSBhcHBsaWNhdGlvbiBhdCB0aGUgc2Ft ZSB0aW1lIGFjcm9zcyB0aGUgd29ybGQuDQo0LiBXaWxkY2FyZCAtIGp1c3QgIHNlYXJjaCBvciBn b29nbGUgaXQgYW5kIHRoZXJlIGFyZSBudW1lcm91cyBhcnRpY2xlcyBjb252ZXlpbmcgdGhlIGlz c3VlIHdpdGggd2lsZGNhcmRzLiANCg0KQSBxdWVzdGlvbiBmcm9tIG15IHNpZGUgOiBXaGF0IGlz IHRoZSByb2xlIG9mIHRoaXMgV0cgPyANCg0KDQo0LjIuMS4xMC4gIE5hbWUgQ29uc3RyYWludHMN Cg0KICAgVGhlIG5hbWUgY29uc3RyYWludHMgZXh0ZW5zaW9uLCB3aGljaCBNVVNUIGJlIHVzZWQg b25seSBpbiBhIENBDQogICBjZXJ0aWZpY2F0ZSwgaW5kaWNhdGVzIGEgbmFtZSBzcGFjZSB3aXRo aW4gd2hpY2ggYWxsIHN1YmplY3QgbmFtZXMgaW4NCiAgIHN1YnNlcXVlbnQgY2VydGlmaWNhdGVz IGluIGEgY2VydGlmaWNhdGlvbiBwYXRoIE1VU1QgYmUgbG9jYXRlZC4NCiAgIFJlc3RyaWN0aW9u cyBhcHBseSB0byB0aGUgc3ViamVjdCBkaXN0aW5ndWlzaGVkIG5hbWUgYW5kIGFwcGx5IHRvDQog ICBzdWJqZWN0IGFsdGVybmF0aXZlIG5hbWVzLiAgUmVzdHJpY3Rpb25zIGFwcGx5IG9ubHkgd2hl biB0aGUNCiAgIHNwZWNpZmllZCBuYW1lIGZvcm0gaXMgcHJlc2VudC4gIElmIG5vIG5hbWUgb2Yg dGhlIHR5cGUgaXMgaW4gdGhlDQogICBjZXJ0aWZpY2F0ZSwgdGhlIGNlcnRpZmljYXRlIGlzIGFj Y2VwdGFibGUuDQoNCi0tLS0tT3JpZ2luYWwgTWVzc2FnZS0tLS0tDQpGcm9tOiBXYXRzb24gTGFk ZCA8d2F0c29uYmxhZGRAZ21haWwuY29tPiANClNlbnQ6IFR1ZXNkYXksIEp1bmUgMjUsIDIwMTkg Njo1NiBQTQ0KVG86IFJhc2htaSBKaGEgPHJhc2htaWpAbWljcm9zb2Z0LmNvbT4NCkNjOiBFcmFu IE1lc3NlcmkgPGVyYW5tQGdvb2dsZS5jb20+OyBQYXVsIFdvdXRlcnMgPHBhdWxAbm9oYXRzLmNh PjsgdHJhbnNAaWV0Zi5vcmcNClN1YmplY3Q6IFJlOiBbVHJhbnNdIGRyYWZ0LWlldGYtdHJhbnMt cmZjNjk2Mi1iaXMtMzENCg0KT24gVHVlLCBKdW4gMjUsIDIwMTkgYXQgNjo1MSBQTSBSYXNobWkg SmhhIDxyYXNobWlqPTQwbWljcm9zb2Z0LmNvbUBkbWFyYy5pZXRmLm9yZz4gd3JvdGU6DQo+DQo+ IE5hbWUgY29uc3RyYWludHMgaXRzZWxmIGlmIG9ydGhvZ29uYWwgdG8gQ1QgYnV0IGJvdGggb2Yg dGhlc2UgYWNoaWV2ZSB0aGUgc2FtZSBnb2FsLiAgUmVzdHJpY3QgYSBDQSB0byBpc3N1ZSBjZXJ0 cyBmb3IgdGhlIGRvbWFpbnMgdGhleSBhcmUgc3VwcG9zZSB0by4gVGhlIGRpZmZlcmVuY2UgaXMg Zm9sbG93aW5nIDoNCj4NCj4gSW4gQ1QsIHlvdSBsb2cgdGhlIGNlcnQgaW50byBDVCBsb2dzIGF0 IHRoZSB0aW1lIG9mIGlzc3VhbmNlIG9mIGVhY2ggDQo+IGNlcnQgTmFtZSBjb25zdHJhaW5lZCBp cyB1cGZyb250IHdoZXJlIENBIGRlY2xhcmVzIHRoYXQgSSBhbSBnb2luZyB0byBpc3N1ZSBjZXJ0 cyBvbmx5IGZvciBmb3JkLmNvbSwgamFndWFyLmNvbSAoaHlwb3RoZXRpY2FsbHkpIGFuZCB0aGF0 4oCZcyBpdC4NCg0KQ3JpdGljaWFsIG5hbWUgY29uc3RyYWludHMgYXJlIEkgdGhpbmsgc3RpbGwg YSBub25zdGFydGVyLiANCg0KPg0KPg0KPg0KPiBOYW1lZCBjb25zdHJhaW50cyBDQSBzaG91bGRu 4oCZdCBuZWVkIHRvIGxvZyBlYWNoIHRpbWUgd2hlbiBhIGNlcnQgaXMgaXNzdWVkLiAgQmVjYXVz ZSB0aGUgdmVyaWZpY2F0aW9uIGFuZCBtb25pdG9yIG9mIHdoZXRoZXIgdGhlIENBIGhhcyBjb21w bGllZCB3aXRoIHRoZSBnb2FsIGlzIGRvbmUgb2ZmbGluZSBvciBhIGRpZmZlcmVudCB0aW1lIGlu IGJvdGggdGhlIHNjZW5hcmlvcy4NCg0KQXJlIHdlIHRhbGtpbmcgYWJvdXQgcm9vdHMgYXJlIGFy ZSB3ZSB0YWxraW5nIGFib3V0IGludGVybWVkaWF0ZXM/DQpCZWNhdXNlIHRoZSBmb2xsb3dpbmcg ZnVuIGNhbiBoYXBwZW46DQoNCjE6IEhvbmVzdCBBY2htZWQncyB0cnVzdGVkIENBIGlzdWVzIER1 YmlvdXMgQ29uc3RyYWluZWQgSW50ZXJtZWRpYXRlIHdpdGggbmFtZSBjb25zdHJhaW50cyBmb3Ig ImV4YW1wbGUuY29tIg0KMjogRHViaW91cyBDb25zdHJhaW5lZCBJbnRlcm1lZGlhdGUgaXNzdWVz IGNlcnQgZm9yIGV4YW1wbGUuY29tDQoNCkNydWNpYWxseSBIb25lc3QgQWNobWVkIGlzbid0IGFj dHVhbGx5IGhvbmVzdCBhbmQgdGhhdCBjZXJ0IGlzIGdvaW5nIHRvIGRvIHRlcnJpYmxlIHRoaW5n cy4gQ1QgY2F0Y2hlcyB0aGUgaXNzdWFuY2UsIG5hbWUgY29uc3RyYWludHMgZG8gbm90Lg0KDQo+ DQo+DQo+DQo+IFRoZSBkcmFmdCBkb2VzbuKAmXQgYWRkcmVzcyB3aGF0IHNob3VsZCBiZSBhbiBh bHRlcm5hdGl2ZSBmb3IgZm9sa3Mgd2hvIA0KPiBkb27igJl0IHdhbnQgQ1QNCj4NCj4gQ1QgYWRk cyBidXJkZW4gZm9yIGVhY2ggY2VydGlmaWNhdGUgaXNzdWFuY2UuIEl0IGFkZHMgfjdzZWNvbmRz IHRvIGV2ZXJ5IGNlcnQgaXNzdWFuY2UgYW5kIGl0IGFkZHMgYSBuZXcgZmFpbHVyZSBlbmRwb2lu dCBpbiB0aGUgcGF0aC4NCg0KV2hhdCBhcHBsaWNhdGlvbiBoYXMgdGhpcyBkZWxheSBiZSBhIHBy b2JsZW0gYW5kIHJlcXVpcmVzIHRydXN0IGJ5IGJyb3dzZXJzPyAoV2hpY2ggYWdhaW4gdGhpcyBX RyBkb2Vzbid0IGRlYWwgd2l0aCkuDQoNCj4gQ1QgaGFzIDAgYWx0ZXJuYXRpdmVzLiBUaGVyZSBp cyBubyBtZWNoYW5pc20gZm9yIHJlZGFjdGlvbi4NCj4NCj4gKFRoZSBvbmx5IGFsdGVybmF0aXZl IHRvIGhhdmUgc3ViZG9tYWluIGxldmVsIHJlZGFjdGlvbiBpcyB0byB1c2UgDQo+IHdpbGRjYXJk IHdoaWNoIGlzIGp1c3QgZnJvbSB0aGUgbGlzdCBvZiDigJh3aGF0IG5vdCB0byBkb+KAmXPigJkg aW4gUEtJLiApDQoNCldpbGRjYXJkcyBhcmUgc3VwcG9ydGVkIGp1c3QgZmluZS4gV2hhdCdzIHRo ZSBhcHBsaWNhdGlvbiB3aGVyZSB0aGlzIGlzIGEgcHJvYmxlbT8NCj4NCj4NCj4NCj4gQ1QgZHJp dmVzIGFuIGltcG9ydGFudCBpbmR1c3RyeS13aWRlIGdvYWwuIFRoZXJlIGFyZSBvdGhlciB3YXlz IHRvIGFjaGlldmUgdGhlIHNhbWUgZ29hbC4gQW5kIGZvciBvcmdhbml6YXRpb25zIHdoZXJlIGVh Y2ggbWlsbGlzZWNvbmQgbWF0dGVycywgdGhlIHVzZXIgYWdlbnQgc2hvdWxkIHN1cHBvcnQgYW4g YWx0ZXJuYXRpdmUgcmF0aGVyIHRoYW4gYWRkIGxvYWQgYW5kIGZhaWx1cmUgcG9pbnQgYXQgdGhl aXIgY3JpdGljYWwgcGF0aCBvZiBpc3N1YW5jZS4gIE5hbWVkIGNvbnN0cmFpbnRzIGlzIHdpdGhp biB0aGUgYm9va3Mgb2YgUEtJLiAgQSBDQSBjYW4gYmUgaGVsZCBhY2NvdW50YWJsZSBsaWtlIGFu eSBvdGhlciBDQS9Ccm93c2VyIGJhc2VsaW5lIHJlcXVpcmVtZW50cyB0aGF0IGlmIHRoZXkgaXNz dWUgY2VydHMgb3V0c2lkZSBvZiB0aGVpciBjb25zdHJhaW50cyB0aGVuIHRoZXkgc2hvdWxkIHRh a2UgaW1tZWRpYXRlIGFjdGlvbiBvciBnZXQgZGlzdHJ1c3RlZC4gSXQgd29u4oCZdCBiZSBhbnkg ZGlmZmVyZW50IGZyb20gYSBDQSBkb2luZyBhIHdyb25nIHRoaW5nIGFuZCBnb3QgY2F1Z2h0IHZp YSBDVCBtb25pdG9ycy4NCj4NCj4NCj4NCj4gVGhpcyBkcmFmdCBzaG91bGQgcHJlc2NyaWJlIGFu IGFsdGVybmF0aXZlIHRvIGFjaGlldmUgdGhlIHNhbWUgZ29hbCB3aGljaCBpcyBhY2hpZXZlZCBi eSBDVCBhbmQgdGhlIGRldGFpbHMgb24gdGhhdCBhbHRlcm5hdGl2ZSBjYW4gYmUgY292ZXJlZCBz b21ld2hlcmUgZWxzZS4NCj4NCj4NCj4NCj4gVGhhbmtzLCBSYXNobWkgSmhhLg0KPg0KPg0KPg0K PiBGcm9tOiBFcmFuIE1lc3NlcmkgPGVyYW5tPTQwZ29vZ2xlLmNvbUBkbWFyYy5pZXRmLm9yZz4N Cj4gU2VudDogVGh1cnNkYXksIEp1bmUgMjAsIDIwMTkgMzoxMCBBTQ0KPiBUbzogUGF1bCBXb3V0 ZXJzIDxwYXVsQG5vaGF0cy5jYT4NCj4gQ2M6IFJhc2htaSBKaGEgPHJhc2htaWpAbWljcm9zb2Z0 LmNvbT47IHRyYW5zQGlldGYub3JnDQo+IFN1YmplY3Q6IFJlOiBbVHJhbnNdIGRyYWZ0LWlldGYt dHJhbnMtcmZjNjk2Mi1iaXMtMzENCj4NCj4NCj4NCj4gUGF1bCBtYWRlIHRoZSBwb2ludCBxdWl0 ZSBhY2N1cmF0ZWx5IC0gQ1QgaXMgb3J0aG9nb25hbCB0byBuYW1lLWNvbnN0cmFpbmluZyBhIENB LCBhbmQgY2FuIGJlIHVzZWQgdG8gdmFsaWRhdGUgdGhlIENBIGhhcyBhZGhlcmVkIHRvIHRoZSBj b25zdHJhaW5lZCBuYW1lcy4NCj4NCj4NCj4NCj4gQWRkaXRpb25hbGx5LCB0aGVyZSdzIG5vIHdh eSB0byBzaWduYWwgdG8gYSB1c2VyIGFnZW50IHRoYXQgIHN1Y2ggYSBDQSB3b3VsZCBiZSAiZXhl bXB0IiBmcm9tIENUIChzb21lIHVzZXIgYWdlbnRzIGhhdmUgRW50ZXJwcmlzZSBjb250cm9scyB0 byBhbGxvdyBpbnN0YW5jZXMgbWFuYWdlZCBieSB0aGUgb3JnYW5pemF0aW9uIHRvIG5vdCByZXF1 aXJlIENUIGZvciBjZXJ0YWluIGRvbWFpbnMsIHRob3VnaCkuDQo+DQo+DQo+DQo+IE9uIFRodSwg SnVuIDIwLCAyMDE5IGF0IDEyOjQ0IEFNIFBhdWwgV291dGVycyA8cGF1bEBub2hhdHMuY2E+IHdy b3RlOg0KPg0KPiBPbiBXZWQsIDE5IEp1biAyMDE5LCBSYXNobWkgSmhhIHdyb3RlOg0KPg0KPiA+ IEhhdmUgeW91IGxvb2tlZCBpbnRvIHRoZSBvcHRpb25zIG9mIG5vdCByZXF1aXJpbmcgQ1QgZm9y IENBcyB3aGljaCANCj4gPiBhcmUgY29uc3RyYWluZWQgdG8gYSBicmllZiBsaXN0IG9mIGRvbWFp bnMgPyBJIHVuZGVyc3RhbmQgdGhpcyB3YXMgY29uc2lkZXJlZCBpbiB0aGUgcGFzdCBidXQgY291 bGRu4oCZdCBmaW5kIGRldGFpbHMgd2h5IHRoaXMgd2FzIG5vdCBhY2NlcHRlZC4NCj4NCj4gV2hl dGhlciBvciBub3QgdG8gcmVxdWlyZSBDVCBpcyBub3QgcGFydCBvZiB0aGUgZG9jdW1lbnQuIFRo aXMgc2VlbXMgDQo+IG1vcmUgbGlrZSBhIHF1ZXN0aW9uIHRvIGJyb3dzZXIgdmVuZG9ycy4gVGhl IGRyYWZ0IG9ubHkgc3RhdGVzOg0KPg0KPg0KPiAgICAgSW4gYWRkaXRpb24sIGlmIFRMUyBjbGll bnRzIHdpbGwgbm90IGFjY2VwdCB1bmxvZ2dlZCBjZXJ0aWZpY2F0ZXMsDQo+ICAgICB0aGVuIHNp dGUgb3duZXJzIHdpbGwgaGF2ZSBhIGdyZWF0ZXIgaW5jZW50aXZlIHRvIHN1Ym1pdCBjZXJ0aWZp Y2F0ZXMNCj4gICAgIHRvIGxvZ3MsIHBvc3NpYmx5IHdpdGggdGhlIGFzc2lzdGFuY2Ugb2YgdGhl aXIgQ0EsIGluY3JlYXNpbmcgdGhlDQo+ICAgICBvdmVyYWxsIHRyYW5zcGFyZW5jeSBvZiB0aGUg c3lzdGVtLg0KPg0KPiBUaGUgImlmIiB0aGVyZSBpcyBpbXBvcnRhbnQuIEl0IGlzIG5vdCBhIGRl Y2lzaW9uIG1hZGUgaW4gdGhpcyANCj4gZG9jdW1lbnQgb3IgdGhpcyBXb3JraW5nIEdyb3VwLg0K Pg0KPiBUaGUgZHJhZnQgb25seSBsaXN0cyB0aGUgcmVxdWlyZW1lbnRzIGFuZCBmb3JtYXRzIGZv ciB3aGVuIENUIGlzIHVzZWQuDQo+DQo+ID4gTmFtZWQgY29uc3RyYWludCBieSBkZWZhdWx0IHBy b3ZpZGUgdGhlIGFzc3VyYW5jZSBhcyB0byB3aGF0IGRvbWFpbnMgdGhleSB3aWxsIGlzc3VlLiBD VCBiZWNvbWVzIGFuIGFkZGl0aW9uYWwgbmV0d29yayBjYWxsIGluIGluIGlzc3VhbmNlIG9mIGNl cnRpZmljYXRlIHdoaWNoIGNhbiBiZSBwcmV2ZW50ZWQuDQo+DQo+IE5vdCAiYXNzdXJhbmNlIiwg YnV0ICJleHBlY3RhdGlvbiIuIENUIGlzIHRoZXJlIHRvIGNvbmZpcm0gdGhpcyANCj4gZXhwZWN0 YXRpb24uIFN1cmVseSwgeW91IHdhbnQgQ1QgbG9ncyB0byBzaG93IGNhcHR1cmVkIGNlcnRpZmlj YXRlcyANCj4gdGhhdCB3ZXJlIHNpZ25lZCBieSBhIENBIG91dHNpZGUgb2YgdGhhdCBDQSdzIG93 biBOYW1lZCBjb25zdHJhaW50IHBvbGljeT8NCj4NCj4gQWRkaXRpb25hbGx5LCBpZiB5b3Ugc2tp cCBhY2NlcHRpbmcgY2VydGlmaWNhdGVzIHdpdGhpbiBhIG5hbWVkIA0KPiBjb25zdHJhaW50LCB3 aGF0IGRvIHlvdSBkbyB3aGVuIHNvbWUgQ0EgY2xhaW1zICIuY29tIiBhcyB0aGVpciBuYW1lZCAN Cj4gY29uc3RyYWludD8NCj4NCj4gUGF1bA0KPg0KPiBfX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fXw0KPiBUcmFucyBtYWlsaW5nIGxpc3QNCj4gVHJhbnNAaWV0 Zi5vcmcNCj4gaHR0cHM6Ly9uYW0wNi5zYWZlbGlua3MucHJvdGVjdGlvbi5vdXRsb29rLmNvbS8/ dXJsPWh0dHBzJTNBJTJGJTJGd3d3Lg0KPiBpZXRmLm9yZyUyRm1haWxtYW4lMkZsaXN0aW5mbyUy RnRyYW5zJmFtcDtkYXRhPTAyJTdDMDElN0NyYXNobWlqJTQwbWljDQo+IHJvc29mdC5jb20lN0M0 OGFmNGMzMjUzNGQ0ZjU4OWI4MDA4ZDZmOWQ5Nzk2YSU3QzcyZjk4OGJmODZmMTQxYWY5MWFiMmQN Cj4gN2NkMDExZGI0NyU3QzElN0MwJTdDNjM2OTcxMTA5NzcxNzE2ODU5JmFtcDtzZGF0YT05N01E SXl6dEtpOCUyRkdDYzZJWg0KPiB1clIxJTJCamd0N0xGMEJuUTdwSG5JWk5zJTJGdyUzRCZhbXA7 cmVzZXJ2ZWQ9MA0KPg0KPiBfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fXw0KPiBUcmFucyBtYWlsaW5nIGxpc3QNCj4gVHJhbnNAaWV0Zi5vcmcNCj4gaHR0cHM6 Ly9uYW0wNi5zYWZlbGlua3MucHJvdGVjdGlvbi5vdXRsb29rLmNvbS8/dXJsPWh0dHBzJTNBJTJG JTJGd3d3Lg0KPiBpZXRmLm9yZyUyRm1haWxtYW4lMkZsaXN0aW5mbyUyRnRyYW5zJmFtcDtkYXRh PTAyJTdDMDElN0NyYXNobWlqJTQwbWljDQo+IHJvc29mdC5jb20lN0M0OGFmNGMzMjUzNGQ0ZjU4 OWI4MDA4ZDZmOWQ5Nzk2YSU3QzcyZjk4OGJmODZmMTQxYWY5MWFiMmQNCj4gN2NkMDExZGI0NyU3 QzElN0MwJTdDNjM2OTcxMTA5NzcxNzE2ODU5JmFtcDtzZGF0YT05N01ESXl6dEtpOCUyRkdDYzZJ Wg0KPiB1clIxJTJCamd0N0xGMEJuUTdwSG5JWk5zJTJGdyUzRCZhbXA7cmVzZXJ2ZWQ9MA0KDQoN Cg0KLS0NCiJNYW4gaXMgYm9ybiBmcmVlLCBidXQgZXZlcnl3aGVyZSBoZSBpcyBpbiBjaGFpbnMi Lg0KLS1Sb3Vzc2VhdS4NCg== From nobody Tue Jun 25 20:01:12 2019 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 67E0A1204C2 for ; Tue, 25 Jun 2019 20:01:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=team.telstra.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8u1anwLKomAb for ; Tue, 25 Jun 2019 20:01:05 -0700 (PDT) Received: from ipxdvo.tcif.telstra.com.au (ipxdvo.tcif.telstra.com.au [203.35.135.212]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 08E75120486 for ; Tue, 25 Jun 2019 20:01:03 -0700 (PDT) X-IronPort-AV: E=Sophos;i="5.63,418,1557151200"; d="scan'208,217";a="165381803" X-Amp-Result: SKIPPED(no attachment in message) Received: from unknown (HELO ipcavi.tcif.telstra.com.au) ([10.97.217.200]) by ipodvi.tcif.telstra.com.au with ESMTP; 26 Jun 2019 13:01:00 +1000 Received: from wsmsg3701.srv.dir.telstra.com ([172.49.40.169]) by ipcavi.tcif.telstra.com.au with ESMTP; 26 Jun 2019 13:01:00 +1000 Received: from wsapp5873.srv.dir.telstra.com (10.75.11.109) by wsmsg3701.srv.dir.telstra.com (172.49.40.169) with Microsoft SMTP Server (TLS) id 8.3.485.1; Wed, 26 Jun 2019 13:01:00 +1000 Received: from wsapp5584.srv.dir.telstra.com (10.75.131.20) by wsapp5873.srv.dir.telstra.com (10.75.11.109) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Wed, 26 Jun 2019 13:00:59 +1000 Received: from AUS01-ME1-obe.outbound.protection.outlook.com (10.172.229.126) by wsapp5584.srv.dir.telstra.com (10.75.131.20) with Microsoft SMTP Server (TLS) id 15.0.1395.4 via Frontend Transport; Wed, 26 Jun 2019 13:00:58 +1000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=team.telstra.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=CEbmCJ/AErvKw2DLVR6fEc/xjHAqL60rG3UD8AiRBWM=; b=iBtOc8Ui1yhSO0methglAeg0uGMGMGDdbqNFhz3JgJT1wSKo7Hf+jSla6+WcIAQdwKOhhhfIL7MHoWP4Ziu9JP+K1Q4jHMK717TLYoZ2mfOKm7z/2EmHAbEczH1EeMnf+pPGcX8t0M0FU+irIlPQklSLj1PsfEUNfsSSq7A3XMM= Received: from SY2PR01MB2764.ausprd01.prod.outlook.com (52.134.190.138) by SY2PR01MB2554.ausprd01.prod.outlook.com (52.134.187.147) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2008.17; Wed, 26 Jun 2019 03:00:58 +0000 Received: from SY2PR01MB2764.ausprd01.prod.outlook.com ([fe80::ad81:55b8:5070:b4a6]) by SY2PR01MB2764.ausprd01.prod.outlook.com ([fe80::ad81:55b8:5070:b4a6%7]) with mapi id 15.20.2008.014; Wed, 26 Jun 2019 03:00:58 +0000 From: "Manger, James" To: Eran Messeri CC: Rob Stradling , "trans@ietf.org" Thread-Topic: [Trans] Directory instead of .well-known for URL structure Thread-Index: AQHVJ7hG+ux4uZr19UqDBEb3y0EQUaap50UAgAAKWICAAO2VgIAAqeKwgACkWgCAAQcwwA== Date: Wed, 26 Jun 2019 03:00:57 +0000 Message-ID: References: <0d5e05fc-8f1e-54b5-536d-231153e7baf7@eff.org> <48a31dcd-71d9-42c8-9ec3-6104939a59ab@www.fastmail.com> <7161898d-a58d-1625-a041-2e93961e71a2@gmail.com> In-Reply-To: Accept-Language: en-AU, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: dlp-product: dlpe-windows dlp-version: 11.1.100.23 dlp-reaction: no-action authentication-results: spf=none (sender IP is ) smtp.mailfrom=James.H.Manger@team.telstra.com; x-originating-ip: [203.35.9.18] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 356adc22-0a65-498d-770d-08d6f9e2835f x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:SY2PR01MB2554; x-ms-traffictypediagnostic: SY2PR01MB2554: x-ms-exchange-purlcount: 4 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-forefront-prvs: 00808B16F3 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(376002)(136003)(39860400002)(366004)(346002)(396003)(13464003)(199004)(189003)(6306002)(54896002)(236005)(55016002)(53936002)(6246003)(316002)(6436002)(9686003)(52536014)(6116002)(54906003)(476003)(446003)(11346002)(3846002)(2906002)(790700001)(478600001)(71190400001)(73956011)(66946007)(76116006)(71200400001)(14444005)(256004)(486006)(66446008)(66476007)(66556008)(64756008)(72206003)(561944003)(186003)(7696005)(86362001)(74316002)(81156014)(8676002)(76176011)(81166006)(14454004)(99286004)(966005)(25786009)(53546011)(6506007)(26005)(33656002)(102836004)(68736007)(66066001)(606006)(229853002)(5660300002)(7736002)(4326008)(8936002)(142923001); DIR:OUT; SFP:1102; SCL:1; SRVR:SY2PR01MB2554; H:SY2PR01MB2764.ausprd01.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:0; MX:1; received-spf: None (protection.outlook.com: team.telstra.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: s/mKJczzrXL912tQLIopiOM60num5ZgxytYpPzf4hnSSoe7qfqxs8ToUxQgwNSDTXX/a/kC6fRL92WqbsOMtFubuR4MvNMlUHq0drpDdSPan8PW00TK6XJNbWJLk95SB65V9dTOQvb73MFK31+4X2jIFrRNWoUftzRF2HPNqnvvtSTiujL0o8nkNi/dq/O1NKhgTC3dwFHe8F5TH9eOZ0szR2Y4UEErE1dA7YQO6Sc8VxF5FPQoDEESiYyxpe9kPsIyseD2oR3CC6AvAjbBeYpC10VziFbWksdhKRempHS/tZoFuNjbhl3iWXqCmw4sqv+jbzaGPBsIbmVe8nLH7/QK0bNEGdXKraO9u8a6ROO2Hc3CtQLGtl0vWKjtuIvbZleWeu45jFZ15F+Cj0Vfx2HtqqfpQM8ZdIPHiW4sj2Uw= Content-Type: multipart/alternative; boundary="_000_SY2PR01MB27644A19071F56C0DBCC69ADE5E20SY2PR01MB2764ausp_" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: 356adc22-0a65-498d-770d-08d6f9e2835f X-MS-Exchange-CrossTenant-originalarrivaltime: 26 Jun 2019 03:00:57.9941 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 49dfc6a3-5fb7-49f4-adea-c54e725bb854 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: James.H.Manger@team.telstra.com X-MS-Exchange-Transport-CrossTenantHeadersStamped: SY2PR01MB2554 X-OriginatorOrg: team.telstra.com Archived-At: Subject: Re: [Trans] Directory instead of .well-known for URL structure X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 26 Jun 2019 03:01:11 -0000 --_000_SY2PR01MB27644A19071F56C0DBCC69ADE5E20SY2PR01MB2764ausp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SSBtZWFudCBhIHNpbmdsZSB0ZW1wbGF0ZSB0byBjb3ZlciBhbGwgcG9zc2libGUgYWN0aW9ucy4N Cg0KSXQgaXMgZWFzeSB0byBkZWZpbmUgYSBzaW5nbGUgdGVtcGxhdGUgZm9yIHRoZSBjdXJyZW50 IEFQSSBmb3IgYSBsb2cgdGhhdCB1c2VzIHRoZSBxdWVyeSBzdHJpbmcgZm9yIHRoZSBwYXJhbWV0 ZXJzICh0aGUg4oCcb2J2aW91c+KAnSBkZXNpZ24pLCBhcyB0aGUgZXhhbXBsZSBzaG93czoNCmh0 dHBzOi8vbG9nLmV4YW1wbGUubmV0L2N0L3YyL3JlZC97YWN0aW9ufXs/Zmlyc3R9ez9zZWNvbmR9 ez9oYXNofXs/c3RhcnR9ez9lbmR9PGh0dHBzOi8vbG9nLmV4YW1wbGUubmV0L2N0L3YyL3JlZC8l N0JhY3Rpb24lN0QlN0I/Zmlyc3QlN0QlN0I/c2Vjb25kJTdEJTdCP2hhc2glN0QlN0I/c3RhcnQl N0QlN0I/ZW5kJTdEPg0KDQpJdCBpcyBzdGlsbCBlYXN5IHRvIHdyaXRlIGEgc2luZ2xlIHRlbXBs YXRlIHRoYXQgdXNlcyBwYXRoIHNlZ21lbnRzIGZvciBwYXJhbWV0ZXJzLCBvciBhIG1peCBvZiBw YXRoIHNlZ21lbnRzIGFuZCB0aGUgcXVlcnkgc3RyaW5nLiBFeGFtcGxlOg0KaHR0cHM6Ly9sb2cu ZXhhbXBsZS5uZXQvY3QvdjIvcmVkL3thY3Rpb259ey9oYXNofXs/Zmlyc3R9ez9zZWNvbmR9ez9z dGFydH17P2VuZH08aHR0cHM6Ly9sb2cuZXhhbXBsZS5uZXQvY3QvdjIvcmVkLyU3YmFjdGlvbiU3 ZCU3Yi9oYXNoJTdkJTdiP2ZpcnN0JTdkJTdiP3NlY29uZCU3ZCU3Yj9zdGFydCU3ZCU3Yj9lbmQl N2Q+DQoNClNvbWUgZnVua3kgVVJMIGRlc2lnbnMgd2lsbCBub3QgYmUgcG9zc2libGUgd2l0aCBh IHNpbmdsZSB0ZW1wbGF0ZSAoZWcgc3RhcnQgJiBlbmQgaW4gYSBzaW5nbGUgcGF0aCBzZWdtZW50 IHNlcGFyYXRlZCBieSBhIGh5cGhlbiwgb25seSBmb3IgdGhvc2UgYWN0aW9ucyBuZWVkaW5nIHRo b3NlIHBhcmFtZXRlcnMpLiBPdGhlciBVUkwgZGVzaWducyB3aWxsIHdvcmsgYnV0IGJlIGEgYml0 IG1lc3N5IChlZyA/aD17aGFzaH0gdG8gdXNlIOKAnGjigJ0gbm90IOKAnGhhc2jigJ0gYXMgdGhl IHF1ZXJ5IHBhcmFtZXRlciBuYW1lIHJlc3VsdHMgaW4gYW4gZXh0cmEgZW1wdHkgcGFyYW0gb24g YWN0aW9ucyB0aGF0IGRvbuKAmXQgdGFrZSBhIGhhc2gpLg0KDQpUaGUgUkZDNjk2MiBhbmQgZHJh ZnQtaWV0Zi10cmFucy1yZmM2OTYyLWJpcyB0ZW1wbGF0ZXMgZG9u4oCZdCBjb21wbHkgd2l0aCBC Q1AxOTAgYXMgdGhleSByZXF1aXJlOg0KMS4gQW4gYXBwLXNwZWNpZmljIHBhdGggKGVnIC9jdC92 MSksIGV2ZW4gdGhvdWdoIGl0IGlzIG9ubHkgYWZ0ZXIgYSBsb2ctY2hvc2VuIHByZWZpeDsNCjIu IEFwcC1zcGVjaWZpYyDigJhhY3Rpb27igJkgdmFsdWVzIG11c3QgZ28gaW50byBhIHBhdGggc2Vn bWVudCAoZWcgL2dldC1zdGgtY29uc2lzdGVuY3kpOyBhbmQNCjMuIEFwcC1zcGVjaWZpYyBwYXJh bWV0ZXJzIG11c3QgZ28gaW50byB0aGUgcXVlcnkgc3RyaW5nIChlZyA/Zmlyc3Q9MjAmc2Vjb25k PTMwKS4NCg0KQSBzaW5nbGUgdGVtcGxhdGUgYWxsb3dzIGEgbG9nIHRvIHB1dCB0aGUgYXBwLXNw ZWNpZmljIHZhcmlhYmxlcyBhbGwgaW4gdGhlIHF1ZXJ5IHN0cmluZywgYWxsIGluIHRoZSBwYXRo LCBvciBhIG1peC4gVGhhdCBpcyBzdWZmaWNpZW50IGZvciBhbGwgcHJhY3RpY2FsIHB1cnBvc2Vz LCB3aXRoIG1pbmltYWwgb3ZlcmhlYWQuIFRoYXQgaXMgZW5vdWdoIGZsZXhpYmlsaXR5IHRvIHNh dGlzZnkgQkNQMTkwIGluIG15IG9waW5pb24sIHBhcnRpY3VsYXJseSBnaXZlbiB0aGF0IGV2ZXJ5 IGxvZyB3aWxsIHVzZSB0aGUg4oCcb2J2aW91c+KAnSBkZXNpZ24gYW55d2F5Lg0KDQpBIGRpcmVj dG9yeSB3aXRoIGEgc2VwYXJhdGUgdGVtcGxhdGUgZm9yIGV2ZXJ5IGFjdGlvbiBpcyBhIG1vcmUg cHVyZSBkZXNpZ246IGl0IGdpdmVzIGEgbG9nIHRvdGFsIGZsZXhpYmlsaXR5IGluIFVSTCBkZXNp Z247IGFuZCBpcyBlYXNpbHkgZXh0ZW5kYWJsZSBpZiB0aGUgbG9nIEFQSSBnZXRzIGZhciBtb3Jl IGNvbXBsZXggaW4gZnV0dXJlLiBBdCB0aGUgY29zdCBvZiBleHRyYSBjYWxscyAmIGNvZGUgdG8g cmVhZCwgcGFyc2UsIGFuZCBwcm9jZXNzIHRoZSBkaXJlY3RvcnkuDQoNCi0tDQpKYW1lcyBNYW5n ZXINCg0KRnJvbTogVHJhbnMgPHRyYW5zLWJvdW5jZXNAaWV0Zi5vcmc+IE9uIEJlaGFsZiBPZiBF cmFuIE1lc3NlcmkNClNlbnQ6IFR1ZXNkYXksIDI1IEp1bmUgMjAxOSA4OjEyIFBNDQpUbzogTWFu Z2VyLCBKYW1lcyA8SmFtZXMuSC5NYW5nZXJAdGVhbS50ZWxzdHJhLmNvbT4NCkNjOiBSb2IgU3Ry YWRsaW5nIDxyb2JAc2VjdGlnby5jb20+OyB0cmFuc0BpZXRmLm9yZw0KU3ViamVjdDogUmU6IFtU cmFuc10gRGlyZWN0b3J5IGluc3RlYWQgb2YgLndlbGwta25vd24gZm9yIFVSTCBzdHJ1Y3R1cmUN Cg0KQ2FuIHlvdSBjbGFyaWZ5IGlmIHlvdSBtZWFuIGEgc2luZ2xlIHRlbXBsYXRlIHRvIGNvdmVy IGFsbCBwb3NzaWJsZSBhY3Rpb25zIG9yIHNlcGFyYXRlIG9uZSBmb3IgZWFjaCBhY3Rpb24/DQoN ClRoZSBmb3JtZXIgd291bGQsIEkgdGhpbmssIGJlIHRyaWNreSB0byBkZWZpbmUgYXMgZGlmZmVy ZW50IGFjdGlvbnMgaGF2ZSBkaWZmZXJlbnQgcGFyYW1ldGVycy4NClRoZSBsYXR0ZXIgaXMgd2hh dCB3ZSBoYWQsIGFuZCBpcyBub3QgaW4gY29tcGxpYW5jZSB3aXRoIEJDUDE5MC4NCg0KRWl0aGVy IHdheSwgdGhlIGlzc3VlIGhlcmUgaXMgY29tcGxpYW5jZSB3aXRoIEJDUDE5MCwgc28gaWYgeW91 ciBwcm9wb3NhbCBpcyBpbiBjb21wbGlhbmNlIHdpdGggQkNQMTkwIGl0J3Mgd29ydGggaGlnaGxp Z2h0aW5nIHdoeSAoYXMgaXQncyBub3QgY2xlYXIgdG8gbWUgcGVyc29uYWxseSkuDQoNClRoYW5r cywNCkVyYW4NCg0KT24gVHVlLCBKdW4gMjUsIDIwMTkgYXQgMTo0NSBBTSBNYW5nZXIsIEphbWVz IDxKYW1lcy5ILk1hbmdlckB0ZWFtLnRlbHN0cmEuY29tPG1haWx0bzpKYW1lcy5ILk1hbmdlckB0 ZWFtLnRlbHN0cmEuY29tPj4gd3JvdGU6DQpXb3VsZCBpdCBiZSBzdWZmaWNpZW50IHRvIHByb3Zp ZGUgYSBVUkwgdGVtcGxhdGUgZm9yIGVhY2ggbG9nLCBpbnN0ZWFkIG9mIGEgZGlyZWN0b3J5IFVS TD8NClBvc3NpYmxlIHRleHQ6DQoNCiAgVGhlIGFkZHJlc3Mgb2YgYSBsb2cgaXMgZGVmaW5lZCBi eSBhIFVSTCB0ZW1wbGF0ZSBbUkZDNjU3MF0gdGhhdCBNVVNUIGluY2x1ZGUNCiAgdGhlIGZvbGxv d2luZyB2YXJpYWJsZXM6IGFjdGlvbiwgZmlyc3QsIHNlY29uZCwgaGFzaCwgc3RhcnQsIGVuZC4N Cg0KICAnYWN0aW9uJyBpZGVudGlmaWVzIHRoZSBjbGllbnQgbWVzc2FnZSwgc3VjaCBhcyAnc3Vi bWl0LWVudHJ5JyBvciAnZ2V0LXN0aCcuDQogICdmaXJzdCcgYW5kICdzZWNvbmQnIGFyZSB0cmVl IHNpemVzLiAnaGFzaCcgaXMgYSBiYXNlNjQtZW5jb2RlZCB2MiBsZWFmIGhhc2guDQogICdzdGFy dCcgYW5kICdlbmQnIGFyZSAwLWJhc2VkIGVudHJ5IGluZGljaWVzLg0KDQogIEV4YW1wbGU6IGh0 dHBzOi8vbG9nLmV4YW1wbGUubmV0L2N0L3YyL3JlZC97YWN0aW9ufXs/Zmlyc3R9ez9zZWNvbmR9 ez9oYXNofXs/c3RhcnR9ez9lbmR9PGh0dHBzOi8vbG9nLmV4YW1wbGUubmV0L2N0L3YyL3JlZC8l N0JhY3Rpb24lN0QlN0I/Zmlyc3QlN0QlN0I/c2Vjb25kJTdEJTdCP2hhc2glN0QlN0I/c3RhcnQl N0QlN0I/ZW5kJTdEPg0KDQotLQ0KSmFtZXMgTWFuZ2VyDQoNCi0tLS0tT3JpZ2luYWwgTWVzc2Fn ZS0tLS0tDQpGcm9tOiBUcmFucyA8dHJhbnMtYm91bmNlc0BpZXRmLm9yZzxtYWlsdG86dHJhbnMt Ym91bmNlc0BpZXRmLm9yZz4+IE9uIEJlaGFsZiBPZiBSb2IgU3RyYWRsaW5nDQpTZW50OiBUdWVz ZGF5LCAyNSBKdW5lIDIwMTkgMTI6MTYgQU0NClRvOiBNZWxpbmRhIFNob3JlIDxtZWxpbmRhLnNo b3JlQGdtYWlsLmNvbTxtYWlsdG86bWVsaW5kYS5zaG9yZUBnbWFpbC5jb20+PjsgdHJhbnNAaWV0 Zi5vcmc8bWFpbHRvOnRyYW5zQGlldGYub3JnPg0KU3ViamVjdDogUmU6IFtUcmFuc10gRGlyZWN0 b3J5IGluc3RlYWQgb2YgLndlbGwta25vd24gZm9yIFVSTCBzdHJ1Y3R1cmUNCg0KVGhpcyBzb3Vu ZHMgdW5hbmltb3VzLiAgOi0pDQoNCkknbGwgZ28gYWhlYWQgYW5kIG1ha2UgdGhpcyBjaGFuZ2Us IGFuZCBJJ2xsIGNhbmNlbCB0aGUgcmVnaXN0cmF0aW9uIHByb2Nlc3MgZm9yICJjdCIgYXMgYSAu d2VsbC1rbm93biBVUkkgc3VmZml4Lg0KDQpPbiAyNC8wNi8yMDE5IDAxOjA1LCBNZWxpbmRhIFNo b3JlIHdyb3RlOg0KPiBPbiA2LzIzLzE5IDM6MjggUE0sIE1hcnRpbiBUaG9tc29uIHdyb3RlOg0K Pj4gSSBhZ3JlZSB3aXRoIEphY29iIGhlcmUuIEFzIEkgaGF2ZSBleHByZXNzZWQgaW4gdGhlIHBh c3QsIEkgYmVsaWV2ZQ0KPj4gdGhhdCB0aGlzIGlzIGEgYmV0dGVyIGRlc2lnbiB0aGFuIHRoZSB3 ZWxsLWtub3duIHByZWZpeC4NCj4NCj4+IE9uIEZyaSwgSnVuIDIxLCAyMDE5LCBhdCAwODozMywg SmFjb2IgSG9mZm1hbi1BbmRyZXdzIHdyb3RlOg0KPj4+IFRoZSBsYXRlc3QgZHJhZnQgYWRvcHRz IGEgLy53ZWxsLWtub3duLyBwYXRoIGZvciBDVCBhcyBhIHdheSB0byBnZXQNCj4+PiAgIGFyb3Vu ZCBCQ1AgMTkwIChVUkkgRGVzaWduIGFuZCBPd25lcnNoaXA6DQo+Pj4gaHR0cHM6Ly90b29scy5p ZXRmLm9yZy9odG1sL2JjcDE5MCNzZWN0aW9uLTMpLg0KPj4+DQo+Pj4gUGVyc29uYWxseSBJIHRo aW5rIEJDUCAxOTAgbWFrZXMgaXQgbmVlZGxlc3NseSBwYWluZnVsIHRvIHNwZWNpZnkNCj4+PiBI VFRQLWJhc2VkIEFQSXMgdXNpbmcgdGVjaG5pcXVlcyB0aGF0IGFyZSB2ZXJ5IGNvbW1vbiBhbW9u Zw0KPj4+IHByYWN0aXRpb25lcnMuIEhvd2V2ZXIsIGdpdmVuIHRoYXQgaXQgaXMgc3RpbGwgY29u c2lkZXJlZCBiZXN0DQo+Pj4gcHJhY3RpY2UgZm9yIElFVEYgZG9jdW1lbnRzLCBJIHByb3Bvc2Ug dGhhdCBDVCBzaG91bGQgdXNlIGENCj4+PiBkaWZmZXJlbnQgd29ya2Fyb3VuZCwgb25lIHVzZWQg dmVyeSBzdWNjZXNzZnVsbHkgYnkgQUNNRTogRGlyZWN0b3J5DQo+Pj4gVVJMcy4NCj4NCj4gSSBo YXZlIGEgZmFpcmx5IHByb2ZvdW5kIGRpc2xpa2UgZm9yIEJDUCAxOTAsIHRvIGJlIGhvbmVzdCwg YW5kIGFtIGluDQo+IGFncmVlbWVudCB3aXRoIHRoZSBwcm9wb3NhbC4NCj4NCj4gTWVsaW5kYQ0K Pg0KDQotLQ0KUm9iIFN0cmFkbGluZw0KU2VuaW9yIFJlc2VhcmNoICYgRGV2ZWxvcG1lbnQgU2Np ZW50aXN0DQpFbWFpbDogcm9iQHNlY3RpZ28uY29tPG1haWx0bzpyb2JAc2VjdGlnby5jb20+DQpC cmFkZm9yZCwgVUsNCk9mZmljZTogKzQ0MTI3NDAyNDcwNw0KU2VjdGlnbyBMaW1pdGVkDQoNClRo aXMgbWVzc2FnZSBhbmQgYW55IGZpbGVzIGFzc29jaWF0ZWQgd2l0aCBpdCBtYXkgY29udGFpbiBs ZWdhbGx5IHByaXZpbGVnZWQsIGNvbmZpZGVudGlhbCwgb3IgcHJvcHJpZXRhcnkgaW5mb3JtYXRp b24uIElmIHlvdSBhcmUgbm90IHRoZSBpbnRlbmRlZCByZWNpcGllbnQsIHlvdSBhcmUgbm90IHBl cm1pdHRlZCB0byB1c2UsIGNvcHksIG9yIGZvcndhcmQgaXQsIGluIHdob2xlIG9yIGluIHBhcnQg d2l0aG91dCB0aGUgZXhwcmVzcyBjb25zZW50IG9mIHRoZSBzZW5kZXIuIFBsZWFzZSBub3RpZnkg dGhlIHNlbmRlciBieSByZXBseSBlbWFpbCwgZGlzcmVnYXJkIHRoZSBmb3JlZ29pbmcgbWVzc2Fn ZXMsIGFuZCBkZWxldGUgaXQgaW1tZWRpYXRlbHkuDQpfX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fXw0KVHJhbnMgbWFpbGluZyBsaXN0DQpUcmFuc0BpZXRmLm9y ZzxtYWlsdG86VHJhbnNAaWV0Zi5vcmc+DQpodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xp c3RpbmZvL3RyYW5zDQoNCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fDQpUcmFucyBtYWlsaW5nIGxpc3QNClRyYW5zQGlldGYub3JnPG1haWx0bzpUcmFuc0Bp ZXRmLm9yZz4NCmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vdHJhbnMNCg== --_000_SY2PR01MB27644A19071F56C0DBCC69ADE5E20SY2PR01MB2764ausp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBjbTsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQph OmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xv cjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1z b0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpwdXJw bGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLm1zb25vcm1hbDAsIGxpLm1zb25v cm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCgltc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGNtOw0KCW1zby1tYXJnaW4tYm90 dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBjbTsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZv bnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnNwYW4uRW1haWxTdHlsZTE4DQoJe21z by1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5z LXNlcmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0eWxl LXR5cGU6ZXhwb3J0LW9ubHk7DQoJbXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVM7fQ0KQHBhZ2Ug V29yZFNlY3Rpb24xDQoJe3NpemU6NjEyLjBwdCA3OTIuMHB0Ow0KCW1hcmdpbjo3Mi4wcHQgNzIu MHB0IDcyLjBwdCA3Mi4wcHQ7fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9u MTt9DQotLT48L3N0eWxlPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVkZWZhdWx0 cyB2OmV4dD0iZWRpdCIgc3BpZG1heD0iMTAyNiIgLz4NCjwveG1sPjwhW2VuZGlmXS0tPjwhLS1b aWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVsYXlvdXQgdjpleHQ9ImVkaXQiPg0KPG86aWRt YXAgdjpleHQ9ImVkaXQiIGRhdGE9IjEiIC8+DQo8L286c2hhcGVsYXlvdXQ+PC94bWw+PCFbZW5k aWZdLS0+DQo8L2hlYWQ+DQo8Ym9keSBsYW5nPSJFTi1BVSIgbGluaz0iYmx1ZSIgdmxpbms9InB1 cnBsZSI+DQo8ZGl2IGNsYXNzPSJXb3JkU2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9Im1zby1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTIj5JIG1lYW50IGEgc2luZ2xl IHRlbXBsYXRlIHRvIGNvdmVyIGFsbCBwb3NzaWJsZSBhY3Rpb25zLjxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJtc28tZmFyZWFzdC1sYW5n dWFnZTpFTi1VUyI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9Im1zby1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTIj5JdCBpcyBlYXN5 IHRvIGRlZmluZSBhIHNpbmdsZSB0ZW1wbGF0ZSBmb3IgdGhlIGN1cnJlbnQgQVBJIGZvciBhIGxv ZyB0aGF0IHVzZXMgdGhlIHF1ZXJ5IHN0cmluZyBmb3IgdGhlIHBhcmFtZXRlcnMgKHRoZSDigJxv YnZpb3Vz4oCdIGRlc2lnbiksIGFzIHRoZSBleGFtcGxlIHNob3dzOjxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxhIGhyZWY9Imh0dHBzOi8vbG9nLmV4YW1wbGUu bmV0L2N0L3YyL3JlZC8lN0JhY3Rpb24lN0QlN0I/Zmlyc3QlN0QlN0I/c2Vjb25kJTdEJTdCP2hh c2glN0QlN0I/c3RhcnQlN0QlN0I/ZW5kJTdEIiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly9sb2cu ZXhhbXBsZS5uZXQvY3QvdjIvcmVkL3thY3Rpb259ez9maXJzdH17P3NlY29uZH17P2hhc2h9ez9z dGFydH17P2VuZH08L2E+PHNwYW4gc3R5bGU9Im1zby1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTIj48 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i bXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJtc28tZmFyZWFzdC1sYW5ndWFnZTpF Ti1VUyI+SXQgaXMgc3RpbGwgZWFzeSB0byB3cml0ZSBhIHNpbmdsZSB0ZW1wbGF0ZSB0aGF0IHVz ZXMgcGF0aCBzZWdtZW50cyBmb3IgcGFyYW1ldGVycywgb3IgYSBtaXggb2YgcGF0aCBzZWdtZW50 cyBhbmQgdGhlIHF1ZXJ5IHN0cmluZy4gRXhhbXBsZTo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48YSBocmVmPSJodHRwczovL2xvZy5leGFtcGxlLm5ldC9jdC92 Mi9yZWQvJTdiYWN0aW9uJTdkJTdiL2hhc2glN2QlN2I/Zmlyc3QlN2QlN2I/c2Vjb25kJTdkJTdi P3N0YXJ0JTdkJTdiP2VuZCU3ZCI+aHR0cHM6Ly9sb2cuZXhhbXBsZS5uZXQvY3QvdjIvcmVkL3th Y3Rpb259ey9oYXNofXs/Zmlyc3R9ez9zZWNvbmR9ez9zdGFydH17P2VuZH08L2E+PHNwYW4gc3R5 bGU9Im1zby1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0ibXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4t VVMiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJtc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1VUyI+U29tZSBmdW5reSBVUkwgZGVz aWducyB3aWxsIG5vdCBiZSBwb3NzaWJsZSB3aXRoIGEgc2luZ2xlIHRlbXBsYXRlIChlZyBzdGFy dCAmYW1wOyBlbmQgaW4gYSBzaW5nbGUgcGF0aCBzZWdtZW50IHNlcGFyYXRlZCBieSBhIGh5cGhl biwgb25seSBmb3IgdGhvc2UgYWN0aW9ucyBuZWVkaW5nIHRob3NlIHBhcmFtZXRlcnMpLiBPdGhl ciBVUkwgZGVzaWducw0KIHdpbGwgd29yayBidXQgYmUgYSBiaXQgbWVzc3kgKGVnID9oPXtoYXNo fSB0byB1c2Ug4oCcaOKAnSBub3Qg4oCcaGFzaOKAnSBhcyB0aGUgcXVlcnkgcGFyYW1ldGVyIG5h bWUgcmVzdWx0cyBpbiBhbiBleHRyYSBlbXB0eSBwYXJhbSBvbiBhY3Rpb25zIHRoYXQgZG9u4oCZ dCB0YWtlIGEgaGFzaCkuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9Im1zby1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTIj48bzpwPiZuYnNwOzwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0ibXNvLWZh cmVhc3QtbGFuZ3VhZ2U6RU4tVVMiPlRoZSBSRkM2OTYyIGFuZCBkcmFmdC1pZXRmLXRyYW5zLXJm YzY5NjItYmlzIHRlbXBsYXRlcyBkb27igJl0IGNvbXBseSB3aXRoIEJDUDE5MCBhcyB0aGV5IHJl cXVpcmU6PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9Im1zby1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTIj4xLiBBbiBhcHAtc3BlY2lmaWMgcGF0 aCAoZWcgL2N0L3YxKSwgZXZlbiB0aG91Z2ggaXQgaXMgb25seSBhZnRlciBhIGxvZy1jaG9zZW4g cHJlZml4OzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJtc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1VUyI+Mi4gQXBwLXNwZWNpZmljIOKAmGFj dGlvbuKAmSB2YWx1ZXMgbXVzdCBnbyBpbnRvIGEgcGF0aCBzZWdtZW50IChlZyAvZ2V0LXN0aC1j b25zaXN0ZW5jeSk7IGFuZDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJtc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1VUyI+My4gQXBwLXNwZWNp ZmljIHBhcmFtZXRlcnMgbXVzdCBnbyBpbnRvIHRoZSBxdWVyeSBzdHJpbmcgKGVnID9maXJzdD0y MCZhbXA7c2Vjb25kPTMwKS4NCjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJtc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1VUyI+PG86cD4mbmJz cDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1z by1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTIj5BIHNpbmdsZSB0ZW1wbGF0ZSBhbGxvd3MgYSBsb2cg dG8gcHV0IHRoZSBhcHAtc3BlY2lmaWMgdmFyaWFibGVzIGFsbCBpbiB0aGUgcXVlcnkgc3RyaW5n LCBhbGwgaW4gdGhlIHBhdGgsIG9yIGEgbWl4LiBUaGF0IGlzIHN1ZmZpY2llbnQgZm9yIGFsbCBw cmFjdGljYWwgcHVycG9zZXMsIHdpdGggbWluaW1hbCBvdmVyaGVhZC4gVGhhdCBpcw0KIGVub3Vn aCBmbGV4aWJpbGl0eSB0byBzYXRpc2Z5IEJDUDE5MCBpbiBteSBvcGluaW9uLCBwYXJ0aWN1bGFy bHkgZ2l2ZW4gdGhhdCBldmVyeSBsb2cgd2lsbCB1c2UgdGhlIOKAnG9idmlvdXPigJ0gZGVzaWdu IGFueXdheS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0ibXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMiPjxvOnA+Jm5ic3A7PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJtc28tZmFyZWFzdC1s YW5ndWFnZTpFTi1VUyI+QSBkaXJlY3Rvcnkgd2l0aCBhIHNlcGFyYXRlIHRlbXBsYXRlIGZvciBl dmVyeSBhY3Rpb24gaXMgYSBtb3JlIHB1cmUgZGVzaWduOiBpdCBnaXZlcyBhIGxvZyB0b3RhbCBm bGV4aWJpbGl0eSBpbiBVUkwgZGVzaWduOyBhbmQgaXMgZWFzaWx5IGV4dGVuZGFibGUgaWYgdGhl IGxvZyBBUEkgZ2V0cyBmYXIgbW9yZSBjb21wbGV4IGluIGZ1dHVyZS4NCiBBdCB0aGUgY29zdCBv ZiBleHRyYSBjYWxscyAmYW1wOyBjb2RlIHRvIHJlYWQsIHBhcnNlLCBhbmQgcHJvY2VzcyB0aGUg ZGlyZWN0b3J5LjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJtc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1VUyI+PG86cD4mbmJzcDs8L286cD48 L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+LS08bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPkphbWVzIE1hbmdlcjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9Im1zby1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTIj48bzpwPiZu YnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBsYW5n PSJFTi1VUyI+RnJvbTo8L3NwYW4+PC9iPjxzcGFuIGxhbmc9IkVOLVVTIj4gVHJhbnMgJmx0O3Ry YW5zLWJvdW5jZXNAaWV0Zi5vcmcmZ3Q7DQo8Yj5PbiBCZWhhbGYgT2YgPC9iPkVyYW4gTWVzc2Vy aTxicj4NCjxiPlNlbnQ6PC9iPiBUdWVzZGF5LCAyNSBKdW5lIDIwMTkgODoxMiBQTTxicj4NCjxi PlRvOjwvYj4gTWFuZ2VyLCBKYW1lcyAmbHQ7SmFtZXMuSC5NYW5nZXJAdGVhbS50ZWxzdHJhLmNv bSZndDs8YnI+DQo8Yj5DYzo8L2I+IFJvYiBTdHJhZGxpbmcgJmx0O3JvYkBzZWN0aWdvLmNvbSZn dDs7IHRyYW5zQGlldGYub3JnPGJyPg0KPGI+U3ViamVjdDo8L2I+IFJlOiBbVHJhbnNdIERpcmVj dG9yeSBpbnN0ZWFkIG9mIC53ZWxsLWtub3duIGZvciBVUkwgc3RydWN0dXJlPG86cD48L286cD48 L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Q2FuIHlvdSBjbGFyaWZ5IGlmIHlvdSBtZWFuIGEg c2luZ2xlIHRlbXBsYXRlIHRvIGNvdmVyIGFsbCBwb3NzaWJsZSBhY3Rpb25zIG9yIHNlcGFyYXRl IG9uZSBmb3IgZWFjaCBhY3Rpb24/PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj5UaGUgZm9ybWVyIHdvdWxkLCBJIHRoaW5rLCBiZSB0cmlja3kgdG8gZGVmaW5l IGFzIGRpZmZlcmVudCBhY3Rpb25zIGhhdmUgZGlmZmVyZW50IHBhcmFtZXRlcnMuPG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5UaGUgbGF0dGVyIGlz IHdoYXQgd2UgaGFkLCBhbmQgaXMgbm90IGluIGNvbXBsaWFuY2Ugd2l0aCBCQ1AxOTAuPG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNw OzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkVpdGhlciB3 YXksIHRoZSBpc3N1ZSBoZXJlIGlzIGNvbXBsaWFuY2Ugd2l0aCBCQ1AxOTAsIHNvIGlmIHlvdXIg cHJvcG9zYWwgaXMgaW4gY29tcGxpYW5jZSB3aXRoIEJDUDE5MCBpdCdzIHdvcnRoIGhpZ2hsaWdo dGluZyB3aHkgKGFzIGl0J3Mgbm90IGNsZWFyIHRvIG1lIHBlcnNvbmFsbHkpLjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5UaGFua3MsPG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5FcmFuPG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJz cDs8L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk9uIFR1ZSwg SnVuIDI1LCAyMDE5IGF0IDE6NDUgQU0gTWFuZ2VyLCBKYW1lcyAmbHQ7PGEgaHJlZj0ibWFpbHRv OkphbWVzLkguTWFuZ2VyQHRlYW0udGVsc3RyYS5jb20iPkphbWVzLkguTWFuZ2VyQHRlYW0udGVs c3RyYS5jb208L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVv dGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFk ZGluZzowY20gMGNtIDBjbSA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tcmlnaHQ6MGNt Ij4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPldvdWxkIGl0IGJlIHN1ZmZpY2llbnQgdG8gcHJvdmlk ZSBhIFVSTCB0ZW1wbGF0ZSBmb3IgZWFjaCBsb2csIGluc3RlYWQgb2YgYSBkaXJlY3RvcnkgVVJM Pzxicj4NClBvc3NpYmxlIHRleHQ6PGJyPg0KPGJyPg0KJm5ic3A7IFRoZSBhZGRyZXNzIG9mIGEg bG9nIGlzIGRlZmluZWQgYnkgYSBVUkwgdGVtcGxhdGUgW1JGQzY1NzBdIHRoYXQgTVVTVCBpbmNs dWRlPGJyPg0KJm5ic3A7IHRoZSBmb2xsb3dpbmcgdmFyaWFibGVzOiBhY3Rpb24sIGZpcnN0LCBz ZWNvbmQsIGhhc2gsIHN0YXJ0LCBlbmQuPGJyPg0KPGJyPg0KJm5ic3A7ICdhY3Rpb24nIGlkZW50 aWZpZXMgdGhlIGNsaWVudCBtZXNzYWdlLCBzdWNoIGFzICdzdWJtaXQtZW50cnknIG9yICdnZXQt c3RoJy48YnI+DQombmJzcDsgJ2ZpcnN0JyBhbmQgJ3NlY29uZCcgYXJlIHRyZWUgc2l6ZXMuICdo YXNoJyBpcyBhIGJhc2U2NC1lbmNvZGVkIHYyIGxlYWYgaGFzaC48YnI+DQombmJzcDsgJ3N0YXJ0 JyBhbmQgJ2VuZCcgYXJlIDAtYmFzZWQgZW50cnkgaW5kaWNpZXMuPGJyPg0KPGJyPg0KJm5ic3A7 IEV4YW1wbGU6IDxhIGhyZWY9Imh0dHBzOi8vbG9nLmV4YW1wbGUubmV0L2N0L3YyL3JlZC8lN0Jh Y3Rpb24lN0QlN0I/Zmlyc3QlN0QlN0I/c2Vjb25kJTdEJTdCP2hhc2glN0QlN0I/c3RhcnQlN0Ql N0I/ZW5kJTdEIiB0YXJnZXQ9Il9ibGFuayI+DQpodHRwczovL2xvZy5leGFtcGxlLm5ldC9jdC92 Mi9yZWQve2FjdGlvbn17P2ZpcnN0fXs/c2Vjb25kfXs/aGFzaH17P3N0YXJ0fXs/ZW5kfTwvYT48 YnI+DQo8YnI+DQotLTxicj4NCkphbWVzIE1hbmdlcjxicj4NCjxicj4NCi0tLS0tT3JpZ2luYWwg TWVzc2FnZS0tLS0tPGJyPg0KRnJvbTogVHJhbnMgJmx0OzxhIGhyZWY9Im1haWx0bzp0cmFucy1i b3VuY2VzQGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+dHJhbnMtYm91bmNlc0BpZXRmLm9yZzwv YT4mZ3Q7IE9uIEJlaGFsZiBPZiBSb2IgU3RyYWRsaW5nPGJyPg0KU2VudDogVHVlc2RheSwgMjUg SnVuZSAyMDE5IDEyOjE2IEFNPGJyPg0KVG86IE1lbGluZGEgU2hvcmUgJmx0OzxhIGhyZWY9Im1h aWx0bzptZWxpbmRhLnNob3JlQGdtYWlsLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPm1lbGluZGEuc2hv cmVAZ21haWwuY29tPC9hPiZndDs7DQo8YSBocmVmPSJtYWlsdG86dHJhbnNAaWV0Zi5vcmciIHRh cmdldD0iX2JsYW5rIj50cmFuc0BpZXRmLm9yZzwvYT48YnI+DQpTdWJqZWN0OiBSZTogW1RyYW5z XSBEaXJlY3RvcnkgaW5zdGVhZCBvZiAud2VsbC1rbm93biBmb3IgVVJMIHN0cnVjdHVyZTxicj4N Cjxicj4NClRoaXMgc291bmRzIHVuYW5pbW91cy4mbmJzcDsgOi0pPGJyPg0KPGJyPg0KSSdsbCBn byBhaGVhZCBhbmQgbWFrZSB0aGlzIGNoYW5nZSwgYW5kIEknbGwgY2FuY2VsIHRoZSByZWdpc3Ry YXRpb24gcHJvY2VzcyBmb3IgJnF1b3Q7Y3QmcXVvdDsgYXMgYSAud2VsbC1rbm93biBVUkkgc3Vm Zml4Ljxicj4NCjxicj4NCk9uIDI0LzA2LzIwMTkgMDE6MDUsIE1lbGluZGEgU2hvcmUgd3JvdGU6 PGJyPg0KJmd0OyBPbiA2LzIzLzE5IDM6MjggUE0sIE1hcnRpbiBUaG9tc29uIHdyb3RlOjxicj4N CiZndDsmZ3Q7IEkgYWdyZWUgd2l0aCBKYWNvYiBoZXJlLiBBcyBJIGhhdmUgZXhwcmVzc2VkIGlu IHRoZSBwYXN0LCBJIGJlbGlldmUgPGJyPg0KJmd0OyZndDsgdGhhdCB0aGlzIGlzIGEgYmV0dGVy IGRlc2lnbiB0aGFuIHRoZSB3ZWxsLWtub3duIHByZWZpeC48YnI+DQomZ3Q7IDxicj4NCiZndDsm Z3Q7IE9uIEZyaSwgSnVuIDIxLCAyMDE5LCBhdCAwODozMywgSmFjb2IgSG9mZm1hbi1BbmRyZXdz IHdyb3RlOjxicj4NCiZndDsmZ3Q7Jmd0OyBUaGUgbGF0ZXN0IGRyYWZ0IGFkb3B0cyBhIC8ud2Vs bC1rbm93bi8gcGF0aCBmb3IgQ1QgYXMgYSB3YXkgdG8gZ2V0PGJyPg0KJmd0OyZndDsmZ3Q7Jm5i c3A7ICZuYnNwO2Fyb3VuZCBCQ1AgMTkwIChVUkkgRGVzaWduIGFuZCBPd25lcnNoaXA6PGJyPg0K Jmd0OyZndDsmZ3Q7IDxhIGhyZWY9Imh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9iY3AxOTAj c2VjdGlvbi0zIiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL2Jj cDE5MCNzZWN0aW9uLTM8L2E+KS48YnI+DQomZ3Q7Jmd0OyZndDs8YnI+DQomZ3Q7Jmd0OyZndDsg UGVyc29uYWxseSBJIHRoaW5rIEJDUCAxOTAgbWFrZXMgaXQgbmVlZGxlc3NseSBwYWluZnVsIHRv IHNwZWNpZnkgPGJyPg0KJmd0OyZndDsmZ3Q7IEhUVFAtYmFzZWQgQVBJcyB1c2luZyB0ZWNobmlx dWVzIHRoYXQgYXJlIHZlcnkgY29tbW9uIGFtb25nIDxicj4NCiZndDsmZ3Q7Jmd0OyBwcmFjdGl0 aW9uZXJzLiBIb3dldmVyLCBnaXZlbiB0aGF0IGl0IGlzIHN0aWxsIGNvbnNpZGVyZWQgYmVzdCA8 YnI+DQomZ3Q7Jmd0OyZndDsgcHJhY3RpY2UgZm9yIElFVEYgZG9jdW1lbnRzLCBJIHByb3Bvc2Ug dGhhdCBDVCBzaG91bGQgdXNlIGEgPGJyPg0KJmd0OyZndDsmZ3Q7IGRpZmZlcmVudCB3b3JrYXJv dW5kLCBvbmUgdXNlZCB2ZXJ5IHN1Y2Nlc3NmdWxseSBieSBBQ01FOiBEaXJlY3RvcnkgPGJyPg0K Jmd0OyZndDsmZ3Q7IFVSTHMuPGJyPg0KJmd0OyA8YnI+DQomZ3Q7IEkgaGF2ZSBhIGZhaXJseSBw cm9mb3VuZCBkaXNsaWtlIGZvciBCQ1AgMTkwLCB0byBiZSBob25lc3QsIGFuZCBhbSBpbiA8YnI+ DQomZ3Q7IGFncmVlbWVudCB3aXRoIHRoZSBwcm9wb3NhbC48YnI+DQomZ3Q7IDxicj4NCiZndDsg TWVsaW5kYTxicj4NCiZndDsgPGJyPg0KPGJyPg0KLS08YnI+DQpSb2IgU3RyYWRsaW5nPGJyPg0K U2VuaW9yIFJlc2VhcmNoICZhbXA7IERldmVsb3BtZW50IFNjaWVudGlzdDxicj4NCkVtYWlsOiA8 YSBocmVmPSJtYWlsdG86cm9iQHNlY3RpZ28uY29tIiB0YXJnZXQ9Il9ibGFuayI+cm9iQHNlY3Rp Z28uY29tPC9hPjxicj4NCkJyYWRmb3JkLCBVSzxicj4NCk9mZmljZTogJiM0Mzs0NDEyNzQwMjQ3 MDc8YnI+DQpTZWN0aWdvIExpbWl0ZWQ8YnI+DQo8YnI+DQpUaGlzIG1lc3NhZ2UgYW5kIGFueSBm aWxlcyBhc3NvY2lhdGVkIHdpdGggaXQgbWF5IGNvbnRhaW4gbGVnYWxseSBwcml2aWxlZ2VkLCBj b25maWRlbnRpYWwsIG9yIHByb3ByaWV0YXJ5IGluZm9ybWF0aW9uLiBJZiB5b3UgYXJlIG5vdCB0 aGUgaW50ZW5kZWQgcmVjaXBpZW50LCB5b3UgYXJlIG5vdCBwZXJtaXR0ZWQgdG8gdXNlLCBjb3B5 LCBvciBmb3J3YXJkIGl0LCBpbiB3aG9sZSBvciBpbiBwYXJ0IHdpdGhvdXQgdGhlIGV4cHJlc3Mg Y29uc2VudA0KIG9mIHRoZSBzZW5kZXIuIFBsZWFzZSBub3RpZnkgdGhlIHNlbmRlciBieSByZXBs eSBlbWFpbCwgZGlzcmVnYXJkIHRoZSBmb3JlZ29pbmcgbWVzc2FnZXMsIGFuZCBkZWxldGUgaXQg aW1tZWRpYXRlbHkuPGJyPg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX188YnI+DQpUcmFucyBtYWlsaW5nIGxpc3Q8YnI+DQo8YSBocmVmPSJtYWlsdG86VHJh bnNAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj5UcmFuc0BpZXRmLm9yZzwvYT48YnI+DQo8YSBo cmVmPSJodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3RyYW5zIiB0YXJnZXQ9 Il9ibGFuayI+aHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby90cmFuczwvYT48 YnI+DQo8YnI+DQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f Xzxicj4NClRyYW5zIG1haWxpbmcgbGlzdDxicj4NCjxhIGhyZWY9Im1haWx0bzpUcmFuc0BpZXRm Lm9yZyIgdGFyZ2V0PSJfYmxhbmsiPlRyYW5zQGlldGYub3JnPC9hPjxicj4NCjxhIGhyZWY9Imh0 dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vdHJhbnMiIHRhcmdldD0iX2JsYW5r Ij5odHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3RyYW5zPC9hPjxvOnA+PC9v OnA+PC9wPg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4N Cg== --_000_SY2PR01MB27644A19071F56C0DBCC69ADE5E20SY2PR01MB2764ausp_-- From nobody Tue Jun 25 21:31:23 2019 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CB27012060A for ; Tue, 25 Jun 2019 21:31:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nohats.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wbO1SijbKCKi for ; Tue, 25 Jun 2019 21:31:20 -0700 (PDT) Received: from mx.nohats.ca (mx.nohats.ca [193.110.157.68]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B5195120608 for ; Tue, 25 Jun 2019 21:31:20 -0700 (PDT) Received: from localhost (localhost [IPv6:::1]) by mx.nohats.ca (Postfix) with ESMTP id 45YVTf1tBkz3J8; Wed, 26 Jun 2019 06:31:18 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nohats.ca; s=default; t=1561523478; bh=7NJAMsLCy9L2gbmL752FNG8MiucOfMT5G0Hb/TR7zvI=; h=Date:From:To:cc:Subject:In-Reply-To:References; b=fVtftRAk8ZFbYnK9tVaWrlSujrnti5Aw9ejOSml3DR1uw8QW4+iHV/WZwk8W06Cv4 HtJJL+VZZu2DkO/r9LteST1cEEPccVAH4WYIu2TR7JS5jTclp4r8nd+UkXqM+1unJu 60I3wTb39dYS6+XG5kc7y5Z9guJVnVy6Zip2zqp4= X-Virus-Scanned: amavisd-new at mx.nohats.ca Received: from mx.nohats.ca ([IPv6:::1]) by localhost (mx.nohats.ca [IPv6:::1]) (amavisd-new, port 10024) with ESMTP id y56eIEiFuTmT; Wed, 26 Jun 2019 06:31:16 +0200 (CEST) Received: from bofh.nohats.ca (bofh.nohats.ca [76.10.157.69]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx.nohats.ca (Postfix) with ESMTPS; Wed, 26 Jun 2019 06:31:15 +0200 (CEST) Received: by bofh.nohats.ca (Postfix, from userid 1000) id 09C9E3547F5; Wed, 26 Jun 2019 00:31:14 -0400 (EDT) DKIM-Filter: OpenDKIM Filter v2.11.0 bofh.nohats.ca 09C9E3547F5 Received: from localhost (localhost [127.0.0.1]) by bofh.nohats.ca (Postfix) with ESMTP id EEE2540D35BF; Wed, 26 Jun 2019 00:31:14 -0400 (EDT) Date: Wed, 26 Jun 2019 00:31:14 -0400 (EDT) From: Paul Wouters To: Rashmi Jha cc: "trans@ietf.org" In-Reply-To: Message-ID: References: User-Agent: Alpine 2.21 (LRH 202 2017-01-01) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII; format=flowed Archived-At: Subject: Re: [Trans] draft-ietf-trans-rfc6962-bis-31 X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 26 Jun 2019 04:31:23 -0000 On Wed, 26 Jun 2019, Rashmi Jha wrote: > 1. We can surely argue critical or non-critical. Named constraints can be critical or non-critical What is a non-critical named constraint? If the client does not understand the named constraint, and it is non-critical, wouldn't it mean the client may continue and ignore the thing, not knowing it is a name constraint? That seems odd to me, as it would defeat the purpose of it. > 3. One of the CT issue is that the persona used to build the solution is thinking of only an application developer, site operator. The cloud scenario is a miss - The scenario is that I want to deploy my application in ~100 regions worldwide. I want to deploy my application at the same time across the world. How is CT preventing this for you? > 4. Wildcard - just search or google it and there are numerous articles conveying the issue with wildcards. > > A question from my side : What is the role of this WG ? https://datatracker.ietf.org/wg/trans/about/ Paul From nobody Tue Jun 25 21:42:35 2019 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5378512017F for ; Tue, 25 Jun 2019 21:42:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nohats.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NXh5gTKKg3-a for ; Tue, 25 Jun 2019 21:42:31 -0700 (PDT) Received: from mx.nohats.ca (mx.nohats.ca [IPv6:2a03:6000:1004:1::68]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EEC8F1200DF for ; Tue, 25 Jun 2019 21:42:30 -0700 (PDT) Received: from localhost (localhost [IPv6:::1]) by mx.nohats.ca (Postfix) with ESMTP id 45YVkY0zZlz3J8; Wed, 26 Jun 2019 06:42:29 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nohats.ca; s=default; t=1561524149; bh=27zzEH7JsBUXD4FmTf5OeDCekQYX0suyTHeKowbE9Iw=; h=Date:From:To:cc:Subject:In-Reply-To:References; b=R2OV0KPJ/tvVOABmGmr5KFfb/WfDoOZHU72lsAffGERpqH0ctAGLkXqTEC4++3Ui4 mSLtjMjLZnQDHVDUjb7p3Ep4FXQBiISQVzF+YaQ9J94a197B+JizGyEmSiTcFU4cPo TsiEpf7LqYo0PmZ3n/lE2NZRvUd56i3U1mTpBlnY= X-Virus-Scanned: amavisd-new at mx.nohats.ca Received: from mx.nohats.ca ([IPv6:::1]) by localhost (mx.nohats.ca [IPv6:::1]) (amavisd-new, port 10024) with ESMTP id OuHZYJ0Z6Z60; Wed, 26 Jun 2019 06:42:27 +0200 (CEST) Received: from bofh.nohats.ca (bofh.nohats.ca [76.10.157.69]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx.nohats.ca (Postfix) with ESMTPS; Wed, 26 Jun 2019 06:42:26 +0200 (CEST) Received: by bofh.nohats.ca (Postfix, from userid 1000) id 513103547F5; Wed, 26 Jun 2019 00:42:25 -0400 (EDT) DKIM-Filter: OpenDKIM Filter v2.11.0 bofh.nohats.ca 513103547F5 Received: from localhost (localhost [127.0.0.1]) by bofh.nohats.ca (Postfix) with ESMTP id 465CA40D35BF; Wed, 26 Jun 2019 00:42:25 -0400 (EDT) Date: Wed, 26 Jun 2019 00:42:25 -0400 (EDT) From: Paul Wouters To: Rashmi Jha cc: Eran Messeri , "trans@ietf.org" In-Reply-To: Message-ID: References: User-Agent: Alpine 2.21 (LRH 202 2017-01-01) MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8BIT Archived-At: Subject: Re: [Trans] draft-ietf-trans-rfc6962-bis-31 X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 26 Jun 2019 04:42:34 -0000 On Wed, 26 Jun 2019, Rashmi Jha wrote: [speaking as an individual only] > Name constraints itself if orthogonal to CT but both of these achieve the same goal.  Restrict a CA to issue certs for the domains they are suppose to. The difference is following : > > * In CT, you log the cert into CT logs at the time of issuance of each cert   > * Name constrained is upfront where CA declares that I am going to issue certs only for ford.com, jaguar.com (hypothetically) and that’s it.   Sure, but having a CA per TLD or even per group of SLD's would explode the number of CAs required. And if these all need to comply to the CAB/Forum rules, that's a lot of auditing. > Named constraints CA shouldn’t need to log each time when a cert is issued.  Because the verification and monitor of whether the CA has complied with the goal is done offline or a different time in both the > scenarios. How would you detect a mis-issuance within the named constraint without CT? > The draft doesn’t address what should be an alternative for folks who don’t want CT It could mention DNSSEC and DANE (TLSA), but I don't think it is neccessary in this document. > * CT adds burden for each certificate issuance. It adds ~7seconds to every cert issuance and it adds a new failure endpoint in the path. I don't think it adds latency if you regularly fetch the latest tree head? > * CT has 0 alternatives. DNSSEC with DANE/TLSA is an alternative. > There is no mechanism for redaction. [chair hat on ] Redaction has been brought up a number of times, but has not seen enough work done for it to be added in this document. Later on, it was suggested redaction should be done as a separate document. [/chair hat] > CT drives an important industry-wide goal. There are other ways to achieve the same goal. And for organizations where each millisecond matters, the user agent should support an alternative rather than add > load and failure point at their critical path of issuance.  Named constraints is within the books of PKI.  A CA can be held accountable like any other CA/Browser baseline requirements that if they issue > certs outside of their constraints then they should take immediate action or get distrusted. It won’t be any different from a CA doing a wrong thing and got caught via CT monitors. The draft only talks about the protocol. Whether or not to allow or require it, in the presence or absence of CT, is up the the browser vendors. So my question to you would be, if name constraints are to be considered for this draft, would it require a document change? > This draft should prescribe an alternative to achieve the same goal which is achieved by CT and the details on that alternative can be covered somewhere else. I'm confused that you say there are no alternatives and that alternatives should be mentioned in the document? Paul > From: Eran Messeri > Sent: Thursday, June 20, 2019 3:10 AM > To: Paul Wouters > Cc: Rashmi Jha ; trans@ietf.org > Subject: Re: [Trans] draft-ietf-trans-rfc6962-bis-31 > >   > > Paul made the point quite accurately - CT is orthogonal to name-constraining a CA, and can be used to validate the CA has adhered to the constrained names. > >   > > Additionally, there's no way to signal to a user agent that  such a CA would be "exempt" from CT (some user agents have Enterprise controls to allow instances managed by the organization to not require CT > for certain domains, though). > >   > > On Thu, Jun 20, 2019 at 12:44 AM Paul Wouters wrote: > > On Wed, 19 Jun 2019, Rashmi Jha wrote: > > > Have you looked into the options of not requiring CT for CAs which are constrained to a brief list of domains ? I understand this was considered in the past but couldn’t find details why this > was not > > accepted. > > Whether or not to require CT is not part of the document. This seems > more like a question to browser vendors. The draft only states: > > >     In addition, if TLS clients will not accept unlogged certificates, >     then site owners will have a greater incentive to submit certificates >     to logs, possibly with the assistance of their CA, increasing the >     overall transparency of the system. > > The "if" there is important. It is not a decision made in this document > or this Working Group. > > The draft only lists the requirements and formats for when CT is used. > > > Named constraint by default provide the assurance as to what domains they will issue. CT becomes an additional network call in in issuance of certificate which can be prevented.   > > Not "assurance", but "expectation". CT is there to confirm this > expectation. Surely, you want CT logs to show captured certificates that > were signed by a CA outside of that CA's own Named constraint policy? > > Additionally, if you skip accepting certificates within a named > constraint, what do you do when some CA claims ".com" as their > named constraint? > > Paul > > _______________________________________________ > Trans mailing list > Trans@ietf.org > https://www.ietf.org/mailman/listinfo/trans > > > From nobody Wed Jun 26 03:05:51 2019 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CF203120278; Wed, 26 Jun 2019 03:05:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=comodoca.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sXhLAm0_mekq; Wed, 26 Jun 2019 03:05:46 -0700 (PDT) Received: from NAM03-DM3-obe.outbound.protection.outlook.com (mail-eopbgr800059.outbound.protection.outlook.com [40.107.80.59]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id ECE451201F8; Wed, 26 Jun 2019 03:05:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=comodoca.onmicrosoft.com; s=selector1-comodoca-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=pJOQklaa/TKczVFOqZCHJK5usMUMpAh8ksM4PQjNHEE=; b=lXGEy0TQgHEbxp5KRc71Smw3uTY8PmkJX8zUbSjn96Vh5dEQSsJvZs6Da2HstWWqDy6ULqAbzQwl5Vn4XtgJ84YkDwguA1xPtACFqailR77huw7DZGD1RX8yxxjYtd+ok301PSuJu0YT3awGn6QxaJbjwBiBZLiV+lVMkSnx5R4= Received: from DM5PR17MB1211.namprd17.prod.outlook.com (10.173.132.148) by DM5PR17MB1434.namprd17.prod.outlook.com (10.175.223.135) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2008.16; Wed, 26 Jun 2019 10:05:44 +0000 Received: from DM5PR17MB1211.namprd17.prod.outlook.com ([fe80::b556:345c:94cf:7258]) by DM5PR17MB1211.namprd17.prod.outlook.com ([fe80::b556:345c:94cf:7258%6]) with mapi id 15.20.2008.018; Wed, 26 Jun 2019 10:05:44 +0000 From: Rob Stradling To: Adam Roach CC: Eric Rescorla , Trans , Alexey Melnikov , "draft-ietf-trans-rfc6962-bis@ietf.org" , "trans-chairs@ietf.org" , The IESG , Paul Wouters Thread-Topic: Adam Roach's Discuss on draft-ietf-trans-rfc6962-bis-31: (with DISCUSS and COMMENT) Thread-Index: AQHU2Wch53aa+rMxm0GatE3OyKQHD6YJjl4AgABCe4CAADnJAICXuSIAgAt+JACAARiwgA== Date: Wed, 26 Jun 2019 10:05:43 +0000 Message-ID: <4b56efb6-5d26-59d2-c6d0-7fe76c77675e@sectigo.com> References: <155245900142.5466.15600148045977298644.idtracker@ietfa.amsl.com> <943a0e44-faab-28f0-f677-b41faa870558@nostrum.com> In-Reply-To: <943a0e44-faab-28f0-f677-b41faa870558@nostrum.com> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-clientproxiedby: LO2P265CA0299.GBRP265.PROD.OUTLOOK.COM (2603:10a6:600:a5::23) To DM5PR17MB1211.namprd17.prod.outlook.com (2603:10b6:3:8b::20) authentication-results: spf=none (sender IP is ) smtp.mailfrom=rob@sectigo.com; x-ms-exchange-messagesentrepresentingtype: 1 x-originating-ip: [2a0e:ac00:25d:300:f68e:38ff:fe7a:a226] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 3182162c-864b-4ce2-d635-08d6fa1dd9cf x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:DM5PR17MB1434; x-ms-traffictypediagnostic: DM5PR17MB1434: x-ms-exchange-purlcount: 4 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-forefront-prvs: 00808B16F3 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(376002)(396003)(39850400004)(346002)(366004)(136003)(199004)(189003)(51444003)(54164003)(14454004)(446003)(53546011)(5660300002)(71200400001)(102836004)(66574012)(71190400001)(46003)(52116002)(305945005)(73956011)(11346002)(2616005)(7736002)(6246003)(66946007)(86362001)(76176011)(486006)(31696002)(99286004)(64756008)(66446008)(66556008)(66476007)(81166006)(6916009)(81156014)(966005)(31686004)(561944003)(478600001)(6306002)(54906003)(476003)(8676002)(6436002)(316002)(68736007)(8936002)(6512007)(6486002)(36756003)(4326008)(6506007)(186003)(229853002)(25786009)(53936002)(6116002)(386003)(2906002)(256004)(14444005); DIR:OUT; SFP:1101; SCL:1; SRVR:DM5PR17MB1434; H:DM5PR17MB1211.namprd17.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: sectigo.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: N59dIOS+FfXN2jiYgPr4/YObb4IS2A2npFuOkAs6vDJMMUN74cTFte1NpmcTpL85IBrww+rkh1ZtwJFT2GI3+WJ5UhpVtp83pvincVEsdNKuYEI0I87t5njWPJanaWp7hwwWlmyDdIUyyk3A1KPYSHp5WvvK2zqZYPpZdfLW3yoz9V+RI1ge/2vRalgMh/MKAtPAAQzmF4ESP+QxLZ1T74PqdkyGAU7h18qmRw1n59QoRTGrB2c16zG/xoaHCMWxrFrX7RFi8JCMawiDAZvEhVrWNZ6xgQUA+X3y9SQIY6JDRzt4ZFZ7e187yLRa/W1NkhrHuxrCfa+XBJCEZvQ9MNACq9BxzL2hZYQGRExcd/ONWgsQqfA9EV9VWEAox6Sl9sPdsk0+wBjlJ5KjEx0DMVRbJxCxm5m5F1CLqr2xEGw= Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: sectigo.com X-MS-Exchange-CrossTenant-Network-Message-Id: 3182162c-864b-4ce2-d635-08d6fa1dd9cf X-MS-Exchange-CrossTenant-originalarrivaltime: 26 Jun 2019 10:05:43.8709 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 0e9c4894-6caa-465d-9660-4b6968b49fb7 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: robs@comodoca.net X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM5PR17MB1434 Archived-At: Subject: Re: [Trans] Adam Roach's Discuss on draft-ietf-trans-rfc6962-bis-31: (with DISCUSS and COMMENT) X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 26 Jun 2019 10:05:50 -0000 T24gMjUvMDYvMjAxOSAxODoyMSwgQWRhbSBSb2FjaCB3cm90ZToNCj4gT24gNi8xOC8xOSA0OjUw IEFNLCBSb2IgU3RyYWRsaW5nIHdyb3RlOg0KPj4gQWRhbSwgdGhhbmtzIGZvciB5b3VyIHJldmll dywgYW5kIEkgYXBvbG9naXplIHRoYXQgbm9uZSBvZiB0aGlzDQo+PiBkb2N1bWVudCdzIGF1dGhv cnMgaGF2ZSBiZWVuIGF2YWlsYWJsZSB0byByZXNwb25kIHVudGlsIG5vdy4NCj4+DQo+PiBJIGhh dmUgZmlsZWQNCj4+IGh0dHBzOi8vZ2l0aHViLmNvbS9nb29nbGUvY2VydGlmaWNhdGUtdHJhbnNw YXJlbmN5LXJmY3MvcHVsbC8zMTAsIHdoaWNoDQo+PiBJIGJlbGlldmUgYWRkcmVzc2VzIGFsbCBv ZiB5b3VyIGNvbmNlcm5zLg0KPiANCj4gDQo+IFRoYW5rcyEgVGhpcyBsb29rcyBnb29kLCBhbHRo b3VnaCB5b3UnbGwgYWxzbyBuZWVkIHRvIHJlZ2lzdGVyICJjdCIgaW4gDQo+IHRoZSBXZWxsLUtu b3duIFVSSXMgcmVnaXN0cnkgWzFdLiBTZWUgWzJdIGZvciB0aGUgcmVnaXN0cmF0aW9uIHRlbXBs YXRlLCANCj4gYW5kIFszXSBmb3IgYW4gZXhhbXBsZSBvZiBpdCBpbiB1c2UuDQoNCkFkYW0sIHRo YW5rcyBmb3IgcmV2aWV3aW5nIHRoaXMgUFIuICBJIHN1Ym1pdHRlZCBhIHJlcXVlc3QgdG8gcmVn aXN0ZXIgDQoiY3QiIGluIHRoZSBXZWxsLUtub3duIFVSSXMgcmVnaXN0cnkgbGFzdCB3ZWVrLCBi dXQgSSBzZW50IGEgZm9sbG93LXVwIA0KbWVzc2FnZSBhIGNvdXBsZSBvZiBkYXlzIGFnbyB0byBj YW5jZWwgdGhlIHJlcXVlc3QuICBUaGlzIGlzIGJlY2F1c2UgYSANCm51bWJlciBvZiBmb2xrcyBv biB0aGUgVFJBTlMgV0cgbWFpbGluZyBsaXN0IG9iamVjdGVkIHRvIHRoaXMgY2hhbmdlLCANCmFu ZCBiZWNhdXNlIG5vYm9keSBoYXMgc2FpZCB0aGF0IHVzaW5nIC53ZWxsLWtub3duIGlzIHRoZWly IHByZWZlcnJlZCANCmFwcHJvYWNoIHRvIHNhdGlzZnlpbmcgQkNQIDE5MC4NCg0KQW5kIHNvIHRo ZSBUUkFOUyBsaXN0IGlzIGN1cnJlbnRseSBkaXNjdXNzaW5nIGFsdGVybmF0aXZlIGFwcHJvYWNo ZXMgdG8gDQpzYXRpc2Z5aW5nIEJDUCAxOTAuICBPbmNlIGl0J3MgY2xlYXIgd2hpY2ggYXBwcm9h Y2ggZm9sa3MgYXJlIGxlYXN0IA0KdW5oYXBweSB3aXRoLCB3ZSdsbCB1cGRhdGUgNjk2Mi1iaXMg YWNjb3JkaW5nbHkuDQoNCj4gSSdsbCBjbGVhciBteSBkaXNjdXNzIGFzIHNvb24gYXMgYSBuZXcg dmVyc2lvbiBpcyBhdmFpbGFibGUgaW4gdGhlIA0KPiBpbnRlcm5ldC1kcmFmdHMgcmVwb3NpdG9y eS4NCj4gDQo+IC9hDQo+IA0KPiANCj4gX19fXw0KPiBbMV0gaHR0cHM6Ly93d3cuaWFuYS5vcmcv YXNzaWdubWVudHMvd2VsbC1rbm93bi11cmlzL3dlbGwta25vd24tdXJpcy54aHRtbA0KPiBbMl0g aHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL3JmYzU3ODUjc2VjdGlvbi01LjEuMQ0KPiBbM10g aHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL3JmYzcwMzMjc2VjdGlvbi0xMC4xDQo+IA0KPiAN Cj4+DQo+PiBPbiAxMy8wMy8yMDE5IDIwOjUyLCBBbGV4ZXkgTWVsbmlrb3Ygd3JvdGU6DQo+Pj4g T24gV2VkLCBNYXIgMTMsIDIwMTksIGF0IDU6MjYgUE0sIEFkYW0gUm9hY2ggd3JvdGU6DQo+Pj4+ IE9uIDMvMTMvMTkgODoyOCBBTSwgRXJpYyBSZXNjb3JsYSB3cm90ZToNCj4+Pj4+IE9uIFR1ZSwg TWFyIDEyLCAyMDE5IGF0IDExOjM2IFBNIEFkYW0gUm9hY2ggdmlhIERhdGF0cmFja2VyDQo+Pj4+ PiA8bm9yZXBseUBpZXRmLi5vcmcgPG1haWx0bzpub3JlcGx5QGlldGYub3JnPj4gd3JvdGU6DQo+ Pj4+Pg0KPj4+Pj4NCj4+Pj4+ICAgICAgDQo+Pj4+PiAtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQo+Pj4+PiDCoMKg wqDCoCBESVNDVVNTOg0KPj4+Pj4gICAgICANCj4+Pj4+IC0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCj4+Pj4+DQo+ Pj4+PiDCoMKgwqDCoCBUaGFua3MgdG8gZXZlcnlvbmUgd2hvIHdvcmtlZCBvbiB1cGRhdGluZyB0 aGlzIHByb3RvY29sIHRvDQo+Pj4+PiDCoMKgwqDCoCByZWZsZWN0IGV4cGVyaWVuY2UNCj4+Pj4+ IMKgwqDCoMKgIGdhdGhlcmVkIGZyb20gdGhlIGluaXRpYWwgQ1QgcHJvdG9jb2wuIEkgaGF2ZSBv bmUgYmxvY2tpbmcNCj4+Pj4+IMKgwqDCoMKgIGNvbW1lbnQsIGFuZCBhIHNtYWxsDQo+Pj4+PiDC oMKgwqDCoCBudW1iZXIgb2YgZWRpdG9yaWFsIHN1Z2dlc3Rpb25zLg0KPj4+Pj4NCj4+Pj4+ICAg ICAgDQo+Pj4+PiAtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0gDQo+Pj4+Pg0KPj4+Pj4NCj4+Pj4+IMKgwqDC oMKgIMKnNToNCj4+Pj4+DQo+Pj4+PiDCoMKgwqDCoCA+wqAgQ2xpZW50cyBhcmUgY29uZmlndXJl ZCB3aXRoIGEgYmFzZSBVUkwgZm9yIGEgbG9nIGFuZCBjb25zdHJ1Y3QNCj4+Pj4+IMKgwqDCoMKg IFVSTHMNCj4+Pj4+IMKgwqDCoMKgID7CoCBmb3IgcmVxdWVzdHMgYnkgYXBwZW5kaW5nIHN1ZmZp eGVzIHRvIHRoaXMgYmFzZSBVUkwuIFRoaXMNCj4+Pj4+IMKgwqDCoMKgIHN0cnVjdHVyZQ0KPj4+ Pj4gwqDCoMKgwqAgPsKgIHBsYWNlcyBzb21lIGRlZ3JlZSBvZiByZXN0cmljdGlvbiBvbiBob3cg bG9nIG9wZXJhdG9ycyBjYW4gDQo+Pj4+PiBkZXBsb3kNCj4+Pj4+IMKgwqDCoMKgID7CoCB0aGVz ZSBzZXJ2aWNlcywgYXMgbm90ZWQgaW4gW1JGQzczMjBdLsKgIEhvd2V2ZXIsIG9wZXJhdGlvbmFs DQo+Pj4+PiDCoMKgwqDCoCA+wqAgZXhwZXJpZW5jZSB3aXRoIHZlcnNpb24gMSBvZiB0aGlzIHBy b3RvY29sIGhhcyBub3QgDQo+Pj4+PiBpbmRpY2F0ZWQgdGhhdA0KPj4+Pj4gwqDCoMKgwqAgPsKg IHRoZXNlIHJlc3RyaWN0aW9ucyBhcmUgYSBwcm9ibGVtIGluIHByYWN0aWNlLg0KPj4+Pj4NCj4+ Pj4+IMKgwqDCoMKgIFRoZSBzeW50aGVzaXMgb2YgVVJMcyBieSBhIHByb3RvY29sIGluIHRoaXMg ZmFzaGlvbiBpcyBwcm9oaWJpdGVkDQo+Pj4+PiDCoMKgwqDCoCBieSBCQ1AgMTkwOg0KPj4+Pj4N Cj4+Pj4+IMKgwqDCoMKgIMKgIMKgU2NoZW1lIGRlZmluaXRpb25zIGRlZmluZSB0aGUgcHJlc2Vu Y2UsIGZvcm1hdCwgYW5kIA0KPj4+Pj4gc2VtYW50aWNzIG9mIGENCj4+Pj4+IMKgwqDCoMKgIMKg IMKgcGF0aCBjb21wb25lbnQgaW4gVVJJczsgYWxsIG90aGVyIHNwZWNpZmljYXRpb25zIE1VU1Qg Tk9UDQo+Pj4+PiDCoMKgwqDCoCBjb25zdHJhaW4sDQo+Pj4+PiDCoMKgwqDCoCDCoCDCoG9yIGRl ZmluZSB0aGUgc3RydWN0dXJlIG9yIHRoZSBzZW1hbnRpY3MgZm9yIGFueSBwYXRoIA0KPj4+Pj4g Y29tcG9uZW50Lg0KPj4+Pj4NCj4+Pj4+IMKgwqDCoMKgIFVubGVzcyB0aGUgaW50ZW50aW9uIG9m IHRoaXMgZG9jdW1lbnQgaXMgdG8gdXBkYXRlIEJDUCAxOTAgdG8NCj4+Pj4+IMKgwqDCoMKgIGNo YW5nZSB0aGlzDQo+Pj4+PiDCoMKgwqDCoCBub3JtYXRpdmUgcmVxdWlyZW1lbnQsIHdlIGNhbid0 IHB1Ymxpc2ggaXQgaW4gaXRzIGN1cnJlbnQgZm9ybS4NCj4+Pj4+IMKgwqDCoMKgIE5vdGUgdGhh dCBkb2luZw0KPj4+Pj4gwqDCoMKgwqAgc28gd291bGQgcmVxdWlyZSBhIGNoYW5nZSBvZiB2ZW51 ZSwgYXMgdXBkYXRlcyB0byBCQ1AgMTkwIHdvdWxkDQo+Pj4+PiDCoMKgwqDCoCBub3QgYmUgY292 ZXJlZA0KPj4+Pj4gwqDCoMKgwqAgYnkgdGhlIGN1cnJlbnQgVFJBTlMgY2hhcnRlci4NCj4+Pj4+ DQo+Pj4+PiDCoMKgwqDCoCBQbGVhc2Ugc2VlIEJDUCAxOTAgc2VjdGlvbiAzIGZvciBhbHRlcm5h dGUgYXBwcm9hY2hlcy4gQWxsIHRocmVlDQo+Pj4+PiDCoMKgwqDCoCBhcHByb2FjaGVzDQo+Pj4+ PiDCoMKgwqDCoCBjb3VsZCBiZSBtYWRlIHRvIHdvcmsgZm9yIENULCBhbmQgSSB3b3VsZCBiZSBo YXBweSB0byBleHBsYWluIGhvdw0KPj4+Pj4gwqDCoMKgwqAgdG8gZG8gc28gaWYNCj4+Pj4+IMKg wqDCoMKgIGNsYXJpZmljYXRpb24gaXMgZGVzaXJlZC4NCj4+Pj4+DQo+Pj4+Pg0KPj4+Pj4gV2hp bGUgSSBhZ3JlZSB0aGF0IHRoaXMgaXMgZm9yYmlkZGVuIGJ5IEJDUCAxOTAsIHRoaXMgc3RydWN0 dXJlIGlzDQo+Pj4+PiBpbmhlcml0ZWQgZnJvbQ0KPj4+Pj4gUkZDIDY5NjIsIHdoaWNoIHByZWRh dGVkIDczMjAsIHNvIG1ha2luZyB0aGF0IGNoYW5nZSBzZWVtcyBsaWtlIGl0J3MNCj4+Pj4+IGdv aW5nDQo+Pj4+PiB0byBiZSBmYWlybHkgZGlzcnVwdGl2ZS4gVGhpcyBzZWVtcyBsaWtlIGl0IGlz IGZhbGxpbmcgaW50byBvdXINCj4+Pj4+IGRpc2N1c3Npb24gdGhlIG90aGVyDQo+Pj4+PiBkYXkg YWJvdXQgd2hhdCBtdXN0IGJlIGNoYW5nZWQgaW4gLWJpcyBkb2N1bWVudHMuDQo+Pj4+IEkgdGhp bmsgdGhlIHRpbWluZyBvZiB0aGlzIGRvY3VtZW50IGlzIGZvcnR1aXRvdXMsIGluIHRoYXQgaXQg Y2FuIGhlbHANCj4+Pj4gaW5mb3JtIHRoYXQgY29udmVyc2F0aW9uLiBJbiBwYXJ0aWN1bGFyLCB0 aGlzIHNpdHVhdGlvbiBoZWxwcyBtZQ0KPj4+PiBiZXR0ZXIgdW5kZXJzdGFuZCB3aHkgYm90aCB5 b3UgYW5kIEJlbmphbWluIHJhaXNlZCBvYmplY3Rpb25zIHRvIHRoZQ0KPj4+PiBoaWdoLWxldmVs IHByb3Bvc2FsIHRoYXQgdW5jaGFuZ2VkIHBhcnRzIG9mIC1iaXMgZG9jdW1lbnRzIHNob3VsZG4n dA0KPj4+PiBiZSBzdWJqZWN0IHRvIERJU0NVU1MgcG9zaXRpb25zLiBUaGUgdGFrZS1hd2F5IHRo YXQgSSBwbGFuIHRvIGJyaW5nIHRvDQo+Pj4+IHRoYXQgY29udmVyc2F0aW9uIGlzIHRoYXQgc3Vj aCBhIGRlY2lzaW9uIG5lZWRzIHRvIGJlIGluZm9ybWVkIGJ5IChhKQ0KPj4+PiBzY29wZSBvZiBj aGFuZ2VzIGJldHdlZW4gYSBkb2N1bWVudCBhbmQgaXRzIC1iaXMsIGFuZCAoYikgc2NvcGUgb2YN Cj4+Pj4gY2hhbmdlcyByZXF1aXJlZCB0byBzYXRpc2Z5IGEgcG90ZW50aWFsIERJU0NVU1MgcG9z aXRpb24uDQo+Pj4+DQo+Pj4+IEluIGNhc2VzIGxpa2UgdGhpcyBvbmUsIHdoZXJlIGEgbm90LWV2 ZW4tcmVtb3RlbHktYmFja3dhcmRzLWNvbXBhdGlibGUNCj4+Pj4gc3VpdGUgb2YgcHJvdG9jb2wg Y2hhbmdlcyBpcyBiZWluZyBtYWRlIHRvIGEgcHJvdG9jb2wgaW4gYSBkb2N1bWVudA0KPj4+PiB1 cGRhdGUgd2hvc2UgZGlmZiBbMV0gaXMgYmFzaWNhbGx5IHRoZSBlbnRpcmUgZG9jdW1lbnQsIEkg ZG9uJ3QgdGhpbmsNCj4+Pj4gdGhlIHByaW5jaXBsZSBvZiBpZ25vcmluZyBleGlzdGluZyBmbGF3 cyBpbiBhIHByZXZpb3VzIGRvY3VtZW50IHJlYWxseQ0KPj4+PiBhcHBsaWVzLiBJIGdldCB0aGF0 IGJvdGggb2YgdGhvc2UgcHJlZGljYXRlcyBhcmUgc29tZXdoYXQgc3ViamVjdGl2ZQ0KPj4+PiBl dmFsdWF0aW9ucywgYW5kIHRoYXQgZHJhd2luZyBhIGxpbmUgaW4gYSBwcm9jZXNzIGRvY3VtZW50 IG1pZ2h0IGJlDQo+Pj4+IGRpZmZpY3VsdDsgYnV0IEkgdGhpbmsgdGhhdCBhbnkgc3RhbmRhcmQs IGhvd2V2ZXIgc3ViamVjdGl2ZSwgdGhhdCB5b3UNCj4+Pj4gd291bGQgYmUgd2lsbGluZyB0byBz aWduIG9uIHRvIHdvdWxkIHBsYWNlIHRoaXMgZG9jdW1lbnQgb3V0c2lkZSB0aGUNCj4+Pj4gY2F0 ZWdvcnkgb2YgImJpcyB2ZXJzaW9ucyB0aGF0IGFyZSBtYWtpbmcgc21hbGwsIGluY3JlbWVudGFs IGNoYW5nZXMNCj4+Pj4gdG8gZXhpc3RpbmcgZG9jdW1lbnRzLiINCj4+Pj4NCj4+Pj4gSWYgdGhl IHJlbWVkeSBmb3IgdGhlIGZsYXcgd2VyZSBhIG1ham9yIG92ZXJoYXVsIHJhdGhlciB0aGFuIGEN Cj4+Pj4gcmVsYXRpdmVseSBtaW5vciB0d2VhaywgaXQgd291bGQgYWdhaW4gc2hpZnQgdGhlIGV2 YWx1YXRpb24gYSBiaXQ7DQo+Pj4+IGhvd2V2ZXIsIHRoZSBuYcOvdmUgYmFuZC1haWQgc29sdXRp b24gb2YgbW92aW5nIENUIGVuZHBvaW50cyB0byBsaXZlDQo+Pj4+IHVuZGVyICIvLndlbGwta25v d24vY3QiIGlzIGEgdHJpdmlhbCBjaGFuZ2UsIGJvdGggZm9yIHRoaXMgZG9jdW1lbnQNCj4+Pj4g YW5kIGZvciBpbXBsZW1lbnRhdGlvbnMgKGluIGZhY3QsIGZvciBpbXBsZW1lbnRhdGlvbnMsIGl0 IGNhbg0KPj4+PiBnZW5lcmFsbHkgYmUgYWNjb21wbGlzaGVkIHdpdGggYSBjb25maWd1cmF0aW9u IHR3ZWFrIHJhdGhlciB0aGFuDQo+Pj4+IHdyaXRpbmcgbmV3IGNvZGUpLiBUbyBiZSBjbGVhciwg dGhpcyBpcyBhIHRleHRib29rIGV4YW1wbGUgb2YgdGhlIGtpbmQNCj4+Pj4gb2Ygc2l0dWF0aW9u IFVSSSB0ZW1wbGF0ZXMgd2VyZSBkZXNpZ25lZCBmb3IsIGJ1dCB0aGF0IHdvdWxkIHJlcXVpcmUN Cj4+Pj4gc3Vic3RhbnRpYWxseSBtb3JlIHdvcmsgdGhhbiBzaW1wbHkgbW92aW5nIGl0IGludG8g dGhlIC53ZWxsLWtub3duDQo+Pj4+IHRyZWUuIEVpdGhlciBhcHByb2FjaCB3b3VsZCBhZGRyZXNz IHRoZSBVUkkgb3duZXJzaGlwIGlzc3VlLg0KPj4+Pg0KPj4+IEkgYW0gaW4gZnVsbCBhZ3JlZW1l bnQgd2l0aCB0aGlzLg0KPj4+DQo+IA0KDQotLSANClJvYiBTdHJhZGxpbmcNClNlbmlvciBSZXNl YXJjaCAmIERldmVsb3BtZW50IFNjaWVudGlzdA0KRW1haWw6IHJvYkBzZWN0aWdvLmNvbQ0KQnJh ZGZvcmQsIFVLDQpPZmZpY2U6ICs0NDEyNzQwMjQ3MDcNClNlY3RpZ28gTGltaXRlZA0KDQpUaGlz IG1lc3NhZ2UgYW5kIGFueSBmaWxlcyBhc3NvY2lhdGVkIHdpdGggaXQgbWF5IGNvbnRhaW4gbGVn YWxseSANCnByaXZpbGVnZWQsIGNvbmZpZGVudGlhbCwgb3IgcHJvcHJpZXRhcnkgaW5mb3JtYXRp b24uIElmIHlvdSBhcmUgbm90IHRoZSANCmludGVuZGVkIHJlY2lwaWVudCwgeW91IGFyZSBub3Qg cGVybWl0dGVkIHRvIHVzZSwgY29weSwgb3IgZm9yd2FyZCBpdCwgDQppbiB3aG9sZSBvciBpbiBw YXJ0IHdpdGhvdXQgdGhlIGV4cHJlc3MgY29uc2VudCBvZiB0aGUgc2VuZGVyLiBQbGVhc2UgDQpu b3RpZnkgdGhlIHNlbmRlciBieSByZXBseSBlbWFpbCwgZGlzcmVnYXJkIHRoZSBmb3JlZ29pbmcg bWVzc2FnZXMsIGFuZCANCmRlbGV0ZSBpdCBpbW1lZGlhdGVseS4NCg== From nobody Wed Jun 26 03:19:45 2019 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D976E120279 for ; Wed, 26 Jun 2019 03:19:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=comodoca.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id H5Hz5x5Nu_vp for ; Wed, 26 Jun 2019 03:19:41 -0700 (PDT) Received: from NAM04-SN1-obe.outbound.protection.outlook.com (mail-eopbgr700049.outbound.protection.outlook.com [40.107.70.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 505251200EB for ; Wed, 26 Jun 2019 03:19:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=comodoca.onmicrosoft.com; s=selector1-comodoca-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=fddYF4a6r+jWUUedyjOkFydHs7EU54/zuvBm2wb8ubo=; b=XGg+zRR/VVkZJBGlY5yKpW4DcQOb9N3XkHW0DURiDlBl1FeRsXgv8FV/KRehvmQdoIIATcyDNVPsjq8ilz4E38SlYOBD78Loqut/1R9bC5GvrQa4cK8CaTtPb+Zoy2HH/ehdVqVURYMHe0atDPlPXdm26HghZPy6zmG7YyokmDA= Received: from DM5PR17MB1211.namprd17.prod.outlook.com (10.173.132.148) by DM5PR17MB1386.namprd17.prod.outlook.com (10.173.133.137) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2008.16; Wed, 26 Jun 2019 10:19:38 +0000 Received: from DM5PR17MB1211.namprd17.prod.outlook.com ([fe80::b556:345c:94cf:7258]) by DM5PR17MB1211.namprd17.prod.outlook.com ([fe80::b556:345c:94cf:7258%6]) with mapi id 15.20.2008.018; Wed, 26 Jun 2019 10:19:38 +0000 From: Rob Stradling To: "Manger, James" , Eran Messeri CC: "trans@ietf.org" Thread-Topic: [Trans] Directory instead of .well-known for URL structure Thread-Index: AQHVJ7g3xV77fgqjj0ive+Voenofmqap50UAgAAKWICAAO2MAIAAr0IAgACfBACAARnhgIAAeouA Date: Wed, 26 Jun 2019 10:19:38 +0000 Message-ID: <986ded03-f707-f8ed-5f75-3c62313ad8d7@sectigo.com> References: <0d5e05fc-8f1e-54b5-536d-231153e7baf7@eff.org> <48a31dcd-71d9-42c8-9ec3-6104939a59ab@www.fastmail.com> <7161898d-a58d-1625-a041-2e93961e71a2@gmail.com> In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-clientproxiedby: LNXP265CA0009.GBRP265.PROD.OUTLOOK.COM (2603:10a6:600:5e::21) To DM5PR17MB1211.namprd17.prod.outlook.com (2603:10b6:3:8b::20) authentication-results: spf=none (sender IP is ) smtp.mailfrom=rob@sectigo.com; x-ms-exchange-messagesentrepresentingtype: 1 x-originating-ip: [2a0e:ac00:25d:300:f68e:38ff:fe7a:a226] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 6dd88dc2-96c3-4e80-2867-08d6fa1fcb3e x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:DM5PR17MB1386; x-ms-traffictypediagnostic: DM5PR17MB1386: x-ms-exchange-purlcount: 5 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-forefront-prvs: 00808B16F3 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(346002)(39850400004)(136003)(396003)(366004)(376002)(189003)(199004)(13464003)(6246003)(76176011)(52116002)(561944003)(305945005)(6306002)(53546011)(6506007)(7736002)(2616005)(386003)(71200400001)(99286004)(4326008)(46003)(71190400001)(486006)(6436002)(8936002)(229853002)(36756003)(25786009)(186003)(14454004)(6486002)(31686004)(53936002)(31696002)(966005)(6116002)(102836004)(476003)(446003)(316002)(256004)(478600001)(73956011)(66946007)(11346002)(110136005)(66476007)(5660300002)(66556008)(64756008)(66446008)(86362001)(14444005)(2906002)(81166006)(81156014)(68736007)(8676002)(6512007)(142923001); DIR:OUT; SFP:1101; SCL:1; SRVR:DM5PR17MB1386; H:DM5PR17MB1211.namprd17.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: sectigo.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: ZQ1hw/X/E4rF89ZtmhcwnMScDBOZObKYAgq0pdgxwEwnmynO5VPAvoxYmt+ZUYeO4OxvCZTwDeAb9Tqyd7ZKpZYpOKyM63NLbqXAY6RYFGn/6xyEGngMXLHrViVNbLoqnPaai+IAYw1NyqCjpmr+QtBnM3sXyf0SS9EYUG32/aCl1vJ5umzXx3ee1355ydHzYcywYJN2NY+zEQzqInE6qx16cy22cIZnxIvUEzG53h3MRifm9WVyjeIDuKRraEWzOqf6EsWyZ0CIKR31fntYzL0Pog6m3JP0ar3mHVcTSl2tuDTMhMYLURyasnVWaPYxIkDEYrys1QOEWOXSfr5/OaDOEAxekHfFAtR+BGeha6ALMwfMU6oTzjADNLnX9qNneAQrfVbGeKcDt3Ggld++0iHEiCosQMM0UtKHuNZRC7k= Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: sectigo.com X-MS-Exchange-CrossTenant-Network-Message-Id: 6dd88dc2-96c3-4e80-2867-08d6fa1fcb3e X-MS-Exchange-CrossTenant-originalarrivaltime: 26 Jun 2019 10:19:38.2854 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 0e9c4894-6caa-465d-9660-4b6968b49fb7 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: robs@comodoca.net X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM5PR17MB1386 Archived-At: Subject: Re: [Trans] Directory instead of .well-known for URL structure X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 26 Jun 2019 10:19:44 -0000 T24gMjYvMDYvMjAxOSAwNDowMCwgTWFuZ2VyLCBKYW1lcyB3cm90ZToNCjxzbmlwPg0KPiBBIGRp cmVjdG9yeSB3aXRoIGEgc2VwYXJhdGUgdGVtcGxhdGUgZm9yIGV2ZXJ5IGFjdGlvbiBpcyBhIG1v cmUgcHVyZSANCj4gZGVzaWduOiBpdCBnaXZlcyBhIGxvZyB0b3RhbCBmbGV4aWJpbGl0eSBpbiBV UkwgZGVzaWduOyBhbmQgaXMgZWFzaWx5IA0KPiBleHRlbmRhYmxlIGlmIHRoZSBsb2cgQVBJIGdl dHMgZmFyIG1vcmUgY29tcGxleCBpbiBmdXR1cmUuDQoNCkkgcHJlZmVyIHRoZSBkaXJlY3Rvcnkg YXBwcm9hY2ggKHZzIFVSSSB0ZW1wbGF0ZXMpLCBmb3IgdGhlc2UgdmVyeSByZWFzb25zLg0KDQpT b21lIGxvZ3MgbWlnaHQgd2FudCB0byBzdXBwb3J0IGFkZGl0aW9uYWwgQVBJIGVuZHBvaW50cyAo ZS5nLiwgdGhlcmUgDQp3YXMgYSAiZ2V0LXN0aHMiIHByb3Bvc2FsIGEgd2hpbGUgYWdvIC0gDQpo dHRwczovL2dpdGh1Yi5jb20vZ29vZ2xlL2NlcnRpZmljYXRlLXRyYW5zcGFyZW5jeS1yZmNzL3B1 bGwvMjAwKS4NCg0KQW5kIHNvbWUgImxvZ3MiIG1pZ2h0IHdhbnQgdG8gc3VwcG9ydCBhIHN1YnNl dCBvZiB0aGUgc3RhbmRhcmQgbG9nIEFQSSANCihlLmcuLCBpbWFnaW5lIGEgbG9nIHN1Ym1pc3Np b24gcHJveHkgdGhhdCBvbmx5IG9mZmVycyBhICJzdWJtaXQtZW50cnkiIA0KZW5kcG9pbnQgdGhh dCwgd2hlbiBjYWxsZWQsIGZvcndhcmRzIHRoZSBzdWJtaXQtZW50cnkgcmVxdWVzdCB0byANCm11 bHRpcGxlIHJlYWwgbG9ncykuDQoNCj4gQXQgdGhlIGNvc3Qgb2YgZXh0cmEgY2FsbHMgJiBjb2Rl IHRvIHJlYWQsIHBhcnNlLCBhbmQgcHJvY2VzcyB0aGUgZGlyZWN0b3J5Lg0KDQpBZ3JlZWQsIGJ1 dCBJIHRoaW5rIGl0J3Mgd29ydGggdGhpcyBjb3N0Lg0KDQo+IC0tDQo+IA0KPiBKYW1lcyBNYW5n ZXINCj4gDQo+ICpGcm9tOipUcmFucyA8dHJhbnMtYm91bmNlc0BpZXRmLm9yZz4gKk9uIEJlaGFs ZiBPZiAqRXJhbiBNZXNzZXJpDQo+ICpTZW50OiogVHVlc2RheSwgMjUgSnVuZSAyMDE5IDg6MTIg UE0NCj4gKlRvOiogTWFuZ2VyLCBKYW1lcyA8SmFtZXMuSC5NYW5nZXJAdGVhbS50ZWxzdHJhLmNv bT4NCj4gKkNjOiogUm9iIFN0cmFkbGluZyA8cm9iQHNlY3RpZ28uY29tPjsgdHJhbnNAaWV0Zi5v cmcNCj4gKlN1YmplY3Q6KiBSZTogW1RyYW5zXSBEaXJlY3RvcnkgaW5zdGVhZCBvZiAud2VsbC1r bm93biBmb3IgVVJMIHN0cnVjdHVyZQ0KPiANCj4gQ2FuIHlvdSBjbGFyaWZ5IGlmIHlvdSBtZWFu IGEgc2luZ2xlIHRlbXBsYXRlIHRvIGNvdmVyIGFsbCBwb3NzaWJsZSANCj4gYWN0aW9ucyBvciBz ZXBhcmF0ZSBvbmUgZm9yIGVhY2ggYWN0aW9uPw0KPiANCj4gVGhlIGZvcm1lciB3b3VsZCwgSSB0 aGluaywgYmUgdHJpY2t5IHRvIGRlZmluZSBhcyBkaWZmZXJlbnQgYWN0aW9ucyBoYXZlIA0KPiBk aWZmZXJlbnQgcGFyYW1ldGVycy4NCj4gDQo+IFRoZSBsYXR0ZXIgaXMgd2hhdCB3ZSBoYWQsIGFu ZCBpcyBub3QgaW4gY29tcGxpYW5jZSB3aXRoIEJDUDE5MC4NCj4gDQo+IEVpdGhlciB3YXksIHRo ZSBpc3N1ZSBoZXJlIGlzIGNvbXBsaWFuY2Ugd2l0aCBCQ1AxOTAsIHNvIGlmIHlvdXIgDQo+IHBy b3Bvc2FsIGlzIGluIGNvbXBsaWFuY2Ugd2l0aCBCQ1AxOTAgaXQncyB3b3J0aCBoaWdobGlnaHRp bmcgd2h5IChhcyANCj4gaXQncyBub3QgY2xlYXIgdG8gbWUgcGVyc29uYWxseSkuDQo+IA0KPiBU aGFua3MsDQo+IA0KPiBFcmFuDQo+IA0KPiBPbiBUdWUsIEp1biAyNSwgMjAxOSBhdCAxOjQ1IEFN IE1hbmdlciwgSmFtZXMgDQo+IDxKYW1lcy5ILk1hbmdlckB0ZWFtLnRlbHN0cmEuY29tIA0KPiA8 bWFpbHRvOkphbWVzLkguTWFuZ2VyQHRlYW0udGVsc3RyYS5jb20+PiB3cm90ZToNCj4gDQo+ICAg ICBXb3VsZCBpdCBiZSBzdWZmaWNpZW50IHRvIHByb3ZpZGUgYSBVUkwgdGVtcGxhdGUgZm9yIGVh Y2ggbG9nLA0KPiAgICAgaW5zdGVhZCBvZiBhIGRpcmVjdG9yeSBVUkw/DQo+ICAgICBQb3NzaWJs ZSB0ZXh0Og0KPiANCj4gICAgICDCoCBUaGUgYWRkcmVzcyBvZiBhIGxvZyBpcyBkZWZpbmVkIGJ5 IGEgVVJMIHRlbXBsYXRlIFtSRkM2NTcwXSB0aGF0DQo+ICAgICBNVVNUIGluY2x1ZGUNCj4gICAg ICDCoCB0aGUgZm9sbG93aW5nIHZhcmlhYmxlczogYWN0aW9uLCBmaXJzdCwgc2Vjb25kLCBoYXNo LCBzdGFydCwgZW5kLg0KPiANCj4gICAgICDCoCAnYWN0aW9uJyBpZGVudGlmaWVzIHRoZSBjbGll bnQgbWVzc2FnZSwgc3VjaCBhcyAnc3VibWl0LWVudHJ5JyBvcg0KPiAgICAgJ2dldC1zdGgnLg0K PiAgICAgIMKgICdmaXJzdCcgYW5kICdzZWNvbmQnIGFyZSB0cmVlIHNpemVzLiAnaGFzaCcgaXMg YSBiYXNlNjQtZW5jb2RlZA0KPiAgICAgdjIgbGVhZiBoYXNoLg0KPiAgICAgIMKgICdzdGFydCcg YW5kICdlbmQnIGFyZSAwLWJhc2VkIGVudHJ5IGluZGljaWVzLg0KPiANCj4gICAgICDCoCBFeGFt cGxlOg0KPiAgICAgaHR0cHM6Ly9sb2cuZXhhbXBsZS5uZXQvY3QvdjIvcmVkL3thY3Rpb259ez9m aXJzdH17P3NlY29uZH17P2hhc2h9ez9zdGFydH17P2VuZH0NCj4gICAgIDxodHRwczovL2xvZy5l eGFtcGxlLm5ldC9jdC92Mi9yZWQvJTdCYWN0aW9uJTdEJTdCP2ZpcnN0JTdEJTdCP3NlY29uZCU3 RCU3Qj9oYXNoJTdEJTdCP3N0YXJ0JTdEJTdCP2VuZCU3RD4NCj4gDQo+ICAgICAtLQ0KPiAgICAg SmFtZXMgTWFuZ2VyDQo+IA0KPiAgICAgLS0tLS1PcmlnaW5hbCBNZXNzYWdlLS0tLS0NCj4gICAg IEZyb206IFRyYW5zIDx0cmFucy1ib3VuY2VzQGlldGYub3JnIDxtYWlsdG86dHJhbnMtYm91bmNl c0BpZXRmLm9yZz4+DQo+ICAgICBPbiBCZWhhbGYgT2YgUm9iIFN0cmFkbGluZw0KPiAgICAgU2Vu dDogVHVlc2RheSwgMjUgSnVuZSAyMDE5IDEyOjE2IEFNDQo+ICAgICBUbzogTWVsaW5kYSBTaG9y ZSA8bWVsaW5kYS5zaG9yZUBnbWFpbC5jb20NCj4gICAgIDxtYWlsdG86bWVsaW5kYS5zaG9yZUBn bWFpbC5jb20+PjsgdHJhbnNAaWV0Zi5vcmcNCj4gICAgIDxtYWlsdG86dHJhbnNAaWV0Zi5vcmc+ DQo+ICAgICBTdWJqZWN0OiBSZTogW1RyYW5zXSBEaXJlY3RvcnkgaW5zdGVhZCBvZiAud2VsbC1r bm93biBmb3IgVVJMIHN0cnVjdHVyZQ0KPiANCj4gICAgIFRoaXMgc291bmRzIHVuYW5pbW91cy7C oCA6LSkNCj4gDQo+ICAgICBJJ2xsIGdvIGFoZWFkIGFuZCBtYWtlIHRoaXMgY2hhbmdlLCBhbmQg SSdsbCBjYW5jZWwgdGhlIHJlZ2lzdHJhdGlvbg0KPiAgICAgcHJvY2VzcyBmb3IgImN0IiBhcyBh IC53ZWxsLWtub3duIFVSSSBzdWZmaXguDQo+IA0KPiAgICAgT24gMjQvMDYvMjAxOSAwMTowNSwg TWVsaW5kYSBTaG9yZSB3cm90ZToNCj4gICAgICA+IE9uIDYvMjMvMTkgMzoyOCBQTSwgTWFydGlu IFRob21zb24gd3JvdGU6DQo+ICAgICAgPj4gSSBhZ3JlZSB3aXRoIEphY29iIGhlcmUuIEFzIEkg aGF2ZSBleHByZXNzZWQgaW4gdGhlIHBhc3QsIEkgYmVsaWV2ZQ0KPiAgICAgID4+IHRoYXQgdGhp cyBpcyBhIGJldHRlciBkZXNpZ24gdGhhbiB0aGUgd2VsbC1rbm93biBwcmVmaXguDQo+ICAgICAg Pg0KPiAgICAgID4+IE9uIEZyaSwgSnVuIDIxLCAyMDE5LCBhdCAwODozMywgSmFjb2IgSG9mZm1h bi1BbmRyZXdzIHdyb3RlOg0KPiAgICAgID4+PiBUaGUgbGF0ZXN0IGRyYWZ0IGFkb3B0cyBhIC8u d2VsbC1rbm93bi8gcGF0aCBmb3IgQ1QgYXMgYSB3YXkgdG8gZ2V0DQo+ICAgICAgPj4+wqAgwqBh cm91bmQgQkNQIDE5MCAoVVJJIERlc2lnbiBhbmQgT3duZXJzaGlwOg0KPiAgICAgID4+PiBodHRw czovL3Rvb2xzLmlldGYub3JnL2h0bWwvYmNwMTkwI3NlY3Rpb24tMykuDQo+ICAgICAgPj4+DQo+ ICAgICAgPj4+IFBlcnNvbmFsbHkgSSB0aGluayBCQ1AgMTkwIG1ha2VzIGl0IG5lZWRsZXNzbHkg cGFpbmZ1bCB0byBzcGVjaWZ5DQo+ICAgICAgPj4+IEhUVFAtYmFzZWQgQVBJcyB1c2luZyB0ZWNo bmlxdWVzIHRoYXQgYXJlIHZlcnkgY29tbW9uIGFtb25nDQo+ICAgICAgPj4+IHByYWN0aXRpb25l cnMuIEhvd2V2ZXIsIGdpdmVuIHRoYXQgaXQgaXMgc3RpbGwgY29uc2lkZXJlZCBiZXN0DQo+ICAg ICAgPj4+IHByYWN0aWNlIGZvciBJRVRGIGRvY3VtZW50cywgSSBwcm9wb3NlIHRoYXQgQ1Qgc2hv dWxkIHVzZSBhDQo+ICAgICAgPj4+IGRpZmZlcmVudCB3b3JrYXJvdW5kLCBvbmUgdXNlZCB2ZXJ5 IHN1Y2Nlc3NmdWxseSBieSBBQ01FOg0KPiAgICAgRGlyZWN0b3J5DQo+ICAgICAgPj4+IFVSTHMu DQo+ICAgICAgPg0KPiAgICAgID4gSSBoYXZlIGEgZmFpcmx5IHByb2ZvdW5kIGRpc2xpa2UgZm9y IEJDUCAxOTAsIHRvIGJlIGhvbmVzdCwgYW5kDQo+ICAgICBhbSBpbg0KPiAgICAgID4gYWdyZWVt ZW50IHdpdGggdGhlIHByb3Bvc2FsLg0KPiAgICAgID4NCj4gICAgICA+IE1lbGluZGENCj4gICAg ICA+DQo+IA0KPiAgICAgLS0NCj4gICAgIFJvYiBTdHJhZGxpbmcNCj4gICAgIFNlbmlvciBSZXNl YXJjaCAmIERldmVsb3BtZW50IFNjaWVudGlzdA0KPiAgICAgRW1haWw6IHJvYkBzZWN0aWdvLmNv bSA8bWFpbHRvOnJvYkBzZWN0aWdvLmNvbT4NCj4gICAgIEJyYWRmb3JkLCBVSw0KPiAgICAgT2Zm aWNlOiArNDQxMjc0MDI0NzA3DQo+ICAgICBTZWN0aWdvIExpbWl0ZWQNCj4gDQo+ICAgICBUaGlz IG1lc3NhZ2UgYW5kIGFueSBmaWxlcyBhc3NvY2lhdGVkIHdpdGggaXQgbWF5IGNvbnRhaW4gbGVn YWxseQ0KPiAgICAgcHJpdmlsZWdlZCwgY29uZmlkZW50aWFsLCBvciBwcm9wcmlldGFyeSBpbmZv cm1hdGlvbi4gSWYgeW91IGFyZSBub3QNCj4gICAgIHRoZSBpbnRlbmRlZCByZWNpcGllbnQsIHlv dSBhcmUgbm90IHBlcm1pdHRlZCB0byB1c2UsIGNvcHksIG9yDQo+ICAgICBmb3J3YXJkIGl0LCBp biB3aG9sZSBvciBpbiBwYXJ0IHdpdGhvdXQgdGhlIGV4cHJlc3MgY29uc2VudCBvZiB0aGUNCj4g ICAgIHNlbmRlci4gUGxlYXNlIG5vdGlmeSB0aGUgc2VuZGVyIGJ5IHJlcGx5IGVtYWlsLCBkaXNy ZWdhcmQgdGhlDQo+ICAgICBmb3JlZ29pbmcgbWVzc2FnZXMsIGFuZCBkZWxldGUgaXQgaW1tZWRp YXRlbHkuDQo+ICAgICBfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fXw0KPiAgICAgVHJhbnMgbWFpbGluZyBsaXN0DQo+ICAgICBUcmFuc0BpZXRmLm9yZyA8bWFp bHRvOlRyYW5zQGlldGYub3JnPg0KPiAgICAgaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9s aXN0aW5mby90cmFucw0KPiANCj4gICAgIF9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fDQo+ICAgICBUcmFucyBtYWlsaW5nIGxpc3QNCj4gICAgIFRyYW5zQGll dGYub3JnIDxtYWlsdG86VHJhbnNAaWV0Zi5vcmc+DQo+ICAgICBodHRwczovL3d3dy5pZXRmLm9y Zy9tYWlsbWFuL2xpc3RpbmZvL3RyYW5zDQo+IA0KDQotLSANClJvYiBTdHJhZGxpbmcNClNlbmlv ciBSZXNlYXJjaCAmIERldmVsb3BtZW50IFNjaWVudGlzdA0KRW1haWw6IHJvYkBzZWN0aWdvLmNv bQ0KQnJhZGZvcmQsIFVLDQpPZmZpY2U6ICs0NDEyNzQwMjQ3MDcNClNlY3RpZ28gTGltaXRlZA0K DQpUaGlzIG1lc3NhZ2UgYW5kIGFueSBmaWxlcyBhc3NvY2lhdGVkIHdpdGggaXQgbWF5IGNvbnRh aW4gbGVnYWxseSANCnByaXZpbGVnZWQsIGNvbmZpZGVudGlhbCwgb3IgcHJvcHJpZXRhcnkgaW5m b3JtYXRpb24uIElmIHlvdSBhcmUgbm90IHRoZSANCmludGVuZGVkIHJlY2lwaWVudCwgeW91IGFy ZSBub3QgcGVybWl0dGVkIHRvIHVzZSwgY29weSwgb3IgZm9yd2FyZCBpdCwgDQppbiB3aG9sZSBv ciBpbiBwYXJ0IHdpdGhvdXQgdGhlIGV4cHJlc3MgY29uc2VudCBvZiB0aGUgc2VuZGVyLiBQbGVh c2UgDQpub3RpZnkgdGhlIHNlbmRlciBieSByZXBseSBlbWFpbCwgZGlzcmVnYXJkIHRoZSBmb3Jl Z29pbmcgbWVzc2FnZXMsIGFuZCANCmRlbGV0ZSBpdCBpbW1lZGlhdGVseS4NCg==