From nobody Fri May 29 16:36:06 2015 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 470A41A9116; Fri, 29 May 2015 16:36:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 98aYU89Zer7o; Fri, 29 May 2015 16:36:04 -0700 (PDT) Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 134711A8820; Fri, 29 May 2015 16:36:04 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: X-Test-IDTracker: no X-IETF-IDTracker: 6.0.3.p1 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <20150529233604.26166.79099.idtracker@ietfa.amsl.com> Date: Fri, 29 May 2015 16:36:04 -0700 Archived-At: Cc: unbearable@ietf.org Subject: [Unbearable] I-D Action: draft-ietf-tokbind-protocol-01.txt X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.15 List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 29 May 2015 23:36:05 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Token Binding Working Group of the IETF. Title : The Token Binding Protocol Version 1.0 Authors : Andrei Popov Magnus Nystroem Dirk Balfanz Adam Langley Filename : draft-ietf-tokbind-protocol-01.txt Pages : 12 Date : 2015-05-29 Abstract: This document specifies Version 1.0 of the Token Binding protocol. The Token Binding protocol allows client/server applications to create long-lived, uniquely identifiable TLS [RFC5246] bindings spanning multiple TLS sessions and connections. Applications are then enabled to cryptographically bind security tokens to the TLS layer, preventing token export and replay attacks. To protect privacy, the TLS Token Binding identifiers are only transmitted encrypted and can be reset by the user at any time. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-tokbind-protocol/ There's also a htmlized version available at: https://tools.ietf.org/html/draft-ietf-tokbind-protocol-01 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-tokbind-protocol-01 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Fri May 29 16:54:45 2015 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5F9BC1A9172 for ; Fri, 29 May 2015 16:54:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CXHsuyXW5K70 for ; Fri, 29 May 2015 16:54:43 -0700 (PDT) Received: from na01-bn1-obe.outbound.protection.outlook.com (mail-bn1on0733.outbound.protection.outlook.com [IPv6:2a01:111:f400:fc10::733]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 81A201A916D for ; Fri, 29 May 2015 16:54:43 -0700 (PDT) Received: from BLUPR03MB1396.namprd03.prod.outlook.com (10.163.81.142) by BLUPR03MB1395.namprd03.prod.outlook.com (10.163.81.141) with Microsoft SMTP Server (TLS) id 15.1.172.22; Fri, 29 May 2015 23:54:21 +0000 Received: from BLUPR03MB1396.namprd03.prod.outlook.com ([10.163.81.142]) by BLUPR03MB1396.namprd03.prod.outlook.com ([10.163.81.142]) with mapi id 15.01.0172.012; Fri, 29 May 2015 23:54:21 +0000 From: Andrei Popov To: "unbearable@ietf.org" Thread-Topic: New and Updated I-Ds Thread-Index: AdCaaI/uZjPJTA7KT/apdeAdcrT1+g== Date: Fri, 29 May 2015 23:54:21 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Andrei.Popov@microsoft.com; x-originating-ip: [2001:4898:80e8:ed31::2] x-microsoft-exchange-diagnostics: 1; BLUPR03MB1395; 3:lg30YSegKMsHnRWXfu5fNZX18q5fiIFjgC8GgtFA6kGU5Hunt5IR0tLOzqd/FkSKtZFTf7pplZ79etOgmDo4vUnPbRc2LXUxoKFE9MrcS76KuKJy8WBtV85w1jn+ShV3ozdNZ9EZMyFE9nlKQZP/jw==; 10:Fo+W2gIrHJNLUC6uT2vnmb3ZGaeiye8gUe31ehRLG5KzZrKuuozL+qEOPP+JnRAXrUGlGlalb7aUpFqdgIJwpUPabiGVugAJFmzkUGILUY8=; 6:l/yrHkekdmBsxFMRB8p1AZhYwrYF6J/uX86B/+wkOMAlbAQ+MBTqH0UCHwjwAbs5 x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:BLUPR03MB1395; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:; x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(601004)(2401001)(520003)(5005006)(3002001); SRVR:BLUPR03MB1395; BCL:0; PCL:0; RULEID:; SRVR:BLUPR03MB1395; x-forefront-prvs: 059185FE08 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(189002)(199003)(68736005)(122556002)(77156002)(77096005)(2900100001)(46102003)(76576001)(229853001)(2351001)(2501003)(62966003)(106356001)(40100003)(5002640100001)(15975445007)(92566002)(99286002)(450100001)(105586002)(2420400003)(107886002)(33656002)(102836002)(19300405004)(64706001)(189998001)(19580395003)(19625215002)(16236675004)(5001960100002)(110136002)(101416001)(81156007)(5001860100001)(7110500001)(74316001)(86362001)(2656002)(87936001)(19617315012)(5001830100001)(97736004)(50986999)(86612001)(54356999)(4001540100001)(3826002); DIR:OUT; SFP:1102; SCL:1; SRVR:BLUPR03MB1395; H:BLUPR03MB1396.namprd03.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:1; LANG:en; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) Content-Type: multipart/alternative; boundary="_000_BLUPR03MB139612A5DD17EE2B8CFAE96B8CC90BLUPR03MB1396namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 29 May 2015 23:54:21.6452 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: BLUPR03MB1395 Archived-At: Subject: [Unbearable] New and Updated I-Ds X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 29 May 2015 23:54:45 -0000 --_000_BLUPR03MB139612A5DD17EE2B8CFAE96B8CC90BLUPR03MB1396namp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable In Dallas we agreed to define a new TLS extension for Token Binding key par= ameters negotiation, instead of using ALPN. Today I've submitted TLS Extension for Token Binding Protocol Negotiation = I-D: https://datatracker.ietf.org/doc/draft-popov-tokbind-negotiation/ I have also updated the Token Binding Protocol I-D: https://tools.ietf.org/= html/draft-ietf-tokbind-protocol-01 The updated version has the following changes: - Removed ALPN negotiation text; - Added a Security Considerations sub-section discussing Token Bin= ding key sharing between applications; - Minor edits, nits, etc. Comments are very welcome! Cheers, Andrei --_000_BLUPR03MB139612A5DD17EE2B8CFAE96B8CC90BLUPR03MB1396namp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

In Dallas we agreed to define a new TLS extension fo= r Token Binding key parameters negotiation, instead of using ALPN.

 

Today I’ve submitted TLS Extension for Token B= inding Protocol Negotiation  I-D: https://datatracker.ietf.org/doc/draft-popov-tokbind-negotiation/

 

I have also updated the Token Binding Protocol I-= D: https://tools.ietf.org/html/draft-ietf-tokbind-protocol-01

The updated version has the following changes:<= /o:p>

-     &= nbsp;    Removed ALPN negotiation text;

-     &= nbsp;    Added a Security Considerations sub-section discuss= ing Token Binding key sharing between applications;

-     &= nbsp;    Minor edits, nits, etc.

 

Comments are very welcome!

 

Cheers,

 

Andrei

--_000_BLUPR03MB139612A5DD17EE2B8CFAE96B8CC90BLUPR03MB1396namp_-- From nobody Fri May 29 23:34:04 2015 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6AA4D1A9124 for ; Fri, 29 May 2015 23:34:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9eVIJbTDg9dR for ; Fri, 29 May 2015 23:34:01 -0700 (PDT) Received: from emh06.mail.saunalahti.fi (emh06.mail.saunalahti.fi [62.142.5.116]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 84BAA1A9123 for ; Fri, 29 May 2015 23:33:59 -0700 (PDT) Received: from LK-Perkele-VII (a91-155-194-207.elisa-laajakaista.fi [91.155.194.207]) by emh06.mail.saunalahti.fi (Postfix) with ESMTP id EC7A969977; Sat, 30 May 2015 09:33:56 +0300 (EEST) Date: Sat, 30 May 2015 09:33:56 +0300 From: Ilari Liusvaara To: Andrei Popov Message-ID: <20150530063356.GA20414@LK-Perkele-VII> References: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.23 (2014-03-12) Sender: Ilari Liusvaara Archived-At: Cc: "unbearable@ietf.org" Subject: Re: [Unbearable] New and Updated I-Ds X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 30 May 2015 06:34:03 -0000 On Fri, May 29, 2015 at 11:54:21PM +0000, Andrei Popov wrote: > In Dallas we agreed to define a new TLS extension for Token Binding key parameters negotiation, instead of using ALPN. > > Today I've submitted TLS Extension for Token Binding Protocol Negotiation I-D: https://datatracker.ietf.org/doc/draft-popov-tokbind-negotiation/ > > I have also updated the Token Binding Protocol I-D: https://tools.ietf.org/html/draft-ietf-tokbind-protocol-01 > The updated version has the following changes: > > - Removed ALPN negotiation text; > > - Added a Security Considerations sub-section discussing Token Binding key sharing between applications; > > - Minor edits, nits, etc. > > Comments are very welcome! Some comments (might have been asked earlier, or not): [NEGOTIATION] 1) [TBNEGO] and [HTTPSTB] (?) don't seem to be linked, like for example [I-D.ietf-tls-session-hash] is. 2) "3. Token Binding Protocol Message" "This message MUST be sent in the client's first application protocol message." "The server MUST terminate the connection if the use of the Token Binding protocol has been successfully negotiated via [TBNEGO] within the TLS handshake, but the client's first application message does not contain the Token Binding message." What if first application protocol message is for something that is not valid for binding, but subsequent messages may be? This can happen in some situations with HTTP/2. Some eTLDs (in the cookie sense) do respond to HTTP requests, and non-eTLDs might be coalesced to those connections. [TBNEGO] 3) rsa2048_pkcs1.5_sha256(0) ... IIRC, that algorithm is known to be broken. Is it for backward compatiblity? The security considerations do not say anything about this, or how to use it safely (most likely via giving reference). 4) "3. Token Binding Negotiation Server Hello Extension" "'key_parameters_list' contains exactly one Token Binding key parameters identifier selected by the server from the client's list." Is there reason for this restriction to just one algorithm? Why it is not "what server can verify" list (i.e. capability adverstiment)? Already established token bindings may have various algorithms, and if multiple token bindings are subsequently coalesced into same connection (may happen with HTTP/2), one may get multiple types of provided_token_binding's. [HTTPSB] 5) "3.5. Negotiated Key Parameters" "The client MUST use the signature algorithm negotiated with the Token Consumer in the referred_token_binding TokenBinding of the TokenBindingMessage, even if that signature algorithm is different from the one negotiated with the origin that the header is sent to." This means that the message may be signed by algorithm that the server doesn't understand and thus can't verify. Does there need to be security considerations for this? -Ilari From nobody Sat May 30 22:23:44 2015 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 35C261B2C54 for ; Sat, 30 May 2015 22:23:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.902 X-Spam-Level: X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Z10hMgwtbB0w for ; Sat, 30 May 2015 22:23:40 -0700 (PDT) Received: from na01-bn1-obe.outbound.protection.outlook.com (mail-bn1on0788.outbound.protection.outlook.com [IPv6:2a01:111:f400:fc10::788]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 855D61B2C53 for ; Sat, 30 May 2015 22:23:40 -0700 (PDT) Received: from BLUPR03MB1394.namprd03.prod.outlook.com (10.163.81.140) by BLUPR03MB278.namprd03.prod.outlook.com (10.255.213.16) with Microsoft SMTP Server (TLS) id 15.1.172.17; Sun, 31 May 2015 05:23:23 +0000 Received: from BLUPR03MB1396.namprd03.prod.outlook.com (10.163.81.142) by BLUPR03MB1394.namprd03.prod.outlook.com (10.163.81.140) with Microsoft SMTP Server (TLS) id 15.1.172.22; Sun, 31 May 2015 05:23:16 +0000 Received: from BLUPR03MB1396.namprd03.prod.outlook.com ([10.163.81.142]) by BLUPR03MB1396.namprd03.prod.outlook.com ([10.163.81.142]) with mapi id 15.01.0172.012; Sun, 31 May 2015 05:23:16 +0000 From: Andrei Popov To: Ilari Liusvaara Thread-Topic: [Unbearable] New and Updated I-Ds Thread-Index: AdCaaI/uZjPJTA7KT/apdeAdcrT1+gAOgp8AAC7aK+A= Date: Sun, 31 May 2015 05:23:15 +0000 Message-ID: References: <20150530063356.GA20414@LK-Perkele-VII> In-Reply-To: <20150530063356.GA20414@LK-Perkele-VII> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Andrei.Popov@microsoft.com; x-originating-ip: [50.46.200.154] x-microsoft-exchange-diagnostics: 1; BLUPR03MB1394; 3:ojAuzEUarTl8A/w8XJNYRzcw0vGePXe7m+2ag0RdhFdVPiSQMOh1EnXhVqyWSHZ8BoHEzGIpd8mX0hkbiYQBVzQztkvtWfBGRBcHk5pNluqVUskM/pVcAh1Pfrsc3l9L8m5AX79hfDOI8Dwkvyi5dQ==; 10:T49SunLJAglar9Rd2UXZV/O1gKCFsiY2WUP60Oe6ohfGA+WF0mFBxZWCy9Mx8x+YJtQG7tZWWkwySVXn3bGNVw1E3pNu3Lp4LbgO5K7qxqY=; 6:XyfVmHbNVx0/rsmEuaa8P6JN+jMLCkH/9OOGm11wdnMh0MwXvVpMyzvrzBe1pf3E x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:; SRVR:BLUPR03MB1394; UriScan:; BCL:0; PCL:0; RULEID:; SRVR:BLUPR03MB278; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:; x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(601004)(2401001)(5005006)(520003)(3002001); SRVR:BLUPR03MB1394; BCL:0; PCL:0; RULEID:; SRVR:BLUPR03MB1394; x-forefront-prvs: 0593E261C4 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(6009001)(377454003)(199003)(13464003)(51704005)(24454002)(52604005)(189002)(74316001)(5002640100001)(97736004)(81156007)(4001540100001)(62966003)(77156002)(46102003)(106356001)(5001860100001)(76576001)(5001830100001)(189998001)(92566002)(2656002)(2950100001)(2900100001)(86362001)(87936001)(5001960100002)(110136002)(68736005)(19580405001)(77096005)(19580395003)(99286002)(102836002)(15975445007)(105586002)(76176999)(54356999)(33656002)(50986999)(40100003)(122556002)(64706001)(66066001)(101416001)(86612001); DIR:OUT; SFP:1102; SCL:1; SRVR:BLUPR03MB1394; H:BLUPR03MB1396.namprd03.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; A:1; MX:1; LANG:en; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-CrossTenant-originalarrivaltime: 31 May 2015 05:23:15.9974 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: BLUPR03MB1394 X-Microsoft-Exchange-Diagnostics: 1; BLUPR03MB278; 2:2V2ynr2Ec3cdiVfKd9KuBGG6fE4ZV6ikkrhwk4pYhXFqEDaWPI2/hMufWg0582kJ; 2:wMKvBJyh6jEKR9GMxvoQ00QmJDRwZlpU0vG3g6dw3vbpMWJrKZr2tbrZSUNAqmIe4W/5wPSchF4Wx+99G9lB8+2QEHWnIOtuN0rNHXtOpjUla6MSlv7AujH+IEhYWVEOqLEIH0VLLExzyHqBEd9GEQ==; 9:+f7pX9VWHgsiOQJX+VzvjlDifVXqXxmMuWCi2MMPFzZXjxTMf7W8ACblj7PsDPabFouH1EnKjKv1eBOk9487+55KZ6pVn6FE2p5ayhaRtUuEgnu7UG/92diGNGxH4wZvyidKoJ84PbPf7WvXGxMthQ== X-OriginatorOrg: microsoft.com Archived-At: Cc: "unbearable@ietf.org" Subject: Re: [Unbearable] New and Updated I-Ds X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 31 May 2015 05:23:43 -0000 SGkgSWxhcmksDQoNClRoYW5rcyBmb3IgcmV2aWV3aW5nIHRoZSBJLURzLg0KDQoxKSBXaWxsIGZp eCB3aXRoIHRoZSBuZXh0IHVwZGF0ZS4NCg0KMikgSXQgbWF5IGJlIGEgZ29vZCBpZGVhIHRvIHJl bW92ZSB0aGlzIHJlcXVpcmVtZW50IGZyb20gW1RCTkVHT10uIEUuZy4gW0hUVFBTVEJdIHNwZWNp ZmllcyBleGFjdGx5IGhvdyBUQiBtZXNzYWdlcyBhcmUgZW5jYXBzdWxhdGVkIGluIEhUVFAuDQoN CjMpIElmIHlvdSdyZSByZWZlcnJpbmcgdG8gdGhlIHVzZSBvZiBQS0NTLCB0aGlzIGlzIGR1ZSB0 byBoYXJkd2FyZSBsaW1pdGF0aW9uczogbW9zdCAoaWYgbm90IGFsbCkgVFBNcyBvbmx5IHN1cHBv cnQgUEtDUy4gQW5kIHN0b3JpbmcgVEIga2V5cyBpbiBhIFRQTSBpcyBwcm9iYWJseSBhIHNlY3Vy aXR5IHdpbiwgZXZlbiBpZiBpdCBpbnZvbHZlcyBQS0NTLg0KDQo0KSBUaGlzIG1heSBoYXZlIGFk dmFudGFnZXMsIGJ1dCBpdCBhbHNvIGluY3JlYXNlcyBjb21wbGV4aXR5LiBMZXQncyBzZWUgd2hh dCBvdGhlcnMgdGhpbmsuDQoNCjUpIFRoaXMgd291bGQgb25seSBoYXBwZW4gaWYgYW4gUlAgbmVn b3RpYXRlZCBUQiBrZXkgcGFyYW1ldGVycyB1bnN1cHBvcnRlZCBieSB0aGUgUlAncyBkZXNpZ25h dGVkIElEUCwgd2hpY2ggaXMgYXJndWFibHkgYSBtaXNjb25maWd1cmF0aW9uLiBJbiB0aGlzIGNh c2UsIHRoZSBJRFAgd291bGQgc2ltcGx5IG5vdCBiaW5kIHRoZSB0b2tlbi4gSGVyZSdzIHdoYXQg W0hUVFBTVEJdIHNheXMgb24gdGhpcyBzdWJqZWN0Og0KIiAgVG9rZW4gUHJvdmlkZXJzIFNIT1VM RCBzdXBwb3J0IGFsbCB0aGUgU2lnbmF0dXJlQW5kSGFzaEFsZ29yaXRobXMNCiAgIHNwZWNpZmll ZCBpbiB0aGUgVG9rZW4gQmluZGluZyBQcm90b2NvbCBbVEJQUk9UT10uICBJZiBhIHRva2VuDQog ICBwcm92aWRlciBkb2VzIG5vdCBzdXBwb3J0IHRoZSBTaWduYXR1cmVBbmRIYXNoQWxnb3JpdGht IHNwZWNpZmllZCBpbg0KICAgdGhlIHJlZmVycmVkX3Rva2VuX2JpbmRpbmcgVG9rZW5CaW5kaW5n IGluIHRoZSBUb2tlbkJpbmRpbmdNZXNzYWdlLA0KICAgaXQgTVVTVCBpc3N1ZSBhbiB1bmJvdW5k IHRva2VuLiINCg0KQlRXLCBpZiB3ZSBkaWQgIzQgYWJvdmUgKG5lZ290aWF0ZWQgbXVsdGlwbGUg VEIga2V5IHBhcmFtZXRlciBzZXRzKSwgdGhlbiB0aGUgY2xpZW50IHdvdWxkIGtub3cgYWxsIHRo ZSBrZXkgcGFyYW1ldGVycyBpdCBoYXMgaW4gY29tbW9uIHdpdGggdGhlIElEUCwgYW5kIHdvdWxk IG5vdCBzZW5kIHVuc3VwcG9ydGVkIHRva2VuIGJpbmRpbmdzIHRvIHRoZSBJRFAgd2hlbiB0aGUg UlAgaXMgbWlzY29uZmlndXJlZC4gVGhpcyBtaWdodCBiZSBtb3JlIGVsZWdhbnQuDQoNCkNoZWVy cywNCg0KQW5kcmVpDQoNCi0tLS0tT3JpZ2luYWwgTWVzc2FnZS0tLS0tDQpGcm9tOiBJbGFyaSBM aXVzdmFhcmEgW21haWx0bzppbGFyaS5saXVzdmFhcmFAZWxpc2FuZXQuZmldIA0KU2VudDogRnJp ZGF5LCBNYXkgMjksIDIwMTUgMTE6MzQgUE0NClRvOiBBbmRyZWkgUG9wb3YNCkNjOiB1bmJlYXJh YmxlQGlldGYub3JnDQpTdWJqZWN0OiBSZTogW1VuYmVhcmFibGVdIE5ldyBhbmQgVXBkYXRlZCBJ LURzDQoNCk9uIEZyaSwgTWF5IDI5LCAyMDE1IGF0IDExOjU0OjIxUE0gKzAwMDAsIEFuZHJlaSBQ b3BvdiB3cm90ZToNCj4gSW4gRGFsbGFzIHdlIGFncmVlZCB0byBkZWZpbmUgYSBuZXcgVExTIGV4 dGVuc2lvbiBmb3IgVG9rZW4gQmluZGluZyBrZXkgcGFyYW1ldGVycyBuZWdvdGlhdGlvbiwgaW5z dGVhZCBvZiB1c2luZyBBTFBOLg0KPiANCj4gVG9kYXkgSSd2ZSBzdWJtaXR0ZWQgVExTIEV4dGVu c2lvbiBmb3IgVG9rZW4gQmluZGluZyBQcm90b2NvbCANCj4gTmVnb3RpYXRpb24gIEktRDogDQo+ IGh0dHBzOi8vZGF0YXRyYWNrZXIuaWV0Zi5vcmcvZG9jL2RyYWZ0LXBvcG92LXRva2JpbmQtbmVn b3RpYXRpb24vDQo+IA0KPiBJIGhhdmUgYWxzbyB1cGRhdGVkIHRoZSBUb2tlbiBCaW5kaW5nIFBy b3RvY29sIEktRDogDQo+IGh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1pZXRmLXRv a2JpbmQtcHJvdG9jb2wtMDENCj4gVGhlIHVwZGF0ZWQgdmVyc2lvbiBoYXMgdGhlIGZvbGxvd2lu ZyBjaGFuZ2VzOg0KPiANCj4gLSAgICAgICAgICBSZW1vdmVkIEFMUE4gbmVnb3RpYXRpb24gdGV4 dDsNCj4gDQo+IC0gICAgICAgICAgQWRkZWQgYSBTZWN1cml0eSBDb25zaWRlcmF0aW9ucyBzdWIt c2VjdGlvbiBkaXNjdXNzaW5nIFRva2VuIEJpbmRpbmcga2V5IHNoYXJpbmcgYmV0d2VlbiBhcHBs aWNhdGlvbnM7DQo+IA0KPiAtICAgICAgICAgIE1pbm9yIGVkaXRzLCBuaXRzLCBldGMuDQo+IA0K PiBDb21tZW50cyBhcmUgdmVyeSB3ZWxjb21lIQ0KDQpTb21lIGNvbW1lbnRzIChtaWdodCBoYXZl IGJlZW4gYXNrZWQgZWFybGllciwgb3Igbm90KToNCg0KW05FR09USUFUSU9OXQ0KDQoxKQ0KDQpb VEJORUdPXSBhbmQgW0hUVFBTVEJdICg/KSBkb24ndCBzZWVtIHRvIGJlIGxpbmtlZCwgbGlrZSBm b3IgZXhhbXBsZSBbSS1ELmlldGYtdGxzLXNlc3Npb24taGFzaF0gaXMuDQoNCjIpDQoNCiIzLiAg VG9rZW4gQmluZGluZyBQcm90b2NvbCBNZXNzYWdlIg0KDQoiVGhpcyBtZXNzYWdlIE1VU1QgYmUg c2VudCBpbiB0aGUgY2xpZW50J3MgZmlyc3QgYXBwbGljYXRpb24gcHJvdG9jb2wgbWVzc2FnZS4i DQoNCiJUaGUgc2VydmVyIE1VU1QgdGVybWluYXRlIHRoZSBjb25uZWN0aW9uIGlmIHRoZSB1c2Ug b2YgdGhlIFRva2VuIEJpbmRpbmcgcHJvdG9jb2wgaGFzIGJlZW4gc3VjY2Vzc2Z1bGx5IG5lZ290 aWF0ZWQgdmlhIFtUQk5FR09dIHdpdGhpbiB0aGUgVExTIGhhbmRzaGFrZSwgYnV0IHRoZSBjbGll bnQncyBmaXJzdCBhcHBsaWNhdGlvbiBtZXNzYWdlIGRvZXMgbm90IGNvbnRhaW4gdGhlIFRva2Vu IEJpbmRpbmcgbWVzc2FnZS4iDQoNCldoYXQgaWYgZmlyc3QgYXBwbGljYXRpb24gcHJvdG9jb2wg bWVzc2FnZSBpcyBmb3Igc29tZXRoaW5nIHRoYXQgaXMgbm90IHZhbGlkIGZvciBiaW5kaW5nLCBi dXQgc3Vic2VxdWVudCBtZXNzYWdlcyBtYXkgYmU/DQoNClRoaXMgY2FuIGhhcHBlbiBpbiBzb21l IHNpdHVhdGlvbnMgd2l0aCBIVFRQLzIuIFNvbWUgZVRMRHMgKGluIHRoZSBjb29raWUNCnNlbnNl KSBkbyByZXNwb25kIHRvIEhUVFAgcmVxdWVzdHMsIGFuZCBub24tZVRMRHMgbWlnaHQgYmUgY29h bGVzY2VkIHRvIHRob3NlIGNvbm5lY3Rpb25zLg0KDQpbVEJORUdPXQ0KDQozKQ0KDQpyc2EyMDQ4 X3BrY3MxLjVfc2hhMjU2KDApIC4uLiBJSVJDLCB0aGF0IGFsZ29yaXRobSBpcyBrbm93biB0byBi ZSBicm9rZW4uIElzIGl0IGZvciBiYWNrd2FyZCBjb21wYXRpYmxpdHk/IFRoZSBzZWN1cml0eSBj b25zaWRlcmF0aW9ucyBkbyBub3Qgc2F5IGFueXRoaW5nIGFib3V0IHRoaXMsIG9yIGhvdyB0byB1 c2UgaXQgc2FmZWx5IChtb3N0IGxpa2VseSB2aWEgZ2l2aW5nIHJlZmVyZW5jZSkuDQoNCjQpDQoN CiIzLiAgVG9rZW4gQmluZGluZyBOZWdvdGlhdGlvbiBTZXJ2ZXIgSGVsbG8gRXh0ZW5zaW9uIg0K DQoiJ2tleV9wYXJhbWV0ZXJzX2xpc3QnIGNvbnRhaW5zIGV4YWN0bHkgb25lIFRva2VuIEJpbmRp bmcga2V5IHBhcmFtZXRlcnMgaWRlbnRpZmllciBzZWxlY3RlZCBieSB0aGUgc2VydmVyIGZyb20g dGhlIGNsaWVudCdzIGxpc3QuIg0KDQpJcyB0aGVyZSByZWFzb24gZm9yIHRoaXMgcmVzdHJpY3Rp b24gdG8ganVzdCBvbmUgYWxnb3JpdGhtPyBXaHkgaXQgaXMgbm90ICJ3aGF0IHNlcnZlciBjYW4g dmVyaWZ5IiBsaXN0IChpLmUuIGNhcGFiaWxpdHkgYWR2ZXJzdGltZW50KT8NCg0KQWxyZWFkeSBl c3RhYmxpc2hlZCB0b2tlbiBiaW5kaW5ncyBtYXkgaGF2ZSB2YXJpb3VzIGFsZ29yaXRobXMsIGFu ZCBpZiBtdWx0aXBsZSB0b2tlbiBiaW5kaW5ncyBhcmUgc3Vic2VxdWVudGx5IGNvYWxlc2NlZCBp bnRvIHNhbWUgY29ubmVjdGlvbiAobWF5IGhhcHBlbiB3aXRoIEhUVFAvMiksIG9uZSBtYXkgZ2V0 IG11bHRpcGxlIHR5cGVzIG9mIHByb3ZpZGVkX3Rva2VuX2JpbmRpbmcncy4NCg0KW0hUVFBTQl0N Cg0KNSkNCg0KIjMuNS4gIE5lZ290aWF0ZWQgS2V5IFBhcmFtZXRlcnMiDQoNCiJUaGUgY2xpZW50 IE1VU1QgdXNlIHRoZSBzaWduYXR1cmUgYWxnb3JpdGhtIG5lZ290aWF0ZWQgd2l0aCB0aGUgVG9r ZW4gQ29uc3VtZXIgaW4gdGhlIHJlZmVycmVkX3Rva2VuX2JpbmRpbmcgVG9rZW5CaW5kaW5nIG9m IHRoZSBUb2tlbkJpbmRpbmdNZXNzYWdlLCBldmVuIGlmIHRoYXQgc2lnbmF0dXJlIGFsZ29yaXRo bSBpcyBkaWZmZXJlbnQgZnJvbSB0aGUgb25lIG5lZ290aWF0ZWQgd2l0aCB0aGUgb3JpZ2luIHRo YXQgdGhlIGhlYWRlciBpcyBzZW50IHRvLiINCg0KVGhpcyBtZWFucyB0aGF0IHRoZSBtZXNzYWdl IG1heSBiZSBzaWduZWQgYnkgYWxnb3JpdGhtIHRoYXQgdGhlIHNlcnZlciBkb2Vzbid0IHVuZGVy c3RhbmQgYW5kIHRodXMgY2FuJ3QgdmVyaWZ5LiBEb2VzIHRoZXJlIG5lZWQgdG8gYmUgc2VjdXJp dHkgY29uc2lkZXJhdGlvbnMgZm9yIHRoaXM/DQoNCg0KLUlsYXJpDQo=