From nobody Wed Jul 1 10:11:45 2015 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CB6941A92E6 for ; Wed, 1 Jul 2015 10:11:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fos4BsBik02I for ; Wed, 1 Jul 2015 10:11:42 -0700 (PDT) Received: from mail-qk0-f169.google.com (mail-qk0-f169.google.com [209.85.220.169]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 26C051A92E2 for ; Wed, 1 Jul 2015 10:11:42 -0700 (PDT) Received: by qkhu186 with SMTP id u186so34127863qkh.0 for ; Wed, 01 Jul 2015 10:11:41 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:content-type:mime-version:subject:from :in-reply-to:date:cc:message-id:references:to; bh=70VTqQ4mbbPJWaRQgTvF9FOmzhMV6bLbOjRi4Em0FEk=; b=P+u+sIAUS9HqlkRE1GPqnN9pGWHpFNHd7U1dMF9JWTQdLOuv56dg9FdUdfpS/Ysq2d QKV1eXlNANKmjx7SEzSlxdAF3Xg/s+/DVavSZ8PXs+Ucs5W0paS7bWQPQvYP3XnHPqu7 rS1coUWbeXGqUNaE/hFMbCfMzja6T9tVgQWWJzgl5qClPqXDzZwg0whRoomWAqlde1cV gaBf0zkeJf9T/V9AcuoTG4rb2ie605TTiYkygzrWhxlaiwM4RmO/bqErfFiMlklLi2Th Ad80Y1p8vZQbMTZ1wZ6pBr20qtZctwvtiH2mpjIlmiPg750UZvihJX6uq3/GSOi74oMk xEWA== X-Gm-Message-State: ALoCoQk3V6E6X4RWZ7w/sibautn6nLekJVB7rWEFlZa3eRinOBOp9JpuWr5RQlOL6XM71bjQZUpD X-Received: by 10.140.108.6 with SMTP id i6mr34859936qgf.73.1435770701316; Wed, 01 Jul 2015 10:11:41 -0700 (PDT) Received: from [192.168.1.216] (186-106-157-161.baf.movistar.cl. [186.106.157.161]) by mx.google.com with ESMTPSA id t33sm1302213qge.19.2015.07.01.10.11.39 (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Wed, 01 Jul 2015 10:11:40 -0700 (PDT) Content-Type: multipart/alternative; boundary="Apple-Mail=_B59D9187-BDE5-45CE-A373-1C5C02754AC6" Mime-Version: 1.0 (Mac OS X Mail 8.2 \(2098\)) From: John Bradley In-Reply-To: Date: Wed, 1 Jul 2015 14:11:34 -0300 Message-Id: References: To: TokenBinding/Internet-Drafts X-Mailer: Apple Mail (2.2098) Archived-At: Cc: unbearable@ietf.org Subject: Re: [Unbearable] [Internet-Drafts] Include-Referer-Token-Binding-ID header meaningful beyond HTTP 302/1? (#10) X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Jul 2015 17:11:45 -0000 --Apple-Mail=_B59D9187-BDE5-45CE-A373-1C5C02754AC6 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 We should really be having this discussion on the list:) I think that the second option is probably more flexible. =20 It would make no difference for the simple use case of a authn request, = however there may be cases where JS is loaded from a origin that may = want to include it=E2=80=99s origin token binding for some calls and not = others. The header approach seems more like a all or nothing proposition. Perhaps someone more familiar with proser based JS could give us a more = informed opinion. John B. > On Jul 1, 2015, at 11:30 AM, Brian Campbell = wrote: >=20 > So just to recap (maybe stating the obvious) - I was imagining the = above auto-post would have the Include-Referer-Token-Binding-ID header = in the response and that would instruct the browser to send the = referred_token_binding in the POST to https://idp.com/oauth-authz = which is at a host/domain that's different = than the one (say https://rp.com/stuff ) that = served the content. So that'd be: >=20 > HTTP/1.1 200 OK > Content-Type: text/html;charset=3DUTF-8 > Cache-Control: no-cache, no-store > Include-Referer-Token-Binding-ID: true >=20 > > Sending you to your identity provider > >
> > > > >
> > > Whereas @balfanz imagined that the = indicator be directly on the
element itself. That would look more = like: >=20 > HTTP/1.1 200 OK > Content-Type: text/html;charset=3DUTF-8 > Cache-Control: no-cache, no-store >=20 > > Sending you to your identity provider > > > > > > >
> > > I don't have a preference between the two (or any other alternative = that might come up). I'm just pushing to have the eventual solution = allow for it somehow. >=20 > =E2=80=94 > Reply to this email directly or view it on GitHub = . >=20 --Apple-Mail=_B59D9187-BDE5-45CE-A373-1C5C02754AC6 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 We should really be having this discussion on the list:)

I think that the second = option is probably more flexible.  
It would = make no difference for the simple use case of a authn request, =  however there may be cases where JS is loaded from a origin that = may want to include it=E2=80=99s origin token binding for some calls and = not others.

The = header approach seems more like a all or nothing proposition.

Perhaps someone more = familiar with proser based JS could give us a more informed = opinion.

John = B.
On Jul 1, 2015, at 11:30 AM, Brian Campbell <notifications@github.com> wrote:

So = just to recap (maybe stating the obvious) - I was imagining the above = auto-post would have the Include-Referer-Token-Binding-ID header in the = response and that would instruct the browser to send the = referred_token_binding in the POST to https://idp.com/oauth-authz which is at a host/domain = that's different than the one (say https://rp.com/stuff) that served the content. So that'd = be:

  HTTP/1.1 200 OK
  Content-Type: text/html;charset=3DUTF-8
  Cache-Control: no-cache, no-store
  Include-Referer-Token-Binding-ID: true

  <html>
   <head><title>Sending you to your identity =
provider</title></head>
   <body onload=3D"javascript:document.forms[0].submit()">
    <form method=3D"post" action=3D"https://idp.com/oauth-authz">
      <input type=3D"hidden" name=3D"client_id" value=3D"abc9er"/>
      <input type=3D"hidden" name=3D"response_type" value=3D"code"/>=

      <input type=3D"hidden" name=3D"scope" value=3D"openid =
profile"/>
      <input type=3D"hidden" name=3D"etc" value=3D"etc"/>
    </form>
   </body>
  </html>

Whereas @balfanz imagined that the indicator be = directly on the <form> element itself. = That would look more like:

  HTTP/1.1 200 OK
  Content-Type: text/html;charset=3DUTF-8
  Cache-Control: no-cache, no-store

  <html>
   <head><title>Sending you to your identity =
provider</title></head>
   <body onload=3D"javascript:document.forms[0].submit()">
    <form method=3D"post" action=3D"https://idp.com/oauth-authz" =
include-referer-token-binding=3D"true">
      <input type=3D"hidden" name=3D"client_id" value=3D"abc9er"/>
      <input type=3D"hidden" name=3D"response_type" value=3D"code"/>=

      <input type=3D"hidden" name=3D"scope" value=3D"openid =
profile"/>
      <input type=3D"hidden" name=3D"etc" value=3D"etc"/>
    </form>
   </body>
  </html>

I don't have a preference between the two (or = any other alternative that might come up). I'm just pushing to have the = eventual solution allow for it somehow.

=E2=80=94
Reply to this email directly or view it on GitHub.3D""


= --Apple-Mail=_B59D9187-BDE5-45CE-A373-1C5C02754AC6-- From nobody Sun Jul 5 13:28:39 2015 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9A6391ACE0D for ; Sun, 5 Jul 2015 13:28:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6KETbn9BI8Xm for ; Sun, 5 Jul 2015 13:28:36 -0700 (PDT) Received: from mail-qg0-f54.google.com (mail-qg0-f54.google.com [209.85.192.54]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7EC5D1ACDFA for ; Sun, 5 Jul 2015 13:28:36 -0700 (PDT) Received: by qgii30 with SMTP id i30so61732241qgi.1 for ; Sun, 05 Jul 2015 13:28:35 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:content-type:mime-version:subject:from :in-reply-to:date:cc:message-id:references:to; bh=6Y/l0mNtgotBfxOSW+pp9p33S9le4LAZXpPNeiTspJE=; b=GuQ9wpq78G3C9qcXgu/EqkcqD3MqA/qTa4AZo+0T4eQh3fc0WnttsiltCmigAiMt+1 Y8s6QcQp2JIsw4KOJk9V7D3/zkP/Q9sROF5NrIQLG4vLQd/rXBSgTmNaNjRL4h1/kgwA hU6a5jRnWksygBuvRrTZwZ1ucT+j65QL05I/qqmDh4fSIVstb4DCt9GwC+F6YPPsjfn7 YT7q/qkxormtyMahC9RhxUzFwZZiPMvc7X+ADkIijfNUCu6Jo6+Di6qWONAEWTO8fdip rjNzJZIAzzjG96GQ91MMOeSJgHSRN5x/zuENe5NNMhajCA5Jcp1kv8EMLQWvhUG7o5Ow PFTg== X-Gm-Message-State: ALoCoQkB3nOjdlPi0/Q4u56O6aCEPi45UfFIoXe3s9iIAF/Q7xS8dPOmqDfG8T+19tyF6ABsMq+b X-Received: by 10.55.20.16 with SMTP id e16mr87543100qkh.71.1436128115627; Sun, 05 Jul 2015 13:28:35 -0700 (PDT) Received: from [192.168.8.100] ([181.202.1.32]) by mx.google.com with ESMTPSA id b38sm8184027qkh.36.2015.07.05.13.27.34 (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Sun, 05 Jul 2015 13:28:34 -0700 (PDT) Content-Type: multipart/alternative; boundary="Apple-Mail=_F385BFE1-7F43-44EE-8CD6-8E96C787C9CE" Mime-Version: 1.0 (Mac OS X Mail 8.2 \(2102\)) From: John Bradley In-Reply-To: Date: Sun, 5 Jul 2015 17:27:16 -0300 Message-Id: <411B772B-7DEF-4B55-B367-69B5D3DAC3B9@ve7jtb.com> References: To: Andrei Popov X-Mailer: Apple Mail (2.2102) Archived-At: Cc: "unbearable@ietf.org" Subject: Re: [Unbearable] New and Updated I-Ds X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 05 Jul 2015 20:28:38 -0000 --Apple-Mail=_F385BFE1-7F43-44EE-8CD6-8E96C787C9CE Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 I haven=E2=80=99t seen any feedback to this on the list. Are you prosing that we adopt this as a working group document? If there are any issues with that, lets discuss it on the list before we = get to Prague. John B. > On Jun 16, 2015, at 4:30 PM, Andrei Popov = wrote: >=20 > Also, please feel free to use GitHub to track issues and make pull = requests: https://github.com/TokenBinding/Internet-Drafts = > =20 > Now that we have TBNEGO I-D, I=E2=80=99ve closed a couple of issues = related to the use of ALPN. > =20 > Cheers, > =20 > Andrei > =20 > From: Andrei Popov=20 > Sent: Friday, May 29, 2015 4:54 PM > To: unbearable@ietf.org > Subject: New and Updated I-Ds > =20 > In Dallas we agreed to define a new TLS extension for Token Binding = key parameters negotiation, instead of using ALPN. > =20 > Today I=E2=80=99ve submitted TLS Extension for Token Binding Protocol = Negotiation I-D: = https://datatracker.ietf.org/doc/draft-popov-tokbind-negotiation/ = > =20 > I have also updated the Token Binding Protocol I-D: = https://tools.ietf.org/html/draft-ietf-tokbind-protocol-01 = > The updated version has the following changes: > - Removed ALPN negotiation text; > - Added a Security Considerations sub-section discussing = Token Binding key sharing between applications; > - Minor edits, nits, etc. > =20 > Comments are very welcome! > =20 > Cheers, > =20 > Andrei > _______________________________________________ > Unbearable mailing list > Unbearable@ietf.org > https://www.ietf.org/mailman/listinfo/unbearable = --Apple-Mail=_F385BFE1-7F43-44EE-8CD6-8E96C787C9CE Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 I haven=E2=80=99t seen any feedback to this on the list.

Are you prosing that we = adopt this as a working group document?

If there are any issues with that, lets = discuss it on the list before we get to Prague.

John B.


On Jun 16, 2015, at 4:30 PM, = Andrei Popov <Andrei.Popov@microsoft.com> wrote:

Also, please feel free to = use GitHub to track issues and make pull requests: https://github.com/TokenBinding/Internet-Drafts
 
Now that we have TBNEGO I-D, I=E2=80=99ve closed a = couple of issues related to the use of ALPN.
 
Cheers,
 
Andrei
 
From: Andrei Popov 
Sent: Friday, May 29, 2015 4:54 = PM
To: unbearable@ietf.org
Subject: New and Updated I-Ds
 
In Dallas we agreed to define a new TLS extension for Token = Binding key parameters negotiation, instead of using ALPN.
 
Today = I=E2=80=99ve submitted TLS Extension for Token Binding Protocol = Negotiation  I-D: https://datatracker.ietf.org/doc/draft-popov-tokbind-negotiatio= n/
 
I have also updated the Token Binding Protocol I-D: https://tools.ietf.org/html/draft-ietf-tokbind-protocol-01<= o:p class=3D"">
The = updated version has the following changes:
-          Removed ALPN = negotiation text;
-          Added a = Security Considerations sub-section discussing Token Binding key sharing = between applications;
-          Minor edits, = nits, etc.
 
Comments are very welcome!
 
Cheers,
 
Andrei
_______________________________________________
Unbearable mailing list
Unbearable@ietf.org
https://www.ietf.org/mailman/listinfo/unbearable

= --Apple-Mail=_F385BFE1-7F43-44EE-8CD6-8E96C787C9CE-- From nobody Mon Jul 6 09:32:49 2015 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5D7791B2FDA for ; Mon, 6 Jul 2015 09:32:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id V5H480XBOQO0 for ; Mon, 6 Jul 2015 09:32:38 -0700 (PDT) Received: from na01-by2-obe.outbound.protection.outlook.com (mail-by2on0142.outbound.protection.outlook.com [207.46.100.142]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8FC7C1B2F96 for ; Mon, 6 Jul 2015 09:32:21 -0700 (PDT) Received: from BLUPR03MB1396.namprd03.prod.outlook.com (10.163.81.142) by BLUPR03MB1394.namprd03.prod.outlook.com (10.163.81.140) with Microsoft SMTP Server (TLS) id 15.1.207.19; Mon, 6 Jul 2015 16:32:19 +0000 Received: from BLUPR03MB1396.namprd03.prod.outlook.com ([10.163.81.142]) by BLUPR03MB1396.namprd03.prod.outlook.com ([10.163.81.142]) with mapi id 15.01.0207.004; Mon, 6 Jul 2015 16:32:19 +0000 From: Andrei Popov To: John Bradley Thread-Topic: [Unbearable] New and Updated I-Ds Thread-Index: AdCaaI/uZjPJTA7KT/apdeAdcrT1+gOAYUOAA725qQAAKUQwMA== Date: Mon, 6 Jul 2015 16:32:19 +0000 Message-ID: References: <411B772B-7DEF-4B55-B367-69B5D3DAC3B9@ve7jtb.com> In-Reply-To: <411B772B-7DEF-4B55-B367-69B5D3DAC3B9@ve7jtb.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: ve7jtb.com; dkim=none (message not signed) header.d=none; x-originating-ip: [2001:4898:80e8:ee31::2] x-microsoft-exchange-diagnostics: 1; BLUPR03MB1394; 5:8qRYWIzozpolXLzm+D8vNEnncFOhNVPkNgUtPfrA7bI2eYE+gVToiO/nqz/KhgsB4KA+8Wo12KnakhcIg+qA/pek6z3ZgDg+O2E6RErqDz6E/xixCbd84jRpoKTxmsyughwnsR1hjB1oFt8/pZ7S9w==; 24:dkymMXDeTYCK5f6I2H8klZaDHalH6IB14yAmNKsN95bKBH5wi8QnQ9nOCHU5DEevX/0SZ61yV0vVxZjpw5QknhYKaPfDPCf3l3gVzojud3I=; 20:Tw5hnWt7lf5QhYFcrHUBA4taH5k5UdMfHOlkL2BPkjwlbCi1+F4ifE4jdQ9XCv6feDNowY3nx9NdEzw1wSUPiw== x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:BLUPR03MB1394; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(108003899814671); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(601004)(2401001)(5005006)(3002001); SRVR:BLUPR03MB1394; BCL:0; PCL:0; RULEID:; SRVR:BLUPR03MB1394; x-forefront-prvs: 06290ECA9D x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(52044002)(377454003)(24454002)(50986999)(122556002)(40100003)(7110500001)(189998001)(19617315012)(86362001)(2900100001)(87936001)(62966003)(77156002)(77096005)(110136002)(76576001)(5001960100002)(74316001)(16236675004)(5003600100002)(2420400003)(5002640100001)(102836002)(575784001)(15975445007)(19580405001)(76176999)(2656002)(92566002)(561944003)(5001920100001)(19580395003)(46102003)(19625215002)(99286002)(2950100001)(54356999)(19300405004)(33656002)(86612001); DIR:OUT; SFP:1102; SCL:1; SRVR:BLUPR03MB1394; H:BLUPR03MB1396.namprd03.prod.outlook.com; FPR:; SPF:None; MLV:sfv; LANG:en; Content-Type: multipart/alternative; boundary="_000_BLUPR03MB13960580C29EEBBC9894C97F8C930BLUPR03MB1396namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 06 Jul 2015 16:32:19.7924 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: BLUPR03MB1394 Archived-At: Cc: "unbearable@ietf.org" Subject: Re: [Unbearable] New and Updated I-Ds X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Jul 2015 16:32:44 -0000 --_000_BLUPR03MB13960580C29EEBBC9894C97F8C930BLUPR03MB1396namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 w5ggIEFyZSB5b3UgcHJvc2luZyB0aGF0IHdlIGFkb3B0IHRoaXMgYXMgYSB3b3JraW5nIGdyb3Vw IGRvY3VtZW50Pw0KaHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9kb2MvZHJhZnQtcG9wb3Yt dG9rYmluZC1uZWdvdGlhdGlvbi8gaXMgd3JpdHRlbiBpbiBzdXBwb3J0IG9mIFdH4oCZcyBkZWNp c2lvbiBpbiBEYWxsYXMgdG8gdXNlIGEgbmV3IFRMUyBleHRlbnNpb24gdG8gbmVnb3RpYXRlIFRv a2VuIEJpbmRpbmcgcGFyYW1ldGVycyAoaW5zdGVhZCBvZiBBTFBOKS4gSSBob3BlIHRoYXQgd2Ug Y2FuIGNvbnRpbnVlIGRpc2N1c3NpbmcgdGhpcyBJLUQgb24gdGhlIG1haWxpbmcgbGlzdCBhbmQg Y29udmVyZ2UgaW4gUHJhZ3VlLiBJZiB0aGUgV0cgYWdyZWVzIHRoYXQgdGhpcyBpcyB0aGUgcmln aHQgYXBwcm9hY2ggb3ZlcmFsbCwgSSB0aGluayB3ZSBzaG91bGQgcHJvY2VlZCB3aXRoIGEgY2Fs bCBmb3IgYWRvcHRpb24sIHdpdGggZnVsbCBleHBlY3RhdGlvbiB0aGF0IHRoZSBkb2N1bWVudCB3 aWxsIGtlZXAgZXZvbHZpbmcuDQoNCg0Kw5ggIEkgaGF2ZW7igJl0IHNlZW4gYW55IGZlZWRiYWNr IHRvIHRoaXMgb24gdGhlIGxpc3QuDQpUaGVyZSBoYXMgYmVlbiBzb21lIGRpc2N1c3Npb246DQpo dHRwczovL21haWxhcmNoaXZlLmlldGYub3JnL2FyY2gvbXNnL3VuYmVhcmFibGUvUjV1YWtJZUhu ZDJkWU16ZFkxelRvSGJ4QktvIC0gdGhlIHByb3Bvc2FsIHRvIGhhcm1vbml6ZSBhbGdvcml0aG0g SURzIGJldHdlZW4gVEJORUdPIGFuZCBUQlBST1RPOw0KaHR0cHM6Ly9tYWlsYXJjaGl2ZS5pZXRm Lm9yZy9hcmNoL21zZy91bmJlYXJhYmxlLzB3OF9GMEg2M1RXcEFiOXhfVjhTb3JaVDBsZyAtIGFt b25nIG90aGVycywgYW4gaWRlYSB0aGF0IG11bHRpcGxlIFRCIHBhcmFtZXRlciBzZXRzIGNvdWxk IGJlIG5lZ290aWF0ZWQsIGUuZy4gdGhlIHNlcnZlciBjb3VsZCByZXR1cm4gYm90aCByc2EyMDQ4 X3BrY3MxLjVfc2hhMjU2KDApIGFuZCAgZWNkc2FwMjU2X3NoYTI1Ni4NCk9uIGJvdGggb2YgdGhl c2UsIEnigJlkIGxpa2UgdG8gc2VlIGEgZGVncmVlIG9mIGNvbnNlbnN1cyBmcm9tIHRoZSBXRywg YmVmb3JlIG1ha2luZyB0aGUgY2hhbmdlcy4NCg0KDQrDmCAgSWYgdGhlcmUgYXJlIGFueSBpc3N1 ZXMgd2l0aCB0aGF0LCBsZXRzIGRpc2N1c3MgaXQgb24gdGhlIGxpc3QgYmVmb3JlIHdlIGdldCB0 byBQcmFndWUuDQpZZXMsIHRoaXMgd291bGQgYmUgYXdlc29tZSENCg0KQ2hlZXJzLA0KDQpBbmRy ZWkNCg0KRnJvbTogSm9obiBCcmFkbGV5IFttYWlsdG86dmU3anRiQHZlN2p0Yi5jb21dDQpTZW50 OiBTdW5kYXksIEp1bHkgNSwgMjAxNSAxOjI3IFBNDQpUbzogQW5kcmVpIFBvcG92DQpDYzogdW5i ZWFyYWJsZUBpZXRmLm9yZw0KU3ViamVjdDogUmU6IFtVbmJlYXJhYmxlXSBOZXcgYW5kIFVwZGF0 ZWQgSS1Ecw0KDQpJIGhhdmVu4oCZdCBzZWVuIGFueSBmZWVkYmFjayB0byB0aGlzIG9uIHRoZSBs aXN0Lg0KDQpBcmUgeW91IHByb3NpbmcgdGhhdCB3ZSBhZG9wdCB0aGlzIGFzIGEgd29ya2luZyBn cm91cCBkb2N1bWVudD8NCg0KSWYgdGhlcmUgYXJlIGFueSBpc3N1ZXMgd2l0aCB0aGF0LCBsZXRz IGRpc2N1c3MgaXQgb24gdGhlIGxpc3QgYmVmb3JlIHdlIGdldCB0byBQcmFndWUuDQoNCkpvaG4g Qi4NCg0KDQpPbiBKdW4gMTYsIDIwMTUsIGF0IDQ6MzAgUE0sIEFuZHJlaSBQb3BvdiA8QW5kcmVp LlBvcG92QG1pY3Jvc29mdC5jb208bWFpbHRvOkFuZHJlaS5Qb3BvdkBtaWNyb3NvZnQuY29tPj4g d3JvdGU6DQoNCkFsc28sIHBsZWFzZSBmZWVsIGZyZWUgdG8gdXNlIEdpdEh1YiB0byB0cmFjayBp c3N1ZXMgYW5kIG1ha2UgcHVsbCByZXF1ZXN0czogaHR0cHM6Ly9naXRodWIuY29tL1Rva2VuQmlu ZGluZy9JbnRlcm5ldC1EcmFmdHMNCg0KTm93IHRoYXQgd2UgaGF2ZSBUQk5FR08gSS1ELCBJ4oCZ dmUgY2xvc2VkIGEgY291cGxlIG9mIGlzc3VlcyByZWxhdGVkIHRvIHRoZSB1c2Ugb2YgQUxQTi4N Cg0KQ2hlZXJzLA0KDQpBbmRyZWkNCg0KRnJvbTogQW5kcmVpIFBvcG92DQpTZW50OiBGcmlkYXks IE1heSAyOSwgMjAxNSA0OjU0IFBNDQpUbzogdW5iZWFyYWJsZUBpZXRmLm9yZzxtYWlsdG86dW5i ZWFyYWJsZUBpZXRmLm9yZz4NClN1YmplY3Q6IE5ldyBhbmQgVXBkYXRlZCBJLURzDQoNCkluIERh bGxhcyB3ZSBhZ3JlZWQgdG8gZGVmaW5lIGEgbmV3IFRMUyBleHRlbnNpb24gZm9yIFRva2VuIEJp bmRpbmcga2V5IHBhcmFtZXRlcnMgbmVnb3RpYXRpb24sIGluc3RlYWQgb2YgdXNpbmcgQUxQTi4N Cg0KVG9kYXkgSeKAmXZlIHN1Ym1pdHRlZCBUTFMgRXh0ZW5zaW9uIGZvciBUb2tlbiBCaW5kaW5n IFByb3RvY29sIE5lZ290aWF0aW9uICBJLUQ6IGh0dHBzOi8vZGF0YXRyYWNrZXIuaWV0Zi5vcmcv ZG9jL2RyYWZ0LXBvcG92LXRva2JpbmQtbmVnb3RpYXRpb24vDQoNCkkgaGF2ZSBhbHNvIHVwZGF0 ZWQgdGhlIFRva2VuIEJpbmRpbmcgUHJvdG9jb2wgSS1EOiBodHRwczovL3Rvb2xzLmlldGYub3Jn L2h0bWwvZHJhZnQtaWV0Zi10b2tiaW5kLXByb3RvY29sLTAxDQpUaGUgdXBkYXRlZCB2ZXJzaW9u IGhhcyB0aGUgZm9sbG93aW5nIGNoYW5nZXM6DQotICAgICAgICAgIFJlbW92ZWQgQUxQTiBuZWdv dGlhdGlvbiB0ZXh0Ow0KLSAgICAgICAgICBBZGRlZCBhIFNlY3VyaXR5IENvbnNpZGVyYXRpb25z IHN1Yi1zZWN0aW9uIGRpc2N1c3NpbmcgVG9rZW4gQmluZGluZyBrZXkgc2hhcmluZyBiZXR3ZWVu IGFwcGxpY2F0aW9uczsNCi0gICAgICAgICAgTWlub3IgZWRpdHMsIG5pdHMsIGV0Yy4NCg0KQ29t bWVudHMgYXJlIHZlcnkgd2VsY29tZSENCg0KQ2hlZXJzLA0KDQpBbmRyZWkNCl9fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQpVbmJlYXJhYmxlIG1haWxpbmcg bGlzdA0KVW5iZWFyYWJsZUBpZXRmLm9yZzxtYWlsdG86VW5iZWFyYWJsZUBpZXRmLm9yZz4NCmh0 dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vdW5iZWFyYWJsZQ0KDQo= --_000_BLUPR03MB13960580C29EEBBC9894C97F8C930BLUPR03MB1396namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6eD0idXJuOnNjaGVtYXMtbWljcm9z b2Z0LWNvbTpvZmZpY2U6ZXhjZWwiIHhtbG5zOm09Imh0dHA6Ly9zY2hlbWFzLm1pY3Jvc29mdC5j b20vb2ZmaWNlLzIwMDQvMTIvb21tbCIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnL1RSL1JFQy1o dG1sNDAiPg0KPGhlYWQ+DQo8bWV0YSBodHRwLWVxdWl2PSJDb250ZW50LVR5cGUiIGNvbnRlbnQ9 InRleHQvaHRtbDsgY2hhcnNldD11dGYtOCI+DQo8bWV0YSBuYW1lPSJHZW5lcmF0b3IiIGNvbnRl bnQ9Ik1pY3Jvc29mdCBXb3JkIDE1IChmaWx0ZXJlZCBtZWRpdW0pIj4NCjxzdHlsZT48IS0tDQov KiBGb250IERlZmluaXRpb25zICovDQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkhlbHZldGlj YTsNCglwYW5vc2UtMToyIDExIDYgNCAyIDIgMiAyIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQt ZmFtaWx5OldpbmdkaW5nczsNCglwYW5vc2UtMTo1IDAgMCAwIDAgMCAwIDAgMCAwO30NCkBmb250 LWZhY2UNCgl7Zm9udC1mYW1pbHk6IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1 IDQgNiAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3Nl LTE6MiAxNSA1IDIgMiAyIDQgMyAyIDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNv Tm9ybWFsLCBsaS5Nc29Ob3JtYWwsIGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJn aW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGlt ZXMgTmV3IFJvbWFuIixzZXJpZjt9DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1z dHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxp bmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1w cmlvcml0eTo5OTsNCgljb2xvcjpwdXJwbGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9 DQpwLk1zb0xpc3RQYXJhZ3JhcGgsIGxpLk1zb0xpc3RQYXJhZ3JhcGgsIGRpdi5Nc29MaXN0UGFy YWdyYXBoDQoJe21zby1zdHlsZS1wcmlvcml0eTozNDsNCgltYXJnaW4tdG9wOjBpbjsNCgltYXJn aW4tcmlnaHQ6MGluOw0KCW1hcmdpbi1ib3R0b206MGluOw0KCW1hcmdpbi1sZWZ0Oi41aW47DQoJ bWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMi4wcHQ7DQoJZm9udC1mYW1pbHk6 IlRpbWVzIE5ldyBSb21hbiIsc2VyaWY7fQ0Kc3Bhbi5hcHBsZS1jb252ZXJ0ZWQtc3BhY2UNCgl7 bXNvLXN0eWxlLW5hbWU6YXBwbGUtY29udmVydGVkLXNwYWNlO30NCnNwYW4uRW1haWxTdHlsZTE4 DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsOw0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5z LXNlcmlmOw0KCWNvbG9yOiMxRjQ5N0Q7fQ0Kc3Bhbi5FbWFpbFN0eWxlMjANCgl7bXNvLXN0eWxl LXR5cGU6cGVyc29uYWwtY29tcG9zZTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJp ZjsNCgljb2xvcjp3aW5kb3d0ZXh0O30NCi5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBl OmV4cG9ydC1vbmx5Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJ e3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBpbiAxLjBpbiAxLjBpbjt9DQpk aXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi8qIExpc3QgRGVmaW5pdGlv bnMgKi8NCkBsaXN0IGwwDQoJe21zby1saXN0LWlkOjExMjY1MDUyMzM7DQoJbXNvLWxpc3QtdHlw ZTpoeWJyaWQ7DQoJbXNvLWxpc3QtdGVtcGxhdGUtaWRzOi0xNDE2MjE3ODY2IC0yNDQwMjY3NDgg Njc2OTg2OTEgNjc2OTg2OTMgNjc2OTg2ODkgNjc2OTg2OTEgNjc2OTg2OTMgNjc2OTg2ODkgNjc2 OTg2OTEgNjc2OTg2OTM7fQ0KQGxpc3QgbDA6bGV2ZWwxDQoJe21zby1sZXZlbC1zdGFydC1hdDoy Ow0KCW1zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvg5g7 DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjps ZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7DQoJbXNv LWZhcmVhc3QtZm9udC1mYW1pbHk6Q2FsaWJyaTsNCgltc28tYmlkaS1mb250LWZhbWlseToiVGlt ZXMgTmV3IFJvbWFuIjt9DQpAbGlzdCBsMDpsZXZlbDINCgl7bXNvLWxldmVsLW51bWJlci1mb3Jt YXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Om87DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7 DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsN Cglmb250LWZhbWlseToiQ291cmllciBOZXciO30NCkBsaXN0IGwwOmxldmVsMw0KCXttc28tbGV2 ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZl bC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0 LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwwOmxldmVs NA0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3 Ow0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246 bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0 IGwwOmxldmVsNQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVs LXRleHQ6bzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBv c2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OiJDb3VyaWVy IE5ldyI7fQ0KQGxpc3QgbDA6bGV2ZWw2DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxl dDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNv LWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250 LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDA6bGV2ZWw3DQoJe21zby1sZXZlbC1udW1iZXIt Zm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9w Om5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0u MjVpbjsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDA6bGV2ZWw4DQoJe21zby1sZXZl bC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDpvOw0KCW1zby1sZXZlbC10 YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWlu ZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3Ijt9DQpAbGlzdCBsMDpsZXZl bDkNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+C pzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9u OmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpv bA0KCXttYXJnaW4tYm90dG9tOjBpbjt9DQp1bA0KCXttYXJnaW4tYm90dG9tOjBpbjt9DQotLT48 L3N0eWxlPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVkZWZhdWx0cyB2OmV4dD0i ZWRpdCIgc3BpZG1heD0iMTAyNiIgLz4NCjwveG1sPjwhW2VuZGlmXS0tPjwhLS1baWYgZ3RlIG1z byA5XT48eG1sPg0KPG86c2hhcGVsYXlvdXQgdjpleHQ9ImVkaXQiPg0KPG86aWRtYXAgdjpleHQ9 ImVkaXQiIGRhdGE9IjEiIC8+DQo8L286c2hhcGVsYXlvdXQ+PC94bWw+PCFbZW5kaWZdLS0+DQo8 L2hlYWQ+DQo8Ym9keSBsYW5nPSJFTi1VUyIgbGluaz0iYmx1ZSIgdmxpbms9InB1cnBsZSI+DQo8 ZGl2IGNsYXNzPSJXb3JkU2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0 eWxlPSJ0ZXh0LWluZGVudDotLjI1aW47bXNvLWxpc3Q6bDAgbGV2ZWwxIGxmbzEiPjwhW2lmICFz dXBwb3J0TGlzdHNdPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpXaW5nZGluZ3MiPjxzcGFuIHN0 eWxlPSJtc28tbGlzdDpJZ25vcmUiPsOYPHNwYW4gc3R5bGU9ImZvbnQ6Ny4wcHQgJnF1b3Q7VGlt ZXMgTmV3IFJvbWFuJnF1b3Q7Ij4mbmJzcDsNCjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwhW2VuZGlm XT5BcmUgeW91IHByb3NpbmcgdGhhdCB3ZSBhZG9wdCB0aGlzIGFzIGEgd29ya2luZyBncm91cCBk b2N1bWVudD88bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1z ZXJpZiI+PGEgaHJlZj0iaHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9kb2MvZHJhZnQtcG9w b3YtdG9rYmluZC1uZWdvdGlhdGlvbi8iPjxzcGFuIHN0eWxlPSJjb2xvcjp3aW5kb3d0ZXh0Ij5o dHRwczovL2RhdGF0cmFja2VyLmlldGYub3JnL2RvYy9kcmFmdC1wb3Bvdi10b2tiaW5kLW5lZ290 aWF0aW9uLzwvc3Bhbj48L2E+DQo8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5pcyB3cml0dGVuIGlu IHN1cHBvcnQgb2YgV0figJlzIGRlY2lzaW9uIGluIERhbGxhcyB0byB1c2UgYSBuZXcgVExTIGV4 dGVuc2lvbiB0byBuZWdvdGlhdGUgVG9rZW4gQmluZGluZyBwYXJhbWV0ZXJzIChpbnN0ZWFkIG9m IEFMUE4pLiBJIGhvcGUgdGhhdCB3ZSBjYW4gY29udGludWUgZGlzY3Vzc2luZyB0aGlzIEktRCBv biB0aGUNCiBtYWlsaW5nIGxpc3QgYW5kIGNvbnZlcmdlIGluIFByYWd1ZS4gSWYgdGhlIFdHIGFn cmVlcyB0aGF0IHRoaXMgaXMgdGhlIHJpZ2h0IGFwcHJvYWNoIG92ZXJhbGwsIEkgdGhpbmsgd2Ug c2hvdWxkIHByb2NlZWQgd2l0aCBhIGNhbGwgZm9yIGFkb3B0aW9uLCB3aXRoIGZ1bGwgZXhwZWN0 YXRpb24gdGhhdCB0aGUgZG9jdW1lbnQgd2lsbCBrZWVwIGV2b2x2aW5nLjxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+PG86cD4mbmJz cDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJ0 ZXh0LWluZGVudDotLjI1aW47bXNvLWxpc3Q6bDAgbGV2ZWwxIGxmbzEiPjwhW2lmICFzdXBwb3J0 TGlzdHNdPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpXaW5nZGluZ3MiPjxzcGFuIHN0eWxlPSJt c28tbGlzdDpJZ25vcmUiPsOYPHNwYW4gc3R5bGU9ImZvbnQ6Ny4wcHQgJnF1b3Q7VGltZXMgTmV3 IFJvbWFuJnF1b3Q7Ij4mbmJzcDsNCjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwhW2VuZGlmXT5JIGhh dmVu4oCZdCBzZWVuIGFueSBmZWVkYmFjayB0byB0aGlzIG9uIHRoZSBsaXN0LjxvOnA+PC9vOnA+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5UaGVyZSBoYXMgYmVl biBzb21lIGRpc2N1c3Npb246PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2Fs aWJyaSZxdW90OyxzYW5zLXNlcmlmIj48YSBocmVmPSJodHRwczovL21haWxhcmNoaXZlLmlldGYu b3JnL2FyY2gvbXNnL3VuYmVhcmFibGUvUjV1YWtJZUhuZDJkWU16ZFkxelRvSGJ4QktvIj48c3Bh biBzdHlsZT0iY29sb3I6d2luZG93dGV4dCI+aHR0cHM6Ly9tYWlsYXJjaGl2ZS5pZXRmLm9yZy9h cmNoL21zZy91bmJlYXJhYmxlL1I1dWFrSWVIbmQyZFlNemRZMXpUb0hieEJLbzwvc3Bhbj48L2E+ DQogLSB0aGUgcHJvcG9zYWwgdG8gaGFybW9uaXplIGFsZ29yaXRobSBJRHMgYmV0d2VlbiBUQk5F R08gYW5kIFRCUFJPVE87PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJy aSZxdW90OyxzYW5zLXNlcmlmIj48YSBocmVmPSJodHRwczovL21haWxhcmNoaXZlLmlldGYub3Jn L2FyY2gvbXNnL3VuYmVhcmFibGUvMHc4X0YwSDYzVFdwQWI5eF9WOFNvclpUMGxnIj48c3BhbiBz dHlsZT0iY29sb3I6d2luZG93dGV4dCI+aHR0cHM6Ly9tYWlsYXJjaGl2ZS5pZXRmLm9yZy9hcmNo L21zZy91bmJlYXJhYmxlLzB3OF9GMEg2M1RXcEFiOXhfVjhTb3JaVDBsZzwvc3Bhbj48L2E+DQog LSBhbW9uZyBvdGhlcnMsIGFuIGlkZWEgdGhhdCBtdWx0aXBsZSBUQiBwYXJhbWV0ZXIgc2V0cyBj b3VsZCBiZSBuZWdvdGlhdGVkLCBlLmcuIHRoZSBzZXJ2ZXIgY291bGQgcmV0dXJuIGJvdGggcnNh MjA0OF9wa2NzMS41X3NoYTI1NigwKSBhbmQgJm5ic3A7ZWNkc2FwMjU2X3NoYTI1Ni48bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPk9u IGJvdGggb2YgdGhlc2UsIEnigJlkIGxpa2UgdG8gc2VlIGEgZGVncmVlIG9mIGNvbnNlbnN1cyBm cm9tIHRoZSBXRywgYmVmb3JlIG1ha2luZyB0aGUgY2hhbmdlcy48bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+Jm5ic3A7PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBoIiBzdHlsZT0idGV4dC1p bmRlbnQ6LS4yNWluO21zby1saXN0OmwwIGxldmVsMSBsZm8xIj48IVtpZiAhc3VwcG9ydExpc3Rz XT48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6V2luZ2RpbmdzIj48c3BhbiBzdHlsZT0ibXNvLWxp c3Q6SWdub3JlIj7DmDxzcGFuIHN0eWxlPSJmb250OjcuMHB0ICZxdW90O1RpbWVzIE5ldyBSb21h biZxdW90OyI+Jm5ic3A7DQo8L3NwYW4+PC9zcGFuPjwvc3Bhbj48IVtlbmRpZl0+SWYgdGhlcmUg YXJlIGFueSBpc3N1ZXMgd2l0aCB0aGF0LCBsZXRzIGRpc2N1c3MgaXQgb24gdGhlIGxpc3QgYmVm b3JlIHdlIGdldCB0byBQcmFndWUuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWYiPlllcywgdGhpcyB3b3VsZCBiZSBhd2Vzb21lITxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+PG86cD4m bmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmIj5DaGVlcnMsPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZx dW90OyxzYW5zLXNlcmlmIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkFuZHJlaTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpw PiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7 Ym9yZGVyLXRvcDpzb2xpZCAjRTFFMUUxIDEuMHB0O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4i Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5Gcm9tOjwvc3Bhbj48 L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJy aSZxdW90OyxzYW5zLXNlcmlmIj4gSm9obiBCcmFkbGV5IFttYWlsdG86dmU3anRiQHZlN2p0Yi5j b21dDQo8YnI+DQo8Yj5TZW50OjwvYj4gU3VuZGF5LCBKdWx5IDUsIDIwMTUgMToyNyBQTTxicj4N CjxiPlRvOjwvYj4gQW5kcmVpIFBvcG92PGJyPg0KPGI+Q2M6PC9iPiB1bmJlYXJhYmxlQGlldGYu b3JnPGJyPg0KPGI+U3ViamVjdDo8L2I+IFJlOiBbVW5iZWFyYWJsZV0gTmV3IGFuZCBVcGRhdGVk IEktRHM8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JIGhh dmVu4oCZdCBzZWVuIGFueSBmZWVkYmFjayB0byB0aGlzIG9uIHRoZSBsaXN0LjxvOnA+PC9vOnA+ PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+QXJlIHlvdSBwcm9zaW5nIHRoYXQg d2UgYWRvcHQgdGhpcyBhcyBhIHdvcmtpbmcgZ3JvdXAgZG9jdW1lbnQ/PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPklmIHRoZXJlIGFyZSBhbnkg aXNzdWVzIHdpdGggdGhhdCwgbGV0cyBkaXNjdXNzIGl0IG9uIHRoZSBsaXN0IGJlZm9yZSB3ZSBn ZXQgdG8gUHJhZ3VlLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj5Kb2huIEIuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxibG9ja3F1b3Rl IHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPk9uIEp1biAxNiwgMjAxNSwgYXQgNDozMCBQTSwgQW5kcmVpIFBv cG92ICZsdDs8YSBocmVmPSJtYWlsdG86QW5kcmVpLlBvcG92QG1pY3Jvc29mdC5jb20iPkFuZHJl aS5Qb3BvdkBtaWNyb3NvZnQuY29tPC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+ QWxzbywgcGxlYXNlIGZlZWwgZnJlZSB0byB1c2UgR2l0SHViIHRvIHRyYWNrIGlzc3VlcyBhbmQg bWFrZSBwdWxsIHJlcXVlc3RzOjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZu YnNwOzwvc3Bhbj48YSBocmVmPSJodHRwczovL2dpdGh1Yi5jb20vVG9rZW5CaW5kaW5nL0ludGVy bmV0LURyYWZ0cyI+PHNwYW4gc3R5bGU9ImNvbG9yOiM5NTRGNzIiPmh0dHBzOi8vZ2l0aHViLmNv bS9Ub2tlbkJpbmRpbmcvSW50ZXJuZXQtRHJhZnRzPC9zcGFuPjwvYT48L3NwYW4+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5z LXNlcmlmIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+Jm5ic3A7PC9zcGFuPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssc2Fucy1zZXJpZiI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPk5vdyB0aGF0 IHdlIGhhdmUgVEJORUdPIEktRCwgSeKAmXZlIGNsb3NlZCBhIGNvdXBsZSBvZiBpc3N1ZXMgcmVs YXRlZCB0byB0aGUgdXNlIG9mIEFMUE4uPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+PG86cD48L286 cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90Oyxz YW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPiZuYnNwOzwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPjxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkm cXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5DaGVlcnMsPC9zcGFuPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1z ZXJpZiI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPiZuYnNwOzwvc3Bhbj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7 LHNhbnMtc2VyaWYiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5BbmRyZWk8L3Nw YW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJy aSZxdW90OyxzYW5zLXNlcmlmIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+Jm5i c3A7PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjRTFFMUUx IDEuMHB0O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4iPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+RnJvbTo8L3NwYW4+PC9iPjxzcGFuIGNsYXNzPSJh cHBsZS1jb252ZXJ0ZWQtc3BhY2UiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PC9zcGFuPjwvc3Bh bj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWYiPkFuZHJlaQ0KIFBvcG92PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZl cnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjxicj4NCjxiPlNlbnQ6PC9iPjxzcGFuIGNsYXNzPSJh cHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj5GcmlkYXksIE1heSAyOSwgMjAxNSA0 OjU0IFBNPGJyPg0KPGI+VG86PC9iPjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2Ui PiZuYnNwOzwvc3Bhbj48YSBocmVmPSJtYWlsdG86dW5iZWFyYWJsZUBpZXRmLm9yZyI+PHNwYW4g c3R5bGU9ImNvbG9yOiM5NTRGNzIiPnVuYmVhcmFibGVAaWV0Zi5vcmc8L3NwYW4+PC9hPjxicj4N CjxiPlN1YmplY3Q6PC9iPjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNw Ozwvc3Bhbj5OZXcgYW5kIFVwZGF0ZWQgSS1EczxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2 Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMt c2VyaWYiPiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+SW4gRGFsbGFzIHdlIGFncmVlZCB0byBk ZWZpbmUgYSBuZXcgVExTIGV4dGVuc2lvbiBmb3IgVG9rZW4gQmluZGluZyBrZXkgcGFyYW1ldGVy cyBuZWdvdGlhdGlvbiwgaW5zdGVhZCBvZiB1c2luZyBBTFBOLjxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+ Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5Ub2RheSBJ4oCZdmUgc3VibWl0dGVkIFRMUyBFeHRl bnNpb24gZm9yIFRva2VuIEJpbmRpbmcgUHJvdG9jb2wgTmVnb3RpYXRpb24gJm5ic3A7SS1EOjxz cGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48YSBocmVmPSJo dHRwczovL2RhdGF0cmFja2VyLmlldGYub3JnL2RvYy9kcmFmdC1wb3Bvdi10b2tiaW5kLW5lZ290 aWF0aW9uLyI+PHNwYW4gc3R5bGU9ImNvbG9yOiM5NTRGNzIiPmh0dHBzOi8vZGF0YXRyYWNrZXIu aWV0Zi5vcmcvZG9jL2RyYWZ0LXBvcG92LXRva2JpbmQtbmVnb3RpYXRpb24vPC9zcGFuPjwvYT48 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+SSBoYXZlIGFsc28g dXBkYXRlZCB0aGUgVG9rZW4gQmluZGluZyBQcm90b2NvbCBJLUQ6PHNwYW4gY2xhc3M9ImFwcGxl LWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjxhIGhyZWY9Imh0dHBzOi8vdG9vbHMuaWV0 Zi5vcmcvaHRtbC9kcmFmdC1pZXRmLXRva2JpbmQtcHJvdG9jb2wtMDEiPjxzcGFuIHN0eWxlPSJj b2xvcjojOTU0RjcyIj5odHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQtaWV0Zi10b2ti aW5kLXByb3RvY29sLTAxPC9zcGFuPjwvYT48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPlRoZSB1cGRhdGVk IHZlcnNpb24gaGFzIHRoZSBmb2xsb3dpbmcgY2hhbmdlczo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9InRleHQtaW5kZW50Oi0uMjVpbiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4tPC9zcGFu PjxzcGFuIHN0eWxlPSJmb250LXNpemU6Ny4wcHQiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOzxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQt c3BhY2UiPiZuYnNwOzwvc3Bhbj48L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5SZW1vdmVkDQogQUxQ TiBuZWdvdGlhdGlvbiB0ZXh0OzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdiBz dHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0idGV4 dC1pbmRlbnQ6LS4yNWluIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPi08L3NwYW4+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZTo3LjBwdCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9z cGFuPjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkFkZGVkDQogYSBTZWN1cml0eSBDb25zaWRlcmF0 aW9ucyBzdWItc2VjdGlvbiBkaXNjdXNzaW5nIFRva2VuIEJpbmRpbmcga2V5IHNoYXJpbmcgYmV0 d2VlbiBhcHBsaWNhdGlvbnM7PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2IHN0 eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJ0ZXh0 LWluZGVudDotLjI1aW4iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+LTwvc3Bhbj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjcuMHB0Ij4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDs8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3Nw YW4+PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+TWlub3INCiBlZGl0cywgbml0cywgZXRjLjxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssc2Fucy1zZXJpZiI+Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5Db21tZW50cyBhcmUgdmVy eSB3ZWxjb21lITxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5D aGVlcnMsPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkFuZHJl aTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVv dDssc2Fucy1zZXJpZiI+X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX188YnI+DQpVbmJlYXJhYmxlIG1haWxpbmcgbGlzdDxicj4NCjwvc3Bhbj48YSBocmVmPSJt YWlsdG86VW5iZWFyYWJsZUBpZXRmLm9yZyI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtm b250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojOTU0Rjcy Ij5VbmJlYXJhYmxlQGlldGYub3JnPC9zcGFuPjwvYT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjku MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj48YnI+DQo8 L3NwYW4+PGEgaHJlZj0iaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby91bmJl YXJhYmxlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hl bHZldGljYSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiM5NTRGNzIiPmh0dHBzOi8vd3d3LmlldGYu b3JnL21haWxtYW4vbGlzdGluZm8vdW5iZWFyYWJsZTwvc3Bhbj48L2E+PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86 cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ib2R5Pg0KPC9odG1sPg0K --_000_BLUPR03MB13960580C29EEBBC9894C97F8C930BLUPR03MB1396namp_-- From nobody Mon Jul 6 16:32:36 2015 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0E8AD1A1B22 for ; Mon, 6 Jul 2015 16:32:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.559 X-Spam-Level: X-Spam-Status: No, score=-6.559 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HELO_EQ_FR=0.35, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id e-xGQBa4ZPGJ for ; Mon, 6 Jul 2015 16:32:30 -0700 (PDT) Received: from mail3-relais-sop.national.inria.fr (mail3-relais-sop.national.inria.fr [192.134.164.104]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 44DF91A1AB8 for ; Mon, 6 Jul 2015 16:32:30 -0700 (PDT) X-IronPort-AV: E=Sophos;i="5.15,418,1432591200"; d="asc'?scan'208,217";a="139162168" Received: from pool-71-161-84-157.cncdnh.east.myfairpoint.net (HELO [192.168.0.101]) ([71.161.84.157]) by mail3-relais-sop.national.inria.fr with ESMTP/TLS/DHE-RSA-AES256-SHA; 07 Jul 2015 01:32:26 +0200 Mime-Version: 1.0 (Mac OS X Mail 8.2 \(2098\)) Content-Type: multipart/signed; boundary="Apple-Mail=_0D413948-0E12-403E-A3E7-D38AE75EF578"; protocol="application/pgp-signature"; micalg=pgp-sha512 X-Pgp-Agent: GPGMail 2.5 From: Karthikeyan Bhargavan In-Reply-To: Date: Mon, 6 Jul 2015 19:32:24 -0400 Message-Id: References: <411B772B-7DEF-4B55-B367-69B5D3DAC3B9@ve7jtb.com> To: Andrei Popov X-Mailer: Apple Mail (2.2098) Archived-At: Cc: John Bradley , "unbearable@ietf.org" Subject: Re: [Unbearable] New and Updated I-Ds X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Jul 2015 23:32:34 -0000 --Apple-Mail=_0D413948-0E12-403E-A3E7-D38AE75EF578 Content-Type: multipart/alternative; boundary="Apple-Mail=_33A78F56-10A6-4AD6-8E27-EB86556A24C6" --Apple-Mail=_33A78F56-10A6-4AD6-8E27-EB86556A24C6 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 This has probably been discussed before, and if so, please excuse the = question. (I couldn=E2=80=99t easily find an answer in the archives.) The current proposals bind tokens to the tls-unique channel binding, = which corresponds to a specific handshake. This means that when an authenticated session is resumed on a new = connection, a new token would need to be issued (so probably the user would have to authenticate again.) Is = this intended? Resumption is not going away anytime soon, and I=E2=80=99ve been told = that a majority of web connections use resumption, so reissuing tokens for a majority of new connections seems excessive. = Would there be interest in using a channel binding that persists across resumption? Best, Karthik > On 06 Jul 2015, at 12:32, Andrei Popov = wrote: >=20 > =C3=98 Are you prosing that we adopt this as a working group = document? > https://datatracker.ietf.org/doc/draft-popov-tokbind-negotiation/ = is = written in support of WG=E2=80=99s decision in Dallas to use a new TLS = extension to negotiate Token Binding parameters (instead of ALPN). I = hope that we can continue discussing this I-D on the mailing list and = converge in Prague. If the WG agrees that this is the right approach = overall, I think we should proceed with a call for adoption, with full = expectation that the document will keep evolving. >=20 > =C3=98 I haven=E2=80=99t seen any feedback to this on the list. > There has been some discussion: > = https://mailarchive.ietf.org/arch/msg/unbearable/R5uakIeHnd2dYMzdY1zToHbxB= Ko = - the proposal to harmonize algorithm IDs between TBNEGO and = TBPROTO; > = https://mailarchive.ietf.org/arch/msg/unbearable/0w8_F0H63TWpAb9x_V8SorZT0= lg = - among others, an idea that multiple TB parameter sets could be = negotiated, e.g. the server could return both rsa2048_pkcs1.5_sha256(0) = and ecdsap256_sha256. > On both of these, I=E2=80=99d like to see a degree of consensus from = the WG, before making the changes. >=20 > =C3=98 If there are any issues with that, lets discuss it on the list = before we get to Prague. > Yes, this would be awesome! >=20 > Cheers, >=20 > Andrei >=20 > From: John Bradley [mailto:ve7jtb@ve7jtb.com] > Sent: Sunday, July 5, 2015 1:27 PM > To: Andrei Popov > Cc: unbearable@ietf.org > Subject: Re: [Unbearable] New and Updated I-Ds >=20 > I haven=E2=80=99t seen any feedback to this on the list. >=20 > Are you prosing that we adopt this as a working group document? >=20 > If there are any issues with that, lets discuss it on the list before = we get to Prague. >=20 > John B. >=20 >=20 > On Jun 16, 2015, at 4:30 PM, Andrei Popov > wrote: >=20 > Also, please feel free to use GitHub to track issues and make pull = requests: https://github.com/TokenBinding/Internet-Drafts = >=20 > Now that we have TBNEGO I-D, I=E2=80=99ve closed a couple of issues = related to the use of ALPN. >=20 > Cheers, >=20 > Andrei >=20 > From: Andrei Popov > Sent: Friday, May 29, 2015 4:54 PM > To: unbearable@ietf.org > Subject: New and Updated I-Ds >=20 > In Dallas we agreed to define a new TLS extension for Token Binding = key parameters negotiation, instead of using ALPN. >=20 > Today I=E2=80=99ve submitted TLS Extension for Token Binding Protocol = Negotiation I-D: = https://datatracker.ietf.org/doc/draft-popov-tokbind-negotiation/ = >=20 > I have also updated the Token Binding Protocol I-D: = https://tools.ietf.org/html/draft-ietf-tokbind-protocol-01 = > The updated version has the following changes: > - Removed ALPN negotiation text; > - Added a Security Considerations sub-section discussing = Token Binding key sharing between applications; > - Minor edits, nits, etc. >=20 > Comments are very welcome! >=20 > Cheers, >=20 > Andrei > _______________________________________________ > Unbearable mailing list > Unbearable@ietf.org > https://www.ietf.org/mailman/listinfo/unbearable = >=20 > _______________________________________________ > Unbearable mailing list > Unbearable@ietf.org > https://www.ietf.org/mailman/listinfo/unbearable --Apple-Mail=_33A78F56-10A6-4AD6-8E27-EB86556A24C6 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 This has probably been discussed before, and if so, please = excuse the question. (I couldn=E2=80=99t easily find an answer in the = archives.)

The = current proposals bind tokens to the tls-unique channel binding, which = corresponds to a specific handshake.
This means = that when an authenticated session is resumed on a new connection, a new = token would need to
be issued (so probably the user = would have to authenticate again.) Is this intended? 

Resumption is not going = away anytime soon, and I=E2=80=99ve been told that a majority of web = connections use resumption,
so reissuing tokens for = a majority of new connections seems excessive. Would there be interest = in using a channel
binding that persists across = resumption?

Best,
Karthik


On 06 Jul 2015, at 12:32, Andrei Popov <Andrei.Popov@microsoft.com> wrote:

=C3=98  Are = you prosing that we adopt this as a working group document?
https://datatracker.ietf.org/doc/draft-popov-tokbind-negotiatio= n/ is= written in support of WG=E2=80=99s decision in Dallas to use a new TLS = extension to negotiate Token Binding parameters (instead of ALPN). I = hope that we can continue discussing this I-D on the mailing list and = converge in Prague. If the WG agrees that this is the right approach = overall, I think we should proceed with a call for adoption, with full = expectation that the document will keep evolving.
 
=C3=98  I = haven=E2=80=99t seen any feedback to this on the list.
There has been some discussion:
https://mailarchive.ietf.org/arch/msg/unbearable/R5uakIeHnd2dYM= zdY1zToHbxBKo - the proposal to harmonize = algorithm IDs between TBNEGO and TBPROTO;
https://mailarchive.ietf.org/arch/msg/unbearable/0w8_F0H63TWpAb= 9x_V8SorZT0lg - among others, an idea = that multiple TB parameter sets could be negotiated, e.g. the server = could return both rsa2048_pkcs1.5_sha256(0) and =  ecdsap256_sha256.
On both of these, I=E2=80=99= d like to see a degree of consensus from the WG, before making the = changes.
 
=C3=98  If = there are any issues with that, lets discuss it on the list before we = get to Prague.
Yes, this would be awesome!
 
Cheers,
 
Andrei
 
From: John Bradley [mailto:ve7jtb@ve7jtb.com] 
Sent: Sunday, July 5, 2015 1:27 = PM
To: Andrei Popov
Cc: unbearable@ietf.org
Subject: Re: [Unbearable] New and = Updated I-Ds
 
I haven=E2=80=99t seen any feedback to = this on the list.
 
Are you prosing that we adopt this as a working group = document?
 
If there are any issues with that, lets discuss it on = the list before we get to Prague.
 
John B.
 
 
On = Jun 16, 2015, at 4:30 PM, Andrei Popov <Andrei.Popov@microsoft.com>= wrote:
 
Also, please feel free to use GitHub to = track issues and make pull requests: https://github.com/TokenBinding/Internet-Drafts
 
Now that we have TBNEGO = I-D, I=E2=80=99ve closed a couple of issues related to the use of = ALPN.
 
Cheers,
 
Andrei
 
From: Andrei Popov 
Sent: Friday, May 29, 2015 4:54 = PM
To: unbearable@ietf.org
Subject: New and Updated I-Ds
 
In Dallas we agreed to define a new TLS = extension for Token Binding key parameters negotiation, instead of using = ALPN.
 
Today I=E2=80=99ve submitted TLS Extension for = Token Binding Protocol Negotiation  I-D: https://datatracker.ietf.org/doc/draft-popov-tokbind-negotiatio= n/
 
I have also updated the Token Binding Protocol = I-D: https://tools.ietf.org/html/draft-ietf-tokbind-protocol-01
The updated version has = the following changes:
-          Removed ALPN negotiation text;
-          Added a Security Considerations sub-section discussing Token = Binding key sharing between applications;
-          Minor edits, nits, etc.
 
Comments are very welcome!
 
Cheers,
 
Andrei
_______________________________________________Unbearable mailing list
Unbearable@ietf.org
https://www.ietf.org/mailman/listinfo/unbearable
 
_______________________________________________
Unbearable mailing list
Unbearable@ietf.org
https://www.ietf.org/mailman/listinfo/unbearable
= --Apple-Mail=_33A78F56-10A6-4AD6-8E27-EB86556A24C6-- --Apple-Mail=_0D413948-0E12-403E-A3E7-D38AE75EF578 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP using GPGMail -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org iQEcBAEBCgAGBQJVmxAIAAoJEB/WSo9veuUKypEH/2yle/pMRtfO5rGiuDd9mBLE B7HyutRa0nBaKaAwFDrVxupDIJMJSF7rmh7+IV0KC+DWQwU437hP3ilJ4VXQ/06p 35zWizCQcsACYelh4xSVxHNY4MJiDji4vB+JKQLqPwsrCcwI+CfFbm6COPH4DDKP XEbauiY8A5HNcfZ6yK4b2PUofGeHVREcEtfKBY1VegRdNasmKU0XlFLDLMiDpWsx IKsQ3HvpF/Iy6i2TL6cvK2Ti6tlkife5ziM6mf2YYuAChNgrhTp6iDMlP1Lsx1KU 1D+yTMf7PplmnBx9k8j9DV4/P9sdQPTjVtuu8edShEUK4JXx5ubp+E7D2MWNgto= =r3h/ -----END PGP SIGNATURE----- --Apple-Mail=_0D413948-0E12-403E-A3E7-D38AE75EF578-- From nobody Mon Jul 6 16:44:51 2015 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E672A1A1B56 for ; Mon, 6 Jul 2015 16:44:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HQNZTO1TLrKG for ; Mon, 6 Jul 2015 16:44:47 -0700 (PDT) Received: from na01-bl2-obe.outbound.protection.outlook.com (mail-bl2on0136.outbound.protection.outlook.com [65.55.169.136]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 983D21A1BA7 for ; Mon, 6 Jul 2015 16:44:46 -0700 (PDT) Received: from BLUPR03MB1396.namprd03.prod.outlook.com (10.163.81.142) by BLUPR03MB1396.namprd03.prod.outlook.com (10.163.81.142) with Microsoft SMTP Server (TLS) id 15.1.207.19; Mon, 6 Jul 2015 23:44:44 +0000 Received: from BLUPR03MB1396.namprd03.prod.outlook.com ([10.163.81.142]) by BLUPR03MB1396.namprd03.prod.outlook.com ([10.163.81.142]) with mapi id 15.01.0207.004; Mon, 6 Jul 2015 23:44:44 +0000 From: Andrei Popov To: Karthikeyan Bhargavan Thread-Topic: [Unbearable] New and Updated I-Ds Thread-Index: AdCaaI/uZjPJTA7KT/apdeAdcrT1+gOAYUOAA725qQAAKUQwMAAPfaMAAABU2zA= Date: Mon, 6 Jul 2015 23:44:44 +0000 Message-ID: References: <411B772B-7DEF-4B55-B367-69B5D3DAC3B9@ve7jtb.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: inria.fr; dkim=none (message not signed) header.d=none; x-originating-ip: [2001:4898:80e8:ee31::5] x-microsoft-exchange-diagnostics: 1; BLUPR03MB1396; 5:ojlJjRjDLelROmWaOoc12Q/8KdlcERtswbQ/f5sbmDhGZSgL4fTlPIcAvRkCdu9jXIKQ+Mwb+tOdrZaSMda69InOPVEa29FJmuwQVQarFYz2OLZ5EOjdnpVNrLwKV15itvagiFoosXVS4yILVCI2iw==; 24:poXmLwGd8aDh/lDS9JfvjxgmDDXXyf51KbRmoe1iRPNUWUA8nN1WVdBF1lxzVpkyZyQHEEhvX7hTPsC0hqx7jSpCfdUXrF3XLJxqzlH6UtU=; 20:J/CBaYIj9Wh3Am+GllnaeSoQKzZofG/sKDrj3z0eqHyU2uVAJYb9AKIsTMTBbEYd3lgXLuHwyZ3ASG/h3hpmaA== x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:BLUPR03MB1396; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(108003899814671); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(601004)(2401001)(5005006)(3002001); SRVR:BLUPR03MB1396; BCL:0; PCL:0; RULEID:; SRVR:BLUPR03MB1396; x-forefront-prvs: 06290ECA9D x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(52044002)(24454002)(377454003)(62966003)(7110500001)(74316001)(5003600100002)(93886004)(189998001)(561944003)(19625215002)(77156002)(19580405001)(19580395003)(76576001)(99286002)(5002640100001)(122556002)(5001960100002)(40100003)(19300405004)(92566002)(110136002)(33656002)(46102003)(19609705001)(5001920100001)(2900100001)(2950100001)(19617315012)(2420400003)(575784001)(15975445007)(86362001)(50986999)(16236675004)(77096005)(87936001)(2656002)(54356999)(102836002)(76176999)(3826002); DIR:OUT; SFP:1102; SCL:1; SRVR:BLUPR03MB1396; H:BLUPR03MB1396.namprd03.prod.outlook.com; FPR:; SPF:None; MLV:sfv; LANG:en; Content-Type: multipart/alternative; boundary="_000_BLUPR03MB1396E04B05EF4E7463C8ED928C930BLUPR03MB1396namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 06 Jul 2015 23:44:44.0248 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: BLUPR03MB1396 Archived-At: Cc: John Bradley , "unbearable@ietf.org" Subject: Re: [Unbearable] New and Updated I-Ds X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Jul 2015 23:44:50 -0000 --_000_BLUPR03MB1396E04B05EF4E7463C8ED928C930BLUPR03MB1396namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGkgS2FydGhpaywNCg0KDQrDmCAgVGhlIGN1cnJlbnQgcHJvcG9zYWxzIGJpbmQgdG9rZW5zIHRv IHRoZSB0bHMtdW5pcXVlIGNoYW5uZWwgYmluZGluZywgd2hpY2ggY29ycmVzcG9uZHMgdG8gYSBz cGVjaWZpYyBoYW5kc2hha2UuDQoNCsOYICBUaGlzIG1lYW5zIHRoYXQgd2hlbiBhbiBhdXRoZW50 aWNhdGVkIHNlc3Npb24gaXMgcmVzdW1lZCBvbiBhIG5ldyBjb25uZWN0aW9uLCBhIG5ldyB0b2tl biB3b3VsZCBuZWVkIHRvDQoNCsOYICBiZSBpc3N1ZWQgKHNvIHByb2JhYmx5IHRoZSB1c2VyIHdv dWxkIGhhdmUgdG8gYXV0aGVudGljYXRlIGFnYWluLikgSXMgdGhpcyBpbnRlbmRlZD8NCg0KTm8s IHRoZSBjdXJyZW50IHByb3Bvc2FscyBiaW5kIHRoZSB0b2tlbiB0byBhIGxvbmctbGl2ZWQgcGVy c2lzdGVudCBrZXksIHNvIHRoZSB0b2tlbiByZW1haW5zIHZhbGlkIGFjcm9zcyBUTFMgc2Vzc2lv bnMgYW5kIFRMUyBjb25uZWN0aW9ucy4NCg0KQ2hlZXJzLA0KDQpBbmRyZWkNCg0KDQpGcm9tOiBL YXJ0aGlrZXlhbiBCaGFyZ2F2YW4gW21haWx0bzprYXJ0aGlrZXlhbi5iaGFyZ2F2YW5AaW5yaWEu ZnJdDQpTZW50OiBNb25kYXksIEp1bHkgNiwgMjAxNSA0OjMyIFBNDQpUbzogQW5kcmVpIFBvcG92 DQpDYzogSm9obiBCcmFkbGV5OyB1bmJlYXJhYmxlQGlldGYub3JnDQpTdWJqZWN0OiBSZTogW1Vu YmVhcmFibGVdIE5ldyBhbmQgVXBkYXRlZCBJLURzDQoNClRoaXMgaGFzIHByb2JhYmx5IGJlZW4g ZGlzY3Vzc2VkIGJlZm9yZSwgYW5kIGlmIHNvLCBwbGVhc2UgZXhjdXNlIHRoZSBxdWVzdGlvbi4g KEkgY291bGRu4oCZdCBlYXNpbHkgZmluZCBhbiBhbnN3ZXIgaW4gdGhlIGFyY2hpdmVzLikNCg0K VGhlIGN1cnJlbnQgcHJvcG9zYWxzIGJpbmQgdG9rZW5zIHRvIHRoZSB0bHMtdW5pcXVlIGNoYW5u ZWwgYmluZGluZywgd2hpY2ggY29ycmVzcG9uZHMgdG8gYSBzcGVjaWZpYyBoYW5kc2hha2UuDQpU aGlzIG1lYW5zIHRoYXQgd2hlbiBhbiBhdXRoZW50aWNhdGVkIHNlc3Npb24gaXMgcmVzdW1lZCBv biBhIG5ldyBjb25uZWN0aW9uLCBhIG5ldyB0b2tlbiB3b3VsZCBuZWVkIHRvDQpiZSBpc3N1ZWQg KHNvIHByb2JhYmx5IHRoZSB1c2VyIHdvdWxkIGhhdmUgdG8gYXV0aGVudGljYXRlIGFnYWluLikg SXMgdGhpcyBpbnRlbmRlZD8NCg0KUmVzdW1wdGlvbiBpcyBub3QgZ29pbmcgYXdheSBhbnl0aW1l IHNvb24sIGFuZCBJ4oCZdmUgYmVlbiB0b2xkIHRoYXQgYSBtYWpvcml0eSBvZiB3ZWIgY29ubmVj dGlvbnMgdXNlIHJlc3VtcHRpb24sDQpzbyByZWlzc3VpbmcgdG9rZW5zIGZvciBhIG1ham9yaXR5 IG9mIG5ldyBjb25uZWN0aW9ucyBzZWVtcyBleGNlc3NpdmUuIFdvdWxkIHRoZXJlIGJlIGludGVy ZXN0IGluIHVzaW5nIGEgY2hhbm5lbA0KYmluZGluZyB0aGF0IHBlcnNpc3RzIGFjcm9zcyByZXN1 bXB0aW9uPw0KDQpCZXN0LA0KS2FydGhpaw0KDQoNCk9uIDA2IEp1bCAyMDE1LCBhdCAxMjozMiwg QW5kcmVpIFBvcG92IDxBbmRyZWkuUG9wb3ZAbWljcm9zb2Z0LmNvbTxtYWlsdG86QW5kcmVpLlBv cG92QG1pY3Jvc29mdC5jb20+PiB3cm90ZToNCg0KPiAgQXJlIHlvdSBwcm9zaW5nIHRoYXQgd2Ug YWRvcHQgdGhpcyBhcyBhIHdvcmtpbmcgZ3JvdXAgZG9jdW1lbnQ/DQpodHRwczovL2RhdGF0cmFj a2VyLmlldGYub3JnL2RvYy9kcmFmdC1wb3Bvdi10b2tiaW5kLW5lZ290aWF0aW9uLyBpcyB3cml0 dGVuIGluIHN1cHBvcnQgb2YgV0figJlzIGRlY2lzaW9uIGluIERhbGxhcyB0byB1c2UgYSBuZXcg VExTIGV4dGVuc2lvbiB0byBuZWdvdGlhdGUgVG9rZW4gQmluZGluZyBwYXJhbWV0ZXJzIChpbnN0 ZWFkIG9mIEFMUE4pLiBJIGhvcGUgdGhhdCB3ZSBjYW4gY29udGludWUgZGlzY3Vzc2luZyB0aGlz IEktRCBvbiB0aGUgbWFpbGluZyBsaXN0IGFuZCBjb252ZXJnZSBpbiBQcmFndWUuIElmIHRoZSBX RyBhZ3JlZXMgdGhhdCB0aGlzIGlzIHRoZSByaWdodCBhcHByb2FjaCBvdmVyYWxsLCBJIHRoaW5r IHdlIHNob3VsZCBwcm9jZWVkIHdpdGggYSBjYWxsIGZvciBhZG9wdGlvbiwgd2l0aCBmdWxsIGV4 cGVjdGF0aW9uIHRoYXQgdGhlIGRvY3VtZW50IHdpbGwga2VlcCBldm9sdmluZy4NCg0KPiAgSSBo YXZlbuKAmXQgc2VlbiBhbnkgZmVlZGJhY2sgdG8gdGhpcyBvbiB0aGUgbGlzdC4NClRoZXJlIGhh cyBiZWVuIHNvbWUgZGlzY3Vzc2lvbjoNCmh0dHBzOi8vbWFpbGFyY2hpdmUuaWV0Zi5vcmcvYXJj aC9tc2cvdW5iZWFyYWJsZS9SNXVha0llSG5kMmRZTXpkWTF6VG9IYnhCS28gLSB0aGUgcHJvcG9z YWwgdG8gaGFybW9uaXplIGFsZ29yaXRobSBJRHMgYmV0d2VlbiBUQk5FR08gYW5kIFRCUFJPVE87 DQpodHRwczovL21haWxhcmNoaXZlLmlldGYub3JnL2FyY2gvbXNnL3VuYmVhcmFibGUvMHc4X0Yw SDYzVFdwQWI5eF9WOFNvclpUMGxnIC0gYW1vbmcgb3RoZXJzLCBhbiBpZGVhIHRoYXQgbXVsdGlw bGUgVEIgcGFyYW1ldGVyIHNldHMgY291bGQgYmUgbmVnb3RpYXRlZCwgZS5nLiB0aGUgc2VydmVy IGNvdWxkIHJldHVybiBib3RoIHJzYTIwNDhfcGtjczEuNV9zaGEyNTYoMCkgYW5kICBlY2RzYXAy NTZfc2hhMjU2Lg0KT24gYm90aCBvZiB0aGVzZSwgSeKAmWQgbGlrZSB0byBzZWUgYSBkZWdyZWUg b2YgY29uc2Vuc3VzIGZyb20gdGhlIFdHLCBiZWZvcmUgbWFraW5nIHRoZSBjaGFuZ2VzLg0KDQo+ ICBJZiB0aGVyZSBhcmUgYW55IGlzc3VlcyB3aXRoIHRoYXQsIGxldHMgZGlzY3VzcyBpdCBvbiB0 aGUgbGlzdCBiZWZvcmUgd2UgZ2V0IHRvIFByYWd1ZS4NClllcywgdGhpcyB3b3VsZCBiZSBhd2Vz b21lIQ0KDQpDaGVlcnMsDQoNCkFuZHJlaQ0KDQpGcm9tOiBKb2huIEJyYWRsZXkgW21haWx0bzp2 ZTdqdGJAdmU3anRiLmNvbV0NClNlbnQ6IFN1bmRheSwgSnVseSA1LCAyMDE1IDE6MjcgUE0NClRv OiBBbmRyZWkgUG9wb3YNCkNjOiB1bmJlYXJhYmxlQGlldGYub3JnPG1haWx0bzp1bmJlYXJhYmxl QGlldGYub3JnPg0KU3ViamVjdDogUmU6IFtVbmJlYXJhYmxlXSBOZXcgYW5kIFVwZGF0ZWQgSS1E cw0KDQpJIGhhdmVu4oCZdCBzZWVuIGFueSBmZWVkYmFjayB0byB0aGlzIG9uIHRoZSBsaXN0Lg0K DQpBcmUgeW91IHByb3NpbmcgdGhhdCB3ZSBhZG9wdCB0aGlzIGFzIGEgd29ya2luZyBncm91cCBk b2N1bWVudD8NCg0KSWYgdGhlcmUgYXJlIGFueSBpc3N1ZXMgd2l0aCB0aGF0LCBsZXRzIGRpc2N1 c3MgaXQgb24gdGhlIGxpc3QgYmVmb3JlIHdlIGdldCB0byBQcmFndWUuDQoNCkpvaG4gQi4NCg0K DQpPbiBKdW4gMTYsIDIwMTUsIGF0IDQ6MzAgUE0sIEFuZHJlaSBQb3BvdiA8QW5kcmVpLlBvcG92 QG1pY3Jvc29mdC5jb208bWFpbHRvOkFuZHJlaS5Qb3BvdkBtaWNyb3NvZnQuY29tPj4gd3JvdGU6 DQoNCkFsc28sIHBsZWFzZSBmZWVsIGZyZWUgdG8gdXNlIEdpdEh1YiB0byB0cmFjayBpc3N1ZXMg YW5kIG1ha2UgcHVsbCByZXF1ZXN0czogaHR0cHM6Ly9naXRodWIuY29tL1Rva2VuQmluZGluZy9J bnRlcm5ldC1EcmFmdHMNCg0KTm93IHRoYXQgd2UgaGF2ZSBUQk5FR08gSS1ELCBJ4oCZdmUgY2xv c2VkIGEgY291cGxlIG9mIGlzc3VlcyByZWxhdGVkIHRvIHRoZSB1c2Ugb2YgQUxQTi4NCg0KQ2hl ZXJzLA0KDQpBbmRyZWkNCg0KRnJvbTogQW5kcmVpIFBvcG92DQpTZW50OiBGcmlkYXksIE1heSAy OSwgMjAxNSA0OjU0IFBNDQpUbzogdW5iZWFyYWJsZUBpZXRmLm9yZzxtYWlsdG86dW5iZWFyYWJs ZUBpZXRmLm9yZz4NClN1YmplY3Q6IE5ldyBhbmQgVXBkYXRlZCBJLURzDQoNCkluIERhbGxhcyB3 ZSBhZ3JlZWQgdG8gZGVmaW5lIGEgbmV3IFRMUyBleHRlbnNpb24gZm9yIFRva2VuIEJpbmRpbmcg a2V5IHBhcmFtZXRlcnMgbmVnb3RpYXRpb24sIGluc3RlYWQgb2YgdXNpbmcgQUxQTi4NCg0KVG9k YXkgSeKAmXZlIHN1Ym1pdHRlZCBUTFMgRXh0ZW5zaW9uIGZvciBUb2tlbiBCaW5kaW5nIFByb3Rv Y29sIE5lZ290aWF0aW9uICBJLUQ6IGh0dHBzOi8vZGF0YXRyYWNrZXIuaWV0Zi5vcmcvZG9jL2Ry YWZ0LXBvcG92LXRva2JpbmQtbmVnb3RpYXRpb24vDQoNCkkgaGF2ZSBhbHNvIHVwZGF0ZWQgdGhl IFRva2VuIEJpbmRpbmcgUHJvdG9jb2wgSS1EOiBodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwv ZHJhZnQtaWV0Zi10b2tiaW5kLXByb3RvY29sLTAxDQpUaGUgdXBkYXRlZCB2ZXJzaW9uIGhhcyB0 aGUgZm9sbG93aW5nIGNoYW5nZXM6DQotICAgICAgICAgIFJlbW92ZWQgQUxQTiBuZWdvdGlhdGlv biB0ZXh0Ow0KLSAgICAgICAgICBBZGRlZCBhIFNlY3VyaXR5IENvbnNpZGVyYXRpb25zIHN1Yi1z ZWN0aW9uIGRpc2N1c3NpbmcgVG9rZW4gQmluZGluZyBrZXkgc2hhcmluZyBiZXR3ZWVuIGFwcGxp Y2F0aW9uczsNCi0gICAgICAgICAgTWlub3IgZWRpdHMsIG5pdHMsIGV0Yy4NCg0KQ29tbWVudHMg YXJlIHZlcnkgd2VsY29tZSENCg0KQ2hlZXJzLA0KDQpBbmRyZWkNCl9fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQpVbmJlYXJhYmxlIG1haWxpbmcgbGlzdA0K VW5iZWFyYWJsZUBpZXRmLm9yZzxtYWlsdG86VW5iZWFyYWJsZUBpZXRmLm9yZz4NCmh0dHBzOi8v d3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vdW5iZWFyYWJsZQ0KDQpfX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KVW5iZWFyYWJsZSBtYWlsaW5nIGxp c3QNClVuYmVhcmFibGVAaWV0Zi5vcmc8bWFpbHRvOlVuYmVhcmFibGVAaWV0Zi5vcmc+DQpodHRw czovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3VuYmVhcmFibGUNCg0K --_000_BLUPR03MB1396E04B05EF4E7463C8ED928C930BLUPR03MB1396namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 SGVsdmV0aWNhOw0KCXBhbm9zZS0xOjIgMTEgNiA0IDIgMiAyIDIgMiA0O30NCkBmb250LWZhY2UN Cgl7Zm9udC1mYW1pbHk6V2luZ2RpbmdzOw0KCXBhbm9zZS0xOjUgMCAwIDAgMCAwIDAgMCAwIDA7 fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToy IDQgNSAzIDUgNCA2IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsN CglwYW5vc2UtMToyIDE1IDUgMiAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAq Lw0KcC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGlu Ow0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFt aWx5OiJUaW1lcyBOZXcgUm9tYW4iLHNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsN Cgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9u OnVuZGVybGluZTt9DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNv LXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5k ZXJsaW5lO30NCnAuTXNvTGlzdFBhcmFncmFwaCwgbGkuTXNvTGlzdFBhcmFncmFwaCwgZGl2Lk1z b0xpc3RQYXJhZ3JhcGgNCgl7bXNvLXN0eWxlLXByaW9yaXR5OjM0Ow0KCW1hcmdpbi10b3A6MGlu Ow0KCW1hcmdpbi1yaWdodDowaW47DQoJbWFyZ2luLWJvdHRvbTowaW47DQoJbWFyZ2luLWxlZnQ6 LjVpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEyLjBwdDsNCglmb250 LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIixzZXJpZjt9DQpzcGFuLmFwcGxlLWNvbnZlcnRlZC1z cGFjZQ0KCXttc28tc3R5bGUtbmFtZTphcHBsZS1jb252ZXJ0ZWQtc3BhY2U7fQ0Kc3Bhbi5FbWFp bFN0eWxlMTgNCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwtcmVwbHk7DQoJZm9udC1mYW1pbHk6 IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6IzFGNDk3RDt9DQouTXNvQ2hwRGVmYXVsdA0K CXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LXNpemU6MTAuMHB0O30NCkBwYWdl IFdvcmRTZWN0aW9uMQ0KCXtzaXplOjguNWluIDExLjBpbjsNCgltYXJnaW46MS4waW4gMS4waW4g MS4waW4gMS4waW47fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQov KiBMaXN0IERlZmluaXRpb25zICovDQpAbGlzdCBsMA0KCXttc28tbGlzdC1pZDoxMTgwNjk4NjE2 Ow0KCW1zby1saXN0LXR5cGU6aHlicmlkOw0KCW1zby1saXN0LXRlbXBsYXRlLWlkczotMTQ3ODgy MDE3MiAtMTE2NTk5MDk0MCA2NzY5ODY5MSA2NzY5ODY5MyA2NzY5ODY4OSA2NzY5ODY5MSA2NzY5 ODY5MyA2NzY5ODY4OSA2NzY5ODY5MSA2NzY5ODY5Mzt9DQpAbGlzdCBsMDpsZXZlbDENCgl7bXNv LWxldmVsLXN0YXJ0LWF0OjA7DQoJbXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1z by1sZXZlbC10ZXh0Ou+DmDsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwt bnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5 OldpbmdkaW5nczsNCgltc28tZmFyZWFzdC1mb250LWZhbWlseTpDYWxpYnJpOw0KCW1zby1iaWRp LWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iO30NCkBsaXN0IGwwOmxldmVsMg0KCXttc28t bGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6bzsNCgltc28tbGV2 ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4 dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyI7fQ0KQGxpc3QgbDA6 bGV2ZWwzDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4 dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3Np dGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7 fQ0KQGxpc3QgbDA6bGV2ZWw0DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCglt c28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVs LW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWls eTpTeW1ib2w7fQ0KQGxpc3QgbDA6bGV2ZWw1DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1 bGxldDsNCgltc28tbGV2ZWwtdGV4dDpvOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1z by1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9u dC1mYW1pbHk6IkNvdXJpZXIgTmV3Ijt9DQpAbGlzdCBsMDpsZXZlbDYNCgl7bXNvLWxldmVsLW51 bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFi LXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRl bnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMDpsZXZlbDcNCgl7 bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCglt c28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7 DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMDps ZXZlbDgNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0 Om87DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlv bjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseToiQ291cmllciBOZXci O30NCkBsaXN0IGwwOmxldmVsOQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJ bXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZl bC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1p bHk6V2luZ2RpbmdzO30NCkBsaXN0IGwxDQoJe21zby1saXN0LWlkOjEzMzE1NjIzMjQ7DQoJbXNv LWxpc3QtdHlwZTpoeWJyaWQ7DQoJbXNvLWxpc3QtdGVtcGxhdGUtaWRzOjIwNjIwNTg5OTQgMTEw NjU0MTk0MiA2NzY5ODY5MSA2NzY5ODY5MyA2NzY5ODY4OSA2NzY5ODY5MSA2NzY5ODY5MyA2NzY5 ODY4OSA2NzY5ODY5MSA2NzY5ODY5Mzt9DQpAbGlzdCBsMTpsZXZlbDENCgl7bXNvLWxldmVsLXN0 YXJ0LWF0OjA7DQoJbXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10 ZXh0Ou+DmDsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBv c2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OldpbmdkaW5n czsNCgltc28tZmFyZWFzdC1mb250LWZhbWlseTpDYWxpYnJpOw0KCW1zby1iaWRpLWZvbnQtZmFt aWx5OiJUaW1lcyBOZXcgUm9tYW4iO30NCkBsaXN0IGwxOmxldmVsMg0KCXttc28tbGV2ZWwtbnVt YmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6bzsNCgltc28tbGV2ZWwtdGFiLXN0 b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6 LS4yNWluOw0KCWZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyI7fQ0KQGxpc3QgbDE6bGV2ZWwzDQoJ e21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJ bXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0 Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3Qg bDE6bGV2ZWw0DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwt dGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1w b3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseTpTeW1ib2w7 fQ0KQGxpc3QgbDE6bGV2ZWw1DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCglt c28tbGV2ZWwtdGV4dDpvOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1u dW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6 IkNvdXJpZXIgTmV3Ijt9DQpAbGlzdCBsMTpsZXZlbDYNCgl7bXNvLWxldmVsLW51bWJlci1mb3Jt YXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9u ZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWlu Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMTpsZXZlbDcNCgl7bXNvLWxldmVs LW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwt dGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1p bmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMTpsZXZlbDgNCgl7 bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Om87DQoJbXNv LWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0K CXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseToiQ291cmllciBOZXciO30NCkBsaXN0 IGwxOmxldmVsOQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVs LXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXIt cG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6V2luZ2Rp bmdzO30NCm9sDQoJe21hcmdpbi1ib3R0b206MGluO30NCnVsDQoJe21hcmdpbi1ib3R0b206MGlu O30NCi0tPjwvc3R5bGU+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWRlZmF1bHRz IHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2IiAvPg0KPC94bWw+PCFbZW5kaWZdLS0+PCEtLVtp ZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWxheW91dCB2OmV4dD0iZWRpdCI+DQo8bzppZG1h cCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4NCjwvbzpzaGFwZWxheW91dD48L3htbD48IVtlbmRp Zl0tLT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9IkVOLVVTIiBsaW5rPSJibHVlIiB2bGluaz0icHVy cGxlIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1 b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+SGkgS2FydGhpayw8bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3 RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb0xpc3RQYXJhZ3Jh cGgiIHN0eWxlPSJ0ZXh0LWluZGVudDotLjI1aW47bXNvLWxpc3Q6bDAgbGV2ZWwxIGxmbzIiPjwh W2lmICFzdXBwb3J0TGlzdHNdPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpXaW5nZGluZ3MiPjxz cGFuIHN0eWxlPSJtc28tbGlzdDpJZ25vcmUiPsOYPHNwYW4gc3R5bGU9ImZvbnQ6Ny4wcHQgJnF1 b3Q7VGltZXMgTmV3IFJvbWFuJnF1b3Q7Ij4mbmJzcDsNCjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwh W2VuZGlmXT5UaGUgY3VycmVudCBwcm9wb3NhbHMgYmluZCB0b2tlbnMgdG8gdGhlIHRscy11bmlx dWUgY2hhbm5lbCBiaW5kaW5nLCB3aGljaCBjb3JyZXNwb25kcyB0byBhIHNwZWNpZmljIGhhbmRz aGFrZS48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBoIiBzdHlsZT0i dGV4dC1pbmRlbnQ6LS4yNWluO21zby1saXN0OmwwIGxldmVsMSBsZm8yIj48IVtpZiAhc3VwcG9y dExpc3RzXT48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6V2luZ2RpbmdzIj48c3BhbiBzdHlsZT0i bXNvLWxpc3Q6SWdub3JlIj7DmDxzcGFuIHN0eWxlPSJmb250OjcuMHB0ICZxdW90O1RpbWVzIE5l dyBSb21hbiZxdW90OyI+Jm5ic3A7DQo8L3NwYW4+PC9zcGFuPjwvc3Bhbj48IVtlbmRpZl0+VGhp cyBtZWFucyB0aGF0IHdoZW4gYW4gYXV0aGVudGljYXRlZCBzZXNzaW9uIGlzIHJlc3VtZWQgb24g YSBuZXcgY29ubmVjdGlvbiwgYSBuZXcgdG9rZW4gd291bGQgbmVlZCB0bzxvOnA+PC9vOnA+PC9w Pg0KPHAgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJ0ZXh0LWluZGVudDotLjI1aW47 bXNvLWxpc3Q6bDAgbGV2ZWwxIGxmbzIiPjwhW2lmICFzdXBwb3J0TGlzdHNdPjxzcGFuIHN0eWxl PSJmb250LWZhbWlseTpXaW5nZGluZ3MiPjxzcGFuIHN0eWxlPSJtc28tbGlzdDpJZ25vcmUiPsOY PHNwYW4gc3R5bGU9ImZvbnQ6Ny4wcHQgJnF1b3Q7VGltZXMgTmV3IFJvbWFuJnF1b3Q7Ij4mbmJz cDsNCjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwhW2VuZGlmXT5iZSBpc3N1ZWQgKHNvIHByb2JhYmx5 IHRoZSB1c2VyIHdvdWxkIGhhdmUgdG8gYXV0aGVudGljYXRlIGFnYWluLikgSXMgdGhpcyBpbnRl bmRlZD8mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fu cy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+Tm8sIHRoZSBj dXJyZW50IHByb3Bvc2FscyBiaW5kIHRoZSB0b2tlbiB0byBhIGxvbmctbGl2ZWQgcGVyc2lzdGVu dCBrZXksIHNvIHRoZSB0b2tlbiByZW1haW5zIHZhbGlkIGFjcm9zcyBUTFMgc2Vzc2lvbnMgYW5k IFRMUyBjb25uZWN0aW9ucy48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxp YnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5 N0QiPkNoZWVycyw8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1 b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPkFu ZHJlaTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fu cy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJz cDs8L286cD48L3NwYW4+PC9wPg0KPGRpdj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRl ci10b3A6c29saWQgI0UxRTFFMSAxLjBwdDtwYWRkaW5nOjMuMHB0IDBpbiAwaW4gMGluIj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+RnJvbTo8L3NwYW4+PC9iPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssc2Fucy1zZXJpZiI+IEthcnRoaWtleWFuIEJoYXJnYXZhbiBbbWFpbHRvOmthcnRoaWtleWFu LmJoYXJnYXZhbkBpbnJpYS5mcl0NCjxicj4NCjxiPlNlbnQ6PC9iPiBNb25kYXksIEp1bHkgNiwg MjAxNSA0OjMyIFBNPGJyPg0KPGI+VG86PC9iPiBBbmRyZWkgUG9wb3Y8YnI+DQo8Yj5DYzo8L2I+ IEpvaG4gQnJhZGxleTsgdW5iZWFyYWJsZUBpZXRmLm9yZzxicj4NCjxiPlN1YmplY3Q6PC9iPiBS ZTogW1VuYmVhcmFibGVdIE5ldyBhbmQgVXBkYXRlZCBJLURzPG86cD48L286cD48L3NwYW4+PC9w Pg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+VGhpcyBoYXMgcHJvYmFibHkgYmVlbiBkaXNjdXNz ZWQgYmVmb3JlLCBhbmQgaWYgc28sIHBsZWFzZSBleGN1c2UgdGhlIHF1ZXN0aW9uLiAoSSBjb3Vs ZG7igJl0IGVhc2lseSBmaW5kIGFuIGFuc3dlciBpbiB0aGUgYXJjaGl2ZXMuKTxvOnA+PC9vOnA+ PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+VGhlIGN1cnJlbnQgcHJvcG9zYWxz IGJpbmQgdG9rZW5zIHRvIHRoZSB0bHMtdW5pcXVlIGNoYW5uZWwgYmluZGluZywgd2hpY2ggY29y cmVzcG9uZHMgdG8gYSBzcGVjaWZpYyBoYW5kc2hha2UuPG86cD48L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5UaGlzIG1lYW5zIHRoYXQgd2hlbiBhbiBhdXRo ZW50aWNhdGVkIHNlc3Npb24gaXMgcmVzdW1lZCBvbiBhIG5ldyBjb25uZWN0aW9uLCBhIG5ldyB0 b2tlbiB3b3VsZCBuZWVkIHRvPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj5iZSBpc3N1ZWQgKHNvIHByb2JhYmx5IHRoZSB1c2VyIHdvdWxkIGhhdmUg dG8gYXV0aGVudGljYXRlIGFnYWluLikgSXMgdGhpcyBpbnRlbmRlZD8mbmJzcDs8bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+UmVzdW1wdGlvbiBp cyBub3QgZ29pbmcgYXdheSBhbnl0aW1lIHNvb24sIGFuZCBJ4oCZdmUgYmVlbiB0b2xkIHRoYXQg YSBtYWpvcml0eSBvZiB3ZWIgY29ubmVjdGlvbnMgdXNlIHJlc3VtcHRpb24sPG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5zbyByZWlzc3VpbmcgdG9r ZW5zIGZvciBhIG1ham9yaXR5IG9mIG5ldyBjb25uZWN0aW9ucyBzZWVtcyBleGNlc3NpdmUuIFdv dWxkIHRoZXJlIGJlIGludGVyZXN0IGluIHVzaW5nIGEgY2hhbm5lbDxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+YmluZGluZyB0aGF0IHBlcnNpc3Rz IGFjcm9zcyByZXN1bXB0aW9uPzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj5CZXN0LDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+S2FydGhpazxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPGJsb2NrcXVvdGUg c3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+T24gMDYgSnVsIDIwMTUsIGF0IDEyOjMyLCBBbmRyZWkgUG9wb3Yg Jmx0OzxhIGhyZWY9Im1haWx0bzpBbmRyZWkuUG9wb3ZAbWljcm9zb2Z0LmNvbSI+QW5kcmVpLlBv cG92QG1pY3Jvc29mdC5jb208L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPGRpdiBz dHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0idGV4 dC1pbmRlbnQ6LS4yNWluIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6V2luZ2RpbmdzIj7DmDwv c3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjcuMHB0Ij4mbmJzcDs8c3BhbiBjbGFzcz0iYXBw bGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PC9zcGFuPkFyZSB5b3UgcHJvc2luZyB0 aGF0IHdlIGFkb3B0IHRoaXMgYXMgYSB3b3JraW5nIGdyb3VwIGRvY3VtZW50PzxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlm Ij48YSBocmVmPSJodHRwczovL2RhdGF0cmFja2VyLmlldGYub3JnL2RvYy9kcmFmdC1wb3Bvdi10 b2tiaW5kLW5lZ290aWF0aW9uLyI+PHNwYW4gc3R5bGU9ImNvbG9yOndpbmRvd3RleHQiPmh0dHBz Oi8vZGF0YXRyYWNrZXIuaWV0Zi5vcmcvZG9jL2RyYWZ0LXBvcG92LXRva2JpbmQtbmVnb3RpYXRp b24vPC9zcGFuPjwvYT48c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8 L3NwYW4+aXMNCiB3cml0dGVuIGluIHN1cHBvcnQgb2YgV0figJlzIGRlY2lzaW9uIGluIERhbGxh cyB0byB1c2UgYSBuZXcgVExTIGV4dGVuc2lvbiB0byBuZWdvdGlhdGUgVG9rZW4gQmluZGluZyBw YXJhbWV0ZXJzIChpbnN0ZWFkIG9mIEFMUE4pLiBJIGhvcGUgdGhhdCB3ZSBjYW4gY29udGludWUg ZGlzY3Vzc2luZyB0aGlzIEktRCBvbiB0aGUgbWFpbGluZyBsaXN0IGFuZCBjb252ZXJnZSBpbiBQ cmFndWUuIElmIHRoZSBXRyBhZ3JlZXMgdGhhdCB0aGlzIGlzIHRoZQ0KIHJpZ2h0IGFwcHJvYWNo IG92ZXJhbGwsIEkgdGhpbmsgd2Ugc2hvdWxkIHByb2NlZWQgd2l0aCBhIGNhbGwgZm9yIGFkb3B0 aW9uLCB3aXRoIGZ1bGwgZXhwZWN0YXRpb24gdGhhdCB0aGUgZG9jdW1lbnQgd2lsbCBrZWVwIGV2 b2x2aW5nLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJ0ZXh0LWluZGVudDotLjI1aW4iPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpX aW5nZGluZ3MiPsOYPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6Ny4wcHQiPiZuYnNwOzxz cGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48L3NwYW4+SSBo YXZlbuKAmXQgc2VlbiBhbnkgZmVlZGJhY2sgdG8gdGhpcyBvbiB0aGUgbGlzdC48bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJp ZiI+VGhlcmUgaGFzIGJlZW4gc29tZSBkaXNjdXNzaW9uOjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+PGEg aHJlZj0iaHR0cHM6Ly9tYWlsYXJjaGl2ZS5pZXRmLm9yZy9hcmNoL21zZy91bmJlYXJhYmxlL1I1 dWFrSWVIbmQyZFlNemRZMXpUb0hieEJLbyI+PHNwYW4gc3R5bGU9ImNvbG9yOndpbmRvd3RleHQi Pmh0dHBzOi8vbWFpbGFyY2hpdmUuaWV0Zi5vcmcvYXJjaC9tc2cvdW5iZWFyYWJsZS9SNXVha0ll SG5kMmRZTXpkWTF6VG9IYnhCS288L3NwYW4+PC9hPjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0 ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj4tDQogdGhlIHByb3Bvc2FsIHRvIGhhcm1vbml6ZSBhbGdv cml0aG0gSURzIGJldHdlZW4gVEJORUdPIGFuZCBUQlBST1RPOzwvc3Bhbj48bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+ PGEgaHJlZj0iaHR0cHM6Ly9tYWlsYXJjaGl2ZS5pZXRmLm9yZy9hcmNoL21zZy91bmJlYXJhYmxl LzB3OF9GMEg2M1RXcEFiOXhfVjhTb3JaVDBsZyI+PHNwYW4gc3R5bGU9ImNvbG9yOndpbmRvd3Rl eHQiPmh0dHBzOi8vbWFpbGFyY2hpdmUuaWV0Zi5vcmcvYXJjaC9tc2cvdW5iZWFyYWJsZS8wdzhf RjBINjNUV3BBYjl4X1Y4U29yWlQwbGc8L3NwYW4+PC9hPjxzcGFuIGNsYXNzPSJhcHBsZS1jb252 ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj4tDQogYW1vbmcgb3RoZXJzLCBhbiBpZGVhIHRoYXQg bXVsdGlwbGUgVEIgcGFyYW1ldGVyIHNldHMgY291bGQgYmUgbmVnb3RpYXRlZCwgZS5nLiB0aGUg c2VydmVyIGNvdWxkIHJldHVybiBib3RoIHJzYTIwNDhfcGtjczEuNV9zaGEyNTYoMCkgYW5kICZu YnNwO2VjZHNhcDI1Nl9zaGEyNTYuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5PbiBib3RoIG9mIHRoZXNl LCBJ4oCZZCBsaWtlIHRvIHNlZSBhIGRlZ3JlZSBvZiBjb25zZW5zdXMgZnJvbSB0aGUgV0csIGJl Zm9yZSBtYWtpbmcgdGhlIGNoYW5nZXMuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+ PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9InRleHQtaW5kZW50Oi0uMjVpbiI+PHNwYW4gc3R5 bGU9ImZvbnQtZmFtaWx5OldpbmdkaW5ncyI+w5g8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZTo3LjBwdCI+Jm5ic3A7PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7 PC9zcGFuPjwvc3Bhbj5JZiB0aGVyZSBhcmUgYW55IGlzc3VlcyB3aXRoIHRoYXQsIGxldHMgZGlz Y3VzcyBpdCBvbiB0aGUgbGlzdCBiZWZvcmUgd2UgZ2V0IHRvIFByYWd1ZS48bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+ WWVzLCB0aGlzIHdvdWxkIGJlIGF3ZXNvbWUhPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3Nw YW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1 b3Q7LHNhbnMtc2VyaWYiPkNoZWVycyw8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzwvc3Bhbj48 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZiI+QW5kcmVpPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPiZuYnNw Ozwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXYgc3R5bGU9ImJvcmRl cjpub25lO2JvcmRlci10b3A6c29saWQgI0UxRTFFMSAxLjBwdDtwYWRkaW5nOjMuMHB0IDBpbiAw aW4gMGluIj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYi PkZyb206PC9zcGFuPjwvYj48c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7 LHNhbnMtc2VyaWYiPiZuYnNwOzwvc3Bhbj48L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5Kb2huDQog QnJhZGxleSBbPGEgaHJlZj0ibWFpbHRvOnZlN2p0YkB2ZTdqdGIuY29tIj5tYWlsdG86dmU3anRi QHZlN2p0Yi5jb208L2E+XTxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNw Ozwvc3Bhbj48YnI+DQo8Yj5TZW50OjwvYj48c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNw YWNlIj4mbmJzcDs8L3NwYW4+U3VuZGF5LCBKdWx5IDUsIDIwMTUgMToyNyBQTTxicj4NCjxiPlRv OjwvYj48c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+QW5k cmVpIFBvcG92PGJyPg0KPGI+Q2M6PC9iPjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3Bh Y2UiPiZuYnNwOzwvc3Bhbj48YSBocmVmPSJtYWlsdG86dW5iZWFyYWJsZUBpZXRmLm9yZyI+dW5i ZWFyYWJsZUBpZXRmLm9yZzwvYT48YnI+DQo8Yj5TdWJqZWN0OjwvYj48c3BhbiBjbGFzcz0iYXBw bGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+UmU6IFtVbmJlYXJhYmxlXSBOZXcgYW5k IFVwZGF0ZWQgSS1Eczwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkkgaGF2ZW7igJl0IHNlZW4gYW55IGZl ZWRiYWNrIHRvIHRoaXMgb24gdGhlIGxpc3QuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5BcmUgeW91IHBy b3NpbmcgdGhhdCB3ZSBhZG9wdCB0aGlzIGFzIGEgd29ya2luZyBncm91cCBkb2N1bWVudD88bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SWYgdGhlcmUgYXJlIGFueSBpc3N1ZXMgd2l0aCB0aGF0 LCBsZXRzIGRpc2N1c3MgaXQgb24gdGhlIGxpc3QgYmVmb3JlIHdlIGdldCB0byBQcmFndWUuPG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkpvaG4gQi48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8YmxvY2txdW90ZSBzdHls ZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+T24gSnVuIDE2LCAyMDE1LCBhdCA0OjMwIFBNLCBBbmRyZWkg UG9wb3YgJmx0OzxhIGhyZWY9Im1haWx0bzpBbmRyZWkuUG9wb3ZAbWljcm9zb2Z0LmNvbSI+PHNw YW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+QW5kcmVpLlBvcG92QG1pY3Jvc29mdC5jb208L3NwYW4+ PC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6 IzFGNDk3RCI+QWxzbywgcGxlYXNlIGZlZWwgZnJlZSB0byB1c2UgR2l0SHViIHRvIHRyYWNrIGlz c3VlcyBhbmQgbWFrZSBwdWxsIHJlcXVlc3RzOjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQt c3BhY2UiPiZuYnNwOzwvc3Bhbj48YSBocmVmPSJodHRwczovL2dpdGh1Yi5jb20vVG9rZW5CaW5k aW5nL0ludGVybmV0LURyYWZ0cyI+PHNwYW4gc3R5bGU9ImNvbG9yOiM5NTRGNzIiPmh0dHBzOi8v Z2l0aHViLmNvbS9Ub2tlbkJpbmRpbmcvSW50ZXJuZXQtRHJhZnRzPC9zcGFuPjwvYT48L3NwYW4+ PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+Jm5ic3A7PC9zcGFuPjxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPk5vdyB0aGF0IHdlIGhhdmUg VEJORUdPIEktRCwgSeKAmXZlIGNsb3NlZCBhIGNvdXBsZSBvZiBpc3N1ZXMgcmVsYXRlZCB0byB0 aGUgdXNlIG9mIEFMUE4uPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxk aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMx RjQ5N0QiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0 OTdEIj5DaGVlcnMsPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5 N0QiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdE Ij5BbmRyZWk8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+ Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2 IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNFMUUxRTEgMS4wcHQ7cGFkZGlu ZzozLjBwdCAwaW4gMGluIDBpbiI+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGli cmkmcXVvdDssc2Fucy1zZXJpZiI+RnJvbTo8L3NwYW4+PC9iPjxzcGFuIGNsYXNzPSJhcHBsZS1j b252ZXJ0ZWQtc3BhY2UiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PC9zcGFuPjwvc3Bhbj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7 LHNhbnMtc2VyaWYiPkFuZHJlaQ0KIFBvcG92PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1z cGFjZSI+Jm5ic3A7PC9zcGFuPjxicj4NCjxiPlNlbnQ6PC9iPjxzcGFuIGNsYXNzPSJhcHBsZS1j b252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj5GcmlkYXksIE1heSAyOSwgMjAxNSA0OjU0IFBN PGJyPg0KPGI+VG86PC9iPjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNw Ozwvc3Bhbj48YSBocmVmPSJtYWlsdG86dW5iZWFyYWJsZUBpZXRmLm9yZyI+PHNwYW4gc3R5bGU9 ImNvbG9yOiM5NTRGNzIiPnVuYmVhcmFibGVAaWV0Zi5vcmc8L3NwYW4+PC9hPjxicj4NCjxiPlN1 YmplY3Q6PC9iPjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bh bj5OZXcgYW5kIFVwZGF0ZWQgSS1Eczwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9k aXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1 b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9k aXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+ SW4gRGFsbGFzIHdlIGFncmVlZCB0byBkZWZpbmUgYSBuZXcgVExTIGV4dGVuc2lvbiBmb3IgVG9r ZW4gQmluZGluZyBrZXkgcGFyYW1ldGVycyBuZWdvdGlhdGlvbiwgaW5zdGVhZCBvZiB1c2luZyBB TFBOLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PC9zcGFuPjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2Fs aWJyaSZxdW90OyxzYW5zLXNlcmlmIj5Ub2RheSBJ4oCZdmUgc3VibWl0dGVkIFRMUyBFeHRlbnNp b24gZm9yIFRva2VuIEJpbmRpbmcgUHJvdG9jb2wgTmVnb3RpYXRpb24gJm5ic3A7SS1EOjxzcGFu IGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48YSBocmVmPSJodHRw czovL2RhdGF0cmFja2VyLmlldGYub3JnL2RvYy9kcmFmdC1wb3Bvdi10b2tiaW5kLW5lZ290aWF0 aW9uLyI+PHNwYW4gc3R5bGU9ImNvbG9yOiM5NTRGNzIiPmh0dHBzOi8vZGF0YXRyYWNrZXIuaWV0 Zi5vcmcvZG9jL2RyYWZ0LXBvcG92LXRva2JpbmQtbmVnb3RpYXRpb24vPC9zcGFuPjwvYT48L3Nw YW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssc2Fucy1zZXJpZiI+SSBoYXZlIGFsc28gdXBkYXRlZCB0aGUgVG9rZW4gQmluZGluZyBQcm90 b2NvbCBJLUQ6PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFu PjxhIGhyZWY9Imh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1pZXRmLXRva2JpbmQt cHJvdG9jb2wtMDEiPjxzcGFuIHN0eWxlPSJjb2xvcjojOTU0RjcyIj5odHRwczovL3Rvb2xzLmll dGYub3JnL2h0bWwvZHJhZnQtaWV0Zi10b2tiaW5kLXByb3RvY29sLTAxPC9zcGFuPjwvYT48L3Nw YW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPlRoZSB1cGRhdGVkIHZlcnNpb24gaGFzIHRo ZSBmb2xsb3dpbmcgY2hhbmdlczo8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2 Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9InRleHQtaW5kZW50Oi0uMjVpbiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4tPC9zcGFu PjxzcGFuIHN0eWxlPSJmb250LXNpemU6Ny4wcHQiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOzxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQt c3BhY2UiPiZuYnNwOzwvc3Bhbj48L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5SZW1vdmVkDQogQUxQ TiBuZWdvdGlhdGlvbiB0ZXh0Ozwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+ DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0idGV4dC1pbmRlbnQ6LS4yNWluIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPi08L3NwYW4+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo3LjBwdCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1z cGFjZSI+Jm5ic3A7PC9zcGFuPjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkFkZGVkDQogYSBTZWN1 cml0eSBDb25zaWRlcmF0aW9ucyBzdWItc2VjdGlvbiBkaXNjdXNzaW5nIFRva2VuIEJpbmRpbmcg a2V5IHNoYXJpbmcgYmV0d2VlbiBhcHBsaWNhdGlvbnM7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJ0ZXh0LWluZGVudDotLjI1aW4iPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1z ZXJpZiI+LTwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjcuMHB0Ij4mbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDs8c3BhbiBjbGFzcz0iYXBw bGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+ TWlub3INCiBlZGl0cywgbml0cywgZXRjLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJp ZiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5Db21tZW50cyBhcmUg dmVyeSB3ZWxjb21lITwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PC9z cGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5DaGVlcnMsPC9zcGFuPjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZx dW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwv ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYi PkFuZHJlaTwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWls eTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+X19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX188YnI+DQpVbmJlYXJhYmxlIG1haWxpbmcgbGlzdDxi cj4NCjwvc3Bhbj48YSBocmVmPSJtYWlsdG86VW5iZWFyYWJsZUBpZXRmLm9yZyI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fu cy1zZXJpZjtjb2xvcjojOTU0RjcyIj5VbmJlYXJhYmxlQGlldGYub3JnPC9zcGFuPjwvYT48c3Bh biBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90 OyxzYW5zLXNlcmlmIj48YnI+DQo8L3NwYW4+PGEgaHJlZj0iaHR0cHM6Ly93d3cuaWV0Zi5vcmcv bWFpbG1hbi9saXN0aW5mby91bmJlYXJhYmxlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiM5NTRG NzIiPmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vdW5iZWFyYWJsZTwvc3Bh bj48L2E+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+X19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX188YnI+DQpVbmJlYXJh YmxlIG1haWxpbmcgbGlzdDxicj4NCjxhIGhyZWY9Im1haWx0bzpVbmJlYXJhYmxlQGlldGYub3Jn Ij5VbmJlYXJhYmxlQGlldGYub3JnPC9hPjxicj4NCjxhIGhyZWY9Imh0dHBzOi8vd3d3LmlldGYu b3JnL21haWxtYW4vbGlzdGluZm8vdW5iZWFyYWJsZSI+aHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFp bG1hbi9saXN0aW5mby91bmJlYXJhYmxlPC9hPjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNw OzwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_BLUPR03MB1396E04B05EF4E7463C8ED928C930BLUPR03MB1396namp_-- From nobody Wed Jul 8 08:21:45 2015 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 55AD21A0045 for ; Wed, 8 Jul 2015 08:21:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0D3_RoGmUfRV for ; Wed, 8 Jul 2015 08:21:43 -0700 (PDT) Received: from mail-lb0-f180.google.com (mail-lb0-f180.google.com [209.85.217.180]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E2DCA1A0041 for ; Wed, 8 Jul 2015 08:21:42 -0700 (PDT) Received: by lbbpo10 with SMTP id po10so58327030lbb.3 for ; Wed, 08 Jul 2015 08:21:41 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:message-id:date:from:user-agent:mime-version:to :subject:content-type:content-transfer-encoding; bh=FMgR9uN75izWPK5NiO2KBIruorzv/XV1kprISmAI80M=; b=MPeKxVw8XK90gFqia9mN5IbjRlWd7EOpwycFxXuHCgoIzGAbR1L+M81Uq5VjYc3r5q 1HcgvGFJb7C3XaTuoMByAsgaZRSc0er28InV1PfXYES+kZyYFjkBfktO6e2hNm8WBFy2 5590BEYSxrLVlCH5RS0auhqKPrurrZgRV11I+XuniGsoViW3stzxFM/rsH5M/nNZEyA2 Ik03ey8yeQSf2VQ6hqZ0fEjC/iD6gYwYA3MB4LE7Vv6i2QzXlpdBZYIxQmptmkzOSvqR 7AIbf7uIT+cX4VznT6TtsltTHoLOYaCf59SlvrS9d6ihXZJWAxbCNj1tRMXC37FXyenM x29A== X-Gm-Message-State: ALoCoQm27ExBET3/HgovEX6wRmPXQ1uOwKkZBcP/HxjyH9oVL2z4N8nIEbixofFAe6URAakQgBLq X-Received: by 10.152.43.37 with SMTP id t5mr9925125lal.96.1436368901358; Wed, 08 Jul 2015 08:21:41 -0700 (PDT) Received: from [10.0.0.120] (tb62-102-145-131.cust.teknikbyran.com. [62.102.145.131]) by smtp.googlemail.com with ESMTPSA id k10sm717644lbq.9.2015.07.08.08.21.40 for (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 08 Jul 2015 08:21:40 -0700 (PDT) Message-ID: <559D4004.1020807@mnt.se> Date: Wed, 08 Jul 2015 17:21:40 +0200 From: Leif Johansson User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.7.0 MIME-Version: 1.0 To: "unbearable@ietf.org" Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Archived-At: Subject: [Unbearable] Agenda for Prague X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 08 Jul 2015 15:21:44 -0000 Folks, A draft agenda for Prague has been posted: https://datatracker.ietf.org/meeting/93/agenda/tokbind Feel free to shout if you are missing anything! Cheers Leif & John From nobody Wed Jul 8 14:32:54 2015 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D15631A8859 for ; Wed, 8 Jul 2015 14:32:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pbSsHMiVlJsm for ; Wed, 8 Jul 2015 14:32:51 -0700 (PDT) Received: from mail-yk0-x234.google.com (mail-yk0-x234.google.com [IPv6:2607:f8b0:4002:c07::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4F55E1A8856 for ; Wed, 8 Jul 2015 14:32:51 -0700 (PDT) Received: by ykcp133 with SMTP id p133so32988804ykc.1 for ; Wed, 08 Jul 2015 14:32:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:date:message-id:subject:from:to:content-type; bh=PlPbZ1Tcct8o79B2C4HHaiwRjVu4B69j+xUXRNB16mI=; b=DNN6SCjqVpL73b3cnaD9p4dEjEdcVQM2TzBRxP1RBwsf4uO7AZ1/8LoclI5u2JRR9C C1swD0qoq37mkv6aPwSefA50u0ypp1L5FKWd534vaHXWlY/0gHoueVwPpyIIelpRC5e3 SKb4/+GDlN6kH1CLY8K8P8KHdaRrRrkEeLAQ/g8XFM3TwTLixx/2DkM3sbLHP1eezPKh fQwJ1xtOib1USodFU9ez/zeT6CMDed6r/7zJzC5UMC4zq6yKYy5vGWsQZ7YdaP0uKYUQ RLxsWyiJ4uOOtGEuNpJPRKPOuFNGHD8lmfRbh90c1dXqCjaTfboW2+DnaH97KluXJ9yG J/zg== MIME-Version: 1.0 X-Received: by 10.129.103.84 with SMTP id b81mr13806282ywc.55.1436391170777; Wed, 08 Jul 2015 14:32:50 -0700 (PDT) Received: by 10.129.110.138 with HTTP; Wed, 8 Jul 2015 14:32:50 -0700 (PDT) Date: Wed, 8 Jul 2015 14:32:50 -0700 Message-ID: From: Martin Thomson To: "unbearable@ietf.org" Content-Type: text/plain; charset=UTF-8 Archived-At: Subject: [Unbearable] API requirements X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 08 Jul 2015 21:32:53 -0000 What do we believe the API requirements to be for this? If this just the equivalent of "Include-Referer-Token-Binding-ID", which I think was considered sufficient, we still need to consider the secondary consequences. Here's a short list of questions that I could devise off the cuff: Are there any reasons for this to be set when the request mode is "same-origin"? (I think that there are, but I'd like to be clear on this.) What limitations should this have with respect to the credentials modes that it can be used with? Does this cause the force Origin header field flag to be set? Of course, we could instead decide on the principles that need to be followed and clearly articulate those. I'm not sure what those are. From nobody Fri Jul 24 03:43:12 2015 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 14EDF1A8AAA for ; Fri, 24 Jul 2015 03:43:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9vXqk419kq8D for ; Fri, 24 Jul 2015 03:43:03 -0700 (PDT) Received: from mail-yk0-x234.google.com (mail-yk0-x234.google.com [IPv6:2607:f8b0:4002:c07::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AFFFB1A8A65 for ; Fri, 24 Jul 2015 03:43:03 -0700 (PDT) Received: by ykay190 with SMTP id y190so16267688yka.3 for ; Fri, 24 Jul 2015 03:43:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:date:message-id:subject:from:to:content-type; bh=pELza9zVTUYwNhrn6YO2phcCI9I/rhGF4Kxlb88VpPI=; b=O9HqpdcK7+ij59vORHf8BKpJ40fckGbbaCIVEvPL3smiU4G/5YYqt1tMYJiF0D3D9T 9JbHNfMtlQQ/u0ME3zsT4P7t+d6HZJcdbx2WianQZx95BvZ6ZgaslfKj2Y6KVnR1BuHb VOpBgS20/QsjY84iinijGgb2QvFpjbm+WkpqBURVj8ExiP71tLkCnr5T11ujJahKXA9m q/6tu5+dQLuD/v+I0ReX1ZO9+4zyOwDcH3ib7wmFBzZwp/u410I9XseDvaXXMp+K2Pis OLQfYUO/AjQOuTA+aWTqt10+mg6OX/+oQEQ4SKkMvysB6kznN8A3DXa0xTLn2yQCTVV+ G6rg== MIME-Version: 1.0 X-Received: by 10.129.93.136 with SMTP id r130mr14598367ywb.52.1437734583182; Fri, 24 Jul 2015 03:43:03 -0700 (PDT) Received: by 10.129.110.138 with HTTP; Fri, 24 Jul 2015 03:43:03 -0700 (PDT) Date: Fri, 24 Jul 2015 12:43:03 +0200 Message-ID: From: Martin Thomson To: "unbearable@ietf.org" Content-Type: text/plain; charset=UTF-8 Archived-At: Subject: [Unbearable] JWS X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Jul 2015 10:43:09 -0000 Though I'm ashamed to admit that I didn't think of this earlier, I have to ask... Why aren't we using JWS? From nobody Fri Jul 24 11:09:08 2015 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 41A3F1A8A58 for ; Fri, 24 Jul 2015 11:09:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8qQ1sNoJxxeP for ; Fri, 24 Jul 2015 11:09:05 -0700 (PDT) Received: from mail-oi0-x229.google.com (mail-oi0-x229.google.com [IPv6:2607:f8b0:4003:c06::229]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 358021A8A60 for ; Fri, 24 Jul 2015 11:08:59 -0700 (PDT) Received: by oibn4 with SMTP id n4so23083856oib.3 for ; Fri, 24 Jul 2015 11:08:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; bh=H7zG6yM1ff5XBDyy/B2y+YFYrz1nnmx3zx1hiV4JwD4=; b=uVLewjaQFj9JaPZs4ME3EOGEQlU+J1VgjuMaSIo/xhEAhE4p5YwXWb8iCZ5dGCOx63 RWGfI/8rcgCedt/+FqMMV0zEpqyykio4DJxruasz+0rXx5vfAYL9+ujnL4ltSuBK5zU4 /+SSHO4KJ2pr/qXF8ZJaYH2oqYsMqc/N1Jh5MP0B+9mR3Ue4hNW9kZBDLVvoExgJq2jd n6ynqciDE+QDTe5yQH0mwrkFB3Nst1yHqhFLtx4GAoKADwIU7zMWcimqQRXu5cUTSI7O +LpFNT7rJbmJiqqX+1IAKkxNIZ4cY0ayCphXjskN85CRI81JFGNNeYNB62SvzNlMkRQz wbzQ== X-Received: by 10.182.76.100 with SMTP id j4mr16038158obw.14.1437761338579; Fri, 24 Jul 2015 11:08:58 -0700 (PDT) MIME-Version: 1.0 Received: by 10.76.94.176 with HTTP; Fri, 24 Jul 2015 11:08:39 -0700 (PDT) In-Reply-To: References: From: Tony Arcieri Date: Fri, 24 Jul 2015 11:08:39 -0700 Message-ID: To: Martin Thomson Content-Type: multipart/alternative; boundary=047d7b672924dba39d051ba2e526 Archived-At: Cc: "unbearable@ietf.org" Subject: Re: [Unbearable] JWS X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Jul 2015 18:09:06 -0000 --047d7b672924dba39d051ba2e526 Content-Type: text/plain; charset=UTF-8 On Fri, Jul 24, 2015 at 3:43 AM, Martin Thomson wrote: > Why aren't we using JWS? This comes to mind: https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/ What about interop with non-JWS/JWT bearer token formats? (Or perhaps I misunderstand what you mean by "using JWS"?) -- Tony Arcieri --047d7b672924dba39d051ba2e526 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
On Fri, Jul 24, 2015 at 3:43 AM, Martin Thomson <martin.thomson@gmail.com> wrote:
Why a= ren't we using JWS?

This comes to mind:=


What about interop with non-JWS/JWT bearer token formats?=

(Or perhaps I misunderstand what you mean by &quo= t;using JWS"?)=C2=A0

--
Tony Arcieri
--047d7b672924dba39d051ba2e526-- From nobody Fri Jul 24 11:19:37 2015 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 695FB1ACEE5 for ; Fri, 24 Jul 2015 11:19:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.601 X-Spam-Level: X-Spam-Status: No, score=-2.601 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pvvEMwUb8we5 for ; Fri, 24 Jul 2015 11:19:33 -0700 (PDT) Received: from mail-wi0-f173.google.com (mail-wi0-f173.google.com [209.85.212.173]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E63191ACE31 for ; Fri, 24 Jul 2015 11:19:23 -0700 (PDT) Received: by wibud3 with SMTP id ud3so38380436wib.0 for ; Fri, 24 Jul 2015 11:19:22 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:content-type:mime-version:subject:from :in-reply-to:date:cc:content-transfer-encoding:message-id:references :to; bh=MNENmPw/MmgSm9v6jCZ5waqUeWgktYUsbP2WO8pA+Y4=; b=fABXJD6PSbg0wXBqDCo7BnFU98ANNDbcWPsMEDBesqK5+zaUv33gNAJ+2v5GzZrHyt nXwW062AAYlBnwxRFrGD0jVOHZl9xKWXPfDLUWskWpei2Pm3cNkDMkheLhzte/ei++0Y c5VAzJ8fRbaKKLkmXCmtUIC00QgiMnvh8QoqTrmXMRO51pdkA/GY+XJSJchUvpyO5dGL rQcEDVJvam1VSqiZDxMtEJ9QvgFWorN/Sz9xz2eaWgLeHabnVR997qYgOyHbJ1JW1zTh n8BF7/RaPiy3kRvSi4/AIoEC9FvNeQYvB2VYhchffMAnFIdYGBdiJLB/yEJ1ngJ4yd+J yzQg== X-Gm-Message-State: ALoCoQmA4/8LpzlB42x0k6tr2+KSwhyHnvhlFqQicGsqa2Tx5N3GlVJIKMoxDikA14EgISn0qweg X-Received: by 10.194.95.132 with SMTP id dk4mr32356155wjb.88.1437761962618; Fri, 24 Jul 2015 11:19:22 -0700 (PDT) Received: from [10.182.152.27] (37-48-61-4.tmcz.cz. [37.48.61.4]) by smtp.gmail.com with ESMTPSA id d7sm4740014wij.0.2015.07.24.11.19.20 (version=TLSv1/SSLv3 cipher=OTHER); Fri, 24 Jul 2015 11:19:21 -0700 (PDT) Content-Type: multipart/signed; boundary=Apple-Mail-2C02B26D-D2DA-45F1-82D0-8B3E7AF87A6E; protocol="application/pkcs7-signature"; micalg=sha1 Mime-Version: 1.0 (1.0) From: John Bradley X-Mailer: iPhone Mail (13A4305g) In-Reply-To: Date: Fri, 24 Jul 2015 20:19:19 +0200 Content-Transfer-Encoding: 7bit Message-Id: References: To: Martin Thomson Archived-At: Cc: "unbearable@ietf.org" Subject: Re: [Unbearable] JWS X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Jul 2015 18:19:35 -0000 --Apple-Mail-2C02B26D-D2DA-45F1-82D0-8B3E7AF87A6E Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Using JWS to sign the TLS unique? =20 It would seem that web-crypto would support it and Defiantly OpenID Connect a= nd OAuth 2 doing Pop tokens.=20 The compact JWS serialization is designed for headers.=20 There is probably some obvious reason, but I don't know it as one of the JWS= authors.=20 John B.=20 Sent from my iPhone > On Jul 24, 2015, at 12:43 PM, Martin Thomson wr= ote: >=20 > Though I'm ashamed to admit that I didn't think of this earlier, I > have to ask... >=20 > Why aren't we using JWS? >=20 > _______________________________________________ > Unbearable mailing list > Unbearable@ietf.org > https://www.ietf.org/mailman/listinfo/unbearable --Apple-Mail-2C02B26D-D2DA-45F1-82D0-8B3E7AF87A6E Content-Type: application/pkcs7-signature; name=smime.p7s Content-Disposition: attachment; filename=smime.p7s Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIHBDCCBwAw ggXooAMCAQICAkgHMA0GCSqGSIb3DQEBBQUAMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3Rh cnRDb20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4 MDYGA1UEAxMvU3RhcnRDb20gQ2xhc3MgMiBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0Ew HhcNMTQwMzI0MjM1NjIzWhcNMTYwMzI1MDkzOTMxWjCBnzEZMBcGA1UEDRMQcXpGMDFYWUNaTUwz ODdoRDELMAkGA1UEBhMCQ0wxIjAgBgNVBAgTGU1ldHJvcG9saXRhbmEgZGUgU2FudGlhZ28xFjAU BgNVBAcTDUlzbGEgZGUgTWFpcG8xFTATBgNVBAMTDEpvaG4gQnJhZGxleTEiMCAGCSqGSIb3DQEJ ARYTamJyYWRsZXlAaWNsb3VkLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALUy 9KOEBlgvo55mGu8RI3AUwHiDreyC8uNKrJyRzXnVWkx9BFOch86GhDhh7jrsCVM/wu69k716Sf1H eMOlTh3TlBp5ylIh+TFf5CMrGew6TeQ9X/shGrLdNKCrBG3/w+n5c33sdiRVfa0+wEPhUGk3X90v Su4DNheZDgxYPNOQTGExk/oWsPVTjF47ubPd1RI1EHJxqy8tEbaDe+hjOiLcajZxLfy5/thjavCb z8lCnibAMXyJU8qiG8N9lZbrCly+Po5oBYvi2Om7H4N1Ry78ufELEJwsB4NebgEb8uV+qMMhnBu8 R8DZpXzVrQWdwxzT4d+xwvZZgMuIqsOD7zcCAwEAAaOCA1UwggNRMAkGA1UdEwQCMAAwCwYDVR0P BAQDAgSwMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDAdBgNVHQ4EFgQUlA2+gZSQ+xSG IFo9cOM/hrDl7O8wHwYDVR0jBBgwFoAUrlWDb+wxyrn3HfqvazHzyB3jrLswgZkGA1UdEQSBkTCB joETamJyYWRsZXlAaWNsb3VkLmNvbYETamJyYWRsZXlAaWNsb3VkLmNvbYEXam9obi5icmFkbGV5 QHdpbmdhYS5jb22BEXZlN2p0YkB2ZTdqdGIuY29tgQ9qYnJhZGxleUBtZS5jb22BEGpicmFkbGV5 QG1hYy5jb22BE2picmFkbGV5QHdpbmdhYS5jb20wggFMBgNVHSAEggFDMIIBPzCCATsGCysGAQQB gbU3AQIDMIIBKjAuBggrBgEFBQcCARYiaHR0cDovL3d3dy5zdGFydHNzbC5jb20vcG9saWN5LnBk ZjCB9wYIKwYBBQUHAgIwgeowJxYgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwAwIB ARqBvlRoaXMgY2VydGlmaWNhdGUgd2FzIGlzc3VlZCBhY2NvcmRpbmcgdG8gdGhlIENsYXNzIDIg VmFsaWRhdGlvbiByZXF1aXJlbWVudHMgb2YgdGhlIFN0YXJ0Q29tIENBIHBvbGljeSwgcmVsaWFu Y2Ugb25seSBmb3IgdGhlIGludGVuZGVkIHB1cnBvc2UgaW4gY29tcGxpYW5jZSBvZiB0aGUgcmVs eWluZyBwYXJ0eSBvYmxpZ2F0aW9ucy4wNgYDVR0fBC8wLTAroCmgJ4YlaHR0cDovL2NybC5zdGFy dHNzbC5jb20vY3J0dTItY3JsLmNybDCBjgYIKwYBBQUHAQEEgYEwfzA5BggrBgEFBQcwAYYtaHR0 cDovL29jc3Auc3RhcnRzc2wuY29tL3N1Yi9jbGFzczIvY2xpZW50L2NhMEIGCCsGAQUFBzAChjZo dHRwOi8vYWlhLnN0YXJ0c3NsLmNvbS9jZXJ0cy9zdWIuY2xhc3MyLmNsaWVudC5jYS5jcnQwIwYD VR0SBBwwGoYYaHR0cDovL3d3dy5zdGFydHNzbC5jb20vMA0GCSqGSIb3DQEBBQUAA4IBAQC7HBJX W64HhQdVgv4THWMRU+C3PAC7RK4Ca8kaM03XjJc6bJ3CCssvDOeB4cUADDqhXth0fkfR+1niM5pF feciZyWN23eG8Z53poS6w8otVZTYxI5CuZIHoCPCWr2oRV5eBcCRx7/Ezoe9Vn934stA6O3e00Jl Q0a87dZP9sOAlysHkNpnRcO37JImKDxhCu6RYonBjBQcy4ikZutQqqI0uCGEoYj9JwmWVj8DSWLO ZbLcQ0kjGg/inHGVcZC+19kI/TyfjwgEOnTIb8E163XJ6xO3yPD4Rbx1qxEY4O8iLtViOBYL4stL u+N+71s7n0p36jMG389tH7nDtHIWKvrZMYIDbDCCA2gCAQEwgZMwgYwxCzAJBgNVBAYTAklMMRYw FAYDVQQKEw1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0 ZSBTaWduaW5nMTgwNgYDVQQDEy9TdGFydENvbSBDbGFzcyAyIFByaW1hcnkgSW50ZXJtZWRpYXRl IENsaWVudCBDQQICSAcwCQYFKw4DAhoFAKCCAa0wGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAc BgkqhkiG9w0BCQUxDxcNMTUwNzI0MTgxOTE5WjAjBgkqhkiG9w0BCQQxFgQUJ75p4Q/Vuflsq/hb oeIEI4w7Jv0wgaQGCSsGAQQBgjcQBDGBljCBkzCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0 YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcx ODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDIgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50IENB AgJIBzCBpgYLKoZIhvcNAQkQAgsxgZaggZMwgYwxCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFy dENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMTgw NgYDVQQDEy9TdGFydENvbSBDbGFzcyAyIFByaW1hcnkgSW50ZXJtZWRpYXRlIENsaWVudCBDQQIC SAcwDQYJKoZIhvcNAQEBBQAEggEAZ+exyvTT5GY8UiKuafHGOpaX2R0qnbNJYodcgWnZyw3IFusc VvQRxURJVrcaUFO8FnsW2oJr9GLwVFlaNl95G5LH7H4wrfQ/+kMAtNCEeNUUNhzyyWNaJme3N3B+ X9zBBJiSkaT6VPT4HI934l7QJwGlmunQ9M1Hc9qd4tVhH46sw4eIceWq0rT4t9Qd1Avi/FJY5Tfv 6pszA5tn6U8x8/lcOs/Qg29q0ie9HV6NcR9gDALkrFj97ysuBpdOIVYxTG4yTzIKCPYsRhf5kQUx TGejT2j8583XZbzkRmA4ptLaeuZTndD4Nn8trpXaczNn2ygsAADP2edQ8ofy8MQ91wAAAAAAAA== --Apple-Mail-2C02B26D-D2DA-45F1-82D0-8B3E7AF87A6E-- From nobody Fri Jul 24 11:39:24 2015 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C78411AD376 for ; Fri, 24 Jul 2015 11:39:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zOnd6WnsOLOe for ; Fri, 24 Jul 2015 11:39:21 -0700 (PDT) Received: from mail-yk0-x236.google.com (mail-yk0-x236.google.com [IPv6:2607:f8b0:4002:c07::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0C4AE1A89FE for ; Fri, 24 Jul 2015 11:39:18 -0700 (PDT) Received: by ykfw194 with SMTP id w194so26632899ykf.0 for ; Fri, 24 Jul 2015 11:39:17 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=wKddgd1CTT5zHofMXNmjMXh7/YsP0PmyVwnsT5p6Dqg=; b=W3xb9QOnzEFyMt1GNxgc/OlB+rqzhccxFX5dfoJ9AdCTOEu5KAjHynH1gepff7y/3U RkFYqrmYvU4cHB9irmULRlrheczcXaEdPWMqAETNwq+7MUlgMSsVwhpBgdRmuxHrUlqV 1R11D7Svd65nu/O1ttTAPJkMgMQdPMYhGeUAc9Wz086dwpDLsi9DyAn1+ZMu3heny2RW T9wBmWpT+hnPhk3gWQFHw6Y5UaZvzAcVi3PmPcUsdeMSPTtiEZVfzMNg91LGVu0Q5KnF g8BzLnkqFmjavOxNYXxJV/mkzs+R9WaETyiLz4ImLd7bdPQ56DzKK01SYzrEEGHd0PEl QFuQ== MIME-Version: 1.0 X-Received: by 10.170.165.2 with SMTP id h2mr16613238ykd.1.1437763157508; Fri, 24 Jul 2015 11:39:17 -0700 (PDT) Received: by 10.129.110.138 with HTTP; Fri, 24 Jul 2015 11:39:17 -0700 (PDT) Received: by 10.129.110.138 with HTTP; Fri, 24 Jul 2015 11:39:17 -0700 (PDT) In-Reply-To: References: Date: Fri, 24 Jul 2015 11:39:17 -0700 Message-ID: From: Martin Thomson To: John Bradley Content-Type: multipart/alternative; boundary=001a11393fb846485f051ba352ff Archived-At: Cc: unbearable@ietf.org Subject: Re: [Unbearable] JWS X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Jul 2015 18:39:22 -0000 --001a11393fb846485f051ba352ff Content-Type: text/plain; charset=UTF-8 On Jul 24, 2015 8:19 PM, "John Bradley" wrote: > > Using JWS to sign the TLS unique? > > It would seem that web-crypto would support it and Defiantly OpenID Connect and OAuth 2 doing Pop tokens. > > The compact JWS serialization is designed for headers. > > There is probably some obvious reason, but I don't know it as one of the JWS authors. That was exactly my thinking. --001a11393fb846485f051ba352ff Content-Type: text/html; charset=UTF-8


On Jul 24, 2015 8:19 PM, "John Bradley" <ve7jtb@ve7jtb.com> wrote:
>
> Using JWS to sign the TLS unique?
>
> It would seem that web-crypto would support it and Defiantly OpenID Connect and OAuth 2 doing Pop tokens.
>
> The compact JWS serialization is designed for headers.
>
> There is probably some obvious reason, but I don't know it as one of the JWS authors.

That was exactly my thinking.

--001a11393fb846485f051ba352ff-- From nobody Fri Jul 24 11:46:09 2015 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EECCC1A8854 for ; Fri, 24 Jul 2015 11:46:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.01 X-Spam-Level: X-Spam-Status: No, score=-2.01 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GL2y9CmxbXZm for ; Fri, 24 Jul 2015 11:46:07 -0700 (PDT) Received: from v2.bluepopcorn.net (v2.bluepopcorn.net [IPv6:2607:f2f8:a994::2]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BB9B41A8833 for ; Fri, 24 Jul 2015 11:46:07 -0700 (PDT) Received: from splunge.local (c-50-136-244-117.hsd1.ca.comcast.net [50.136.244.117]) (authenticated bits=0) by v2.bluepopcorn.net (8.14.3/8.14.3/Debian-9.4) with ESMTP id t6OIk3od000573 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES128-SHA bits=128 verify=NO); Fri, 24 Jul 2015 11:46:04 -0700 To: Tony Arcieri , Martin Thomson References: From: Jim Fenton Message-ID: <55B287EB.2090301@bluepopcorn.net> Date: Fri, 24 Jul 2015 11:46:03 -0700 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:38.0) Gecko/20100101 Thunderbird/38.1.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/alternative; boundary="------------030708080002000907070809" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=bluepopcorn.net; s=supersize; t=1437763565; bh=wo4b9gG4ObwVm6xI9isiTlPrg/QJGaizmUv87VDI4os=; h=Subject:To:References:Cc:From:Date:In-Reply-To; b=ou5LzhDOz3DdQZCUiSUI2NBayVVB+eSjf/TCJgy9VjY8b85UBQ6Tt/PC/7SxGJKAe ojChFz1Gz9mvPk+C43yjy39fu24w4t3m8C48Fbv23egdALPB33d3tvpVPdhRXg1c+s ChBUkyWg8FYa6GmngQcTQywDb7N4CFKnV6Af9nJk= Archived-At: Cc: "unbearable@ietf.org" Subject: Re: [Unbearable] JWS X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Jul 2015 18:46:09 -0000 This is a multi-part message in MIME format. --------------030708080002000907070809 Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit On 7/24/15 11:08 AM, Tony Arcieri wrote: > On Fri, Jul 24, 2015 at 3:43 AM, Martin Thomson > > wrote: > > Why aren't we using JWS? > > > This comes to mind: > > https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/ I would point to the fact that we (now) have libraries that have been vetted as a reason to use JWS, not the other way around. (or maybe that's what you meant) -Jim --------------030708080002000907070809 Content-Type: text/html; charset=windows-1252 Content-Transfer-Encoding: 7bit
On 7/24/15 11:08 AM, Tony Arcieri wrote:
On Fri, Jul 24, 2015 at 3:43 AM, Martin Thomson <martin.thomson@gmail.com> wrote:
Why aren't we using JWS?

This comes to mind:


I would point to the fact that we (now) have libraries that have been vetted as a reason to use JWS, not the other way around.

(or maybe that's what you meant)

-Jim

--------------030708080002000907070809-- From nobody Fri Jul 24 11:46:26 2015 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6898B1AD373 for ; Fri, 24 Jul 2015 11:46:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vp_FRwEjJpHd for ; Fri, 24 Jul 2015 11:46:23 -0700 (PDT) Received: from mail-wi0-f169.google.com (mail-wi0-f169.google.com [209.85.212.169]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 531481A8833 for ; Fri, 24 Jul 2015 11:46:23 -0700 (PDT) Received: by wibxm9 with SMTP id xm9so40471519wib.0 for ; Fri, 24 Jul 2015 11:46:22 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:content-type:mime-version:subject:from :in-reply-to:date:cc:message-id:references:to; bh=O7PAuJAMAutho4zAzj1NYsDPh6H2Fmwxxk4ZlyFdROY=; b=fPnU1Kq50BBfd5+geXySTRlM9fn7J+vQSnsDF2wVL/h9s26rE10fb72AG/BwlyQSCF cVEGeK6EUsb3IH7+d03vi1ZO58l7V0EQV2QkjSStQxfktnKAQEXGRFePivSD9MIWD5Xa +zQ4Nw8yHyoxnFsE2nWlxKqMmgWU4MGse0S8cl4TBYZW3h0tbr+l+4c8qMLD7C2os876 GBeFpZJVHMIbbCmv+xkO4wQJ3FnRKWOo0L75OrgMsDYvQ65o06s2anJp7lIcu1GzO31k JMD2AvqBu8L1gdzbRE7ZLN8jrNjAaUicLEk7MARiH3NVf8oHfoPjqCrCxSLiutOBlMln J1Zg== X-Gm-Message-State: ALoCoQnuJYW3u4+m47g1Efa5UBKuPNRIzj0JpzEqlVXJcMyJoP4serjdqzGhRoVxsMk572iSfhnJ X-Received: by 10.194.86.65 with SMTP id n1mr26340270wjz.100.1437763582006; Fri, 24 Jul 2015 11:46:22 -0700 (PDT) Received: from [10.0.5.16] ([62.168.35.69]) by smtp.gmail.com with ESMTPSA id ev8sm13935606wjb.8.2015.07.24.11.46.20 (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Fri, 24 Jul 2015 11:46:21 -0700 (PDT) Content-Type: multipart/signed; boundary="Apple-Mail=_DBDDFED9-98BF-4402-8C1A-675BB64CF993"; protocol="application/pkcs7-signature"; micalg=sha1 Mime-Version: 1.0 (Mac OS X Mail 8.2 \(2102\)) From: John Bradley In-Reply-To: Date: Fri, 24 Jul 2015 20:46:18 +0200 Message-Id: <8CA54813-719D-41B1-9177-BC81CE31BFE8@ve7jtb.com> References: To: Martin Thomson X-Mailer: Apple Mail (2.2102) Archived-At: Cc: unbearable@ietf.org Subject: Re: [Unbearable] JWS X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Jul 2015 18:46:25 -0000 --Apple-Mail=_DBDDFED9-98BF-4402-8C1A-675BB64CF993 Content-Type: multipart/alternative; boundary="Apple-Mail=_94E394ED-D639-41BF-9796-EC9B9BE18093" --Apple-Mail=_94E394ED-D639-41BF-9796-EC9B9BE18093 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 In the meeting today I was thinking that we have a JWA registry for sig = algorithms that could be used. However I didn=E2=80=99t want to add to = the confusion. John B. > On Jul 24, 2015, at 8:39 PM, Martin Thomson = wrote: >=20 >=20 > On Jul 24, 2015 8:19 PM, "John Bradley" > wrote: > > > > Using JWS to sign the TLS unique? > > > > It would seem that web-crypto would support it and Defiantly OpenID = Connect and OAuth 2 doing Pop tokens. > > > > The compact JWS serialization is designed for headers. > > > > There is probably some obvious reason, but I don't know it as one of = the JWS authors. >=20 > That was exactly my thinking. >=20 --Apple-Mail=_94E394ED-D639-41BF-9796-EC9B9BE18093 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 In the meeting today I was thinking that we have a JWA = registry for sig algorithms that could be used.  However I didn=E2=80= =99t want to add to the confusion.

John B.
On Jul 24, 2015, at 8:39 PM, = Martin Thomson <martin.thomson@gmail.com> wrote:


On Jul 24, 2015 8:19 PM, "John Bradley" <ve7jtb@ve7jtb.com> = wrote:
>
> Using JWS to sign the TLS unique?
>
> It would seem that web-crypto would support it and Defiantly OpenID = Connect and OAuth 2 doing Pop tokens.
>
> The compact JWS serialization is designed for headers.
= >
> There is probably some obvious reason, but I don't know it as one = of the JWS authors.

That was exactly my = thinking.


= --Apple-Mail=_94E394ED-D639-41BF-9796-EC9B9BE18093-- --Apple-Mail=_DBDDFED9-98BF-4402-8C1A-675BB64CF993 Content-Disposition: attachment; filename=smime.p7s Content-Type: application/pkcs7-signature; name=smime.p7s Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIINPDCCBjQw ggQcoAMCAQICASAwDQYJKoZIhvcNAQEFBQAwfTELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcxKTAn BgNVBAMTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTA3MTAyNDIxMDI1NVoX DTE3MTAyNDIxMDI1NVowgYwxCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSsw KQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMTgwNgYDVQQDEy9TdGFy dENvbSBDbGFzcyAyIFByaW1hcnkgSW50ZXJtZWRpYXRlIENsaWVudCBDQTCCASIwDQYJKoZIhvcN AQEBBQADggEPADCCAQoCggEBAMsohUWcASz7GfKrpTOMKqANy9BV7V0igWdGxA8IU77L3aTxErQ+ fcxtDYZ36Z6GH0YFn7fq5RADteP0AYzrCA+EQTfi8q1+kA3m0nwtwXG94M5sIqsvs7lRP1aycBke /s5g9hJHryZ2acScnzczjBCAo7X1v5G3yw8MDP2m2RCye0KfgZ4nODerZJVzhAlOD9YejvAXZqHk sw56HzElVIoYSZ3q4+RJuPXXfIoyby+Y2m1E+YzX5iCZXBx05gk6MKAW1vaw4/v2OOLy6FZH3XHH tOkzUreG//CsFnB9+uaYSlR65cdGzTsmoIK8WH1ygoXhRBm98SD7Hf/r3FELNvUCAwEAAaOCAa0w ggGpMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBSuVYNv7DHKufcd +q9rMfPIHeOsuzAfBgNVHSMEGDAWgBROC+8apEBbpRdphzDKNGhD0EGu8jBmBggrBgEFBQcBAQRa MFgwJwYIKwYBBQUHMAGGG2h0dHA6Ly9vY3NwLnN0YXJ0c3NsLmNvbS9jYTAtBggrBgEFBQcwAoYh aHR0cDovL3d3dy5zdGFydHNzbC5jb20vc2ZzY2EuY3J0MFsGA1UdHwRUMFIwJ6AloCOGIWh0dHA6 Ly93d3cuc3RhcnRzc2wuY29tL3Nmc2NhLmNybDAnoCWgI4YhaHR0cDovL2NybC5zdGFydHNzbC5j b20vc2ZzY2EuY3JsMIGABgNVHSAEeTB3MHUGCysGAQQBgbU3AQIBMGYwLgYIKwYBBQUHAgEWImh0 dHA6Ly93d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwNAYIKwYBBQUHAgEWKGh0dHA6Ly93d3cu c3RhcnRzc2wuY29tL2ludGVybWVkaWF0ZS5wZGYwDQYJKoZIhvcNAQEFBQADggIBADqpJw3I07QW ke9plNBpxUxcffc7nUrIQpJHDci91DFG7fVhHRkMZ1J+BKg5UNUxIFJ2Z9B90Micc/NXcs7kPBRd n6XGO/vPc87Y6R+cWS9Nc9+fp3Enmsm94OxOwI9wn8qnr/6o3mD4noP9JphwUPTXwHovjavRnhUQ HLfo/i2NG0XXgTHXS2Xm0kVUozXqpYpAdumMiB/vezj1QHQJDmUdPYMcp+reg9901zkyT3fDW/iv JVv6pWtkh6Pw2ytZT7mvg7YhX3V50Nv860cV11mocUVcqBLv0gcT+HBDYtbuvexNftwNQKD5193A 7zN4vG7CTYkXxytSjKuXrpEatEiFPxWgb84nVj25SU5q/r1Xhwby6mLhkbaXslkVtwEWT3Van49r KjlK4XrUKYYWtnfzq6aSak5u0Vpxd1rY79tWhD3EdCvOhNz/QplNa+VkIsrcp7+8ZhP1l1b2U6Ma xIVteuVMD3X0vziIwr7jxYae9FZjbxlpUemqXjcC0QaFfN7qI0JsQMALL7iGRBg7K0CoOBzECdD3 fuZil5kU/LP9cr1BK31U0Uy651bFnAMMMkqhAChIbn0ei72VnbpSsrrSdF0BAGYQ8vyHae5aCg+H 75dVCV33K6FuxZrf09yTz+Vx/PkdRUYkXmZz/OTfyJXsUOUXrym6KvI2rYpccSk5MIIHADCCBeig AwIBAgICSAcwDQYJKoZIhvcNAQEFBQAwgYwxCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENv bSBMdGQuMSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMTgwNgYD VQQDEy9TdGFydENvbSBDbGFzcyAyIFByaW1hcnkgSW50ZXJtZWRpYXRlIENsaWVudCBDQTAeFw0x NDAzMjQyMzU2MjNaFw0xNjAzMjUwOTM5MzFaMIGfMRkwFwYDVQQNExBxekYwMVhZQ1pNTDM4N2hE MQswCQYDVQQGEwJDTDEiMCAGA1UECBMZTWV0cm9wb2xpdGFuYSBkZSBTYW50aWFnbzEWMBQGA1UE BxMNSXNsYSBkZSBNYWlwbzEVMBMGA1UEAxMMSm9obiBCcmFkbGV5MSIwIAYJKoZIhvcNAQkBFhNq YnJhZGxleUBpY2xvdWQuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtTL0o4QG WC+jnmYa7xEjcBTAeIOt7ILy40qsnJHNedVaTH0EU5yHzoaEOGHuOuwJUz/C7r2TvXpJ/Ud4w6VO HdOUGnnKUiH5MV/kIysZ7DpN5D1f+yEast00oKsEbf/D6flzfex2JFV9rT7AQ+FQaTdf3S9K7gM2 F5kODFg805BMYTGT+haw9VOMXju5s93VEjUQcnGrLy0RtoN76GM6ItxqNnEt/Ln+2GNq8JvPyUKe JsAxfIlTyqIbw32VlusKXL4+jmgFi+LY6bsfg3VHLvy58QsQnCwHg15uARvy5X6owyGcG7xHwNml fNWtBZ3DHNPh37HC9lmAy4iqw4PvNwIDAQABo4IDVTCCA1EwCQYDVR0TBAIwADALBgNVHQ8EBAMC BLAwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMB0GA1UdDgQWBBSUDb6BlJD7FIYgWj1w 4z+GsOXs7zAfBgNVHSMEGDAWgBSuVYNv7DHKufcd+q9rMfPIHeOsuzCBmQYDVR0RBIGRMIGOgRNq YnJhZGxleUBpY2xvdWQuY29tgRNqYnJhZGxleUBpY2xvdWQuY29tgRdqb2huLmJyYWRsZXlAd2lu Z2FhLmNvbYERdmU3anRiQHZlN2p0Yi5jb22BD2picmFkbGV5QG1lLmNvbYEQamJyYWRsZXlAbWFj LmNvbYETamJyYWRsZXlAd2luZ2FhLmNvbTCCAUwGA1UdIASCAUMwggE/MIIBOwYLKwYBBAGBtTcB AgMwggEqMC4GCCsGAQUFBwIBFiJodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9wb2xpY3kucGRmMIH3 BggrBgEFBQcCAjCB6jAnFiBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTADAgEBGoG+ VGhpcyBjZXJ0aWZpY2F0ZSB3YXMgaXNzdWVkIGFjY29yZGluZyB0byB0aGUgQ2xhc3MgMiBWYWxp ZGF0aW9uIHJlcXVpcmVtZW50cyBvZiB0aGUgU3RhcnRDb20gQ0EgcG9saWN5LCByZWxpYW5jZSBv bmx5IGZvciB0aGUgaW50ZW5kZWQgcHVycG9zZSBpbiBjb21wbGlhbmNlIG9mIHRoZSByZWx5aW5n IHBhcnR5IG9ibGlnYXRpb25zLjA2BgNVHR8ELzAtMCugKaAnhiVodHRwOi8vY3JsLnN0YXJ0c3Ns LmNvbS9jcnR1Mi1jcmwuY3JsMIGOBggrBgEFBQcBAQSBgTB/MDkGCCsGAQUFBzABhi1odHRwOi8v b2NzcC5zdGFydHNzbC5jb20vc3ViL2NsYXNzMi9jbGllbnQvY2EwQgYIKwYBBQUHMAKGNmh0dHA6 Ly9haWEuc3RhcnRzc2wuY29tL2NlcnRzL3N1Yi5jbGFzczIuY2xpZW50LmNhLmNydDAjBgNVHRIE HDAahhhodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS8wDQYJKoZIhvcNAQEFBQADggEBALscEldbrgeF B1WC/hMdYxFT4Lc8ALtErgJryRozTdeMlzpsncIKyy8M54HhxQAMOqFe2HR+R9H7WeIzmkV95yJn JY3bd4bxnnemhLrDyi1VlNjEjkK5kgegI8JavahFXl4FwJHHv8TOh71Wf3fiy0Do7d7TQmVDRrzt 1k/2w4CXKweQ2mdFw7fskiYoPGEK7pFiicGMFBzLiKRm61CqojS4IYShiP0nCZZWPwNJYs5lstxD SSMaD+KccZVxkL7X2Qj9PJ+PCAQ6dMhvwTXrdcnrE7fI8PhFvHWrERjg7yIu1WI4Fgviy0u7437v WzufSnfqMwbfz20fucO0chYq+tkxggNsMIIDaAIBATCBkzCBjDELMAkGA1UEBhMCSUwxFjAUBgNV BAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNp Z25pbmcxODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDIgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xp ZW50IENBAgJIBzAJBgUrDgMCGgUAoIIBrTAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqG SIb3DQEJBTEPFw0xNTA3MjQxODQ2MTlaMCMGCSqGSIb3DQEJBDEWBBR7iSDL70upkJ1iRx/N5rTY fo2JnDCBpAYJKwYBBAGCNxAEMYGWMIGTMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRD b20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYG A1UEAxMvU3RhcnRDb20gQ2xhc3MgMiBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0ECAkgH MIGmBgsqhkiG9w0BCRACCzGBlqCBkzCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29t IEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcxODA2BgNV BAMTL1N0YXJ0Q29tIENsYXNzIDIgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50IENBAgJIBzAN BgkqhkiG9w0BAQEFAASCAQBXbtEBhNP4InOpqG7Mb+CqWrNqu4pjRK+Rj5/re8O5paFHu/5TmZkU 81YOIm/6athg0hWspR5fGVTZC1QE5m/PH6iNAiqdi/2YKTdrsHA9OnIPFKKwi2LYV0eI37tiqhSC t8xNjZfUJEDettqNoDNCrs/V5+E1cOQRBkuA8z07ChdIneGoiuGMkzxo7j0N7bzEKeMdiHhIJn0M hB343wO6uY/83AouWC+jbi5hjsDkgeljJzoPdN4q9Nh4cmbUyKD0o0PGoxiAFQm9/D0OlNInLqi4 uDoD2hviJ7qdRa2M5bjRe1eDo0cCa2wxTdoRM3Yn1zkWCxhqrzpniJyo7ZZqAAAAAAAA --Apple-Mail=_DBDDFED9-98BF-4402-8C1A-675BB64CF993-- From nobody Fri Jul 24 11:50:43 2015 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 61E751A6F3B for ; Fri, 24 Jul 2015 11:50:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.088 X-Spam-Level: X-Spam-Status: No, score=0.088 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=1.989, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ASIqMh8gKi2L for ; Fri, 24 Jul 2015 11:50:39 -0700 (PDT) Received: from na01-by2-obe.outbound.protection.outlook.com (mail-by2on0127.outbound.protection.outlook.com [207.46.100.127]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 28C2A1A891B for ; Fri, 24 Jul 2015 11:50:38 -0700 (PDT) Received: from BY2PR03MB442.namprd03.prod.outlook.com (10.141.141.145) by BY2PR03MB444.namprd03.prod.outlook.com (10.141.141.154) with Microsoft SMTP Server (TLS) id 15.1.231.11; Fri, 24 Jul 2015 18:50:37 +0000 Received: from BY2PR03MB442.namprd03.prod.outlook.com ([10.141.141.145]) by BY2PR03MB442.namprd03.prod.outlook.com ([10.141.141.145]) with mapi id 15.01.0225.018; Fri, 24 Jul 2015 18:50:37 +0000 From: Mike Jones To: Jim Fenton , Tony Arcieri , Martin Thomson Thread-Topic: [Unbearable] JWS Thread-Index: AQHQxf2LrXyN25oYS0WGLqzBTojPR53q642AgAAKc4CAAAA6UA== Date: Fri, 24 Jul 2015 18:50:37 +0000 Message-ID: References: <55B287EB.2090301@bluepopcorn.net> In-Reply-To: <55B287EB.2090301@bluepopcorn.net> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: bluepopcorn.net; dkim=none (message not signed) header.d=none; x-originating-ip: [12.130.117.147] x-microsoft-exchange-diagnostics: 1; BY2PR03MB444; 5:+MSI52qqghCDS/tC4zcvkIlKlTftSFuupjz/5tXV7EX61CEgqM9YY+IXndYESVHFouu0OMH2F1bw3oRUdjPHu0HQjNrdodb5xI8qhusyNz/3n1P8HoWc9TpOgUHP+DVLnjHlWyKh52HGZoDVosIvqg==; 24:SKeaTvOdRJuCCC3Nih9ItYP6iAS6/ri7wJNaF+qhUs94fc9a5wM2PHclODeP12/xExv2DQjqxYMLfXa0/pqFgNXxZFzAtLoQDyoGiHlPEA4=; 20:Pe2oW/EUSdlwTW4QTB7X+2EHcg3NQmBVUnyNvRqMeSMGV+GjeBim/EFaC9A7/TmaJfkDWHGxsfcdd0bh0PHp5Q== x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:BY2PR03MB444; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(108003899814671); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(601004)(2401001)(5005006)(3002001); SRVR:BY2PR03MB444; BCL:0; PCL:0; RULEID:; SRVR:BY2PR03MB444; x-forefront-prvs: 0647963F84 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(377454003)(24454002)(479174004)(76576001)(2950100001)(87936001)(106116001)(99286002)(5001960100002)(2656002)(74316001)(77156002)(40100003)(92566002)(16236675004)(46102003)(19617315012)(62966003)(15395725005)(5001770100001)(5003600100002)(19580395003)(2900100001)(102836002)(77096005)(122556002)(19580405001)(10090500001)(15975445007)(189998001)(5002640100001)(86362001)(19625215002)(54356999)(33656002)(76176999)(50986999)(86612001)(19300405004)(66066001); DIR:OUT; SFP:1102; SCL:1; SRVR:BY2PR03MB444; H:BY2PR03MB442.namprd03.prod.outlook.com; FPR:; SPF:None; MLV:sfv; LANG:en; Content-Type: multipart/alternative; boundary="_000_BY2PR03MB4427BDF6346931B3D525605F5810BY2PR03MB442namprd_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 24 Jul 2015 18:50:37.0551 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY2PR03MB444 Archived-At: Cc: "unbearable@ietf.org" Subject: Re: [Unbearable] JWS X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Jul 2015 18:50:41 -0000 --_000_BY2PR03MB4427BDF6346931B3D525605F5810BY2PR03MB442namprd_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable There's lots of interoperable, tested JWS libraries now for essentially eve= ry widely-used development platform. See http://openid.net/developers/libr= aries/#jwt and http://jwt.io/, plus the blog post https://auth0.com/blog/20= 15/07/21/jwt-json-webtoken-logo/. -- Mike From: Unbearable [mailto:unbearable-bounces@ietf.org] On Behalf Of Jim Fent= on Sent: Friday, July 24, 2015 11:46 AM To: Tony Arcieri; Martin Thomson Cc: unbearable@ietf.org Subject: Re: [Unbearable] JWS On 7/24/15 11:08 AM, Tony Arcieri wrote: On Fri, Jul 24, 2015 at 3:43 AM, Martin Thomson > wrote: Why aren't we using JWS? This comes to mind: https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-toke= n-libraries/ I would point to the fact that we (now) have libraries that have been vette= d as a reason to use JWS, not the other way around. (or maybe that's what you meant) -Jim --_000_BY2PR03MB4427BDF6346931B3D525605F5810BY2PR03MB442namprd_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

There’s lots of int= eroperable, tested JWS libraries now for essentially every widely-used deve= lopment platform.  See http://openid.net/d= evelopers/libraries/#jwt and http://jwt.io/, plus the blog post https://auth0.com/blog/2015/07/21/jwt-json-webtoken-logo/.

 <= /p>

    &= nbsp;           &nbs= p;            &= nbsp;           &nbs= p;            &= nbsp;     -- Mike

 <= /p>

From: Unbearable [mailto:unbearable-bounces@ietf.org] On Behalf Of Jim Fenton
Sent: Friday, July 24, 2015 11:46 AM
To: Tony Arcieri; Martin Thomson
Cc: unbearable@ietf.org
Subject: Re: [Unbearable] JWS

 

On 7/24/15 11:08 AM, Tony Arcieri wrote:<= /p>

On Fri, Jul 24, 2015 at 3:43 AM, Martin Thomson <= martin.thomso= n@gmail.com> wrote:


I would point to the fact that we (now) have libraries that have been vette= d as a reason to use JWS, not the other way around.

(or maybe that's what you meant)

-Jim

--_000_BY2PR03MB4427BDF6346931B3D525605F5810BY2PR03MB442namprd_-- From nobody Fri Jul 24 11:54:41 2015 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 171341A8ABE for ; Fri, 24 Jul 2015 11:54:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8bHoy5HfezY2 for ; Fri, 24 Jul 2015 11:54:38 -0700 (PDT) Received: from mail-oi0-x234.google.com (mail-oi0-x234.google.com [IPv6:2607:f8b0:4003:c06::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 770561A8AF8 for ; Fri, 24 Jul 2015 11:54:38 -0700 (PDT) Received: by oihq81 with SMTP id q81so23978944oih.2 for ; Fri, 24 Jul 2015 11:54:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; bh=rHXziKo9qI/7yJl8SJVTaj26RCtoVGxrgBGNtLejQe0=; b=F6Ux7E9XK4aXsWnU9pJsiOlopBDGJq0NB+Fhupuuf4T192+jkQHaBYMwKeT4PHouJ0 uPVIJoFGKLLn6cQLi9Cos0Ic7tE55g6AcVRXG68bbBPsmntLEu5ZBulQwvWDvFNALaCF we2PfESY9rRc/c8jWk72jOpO8kr0W6NblAk/yuOeo67Yz2+ArnO0jead50AlbGrmJ44z z4xnCQXLvZkjytdctZfEUqc7OUhH+8HIELlUskqEY1sFYXCB65qwlisH68xZY6LQZv2c jz3O8QjXb5IKwkYHu7t6QhgjFiM3Vvt0iyRIBCnxAgcvlZyd0/ZenKpQAON1/D4JAfRj PT5w== X-Received: by 10.182.142.202 with SMTP id ry10mr16567705obb.27.1437764077880; Fri, 24 Jul 2015 11:54:37 -0700 (PDT) MIME-Version: 1.0 Received: by 10.76.94.176 with HTTP; Fri, 24 Jul 2015 11:54:18 -0700 (PDT) In-Reply-To: <55B287EB.2090301@bluepopcorn.net> References: <55B287EB.2090301@bluepopcorn.net> From: Tony Arcieri Date: Fri, 24 Jul 2015 11:54:18 -0700 Message-ID: To: Jim Fenton Content-Type: multipart/alternative; boundary=001a1130caea221c95051ba38906 Archived-At: Cc: "unbearable@ietf.org" , Martin Thomson Subject: Re: [Unbearable] JWS X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Jul 2015 18:54:40 -0000 --001a1130caea221c95051ba38906 Content-Type: text/plain; charset=UTF-8 On Fri, Jul 24, 2015 at 11:46 AM, Jim Fenton wrote: > I would point to the fact that we (now) have libraries that have been > vetted as a reason to use JWS, not the other way around. > > (or maybe that's what you meant) > If finding a single vuln meant that a library is "vetted", OpenSSL would be an impenetrable fortress by now. This particular vulnerability speaks to what I think is a design flaw that adds sharp edges to the format, namely that an attacker can choose algorithms as part of a malleable portion of the message which the verifier needs to interpret in order to verify the messages. It's not an intractable problem, but it is one that leads to implementation difficulties, and is one of the reasons I've avoided JWT and instead used bearer token formats where these sort of problems are impossible by design. I would like to leverage tokbind, but it saddens me that to do so I might have to add this attack surface back. -- Tony Arcieri --001a1130caea221c95051ba38906 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
On F= ri, Jul 24, 2015 at 11:46 AM, Jim Fenton <fenton@bluepopcorn.net&= gt; wrote:
=20 =20 =20
I would point to the fact that we (now) have libraries that have been vetted as a reason to use JWS, not the other way around.
=
(or maybe that's what you meant)

<= div>If finding a single vuln meant that a library is "vetted", Op= enSSL would be an impenetrable fortress by now.

Th= is particular vulnerability speaks to what I think is a design flaw that ad= ds sharp edges to the format, namely that an attacker can choose algorithms= as part of a malleable portion of the message which the verifier needs to = interpret in order to verify the messages.

It'= s not an intractable problem, but it is one that leads to implementation di= fficulties, and is one of the reasons I've avoided JWT and instead used= bearer token formats where these sort of problems are impossible by design= .

I would like to leverage tokbind, but it saddens= me that to do so I might have to add this attack surface back.
=

--
Tony Arcieri
--001a1130caea221c95051ba38906-- From nobody Fri Jul 24 11:58:23 2015 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B054D1A8898 for ; Fri, 24 Jul 2015 11:58:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.601 X-Spam-Level: X-Spam-Status: No, score=-2.601 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NPfZWdgRSAzx for ; Fri, 24 Jul 2015 11:58:20 -0700 (PDT) Received: from mail-wi0-f172.google.com (mail-wi0-f172.google.com [209.85.212.172]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 77F541A8854 for ; Fri, 24 Jul 2015 11:58:20 -0700 (PDT) Received: by wicgb10 with SMTP id gb10so40637568wic.1 for ; Fri, 24 Jul 2015 11:58:19 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:content-type:subject:message-id:date:to :mime-version; bh=d3FCouSCpTverT1OoxiYQztyRUiD9q5lJGdyoqDZHnI=; b=X5MvB2pteOiZvYsVPapqddgpc+x0Cb2UEl10H5MA25YGPFV5JPua3qXHyGGbPxVtSv pFkE1hc/v1Oow9RgqFfilfprXLmOWIAvbGQnMBhf/brwoXbbJm/OuPKLWRtvxhOlYtDS ltR+ARThUKVHHqakDKxHZFq+p4/fTNbFXZz83iXl7UkY/IEFAPezmt/bM31sFikvrjiB 61dAjcgzL187xCKWtdT0xiZ0MU3E2H1mS4VhVedRZ45bARc1zz+r83Joeboeb4ENfSqP isvkjRD4rHTwDrz0uVg9WJt9pp5dPzqcpieMzqGuFFvuf9PhkGdcHqpBqyqNSEHXBxdC YqGw== X-Gm-Message-State: ALoCoQlojnUhtxBgR9TD/OHDQdwlyHgWVpTKIXWmKaq1RNu14rsf8TYN+uuz8cBokxeUGTWy+cKk X-Received: by 10.194.200.73 with SMTP id jq9mr29406550wjc.52.1437764299140; Fri, 24 Jul 2015 11:58:19 -0700 (PDT) Received: from [10.0.5.16] ([62.168.35.69]) by smtp.gmail.com with ESMTPSA id uc16sm4856222wib.8.2015.07.24.11.58.18 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Fri, 24 Jul 2015 11:58:18 -0700 (PDT) From: John Bradley Content-Type: multipart/signed; boundary="Apple-Mail=_969678DE-3A8B-4E75-BFFA-6DA122F37F2C"; protocol="application/pkcs7-signature"; micalg=sha1 Message-Id: <8B7937F9-832F-496D-8EB7-28E97A2CD82D@ve7jtb.com> Date: Fri, 24 Jul 2015 20:58:15 +0200 To: "unbearable@ietf.org" Mime-Version: 1.0 (Mac OS X Mail 8.2 \(2102\)) X-Mailer: Apple Mail (2.2102) Archived-At: Subject: [Unbearable] Interim meeting? X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Jul 2015 18:58:22 -0000 --Apple-Mail=_969678DE-3A8B-4E75-BFFA-6DA122F37F2C Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii At the meeting today we discussed having a interim meeting before = Yokohama to try and make progress. One possibility is October 9 in DC. That is next to the Fido meeting in = DC and the Internet 2 Technology exchange Cleveland, OH earlier in the = week. Are there other times when people might be available? John B.= --Apple-Mail=_969678DE-3A8B-4E75-BFFA-6DA122F37F2C Content-Disposition: attachment; filename=smime.p7s Content-Type: application/pkcs7-signature; name=smime.p7s Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIINPDCCBjQw ggQcoAMCAQICASAwDQYJKoZIhvcNAQEFBQAwfTELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcxKTAn BgNVBAMTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTA3MTAyNDIxMDI1NVoX DTE3MTAyNDIxMDI1NVowgYwxCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSsw KQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMTgwNgYDVQQDEy9TdGFy dENvbSBDbGFzcyAyIFByaW1hcnkgSW50ZXJtZWRpYXRlIENsaWVudCBDQTCCASIwDQYJKoZIhvcN AQEBBQADggEPADCCAQoCggEBAMsohUWcASz7GfKrpTOMKqANy9BV7V0igWdGxA8IU77L3aTxErQ+ fcxtDYZ36Z6GH0YFn7fq5RADteP0AYzrCA+EQTfi8q1+kA3m0nwtwXG94M5sIqsvs7lRP1aycBke /s5g9hJHryZ2acScnzczjBCAo7X1v5G3yw8MDP2m2RCye0KfgZ4nODerZJVzhAlOD9YejvAXZqHk sw56HzElVIoYSZ3q4+RJuPXXfIoyby+Y2m1E+YzX5iCZXBx05gk6MKAW1vaw4/v2OOLy6FZH3XHH tOkzUreG//CsFnB9+uaYSlR65cdGzTsmoIK8WH1ygoXhRBm98SD7Hf/r3FELNvUCAwEAAaOCAa0w ggGpMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBSuVYNv7DHKufcd +q9rMfPIHeOsuzAfBgNVHSMEGDAWgBROC+8apEBbpRdphzDKNGhD0EGu8jBmBggrBgEFBQcBAQRa MFgwJwYIKwYBBQUHMAGGG2h0dHA6Ly9vY3NwLnN0YXJ0c3NsLmNvbS9jYTAtBggrBgEFBQcwAoYh aHR0cDovL3d3dy5zdGFydHNzbC5jb20vc2ZzY2EuY3J0MFsGA1UdHwRUMFIwJ6AloCOGIWh0dHA6 Ly93d3cuc3RhcnRzc2wuY29tL3Nmc2NhLmNybDAnoCWgI4YhaHR0cDovL2NybC5zdGFydHNzbC5j b20vc2ZzY2EuY3JsMIGABgNVHSAEeTB3MHUGCysGAQQBgbU3AQIBMGYwLgYIKwYBBQUHAgEWImh0 dHA6Ly93d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwNAYIKwYBBQUHAgEWKGh0dHA6Ly93d3cu c3RhcnRzc2wuY29tL2ludGVybWVkaWF0ZS5wZGYwDQYJKoZIhvcNAQEFBQADggIBADqpJw3I07QW ke9plNBpxUxcffc7nUrIQpJHDci91DFG7fVhHRkMZ1J+BKg5UNUxIFJ2Z9B90Micc/NXcs7kPBRd n6XGO/vPc87Y6R+cWS9Nc9+fp3Enmsm94OxOwI9wn8qnr/6o3mD4noP9JphwUPTXwHovjavRnhUQ HLfo/i2NG0XXgTHXS2Xm0kVUozXqpYpAdumMiB/vezj1QHQJDmUdPYMcp+reg9901zkyT3fDW/iv JVv6pWtkh6Pw2ytZT7mvg7YhX3V50Nv860cV11mocUVcqBLv0gcT+HBDYtbuvexNftwNQKD5193A 7zN4vG7CTYkXxytSjKuXrpEatEiFPxWgb84nVj25SU5q/r1Xhwby6mLhkbaXslkVtwEWT3Van49r KjlK4XrUKYYWtnfzq6aSak5u0Vpxd1rY79tWhD3EdCvOhNz/QplNa+VkIsrcp7+8ZhP1l1b2U6Ma xIVteuVMD3X0vziIwr7jxYae9FZjbxlpUemqXjcC0QaFfN7qI0JsQMALL7iGRBg7K0CoOBzECdD3 fuZil5kU/LP9cr1BK31U0Uy651bFnAMMMkqhAChIbn0ei72VnbpSsrrSdF0BAGYQ8vyHae5aCg+H 75dVCV33K6FuxZrf09yTz+Vx/PkdRUYkXmZz/OTfyJXsUOUXrym6KvI2rYpccSk5MIIHADCCBeig AwIBAgICSAcwDQYJKoZIhvcNAQEFBQAwgYwxCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENv bSBMdGQuMSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMTgwNgYD VQQDEy9TdGFydENvbSBDbGFzcyAyIFByaW1hcnkgSW50ZXJtZWRpYXRlIENsaWVudCBDQTAeFw0x NDAzMjQyMzU2MjNaFw0xNjAzMjUwOTM5MzFaMIGfMRkwFwYDVQQNExBxekYwMVhZQ1pNTDM4N2hE MQswCQYDVQQGEwJDTDEiMCAGA1UECBMZTWV0cm9wb2xpdGFuYSBkZSBTYW50aWFnbzEWMBQGA1UE BxMNSXNsYSBkZSBNYWlwbzEVMBMGA1UEAxMMSm9obiBCcmFkbGV5MSIwIAYJKoZIhvcNAQkBFhNq YnJhZGxleUBpY2xvdWQuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtTL0o4QG WC+jnmYa7xEjcBTAeIOt7ILy40qsnJHNedVaTH0EU5yHzoaEOGHuOuwJUz/C7r2TvXpJ/Ud4w6VO HdOUGnnKUiH5MV/kIysZ7DpN5D1f+yEast00oKsEbf/D6flzfex2JFV9rT7AQ+FQaTdf3S9K7gM2 F5kODFg805BMYTGT+haw9VOMXju5s93VEjUQcnGrLy0RtoN76GM6ItxqNnEt/Ln+2GNq8JvPyUKe JsAxfIlTyqIbw32VlusKXL4+jmgFi+LY6bsfg3VHLvy58QsQnCwHg15uARvy5X6owyGcG7xHwNml fNWtBZ3DHNPh37HC9lmAy4iqw4PvNwIDAQABo4IDVTCCA1EwCQYDVR0TBAIwADALBgNVHQ8EBAMC BLAwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMB0GA1UdDgQWBBSUDb6BlJD7FIYgWj1w 4z+GsOXs7zAfBgNVHSMEGDAWgBSuVYNv7DHKufcd+q9rMfPIHeOsuzCBmQYDVR0RBIGRMIGOgRNq YnJhZGxleUBpY2xvdWQuY29tgRNqYnJhZGxleUBpY2xvdWQuY29tgRdqb2huLmJyYWRsZXlAd2lu Z2FhLmNvbYERdmU3anRiQHZlN2p0Yi5jb22BD2picmFkbGV5QG1lLmNvbYEQamJyYWRsZXlAbWFj LmNvbYETamJyYWRsZXlAd2luZ2FhLmNvbTCCAUwGA1UdIASCAUMwggE/MIIBOwYLKwYBBAGBtTcB AgMwggEqMC4GCCsGAQUFBwIBFiJodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9wb2xpY3kucGRmMIH3 BggrBgEFBQcCAjCB6jAnFiBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTADAgEBGoG+ VGhpcyBjZXJ0aWZpY2F0ZSB3YXMgaXNzdWVkIGFjY29yZGluZyB0byB0aGUgQ2xhc3MgMiBWYWxp ZGF0aW9uIHJlcXVpcmVtZW50cyBvZiB0aGUgU3RhcnRDb20gQ0EgcG9saWN5LCByZWxpYW5jZSBv bmx5IGZvciB0aGUgaW50ZW5kZWQgcHVycG9zZSBpbiBjb21wbGlhbmNlIG9mIHRoZSByZWx5aW5n IHBhcnR5IG9ibGlnYXRpb25zLjA2BgNVHR8ELzAtMCugKaAnhiVodHRwOi8vY3JsLnN0YXJ0c3Ns LmNvbS9jcnR1Mi1jcmwuY3JsMIGOBggrBgEFBQcBAQSBgTB/MDkGCCsGAQUFBzABhi1odHRwOi8v b2NzcC5zdGFydHNzbC5jb20vc3ViL2NsYXNzMi9jbGllbnQvY2EwQgYIKwYBBQUHMAKGNmh0dHA6 Ly9haWEuc3RhcnRzc2wuY29tL2NlcnRzL3N1Yi5jbGFzczIuY2xpZW50LmNhLmNydDAjBgNVHRIE HDAahhhodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS8wDQYJKoZIhvcNAQEFBQADggEBALscEldbrgeF B1WC/hMdYxFT4Lc8ALtErgJryRozTdeMlzpsncIKyy8M54HhxQAMOqFe2HR+R9H7WeIzmkV95yJn JY3bd4bxnnemhLrDyi1VlNjEjkK5kgegI8JavahFXl4FwJHHv8TOh71Wf3fiy0Do7d7TQmVDRrzt 1k/2w4CXKweQ2mdFw7fskiYoPGEK7pFiicGMFBzLiKRm61CqojS4IYShiP0nCZZWPwNJYs5lstxD SSMaD+KccZVxkL7X2Qj9PJ+PCAQ6dMhvwTXrdcnrE7fI8PhFvHWrERjg7yIu1WI4Fgviy0u7437v WzufSnfqMwbfz20fucO0chYq+tkxggNsMIIDaAIBATCBkzCBjDELMAkGA1UEBhMCSUwxFjAUBgNV BAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNp Z25pbmcxODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDIgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xp ZW50IENBAgJIBzAJBgUrDgMCGgUAoIIBrTAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqG SIb3DQEJBTEPFw0xNTA3MjQxODU4MTZaMCMGCSqGSIb3DQEJBDEWBBRxDpgMJb4BdmyDTSAY4RxL A4d9gTCBpAYJKwYBBAGCNxAEMYGWMIGTMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRD b20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYG A1UEAxMvU3RhcnRDb20gQ2xhc3MgMiBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0ECAkgH MIGmBgsqhkiG9w0BCRACCzGBlqCBkzCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29t IEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcxODA2BgNV BAMTL1N0YXJ0Q29tIENsYXNzIDIgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50IENBAgJIBzAN BgkqhkiG9w0BAQEFAASCAQCKxRswNt1Tl6WWyvP5AyJYn+7Zug6muSktpGNCY7/5bpObNKqFIhh1 Tqy+0PndKWXPO/2CzQIbDX+cFwCls7FTTXdJ//dp9Yek/kiwhWlCM0HmAgqDaLOOTAopUz6Ks3t+ lOec7Pu4KrBiTPV62LtF1dXQnbdbMBXZQyzpXmz9wIEIqUhfDlA0XPpI5rz3PG26EApVVIvogzb+ D97ekeeI1u1GFK5dpiX+Rx1yyF1Efafu2VckJMkuZtei3YJDAt8ViH7YXeOmvZwkBYvNE+NGyAJl vH1PLVd6kZ3wdt/6uXLkggmyVdcaw6oMyrJlsOgJ+rQvNV6b9JAaE92ZIWB5AAAAAAAA --Apple-Mail=_969678DE-3A8B-4E75-BFFA-6DA122F37F2C-- From nobody Fri Jul 24 11:58:30 2015 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C9D7D1A1F1D for ; Fri, 24 Jul 2015 11:58:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mcNPV__Qjt3H for ; Fri, 24 Jul 2015 11:58:26 -0700 (PDT) Received: from na01-by2-obe.outbound.protection.outlook.com (mail-by2on0132.outbound.protection.outlook.com [207.46.100.132]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 86AE31A8854 for ; Fri, 24 Jul 2015 11:58:26 -0700 (PDT) Received: from BY2PR03MB442.namprd03.prod.outlook.com (10.141.141.145) by BY2PR03MB441.namprd03.prod.outlook.com (10.141.141.142) with Microsoft SMTP Server (TLS) id 15.1.225.13; Fri, 24 Jul 2015 18:58:24 +0000 Received: from BY2PR03MB442.namprd03.prod.outlook.com ([10.141.141.145]) by BY2PR03MB442.namprd03.prod.outlook.com ([10.141.141.145]) with mapi id 15.01.0225.018; Fri, 24 Jul 2015 18:58:24 +0000 From: Mike Jones To: Tony Arcieri , Jim Fenton Thread-Topic: [Unbearable] JWS Thread-Index: AQHQxf2LrXyN25oYS0WGLqzBTojPR53q642AgAAKc4CAAAJOAIAAAIuA Date: Fri, 24 Jul 2015 18:58:24 +0000 Message-ID: References: <55B287EB.2090301@bluepopcorn.net> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: gmail.com; dkim=none (message not signed) header.d=none; x-originating-ip: [12.130.117.147] x-microsoft-exchange-diagnostics: 1; BY2PR03MB441; 5:5mHkalfKU109dXtHaEqxWRpbd6GG/9eoTrj0Zb2jfXZOZKJxOMhIi0c1vVei/mLonLghez9HrJbm4Njjd+gASy2ltbuQHJtJAgnWg7aeg+GA6oBrIdHF0F5Ywn2azCbWr455mtae+zrHADxRcVkZFQ==; 24:evJ8xzBXwKHp3pdnja/cOOnL56/yOqgi6nMacWKJ1SSNoDXx1mHJrvoENhxg492du7ZR1eQn8ZkAimAdI+qjDakmJFj5dnc7vOUAAy6DxO4=; 20:Sw4xW0g8WmtJ0J6WxUXHK5Cj8hw7a/w+AS94A/2trwD4KMSpWXQRZ/cQUnoeBbg3I3C6Gd4AXo1ExxhaG7UeDw== x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:BY2PR03MB441; by2pr03mb441: X-MS-Exchange-Organization-RulesExecuted x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(108003899814671); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(601004)(2401001)(5005006)(3002001); SRVR:BY2PR03MB441; BCL:0; PCL:0; RULEID:; SRVR:BY2PR03MB441; x-forefront-prvs: 0647963F84 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(24454002)(377454003)(86362001)(66066001)(122556002)(93886004)(46102003)(106116001)(19617315012)(86612001)(99286002)(19609705001)(2656002)(19300405004)(19580395003)(5003600100002)(76576001)(92566002)(87936001)(54356999)(77156002)(74316001)(5002640100001)(16236675004)(10090500001)(50986999)(77096005)(5001960100002)(2900100001)(76176999)(2950100001)(102836002)(15975445007)(19625215002)(33656002)(189998001)(5001770100001)(62966003)(40100003)(19580405001); DIR:OUT; SFP:1102; SCL:1; SRVR:BY2PR03MB441; H:BY2PR03MB442.namprd03.prod.outlook.com; FPR:; SPF:None; MLV:sfv; LANG:en; Content-Type: multipart/alternative; boundary="_000_BY2PR03MB442B981834FD5B33291B020F5810BY2PR03MB442namprd_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 24 Jul 2015 18:58:24.1313 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY2PR03MB441 Archived-At: Cc: "unbearable@ietf.org" , Martin Thomson Subject: Re: [Unbearable] JWS X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Jul 2015 18:58:28 -0000 --_000_BY2PR03MB442B981834FD5B33291B020F5810BY2PR03MB442namprd_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 V2hlbiB1c2luZyB0aGUgSldTIENvbXBhY3QgU2VyaWFsaXphdGlvbiBodHRwOi8vdG9vbHMuaWV0 Zi5vcmcvaHRtbC9yZmM3NTE1I3NlY3Rpb24tMy4xLCB3aGljaCBpcyB3aGF0IFRva2VuIEJpbmRp bmcgd291bGQgdXNlLCBhdHRhY2tlcnMgY2Fu4oCZdCBjaG9vc2UgYWxnb3JpdGhtcyBiZWNhdXNl IHRoZSBhbGdvcml0aG0gaWRlbnRpZmllciBpcyBpbmNsdWRlZCBpbiB0aGUgaW50ZWdyaXR5LXBy b3RlY3RlZCBpbmZvcm1hdGlvbi4NCg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgLS0gTWlrZQ0KDQpGcm9tOiBVbmJlYXJhYmxlIFtt YWlsdG86dW5iZWFyYWJsZS1ib3VuY2VzQGlldGYub3JnXSBPbiBCZWhhbGYgT2YgVG9ueSBBcmNp ZXJpDQpTZW50OiBGcmlkYXksIEp1bHkgMjQsIDIwMTUgMTE6NTQgQU0NClRvOiBKaW0gRmVudG9u DQpDYzogdW5iZWFyYWJsZUBpZXRmLm9yZzsgTWFydGluIFRob21zb24NClN1YmplY3Q6IFJlOiBb VW5iZWFyYWJsZV0gSldTDQoNCk9uIEZyaSwgSnVsIDI0LCAyMDE1IGF0IDExOjQ2IEFNLCBKaW0g RmVudG9uIDxmZW50b25AYmx1ZXBvcGNvcm4ubmV0PG1haWx0bzpmZW50b25AYmx1ZXBvcGNvcm4u bmV0Pj4gd3JvdGU6DQpJIHdvdWxkIHBvaW50IHRvIHRoZSBmYWN0IHRoYXQgd2UgKG5vdykgaGF2 ZSBsaWJyYXJpZXMgdGhhdCBoYXZlIGJlZW4gdmV0dGVkIGFzIGEgcmVhc29uIHRvIHVzZSBKV1Ms IG5vdCB0aGUgb3RoZXIgd2F5IGFyb3VuZC4NCg0KKG9yIG1heWJlIHRoYXQncyB3aGF0IHlvdSBt ZWFudCkNCg0KSWYgZmluZGluZyBhIHNpbmdsZSB2dWxuIG1lYW50IHRoYXQgYSBsaWJyYXJ5IGlz ICJ2ZXR0ZWQiLCBPcGVuU1NMIHdvdWxkIGJlIGFuIGltcGVuZXRyYWJsZSBmb3J0cmVzcyBieSBu b3cuDQoNClRoaXMgcGFydGljdWxhciB2dWxuZXJhYmlsaXR5IHNwZWFrcyB0byB3aGF0IEkgdGhp bmsgaXMgYSBkZXNpZ24gZmxhdyB0aGF0IGFkZHMgc2hhcnAgZWRnZXMgdG8gdGhlIGZvcm1hdCwg bmFtZWx5IHRoYXQgYW4gYXR0YWNrZXIgY2FuIGNob29zZSBhbGdvcml0aG1zIGFzIHBhcnQgb2Yg YSBtYWxsZWFibGUgcG9ydGlvbiBvZiB0aGUgbWVzc2FnZSB3aGljaCB0aGUgdmVyaWZpZXIgbmVl ZHMgdG8gaW50ZXJwcmV0IGluIG9yZGVyIHRvIHZlcmlmeSB0aGUgbWVzc2FnZXMuDQoNCkl0J3Mg bm90IGFuIGludHJhY3RhYmxlIHByb2JsZW0sIGJ1dCBpdCBpcyBvbmUgdGhhdCBsZWFkcyB0byBp bXBsZW1lbnRhdGlvbiBkaWZmaWN1bHRpZXMsIGFuZCBpcyBvbmUgb2YgdGhlIHJlYXNvbnMgSSd2 ZSBhdm9pZGVkIEpXVCBhbmQgaW5zdGVhZCB1c2VkIGJlYXJlciB0b2tlbiBmb3JtYXRzIHdoZXJl IHRoZXNlIHNvcnQgb2YgcHJvYmxlbXMgYXJlIGltcG9zc2libGUgYnkgZGVzaWduLg0KDQpJIHdv dWxkIGxpa2UgdG8gbGV2ZXJhZ2UgdG9rYmluZCwgYnV0IGl0IHNhZGRlbnMgbWUgdGhhdCB0byBk byBzbyBJIG1pZ2h0IGhhdmUgdG8gYWRkIHRoaXMgYXR0YWNrIHN1cmZhY2UgYmFjay4NCg0KLS0N ClRvbnkgQXJjaWVyaQ0K --_000_BY2PR03MB442B981834FD5B33291B020F5810BY2PR03MB442namprd_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTQgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1IDUgMiAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNlDQoJ e2ZvbnQtZmFtaWx5OlRhaG9tYTsNCglwYW5vc2UtMToyIDExIDYgNCAzIDUgNCA0IDIgNDt9DQov KiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1z b05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNp emU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iLCJzZXJpZiI7fQ0KYTps aW5rLCBzcGFuLk1zb0h5cGVybGluaw0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6 Ymx1ZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCmE6dmlzaXRlZCwgc3Bhbi5Nc29I eXBlcmxpbmtGb2xsb3dlZA0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6cHVycGxl Ow0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0Kc3Bhbi5FbWFpbFN0eWxlMTcNCgl7bXNv LXN0eWxlLXR5cGU6cGVyc29uYWwtcmVwbHk7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLCJzYW5z LXNlcmlmIjsNCgljb2xvcjojMUY0OTdEO30NCi5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10 eXBlOmV4cG9ydC1vbmx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIiwic2Fucy1zZXJpZiI7fQ0K QHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAx LjBpbiAxLjBpbiAxLjBpbjt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24x O30NCi0tPjwvc3R5bGU+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWRlZmF1bHRz IHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2IiAvPg0KPC94bWw+PCFbZW5kaWZdLS0+PCEtLVtp ZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWxheW91dCB2OmV4dD0iZWRpdCI+DQo8bzppZG1h cCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4NCjwvbzpzaGFwZWxheW91dD48L3htbD48IVtlbmRp Zl0tLT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9IkVOLVVTIiBsaW5rPSJibHVlIiB2bGluaz0icHVy cGxlIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1 b3Q7LCZxdW90O3NhbnMtc2VyaWYmcXVvdDs7Y29sb3I6IzFGNDk3RCI+V2hlbiB1c2luZyB0aGUg SldTIENvbXBhY3QgU2VyaWFsaXphdGlvbg0KPGEgaHJlZj0iaHR0cDovL3Rvb2xzLmlldGYub3Jn L2h0bWwvcmZjNzUxNSNzZWN0aW9uLTMuMSI+aHR0cDovL3Rvb2xzLmlldGYub3JnL2h0bWwvcmZj NzUxNSNzZWN0aW9uLTMuMTwvYT4sIHdoaWNoIGlzIHdoYXQgVG9rZW4gQmluZGluZyB3b3VsZCB1 c2UsIGF0dGFja2VycyBjYW7igJl0IGNob29zZSBhbGdvcml0aG1zIGJlY2F1c2UgdGhlIGFsZ29y aXRobSBpZGVudGlmaWVyIGlzIGluY2x1ZGVkIGluIHRoZSBpbnRlZ3JpdHktcHJvdGVjdGVkIGlu Zm9ybWF0aW9uLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90Oztjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LCZxdW90O3NhbnMtc2VyaWYm cXVvdDs7Y29sb3I6IzFGNDk3RCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IC0tIE1pa2U8bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LCZxdW90O3NhbnMtc2VyaWYmcXVvdDs7 Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7VGFob21hJnF1b3Q7LCZxdW90O3NhbnMtc2VyaWYmcXVvdDsiPkZyb206PC9zcGFuPjwvYj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtUYWhvbWEmcXVv dDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90OyI+IFVuYmVhcmFibGUgW21haWx0bzp1bmJlYXJhYmxl LWJvdW5jZXNAaWV0Zi5vcmddDQo8Yj5PbiBCZWhhbGYgT2YgPC9iPlRvbnkgQXJjaWVyaTxicj4N CjxiPlNlbnQ6PC9iPiBGcmlkYXksIEp1bHkgMjQsIDIwMTUgMTE6NTQgQU08YnI+DQo8Yj5Ubzo8 L2I+IEppbSBGZW50b248YnI+DQo8Yj5DYzo8L2I+IHVuYmVhcmFibGVAaWV0Zi5vcmc7IE1hcnRp biBUaG9tc29uPGJyPg0KPGI+U3ViamVjdDo8L2I+IFJlOiBbVW5iZWFyYWJsZV0gSldTPG86cD48 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48 L3A+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5PbiBGcmksIEp1 bCAyNCwgMjAxNSBhdCAxMTo0NiBBTSwgSmltIEZlbnRvbiAmbHQ7PGEgaHJlZj0ibWFpbHRvOmZl bnRvbkBibHVlcG9wY29ybi5uZXQiIHRhcmdldD0iX2JsYW5rIj5mZW50b25AYmx1ZXBvcGNvcm4u bmV0PC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPkkgd291bGQgcG9pbnQgdG8gdGhlIGZhY3QgdGhhdCB3ZSAobm93KSBoYXZl IGxpYnJhcmllcyB0aGF0IGhhdmUgYmVlbiB2ZXR0ZWQgYXMgYSByZWFzb24gdG8gdXNlIEpXUywg bm90IHRoZSBvdGhlciB3YXkgYXJvdW5kLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48YnI+DQoob3IgbWF5YmUgdGhhdCdzIHdoYXQgeW91IG1lYW50KTxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJz cDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JZiBmaW5k aW5nIGEgc2luZ2xlIHZ1bG4gbWVhbnQgdGhhdCBhIGxpYnJhcnkgaXMgJnF1b3Q7dmV0dGVkJnF1 b3Q7LCBPcGVuU1NMIHdvdWxkIGJlIGFuIGltcGVuZXRyYWJsZSBmb3J0cmVzcyBieSBub3cuPG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZu YnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlRoaXMg cGFydGljdWxhciB2dWxuZXJhYmlsaXR5IHNwZWFrcyB0byB3aGF0IEkgdGhpbmsgaXMgYSBkZXNp Z24gZmxhdyB0aGF0IGFkZHMgc2hhcnAgZWRnZXMgdG8gdGhlIGZvcm1hdCwgbmFtZWx5IHRoYXQg YW4gYXR0YWNrZXIgY2FuIGNob29zZSBhbGdvcml0aG1zIGFzIHBhcnQgb2YgYSBtYWxsZWFibGUg cG9ydGlvbiBvZiB0aGUgbWVzc2FnZSB3aGljaCB0aGUgdmVyaWZpZXIgbmVlZHMgdG8gaW50ZXJw cmV0DQogaW4gb3JkZXIgdG8gdmVyaWZ5IHRoZSBtZXNzYWdlcy48bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SXQncyBub3QgYW4gaW50cmFjdGFi bGUgcHJvYmxlbSwgYnV0IGl0IGlzIG9uZSB0aGF0IGxlYWRzIHRvIGltcGxlbWVudGF0aW9uIGRp ZmZpY3VsdGllcywgYW5kIGlzIG9uZSBvZiB0aGUgcmVhc29ucyBJJ3ZlIGF2b2lkZWQgSldUIGFu ZCBpbnN0ZWFkIHVzZWQgYmVhcmVyIHRva2VuIGZvcm1hdHMgd2hlcmUgdGhlc2Ugc29ydCBvZiBw cm9ibGVtcyBhcmUgaW1wb3NzaWJsZSBieSBkZXNpZ24uPG86cD48L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkkgd291bGQgbGlrZSB0byBsZXZlcmFnZSB0 b2tiaW5kLCBidXQgaXQgc2FkZGVucyBtZSB0aGF0IHRvIGRvIHNvIEkgbWlnaHQgaGF2ZSB0byBh ZGQgdGhpcyBhdHRhY2sgc3VyZmFjZSBiYWNrLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwv ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+LS0gPG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+VG9ueSBBcmNpZXJpPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwv ZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_BY2PR03MB442B981834FD5B33291B020F5810BY2PR03MB442namprd_-- From nobody Fri Jul 24 12:09:49 2015 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 25BDB1A8AF8 for ; Fri, 24 Jul 2015 12:09:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id D6PTa2OgneX4 for ; Fri, 24 Jul 2015 12:09:45 -0700 (PDT) Received: from mail-wi0-f178.google.com (mail-wi0-f178.google.com [209.85.212.178]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 593021A92DC for ; Fri, 24 Jul 2015 12:09:45 -0700 (PDT) Received: by wicmv11 with SMTP id mv11so75736118wic.0 for ; Fri, 24 Jul 2015 12:09:44 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:content-type:mime-version:subject:from :in-reply-to:date:cc:message-id:references:to; bh=/HU7LijGjuR8/cdlp1JCJ2ulKbhwzFohY/odTRouDfA=; b=B8BG6sXiNvPqfQOGCdmuEf4ugZMpOD6bCgwe6fxeA7+cWLngMSyxsu7aYsgMLajcJp A2krAqwEC9wmXeZQQWFyAi5c4N2O7So1vLHwNVNzgEAp/QuwWKtVNjBtwr7PYypFKJxb g1j3pz7b1ikMmzrA6wkqAWZoiZb9CAti1OhdN9welgY82Zk/N19aY5P3Zl2eXMBBguam 4YT/gY8OryEQP7jvth2+GiHp9hFRBd8YPGaPU2Ri5MAO8mPvvR4eKtV8UQqSJIhpAEKE jIiDDx2tYbyTpd4uJfa9dO2VMCJsctsIWLMt7xrmXNSyGSPtx18hZAQ933PwdIlX9FmA JkNg== X-Gm-Message-State: ALoCoQkfb7pmnlSBDZQSRNHGNv3CCTgUO1yPTcIV/ARsepmEv3EVylRJ/DwQzOvaYmbbBwafAj1l X-Received: by 10.194.142.209 with SMTP id ry17mr31776100wjb.5.1437764984005; Fri, 24 Jul 2015 12:09:44 -0700 (PDT) Received: from [10.0.5.16] ([62.168.35.69]) by smtp.gmail.com with ESMTPSA id fm8sm4896937wib.9.2015.07.24.12.09.42 (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Fri, 24 Jul 2015 12:09:42 -0700 (PDT) Content-Type: multipart/signed; boundary="Apple-Mail=_4F5050D2-FEA6-4E16-B36A-783D373A9405"; protocol="application/pkcs7-signature"; micalg=sha1 Mime-Version: 1.0 (Mac OS X Mail 8.2 \(2102\)) From: John Bradley In-Reply-To: Date: Fri, 24 Jul 2015 21:09:40 +0200 Message-Id: <301BBBAC-1CF8-43BD-9865-52D8F725BA84@ve7jtb.com> References: <55B287EB.2090301@bluepopcorn.net> To: Michael Jones X-Mailer: Apple Mail (2.2102) Archived-At: Cc: Jim Fenton , Tony Arcieri , "unbearable@ietf.org" , Martin Thomson Subject: Re: [Unbearable] JWS X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Jul 2015 19:09:48 -0000 --Apple-Mail=_4F5050D2-FEA6-4E16-B36A-783D373A9405 Content-Type: multipart/alternative; boundary="Apple-Mail=_B01916C8-756A-4C62-A82D-D57CB8ABD765" --Apple-Mail=_B01916C8-756A-4C62-A82D-D57CB8ABD765 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 The JWS would be self signed over the tls unique and public key. I = don=E2=80=99t know if there is an attack posable based on changing the = alg of the signature over the tls unique. This is separate to the question of how the server might bind a cookie = to that public key. I expect that JWS will also be a popular choice = for that. =20 The advantage would mostly be that the signing algs might align better. John B. > On Jul 24, 2015, at 8:58 PM, Mike Jones = wrote: >=20 > When using the JWS Compact Serialization = http://tools.ietf.org/html/rfc7515#section-3.1 = , which is what Token = Binding would use, attackers can=E2=80=99t choose algorithms because the = algorithm identifier is included in the integrity-protected information. > =20 > -- Mike > =20 > From: Unbearable [mailto:unbearable-bounces@ietf.org] On Behalf Of = Tony Arcieri > Sent: Friday, July 24, 2015 11:54 AM > To: Jim Fenton > Cc: unbearable@ietf.org; Martin Thomson > Subject: Re: [Unbearable] JWS > =20 > On Fri, Jul 24, 2015 at 11:46 AM, Jim Fenton > wrote: > I would point to the fact that we (now) have libraries that have been = vetted as a reason to use JWS, not the other way around. >=20 > (or maybe that's what you meant) > =20 > If finding a single vuln meant that a library is "vetted", OpenSSL = would be an impenetrable fortress by now. > =20 > This particular vulnerability speaks to what I think is a design flaw = that adds sharp edges to the format, namely that an attacker can choose = algorithms as part of a malleable portion of the message which the = verifier needs to interpret in order to verify the messages. > =20 > It's not an intractable problem, but it is one that leads to = implementation difficulties, and is one of the reasons I've avoided JWT = and instead used bearer token formats where these sort of problems are = impossible by design. > =20 > I would like to leverage tokbind, but it saddens me that to do so I = might have to add this attack surface back. > =20 > --=20 > Tony Arcieri > _______________________________________________ > Unbearable mailing list > Unbearable@ietf.org > https://www.ietf.org/mailman/listinfo/unbearable --Apple-Mail=_B01916C8-756A-4C62-A82D-D57CB8ABD765 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 The JWS would be self signed over the tls unique and public = key.   I don=E2=80=99t know if there is an attack posable based on = changing the alg of the signature over the tls unique.

This is separate to the question of how = the server might bind a cookie to that public key.    I expect = that JWS will also be a popular choice for that.   

The advantage would = mostly be that the signing algs might align better.

John B.

On Jul 24, 2015, at 8:58 PM, Mike Jones <Michael.Jones@microsoft.com> wrote:

When using the JWS Compact = Serialization http://tools.ietf.org/html/rfc7515#section-3.1, which is = what Token Binding would use, attackers can=E2=80=99t choose algorithms = because the algorithm identifier is included in the integrity-protected = information.
 
          &nb= sp;            = ;            &= nbsp;           &nb= sp;            -- = Mike
 
From: Unbearable = [mailto:unbearable-bounces@ietf.org] On Behalf = Of Tony Arcieri
Sent: Friday, July 24, 2015 11:54 = AM
To: Jim Fenton
Cc: unbearable@ietf.org; = Martin Thomson
Subject: Re: [Unbearable] JWS
 
On Fri, Jul 24, 2015 = at 11:46 AM, Jim Fenton <fenton@bluepopcorn.net> wrote:
I would point to the fact that we (now) = have libraries that have been vetted as a reason to use JWS, not the = other way around.

(or maybe that's what you meant)
 
If finding a single vuln meant that a = library is "vetted", OpenSSL would be an impenetrable fortress by = now.
 
This particular vulnerability speaks to what I think = is a design flaw that adds sharp edges to the format, namely that an = attacker can choose algorithms as part of a malleable portion of the = message which the verifier needs to interpret in order to verify the = messages.
 
It's not an intractable problem, but it is one that = leads to implementation difficulties, and is one of the reasons I've = avoided JWT and instead used bearer token formats where these sort of = problems are impossible by design.
 
I would like to leverage tokbind, but it saddens me = that to do so I might have to add this attack surface back.
 
-- 
Tony Arcieri
_______________________________________________
Unbearable mailing list
Unbearable@ietf.org
https://www.ietf.org/mailman/listinfo/unbearable

= --Apple-Mail=_B01916C8-756A-4C62-A82D-D57CB8ABD765-- --Apple-Mail=_4F5050D2-FEA6-4E16-B36A-783D373A9405 Content-Disposition: attachment; filename=smime.p7s Content-Type: application/pkcs7-signature; name=smime.p7s Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIINPDCCBjQw ggQcoAMCAQICASAwDQYJKoZIhvcNAQEFBQAwfTELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcxKTAn BgNVBAMTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTA3MTAyNDIxMDI1NVoX DTE3MTAyNDIxMDI1NVowgYwxCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSsw KQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMTgwNgYDVQQDEy9TdGFy dENvbSBDbGFzcyAyIFByaW1hcnkgSW50ZXJtZWRpYXRlIENsaWVudCBDQTCCASIwDQYJKoZIhvcN AQEBBQADggEPADCCAQoCggEBAMsohUWcASz7GfKrpTOMKqANy9BV7V0igWdGxA8IU77L3aTxErQ+ fcxtDYZ36Z6GH0YFn7fq5RADteP0AYzrCA+EQTfi8q1+kA3m0nwtwXG94M5sIqsvs7lRP1aycBke /s5g9hJHryZ2acScnzczjBCAo7X1v5G3yw8MDP2m2RCye0KfgZ4nODerZJVzhAlOD9YejvAXZqHk sw56HzElVIoYSZ3q4+RJuPXXfIoyby+Y2m1E+YzX5iCZXBx05gk6MKAW1vaw4/v2OOLy6FZH3XHH tOkzUreG//CsFnB9+uaYSlR65cdGzTsmoIK8WH1ygoXhRBm98SD7Hf/r3FELNvUCAwEAAaOCAa0w ggGpMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBSuVYNv7DHKufcd +q9rMfPIHeOsuzAfBgNVHSMEGDAWgBROC+8apEBbpRdphzDKNGhD0EGu8jBmBggrBgEFBQcBAQRa MFgwJwYIKwYBBQUHMAGGG2h0dHA6Ly9vY3NwLnN0YXJ0c3NsLmNvbS9jYTAtBggrBgEFBQcwAoYh aHR0cDovL3d3dy5zdGFydHNzbC5jb20vc2ZzY2EuY3J0MFsGA1UdHwRUMFIwJ6AloCOGIWh0dHA6 Ly93d3cuc3RhcnRzc2wuY29tL3Nmc2NhLmNybDAnoCWgI4YhaHR0cDovL2NybC5zdGFydHNzbC5j b20vc2ZzY2EuY3JsMIGABgNVHSAEeTB3MHUGCysGAQQBgbU3AQIBMGYwLgYIKwYBBQUHAgEWImh0 dHA6Ly93d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwNAYIKwYBBQUHAgEWKGh0dHA6Ly93d3cu c3RhcnRzc2wuY29tL2ludGVybWVkaWF0ZS5wZGYwDQYJKoZIhvcNAQEFBQADggIBADqpJw3I07QW ke9plNBpxUxcffc7nUrIQpJHDci91DFG7fVhHRkMZ1J+BKg5UNUxIFJ2Z9B90Micc/NXcs7kPBRd n6XGO/vPc87Y6R+cWS9Nc9+fp3Enmsm94OxOwI9wn8qnr/6o3mD4noP9JphwUPTXwHovjavRnhUQ HLfo/i2NG0XXgTHXS2Xm0kVUozXqpYpAdumMiB/vezj1QHQJDmUdPYMcp+reg9901zkyT3fDW/iv JVv6pWtkh6Pw2ytZT7mvg7YhX3V50Nv860cV11mocUVcqBLv0gcT+HBDYtbuvexNftwNQKD5193A 7zN4vG7CTYkXxytSjKuXrpEatEiFPxWgb84nVj25SU5q/r1Xhwby6mLhkbaXslkVtwEWT3Van49r KjlK4XrUKYYWtnfzq6aSak5u0Vpxd1rY79tWhD3EdCvOhNz/QplNa+VkIsrcp7+8ZhP1l1b2U6Ma xIVteuVMD3X0vziIwr7jxYae9FZjbxlpUemqXjcC0QaFfN7qI0JsQMALL7iGRBg7K0CoOBzECdD3 fuZil5kU/LP9cr1BK31U0Uy651bFnAMMMkqhAChIbn0ei72VnbpSsrrSdF0BAGYQ8vyHae5aCg+H 75dVCV33K6FuxZrf09yTz+Vx/PkdRUYkXmZz/OTfyJXsUOUXrym6KvI2rYpccSk5MIIHADCCBeig AwIBAgICSAcwDQYJKoZIhvcNAQEFBQAwgYwxCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENv bSBMdGQuMSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMTgwNgYD VQQDEy9TdGFydENvbSBDbGFzcyAyIFByaW1hcnkgSW50ZXJtZWRpYXRlIENsaWVudCBDQTAeFw0x NDAzMjQyMzU2MjNaFw0xNjAzMjUwOTM5MzFaMIGfMRkwFwYDVQQNExBxekYwMVhZQ1pNTDM4N2hE MQswCQYDVQQGEwJDTDEiMCAGA1UECBMZTWV0cm9wb2xpdGFuYSBkZSBTYW50aWFnbzEWMBQGA1UE BxMNSXNsYSBkZSBNYWlwbzEVMBMGA1UEAxMMSm9obiBCcmFkbGV5MSIwIAYJKoZIhvcNAQkBFhNq YnJhZGxleUBpY2xvdWQuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtTL0o4QG WC+jnmYa7xEjcBTAeIOt7ILy40qsnJHNedVaTH0EU5yHzoaEOGHuOuwJUz/C7r2TvXpJ/Ud4w6VO HdOUGnnKUiH5MV/kIysZ7DpN5D1f+yEast00oKsEbf/D6flzfex2JFV9rT7AQ+FQaTdf3S9K7gM2 F5kODFg805BMYTGT+haw9VOMXju5s93VEjUQcnGrLy0RtoN76GM6ItxqNnEt/Ln+2GNq8JvPyUKe JsAxfIlTyqIbw32VlusKXL4+jmgFi+LY6bsfg3VHLvy58QsQnCwHg15uARvy5X6owyGcG7xHwNml fNWtBZ3DHNPh37HC9lmAy4iqw4PvNwIDAQABo4IDVTCCA1EwCQYDVR0TBAIwADALBgNVHQ8EBAMC BLAwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMB0GA1UdDgQWBBSUDb6BlJD7FIYgWj1w 4z+GsOXs7zAfBgNVHSMEGDAWgBSuVYNv7DHKufcd+q9rMfPIHeOsuzCBmQYDVR0RBIGRMIGOgRNq YnJhZGxleUBpY2xvdWQuY29tgRNqYnJhZGxleUBpY2xvdWQuY29tgRdqb2huLmJyYWRsZXlAd2lu Z2FhLmNvbYERdmU3anRiQHZlN2p0Yi5jb22BD2picmFkbGV5QG1lLmNvbYEQamJyYWRsZXlAbWFj LmNvbYETamJyYWRsZXlAd2luZ2FhLmNvbTCCAUwGA1UdIASCAUMwggE/MIIBOwYLKwYBBAGBtTcB AgMwggEqMC4GCCsGAQUFBwIBFiJodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9wb2xpY3kucGRmMIH3 BggrBgEFBQcCAjCB6jAnFiBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTADAgEBGoG+ VGhpcyBjZXJ0aWZpY2F0ZSB3YXMgaXNzdWVkIGFjY29yZGluZyB0byB0aGUgQ2xhc3MgMiBWYWxp ZGF0aW9uIHJlcXVpcmVtZW50cyBvZiB0aGUgU3RhcnRDb20gQ0EgcG9saWN5LCByZWxpYW5jZSBv bmx5IGZvciB0aGUgaW50ZW5kZWQgcHVycG9zZSBpbiBjb21wbGlhbmNlIG9mIHRoZSByZWx5aW5n IHBhcnR5IG9ibGlnYXRpb25zLjA2BgNVHR8ELzAtMCugKaAnhiVodHRwOi8vY3JsLnN0YXJ0c3Ns LmNvbS9jcnR1Mi1jcmwuY3JsMIGOBggrBgEFBQcBAQSBgTB/MDkGCCsGAQUFBzABhi1odHRwOi8v b2NzcC5zdGFydHNzbC5jb20vc3ViL2NsYXNzMi9jbGllbnQvY2EwQgYIKwYBBQUHMAKGNmh0dHA6 Ly9haWEuc3RhcnRzc2wuY29tL2NlcnRzL3N1Yi5jbGFzczIuY2xpZW50LmNhLmNydDAjBgNVHRIE HDAahhhodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS8wDQYJKoZIhvcNAQEFBQADggEBALscEldbrgeF B1WC/hMdYxFT4Lc8ALtErgJryRozTdeMlzpsncIKyy8M54HhxQAMOqFe2HR+R9H7WeIzmkV95yJn JY3bd4bxnnemhLrDyi1VlNjEjkK5kgegI8JavahFXl4FwJHHv8TOh71Wf3fiy0Do7d7TQmVDRrzt 1k/2w4CXKweQ2mdFw7fskiYoPGEK7pFiicGMFBzLiKRm61CqojS4IYShiP0nCZZWPwNJYs5lstxD SSMaD+KccZVxkL7X2Qj9PJ+PCAQ6dMhvwTXrdcnrE7fI8PhFvHWrERjg7yIu1WI4Fgviy0u7437v WzufSnfqMwbfz20fucO0chYq+tkxggNsMIIDaAIBATCBkzCBjDELMAkGA1UEBhMCSUwxFjAUBgNV BAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNp Z25pbmcxODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDIgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xp ZW50IENBAgJIBzAJBgUrDgMCGgUAoIIBrTAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqG SIb3DQEJBTEPFw0xNTA3MjQxOTA5NDBaMCMGCSqGSIb3DQEJBDEWBBTjbNSuMnqvEixqs7hRfYvg HeTJKDCBpAYJKwYBBAGCNxAEMYGWMIGTMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRD b20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYG A1UEAxMvU3RhcnRDb20gQ2xhc3MgMiBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0ECAkgH MIGmBgsqhkiG9w0BCRACCzGBlqCBkzCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29t IEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcxODA2BgNV BAMTL1N0YXJ0Q29tIENsYXNzIDIgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50IENBAgJIBzAN BgkqhkiG9w0BAQEFAASCAQCPiiYfETQAm03rmeOlr5sAJiLqILwxFDBAfAfSJ4IWVwPVaq/FUa7T WCDljSr1fIeunhetL8OW5YRPnbOZ8p85Ht1qis30qsK3X2t3k4UEOHamY0q/50poopo7VOHLuN/8 eSNp8vopZJsWNbJb/z7z4UaChCvbAuYc/20mFfoT9VDA42abIYNe4Tic3fFPVxKC/UIKuvTRoiCJ 80+Ds+Mtn4bvY04DJsMAgdyMvc3vwYpmLqazNm8rVbgsnuHpBxTSNbqwiKPq5XGu4MgC2VLyAk7k OSz1I2G13EUUVfCepqlyK/ASp081m4Bwtvb5wfnvjj2wnOAHxekriUuNyWrEAAAAAAAA --Apple-Mail=_4F5050D2-FEA6-4E16-B36A-783D373A9405-- From nobody Fri Jul 24 19:31:15 2015 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D30BA1A8769 for ; Fri, 24 Jul 2015 19:31:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id G2NSfXqEsHWA for ; Fri, 24 Jul 2015 19:31:12 -0700 (PDT) Received: from mail-oi0-x232.google.com (mail-oi0-x232.google.com [IPv6:2607:f8b0:4003:c06::232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 288A51A711A for ; Fri, 24 Jul 2015 19:31:12 -0700 (PDT) Received: by oihq81 with SMTP id q81so28495898oih.2 for ; Fri, 24 Jul 2015 19:31:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; bh=EwFjhFZ+qLMPVs67R3mez2eyJpndXsb4kiYeka7vcX8=; b=O2++jr8FOvDAaCQCFQZnO7ywE9CpUddgE/Cz9ve2IwQL4hO+CGT2eTLto8I6z7Ggzd Wf8e3z0eYQyey0LJpvjhCh3lNz4Iv7DHwZEzvMYKQDCu0f/7yqNWQuZBnxuNWRMuIH1i 9T++hYFhjYeJPvHfRq1b69KT8Ql/jxEErItqSSoBIPEiPYUqFmGFZGU5RG3OEqvdHWNZ ULwTd7TXYC+nDYwXmMTMRPU1GE1xUY8nRodMhAaHJzF/TxDPZrSSZr1qxzNFaNBwdBmf qDw+21ZI4wERqta+vMinM21dvzypiskoNHGtcUrrnVcTZjNy44EvoP8h4RO1M2t/9Ebj sxKg== X-Received: by 10.202.174.205 with SMTP id x196mr17119147oie.50.1437791471619; Fri, 24 Jul 2015 19:31:11 -0700 (PDT) MIME-Version: 1.0 Received: by 10.76.94.176 with HTTP; Fri, 24 Jul 2015 19:30:52 -0700 (PDT) In-Reply-To: <301BBBAC-1CF8-43BD-9865-52D8F725BA84@ve7jtb.com> References: <55B287EB.2090301@bluepopcorn.net> <301BBBAC-1CF8-43BD-9865-52D8F725BA84@ve7jtb.com> From: Tony Arcieri Date: Fri, 24 Jul 2015 19:30:52 -0700 Message-ID: To: John Bradley Content-Type: multipart/alternative; boundary=001a113cefe4ed5569051ba9e9fd Archived-At: Cc: Jim Fenton , Michael Jones , Martin Thomson , "unbearable@ietf.org" Subject: Re: [Unbearable] JWS X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 25 Jul 2015 02:31:14 -0000 --001a113cefe4ed5569051ba9e9fd Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable On Fri, Jul 24, 2015 at 12:09 PM, John Bradley wrote: > The JWS would be self signed over the tls unique and public key. I don= =E2=80=99t > know if there is an attack posable based on changing the alg of the > signature over the tls unique. > To flip your statement around, if there were any sort of attack against this sort of self-signed signature, lots of things would be possible. In general, my reaction is you all have a particularly scary attitude for a WG that's supposedly attempting to develop secure software. Going back to this: On Fri, Jul 24, 2015 at 11:46 AM, Jim Fenton wrote= : > I would point to the fact that we (now) have libraries that have been > vetted as a reason to use JWS, not the other way around. > If people are finding vulnerabilities, that's not a good sign. That's a bad sign. That's a sign that you should be worried. Every single reaction I've received from everyone who has posted a response to me in this thread has only elevated my concerns. Things are not proceeding in a direction I would generally deem trustworthy, and that worries me. There are lots of signals of problems, and the general reaction I'm getting from this WG is to downplay every single security-related concern I've broached. I find this particularly concerning. --=20 Tony Arcieri --001a113cefe4ed5569051ba9e9fd Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
On F= ri, Jul 24, 2015 at 12:09 PM, John Bradley <ve7jtb@ve7jtb.com> wrote:
The JWS would be self signed over= the tls unique and public key. =C2=A0 I don=E2=80=99t know if there is an = attack posable based on changing the alg of the signature over the tls uniq= ue.

To flip your statement around, if= there were any sort of attack against this sort of self-signed signature, = lots of things would be possible.

In general, my r= eaction is you all have a particularly scary attitude for a WG that's s= upposedly attempting to develop secure software.

G= oing back to this:

On Fri, Jul 24, 2015 at 11:46 AM, Jim Fent= on=C2=A0<fenton@bluepopcorn.net&g= t;= =C2=A0wrote:
I would point to the fact that we (no= w) have libraries that have been vetted as a reason to use JWS, not the oth= er way around.

If people are fi= nding vulnerabilities, that's not a good sign. That's a bad sign. T= hat's a sign that you should be worried.

Every= single reaction I've received from everyone who has posted a response = to me in this thread has only elevated my concerns.

Things are not proceeding in a direction I would generally deem trustwort= hy, and that worries me. There are lots of signals of problems, and the gen= eral reaction I'm getting from this WG is to downplay every single secu= rity-related concern I've broached. I find this particularly concerning= .

--
Tony Arci= eri
--001a113cefe4ed5569051ba9e9fd-- From nobody Fri Jul 24 20:44:05 2015 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 30F1C1AC42E for ; Fri, 24 Jul 2015 20:44:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.01 X-Spam-Level: X-Spam-Status: No, score=-2.01 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GgCYkVwQv7Ia for ; Fri, 24 Jul 2015 20:44:02 -0700 (PDT) Received: from v2.bluepopcorn.net (v2.bluepopcorn.net [IPv6:2607:f2f8:a994::2]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A84691A8948 for ; Fri, 24 Jul 2015 20:44:02 -0700 (PDT) Received: from splunge.local (c-50-136-244-117.hsd1.ca.comcast.net [50.136.244.117]) (authenticated bits=0) by v2.bluepopcorn.net (8.14.3/8.14.3/Debian-9.4) with ESMTP id t6P3hv3S005695 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES128-SHA bits=128 verify=NO); Fri, 24 Jul 2015 20:43:58 -0700 To: Tony Arcieri , John Bradley References: <55B287EB.2090301@bluepopcorn.net> <301BBBAC-1CF8-43BD-9865-52D8F725BA84@ve7jtb.com> From: Jim Fenton X-Enigmail-Draft-Status: N1110 Message-ID: <55B305FE.8050308@bluepopcorn.net> Date: Fri, 24 Jul 2015 20:43:58 -0700 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:38.0) Gecko/20100101 Thunderbird/38.1.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/alternative; boundary="------------000608010009060001060807" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=bluepopcorn.net; s=supersize; t=1437795839; bh=qIYUUDeqjDWkc/TiKqLN5s0EjNZEvFtYMR3XLNcUFzA=; h=Subject:To:References:Cc:From:Date:In-Reply-To; b=kdBDVUpFntR8pHk0kkKKBagu2W00xJGqp/YrIrL+Ii/1aq60FlLTJX8Ayxsa4a65c acZ+s9L9q9Dd5AcHANkGCefnmL0yV9xDaTlFB89wm7F+k8krTyskHObi4IBTtsn3ln +9AQVvJ02LDgrmP7OEbQu9kdcmfvM0ojXFaw+ba4= Archived-At: Cc: Michael Jones , Martin Thomson , "unbearable@ietf.org" Subject: Re: [Unbearable] JWS X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 25 Jul 2015 03:44:04 -0000 This is a multi-part message in MIME format. --------------000608010009060001060807 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 7/24/15 7:30 PM, Tony Arcieri wrote: > > Going back to this: > > On Fri, Jul 24, 2015 at 11:46 AM, Jim Fenton > wrote: > > I would point to the fact that we (now) have libraries that have > been vetted as a reason to use JWS, not the other way around. > > > If people are finding vulnerabilities, that's not a good sign. That's > a bad sign. That's a sign that you should be worried. I agree that a library that has had a bug found and fixed does not mean that it has been vetted. I expressed this wrong. But having a library that has had at least some degree of use and debugging is an advantage over doing something different and writing new libraries from scratch. That is, unless the new alternative is less likely to result in implementation errors. I believe there was an assertion earlier that the alternative being proposed is somehow more likely to be implemented correctly. If so, I don't understand the basis for that assertion, and I'd like to. -Jim --------------000608010009060001060807 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 8bit
On 7/24/15 7:30 PM, Tony Arcieri wrote:

Going back to this:

On Fri, Jul 24, 2015 at 11:46 AM, Jim Fenton <fenton@bluepopcorn.net> wrote:
I would point to the fact that we (now) have libraries that have been vetted as a reason to use JWS, not the other way around.

If people are finding vulnerabilities, that's not a good sign. That's a bad sign. That's a sign that you should be worried.

I agree that a library that has had a bug found and fixed does not mean that it has been vetted. I expressed this wrong.

But having a library that has had at least some degree of use and debugging is an advantage over doing something different and writing new libraries from scratch. That is, unless the new alternative is less likely to result in implementation errors. I believe there was an assertion earlier that the alternative being proposed is somehow more likely to be implemented correctly. If so, I don't understand the basis for that assertion, and I'd like to.

-Jim

--------------000608010009060001060807-- From nobody Fri Jul 24 21:15:38 2015 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C4FFF1B29F3 for ; Fri, 24 Jul 2015 21:15:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6GNN-yIeNR2X for ; Fri, 24 Jul 2015 21:15:36 -0700 (PDT) Received: from mail-ob0-x22c.google.com (mail-ob0-x22c.google.com [IPv6:2607:f8b0:4003:c01::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4ED601B29F2 for ; Fri, 24 Jul 2015 21:15:36 -0700 (PDT) Received: by obbop1 with SMTP id op1so27662791obb.2 for ; Fri, 24 Jul 2015 21:15:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; bh=Z+4toegs+gi3+JBIUwZUJ2RcHXCn+OyDmNnIKSnbm0o=; b=VmFjsOZP+CR2SxmyJuUW8Wce4QWaByonSHGxmNIFi+gtpWaUyxePmm7xMU8TWnsP+Y uDxdHoF7GWYHjoKAOo6wkRE9xdpBo6P8PUh6Mgy5W1lLw5b7SD9aIEvggRzhZflM/Rle 5eYXorgE81/UDGX2oyYS+BZ0ryMiAY9yCuhOE2UYBpTM/ZIXX32bcyMkLrhVGrNJ3MRA MFEZ6pPJShRT2os8SIlWMU/mlBg/4DfF/M0mk4yU3a2PdC31QrluLInQiVKegx/6RWYt MNTD8qQgFnaJaAmtFI9BCCcSXEwXXQF6B39qRYk/zcRXD5Y6preLeA1d0Z3NboPg/MII pTbA== X-Received: by 10.182.76.100 with SMTP id j4mr17641154obw.14.1437797735819; Fri, 24 Jul 2015 21:15:35 -0700 (PDT) MIME-Version: 1.0 Received: by 10.76.94.176 with HTTP; Fri, 24 Jul 2015 21:15:16 -0700 (PDT) In-Reply-To: <55B305FE.8050308@bluepopcorn.net> References: <55B287EB.2090301@bluepopcorn.net> <301BBBAC-1CF8-43BD-9865-52D8F725BA84@ve7jtb.com> <55B305FE.8050308@bluepopcorn.net> From: Tony Arcieri Date: Fri, 24 Jul 2015 21:15:16 -0700 Message-ID: To: Jim Fenton Content-Type: multipart/alternative; boundary=047d7b6729244d7556051bab5f45 Archived-At: Cc: John Bradley , Michael Jones , Martin Thomson , "unbearable@ietf.org" Subject: Re: [Unbearable] JWS X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 25 Jul 2015 04:15:37 -0000 --047d7b6729244d7556051bab5f45 Content-Type: text/plain; charset=UTF-8 On Fri, Jul 24, 2015 at 8:43 PM, Jim Fenton wrote: > I agree that a library that has had a bug found and fixed does not mean > that it has been vetted. I expressed this wrong. > > But having a library that has had at least some degree of use and > debugging is an advantage over doing something different and writing new > libraries from scratch. > I don't think JWS/JWT are the only game in town. There are alternatives to consider which don't involve "writing new libraries from scratch" -- Tony Arcieri --047d7b6729244d7556051bab5f45 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
On F= ri, Jul 24, 2015 at 8:43 PM, Jim Fenton <fenton@bluepopcorn.net> wrote:
=20 =20 =20
I agree that a library that has had a bug found and fixed does not mean that it has been vetted. I expressed this wrong.
But having a library that has had at least some degree of use and debugging is an advantage over doing something different and writing new libraries from scratch.

I don= 't think JWS/JWT are the only game in town. There are alternatives to c= onsider which don't involve "writing new libraries from scratch&qu= ot;
=C2=A0
--
Tony = Arcieri
--047d7b6729244d7556051bab5f45-- From nobody Fri Jul 24 21:30:58 2015 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E52171B2A1C for ; Fri, 24 Jul 2015 21:30:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hEajKkX4Ct8s for ; Fri, 24 Jul 2015 21:30:54 -0700 (PDT) Received: from na01-bn1-obe.outbound.protection.outlook.com (mail-bn1on0733.outbound.protection.outlook.com [IPv6:2a01:111:f400:fc10::733]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3FD001B2A19 for ; Fri, 24 Jul 2015 21:30:54 -0700 (PDT) Received: from BY2PR03MB443.namprd03.prod.outlook.com (10.141.141.152) by BY2PR03MB394.namprd03.prod.outlook.com (10.141.141.13) with Microsoft SMTP Server (TLS) id 15.1.225.13; Sat, 25 Jul 2015 04:30:49 +0000 Received: from BY2PR03MB442.namprd03.prod.outlook.com (10.141.141.145) by BY2PR03MB443.namprd03.prod.outlook.com (10.141.141.152) with Microsoft SMTP Server (TLS) id 15.1.225.13; Sat, 25 Jul 2015 04:30:48 +0000 Received: from BY2PR03MB442.namprd03.prod.outlook.com ([10.141.141.145]) by BY2PR03MB442.namprd03.prod.outlook.com ([10.141.141.145]) with mapi id 15.01.0225.018; Sat, 25 Jul 2015 04:30:48 +0000 From: Mike Jones To: Tony Arcieri , Jim Fenton Thread-Topic: [Unbearable] JWS Thread-Index: AQHQxf2LrXyN25oYS0WGLqzBTojPR53q642AgAAKc4CAAAJOAIAAAIuAgAADwACAAHtFAIAAFG0AgAAIvgCAAADyEA== Date: Sat, 25 Jul 2015 04:30:48 +0000 Message-ID: References: <55B287EB.2090301@bluepopcorn.net> <301BBBAC-1CF8-43BD-9865-52D8F725BA84@ve7jtb.com> <55B305FE.8050308@bluepopcorn.net> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: gmail.com; dkim=none (message not signed) header.d=none; x-originating-ip: [12.130.117.133] x-microsoft-exchange-diagnostics: 1; BY2PR03MB443; 5:X3MTo82p5jPYYbrB+dLlhaJHvsic8EBBah453TvTNEP/wHw3eMTWv7eYNZjeUFEIuVbAMtqBCnBxAU165LWnRErfwdRqt1iq8WFCm9EvK8GfqhqdvOhEEfBD65d8cG5oK1MkD24qLwul1pNVBU3OsQ==; 24:xMa7Rbjy/nuluFLRJ7LcqQoYASuQiguAKoj9Lt5Po2OD7R7/N1hrGfr9AAv99Czmt8LzTFTM8xP0HBsTZVIV5xUARZU5WYkl8RekPi68Ejs=; 20:XOai99/G+dUg9A64QZYrXyL3KEszX/vwtgkQQlNkJMNGdpVEPuTfVmkxmy5q9PfmeS2B5ZbnmzL4yIyTbTpsCQ== x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:; SRVR:BY2PR03MB443; UriScan:; BCL:0; PCL:0; RULEID:; SRVR:BY2PR03MB394; by2pr03mb443: X-MS-Exchange-Organization-RulesExecuted x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(108003899814671); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(601004)(2401001)(5005006)(3002001); SRVR:BY2PR03MB443; BCL:0; PCL:0; RULEID:; SRVR:BY2PR03MB443; x-forefront-prvs: 0648FCFFA8 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(24454002)(377454003)(74316001)(10090500001)(76176999)(92566002)(86612001)(33656002)(19625215002)(189998001)(46102003)(86362001)(5003600100002)(19580405001)(16236675004)(5002640100001)(106116001)(54356999)(50986999)(19300405004)(5001960100002)(122556002)(19609705001)(77096005)(87936001)(15975445007)(19580395003)(62966003)(77156002)(2950100001)(76576001)(66066001)(102836002)(40100003)(2656002)(93886004)(2900100001); DIR:OUT; SFP:1102; SCL:1; SRVR:BY2PR03MB443; H:BY2PR03MB442.namprd03.prod.outlook.com; FPR:; SPF:None; MLV:sfv; LANG:en; Content-Type: multipart/alternative; boundary="_000_BY2PR03MB442CC8201A4FED97C5E750BF5800BY2PR03MB442namprd_" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-originalarrivaltime: 25 Jul 2015 04:30:48.3255 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY2PR03MB443 X-Microsoft-Exchange-Diagnostics: 1; BY2PR03MB394; 2:tEYnHo1AhXiYRYh6oAWO4qBHjWSaM9kYbbi1EKXa+hO2BfaHRrPuzXc/LYIUulW9c0GvZFuzvlEt+YC/2hyXIFv25qQelERN5fTX4UKjQj8CRns987jCm7CkA0IIg+M9DXqTdJNm6fgkwKcB0/8olS5OlHX1eUYt2cjnudiM6cE=; 3:vIZs5f0l2AOcVVG4e748J3Pev/5xEXpShogioiQgPal39hHf7BZH243PWUC6HO51XdExKSvQQmW1dc6+g6Fogoatt2iJOMpk71HKA/ycqcuZ9q38kC2I1n54OfcwMcI/TE4lMtL/lPIdxWgqueFCXA==; 25:9iz05gTnBTbwSXWJ/az0z2tm5zbkP2c14q2BRXYdzG5xxatp1WqaBulhWFOoMus4scRx+B8cxXKEhZyQGuQbsUcdVuzHmt/uW+iwFG+K4duFoXKml4feHVnM0Xeu7nrUjWy+XB0rAGtY+wBPTGebY9ugsl+lNPlFfOBA6xSKF5dAstfGLIDiDjZrXbqowIAKc95WPRCCDhE7wWt968VjHqRNHpAJDBdMwQveiDb8azGv/JFEDri9AKMZObh3GaK/3juNulpH3IgWwV+zZLnx9g== X-Microsoft-Exchange-Diagnostics: 1; BY2PR03MB394; 20:EMUSduMjoNqwEMAhtsBYQFz0wfACAuQEabsXp3L9//PWMsBz8F6WB+EI79LeGf5yOnV78kAcWnimC05hzJX5vY8cxvUgW2pvqKedsedtRV7xRe8Ls1XN4vUwWZio06/fxI7aaYYN0EyzuAIXzhATLWvrOA7uRJnz/y473mvXSVicqP8pLGKpH7Ciyqn8PTU7C6Zz2xFyAAcRKwwuZVls+eoM6mDXW7XT9x19mMF6Dp0aTqKNxmcUfA+yW8qUmuie3Y7BYi4md6FWly6RRV/IuFMwkjQLkgbL1sgVuLg6d6zaEyJHuZCVnwzCaRTiCux+ufcaOBK61fPwUkrqL7VadZSSZzZ+32kTLxC5pDHg6tch1O4abOh+39NMz3Emud4hcV0O3oNBpoobi2ZOhYZANsNHEo8KeXmw1TBKqz0lz6fF20oK05YNF/AwOdAExPPFn4uGL572sjK2ICeuo9/DyZgT9X9J+xLAPH8I6XKbIVzs2rE3P1EQBRhIovD55HDp; 23:IZ7rYJI7nCmcwKBdnpuMjfWsBB3tkalyZ1Fhp3IymhUb4J8nLNoRqWxtQxu0si7zpVpWz2QXUjr8w5MPI4so/ZI3qMU4CNvXlH28yed+E3mEmwKbGXi8fF18/ljkr55vtJA6zKD7Y3PVj11b5qOQ2VxWGSOyy5FFhPHeMKoIvEo1pQMRr/dHhHG1/WbmIYeQWgNGoVpAcluEYRRRHMno3KXuhn/k8lwTX1Zitszka8kK6pdr7YX8MxPboIMEyuCJ BY2PR03MB394: X-MS-Exchange-Organization-RulesExecuted X-OriginatorOrg: microsoft.com Archived-At: Cc: John Bradley , "unbearable@ietf.org" , Martin Thomson Subject: Re: [Unbearable] JWS X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 25 Jul 2015 04:30:57 -0000 --_000_BY2PR03MB442CC8201A4FED97C5E750BF5800BY2PR03MB442namprd_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 V2hhdCBhdHRhY2tzIGFyZSB5b3Ugd29ycmllZCBhYm91dCBUb255PyAgQXMgSeKAmWQgd3JpdHRl biBlYXJsaWVyLCBhbiBhdHRhY2tlciBjYW7igJl0IGNoYW5nZSB0aGUgYWxnb3JpdGhtIGZvciBz aWduZWQvTUFDZWQgY29udGVudCwgc2luY2UgdGhlIGFsZ29yaXRobSBpZGVudGlmaWVyIGlzIGlu dGVncml0eSBwcm90ZWN0ZWQgYW5kIHRoZSBzaWduYXR1cmUgd2lsbCBiZSByZWplY3RlZCBpZiBu b3QgcHJvZHVjZWQgYnkgdGhlIGFsZ29yaXRobSBwcm90ZWN0ZWQgaW4gdGhlIGhlYWRlci4NCg0K QWxzbywgSeKAmWxsIG9ic2VydmUgdGhhdCB2ZXJpZnlpbmcgdGhhdCB0aGUgYWxnb3JpdGhtIHVz ZWQgaXMgY3VycmVudGx5IGFjY2VwdGFibGUgdG8gdGhlIGFwcGxpY2F0aW9uIGlzIGEgc3RhbmRh cmQgcGFydCBvZiBhbnkgY3J5cHRvZ3JhcGhpYyB3b3JrZmxvdy4gIEp1c3QgbGlrZSB5b3Ugd291 bGRu4oCZdCBhY2NlcHQgYW4gTUQ1IE1BQyBiZWNhdXNlIGl04oCZcyBub3QgaW4geW91ciBhY2Nl cHRhYmxlIGFsZ29yaXRobXMgbGlzdCwgeW91IHdvdWxkbuKAmXQgYWNjZXB0IOKAnG5vbmXigJ0g Zm9yIHRoZSBzYW1lIHJlYXNvbi4gIFRoaXMgbmVjZXNzYXJ5IGFsZ29yaXRobSBoeWdpZW5lIHN0 ZXAgaXMgZXhwbGljaXRseSByZXF1aXJlZCBieSBKV1MsIHdpdGggdGhpcyBsYW5ndWFnZToNCiAg IEZpbmFsbHksIG5vdGUgdGhhdCBpdCBpcyBhbiBhcHBsaWNhdGlvbiBkZWNpc2lvbiB3aGljaCBh bGdvcml0aG1zIG1heQ0KICAgYmUgdXNlZCBpbiBhIGdpdmVuIGNvbnRleHQuICBFdmVuIGlmIGEg SldTIGNhbiBiZSBzdWNjZXNzZnVsbHkNCiAgIHZhbGlkYXRlZCwgdW5sZXNzIHRoZSBhbGdvcml0 aG0ocykgdXNlZCBpbiB0aGUgSldTIGFyZSBhY2NlcHRhYmxlIHRvDQogICB0aGUgYXBwbGljYXRp b24sIGl0IFNIT1VMRCBjb25zaWRlciB0aGUgSldTIHRvIGJlIGludmFsaWQuDQoNCiAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEJlc3Qg d2lzaGVzLA0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgLS0gTWlrZQ0KDQpGcm9tOiBUb255IEFyY2llcmkgW21haWx0bzpiYXNjdWxl QGdtYWlsLmNvbV0NClNlbnQ6IEZyaWRheSwgSnVseSAyNCwgMjAxNSA5OjE1IFBNDQpUbzogSmlt IEZlbnRvbg0KQ2M6IEpvaG4gQnJhZGxleTsgTWlrZSBKb25lczsgdW5iZWFyYWJsZUBpZXRmLm9y ZzsgTWFydGluIFRob21zb24NClN1YmplY3Q6IFJlOiBbVW5iZWFyYWJsZV0gSldTDQoNCk9uIEZy aSwgSnVsIDI0LCAyMDE1IGF0IDg6NDMgUE0sIEppbSBGZW50b24gPGZlbnRvbkBibHVlcG9wY29y bi5uZXQ8bWFpbHRvOmZlbnRvbkBibHVlcG9wY29ybi5uZXQ+PiB3cm90ZToNCkkgYWdyZWUgdGhh dCBhIGxpYnJhcnkgdGhhdCBoYXMgaGFkIGEgYnVnIGZvdW5kIGFuZCBmaXhlZCBkb2VzIG5vdCBt ZWFuIHRoYXQgaXQgaGFzIGJlZW4gdmV0dGVkLiBJIGV4cHJlc3NlZCB0aGlzIHdyb25nLg0KDQpC dXQgaGF2aW5nIGEgbGlicmFyeSB0aGF0IGhhcyBoYWQgYXQgbGVhc3Qgc29tZSBkZWdyZWUgb2Yg dXNlIGFuZCBkZWJ1Z2dpbmcgaXMgYW4gYWR2YW50YWdlIG92ZXIgZG9pbmcgc29tZXRoaW5nIGRp ZmZlcmVudCBhbmQgd3JpdGluZyBuZXcgbGlicmFyaWVzIGZyb20gc2NyYXRjaC4NCg0KSSBkb24n dCB0aGluayBKV1MvSldUIGFyZSB0aGUgb25seSBnYW1lIGluIHRvd24uIFRoZXJlIGFyZSBhbHRl cm5hdGl2ZXMgdG8gY29uc2lkZXIgd2hpY2ggZG9uJ3QgaW52b2x2ZSAid3JpdGluZyBuZXcgbGli cmFyaWVzIGZyb20gc2NyYXRjaCINCg0KLS0NClRvbnkgQXJjaWVyaQ0K --_000_BY2PR03MB442CC8201A4FED97C5E750BF5800BY2PR03MB442namprd_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTQgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1IDUgMiAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNlDQoJ e2ZvbnQtZmFtaWx5OlRhaG9tYTsNCglwYW5vc2UtMToyIDExIDYgNCAzIDUgNCA0IDIgNDt9DQov KiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1z b05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNp emU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iLCJzZXJpZiI7fQ0KYTps aW5rLCBzcGFuLk1zb0h5cGVybGluaw0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6 Ymx1ZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCmE6dmlzaXRlZCwgc3Bhbi5Nc29I eXBlcmxpbmtGb2xsb3dlZA0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6cHVycGxl Ow0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KcHJlDQoJe21zby1zdHlsZS1wcmlvcml0 eTo5OTsNCgltc28tc3R5bGUtbGluazoiSFRNTCBQcmVmb3JtYXR0ZWQgQ2hhciI7DQoJbWFyZ2lu OjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEyLjBwdDsNCglmb250 LWZhbWlseToiQ291cmllciBOZXciO30NCnNwYW4uRW1haWxTdHlsZTE3DQoJe21zby1zdHlsZS10 eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIiwic2Fucy1zZXJpZiI7 DQoJY29sb3I6IzFGNDk3RDt9DQpzcGFuLkhUTUxQcmVmb3JtYXR0ZWRDaGFyDQoJe21zby1zdHls ZS1uYW1lOiJIVE1MIFByZWZvcm1hdHRlZCBDaGFyIjsNCgltc28tc3R5bGUtcHJpb3JpdHk6OTk7 DQoJbXNvLXN0eWxlLWxpbms6IkhUTUwgUHJlZm9ybWF0dGVkIjsNCglmb250LWZhbWlseToiQ291 cmllciBOZXciO30NCi5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5 Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIiwic2Fucy1zZXJpZiI7fQ0KQHBhZ2UgV29yZFNlY3Rp b24xDQoJe3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBpbiAxLjBpbiAxLjBp bjt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi0tPjwvc3R5bGU+ PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWRlZmF1bHRzIHY6ZXh0PSJlZGl0IiBz cGlkbWF4PSIxMDI2IiAvPg0KPC94bWw+PCFbZW5kaWZdLS0+PCEtLVtpZiBndGUgbXNvIDldPjx4 bWw+DQo8bzpzaGFwZWxheW91dCB2OmV4dD0iZWRpdCI+DQo8bzppZG1hcCB2OmV4dD0iZWRpdCIg ZGF0YT0iMSIgLz4NCjwvbzpzaGFwZWxheW91dD48L3htbD48IVtlbmRpZl0tLT4NCjwvaGVhZD4N Cjxib2R5IGxhbmc9IkVOLVVTIiBsaW5rPSJibHVlIiB2bGluaz0icHVycGxlIj4NCjxkaXYgY2xh c3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LCZxdW90O3NhbnMt c2VyaWYmcXVvdDs7Y29sb3I6IzFGNDk3RCI+V2hhdCBhdHRhY2tzIGFyZSB5b3Ugd29ycmllZCBh Ym91dCBUb255PyZuYnNwOyBBcyBJ4oCZZCB3cml0dGVuIGVhcmxpZXIsIGFuIGF0dGFja2VyIGNh buKAmXQgY2hhbmdlIHRoZSBhbGdvcml0aG0gZm9yIHNpZ25lZC9NQUNlZCBjb250ZW50LCBzaW5j ZSB0aGUgYWxnb3JpdGhtIGlkZW50aWZpZXINCiBpcyBpbnRlZ3JpdHkgcHJvdGVjdGVkIGFuZCB0 aGUgc2lnbmF0dXJlIHdpbGwgYmUgcmVqZWN0ZWQgaWYgbm90IHByb2R1Y2VkIGJ5IHRoZSBhbGdv cml0aG0gcHJvdGVjdGVkIGluIHRoZSBoZWFkZXIuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q2FsaWJyaSZxdW90OywmcXVvdDtzYW5zLXNlcmlmJnF1b3Q7O2NvbG9yOiMxRjQ5 N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90Oztjb2xvcjojMUY0OTdEIj5BbHNvLCBJ4oCZbGwgb2Jz ZXJ2ZSB0aGF0IHZlcmlmeWluZyB0aGF0IHRoZSBhbGdvcml0aG0gdXNlZCBpcyBjdXJyZW50bHkg YWNjZXB0YWJsZSB0byB0aGUgYXBwbGljYXRpb24gaXMgYSBzdGFuZGFyZCBwYXJ0IG9mIGFueSBj cnlwdG9ncmFwaGljIHdvcmtmbG93LiZuYnNwOyBKdXN0DQogbGlrZSB5b3Ugd291bGRu4oCZdCBh Y2NlcHQgYW4gTUQ1IE1BQyBiZWNhdXNlIGl04oCZcyBub3QgaW4geW91ciBhY2NlcHRhYmxlIGFs Z29yaXRobXMgbGlzdCwgeW91IHdvdWxkbuKAmXQgYWNjZXB0IOKAnG5vbmXigJ0gZm9yIHRoZSBz YW1lIHJlYXNvbi4mbmJzcDsgVGhpcyBuZWNlc3NhcnkgYWxnb3JpdGhtIGh5Z2llbmUgc3RlcCBp cyBleHBsaWNpdGx5IHJlcXVpcmVkIGJ5IEpXUywgd2l0aCB0aGlzIGxhbmd1YWdlOjxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJwYWdlLWJyZWFrLWJl Zm9yZTphbHdheXMiPjxzcGFuIGxhbmc9IkVOIiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291 cmllciBOZXcmcXVvdDsiPiZuYnNwOyZuYnNwOyBGaW5hbGx5LCBub3RlIHRoYXQgaXQgaXMgYW4g YXBwbGljYXRpb24gZGVjaXNpb24gd2hpY2ggYWxnb3JpdGhtcyBtYXk8bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0icGFnZS1icmVhay1iZWZvcmU6YWx3 YXlzIj48c3BhbiBsYW5nPSJFTiIgc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3 JnF1b3Q7Ij4mbmJzcDsmbmJzcDsgYmUgdXNlZCBpbiBhIGdpdmVuIGNvbnRleHQuJm5ic3A7IEV2 ZW4gaWYgYSBKV1MgY2FuIGJlIHN1Y2Nlc3NmdWxseTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJwYWdlLWJyZWFrLWJlZm9yZTphbHdheXMiPjxzcGFu IGxhbmc9IkVOIiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPiZu YnNwOyZuYnNwOyB2YWxpZGF0ZWQsIHVubGVzcyB0aGUgYWxnb3JpdGhtKHMpIHVzZWQgaW4gdGhl IEpXUyBhcmUgYWNjZXB0YWJsZSB0bzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJwYWdlLWJyZWFrLWJlZm9yZTphbHdheXMiPjxzcGFuIGxhbmc9IkVO IiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPiZuYnNwOyZuYnNw OyB0aGUgYXBwbGljYXRpb24sIGl0IFNIT1VMRCBjb25zaWRlciB0aGUgSldTIHRvIGJlIGludmFs aWQuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OywmcXVv dDtzYW5zLXNlcmlmJnF1b3Q7O2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90Oztj b2xvcjojMUY0OTdEIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgQmVzdCB3aXNoZXMsPG86cD48L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OywmcXVvdDtzYW5zLXNlcmlmJnF1b3Q7O2Nv bG9yOiMxRjQ5N0QiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAtLSBNaWtlPG86cD48L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OywmcXVvdDtzYW5zLXNlcmlmJnF1b3Q7O2NvbG9yOiMx RjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1RhaG9t YSZxdW90OywmcXVvdDtzYW5zLXNlcmlmJnF1b3Q7Ij5Gcm9tOjwvc3Bhbj48L2I+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VGFob21hJnF1b3Q7LCZxdW90 O3NhbnMtc2VyaWYmcXVvdDsiPiBUb255IEFyY2llcmkgW21haWx0bzpiYXNjdWxlQGdtYWlsLmNv bV0NCjxicj4NCjxiPlNlbnQ6PC9iPiBGcmlkYXksIEp1bHkgMjQsIDIwMTUgOToxNSBQTTxicj4N CjxiPlRvOjwvYj4gSmltIEZlbnRvbjxicj4NCjxiPkNjOjwvYj4gSm9obiBCcmFkbGV5OyBNaWtl IEpvbmVzOyB1bmJlYXJhYmxlQGlldGYub3JnOyBNYXJ0aW4gVGhvbXNvbjxicj4NCjxiPlN1Ympl Y3Q6PC9iPiBSZTogW1VuYmVhcmFibGVdIEpXUzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+T24gRnJpLCBKdWwgMjQsIDIwMTUgYXQgODo0MyBQTSwg SmltIEZlbnRvbiAmbHQ7PGEgaHJlZj0ibWFpbHRvOmZlbnRvbkBibHVlcG9wY29ybi5uZXQiIHRh cmdldD0iX2JsYW5rIj5mZW50b25AYmx1ZXBvcGNvcm4ubmV0PC9hPiZndDsgd3JvdGU6PG86cD48 L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkkgYWdyZWUgdGhh dCBhIGxpYnJhcnkgdGhhdCBoYXMgaGFkIGEgYnVnIGZvdW5kIGFuZCBmaXhlZCBkb2VzIG5vdCBt ZWFuIHRoYXQgaXQgaGFzIGJlZW4gdmV0dGVkLiBJIGV4cHJlc3NlZCB0aGlzIHdyb25nLjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48YnI+DQpCdXQgaGF2aW5n IGEgbGlicmFyeSB0aGF0IGhhcyBoYWQgYXQgbGVhc3Qgc29tZSBkZWdyZWUgb2YgdXNlIGFuZCBk ZWJ1Z2dpbmcgaXMgYW4gYWR2YW50YWdlIG92ZXIgZG9pbmcgc29tZXRoaW5nIGRpZmZlcmVudCBh bmQgd3JpdGluZyBuZXcgbGlicmFyaWVzIGZyb20gc2NyYXRjaC48bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SSBkb24ndCB0aGluayBKV1MvSldU IGFyZSB0aGUgb25seSBnYW1lIGluIHRvd24uIFRoZXJlIGFyZSBhbHRlcm5hdGl2ZXMgdG8gY29u c2lkZXIgd2hpY2ggZG9uJ3QgaW52b2x2ZSAmcXVvdDt3cml0aW5nIG5ldyBsaWJyYXJpZXMgZnJv bSBzY3JhdGNoJnF1b3Q7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj4tLSA8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj5Ub255IEFyY2llcmk8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4N CjwvZGl2Pg0KPC9ib2R5Pg0KPC9odG1sPg0K --_000_BY2PR03MB442CC8201A4FED97C5E750BF5800BY2PR03MB442namprd_-- From nobody Fri Jul 24 23:33:18 2015 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AF0BC1B2CE4 for ; Fri, 24 Jul 2015 23:33:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.209 X-Spam-Level: X-Spam-Status: No, score=-4.209 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cIdwVx7_233s for ; Fri, 24 Jul 2015 23:33:14 -0700 (PDT) Received: from userp1040.oracle.com (userp1040.oracle.com [156.151.31.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D332C1B2CE6 for ; Fri, 24 Jul 2015 23:33:14 -0700 (PDT) Received: from aserv0022.oracle.com (aserv0022.oracle.com [141.146.126.234]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id t6P6X3P8011745 (version=TLSv1 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Sat, 25 Jul 2015 06:33:04 GMT Received: from userv0121.oracle.com (userv0121.oracle.com [156.151.31.72]) by aserv0022.oracle.com (8.13.8/8.13.8) with ESMTP id t6P6X3GR017028 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL); Sat, 25 Jul 2015 06:33:03 GMT Received: from abhmp0012.oracle.com (abhmp0012.oracle.com [141.146.116.18]) by userv0121.oracle.com (8.13.8/8.13.8) with ESMTP id t6P6X2Nh001763; Sat, 25 Jul 2015 06:33:02 GMT Received: from [25.87.95.120] (/72.143.228.191) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Fri, 24 Jul 2015 23:33:01 -0700 Content-Type: multipart/alternative; boundary=Apple-Mail-9BA599C3-90DD-447E-B67C-F376028C4229 Content-Transfer-Encoding: 7bit From: Phil Hunt Mime-Version: 1.0 (1.0) Date: Sat, 25 Jul 2015 08:18:57 +0200 Message-Id: References: <55B287EB.2090301@bluepopcorn.net> <301BBBAC-1CF8-43BD-9865-52D8F725BA84@ve7jtb.com> <55B305FE.8050308@bluepopcorn.net> In-Reply-To: To: Mike Jones X-Mailer: iPhone Mail (12F70) X-Source-IP: aserv0022.oracle.com [141.146.126.234] Archived-At: Cc: Jim Fenton , Tony Arcieri , "unbearable@ietf.org" , Martin Thomson , John Bradley Subject: Re: [Unbearable] JWS X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 25 Jul 2015 06:33:16 -0000 --Apple-Mail-9BA599C3-90DD-447E-B67C-F376028C4229 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable +1.=20 Phil > On Jul 25, 2015, at 06:30, Mike Jones wrote:= >=20 > What attacks are you worried about Tony? As I=E2=80=99d written earlier, a= n attacker can=E2=80=99t change the algorithm for signed/MACed content, sinc= e the algorithm identifier is integrity protected and the signature will be r= ejected if not produced by the algorithm protected in the header. > =20 > Also, I=E2=80=99ll observe that verifying that the algorithm used is curre= ntly acceptable to the application is a standard part of any cryptographic w= orkflow. Just like you wouldn=E2=80=99t accept an MD5 MAC because it=E2=80=99= s not in your acceptable algorithms list, you wouldn=E2=80=99t accept =E2=80= =9Cnone=E2=80=9D for the same reason. This necessary algorithm hygiene step= is explicitly required by JWS, with this language: > Finally, note that it is an application decision which algorithms may > be used in a given context. Even if a JWS can be successfully > validated, unless the algorithm(s) used in the JWS are acceptable to > the application, it SHOULD consider the JWS to be invalid. > =20 > Best wishes, > -- Mike > =20 > From: Tony Arcieri [mailto:bascule@gmail.com]=20 > Sent: Friday, July 24, 2015 9:15 PM > To: Jim Fenton > Cc: John Bradley; Mike Jones; unbearable@ietf.org; Martin Thomson > Subject: Re: [Unbearable] JWS > =20 > On Fri, Jul 24, 2015 at 8:43 PM, Jim Fenton wrote= : > I agree that a library that has had a bug found and fixed does not mean th= at it has been vetted. I expressed this wrong. >=20 > But having a library that has had at least some degree of use and debuggin= g is an advantage over doing something different and writing new libraries f= rom scratch. > =20 > I don't think JWS/JWT are the only game in town. There are alternatives to= consider which don't involve "writing new libraries from scratch" > =20 > -- > Tony Arcieri > _______________________________________________ > Unbearable mailing list > Unbearable@ietf.org > https://www.ietf.org/mailman/listinfo/unbearable --Apple-Mail-9BA599C3-90DD-447E-B67C-F376028C4229 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable
+1. 

Phil

On Jul 25, 2015, at 0= 6:30, Mike Jones <Michael.= Jones@microsoft.com> wrote:

What attacks are you worrie= d about Tony?  As I=E2=80=99d written earlier, an attacker can=E2=80=99= t change the algorithm for signed/MACed content, since the algorithm identif= ier is integrity protected and the signature will be rejected if not produced b= y the algorithm protected in the header.

 

Also, I=E2=80=99ll observe t= hat verifying that the algorithm used is currently acceptable to the applica= tion is a standard part of any cryptographic workflow.  Just like you wouldn=E2=80=99t accept an MD5 MAC because it=E2=80=99s not in you= r acceptable algorithms list, you wouldn=E2=80=99t accept =E2=80=9Cnone=E2=80= =9D for the same reason.  This necessary algorithm hygiene step is expl= icitly required by JWS, with this language:

   Finally, note that= it is an application decision which algorithms may

   be used in a given= context.  Even if a JWS can be successfully

   validated, unless t= he algorithm(s) used in the JWS are acceptable to

   the application, i= t SHOULD consider the JWS to be invalid.

 

    &nb= sp;            &= nbsp;            = ;            &nb= sp;            &= nbsp;    Best wishes,

    &nb= sp;            &= nbsp;            = ;            &nb= sp;            &= nbsp;    -- Mike

 

From: Tony Arcier= i [mailto:bascule@gmail.com]
Sent: Friday, July 24, 2015 9:15 PM
To: Jim Fenton
Cc: John Bradley; Mike Jones; = unbearable@ietf.org; Martin Thomson
Subject: Re: [Unbearable] JWS

 

On Fri, Jul 24, 2015 at 8:43 PM, Jim Fenton <fenton@bluepopcorn.ne= t> wrote:

I agree that a library that has had a bug found and f= ixed does not mean that it has been vetted. I expressed this wrong.


But having a library that has had at least some degree of use and debugging i= s an advantage over doing something different and writing new libraries from= scratch.

 

I don't think JWS/JWT are the only game in town. Ther= e are alternatives to consider which don't involve "writing new libraries fr= om scratch"

 

--

Tony Arcieri

____________________= ___________________________
Unbearable mailing listUnbearable@ietf.org
http= s://www.ietf.org/mailman/listinfo/unbearable
= --Apple-Mail-9BA599C3-90DD-447E-B67C-F376028C4229-- From nobody Sat Jul 25 01:22:20 2015 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 481E51A9308 for ; Sat, 25 Jul 2015 01:22:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cd-yNqPpEJ_z for ; Sat, 25 Jul 2015 01:22:16 -0700 (PDT) Received: from mail-wi0-f175.google.com (mail-wi0-f175.google.com [209.85.212.175]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E43721A92FD for ; Sat, 25 Jul 2015 01:22:15 -0700 (PDT) Received: by wibud3 with SMTP id ud3so86135460wib.1 for ; Sat, 25 Jul 2015 01:22:14 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:content-type:mime-version:subject:from :in-reply-to:date:cc:message-id:references:to; bh=AkvhOB1pQvxpr+XEtdCyyWFK+RXtgFvQjPX/RALepn4=; b=BqJDUCvsw4zw41FiJySUlT6RTbT/vkMc+XdgQNe5OZ/Phu7NiNzc1+W8U7F1Mm/0by 7YH8NuNuBm0STuCPKtwzrvQf4yaGlA0yUSO6UA43yBTu48xt7aaOvuLrLqWQ4Q2o2qCf SmeqveHqjcNm0DgPQfPKlHwc9iZpKQqn6of3PEOgs+e843XQdYDpeZFQytOUR5A8dCPv TVObLXwVEc1bgc0OvVpF8g43whao49Cqq/oiIC9qeT/E8zle1s/ZqKeN1GwlukGA+bgG IRFqYM/yQXaWHXm6s9k1cJ6bXe/So897453SUdtn6AFiwSY4h4TzdHH9u5xbf3ADxpN3 1qDg== X-Gm-Message-State: ALoCoQlOhXBoWKRpYUEsprWzoO04OChQl+eXnl8CreKxttle4fhfmRB7vdCq1Oi3Hd+4CqK6WU+L X-Received: by 10.194.175.233 with SMTP id cd9mr34607273wjc.68.1437812534585; Sat, 25 Jul 2015 01:22:14 -0700 (PDT) Received: from [10.6.0.67] ([62.212.85.119]) by smtp.gmail.com with ESMTPSA id v9sm16460425wjq.41.2015.07.25.01.22.13 (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Sat, 25 Jul 2015 01:22:13 -0700 (PDT) Content-Type: multipart/signed; boundary="Apple-Mail=_393C17D7-5149-4403-86E2-96D195D4C1CB"; protocol="application/pkcs7-signature"; micalg=sha1 Mime-Version: 1.0 (Mac OS X Mail 8.2 \(2102\)) From: John Bradley In-Reply-To: Date: Sat, 25 Jul 2015 10:22:12 +0200 Message-Id: <1D759D00-9DD2-4F44-BDD5-63615941B0CB@ve7jtb.com> References: <55B287EB.2090301@bluepopcorn.net> <301BBBAC-1CF8-43BD-9865-52D8F725BA84@ve7jtb.com> <55B305FE.8050308@bluepopcorn.net> To: Tony Arcieri X-Mailer: Apple Mail (2.2102) Archived-At: Cc: Jim Fenton , Michael Jones , Martin Thomson , "unbearable@ietf.org" Subject: Re: [Unbearable] JWS X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 25 Jul 2015 08:22:19 -0000 --Apple-Mail=_393C17D7-5149-4403-86E2-96D195D4C1CB Content-Type: multipart/alternative; boundary="Apple-Mail=_E5CEB814-A60E-4CB2-A667-08AAAF4EB565" --Apple-Mail=_E5CEB814-A60E-4CB2-A667-08AAAF4EB565 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 It is true that JWS/JWT are not the only game in town. In point of = fact the Token Binding specs don=E2=80=99t use JWS/JWT at this point. This started form a question, asking why we don=E2=80=99t reuse that = signature/envelope format vs something custom. That is a reasonable thing to ask and people to provide opinions on, = however I don=E2=80=99t think it is a indication that we are close to = making a change. The blog post you point to has information on two implementation flaws = (it is argued that they are caused by a design flaw allowing the = implementation flaws)=20 1: that a receiver blindly uses the alg specified in the assertion, = without respect to it=E2=80=99s relationship with the sender. This is = a algorithm down grade attack and is not unique to JWS/JWE. 2: That an attacker knowing the public key and key_id for a sender can = craft a assertion that uses a HMAC algorithm with that public key. Any = signature verification that allows keys to be used with the wrong = algorithm is problematic. If these attacks can compromise token binding then they need to be = addressed in whatever signature method we use. At the F2F we did ask for an expansion of the security considerations. I would like to understand the attacks on this level of the protocol. We have a alg negotiation phase, =20 Can an attacker who has a token bound token and knows the public key = negotiate a algorithm downgrade that would let them sign without the = original private key? After a alg for a key is established at the server is that maintained = across sessions or is a new TLS session able to negotiate a different = alg for the same key? I think that is the more general question. I suspect the correct answer is that the alg for a UA is established = before the self signed token is sent, and the server MUST not allow a = different alg to be negotiated for that key, otherwise it would be = treated as a new key. That would apply equally to any envelope we use. I hope we can capture some of this in the new security considerations, = as it might be something that a implementer could get wrong. Regards John B. > On Jul 25, 2015, at 6:15 AM, Tony Arcieri wrote: >=20 > On Fri, Jul 24, 2015 at 8:43 PM, Jim Fenton > wrote: > I agree that a library that has had a bug found and fixed does not = mean that it has been vetted. I expressed this wrong. >=20 > But having a library that has had at least some degree of use and = debugging is an advantage over doing something different and writing new = libraries from scratch. >=20 > I don't think JWS/JWT are the only game in town. There are = alternatives to consider which don't involve "writing new libraries from = scratch" > =20 > --=20 > Tony Arcieri --Apple-Mail=_E5CEB814-A60E-4CB2-A667-08AAAF4EB565 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 It is true that JWS/JWT are not the only game in town.   = In point of fact the Token Binding specs don=E2=80=99t use JWS/JWT at = this point.

This = started form a question, asking why we don=E2=80=99t reuse that = signature/envelope format vs something custom.

That is a reasonable thing to ask and = people to provide opinions on, however I don=E2=80=99t think it is a = indication that we are close to making a change.

The blog post you point to has = information on two implementation flaws (it is argued that they are = caused by a design flaw allowing the implementation = flaws) 
1: that a receiver blindly uses the = alg specified in the assertion, without respect to it=E2=80=99s = relationship with the sender.   This is a algorithm down grade = attack and is not unique to JWS/JWE.
2: That an = attacker knowing the public key and key_id for a sender can craft a = assertion that uses a HMAC algorithm with that public key.   Any = signature verification that allows keys to be used with the wrong = algorithm is problematic.

If these attacks can compromise token binding then they need = to be addressed in whatever signature method we use.
At the F2F we did ask for an expansion of the security = considerations.

I would like to understand the attacks on this level of the = protocol.

We = have a alg negotiation phase,   
Can an = attacker who has a token bound token and knows the public key negotiate = a algorithm downgrade that would let them sign without the original = private key?
After a alg for a key is established = at the server is that maintained across sessions or is a new TLS session = able to negotiate a different alg for the same key?

I think that is the more = general question.

I suspect the correct answer is that the alg for a UA is = established before the self signed token is sent, and the server MUST = not allow a different alg to be negotiated for that key, otherwise it = would be treated as a new key.   That would apply equally to any = envelope we use.

I hope we can capture some of this in the new security = considerations, as it might be something that a implementer could get = wrong.

Regards
John B.

On Jul 25, 2015, at 6:15 AM, Tony Arcieri = <bascule@gmail.com> wrote:

On Fri, = Jul 24, 2015 at 8:43 PM, Jim Fenton <fenton@bluepopcorn.net> wrote:
=20 =20 =20
I agree that a library that has had a bug found and = fixed does not mean that it has been vetted. I expressed this wrong.
But having a library that has had at least some degree of use and debugging is an advantage over doing something different and writing new libraries from scratch.

I don't think JWS/JWT are the only game = in town. There are alternatives to consider which don't involve "writing = new libraries from scratch"
 
-- =
Tony Arcieri

= --Apple-Mail=_E5CEB814-A60E-4CB2-A667-08AAAF4EB565-- --Apple-Mail=_393C17D7-5149-4403-86E2-96D195D4C1CB Content-Disposition: attachment; filename=smime.p7s Content-Type: application/pkcs7-signature; name=smime.p7s Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIINPDCCBjQw ggQcoAMCAQICASAwDQYJKoZIhvcNAQEFBQAwfTELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcxKTAn BgNVBAMTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTA3MTAyNDIxMDI1NVoX DTE3MTAyNDIxMDI1NVowgYwxCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSsw KQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMTgwNgYDVQQDEy9TdGFy dENvbSBDbGFzcyAyIFByaW1hcnkgSW50ZXJtZWRpYXRlIENsaWVudCBDQTCCASIwDQYJKoZIhvcN AQEBBQADggEPADCCAQoCggEBAMsohUWcASz7GfKrpTOMKqANy9BV7V0igWdGxA8IU77L3aTxErQ+ fcxtDYZ36Z6GH0YFn7fq5RADteP0AYzrCA+EQTfi8q1+kA3m0nwtwXG94M5sIqsvs7lRP1aycBke /s5g9hJHryZ2acScnzczjBCAo7X1v5G3yw8MDP2m2RCye0KfgZ4nODerZJVzhAlOD9YejvAXZqHk sw56HzElVIoYSZ3q4+RJuPXXfIoyby+Y2m1E+YzX5iCZXBx05gk6MKAW1vaw4/v2OOLy6FZH3XHH tOkzUreG//CsFnB9+uaYSlR65cdGzTsmoIK8WH1ygoXhRBm98SD7Hf/r3FELNvUCAwEAAaOCAa0w ggGpMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBSuVYNv7DHKufcd +q9rMfPIHeOsuzAfBgNVHSMEGDAWgBROC+8apEBbpRdphzDKNGhD0EGu8jBmBggrBgEFBQcBAQRa MFgwJwYIKwYBBQUHMAGGG2h0dHA6Ly9vY3NwLnN0YXJ0c3NsLmNvbS9jYTAtBggrBgEFBQcwAoYh aHR0cDovL3d3dy5zdGFydHNzbC5jb20vc2ZzY2EuY3J0MFsGA1UdHwRUMFIwJ6AloCOGIWh0dHA6 Ly93d3cuc3RhcnRzc2wuY29tL3Nmc2NhLmNybDAnoCWgI4YhaHR0cDovL2NybC5zdGFydHNzbC5j b20vc2ZzY2EuY3JsMIGABgNVHSAEeTB3MHUGCysGAQQBgbU3AQIBMGYwLgYIKwYBBQUHAgEWImh0 dHA6Ly93d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwNAYIKwYBBQUHAgEWKGh0dHA6Ly93d3cu c3RhcnRzc2wuY29tL2ludGVybWVkaWF0ZS5wZGYwDQYJKoZIhvcNAQEFBQADggIBADqpJw3I07QW ke9plNBpxUxcffc7nUrIQpJHDci91DFG7fVhHRkMZ1J+BKg5UNUxIFJ2Z9B90Micc/NXcs7kPBRd n6XGO/vPc87Y6R+cWS9Nc9+fp3Enmsm94OxOwI9wn8qnr/6o3mD4noP9JphwUPTXwHovjavRnhUQ HLfo/i2NG0XXgTHXS2Xm0kVUozXqpYpAdumMiB/vezj1QHQJDmUdPYMcp+reg9901zkyT3fDW/iv JVv6pWtkh6Pw2ytZT7mvg7YhX3V50Nv860cV11mocUVcqBLv0gcT+HBDYtbuvexNftwNQKD5193A 7zN4vG7CTYkXxytSjKuXrpEatEiFPxWgb84nVj25SU5q/r1Xhwby6mLhkbaXslkVtwEWT3Van49r KjlK4XrUKYYWtnfzq6aSak5u0Vpxd1rY79tWhD3EdCvOhNz/QplNa+VkIsrcp7+8ZhP1l1b2U6Ma xIVteuVMD3X0vziIwr7jxYae9FZjbxlpUemqXjcC0QaFfN7qI0JsQMALL7iGRBg7K0CoOBzECdD3 fuZil5kU/LP9cr1BK31U0Uy651bFnAMMMkqhAChIbn0ei72VnbpSsrrSdF0BAGYQ8vyHae5aCg+H 75dVCV33K6FuxZrf09yTz+Vx/PkdRUYkXmZz/OTfyJXsUOUXrym6KvI2rYpccSk5MIIHADCCBeig AwIBAgICSAcwDQYJKoZIhvcNAQEFBQAwgYwxCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENv bSBMdGQuMSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMTgwNgYD VQQDEy9TdGFydENvbSBDbGFzcyAyIFByaW1hcnkgSW50ZXJtZWRpYXRlIENsaWVudCBDQTAeFw0x NDAzMjQyMzU2MjNaFw0xNjAzMjUwOTM5MzFaMIGfMRkwFwYDVQQNExBxekYwMVhZQ1pNTDM4N2hE MQswCQYDVQQGEwJDTDEiMCAGA1UECBMZTWV0cm9wb2xpdGFuYSBkZSBTYW50aWFnbzEWMBQGA1UE BxMNSXNsYSBkZSBNYWlwbzEVMBMGA1UEAxMMSm9obiBCcmFkbGV5MSIwIAYJKoZIhvcNAQkBFhNq YnJhZGxleUBpY2xvdWQuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtTL0o4QG WC+jnmYa7xEjcBTAeIOt7ILy40qsnJHNedVaTH0EU5yHzoaEOGHuOuwJUz/C7r2TvXpJ/Ud4w6VO HdOUGnnKUiH5MV/kIysZ7DpN5D1f+yEast00oKsEbf/D6flzfex2JFV9rT7AQ+FQaTdf3S9K7gM2 F5kODFg805BMYTGT+haw9VOMXju5s93VEjUQcnGrLy0RtoN76GM6ItxqNnEt/Ln+2GNq8JvPyUKe JsAxfIlTyqIbw32VlusKXL4+jmgFi+LY6bsfg3VHLvy58QsQnCwHg15uARvy5X6owyGcG7xHwNml fNWtBZ3DHNPh37HC9lmAy4iqw4PvNwIDAQABo4IDVTCCA1EwCQYDVR0TBAIwADALBgNVHQ8EBAMC BLAwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMB0GA1UdDgQWBBSUDb6BlJD7FIYgWj1w 4z+GsOXs7zAfBgNVHSMEGDAWgBSuVYNv7DHKufcd+q9rMfPIHeOsuzCBmQYDVR0RBIGRMIGOgRNq YnJhZGxleUBpY2xvdWQuY29tgRNqYnJhZGxleUBpY2xvdWQuY29tgRdqb2huLmJyYWRsZXlAd2lu Z2FhLmNvbYERdmU3anRiQHZlN2p0Yi5jb22BD2picmFkbGV5QG1lLmNvbYEQamJyYWRsZXlAbWFj LmNvbYETamJyYWRsZXlAd2luZ2FhLmNvbTCCAUwGA1UdIASCAUMwggE/MIIBOwYLKwYBBAGBtTcB AgMwggEqMC4GCCsGAQUFBwIBFiJodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9wb2xpY3kucGRmMIH3 BggrBgEFBQcCAjCB6jAnFiBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTADAgEBGoG+ VGhpcyBjZXJ0aWZpY2F0ZSB3YXMgaXNzdWVkIGFjY29yZGluZyB0byB0aGUgQ2xhc3MgMiBWYWxp ZGF0aW9uIHJlcXVpcmVtZW50cyBvZiB0aGUgU3RhcnRDb20gQ0EgcG9saWN5LCByZWxpYW5jZSBv bmx5IGZvciB0aGUgaW50ZW5kZWQgcHVycG9zZSBpbiBjb21wbGlhbmNlIG9mIHRoZSByZWx5aW5n IHBhcnR5IG9ibGlnYXRpb25zLjA2BgNVHR8ELzAtMCugKaAnhiVodHRwOi8vY3JsLnN0YXJ0c3Ns LmNvbS9jcnR1Mi1jcmwuY3JsMIGOBggrBgEFBQcBAQSBgTB/MDkGCCsGAQUFBzABhi1odHRwOi8v b2NzcC5zdGFydHNzbC5jb20vc3ViL2NsYXNzMi9jbGllbnQvY2EwQgYIKwYBBQUHMAKGNmh0dHA6 Ly9haWEuc3RhcnRzc2wuY29tL2NlcnRzL3N1Yi5jbGFzczIuY2xpZW50LmNhLmNydDAjBgNVHRIE HDAahhhodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS8wDQYJKoZIhvcNAQEFBQADggEBALscEldbrgeF B1WC/hMdYxFT4Lc8ALtErgJryRozTdeMlzpsncIKyy8M54HhxQAMOqFe2HR+R9H7WeIzmkV95yJn JY3bd4bxnnemhLrDyi1VlNjEjkK5kgegI8JavahFXl4FwJHHv8TOh71Wf3fiy0Do7d7TQmVDRrzt 1k/2w4CXKweQ2mdFw7fskiYoPGEK7pFiicGMFBzLiKRm61CqojS4IYShiP0nCZZWPwNJYs5lstxD SSMaD+KccZVxkL7X2Qj9PJ+PCAQ6dMhvwTXrdcnrE7fI8PhFvHWrERjg7yIu1WI4Fgviy0u7437v WzufSnfqMwbfz20fucO0chYq+tkxggNsMIIDaAIBATCBkzCBjDELMAkGA1UEBhMCSUwxFjAUBgNV BAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNp Z25pbmcxODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDIgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xp ZW50IENBAgJIBzAJBgUrDgMCGgUAoIIBrTAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqG SIb3DQEJBTEPFw0xNTA3MjUwODIyMTJaMCMGCSqGSIb3DQEJBDEWBBRQgMr6U7Q2Pj6oE89q4JZZ aDLnxTCBpAYJKwYBBAGCNxAEMYGWMIGTMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRD b20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYG A1UEAxMvU3RhcnRDb20gQ2xhc3MgMiBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0ECAkgH MIGmBgsqhkiG9w0BCRACCzGBlqCBkzCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29t IEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcxODA2BgNV BAMTL1N0YXJ0Q29tIENsYXNzIDIgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50IENBAgJIBzAN BgkqhkiG9w0BAQEFAASCAQCjIJQYT2f5HditVZTrzEna97vuwVa1+HdIu/sCm+eR4vjyHN3eXan4 XPre5L47aaoi+3BsBO/BOtCI9yIyDMAp1iFCO1zVQndHdw0DGhNUh5qEzuxJUy9EJ1vw74XHODm/ BYzol9WpeN2isSshizX/kXyfG8D8cXqV8R7qvmStpFU7BSo23rzxAsfhsFlEVa8urtW1177NTVBk XMWk+/ZbvpMg/A9LHh7tOpFrThuTT7eOPH06d90+NO9StLjzLc8ZdtUv+EEFzr079JrRS8HKMol9 gbiU1CtDLGg3sQ8vsotQq29Nh0F47QO8sE5Dgm3SdMMiko8kEC2TU53r3kYeAAAAAAAA --Apple-Mail=_393C17D7-5149-4403-86E2-96D195D4C1CB-- From nobody Sat Jul 25 10:17:43 2015 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AD54F1A1B82 for ; Sat, 25 Jul 2015 10:17:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9QcWKnTtJIwg for ; Sat, 25 Jul 2015 10:17:41 -0700 (PDT) Received: from mail-oi0-x233.google.com (mail-oi0-x233.google.com [IPv6:2607:f8b0:4003:c06::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F01DC1A0233 for ; Sat, 25 Jul 2015 10:17:40 -0700 (PDT) Received: by oibn4 with SMTP id n4so33683120oib.3 for ; Sat, 25 Jul 2015 10:17:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; bh=3W/3IwRjS8wKRWVDnqWZPupioOGhu1PrJ9LnoKCM8DA=; b=hamK9JG0IDA6OuP+0OBFxSpO8R7sM7Uqyosq5e+IGkK5IhlrFvRLBjET6Gw+ntAQgY HD4qkKcnWWBhaMfRzONzH+mEYeTrap9LopNQlLpy9tItWq+M+2Ckt1/tW/OK7jHZnNbD DccnxDV2ozq1NsgzGINE8I3y9mRzSwA7v/lbGyK1FTLfCUWh7nsIiKYaPjo+vcCs/0UF o4EhEmzOCHZ+rhPvPbxUZ6XBcJndJnlskfMZ2i/tr+uJ9YeQ1jaswGdwzL9NBOrIhPR5 dP/kqILHXS5bfy8bFoRIRDxKUUCj3fmqRZnfE9UjUifx+YELS78aW/jrk4CIjILerzo8 RqWA== X-Received: by 10.202.1.67 with SMTP id 64mr19397272oib.6.1437844660490; Sat, 25 Jul 2015 10:17:40 -0700 (PDT) MIME-Version: 1.0 Received: by 10.76.94.176 with HTTP; Sat, 25 Jul 2015 10:17:21 -0700 (PDT) In-Reply-To: References: <55B287EB.2090301@bluepopcorn.net> <301BBBAC-1CF8-43BD-9865-52D8F725BA84@ve7jtb.com> <55B305FE.8050308@bluepopcorn.net> From: Tony Arcieri Date: Sat, 25 Jul 2015 10:17:21 -0700 Message-ID: To: Mike Jones Content-Type: multipart/alternative; boundary=001a1137d51c3b1768051bb64c0e Archived-At: Cc: Jim Fenton , John Bradley , "unbearable@ietf.org" , Martin Thomson Subject: Re: [Unbearable] JWS X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 25 Jul 2015 17:17:42 -0000 --001a1137d51c3b1768051bb64c0e Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable On Fri, Jul 24, 2015 at 9:30 PM, Mike Jones wrote: > What attacks are you worried about Tony? > Ones that arise from logic/implementation bugs in buggy verifiers/libraries > As I=E2=80=99d written earlier, an attacker can=E2=80=99t change the algo= rithm for > signed/MACed content, since the algorithm identifier is integrity protect= ed > and the signature will be rejected if not produced by the algorithm > protected in the header. > Except, as has actually happened in more than one case, you can trick buggy implementations into interpreting RSA public keys as symmetric MAC keys. Oops. This speaks to why stuffing both MACs and digital signatures into a single standard and letting them be used interchangeably was probably a bad idea. > Also, I=E2=80=99ll observe that verifying that the algorithm used is cur= rently > acceptable to the application is a standard part of any cryptographic > workflow. > "Cipher agility" is growingly reviled among many experts I know in the cryptography community, and it's totally unnecessary for this use case. Instead of including algorithm names in the token, you can just include an opaque key ID/handle, and the verifier should understand the mapping of KIDs to keys and associated verification algorithms. It's not information that should be supplied by the token. It not only wastes space, but encourages implementers to make the mistakes that lead to these sort of attacks. --=20 Tony Arcieri --001a1137d51c3b1768051bb64c0e Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
On F= ri, Jul 24, 2015 at 9:30 PM, Mike Jones <Michael.Jones@microsoft.com> wrote:

What attacks are you worr= ied about Tony?


Ones= that arise from logic/implementation bugs in buggy verifiers/libraries
=C2=A0

As I=E2=80=99d written earlier, an attacker can=E2=80=99t change the= algorithm for signed/MACed content, since the algorithm identifier is integrity protected and the signature will be rejected if not produced = by the algorithm protected in the header.


Except, as has actually happened in more than one cas= e, you can trick buggy implementations into interpreting RSA public keys as= symmetric MAC keys. Oops. This speaks to why stuffing both MACs and digita= l signatures into a single standard and letting them be used interchangeabl= y was probably a bad idea.
=C2=A0

Also, I=E2=80=99ll observe that verifying th= at the algorithm used is currently acceptable to the application is a stand= ard part of any cryptographic workflow.=C2=A0


"Cipher agility" is growingly rev= iled among many experts I know in the cryptography community, and it's = totally unnecessary for this use case. Instead of including algorithm names= in the token, you can just include an opaque key ID/handle, and the verifi= er should understand the mapping of KIDs to keys and associated verificatio= n algorithms. It's not information that should be supplied by the token= . It not only wastes space, but encourages implementers to make the mistake= s that lead to these sort of attacks.

--
Tony Arcieri
--001a1137d51c3b1768051bb64c0e-- From nobody Sat Jul 25 17:00:05 2015 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 313E21A8A0E for ; Sat, 25 Jul 2015 17:00:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.209 X-Spam-Level: X-Spam-Status: No, score=-4.209 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OXrEi0T7UNeg for ; Sat, 25 Jul 2015 17:00:02 -0700 (PDT) Received: from aserp1040.oracle.com (aserp1040.oracle.com [141.146.126.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 523D41A8981 for ; Sat, 25 Jul 2015 17:00:02 -0700 (PDT) Received: from userv0022.oracle.com (userv0022.oracle.com [156.151.31.74]) by aserp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id t6PNxqPY003973 (version=TLSv1 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Sat, 25 Jul 2015 23:59:53 GMT Received: from aserv0121.oracle.com (aserv0121.oracle.com [141.146.126.235]) by userv0022.oracle.com (8.13.8/8.13.8) with ESMTP id t6PNxohQ014145 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL); Sat, 25 Jul 2015 23:59:51 GMT Received: from abhmp0014.oracle.com (abhmp0014.oracle.com [141.146.116.20]) by aserv0121.oracle.com (8.13.8/8.13.8) with ESMTP id t6PNxoEw030963; Sat, 25 Jul 2015 23:59:50 GMT Received: from [25.167.69.168] (/72.143.224.100) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Sat, 25 Jul 2015 16:59:49 -0700 Content-Type: multipart/alternative; boundary=Apple-Mail-517492DA-C942-40EE-BC0E-26A4B4E1D813 Mime-Version: 1.0 (1.0) From: Phil Hunt X-Mailer: iPhone Mail (12F70) In-Reply-To: Date: Sat, 25 Jul 2015 16:59:47 -0700 Content-Transfer-Encoding: 7bit Message-Id: References: <55B287EB.2090301@bluepopcorn.net> <301BBBAC-1CF8-43BD-9865-52D8F725BA84@ve7jtb.com> <55B305FE.8050308@bluepopcorn.net> To: Tony Arcieri X-Source-IP: userv0022.oracle.com [156.151.31.74] Archived-At: Cc: Jim Fenton , John Bradley , Mike Jones , Martin Thomson , "unbearable@ietf.org" Subject: Re: [Unbearable] JWS X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 26 Jul 2015 00:00:04 -0000 --Apple-Mail-517492DA-C942-40EE-BC0E-26A4B4E1D813 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Give us a reason beyond FUD that we can discuss please.=20 Phil > On Jul 25, 2015, at 10:17, Tony Arcieri wrote: >=20 >> On Fri, Jul 24, 2015 at 9:30 PM, Mike Jones = wrote: >> What attacks are you worried about Tony? >>=20 >=20 > Ones that arise from logic/implementation bugs in buggy verifiers/librarie= s > =20 >> As I=E2=80=99d written earlier, an attacker can=E2=80=99t change the algo= rithm for signed/MACed content, since the algorithm identifier is integrity p= rotected and the signature will be rejected if not produced by the algorithm= protected in the header. >>=20 >=20 > Except, as has actually happened in more than one case, you can trick bugg= y implementations into interpreting RSA public keys as symmetric MAC keys. O= ops. This speaks to why stuffing both MACs and digital signatures into a sin= gle standard and letting them be used interchangeably was probably a bad ide= a. > =20 >> Also, I=E2=80=99ll observe that verifying that the algorithm used is curr= ently acceptable to the application is a standard part of any cryptographic w= orkflow.=20 >>=20 >=20 >=20 > "Cipher agility" is growingly reviled among many experts I know in the cry= ptography community, and it's totally unnecessary for this use case. Instead= of including algorithm names in the token, you can just include an opaque k= ey ID/handle, and the verifier should understand the mapping of KIDs to keys= and associated verification algorithms. It's not information that should be= supplied by the token. It not only wastes space, but encourages implementer= s to make the mistakes that lead to these sort of attacks. >=20 > --=20 > Tony Arcieri > _______________________________________________ > Unbearable mailing list > Unbearable@ietf.org > https://www.ietf.org/mailman/listinfo/unbearable --Apple-Mail-517492DA-C942-40EE-BC0E-26A4B4E1D813 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable
Give us a reason beyond FUD that we ca= n discuss please. 

Phil

On Jul 25, 2015, at 10:17,= Tony Arcieri <bascule@gmail.com= > wrote:

On Fri, Jul 24, 2015 at 9= :30 PM, Mike Jones <Michael.Jones@mic= rosoft.com> wrote:

What attacks are you worrie= d about Tony?


Ones th= at arise from logic/implementation bugs in buggy verifiers/libraries
 

As= I=E2=80=99d written earlier, an attacker can=E2=80=99t change the algorithm= for signed/MACed content, since the algorithm identifier is integrity protected and the signature will be rejected if not produced b= y the algorithm protected in the header.

=

Except, as has actually happened in more than one case, y= ou can trick buggy implementations into interpreting RSA public keys as symm= etric MAC keys. Oops. This speaks to why stuffing both MACs and digital sign= atures into a single standard and letting them be used interchangeably was p= robably a bad idea.
 

Also, I=E2=80=99ll observe that verifying that= the algorithm used is currently acceptable to the application is a standard= part of any cryptographic workflow. 


"Cipher agility" is growingly reviled among many= experts I know in the cryptography community, and it's totally unnecessary f= or this use case. Instead of including algorithm names in the token, you can= just include an opaque key ID/handle, and the verifier should understand th= e mapping of KIDs to keys and associated verification algorithms. It's not i= nformation that should be supplied by the token. It not only wastes space, b= ut encourages implementers to make the mistakes that lead to these sort of a= ttacks.

--
Tony Arcie= ri
____________________= ___________________________
Unbearable mailing listUnbearable@ietf.org
http= s://www.ietf.org/mailman/listinfo/unbearable
= --Apple-Mail-517492DA-C942-40EE-BC0E-26A4B4E1D813-- From nobody Sun Jul 26 11:17:58 2015 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C9B071ACD2B for ; Sun, 26 Jul 2015 11:17:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5eXIgbkyDevs for ; Sun, 26 Jul 2015 11:17:55 -0700 (PDT) Received: from mail-ob0-x22c.google.com (mail-ob0-x22c.google.com [IPv6:2607:f8b0:4003:c01::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E25F31ACD26 for ; Sun, 26 Jul 2015 11:17:54 -0700 (PDT) Received: by obnw1 with SMTP id w1so45273959obn.3 for ; Sun, 26 Jul 2015 11:17:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; bh=YnXe1rzGraQicAkr0tS7S9L5iP7AqgDwTbFvkydma0E=; b=r/7bFjxqxr0AAJkRhnxMhdhutKbmJTGljNCW84Cbu88Q2ix9/AiRlYsa0EqB+3Cagj MiLRXwpRKORIwiLcYbHVntygMAHFKdHLJFV8ekvaLVRZ+q2x/QIvqAL2ahVBOVhNM4Ad R6PT5XH/FFfRTBuLufwZqVlJQZINKEanLzrhvqrk/Oh1qruG2Ew+ZoMtJeKN2YMjvNo+ vRH00vps3dXeSauaBDnz4YYtIAcFRe0p3bL3Zd1me/T+GAqe/OJyF3LXkGwwH1y+q/y0 jWC4rEHFGKnUJ28DEDOXIJwutqswbwTP8uPCaqjd8PUqVvqSCrl2YRCHXby8GUN865vL 0c2w== X-Received: by 10.182.142.202 with SMTP id ry10mr23988358obb.27.1437934674372; Sun, 26 Jul 2015 11:17:54 -0700 (PDT) MIME-Version: 1.0 Received: by 10.76.94.176 with HTTP; Sun, 26 Jul 2015 11:17:34 -0700 (PDT) In-Reply-To: References: <55B287EB.2090301@bluepopcorn.net> <301BBBAC-1CF8-43BD-9865-52D8F725BA84@ve7jtb.com> <55B305FE.8050308@bluepopcorn.net> From: Tony Arcieri Date: Sun, 26 Jul 2015 11:17:34 -0700 Message-ID: To: Phil Hunt Content-Type: multipart/alternative; boundary=001a1130caea79f09d051bcb4103 Archived-At: Cc: Jim Fenton , John Bradley , Mike Jones , Martin Thomson , "unbearable@ietf.org" Subject: Re: [Unbearable] JWS X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 26 Jul 2015 18:17:57 -0000 --001a1130caea79f09d051bcb4103 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable JWS just seems like a lot more than you need. By using it, you run the risk of hitting one of these logic bugs, and exposing yourself to bugclasses that otherwise wouldn't exist. Otherwise it does seem like the evolving least common denominator for this sort of thing. On Sat, Jul 25, 2015 at 4:59 PM, Phil Hunt wrote: > Give us a reason beyond FUD that we can discuss please. > > Phil > > On Jul 25, 2015, at 10:17, Tony Arcieri wrote: > > On Fri, Jul 24, 2015 at 9:30 PM, Mike Jones > wrote: > >> What attacks are you worried about Tony? >> > > Ones that arise from logic/implementation bugs in buggy verifiers/librari= es > > >> As I=E2=80=99d written earlier, an attacker can=E2=80=99t change the alg= orithm for >> signed/MACed content, since the algorithm identifier is integrity protec= ted >> and the signature will be rejected if not produced by the algorithm >> protected in the header. >> > > Except, as has actually happened in more than one case, you can trick > buggy implementations into interpreting RSA public keys as symmetric MAC > keys. Oops. This speaks to why stuffing both MACs and digital signatures > into a single standard and letting them be used interchangeably was > probably a bad idea. > > >> Also, I=E2=80=99ll observe that verifying that the algorithm used is cu= rrently >> acceptable to the application is a standard part of any cryptographic >> workflow. >> > > "Cipher agility" is growingly reviled among many experts I know in the > cryptography community, and it's totally unnecessary for this use case. > Instead of including algorithm names in the token, you can just include a= n > opaque key ID/handle, and the verifier should understand the mapping of > KIDs to keys and associated verification algorithms. It's not information > that should be supplied by the token. It not only wastes space, but > encourages implementers to make the mistakes that lead to these sort of > attacks. > > -- > Tony Arcieri > > _______________________________________________ > Unbearable mailing list > Unbearable@ietf.org > https://www.ietf.org/mailman/listinfo/unbearable > > --=20 Tony Arcieri --001a1130caea79f09d051bcb4103 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
JWS just seems like a lot more than you need. By using it,= you run the risk of hitting one of these logic bugs, and exposing yourself= to bugclasses that otherwise wouldn't exist.

Otherw= ise it does seem like the evolving least common denominator for this sort o= f thing.

On Sat, Jul 25, 2015 at 4:59 PM, Phil Hunt <phil.hunt@oracle.com= > wrote:
Give us a reason beyond FUD that we can discuss please.=C2=A0

Phil

On Jul 25, 2015, at 10:17, Tony Arcieri <bascule@gmail.com> = wrote:

On Fri, Jul 24, 2015 at 9:30= PM, Mike Jones <Michael.Jones@microsoft.com> wrot= e:

What attacks are you worr= ied about Tony?


Ones= that arise from logic/implementation bugs in buggy verifiers/libraries
=C2=A0

As I=E2=80=99d written earlier, an attacker can=E2=80=99t change the= algorithm for signed/MACed content, since the algorithm identifier is integrity protected and the signature will be rejected if not produced = by the algorithm protected in the header.


Except, as has actually happened in more than one cas= e, you can trick buggy implementations into interpreting RSA public keys as= symmetric MAC keys. Oops. This speaks to why stuffing both MACs and digita= l signatures into a single standard and letting them be used interchangeabl= y was probably a bad idea.
=C2=A0

Also, I=E2=80=99ll observe that verifying th= at the algorithm used is currently acceptable to the application is a stand= ard part of any cryptographic workflow.=C2=A0


"Cipher agility" is growingly rev= iled among many experts I know in the cryptography community, and it's = totally unnecessary for this use case. Instead of including algorithm names= in the token, you can just include an opaque key ID/handle, and the verifi= er should understand the mapping of KIDs to keys and associated verificatio= n algorithms. It's not information that should be supplied by the token= . It not only wastes space, but encourages implementers to make the mistake= s that lead to these sort of attacks.

--
Tony = Arcieri
_______= ________________________________________
U= nbearable mailing list
Unbearable@ietf.org
https://ww= w.ietf.org/mailman/listinfo/unbearable



--
Tony Arcieri
--001a1130caea79f09d051bcb4103-- From nobody Sun Jul 26 11:59:58 2015 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C0F7F1A872C for ; Sun, 26 Jul 2015 11:59:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.209 X-Spam-Level: X-Spam-Status: No, score=-4.209 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id J29uaafRmp00 for ; Sun, 26 Jul 2015 11:59:56 -0700 (PDT) Received: from aserp1040.oracle.com (aserp1040.oracle.com [141.146.126.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DB2B11ACD83 for ; Sun, 26 Jul 2015 11:59:55 -0700 (PDT) Received: from userv0022.oracle.com (userv0022.oracle.com [156.151.31.74]) by aserp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id t6QIxiE1032131 (version=TLSv1 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Sun, 26 Jul 2015 18:59:44 GMT Received: from aserv0121.oracle.com (aserv0121.oracle.com [141.146.126.235]) by userv0022.oracle.com (8.13.8/8.13.8) with ESMTP id t6QIxgIH024027 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL); Sun, 26 Jul 2015 18:59:43 GMT Received: from abhmp0003.oracle.com (abhmp0003.oracle.com [141.146.116.9]) by aserv0121.oracle.com (8.13.8/8.13.8) with ESMTP id t6QIxgrV021265; Sun, 26 Jul 2015 18:59:42 GMT Received: from [25.167.69.168] (/72.143.224.100) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Sun, 26 Jul 2015 11:59:42 -0700 Content-Type: multipart/alternative; boundary=Apple-Mail-82D152B4-49EE-4BFE-A5B4-464D29A85799 Mime-Version: 1.0 (1.0) From: Phil Hunt X-Mailer: iPhone Mail (12F70) In-Reply-To: Date: Sun, 26 Jul 2015 11:59:38 -0700 Content-Transfer-Encoding: 7bit Message-Id: References: <55B287EB.2090301@bluepopcorn.net> <301BBBAC-1CF8-43BD-9865-52D8F725BA84@ve7jtb.com> <55B305FE.8050308@bluepopcorn.net> To: Tony Arcieri X-Source-IP: userv0022.oracle.com [156.151.31.74] Archived-At: Cc: Jim Fenton , John Bradley , Mike Jones , Martin Thomson , "unbearable@ietf.org" Subject: Re: [Unbearable] JWS X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 26 Jul 2015 18:59:57 -0000 --Apple-Mail-82D152B4-49EE-4BFE-A5B4-464D29A85799 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Thanks Tony. I thinks that is a better point.=20 I think the use of JWS here is not introducing any new risks that we aren't a= lready exposed to.=20 We already use JWS in tokens and http payloads.=20 Phil > On Jul 26, 2015, at 11:17, Tony Arcieri wrote: >=20 > JWS just seems like a lot more than you need. By using it, you run the ris= k of hitting one of these logic bugs, and exposing yourself to bugclasses th= at otherwise wouldn't exist. >=20 > Otherwise it does seem like the evolving least common denominator for this= sort of thing. >=20 >> On Sat, Jul 25, 2015 at 4:59 PM, Phil Hunt wrote: >> Give us a reason beyond FUD that we can discuss please.=20 >>=20 >> Phil >>=20 >>> On Jul 25, 2015, at 10:17, Tony Arcieri wrote: >>>=20 >>>> On Fri, Jul 24, 2015 at 9:30 PM, Mike Jones wrote: >>>> What attacks are you worried about Tony? >>>>=20 >>>=20 >>> Ones that arise from logic/implementation bugs in buggy verifiers/librar= ies >>> =20 >>>> As I=E2=80=99d written earlier, an attacker can=E2=80=99t change the al= gorithm for signed/MACed content, since the algorithm identifier is integrit= y protected and the signature will be rejected if not produced by the algori= thm protected in the header. >>>>=20 >>>=20 >>> Except, as has actually happened in more than one case, you can trick bu= ggy implementations into interpreting RSA public keys as symmetric MAC keys.= Oops. This speaks to why stuffing both MACs and digital signatures into a s= ingle standard and letting them be used interchangeably was probably a bad i= dea. >>> =20 >>>> Also, I=E2=80=99ll observe that verifying that the algorithm used is cu= rrently acceptable to the application is a standard part of any cryptographi= c workflow.=20 >>>>=20 >>>=20 >>>=20 >>> "Cipher agility" is growingly reviled among many experts I know in the c= ryptography community, and it's totally unnecessary for this use case. Inste= ad of including algorithm names in the token, you can just include an opaque= key ID/handle, and the verifier should understand the mapping of KIDs to ke= ys and associated verification algorithms. It's not information that should b= e supplied by the token. It not only wastes space, but encourages implemente= rs to make the mistakes that lead to these sort of attacks. >>>=20 >>> --=20 >>> Tony Arcieri >>> _______________________________________________ >>> Unbearable mailing list >>> Unbearable@ietf.org >>> https://www.ietf.org/mailman/listinfo/unbearable >=20 >=20 >=20 > --=20 > Tony Arcieri > _______________________________________________ > Unbearable mailing list > Unbearable@ietf.org > https://www.ietf.org/mailman/listinfo/unbearable --Apple-Mail-82D152B4-49EE-4BFE-A5B4-464D29A85799 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable
Thanks Tony. I thinks that is a better= point. 

I think the use of JWS here is not in= troducing any new risks that we aren't already exposed to. 
<= br>
We already use JWS in tokens and http payloads. 

Phil

On Jul 26, 2015, at 11:17, Tony Arcieri <bascule@gmail.com> wrote:

=
JWS just seems like a lot mo= re than you need. By using it, you run the risk of hitting one of these logi= c bugs, and exposing yourself to bugclasses that otherwise wouldn't exist.
Otherwise it does seem like the evolving least common deno= minator for this sort of thing.

On Sat, Jul 25, 2015 at 4:59 PM, Phil Hunt <phil= .hunt@oracle.com> wrote:
Give us a reason beyond FUD that we can discuss please.&nbs= p;

Phil<= /div>

On Jul 25, 2015, at 10:17, Tony Arcieri= <bascule@gmail.co= m> wrote:

On Fri, Jul 24, 2015= at 9:30 PM, Mike Jones <Michael.Jones@microsoft.com> wrote:

What attacks are you worrie= d about Tony?


Ones th= at arise from logic/implementation bugs in buggy verifiers/libraries
 

As= I=E2=80=99d written earlier, an attacker can=E2=80=99t change the algorithm= for signed/MACed content, since the algorithm identifier is integrity protected and the signature will be rejected if not produced b= y the algorithm protected in the header.

=

Except, as has actually happened in more than one case, y= ou can trick buggy implementations into interpreting RSA public keys as symm= etric MAC keys. Oops. This speaks to why stuffing both MACs and digital sign= atures into a single standard and letting them be used interchangeably was p= robably a bad idea.
 

Also, I=E2=80=99ll observe that verifying that= the algorithm used is currently acceptable to the application is a standard= part of any cryptographic workflow. 


"Cipher agility" is growingly reviled among many= experts I know in the cryptography community, and it's totally unnecessary f= or this use case. Instead of including algorithm names in the token, you can= just include an opaque key ID/handle, and the verifier should understand th= e mapping of KIDs to keys and associated verification algorithms. It's not i= nformation that should be supplied by the token. It not only wastes space, b= ut encourages implementers to make the mistakes that lead to these sort of a= ttacks.

--
Tony Arcieri
________= _______________________________________
Unb= earable mailing list
Unbearable@ietf.org
https://www.ietf= .org/mailman/listinfo/unbearable



--
Tony Arcieri
____________________= ___________________________
Unbearable mailing listUnbearable@ietf.org
http= s://www.ietf.org/mailman/listinfo/unbearable
= --Apple-Mail-82D152B4-49EE-4BFE-A5B4-464D29A85799-- From nobody Sun Jul 26 12:37:20 2015 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BCC521A883C for ; Sun, 26 Jul 2015 12:37:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yaExkZHxDrew for ; Sun, 26 Jul 2015 12:37:17 -0700 (PDT) Received: from emh03.mail.saunalahti.fi (emh03.mail.saunalahti.fi [62.142.5.109]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E107E1A882F for ; Sun, 26 Jul 2015 12:37:15 -0700 (PDT) Received: from LK-Perkele-VII (a91-155-194-207.elisa-laajakaista.fi [91.155.194.207]) by emh03.mail.saunalahti.fi (Postfix) with ESMTP id 01C831887D7 for ; Sun, 26 Jul 2015 22:37:12 +0300 (EEST) Date: Sun, 26 Jul 2015 22:37:12 +0300 From: Ilari Liusvaara To: "unbearable@ietf.org" Message-ID: <20150726193711.GA8628@LK-Perkele-VII> References: <301BBBAC-1CF8-43BD-9865-52D8F725BA84@ve7jtb.com> <55B305FE.8050308@bluepopcorn.net> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.23 (2014-03-12) Sender: Ilari Liusvaara Archived-At: Subject: Re: [Unbearable] JWS X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 26 Jul 2015 19:37:18 -0000 On Sun, Jul 26, 2015 at 11:59:38AM -0700, Phil Hunt wrote: > > I think the use of JWS here is not introducing any new risks > that we aren't already exposed to. JWS can represent inconsistent algorithms, the present format can not. And there have been multiple very serious JWS library security bugs due to inconsistent algorithms. -Ilari From nobody Sun Jul 26 13:46:48 2015 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 23F801A010F for ; Sun, 26 Jul 2015 13:46:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.661 X-Spam-Level: X-Spam-Status: No, score=-1.661 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HELO_EQ_SE=0.35, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4WNx43PXOQzA for ; Sun, 26 Jul 2015 13:46:45 -0700 (PDT) Received: from e-mailfilter01.sunet.se (e-mailfilter01.sunet.se [IPv6:2001:6b0:8:2::201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6CE0A1A0111 for ; Sun, 26 Jul 2015 13:46:45 -0700 (PDT) Received: from smtp1.sunet.se (smtp1.sunet.se [192.36.171.214]) by e-mailfilter01.sunet.se (8.14.4/8.14.4/Debian-4) with ESMTP id t6QKkgUJ003097 (version=TLSv1/SSLv3 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for ; Sun, 26 Jul 2015 22:46:43 +0200 Received: from kerio.sunet.se (kerio.sunet.se [192.36.171.210]) by smtp1.sunet.se (8.14.9/8.14.7) with ESMTP id t6QKkdde002189 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Sun, 26 Jul 2015 22:46:42 +0200 (CEST) VBR-Info: md=sunet.se; mc=all; mv=swamid.se DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=sunet.se; s=default; t=1437943602; bh=4w+28Zag+oGm6Sk4TwimAQ2facd9QWS7kAN+DalRTow=; h=Date:From:To:Subject:References:In-Reply-To; b=SRhX7ysm+G2dIyD+mOvZ8uwq3a0xxXeNjxWs5VM0P52kVlhrW75RbhdMO4DiBukYx Y+DeKtjZf4xCaL1VdF6toHsv6mLbuOztYQIq/E/mIVOru7rgSWbjfydSTp39TNFXFn UiSbohQbj47WYPuHKGKK9vjMc99ZTHvsqWS2A+pM= X-Footer: c3VuZXQuc2U= Received: from [192.168.1.89] ([81.230.12.165]) (authenticated user leifj@sunet.se) by kerio.sunet.se (Kerio Connect 8.3.4 patch 1) (using TLSv1.2 with cipher DHE-RSA-AES256-SHA (256 bits)) for unbearable@ietf.org; Sun, 26 Jul 2015 22:46:38 +0200 Message-ID: <55B5472E.9040905@sunet.se> Date: Sun, 26 Jul 2015 22:46:38 +0200 From: Leif Johansson User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.8.0 MIME-Version: 1.0 To: unbearable@ietf.org References: <301BBBAC-1CF8-43BD-9865-52D8F725BA84@ve7jtb.com> <55B305FE.8050308@bluepopcorn.net> <20150726193711.GA8628@LK-Perkele-VII> In-Reply-To: <20150726193711.GA8628@LK-Perkele-VII> Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit X-Bayes-Prob: 0.0001 (Score 0, tokens from: outbound, outbound-sunet-se:default, sunet-se:default, base:default, @@RPTN) X-CanIt-Geo: ip=192.36.171.210; country=SE; latitude=59.3294; longitude=18.0686; http://maps.google.com/maps?q=59.3294,18.0686&z=6 X-CanItPRO-Stream: outbound-sunet-se:outbound (inherits from outbound-sunet-se:default, sunet-se:default, base:default) X-Canit-Stats-ID: 09OV8KGlP - 280032edefd8 - 20150726 X-CanIt-Archive-Cluster: PfMRe/vJWMiXwM2YIH5BVExnUnw Received-SPF: neutral (e-mailfilter01.sunet.se: 192.36.171.210 is neither permitted nor denied by domain leifj@sunet.se) receiver=e-mailfilter01.sunet.se; client-ip=192.36.171.210; envelope-from=; helo=smtp1.sunet.se; identity=mailfrom X-Scanned-By: CanIt (www . roaringpenguin . com) on 192.36.171.201 Archived-At: Subject: Re: [Unbearable] JWS X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 26 Jul 2015 20:46:48 -0000 On 2015-07-26 21:37, Ilari Liusvaara wrote: > On Sun, Jul 26, 2015 at 11:59:38AM -0700, Phil Hunt wrote: >> >> I think the use of JWS here is not introducing any new risks >> that we aren't already exposed to. > > JWS can represent inconsistent algorithms, the present format can not. > > And there have been multiple very serious JWS library security > bugs due to inconsistent algorithms. Unless these bugs stem from issues with the specification I'm going to put on my chairs hat and call "rathole" on this thread. If anyone wants tokbind to use JWS (and I can see both pros and cons) then please suggest text - perhaps via a pull-request - so the WG can evaluate a specific suggestion. Cheers Leif From nobody Mon Jul 27 16:05:53 2015 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8D9411A0006 for ; Mon, 27 Jul 2015 16:05:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EN3vrhTI8CqH for ; Mon, 27 Jul 2015 16:05:51 -0700 (PDT) Received: from mail-oi0-x22b.google.com (mail-oi0-x22b.google.com [IPv6:2607:f8b0:4003:c06::22b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 23D501A000E for ; Mon, 27 Jul 2015 16:05:51 -0700 (PDT) Received: by oibn4 with SMTP id n4so59839078oib.3 for ; Mon, 27 Jul 2015 16:05:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:from:date:message-id:subject:to:cc:content-type; bh=SkWQ8qU2TzGmxibNGQnG1p5JqwEjoIBswnaK0/VkUHE=; b=eAbPIzJkBe/GVlGmU2lN6X6KxaXk7ZLnewLwr9v0KL7YTkuMsqKSAy/DvCRIk+upIu j2oyZ3uVNjYHo4RmlByYzDnEAxz5RDMlXSVItlwXf4P0qhetaR7nXOAJl/lSTAvAAfoB FPM869aC68H4Myrx91X0ika2wm+z6aaCSBneGQUnGmc1NEQ4lt+7q3pqnlMcprYF0Y0d G4V/dQeEWghChaDDrdzOFt5CG8zezkvZoW6joogh92vj1ZqHWa27KFqPanfSPzvdSzoC Ca8MkSDU8XBpN6kdCRM9sVgA7bbXMyMnI4C0rPe1Szf1oAIZ3SEUtHiV7tDiy5VeCrzJ 2OBA== X-Received: by 10.202.210.68 with SMTP id j65mr28970231oig.68.1438038350653; Mon, 27 Jul 2015 16:05:50 -0700 (PDT) MIME-Version: 1.0 Received: by 10.76.94.176 with HTTP; Mon, 27 Jul 2015 16:05:31 -0700 (PDT) From: Tony Arcieri Date: Mon, 27 Jul 2015 16:05:31 -0700 Message-ID: To: Phil Hunt Content-Type: multipart/alternative; boundary=001a113d2b38106f13051be36545 Archived-At: Cc: Jim Fenton , John Bradley , Mike Jones , Martin Thomson , "unbearable@ietf.org" Subject: [Unbearable] Where is JOSE/JWS/JWT already used in tokbind? X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Jul 2015 23:05:52 -0000 --001a113d2b38106f13051be36545 Content-Type: text/plain; charset=UTF-8 Apologies to the chairs if this is further proceeding down the rabbit hole, but I am legitimately confused interpreting your existing drafts and just want some clarification and don't really want this thread to proceed beyond my own self-edification, if that is ok. On Sun, Jul 26, 2015 at 11:59 AM, Phil Hunt wrote: > I think the use of JWS here is not introducing any new risks that we > aren't already exposed to. > > We already use JWS in tokens and http payloads. > When you say "we", is this within the context of tokbind? If so, where is that described in the drafts? Or are you simply assuming everyone is using JWT for bearer tokens nowadays? (which is not the case, I can assure you) Please clarify. Thank you. -- Tony Arcieri --001a113d2b38106f13051be36545 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Apol= ogies to the chairs if this is further proceeding down the rabbit hole, but= I am legitimately confused interpreting your existing drafts and just want= some clarification and don't really want this thread to proceed beyond= my own self-edification, if that is ok.
On Sun, Jul 26, 2015 at 11:59 AM, Phil H= unt <phil.hunt@oracle.com> wrote:
I think the use of JWS here is not introd= ucing any new risks that we aren't already exposed to.=C2=A0
<= div>
We already use JWS in tokens and http payloads.=C2=A0

When you say "we", is t= his within the context of tokbind? If so, where is that described in the dr= afts?

Or are you simply assuming everyone is using= JWT for bearer tokens nowadays? (which is not the case, I can assure you)<= /div>

Please clarify. Thank you.

--
Tony Arcieri
--001a113d2b38106f13051be36545-- From nobody Tue Jul 28 01:49:06 2015 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B99901A87B9 for ; Tue, 28 Jul 2015 01:49:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.661 X-Spam-Level: X-Spam-Status: No, score=-1.661 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HELO_EQ_SE=0.35, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id c2hlLOBxV-ob for ; Tue, 28 Jul 2015 01:49:03 -0700 (PDT) Received: from e-mailfilter01.sunet.se (e-mailfilter01.sunet.se [IPv6:2001:6b0:8:2::201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 632691A87B0 for ; Tue, 28 Jul 2015 01:49:03 -0700 (PDT) Received: from smtp1.sunet.se (smtp1.sunet.se [192.36.171.214]) by e-mailfilter01.sunet.se (8.14.4/8.14.4/Debian-4) with ESMTP id t6S8n1fl020248 (version=TLSv1/SSLv3 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for ; Tue, 28 Jul 2015 10:49:01 +0200 Received: from kerio.sunet.se (kerio.sunet.se [192.36.171.210]) by smtp1.sunet.se (8.14.9/8.14.7) with ESMTP id t6S8mwfm005897 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Tue, 28 Jul 2015 10:49:00 +0200 (CEST) VBR-Info: md=sunet.se; mc=all; mv=swamid.se DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=sunet.se; s=default; t=1438073340; bh=pcaD8DoAgfeeV0+z5g32FTbcPYpy0yjHMmjO3lO4dqA=; h=Date:From:To:Subject:References:In-Reply-To; b=JOhDXGXBKSdkI2c/CD4QgkiJkowGakPdo+Z1IO2DOjgBLKomd2NEU6T7K0HbK7pvz Do3YoGSqbVE5hyIJUXqp8GO+7J/J6pkkiyCLcmDz4clzzG9hDyloT8TyJZFXyHxQRv M4TmkXdPgqk+CpvTz07intMWfPlLtG7833El+ZZ0= X-Footer: c3VuZXQuc2U= Received: from [192.168.1.89] ([81.230.12.165]) (authenticated user leifj@sunet.se) by kerio.sunet.se (Kerio Connect 8.3.4 patch 1) (using TLSv1.2 with cipher DHE-RSA-AES256-SHA (256 bits)) for unbearable@ietf.org; Tue, 28 Jul 2015 10:48:57 +0200 Message-ID: <55B741F8.9020809@sunet.se> Date: Tue, 28 Jul 2015 10:48:56 +0200 From: Leif Johansson User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.8.0 MIME-Version: 1.0 To: unbearable@ietf.org References: In-Reply-To: Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit X-Bayes-Prob: 0.0001 (Score 0, tokens from: outbound, outbound-sunet-se:default, sunet-se:default, base:default, @@RPTN) X-CanIt-Geo: ip=192.36.171.210; country=SE; latitude=59.3294; longitude=18.0686; http://maps.google.com/maps?q=59.3294,18.0686&z=6 X-CanItPRO-Stream: outbound-sunet-se:outbound (inherits from outbound-sunet-se:default, sunet-se:default, base:default) X-Canit-Stats-ID: 09OVIN1M6 - 97530cae9c34 - 20150728 X-CanIt-Archive-Cluster: PfMRe/vJWMiXwM2YIH5BVExnUnw Received-SPF: neutral (e-mailfilter01.sunet.se: 192.36.171.210 is neither permitted nor denied by domain leifj@sunet.se) receiver=e-mailfilter01.sunet.se; client-ip=192.36.171.210; envelope-from=; helo=smtp1.sunet.se; identity=mailfrom X-Scanned-By: CanIt (www . roaringpenguin . com) on 192.36.171.201 Archived-At: Subject: Re: [Unbearable] Where is JOSE/JWS/JWT already used in tokbind? X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Jul 2015 08:49:05 -0000 On 2015-07-28 01:05, Tony Arcieri wrote: > Apologies to the chairs if this is further proceeding down the rabbit > hole, but I am legitimately confused interpreting your existing drafts > and just want some clarification and don't really want this thread to > proceed beyond my own self-edification, if that is ok. > rathole avoided > On Sun, Jul 26, 2015 at 11:59 AM, Phil Hunt > wrote: > > I think the use of JWS here is not introducing any new risks that we > aren't already exposed to. > > We already use JWS in tokens and http payloads. > > > When you say "we", is this within the context of tokbind? If so, where > is that described in the drafts? > > Or are you simply assuming everyone is using JWT for bearer tokens > nowadays? (which is not the case, I can assure you) > > Please clarify. Thank you. > > -- > Tony Arcieri > > > _______________________________________________ > Unbearable mailing list > Unbearable@ietf.org > https://www.ietf.org/mailman/listinfo/unbearable > From nobody Wed Jul 29 02:27:02 2015 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DD53E1A0195 for ; Wed, 29 Jul 2015 02:27:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.661 X-Spam-Level: X-Spam-Status: No, score=-1.661 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HELO_EQ_SE=0.35, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LNv4QkgcwxpC for ; Wed, 29 Jul 2015 02:26:58 -0700 (PDT) Received: from e-mailfilter01.sunet.se (e-mailfilter01.sunet.se [IPv6:2001:6b0:8:2::201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8CBE01A0194 for ; Wed, 29 Jul 2015 02:26:55 -0700 (PDT) Received: from smtp1.sunet.se (smtp1.sunet.se [192.36.171.214]) by e-mailfilter01.sunet.se (8.14.4/8.14.4/Debian-4) with ESMTP id t6T9QrGc008611 (version=TLSv1/SSLv3 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for ; Wed, 29 Jul 2015 11:26:53 +0200 Received: from kerio.sunet.se (kerio.sunet.se [192.36.171.210]) by smtp1.sunet.se (8.14.9/8.14.7) with ESMTP id t6T9QoXn026441 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Wed, 29 Jul 2015 11:26:52 +0200 (CEST) VBR-Info: md=sunet.se; mc=all; mv=swamid.se DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=sunet.se; s=default; t=1438162012; bh=k0/sNLfSjtj8IjDMQG94jJwe8SMgfhnsSiPRtTvmcc8=; h=Date:From:To:Subject:References:In-Reply-To; b=t7WsV+saTh+DgxWw6D8egYHrT7Nrq34ZqyeyscorVf/WZBinq4KMELokUWXO5elH2 m0Lh1VUUumf+R+wqD6a1frQ32qya6jGiWaqoz2KEl5VNnDJXopHTJpYA/tgcDbFos1 slw6XL+UlREYqONPeU2yc1khZNsE0jPsvum5pOcE= X-Footer: c3VuZXQuc2U= Received: from [10.0.0.120] ([62.102.145.131]) (authenticated user leifj@sunet.se) by kerio.sunet.se (Kerio Connect 8.3.4 patch 1) (using TLSv1.2 with cipher DHE-RSA-AES256-SHA (256 bits)) for unbearable@ietf.org; Wed, 29 Jul 2015 11:26:48 +0200 Message-ID: <55B89C57.3060401@sunet.se> Date: Wed, 29 Jul 2015 11:26:47 +0200 From: Leif Johansson User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.8.0 MIME-Version: 1.0 To: unbearable@ietf.org References: <55B741F8.9020809@sunet.se> In-Reply-To: <55B741F8.9020809@sunet.se> Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit X-Bayes-Prob: 0.0001 (Score 0, tokens from: outbound, outbound-sunet-se:default, sunet-se:default, base:default, @@RPTN) X-CanIt-Geo: ip=192.36.171.210; country=SE; latitude=59.3294; longitude=18.0686; http://maps.google.com/maps?q=59.3294,18.0686&z=6 X-CanItPRO-Stream: outbound-sunet-se:outbound (inherits from outbound-sunet-se:default, sunet-se:default, base:default) X-Canit-Stats-ID: 09OW9qRRW - 22df54f95b76 - 20150729 X-CanIt-Archive-Cluster: PfMRe/vJWMiXwM2YIH5BVExnUnw Received-SPF: neutral (e-mailfilter01.sunet.se: 192.36.171.210 is neither permitted nor denied by domain leifj@sunet.se) receiver=e-mailfilter01.sunet.se; client-ip=192.36.171.210; envelope-from=; helo=smtp1.sunet.se; identity=mailfrom X-Scanned-By: CanIt (www . roaringpenguin . com) on 192.36.171.201 Archived-At: Subject: Re: [Unbearable] Where is JOSE/JWS/JWT already used in tokbind? X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 Jul 2015 09:27:01 -0000 On 2015-07-28 10:48, Leif Johansson wrote: > On 2015-07-28 01:05, Tony Arcieri wrote: >> Apologies to the chairs if this is further proceeding down the rabbit >> hole, but I am legitimately confused interpreting your existing drafts >> and just want some clarification and don't really want this thread to >> proceed beyond my own self-edification, if that is ok. >> > > rathole avoided To clarify: I mean that this line of discussion is perfectly reasonable and doesn't lead the WG to rathole, as for instance a discussion of bugs in JWS implementations would. Personally (and Phil can correct me if I'm wrong) I believe he meant to say that other parts of the web stack uses JWS, not that tokenbinding does so today. Cheers Leif