From nobody Thu Jun 2 08:10:29 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9C23C12D977 for ; Thu, 19 May 2016 09:30:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7 X-Spam-Level: X-Spam-Status: No, score=-7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_32=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ulZFtJeyOma9 for ; Thu, 19 May 2016 09:30:07 -0700 (PDT) Received: from github-smtp2a-ext-cp1-prd.iad.github.net (github-smtp2-ext5.iad.github.net [192.30.252.196]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6239312D888 for ; Thu, 19 May 2016 09:30:07 -0700 (PDT) Date: Thu, 19 May 2016 09:30:06 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1463675406; bh=TIuAQx5XfUtpLfd6bXVPjdzyVB/7yOX/DeHUo58Nk54=; h=From:Reply-To:To:Cc:Subject:List-ID:List-Archive:List-Post: List-Unsubscribe:From; b=K6oKcEp60PFG58q5bw+2T+2LfXS7NQ2HwAXcTORysu/PT9TbLiQEOwS3Pa2IORIoq RDW/asI5fcaEX0jax0EdG3SMM9szKGEXDskBfHbP6vJIiYVBzKT6g1AZwffeKwIMNK O6iBmjlaanLvza8icc9Jax/3F32phPJAqcTUir5w= From: Brian Campbell To: TokenBinding/Internet-Drafts Message-ID: Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_573dea0e2f794_7f593febcee7b2c04058f8"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list X-GitHub-Sender: b---c X-GitHub-Recipient: unbearable-ML X-Auto-Response-Suppress: All X-GitHub-Recipient-Address: unbearable@ietf.org Archived-At: X-Mailman-Approved-At: Thu, 02 Jun 2016 08:10:26 -0700 Subject: [Unbearable] [TokenBinding/Internet-Drafts] TBPROTO: ecdsap256 clarifications (#38) X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Reply-To: TokenBinding/Internet-Drafts List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 19 May 2016 16:30:09 -0000 ----==_mimepart_573dea0e2f794_7f593febcee7b2c04058f8 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Is ecdsap256 the NIST P-256 curve (also known as, I think, X9.62 prime256v1 or SECG secp256r1)? I'm guessing so but it's not totally clear from the document. The relevant text (that I could find anyway) from TBPROTO-03 here: > When an ecdsap256 key is used, TokenBinding.signature contains a pair > of integers, R followed by S, as defined in [ANSI.X9-62.2005]. R and > S are encoded in big-endian format. ECPoint.point contains the X > coordinate followed by the Y coordinate. The X and Y coordinates are > unsigned integers encoded in big-endian format. I was going to suggest that TBPROTO explicitly say that for ecdsap256 R & S and X & Y always be exactly 32 octets/bytes long and that any leading zero bytes be preserved (rare but possible AFAIK), which I assume was the intent so that the point and signature can be consistently processed. Then I thought maybe I should first look at ANSI.X9-62 to see if this was already clearly stated there somewhere. But it seems that one can't actually read X9-62 without shelling out $100, which is a lot to just look for a little details like that. So, from that fun little story (sorry!), a couple comments/questions/suggestions: Can TBPROTO state the curve used with the ecdsap256 TB key parameters in a way that's easy and obvious? And maybe also cite a document that's a little more accessible than X9-62 in doing so? I believe many RFCs, 7518/JWA for example, cite FIPS PUB 186-4 "Digital Signature Standard (DSS)" for ECDSA and the P-* curves. I expect most implementers will be using an existing ECDSA implementation and just need to get the parameters and input/output formatted correctly. That reference and the text in JWA was enough for many independent implementations to get it right with JWS. And about getting the input/output formatted correctly, can or should TBPROTO say that R&S/X&Y are always 32 bytes and so leading zeros need to be added or retained? --- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/TokenBinding/Internet-Drafts/issues/38 ----==_mimepart_573dea0e2f794_7f593febcee7b2c04058f8 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

Is ecdsap256 the NIST P-256 curve (also known as, I think, X9.62 prime256v1 or SECG secp256r1)? I'm guessing so but it's not totally clear from the document. The relevant text (that I could find anyway) from TBPROTO-03 here:

When an ecdsap256 key is used, TokenBinding.signature contains a pair
of integers, R followed by S, as defined in [ANSI.X9-62.2005]. R and
S are encoded in big-endian format. ECPoint.point contains the X
coordinate followed by the Y coordinate. The X and Y coordinates are
unsigned integers encoded in big-endian format.

I was going to suggest that TBPROTO explicitly say that for ecdsap256 R & S and X & Y always be exactly 32 octets/bytes long and that any leading zero bytes be preserved (rare but possible AFAIK), which I assume was the intent so that the point and signature can be consistently processed. Then I thought maybe I should first look at ANSI.X9-62 to see if this was already clearly stated there somewhere. But it seems that one can't actually read X9-62 without shelling out $100, which is a lot to just look for a little details like that.

So, from that fun little story (sorry!), a couple comments/questions/suggestions:

Can TBPROTO state the curve used with the ecdsap256 TB key parameters in a way that's easy and obvious? And maybe also cite a document that's a little more accessible than X9-62 in doing so? I believe many RFCs, 7518/JWA for example, cite FIPS PUB 186-4 "Digital Signature Standard (DSS)" for ECDSA and the P-* curves. I expect most implementers will be using an existing ECDSA implementation and just need to get the parameters and input/output formatted correctly. That reference and the text in JWA was enough for many independent implementations to get it right with JWS.

And about getting the input/output formatted correctly, can or should TBPROTO say that R&S/X&Y are always 32 bytes and so leading zeros need to be added or retained?

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub

----==_mimepart_573dea0e2f794_7f593febcee7b2c04058f8-- From nobody Thu Jun 2 08:10:32 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DFE7D12D123 for ; Thu, 19 May 2016 16:34:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.942 X-Spam-Level: X-Spam-Status: No, score=-4.942 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_12=2.059, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id B9QmVfJewm-U for ; Thu, 19 May 2016 16:34:32 -0700 (PDT) Received: from github-smtp2a-ext-cp1-prd.iad.github.net (github-smtp2-ext7.iad.github.net [192.30.252.198]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5312912D11F for ; Thu, 19 May 2016 16:34:32 -0700 (PDT) Date: Thu, 19 May 2016 16:34:29 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1463700869; bh=8jLQImOdIugpq4pJ/dA429DR4D4ICCoiPWg2MkhrvfY=; h=From:Reply-To:To:Cc:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=his1BxyTrSv0pQ0+HY3TIqp3SYD/MQNuc61bloOPfOY0U/FY64r/87D8AneA3svDH /vZuTo37B1mWMWyAMDdvJDvWIVCfscCRA4+1mPswb553BsN5x2b85yFTOZd1He2ues LfXtUlU/OKs5t/HV9lJsknD00dSV2cKXtxqmk6uU= From: Andrei-Popov To: TokenBinding/Internet-Drafts Message-ID: In-Reply-To: References: Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_573e4d855c4f7_41183faf20f512c01335956"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list X-GitHub-Sender: Andrei-Popov X-GitHub-Recipient: unbearable-ML X-Auto-Response-Suppress: All X-GitHub-Recipient-Address: unbearable@ietf.org Archived-At: X-Mailman-Approved-At: Thu, 02 Jun 2016 08:10:26 -0700 Subject: Re: [Unbearable] [TokenBinding/Internet-Drafts] added explicit referred TB processing (#16) X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Reply-To: TokenBinding/Internet-Drafts List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 19 May 2016 23:34:34 -0000 ----==_mimepart_573e4d855c4f7_41183faf20f512c01335956 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Merged #16. --- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/TokenBinding/Internet-Drafts/pull/16#event-666512077 ----==_mimepart_573e4d855c4f7_41183faf20f512c01335956 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

Merged #16.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub

----==_mimepart_573e4d855c4f7_41183faf20f512c01335956-- From nobody Thu Jun 2 08:10:35 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EE77812D608 for ; Fri, 20 May 2016 12:09:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.942 X-Spam-Level: X-Spam-Status: No, score=-4.942 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_12=2.059, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kQqecy5W1CFq for ; Fri, 20 May 2016 12:09:49 -0700 (PDT) Received: from github-smtp2a-ext-cp1-prd.iad.github.net (github-smtp2-ext5.iad.github.net [192.30.252.196]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 91C0612D5DC for ; Fri, 20 May 2016 12:09:49 -0700 (PDT) Date: Fri, 20 May 2016 12:09:47 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1463771387; bh=S8vpcRqeFQrgYQieVVIW2E6mKSJ8ZuAwA+DID3YX8+0=; h=From:Reply-To:To:Cc:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=UbenaicsVkGkZpbZ1m1nrB2oSCy2zH5TS/y9z/oMXS+Y7j9ivnWmFGlNSDhg/5Ndk LZ6z5hq3YsDDuaYdQtM515OGKxmc3E2z3Fqr4kMSUVgTfXyhAtVr/dyLWRzo7/ms4Z 9m4/e4c/lp88zuJ4T6tE8wYqFJbncMQ98lFQhCjo= From: Andrei-Popov To: TokenBinding/Internet-Drafts Message-ID: In-Reply-To: References: Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_573f60fb79b15_3aa63fcf233af2a024203b"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list X-GitHub-Sender: Andrei-Popov X-GitHub-Recipient: unbearable-ML X-Auto-Response-Suppress: All X-GitHub-Recipient-Address: unbearable@ietf.org Archived-At: X-Mailman-Approved-At: Thu, 02 Jun 2016 08:10:26 -0700 Subject: Re: [Unbearable] [TokenBinding/Internet-Drafts] TBPROTO: ecdsap256 clarifications (#38) X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Reply-To: TokenBinding/Internet-Drafts List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 20 May 2016 19:09:51 -0000 ----==_mimepart_573f60fb79b15_3aa63fcf233af2a024203b Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Thanks for the feedback; I'll clarify in the next TBPROTO revision. --- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/TokenBinding/Internet-Drafts/issues/38#issuecomment-220693277 ----==_mimepart_573f60fb79b15_3aa63fcf233af2a024203b Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

Thanks for the feedback; I'll clarify in the next TBPROTO revision.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub

----==_mimepart_573f60fb79b15_3aa63fcf233af2a024203b-- From nobody Thu Jun 2 08:10:36 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9B51112D662 for ; Fri, 20 May 2016 16:55:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.942 X-Spam-Level: X-Spam-Status: No, score=-4.942 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_12=2.059, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id W3AGllzKY5Dq for ; Fri, 20 May 2016 16:55:43 -0700 (PDT) Received: from github-smtp2a-ext-cp1-prd.iad.github.net (github-smtp2-ext5.iad.github.net [192.30.252.196]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2C0EB12D0DA for ; Fri, 20 May 2016 16:55:43 -0700 (PDT) Date: Fri, 20 May 2016 16:55:42 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1463788542; bh=WuMjAmTcAYEuptJvDqFedUjjIJFymFu9EksySZZnR+w=; h=From:Reply-To:To:Cc:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=itMPGYapRDwtvyVIEXSsslgCwHo4dhwK3VdhYAEwxbDbN8gI8GBIEVDfkf1bR6CqR qDwR9+b0FLlZEjbdl81DipJ63tXxVPq9rWhnzztvo0ux4OJXiqOkWXi0uXqFpOsdSq N8tE/xrx3XXvsBs/DaRqdGjC1uA3aA1aG80uts4k= From: Andrei-Popov To: TokenBinding/Internet-Drafts Message-ID: In-Reply-To: References: Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_573fa3fe4fddf_2ef83fb845e2b2a01034a5"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list X-GitHub-Sender: Andrei-Popov X-GitHub-Recipient: unbearable-ML X-Auto-Response-Suppress: All X-GitHub-Recipient-Address: unbearable@ietf.org Archived-At: X-Mailman-Approved-At: Thu, 02 Jun 2016 08:10:26 -0700 Subject: Re: [Unbearable] [TokenBinding/Internet-Drafts] TBPROTO: ecdsap256 clarifications (#38) X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Reply-To: TokenBinding/Internet-Drafts List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 20 May 2016 23:55:44 -0000 ----==_mimepart_573fa3fe4fddf_2ef83fb845e2b2a01034a5 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Closed #38. --- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/TokenBinding/Internet-Drafts/issues/38#event-667790556 ----==_mimepart_573fa3fe4fddf_2ef83fb845e2b2a01034a5 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

Closed #38.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub

----==_mimepart_573fa3fe4fddf_2ef83fb845e2b2a01034a5-- From nobody Thu Jun 2 08:10:42 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5A2C312D9FE for ; Wed, 25 May 2016 12:19:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.942 X-Spam-Level: X-Spam-Status: No, score=-4.942 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_12=2.059, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id U6sqAmr2W57g for ; Wed, 25 May 2016 12:19:07 -0700 (PDT) Received: from github-smtp2a-ext-cp1-prd.iad.github.net (github-smtp2-ext1.iad.github.net [192.30.252.192]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7BD2B12D9AE for ; Wed, 25 May 2016 12:18:59 -0700 (PDT) Date: Wed, 25 May 2016 12:18:58 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1464203938; bh=rIHuqGwLcGNSR9M6C4VQSD0TFwIye/oXyCO2whhUlWc=; h=From:Reply-To:To:Cc:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=fPPsZCoKlbQbr/YfVExyXC1XZTeCU4vFajXFmLGHuGKOk2CUbynhZdc4mIQJjFZdA AoNfNI/DlBqoSV0pGBaRNm1ySYwp1vsbn2Q1JbSnMXE96ol5YC2ur0ciUmzSxVa4Je nvbm0iA32ldDJPT6BPa770563tlIhFlj4EOwfzkA= From: Brian Campbell To: TokenBinding/Internet-Drafts Message-ID: In-Reply-To: References: Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_5745faa26a1b1_53143ff6454e72a013149a"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list X-GitHub-Sender: b---c X-GitHub-Recipient: unbearable-ML X-Auto-Response-Suppress: All X-GitHub-Recipient-Address: unbearable@ietf.org Archived-At: X-Mailman-Approved-At: Thu, 02 Jun 2016 08:10:26 -0700 Subject: Re: [Unbearable] [TokenBinding/Internet-Drafts] HTTPSTB: distinct header for the referred Token Binding (#35) X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Reply-To: TokenBinding/Internet-Drafts List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 25 May 2016 19:19:08 -0000 ----==_mimepart_5745faa26a1b1_53143ff6454e72a013149a Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Closing this one as I was unable to gather support for the change or sway the opinion of an editor. http://www.ietf.org/mail-archive/web/unbearable/current/msg00529.html and previous have some of the discussion. --- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/TokenBinding/Internet-Drafts/issues/35#issuecomment-221678527 ----==_mimepart_5745faa26a1b1_53143ff6454e72a013149a Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

Closing this one as I was unable to gather support for the change or sway the opinion of an editor. http://www.ietf.org/mail-archive/web/unbearable/current/msg00529.html and previous have some of the discussion.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub

----==_mimepart_5745faa26a1b1_53143ff6454e72a013149a-- From nobody Thu Jun 2 08:10:45 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6903C12D179 for ; Thu, 26 May 2016 14:29:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.455 X-Spam-Level: X-Spam-Status: No, score=-5.455 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_20=1.546, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PXBi2-sIHo5L for ; Thu, 26 May 2016 14:29:02 -0700 (PDT) Received: from github-smtp2a-ext-cp1-prd.iad.github.net (github-smtp2-ext4.iad.github.net [192.30.252.195]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B5C8E12D145 for ; Thu, 26 May 2016 14:29:02 -0700 (PDT) Date: Thu, 26 May 2016 14:29:01 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1464298141; bh=z2zAMc/+cmXcLfHNFC409o4F6Q/DGGf8vxvu3rVzUTE=; h=From:Reply-To:To:Cc:Subject:List-ID:List-Archive:List-Post: List-Unsubscribe:From; b=s6HUGNLJrMM5p5r/mJUqQ5GhDpxBh/JEPNJnGk/NSb6PgvZ4vUmd+nakk3b6Hwpz4 R3I6ix5gm3YcSjNNpL4BHkJnpqKkdnDSxENCxvKpuUW7xUn5jfEqOIt69SuMZwPTpO 9OdfJlRVV8vV22E6qoBZ362zKHrOWMOXcVSKXtls= From: Brian Campbell To: TokenBinding/Internet-Drafts Message-ID: Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_57476a9d8e9ad_3963f9591f5f29c244767"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list X-GitHub-Sender: b---c X-GitHub-Recipient: unbearable-ML X-Auto-Response-Suppress: All X-GitHub-Recipient-Address: unbearable@ietf.org Archived-At: X-Mailman-Approved-At: Thu, 02 Jun 2016 08:10:26 -0700 Subject: [Unbearable] [TokenBinding/Internet-Drafts] TBPROTO: provide some examples (#39) X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Reply-To: TokenBinding/Internet-Drafts List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 26 May 2016 21:29:06 -0000 ----==_mimepart_57476a9d8e9ad_3963f9591f5f29c244767 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit I think there'd be real value in providing some examples in TBPROTO (and also maybe HTTPSTB) that could help serve to validate reader's interpretation of the text. As an implementer of JWS & JWE, for instance, I found the examples in the documents to be exceptionally valuable in aiding my understanding and helping to vet the implementation. I think some example TokenBindingMessages in the TB doc(s) could be similarly valuable. I'd been thinking about suggesting it for a while. Then some of the questions and stated interpretations in [the thread](http://www.ietf.org/mail-archive/web/unbearable/current/threads.html#00514) leading up to [my saying something similar on the WG list](http://www.ietf.org/mail-archive/web/unbearable/current/msg00546.html) reminded me about it and reinforced that even clearly written text and "TLS Presentation Language" can be interpreted different ways by different people. Examples can be very helpful with that. --- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/TokenBinding/Internet-Drafts/issues/39 ----==_mimepart_57476a9d8e9ad_3963f9591f5f29c244767 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

I think there'd be real value in providing some examples in TBPROTO (and also maybe HTTPSTB) that could help serve to validate reader's interpretation of the text.

As an implementer of JWS & JWE, for instance, I found the examples in the documents to be exceptionally valuable in aiding my understanding and helping to vet the implementation. I think some example TokenBindingMessages in the TB doc(s) could be similarly valuable.

I'd been thinking about suggesting it for a while. Then some of the questions and stated interpretations in the thread leading up to my saying something similar on the WG list reminded me about it and reinforced that even clearly written text and "TLS Presentation Language" can be interpreted different ways by different people. Examples can be very helpful with that.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub

----==_mimepart_57476a9d8e9ad_3963f9591f5f29c244767-- From nobody Thu Jun 2 08:10:47 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6839612D8F6 for ; Fri, 27 May 2016 14:12:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.961 X-Spam-Level: X-Spam-Status: No, score=-4.961 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_12=2.059, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jIdhg8r54lNa for ; Fri, 27 May 2016 14:12:42 -0700 (PDT) Received: from github-smtp2a-ext-cp1-prd.iad.github.net (github-smtp2-ext8.iad.github.net [192.30.252.199]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EC39112D8E2 for ; Fri, 27 May 2016 14:12:41 -0700 (PDT) Date: Fri, 27 May 2016 14:12:40 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1464383560; bh=SRlq+Rli3akos6CuLhrqvD90ByKASHYiAbLo/vJgpk4=; h=From:Reply-To:To:Cc:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=rJi5OYiiCxMzZuuMhJP9aW3Zc9KZagYbfyLvcvmQSWzHLTqVlmSn/jXUr6wo805tK ieHWDqzofDlCuGMdp6tFpFNFGhVpU3B8kZQ/8aPsjj0VRiH99UxoMXNQqqDeTloPwb foFJTQApnQRg7jF3glwXSR2pIJiHBCktnToD07hk= From: Brian Campbell To: TokenBinding/Internet-Drafts Message-ID: In-Reply-To: References: Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_5748b848cd70b_2d9e3fd39526f2c01099a"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list X-GitHub-Sender: b---c X-GitHub-Recipient: unbearable-ML X-Auto-Response-Suppress: All X-GitHub-Recipient-Address: unbearable@ietf.org Archived-At: X-Mailman-Approved-At: Thu, 02 Jun 2016 08:10:26 -0700 Subject: Re: [Unbearable] [TokenBinding/Internet-Drafts] HTTPSTB: Add Acknowledgements (#36) X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Reply-To: TokenBinding/Internet-Drafts List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 27 May 2016 21:12:43 -0000 ----==_mimepart_5748b848cd70b_2d9e3fd39526f2c01099a Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit *maybe* Nick Harper, Vinod Anupam, Martin Thomson, Scott Cantor, others --- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/TokenBinding/Internet-Drafts/issues/36#issuecomment-222254264 ----==_mimepart_5748b848cd70b_2d9e3fd39526f2c01099a Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

maybe Nick Harper, Vinod Anupam, Martin Thomson, Scott Cantor, others

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_5748b848cd70b_2d9e3fd39526f2c01099a-- From dave.tonge@bluespeckfinancial.co.uk Tue Jun 21 07:55:26 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B209712D7F2 for ; Tue, 21 Jun 2016 07:55:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=momentumft.co.uk Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kcR9Ova3dKgM for ; Tue, 21 Jun 2016 07:55:24 -0700 (PDT) Received: from mail-lf0-x22e.google.com (mail-lf0-x22e.google.com [IPv6:2a00:1450:4010:c07::22e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 74B8712D83C for ; Tue, 21 Jun 2016 07:55:23 -0700 (PDT) Received: by mail-lf0-x22e.google.com with SMTP id h129so27726399lfh.1 for ; Tue, 21 Jun 2016 07:55:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=momentumft.co.uk; s=google; h=mime-version:from:date:message-id:subject:to; bh=19WJJKgMKtSrukB0IJy1o3T7eiWOH5lkb0A4g0xpwE4=; b=I+MBuVBTdTsGNM4Ts2vkvzISuV2zA8S6x7LVtNLW/zXCafhM5csZzu3RAJnJjvOV1A RgFKeUp73+QQst8humWntr9gfnn2en6hw0gRCpiwfGuzl6+UyyBTBFwEUSXV+p6U6Zz0 8xfx0C4wSaKwXHEdujcZPYLEK/7Ce0ZtcunfM= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=19WJJKgMKtSrukB0IJy1o3T7eiWOH5lkb0A4g0xpwE4=; b=QN6Lm6MAxB2zFiMuyl2quxIGTeRXAYgbNkSHjRE0xPbAhHIUaeh1hpJ+bu2AykhBJV eKiin6N40dyJ3lfir7oO27hdb6heliXf0nbC9G3dUs3j5HiS/n8QZf4PxIlvZYQIcoFR 1H9uqKzMPV8Ic2sHfVvM2HsI4oKRiFQKYtQLYYMCAEh/6igB3hf+FPMyp8KFJY8Tk4RK tmn5HhbAMpPPMsFOoYosUWrtmS8f7q1JOxwqzyGrJB0Eize4ve9NBC/cMssdy+SyB0V/ JxNWHYfdh7VmfXtarDOit9/pjpj35K95FV0ict/AkhcWZK6MhrMW64pakGpa4G8DA/jn 4iTQ== X-Gm-Message-State: ALyK8tL7WoY/tt+7OX3P3EAzgko5cLwQ2tUZSY5FjZqhN3FRKpihR3otfoT6F7+P7D6275M7eEozkvvH4y7hEEtm X-Received: by 10.28.228.86 with SMTP id b83mr3657899wmh.11.1466520920723; Tue, 21 Jun 2016 07:55:20 -0700 (PDT) MIME-Version: 1.0 Received: by 10.28.185.203 with HTTP; Tue, 21 Jun 2016 07:55:01 -0700 (PDT) From: Dave Tonge Date: Tue, 21 Jun 2016 15:55:01 +0100 Message-ID: To: unbearable@ietf.org Content-Type: multipart/alternative; boundary=001a114b0cd88933d30535cb0253 Archived-At: Subject: [Unbearable] Current implementations of token binding spec? X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Jun 2016 14:58:18 -0000 --001a114b0cd88933d30535cb0253 Content-Type: text/plain; charset=UTF-8 Hi I'm currently working with the UK Open Banking Standard and the OpenID Financial API WG . The issue of token binding is being discussed and I wanted to try out an actual real world implementation. After some research there don't seem to be many implementations in the wild (unless I've missed something). It is supported in Chrome, but doesn't seem to be supported in OpenSSL yet (and therefore not in Node.JS, Python, Ruby, etc. I've opened an issue on the OpenSSL repo: https://github.com/openssl/openssl/issues/1242 Is my understanding correct? How would you recommend trying out a a live implementation of token binding? Thanks -- Dave Tonge CTO 10 Temple Back | Bristol | BS1 6FL t: +44 (0)117 280 5120 m: +44 (0)7577 815570 Momentum Financial Technology Ltd is authorised and regulated by the Financial Conduct Authority (Register number 561538). Registered in England & Wales, company registration number 06909772. DISCLAIMER: This email (including any attachments) is subject to copyright, and the information in it is confidential. Use of this email or of any information in it other than by the addressee is unauthorised and unlawful. Whilst reasonable efforts are made to ensure that any attachments are virus-free, it is the recipient's sole responsibility to scan all attachments for viruses. All calls and emails to and from this company may be monitored and recorded for legitimate purposes relating to this company's business. Any opinions expressed in this email (or in any attachments) are those of the author and do not necessarily represent the opinions of Momentum Financial Technology Ltd or of any other group company. --001a114b0cd88933d30535cb0253 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Hi

I'm cu= rrently working with the UK Open Banking Standard and the OpenID Financial API WG.=C2=A0
The issue of token bind= ing is being discussed and I wanted to try out an actual real world impleme= ntation.=C2=A0
After some research there don't seem to b= e many implementations in the wild (unless I've missed something).

It is supported in Chrome, but doesn't s= eem to be supported in OpenSSL yet (and therefore not in Node.JS, Python, R= uby, etc.
I've opened an issue on the OpenSSL repo: https://github.com/o= penssl/openssl/issues/1242

Is my und= erstanding correct? How would you recommend trying out a a live implementat= ion of token binding?

Thanks
<= br>
--
Dave= Tonge
CTO
10 Temple Back | Br= istol | BS1 6FL
t:=C2=A0+44 (0)117 280 5120
m:=C2=A0+44 (0)7577 815570
=C2=A0
Momentum Financial Technology Ltd is authorised and re= gulated by the Financial Conduct Authority (Register number=C2=A0561538). Registered in E= ngland & Wales, company registration number=C2=A006909772.=C2=A0DISCLAIMER: This email (including any attachments) is sub= ject to copyright, and the information in it is confidential. Use of this e= mail or of any information in it other than by the addressee is unauthorise= d and unlawful. Whilst reasonable efforts are made to ensure that any attac= hments are virus-free, it is the recipient's sole responsibility to sca= n all attachments for viruses. All calls and emails to and from this compan= y may be monitored and recorded for legitimate purposes relating to this co= mpany's business. Any opinions expressed in this email (or in any attac= hments) are those of the author and do not necessarily represent the opinio= ns of Momentum Financial Technology Ltd or of any other group company.
--001a114b0cd88933d30535cb0253-- From nobody Tue Jun 21 08:04:41 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7046212D13A for ; Tue, 21 Jun 2016 08:04:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.126 X-Spam-Level: X-Spam-Status: No, score=-4.126 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-1.426, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ECrjfJk8J9AU for ; Tue, 21 Jun 2016 08:04:38 -0700 (PDT) Received: from mail-vk0-x235.google.com (mail-vk0-x235.google.com [IPv6:2607:f8b0:400c:c05::235]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5BA4412D12F for ; Tue, 21 Jun 2016 08:04:38 -0700 (PDT) Received: by mail-vk0-x235.google.com with SMTP id d185so24077751vkg.0 for ; Tue, 21 Jun 2016 08:04:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=aBA0DBYERaPTwv/TKZPgougO9qUXHRHiYM6t9VEzvr0=; b=NODIayxbUwT5HY4SZtgIfLqWP+GBbGN6x6h73RmL6jL4Rpy0ejgIAZNAVZVuM7YU17 NA71JjmhokXKqfKyVJIq8e0U4xdjbyEyg3A/MNB5IE47jEPhH9FcU8MyINDQ6Vy7gYJh M/zUr5ARG13CM35h+RXeLB0zzVy8a2PFTGHLlTEpTVSw085eH2Setlcp2FtWnIg8aXzK keUoEDNDoI6BpoF8AnmjJParUEft3yXssv6/DVsgLVclA3JAJ8kuQuW0tUs2sw2FPibi b7K3Yby4YwL79ho9UIuTiJKU/2X04bQx8X8Qz4gdGrPm+ak4AqUlvzToBor7+2gdLChL 98Qw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=aBA0DBYERaPTwv/TKZPgougO9qUXHRHiYM6t9VEzvr0=; b=AhwOmByjah16W8l9c89r/ZxlEzxE5KdbUZYXx0LEofNi0IVPGThgGww5wppJ7ZLFiF aIOeDyTPT8v1rHOyiAjnNN8kyxI3a/5Jr0KE8KSpCwgj15+iWY5BZM/KmmXURXJyLIgf B4d+cFUeBJlrpO+/dz5PFRpbkf5zB/HX/MLq6wDjPKobiNTSJJlzqWNei26GWYZLZeyj AHEMtjeRyV/vVl/rBWm9/2mL+xbeHXr3mBqo0jzcixdGgTqzJYQUJBEBBxoRfqL5P03R fblKEcSE9paVLX9EP3PRngvd0jQr7BwVH/PjzdOI7iAm0Wigjd4FygLvsFiYxaGYpZIp jcjA== X-Gm-Message-State: ALyK8tJu5u/2sbEkUcuZOewOdnXLfmMq/BbKVRXIPn9Z3WqOjowCEolMl62dB8L18IxlaREZVUscLv3nJiD+jht3 X-Received: by 10.31.140.202 with SMTP id o193mr8269089vkd.80.1466521477269; Tue, 21 Jun 2016 08:04:37 -0700 (PDT) MIME-Version: 1.0 Received: by 10.31.200.65 with HTTP; Tue, 21 Jun 2016 08:04:36 -0700 (PDT) In-Reply-To: References: From: Bill Cox Date: Tue, 21 Jun 2016 08:04:36 -0700 Message-ID: To: Dave Tonge Content-Type: multipart/alternative; boundary=001a11425abab5bfc60535cb233e Archived-At: Cc: Tokbind WG Subject: Re: [Unbearable] Current implementations of token binding spec? X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Jun 2016 15:04:40 -0000 --001a11425abab5bfc60535cb233e Content-Type: text/plain; charset=UTF-8 I am in the process of open-sourcing Google's token binding library right now... On Tue, Jun 21, 2016 at 7:55 AM, Dave Tonge wrote: > Hi > > I'm currently working with the UK Open Banking Standard > and the OpenID Financial API WG > . > The issue of token binding is being discussed and I wanted to try out an > actual real world implementation. > After some research there don't seem to be many implementations in the > wild (unless I've missed something). > > It is supported in Chrome, but doesn't seem to be supported in OpenSSL yet > (and therefore not in Node.JS, Python, Ruby, etc. > I've opened an issue on the OpenSSL repo: > https://github.com/openssl/openssl/issues/1242 > > Is my understanding correct? How would you recommend trying out a a live > implementation of token binding? > > Thanks > > -- > Dave Tonge > CTO > 10 Temple Back | Bristol | BS1 6FL > t: +44 (0)117 280 5120 > m: +44 (0)7577 815570 > > Momentum Financial Technology Ltd is authorised and regulated by the > Financial Conduct Authority (Register number 561538). Registered in > England & Wales, company registration number 06909772. DISCLAIMER: This > email (including any attachments) is subject to copyright, and the > information in it is confidential. Use of this email or of any information > in it other than by the addressee is unauthorised and unlawful. Whilst > reasonable efforts are made to ensure that any attachments are virus-free, > it is the recipient's sole responsibility to scan all attachments for > viruses. All calls and emails to and from this company may be monitored and > recorded for legitimate purposes relating to this company's business. Any > opinions expressed in this email (or in any attachments) are those of the > author and do not necessarily represent the opinions of Momentum Financial > Technology Ltd or of any other group company. > > _______________________________________________ > Unbearable mailing list > Unbearable@ietf.org > https://www.ietf.org/mailman/listinfo/unbearable > > --001a11425abab5bfc60535cb233e Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
I am in the process of open-sourcing Google's token bi= nding library right now...

On Tue, Jun 21, 2016 at 7:55 AM, Dave Tonge <da= ve.tonge@momentumft.co.uk> wrote:
Hi

I&#= 39;m currently working with the UK Open Banking Standard and the OpenID Financial API WG.= =C2=A0
The issue of token binding is being discussed and I w= anted to try out an actual real world implementation.=C2=A0
= After some research there don't seem to be many implementations in the = wild (unless I've missed something).

It is supported in Chrome, but doesn't seem to be supported in OpenSSL= yet (and therefore not in Node.JS, Python, Ruby, etc.
I'= ;ve opened an issue on the OpenSSL repo: https://github.com/openssl/opens= sl/issues/1242

Is my understanding c= orrect? How would you recommend trying out a a live implementation of token= binding?

Thanks

--
Dave Tonge
CTO
10 Temple Ba= ck | Bristol | BS1 6FL
=C2=A0=
Momentum Fin= ancial Technology Ltd is authorised and regulated by the Financial Conduct = Authority (Register number=C2=A0561538). Registered in England & Wales, company regis= tration number=C2=A00= 6909772.=C2=A0DISCLAIMER: Thi= s email (including any attachments) is subject to copyright, and the inform= ation in it is confidential. Use of this email or of any information in it = other than by the addressee is unauthorised and unlawful. Whilst reasonable= efforts are made to ensure that any attachments are virus-free, it is the = recipient's sole responsibility to scan all attachments for viruses. Al= l calls and emails to and from this company may be monitored and recorded f= or legitimate purposes relating to this company's business. Any opinion= s expressed in this email (or in any attachments) are those of the author a= nd do not necessarily represent the opinions of Momentum Financial Technolo= gy Ltd or of any other group company.
<= /div>

_______________________________________________
Unbearable mailing list
Unbearable@ietf.org
https://www.ietf.org/mailman/listinfo/unbearable=


--001a11425abab5bfc60535cb233e-- From nobody Tue Jun 21 08:36:23 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 45E8312D980 for ; Tue, 21 Jun 2016 08:36:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=ve7jtb-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sh58LxSEMieU for ; Tue, 21 Jun 2016 08:36:20 -0700 (PDT) Received: from mail-qk0-x231.google.com (mail-qk0-x231.google.com [IPv6:2607:f8b0:400d:c09::231]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E96B712D198 for ; Tue, 21 Jun 2016 08:36:19 -0700 (PDT) Received: by mail-qk0-x231.google.com with SMTP id c73so26050351qkg.2 for ; Tue, 21 Jun 2016 08:36:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ve7jtb-com.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc:message-id:references :to; bh=g/52ohS7xn+wbDGSz9JL1/M7mKayNPpgFxXkWbKl9cc=; b=L3W21o6T5O1Lme6TDs5dTD4ChX1gpcPO7C3QXGhL+f1MDZ0LLHbEalLGiPl2ON5IOC S60cY41mpXUYQnLBsnQuHU4cCIx1QJmQ++nFaDWsPmsIpYeGYLEBG5P0NDOE0YEqcrA2 88sZBMx5rlV/FPwW+1g4uQgqsZ7VOpQ+8hz/yMdrWyDB7GqlXksKJBaBEF/k9RSs66iT 7kw+W7wdTK+r96Ikob6tI9wVP5ftBwSKm5MA52AHQRIShzB4qoxtJnODyLj5yUsEy02E sptSgm/cCriZ/o3B4mEs0cVDbF10jIAJEI/3cgPcsjEmRoUpnTISCx98zhbSyStEwOR1 LfLA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :message-id:references:to; bh=g/52ohS7xn+wbDGSz9JL1/M7mKayNPpgFxXkWbKl9cc=; b=ddsXL6N/LTfR7p6OJD3F3I9BFfjQ28q6U0xgu2wE9BECN1oS4h6yQHDE58pW6e0eIJ PoDHDJb4J/5TAQqeBY/+2cYOZznXLm3SeiOAQ19yobeVPnRyETdgfXwIMmEae6/YG1yu AWzalZkOG2aiNFm57YSTnwFQjGS3V00xI7h8kD8k/kLQCWeeJuEWOL+Tc3XmDvY1nx2g DalWi/vdc8w9BNKW5FAYWU8zLl0kHWWvhxoICq9BpY/2QuXPKQnNCEqYi7vnVirdeGGE +rBxyAGq7ypoR/1YTP/qT5X8rgdtNXxNRiKk0fyF4SRUoRhRzC5TslAdgdNO8Fhp7YKg HYOQ== X-Gm-Message-State: ALyK8tL66d+v5Q+0H0xaefB5RfewsDNpQl4zVmAmjOEtj/vsEa+SrnhqynG1dbAXOs3ONw== X-Received: by 10.55.145.67 with SMTP id t64mr30055640qkd.96.1466523378869; Tue, 21 Jun 2016 08:36:18 -0700 (PDT) Received: from [192.168.1.39] ([191.115.37.147]) by smtp.gmail.com with ESMTPSA id u85sm23494408qku.44.2016.06.21.08.36.07 (version=TLSv1/SSLv3 cipher=OTHER); Tue, 21 Jun 2016 08:36:18 -0700 (PDT) Content-Type: multipart/alternative; boundary="Apple-Mail=_916A356C-BCFB-46E9-A348-120A7F6E6879" Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: John Bradley In-Reply-To: Date: Tue, 21 Jun 2016 11:35:53 -0400 Message-Id: References: To: Dave Tonge X-Mailer: Apple Mail (2.3124) Archived-At: Cc: unbearable@ietf.org Subject: Re: [Unbearable] Current implementations of token binding spec? X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Jun 2016 15:36:22 -0000 --Apple-Mail=_916A356C-BCFB-46E9-A348-120A7F6E6879 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Currently if you are brave, there is a Python test server as part of the = Chromium project on Github for testing. https://github.com/chromium/chromium = Last time I tried it you needed to checkout the whole project to get the = test server to build. =20 I think they are working on making that easier.=20 Also as part of that project there is the Cronet http/TLS lib that can = be used on iOS and Android. We are hoping to include that as an option in the AppAuth project for = token binding refresh and access tokens on mobile. https://github.com/openid We are working/lobbying to get support included in more places such as = Python and Java. I hope you can contribute to the WG and help us move this spec to a RFC = quickly by showing demand. Regards John B. > On Jun 21, 2016, at 10:55 AM, Dave Tonge = wrote: >=20 > Hi >=20 > I'm currently working with the UK Open Banking Standard = and the OpenID Financial API WG = .=20 > The issue of token binding is being discussed and I wanted to try out = an actual real world implementation.=20 > After some research there don't seem to be many implementations in the = wild (unless I've missed something). >=20 > It is supported in Chrome, but doesn't seem to be supported in OpenSSL = yet (and therefore not in Node.JS, Python, Ruby, etc. > I've opened an issue on the OpenSSL repo: = https://github.com/openssl/openssl/issues/1242 = >=20 > Is my understanding correct? How would you recommend trying out a a = live implementation of token binding? >=20 > Thanks >=20 > --=20 > Dave Tonge > CTO >=20 > 10 Temple Back | Bristol | BS1 6FL > t: +44 (0)117 280 5120 > m: +44 (0)7577 815570 > =20 > Momentum Financial Technology Ltd is authorised and regulated by the = Financial Conduct Authority (Register number 561538). Registered in = England & Wales, company registration number 06909772. DISCLAIMER: This = email (including any attachments) is subject to copyright, and the = information in it is confidential. Use of this email or of any = information in it other than by the addressee is unauthorised and = unlawful. Whilst reasonable efforts are made to ensure that any = attachments are virus-free, it is the recipient's sole responsibility to = scan all attachments for viruses. All calls and emails to and from this = company may be monitored and recorded for legitimate purposes relating = to this company's business. Any opinions expressed in this email (or in = any attachments) are those of the author and do not necessarily = represent the opinions of Momentum Financial Technology Ltd or of any = other group company. > _______________________________________________ > Unbearable mailing list > Unbearable@ietf.org > https://www.ietf.org/mailman/listinfo/unbearable --Apple-Mail=_916A356C-BCFB-46E9-A348-120A7F6E6879 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii Currently if you are brave, there is a Python test server as = part of the Chromium project on Github for testing.
https://github.com/chromium/chromium

Last time I tried it you = needed to checkout the whole project to get the test server to build. =  
I think they are working on making that = easier. 

Also as part of that project there is the Cronet http/TLS lib = that can be used on iOS and Android.

We are hoping to include that as an = option in the AppAuth project for token binding refresh and access = tokens on mobile.

https://github.com/openid
We are working/lobbying to get support = included in more places such as Python and Java.

I hope you can contribute to the WG and = help us move this spec to a RFC quickly by showing demand.

Regards
John B.


On Jun 21, 2016, at 10:55 AM, = Dave Tonge <dave.tonge@momentumft.co.uk> wrote:

Hi

I'm currently working with the UK Open = Banking Standard and the OpenID Financial API WG. 
The issue of token binding is being discussed and I = wanted to try out an actual real world implementation. 
After some research there don't seem to be many = implementations in the wild (unless I've missed something).

It is supported in = Chrome, but doesn't seem to be supported in OpenSSL yet (and therefore = not in Node.JS, Python, Ruby, etc.
I've opened an issue on = the OpenSSL repo: https://github.com/openssl/openssl/issues/1242

Is my understanding = correct? How would you recommend trying out a a live implementation of = token binding?

Thanks

--
Dave = Tonge
CTO
10 Temple Back | Bristol | BS1 = 6FL
t: +44 (0)117 280 5120
m: +44 (0)7577 = 815570
 
Momentum = Financial Technology Ltd is authorised and regulated by the Financial = Conduct Authority (Register number 561538).= Registered in England & Wales, company registration = number 06909772. DISCLAIMER: This email (including any attachments) is subject = to copyright, and the information in it is confidential. Use of this = email or of any information in it other than by the addressee is = unauthorised and unlawful. Whilst reasonable efforts are made to ensure = that any attachments are virus-free, it is the recipient's sole = responsibility to scan all attachments for viruses. All calls and emails = to and from this company may be monitored and recorded for legitimate = purposes relating to this company's business. Any opinions expressed in = this email (or in any attachments) are those of the author and do not = necessarily represent the opinions of Momentum Financial Technology Ltd = or of any other group = company.
_______________________________________________
Unbearable = mailing list
Unbearable@ietf.org
https://www.ietf.org/mailman/listinfo/unbearable

= --Apple-Mail=_916A356C-BCFB-46E9-A348-120A7F6E6879-- From nobody Tue Jun 21 09:14:22 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AABFA12D1BE for ; Tue, 21 Jun 2016 09:14:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=momentumft.co.uk Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZoEXweRUSyNS for ; Tue, 21 Jun 2016 09:14:18 -0700 (PDT) Received: from mail-lf0-x233.google.com (mail-lf0-x233.google.com [IPv6:2a00:1450:4010:c07::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3A75D12D091 for ; Tue, 21 Jun 2016 09:14:18 -0700 (PDT) Received: by mail-lf0-x233.google.com with SMTP id l188so30513230lfe.2 for ; Tue, 21 Jun 2016 09:14:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=momentumft.co.uk; s=google; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=kjqNlJNNDQr5htpcFc3u9X/PH7Z2YhORCpBugChNqZY=; b=Ja9TWLcJk+HKBYUQkr/7KOqgOK6fSLnBdfClceyPWHbPuroCLnF3P4y8WHDAUxSrll 0GynUWZ3hvWmr7NLrgPGXpRGDNPDETyYCmpWwp8PPiCJjoGmprJG7NwE9ItgP5OrFhEy Cc87reQgqtGp8VL3Fr9SlSU9fT5PwonfJ+68Q= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=kjqNlJNNDQr5htpcFc3u9X/PH7Z2YhORCpBugChNqZY=; b=OJjJrQgN4zXaPd8znBJ+nVhrM+WPR3VZFsu/vkRAHPGyWurK3akOWUh2ipGNHr+k+U QbS+/oe4T9Lc7v7alXS41+3PLbCRRvbVbGttXt6kLlDWtm1h5qGlLd1zINIqO+uVEdlF vLfJuemvt7luBMM0oAISQGGJCB2TbcpkuMH9GEOJ4bcD/+F/CuCGcgucYZ0KmaS70n6c CoLs9POaUGwIGI0yMHL/w6iuIUPWyBmIqpJCKxoDkqNkxnM/pJKcRIUO8WWlnADaK9nB 1Efv83RINo7XNM/d4Qdu+pBRixirw9E2tmNDkBrB+9ehxD+wcDi3GAbPjHz9vofSdOky qiKA== X-Gm-Message-State: ALyK8tKzqbLNZkI1y/zgPWZ15ervQgZWOqPWhX1QYygMgma/S+JDdMjOuJsZlsVOiYOOH+whhZSOq4HAV0JTHdnY X-Received: by 10.28.197.132 with SMTP id v126mr4051358wmf.8.1466525654777; Tue, 21 Jun 2016 09:14:14 -0700 (PDT) MIME-Version: 1.0 Received: by 10.28.185.203 with HTTP; Tue, 21 Jun 2016 09:13:55 -0700 (PDT) In-Reply-To: References: From: Dave Tonge Date: Tue, 21 Jun 2016 17:13:55 +0100 Message-ID: To: John Bradley , waywardgeek@google.com Content-Type: multipart/alternative; boundary=94eb2c0d47d4b51fa70535cc1c78 Archived-At: Cc: unbearable@ietf.org Subject: Re: [Unbearable] Current implementations of token binding spec? X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Jun 2016 16:14:21 -0000 --94eb2c0d47d4b51fa70535cc1c78 Content-Type: text/plain; charset=UTF-8 Thanks Bill and John Bill - looking forward to it, I'll give it a try when its released. John - I'll take a look at the test server in chromium. I'm keen to help push forward support, so please let me know if there is anything else I can to do to help. Thanks Dave On 21 June 2016 at 16:35, John Bradley wrote: > Currently if you are brave, there is a Python test server as part of the > Chromium project on Github for testing. > https://github.com/chromium/chromium > > Last time I tried it you needed to checkout the whole project to get the > test server to build. > I think they are working on making that easier. > > Also as part of that project there is the Cronet http/TLS lib that can be > used on iOS and Android. > > We are hoping to include that as an option in the AppAuth project for > token binding refresh and access tokens on mobile. > > https://github.com/openid > > We are working/lobbying to get support included in more places such as > Python and Java. > > I hope you can contribute to the WG and help us move this spec to a RFC > quickly by showing demand. > > Regards > John B. > > > On Jun 21, 2016, at 10:55 AM, Dave Tonge > wrote: > > Hi > > I'm currently working with the UK Open Banking Standard > and the OpenID Financial API WG > . > The issue of token binding is being discussed and I wanted to try out an > actual real world implementation. > After some research there don't seem to be many implementations in the > wild (unless I've missed something). > > It is supported in Chrome, but doesn't seem to be supported in OpenSSL yet > (and therefore not in Node.JS, Python, Ruby, etc. > I've opened an issue on the OpenSSL repo: > https://github.com/openssl/openssl/issues/1242 > > Is my understanding correct? How would you recommend trying out a a live > implementation of token binding? > > Thanks > > -- > Dave Tonge > CTO > 10 Temple Back | Bristol | BS1 6FL > t: +44 (0)117 280 5120 > m: +44 (0)7577 815570 > > Momentum Financial Technology Ltd is authorised and regulated by the > Financial Conduct Authority (Register number 561538). Registered in > England & Wales, company registration number 06909772. DISCLAIMER: This > email (including any attachments) is subject to copyright, and the > information in it is confidential. Use of this email or of any information > in it other than by the addressee is unauthorised and unlawful. Whilst > reasonable efforts are made to ensure that any attachments are virus-free, > it is the recipient's sole responsibility to scan all attachments for > viruses. All calls and emails to and from this company may be monitored and > recorded for legitimate purposes relating to this company's business. Any > opinions expressed in this email (or in any attachments) are those of the > author and do not necessarily represent the opinions of Momentum Financial > Technology Ltd or of any other group company. > _______________________________________________ > Unbearable mailing list > Unbearable@ietf.org > https://www.ietf.org/mailman/listinfo/unbearable > > > -- Dave Tonge CTO 10 Temple Back | Bristol | BS1 6FL t: +44 (0)117 280 5120 m: +44 (0)7577 815570 Momentum Financial Technology Ltd is authorised and regulated by the Financial Conduct Authority (Register number 561538). Registered in England & Wales, company registration number 06909772. DISCLAIMER: This email (including any attachments) is subject to copyright, and the information in it is confidential. Use of this email or of any information in it other than by the addressee is unauthorised and unlawful. Whilst reasonable efforts are made to ensure that any attachments are virus-free, it is the recipient's sole responsibility to scan all attachments for viruses. All calls and emails to and from this company may be monitored and recorded for legitimate purposes relating to this company's business. Any opinions expressed in this email (or in any attachments) are those of the author and do not necessarily represent the opinions of Momentum Financial Technology Ltd or of any other group company. --94eb2c0d47d4b51fa70535cc1c78 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Thanks Bill and John

Bill - looking forward= to it, I'll give it a try when its released.
John - I'll take= a look at the test server in chromium.

I'm keen to help= push forward support, so please let me know if there is anything else I ca= n to do to help.

Thanks

Dave

On 21 June 2016 at 16:= 35, John Bradley <ve7jtb@ve7jtb.com> wrote:
Currently if you are = brave, there is a Python test server as part of the Chromium project on Git= hub for testing.

<= div>Last time I tried it you needed to checkout the whole project to get th= e test server to build. =C2=A0
I think they are working on making= that easier.=C2=A0

Also as part of that project t= here is the Cronet http/TLS lib that can be used on iOS and Android.
<= div>
We are hoping to include that as an option in the AppAut= h project for token binding refresh and access tokens on mobile.
=
http= s://github.com/openid

We are working/lobbying to= get support included in more places such as Python and Java.
I hope you can contribute to the WG and help us move this spec = to a RFC quickly by showing demand.

Regards
<= div>John B.


On Jun 21, 2016, at 10:55 AM, Dave To= nge <da= ve.tonge@momentumft.co.uk> wrote:

Hi

I'm currently working with the UK Open Banking Standard and the OpenID Financial API W= G.=C2=A0
The issue of token binding is being discussed a= nd I wanted to try out an actual real world implementation.=C2=A0
After some research there don't seem to be many implementations i= n the wild (unless I've missed something).

It is supported in Chrome, but doesn't seem to be supported in O= penSSL yet (and therefore not in Node.JS, Python, Ruby, etc.
I've opened an issue on the OpenSSL repo: https://github.com/openssl= /openssl/issues/1242

Is my understan= ding correct? How would you recommend trying out a a live implementation of= token binding?

Thanks

--
Dave Tonge
CTO
10 Temple Back | Bristol | BS1 6FL
t:=C2=A0+44 (0)117 280 5120
= m:=C2=A0+44 (0)7577 815570
=C2= =A0
Momentum = Financial Technology Ltd is authorised and regulated by the Financial Condu= ct Authority (Register number=C2=A0561538). Registered in England & Wales, company re= gistration number=C2=A006909772.=C2=A0DISCLAIMER: = This email (including any attachments) is subject to copyright, and the inf= ormation in it is confidential. Use of this email or of any information in = it other than by the addressee is unauthorised and unlawful. Whilst reasona= ble efforts are made to ensure that any attachments are virus-free, it is t= he recipient's sole responsibility to scan all attachments for viruses.= All calls and emails to and from this company may be monitored and recorde= d for legitimate purposes relating to this company's business. Any opin= ions expressed in this email (or in any attachments) are those of the autho= r and do not necessarily represent the opinions of Momentum Financial Techn= ology Ltd or of any other group company.
_______________________________________________
Unbearable mailing list<= br>Unbearable@ietf= .org
https://www.ietf.org/mailman/listinfo/unbearable


<= br clear=3D"all">

--
Dave Tonge
CTO
=
= t:=C2=A0+44 (0= )117 280 5120
m:=C2=A0+44 (0)7577 815570
=C2=A0
Momentum Financial Technology Ltd= is authorised and regulated by the Financial Conduct Authority (Register n= umber=C2=A0561538). Registered in England & Wales, company registration number=C2=A0<= span style=3D"color:rgb(220,41,30);font-weight:bold">06909772.=C2=A0= DISCLAIMER: This email (including an= y attachments) is subject to copyright, and the information in it is confid= ential. Use of this email or of any information in it other than by the add= ressee is unauthorised and unlawful. Whilst reasonable efforts are made to = ensure that any attachments are virus-free, it is the recipient's sole = responsibility to scan all attachments for viruses. All calls and emails to= and from this company may be monitored and recorded for legitimate purpose= s relating to this company's business. Any opinions expressed in this e= mail (or in any attachments) are those of the author and do not necessarily= represent the opinions of Momentum Financial Technology Ltd or of any othe= r group company.
--94eb2c0d47d4b51fa70535cc1c78-- From nobody Tue Jun 21 13:57:48 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8366812D91C for ; Tue, 21 Jun 2016 13:57:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=pingidentity.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id byMAXegIz4Oo for ; Tue, 21 Jun 2016 13:57:45 -0700 (PDT) Received: from mail-io0-x22d.google.com (mail-io0-x22d.google.com [IPv6:2607:f8b0:4001:c06::22d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E5E6D12D7AF for ; Tue, 21 Jun 2016 13:48:13 -0700 (PDT) Received: by mail-io0-x22d.google.com with SMTP id t74so27382034ioi.0 for ; Tue, 21 Jun 2016 13:48:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=pingidentity.com; s=gmail; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=l1E+ZiirpK3Hz3ycjZP6Ph8At2qEVkgBTOk4hJFGfs4=; b=DUmzBK+J1qdMHoawpo2EDXEpJyil87uHESWUPpDncuBgD6cK2FMJqc2c7rHOdDwXD0 WrOvyBXQioCPJESDqVuoAYViFFmQiIkSRq4I/yLN8/tRKOgxkUZxYL4zwD5JpljQ/zgE /Sn9V86jOvpHVh4vg4+WkmcabPTbCb2rIG1h4= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=l1E+ZiirpK3Hz3ycjZP6Ph8At2qEVkgBTOk4hJFGfs4=; b=ZNIxyw+CyQGJAKg3tcyvPfc/X2ceF94JhUQ7i5ENbz9U9WZh1+kje13Riy3beEYClf iRK7Ovt/Y7O0izpQFIL+YBsXj4xiQVAC2guash8TGuU1xC0XuaHmZ5ucoyd/C7EQNOV8 fDIgbTtAf3T+v/rrUJdwxBIK6rUwtK+U82MPIoAKdrtg+CK6Bjr5oBV+VQFCnx3GjzvD BZ0Inrq0uRZ2Ze88guL1v9xZzYO/d+vVtVVCW8UqqE+kSPja6O6DBSFqSlJS1wQhPDCq PeN6c5YspVSN6+cVKl4KW1BCU7UE+l9Tufem4+C+3LEg/eBubiDG/awgsluuS9eZEJcJ onSA== X-Gm-Message-State: ALyK8tKT8aEbYjqGHhUNmhV61PfQSTBsxE0grqYdlRSPfDUDChOgGR1edfz8yQlOXDcoarWl7j/7iF+JAywtu7q3 X-Received: by 10.107.44.71 with SMTP id s68mr34196269ios.174.1466542093063; Tue, 21 Jun 2016 13:48:13 -0700 (PDT) MIME-Version: 1.0 Received: by 10.79.124.155 with HTTP; Tue, 21 Jun 2016 13:47:43 -0700 (PDT) In-Reply-To: References: From: Brian Campbell Date: Tue, 21 Jun 2016 14:47:43 -0600 Message-ID: To: Dave Tonge Content-Type: multipart/alternative; boundary=001a11399c90816fb60535cff007 Archived-At: Cc: John Bradley , IETF Tokbind WG , Bill Cox Subject: Re: [Unbearable] Current implementations of token binding spec? X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Jun 2016 20:57:47 -0000 --001a11399c90816fb60535cff007 Content-Type: text/plain; charset=UTF-8 In the implementations that are out there now, what value is being used to identify the token_binding ExtensionType? TBNEGO just has a TBD right now. Is there any work underway towards getting early assignment of a ExtensionType Value for TB? Or is that even possible? On Tue, Jun 21, 2016 at 10:13 AM, Dave Tonge wrote: > Thanks Bill and John > > Bill - looking forward to it, I'll give it a try when its released. > John - I'll take a look at the test server in chromium. > > I'm keen to help push forward support, so please let me know if there is > anything else I can to do to help. > > Thanks > > Dave > > On 21 June 2016 at 16:35, John Bradley wrote: > >> Currently if you are brave, there is a Python test server as part of the >> Chromium project on Github for testing. >> https://github.com/chromium/chromium >> >> Last time I tried it you needed to checkout the whole project to get the >> test server to build. >> I think they are working on making that easier. >> >> Also as part of that project there is the Cronet http/TLS lib that can be >> used on iOS and Android. >> >> We are hoping to include that as an option in the AppAuth project for >> token binding refresh and access tokens on mobile. >> >> https://github.com/openid >> >> We are working/lobbying to get support included in more places such as >> Python and Java. >> >> I hope you can contribute to the WG and help us move this spec to a RFC >> quickly by showing demand. >> >> Regards >> John B. >> >> >> On Jun 21, 2016, at 10:55 AM, Dave Tonge >> wrote: >> >> Hi >> >> I'm currently working with the UK Open Banking Standard >> and the OpenID Financial API WG >> . >> The issue of token binding is being discussed and I wanted to try out an >> actual real world implementation. >> After some research there don't seem to be many implementations in the >> wild (unless I've missed something). >> >> It is supported in Chrome, but doesn't seem to be supported in OpenSSL >> yet (and therefore not in Node.JS, Python, Ruby, etc. >> I've opened an issue on the OpenSSL repo: >> https://github.com/openssl/openssl/issues/1242 >> >> Is my understanding correct? How would you recommend trying out a a live >> implementation of token binding? >> >> Thanks >> >> -- >> Dave Tonge >> CTO >> 10 Temple Back | Bristol | BS1 6FL >> t: +44 (0)117 280 5120 >> m: +44 (0)7577 815570 >> >> Momentum Financial Technology Ltd is authorised and regulated by the >> Financial Conduct Authority (Register number 561538). Registered in >> England & Wales, company registration number 06909772. DISCLAIMER: This >> email (including any attachments) is subject to copyright, and the >> information in it is confidential. Use of this email or of any information >> in it other than by the addressee is unauthorised and unlawful. Whilst >> reasonable efforts are made to ensure that any attachments are virus-free, >> it is the recipient's sole responsibility to scan all attachments for >> viruses. All calls and emails to and from this company may be monitored and >> recorded for legitimate purposes relating to this company's business. Any >> opinions expressed in this email (or in any attachments) are those of the >> author and do not necessarily represent the opinions of Momentum Financial >> Technology Ltd or of any other group company. >> _______________________________________________ >> Unbearable mailing list >> Unbearable@ietf.org >> https://www.ietf.org/mailman/listinfo/unbearable >> >> >> > > > -- > Dave Tonge > CTO > 10 Temple Back | Bristol | BS1 6FL > t: +44 (0)117 280 5120 > m: +44 (0)7577 815570 > > Momentum Financial Technology Ltd is authorised and regulated by the > Financial Conduct Authority (Register number 561538). Registered in > England & Wales, company registration number 06909772. DISCLAIMER: This > email (including any attachments) is subject to copyright, and the > information in it is confidential. Use of this email or of any information > in it other than by the addressee is unauthorised and unlawful. Whilst > reasonable efforts are made to ensure that any attachments are virus-free, > it is the recipient's sole responsibility to scan all attachments for > viruses. All calls and emails to and from this company may be monitored and > recorded for legitimate purposes relating to this company's business. Any > opinions expressed in this email (or in any attachments) are those of the > author and do not necessarily represent the opinions of Momentum Financial > Technology Ltd or of any other group company. > > _______________________________________________ > Unbearable mailing list > Unbearable@ietf.org > https://www.ietf.org/mailman/listinfo/unbearable > > --001a11399c90816fb60535cff007 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
In the implementations that are out there now, what value = is being used to identify the token_binding ExtensionType? TBNEGO = just has a TBD right now. Is there any work underway towards getting ea= rly assignment of a ExtensionType Value for TB? Or is that even possible? <= br>

On Tue, = Jun 21, 2016 at 10:13 AM, Dave Tonge <dave.tonge@momentumft.co.u= k> wrote:
=
= Thanks Bill and John

Bill - looking forward to it, I'll = give it a try when its released.
John - I'll take a look at the te= st server in chromium.

I'm keen to help push forward sup= port, so please let me know if there is anything else I can to do to help.<= /div>

Thanks
<= div class=3D"gmail_default" style=3D"font-family:trebuchet ms,sans-serif"><= br>
Dave

On 21 June 20= 16 at 16:35, John Bradley <ve7jtb@ve7jtb.com> wrote:
Currently if= you are brave, there is a Python test server as part of the Chromium proje= ct on Github for testing.
Last time I tried it you needed to checkout the whole project = to get the test server to build. =C2=A0
I think they are working = on making that easier.=C2=A0

Also as part of that = project there is the Cronet http/TLS lib that can be used on iOS and Androi= d.

We are hoping to include that as an option in t= he AppAuth project for token binding refresh and access tokens on mobile.

https://github.com/openid

We are working/lo= bbying to get support included in more places such as Python and Java.

I hope you can contribute to the WG and help us move t= his spec to a RFC quickly by showing demand.

Regar= ds
John B.


On Jun 21, 2016, at 10:55 AM, Dave Tonge &l= t;dave.ton= ge@momentumft.co.uk> wrote:

Hi

I'm curren= tly working with the UK Open Banking Standard and the OpenID Financial API WG.=C2=A0
<= div class=3D"gmail_default" style=3D"font-family:'trebuchet ms',san= s-serif">The issue of token binding is being discussed and I wanted to try = out an actual real world implementation.=C2=A0
After some re= search there don't seem to be many implementations in the wild (unless = I've missed something).

It is suppor= ted in Chrome, but doesn't seem to be supported in OpenSSL yet (and the= refore not in Node.JS, Python, Ruby, etc.
I've opened an= issue on the OpenSSL repo: https://github.com/openssl/openssl/issues/124= 2

Is my understanding correct? How w= ould you recommend trying out a a live implementation of token binding?

Thanks

--
<= div style=3D"color:rgb(97,97,97);font-family:'Open Sans';font-size:= 14px;font-weight:normal;line-height:21px">
Dave Tonge
CTO
10 Temple Back | Bristol | BS1 6FL
<= span style=3D"font-size:0.875em;line-height:1.4;color:rgb(220,41,30);font-w= eight:bold">m:=C2=A0+44 (0)7577 815570
=C2=A0
Momentum Financial Technology Ltd is authorised and regulated by the F= inancial Conduct Authority (Register number=C2=A0561538). Registered in England & Wal= es, company registration number=C2=A006909772.=C2=A0DISCLAIMER: This email (including any attachments) is subject to copyrigh= t, and the information in it is confidential. Use of this email or of any i= nformation in it other than by the addressee is unauthorised and unlawful. = Whilst reasonable efforts are made to ensure that any attachments are virus= -free, it is the recipient's sole responsibility to scan all attachment= s for viruses. All calls and emails to and from this company may be monitor= ed and recorded for legitimate purposes relating to this company's busi= ness. Any opinions expressed in this email (or in any attachments) are thos= e of the author and do not necessarily represent the opinions of Momentum F= inancial Technology Ltd or of any other group company.
_______________________________________________
Unbearable mailing list<= br>Unbearable@ietf= .org
https://www.ietf.org/mailman/listinfo/unbearable


<= br clear=3D"all">

--
Dave Tong= e
CTO
10 Temple Back | Bristol= | BS1 6FL
=C2=A0
=
Momentum Financial Techn= ology Ltd is authorised and regulated by the Financial Conduct Authority (R= egister number=C2=A05= 61538). Registered in England & Wales, company registration numb= er=C2=A006909772.=C2=A0DISCLAIMER: This email (inc= luding any attachments) is subject to copyright, and the information in it = is confidential. Use of this email or of any information in it other than b= y the addressee is unauthorised and unlawful. Whilst reasonable efforts are= made to ensure that any attachments are virus-free, it is the recipient= 9;s sole responsibility to scan all attachments for viruses. All calls and = emails to and from this company may be monitored and recorded for legitimat= e purposes relating to this company's business. Any opinions expressed = in this email (or in any attachments) are those of the author and do not ne= cessarily represent the opinions of Momentum Financial Technology Ltd or of= any other group company.

_______________________________________________
Unbearable mailing list
Unbearable@ietf.org
https://www.ietf.org/mailman/listinfo/unbearable=


--001a11399c90816fb60535cff007-- From nobody Tue Jun 21 14:14:03 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 186F612DA02 for ; Tue, 21 Jun 2016 14:14:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.792 X-Spam-Level: X-Spam-Status: No, score=-1.792 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_DKIM_INVALID=0.01] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=fail (1024-bit key) reason="fail (body has been altered)" header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vVYKCsO7go-n for ; Tue, 21 Jun 2016 14:13:59 -0700 (PDT) Received: from na01-bl2-obe.outbound.protection.outlook.com (mail-bl2on0114.outbound.protection.outlook.com [65.55.169.114]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 71C4812DA00 for ; Tue, 21 Jun 2016 14:13:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=VAMLpi/clfW4LR52popxzzlCpa31yWh3uKwY+ii2LTs=; b=VSSK82AVElDWQeuyPfeUGG8hNqdNkSNJDOQzH5MOcnSvTegde5LOrdbz+ePKbkaW3iAx5szD/y0ZTw7kt2ihdqpWznK2uSyIOp90pBhmQzYuE8KsN45n54N7yP2LpN/quqtUXBHTFDR8CWTRyMoy7I/J5DnoOgEMPncVmV6jncU= Received: from BN3PR03MB1445.namprd03.prod.outlook.com (10.163.34.28) by BN3PR03MB1447.namprd03.prod.outlook.com (10.163.34.30) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.523.12; Tue, 21 Jun 2016 21:13:57 +0000 Received: from BN3PR03MB1445.namprd03.prod.outlook.com ([10.163.34.28]) by BN3PR03MB1445.namprd03.prod.outlook.com ([10.163.34.28]) with mapi id 15.01.0523.015; Tue, 21 Jun 2016 21:13:57 +0000 From: Andrei Popov To: Brian Campbell , Dave Tonge Thread-Topic: [Unbearable] Current implementations of token binding spec? Thread-Index: AQHRy81dQsbyqtIbvUuuTDArSnajE5/0DZWAgAAKoYCAAEyAgIAABeAQ Date: Tue, 21 Jun 2016 21:13:57 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Andrei.Popov@microsoft.com; x-originating-ip: [2001:4898:80e8:e::1d2] x-ms-office365-filtering-correlation-id: c97e8711-c482-403e-1662-08d39a18f539 x-microsoft-exchange-diagnostics: 1; BN3PR03MB1447; 6:1KopALmgp26wGMDw852EeNBc2OgulXBragKILCw3SXircYYtWm/gNURx4xCAqtH0h/how/+DMJyqzB9pUGkZBDpo6gO2Ulu7pNU/y/7X99HRAPz+Wy9CXWoJ7VzolraAgbHVOHAc+gyOwteFO6ma0M/VJXB8aBdv9+92uoeMeC6rWBW6TO1aJ2OVBDe/SymIabE1yzXJoDm8STuZre99i/zUzCpKJmq+dEGX9TzGmXaK1VolGAp4E0/tCV3ofgVOnAWVG6Xp+EAKlFYbqTxqK+bW/TjyIz3ePNWE4KTLausIj2lWqFJWUgsZ4AggnkQOMSSXtpPW8YNLHKve3dS/7g==; 5:9v+uXe+B7AIkQBRruZpNC/WdoYyDrz33yToPRZy2sungg7itjj+CGJJQy0mPepDi4Ca7jlSzLlHt/+9t3QERZhN3fVTL690kMB7LSOqHj82VLG39UqpoJgsHI+DeQE7RJC7sWnPywWqyZgCU+nJFBg==; 24:v4a1Akt7GPY84VH/fFfx4dBER1VridSL2u6xD84IbyZqthn2yknahwNuLyY6WpmdEr5pPk4p31wQdS4FlurFvgOrUll7XGRKO0eoy/YpARE=; 7:928mPfgAL3hi6uwpDc+7XTALy2vYXgdEZE0hhSJfpMV17O2r1JdW5Niwr3khbTw9uA4Fv8EnhYZQ9V7KhGTi6VOi7Lh3NHkvV/+32EAiCDPlz3oYoCCYTYVhl9dcLtU4M421yAdmbDJ/xCy+UlAgtztSic4vg4/YSeOE5xwgDXPGsUbZB91H9x6JguNFLbCRGuS8/SyeiD/LJ6Jr5DGAS3CVwx1RYZ+SSmKuWnvt9dXn5OAcsnd9gVoYMx10WjuN x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:BN3PR03MB1447; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(158342451672863)(166708455590820)(211936372134217)(21748063052155); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(102415321)(61425038)(601004)(2401047)(5005006)(8121501046)(10201501046)(3002001)(6055026)(61426038)(61427038); SRVR:BN3PR03MB1447; BCL:0; PCL:0; RULEID:; SRVR:BN3PR03MB1447; x-forefront-prvs: 098076C36C x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(7916002)(24454002)(38564003)(189002)(377454003)(377424004)(199003)(122556002)(586003)(92566002)(102836003)(87936001)(790700001)(97736004)(6116002)(4326007)(16236675004)(2906002)(5890100001)(15395725005)(19300405004)(189998001)(86612001)(7696003)(5003600100003)(99286002)(86362001)(11100500001)(5001770100001)(5002640100001)(33656002)(19617315012)(101416001)(9686002)(19625215002)(3660700001)(76176999)(54356999)(99936001)(10090500001)(93886004)(76576001)(8936002)(106356001)(105586002)(106116001)(81166006)(81156014)(3280700002)(9326002)(7846002)(8676002)(7906002)(18206015028)(2950100001)(2900100001)(19580405001)(15975445007)(19609705001)(77096005)(19580395003)(50986999)(5005710100001)(74316001)(10400500002)(10290500002)(68736007)(7736002)(8990500004)(7099028)(3826002); DIR:OUT; SFP:1102; SCL:1; SRVR:BN3PR03MB1447; H:BN3PR03MB1445.namprd03.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:1; LANG:en; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/mixed; boundary="_004_BN3PR03MB14450B3302E670E17B54C0638C2B0BN3PR03MB1445namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 21 Jun 2016 21:13:57.1552 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN3PR03MB1447 Archived-At: Cc: John Bradley , IETF Tokbind WG , Bill Cox Subject: Re: [Unbearable] Current implementations of token binding spec? X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Jun 2016 21:14:02 -0000 --_004_BN3PR03MB14450B3302E670E17B54C0638C2B0BN3PR03MB1445namp_ Content-Type: multipart/alternative; boundary="_000_BN3PR03MB14450B3302E670E17B54C0638C2B0BN3PR03MB1445namp_" --_000_BN3PR03MB14450B3302E670E17B54C0638C2B0BN3PR03MB1445namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGkgQnJpYW4sDQoNCkVhcmx5IGFzc2lnbm1lbnQgaXMgYXZhaWxhYmxlOyBwbGVhc2Ugc2VlIGF0 dGFjaGVkLg0KDQoNCuKAnDI0ICAgICAgICAgdG9rZW5fYmluZGluZyAoVEVNUE9SQVJZIC0gcmVn aXN0ZXJlZCAyMDE2LTAyLTA0LCBleHBpcmVzIDIwMTctMDItMDQpDQoNCltkcmFmdC1pZXRmLXRv a2JpbmQtbmVnb3RpYXRpb25d4oCdDQoNCkNoZWVycywNCg0KQW5kcmVpDQoNCkZyb206IFVuYmVh cmFibGUgW21haWx0bzp1bmJlYXJhYmxlLWJvdW5jZXNAaWV0Zi5vcmddIE9uIEJlaGFsZiBPZiBC cmlhbiBDYW1wYmVsbA0KU2VudDogVHVlc2RheSwgSnVuZSAyMSwgMjAxNiAxOjQ4IFBNDQpUbzog RGF2ZSBUb25nZSA8ZGF2ZS50b25nZUBtb21lbnR1bWZ0LmNvLnVrPg0KQ2M6IEpvaG4gQnJhZGxl eSA8dmU3anRiQHZlN2p0Yi5jb20+OyBJRVRGIFRva2JpbmQgV0cgPHVuYmVhcmFibGVAaWV0Zi5v cmc+OyBCaWxsIENveCA8d2F5d2FyZGdlZWtAZ29vZ2xlLmNvbT4NClN1YmplY3Q6IFJlOiBbVW5i ZWFyYWJsZV0gQ3VycmVudCBpbXBsZW1lbnRhdGlvbnMgb2YgdG9rZW4gYmluZGluZyBzcGVjPw0K DQpJbiB0aGUgaW1wbGVtZW50YXRpb25zIHRoYXQgYXJlIG91dCB0aGVyZSBub3csIHdoYXQgdmFs dWUgaXMgYmVpbmcgdXNlZCB0byBpZGVudGlmeSB0aGUgdG9rZW5fYmluZGluZyBFeHRlbnNpb25U eXBlPyBUQk5FR08ganVzdCBoYXMgYSBUQkQ8aHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL2Ry YWZ0LWlldGYtdG9rYmluZC1uZWdvdGlhdGlvbi0wMiNzZWN0aW9uLTI+IHJpZ2h0IG5vdy4gSXMg dGhlcmUgYW55IHdvcmsgdW5kZXJ3YXkgdG93YXJkcyBnZXR0aW5nIGVhcmx5IGFzc2lnbm1lbnQg b2YgYSBFeHRlbnNpb25UeXBlIFZhbHVlIGZvciBUQj8gT3IgaXMgdGhhdCBldmVuIHBvc3NpYmxl Pw0KDQpPbiBUdWUsIEp1biAyMSwgMjAxNiBhdCAxMDoxMyBBTSwgRGF2ZSBUb25nZSA8ZGF2ZS50 b25nZUBtb21lbnR1bWZ0LmNvLnVrPG1haWx0bzpkYXZlLnRvbmdlQG1vbWVudHVtZnQuY28udWs+ PiB3cm90ZToNClRoYW5rcyBCaWxsIGFuZCBKb2huDQoNCkJpbGwgLSBsb29raW5nIGZvcndhcmQg dG8gaXQsIEknbGwgZ2l2ZSBpdCBhIHRyeSB3aGVuIGl0cyByZWxlYXNlZC4NCkpvaG4gLSBJJ2xs IHRha2UgYSBsb29rIGF0IHRoZSB0ZXN0IHNlcnZlciBpbiBjaHJvbWl1bS4NCg0KSSdtIGtlZW4g dG8gaGVscCBwdXNoIGZvcndhcmQgc3VwcG9ydCwgc28gcGxlYXNlIGxldCBtZSBrbm93IGlmIHRo ZXJlIGlzIGFueXRoaW5nIGVsc2UgSSBjYW4gdG8gZG8gdG8gaGVscC4NCg0KVGhhbmtzDQoNCkRh dmUNCg0KT24gMjEgSnVuZSAyMDE2IGF0IDE2OjM1LCBKb2huIEJyYWRsZXkgPHZlN2p0YkB2ZTdq dGIuY29tPG1haWx0bzp2ZTdqdGJAdmU3anRiLmNvbT4+IHdyb3RlOg0KQ3VycmVudGx5IGlmIHlv dSBhcmUgYnJhdmUsIHRoZXJlIGlzIGEgUHl0aG9uIHRlc3Qgc2VydmVyIGFzIHBhcnQgb2YgdGhl IENocm9taXVtIHByb2plY3Qgb24gR2l0aHViIGZvciB0ZXN0aW5nLg0KaHR0cHM6Ly9naXRodWIu Y29tL2Nocm9taXVtL2Nocm9taXVtDQoNCkxhc3QgdGltZSBJIHRyaWVkIGl0IHlvdSBuZWVkZWQg dG8gY2hlY2tvdXQgdGhlIHdob2xlIHByb2plY3QgdG8gZ2V0IHRoZSB0ZXN0IHNlcnZlciB0byBi dWlsZC4NCkkgdGhpbmsgdGhleSBhcmUgd29ya2luZyBvbiBtYWtpbmcgdGhhdCBlYXNpZXIuDQoN CkFsc28gYXMgcGFydCBvZiB0aGF0IHByb2plY3QgdGhlcmUgaXMgdGhlIENyb25ldCBodHRwL1RM UyBsaWIgdGhhdCBjYW4gYmUgdXNlZCBvbiBpT1MgYW5kIEFuZHJvaWQuDQoNCldlIGFyZSBob3Bp bmcgdG8gaW5jbHVkZSB0aGF0IGFzIGFuIG9wdGlvbiBpbiB0aGUgQXBwQXV0aCBwcm9qZWN0IGZv ciB0b2tlbiBiaW5kaW5nIHJlZnJlc2ggYW5kIGFjY2VzcyB0b2tlbnMgb24gbW9iaWxlLg0KDQpo dHRwczovL2dpdGh1Yi5jb20vb3BlbmlkDQoNCldlIGFyZSB3b3JraW5nL2xvYmJ5aW5nIHRvIGdl dCBzdXBwb3J0IGluY2x1ZGVkIGluIG1vcmUgcGxhY2VzIHN1Y2ggYXMgUHl0aG9uIGFuZCBKYXZh Lg0KDQpJIGhvcGUgeW91IGNhbiBjb250cmlidXRlIHRvIHRoZSBXRyBhbmQgaGVscCB1cyBtb3Zl IHRoaXMgc3BlYyB0byBhIFJGQyBxdWlja2x5IGJ5IHNob3dpbmcgZGVtYW5kLg0KDQpSZWdhcmRz DQpKb2huIEIuDQoNCg0KT24gSnVuIDIxLCAyMDE2LCBhdCAxMDo1NSBBTSwgRGF2ZSBUb25nZSA8 ZGF2ZS50b25nZUBtb21lbnR1bWZ0LmNvLnVrPG1haWx0bzpkYXZlLnRvbmdlQG1vbWVudHVtZnQu Y28udWs+PiB3cm90ZToNCg0KSGkNCg0KSSdtIGN1cnJlbnRseSB3b3JraW5nIHdpdGggdGhlIFVL IE9wZW4gQmFua2luZyBTdGFuZGFyZCA8aHR0cHM6Ly9naXRodWIuY29tL09wZW5CYW5raW5nU3Rh bmRhcmQ+IGFuZCB0aGUgT3BlbklEIEZpbmFuY2lhbCBBUEkgV0c8aHR0cDovL29wZW5pZC5uZXQv d2cvZmFwaS8+Lg0KVGhlIGlzc3VlIG9mIHRva2VuIGJpbmRpbmcgaXMgYmVpbmcgZGlzY3Vzc2Vk IGFuZCBJIHdhbnRlZCB0byB0cnkgb3V0IGFuIGFjdHVhbCByZWFsIHdvcmxkIGltcGxlbWVudGF0 aW9uLg0KQWZ0ZXIgc29tZSByZXNlYXJjaCB0aGVyZSBkb24ndCBzZWVtIHRvIGJlIG1hbnkgaW1w bGVtZW50YXRpb25zIGluIHRoZSB3aWxkICh1bmxlc3MgSSd2ZSBtaXNzZWQgc29tZXRoaW5nKS4N Cg0KSXQgaXMgc3VwcG9ydGVkIGluIENocm9tZSwgYnV0IGRvZXNuJ3Qgc2VlbSB0byBiZSBzdXBw b3J0ZWQgaW4gT3BlblNTTCB5ZXQgKGFuZCB0aGVyZWZvcmUgbm90IGluIE5vZGUuSlMsIFB5dGhv biwgUnVieSwgZXRjLg0KSSd2ZSBvcGVuZWQgYW4gaXNzdWUgb24gdGhlIE9wZW5TU0wgcmVwbzog aHR0cHM6Ly9naXRodWIuY29tL29wZW5zc2wvb3BlbnNzbC9pc3N1ZXMvMTI0Mg0KDQpJcyBteSB1 bmRlcnN0YW5kaW5nIGNvcnJlY3Q/IEhvdyB3b3VsZCB5b3UgcmVjb21tZW5kIHRyeWluZyBvdXQg YSBhIGxpdmUgaW1wbGVtZW50YXRpb24gb2YgdG9rZW4gYmluZGluZz8NCg0KVGhhbmtzDQoNCi0t DQpEYXZlIFRvbmdlDQpDVE8NCltodHRwOi8vd3d3Lm1vbWVudHVtZmluYW5jaWFsdGVjaG5vbG9n eS5jb20vd3AtY29udGVudC90aGVtZXMvcm9vdHMvYXNzZXRzL2ltZy9tZnQtbG9nby1lbWFpbC5w bmddDQoxMCBUZW1wbGUgQmFjayB8IEJyaXN0b2wgfCBCUzEgNkZMDQp0OiArNDQgKDApMTE3IDI4 MCA1MTIwPHRlbDolMkI0NCUyMCUyODAlMjkxMTclMjAyODAlMjA1MTIwPg0KbTogKzQ0ICgwKTc1 NzcgODE1NTcwPHRlbDolMkI0NCUyMCUyODAlMjk3NTc3JTIwODE1NTcwPg0KDQpNb21lbnR1bSBG aW5hbmNpYWwgVGVjaG5vbG9neSBMdGQgaXMgYXV0aG9yaXNlZCBhbmQgcmVndWxhdGVkIGJ5IHRo ZSBGaW5hbmNpYWwgQ29uZHVjdCBBdXRob3JpdHkgKFJlZ2lzdGVyIG51bWJlciA1NjE1MzgpLiBS ZWdpc3RlcmVkIGluIEVuZ2xhbmQgJiBXYWxlcywgY29tcGFueSByZWdpc3RyYXRpb24gbnVtYmVy IDA2OTA5NzcyLiBESVNDTEFJTUVSOiBUaGlzIGVtYWlsIChpbmNsdWRpbmcgYW55IGF0dGFjaG1l bnRzKSBpcyBzdWJqZWN0IHRvIGNvcHlyaWdodCwgYW5kIHRoZSBpbmZvcm1hdGlvbiBpbiBpdCBp cyBjb25maWRlbnRpYWwuIFVzZSBvZiB0aGlzIGVtYWlsIG9yIG9mIGFueSBpbmZvcm1hdGlvbiBp biBpdCBvdGhlciB0aGFuIGJ5IHRoZSBhZGRyZXNzZWUgaXMgdW5hdXRob3Jpc2VkIGFuZCB1bmxh d2Z1bC4gV2hpbHN0IHJlYXNvbmFibGUgZWZmb3J0cyBhcmUgbWFkZSB0byBlbnN1cmUgdGhhdCBh bnkgYXR0YWNobWVudHMgYXJlIHZpcnVzLWZyZWUsIGl0IGlzIHRoZSByZWNpcGllbnQncyBzb2xl IHJlc3BvbnNpYmlsaXR5IHRvIHNjYW4gYWxsIGF0dGFjaG1lbnRzIGZvciB2aXJ1c2VzLiBBbGwg Y2FsbHMgYW5kIGVtYWlscyB0byBhbmQgZnJvbSB0aGlzIGNvbXBhbnkgbWF5IGJlIG1vbml0b3Jl ZCBhbmQgcmVjb3JkZWQgZm9yIGxlZ2l0aW1hdGUgcHVycG9zZXMgcmVsYXRpbmcgdG8gdGhpcyBj b21wYW55J3MgYnVzaW5lc3MuIEFueSBvcGluaW9ucyBleHByZXNzZWQgaW4gdGhpcyBlbWFpbCAo b3IgaW4gYW55IGF0dGFjaG1lbnRzKSBhcmUgdGhvc2Ugb2YgdGhlIGF1dGhvciBhbmQgZG8gbm90 IG5lY2Vzc2FyaWx5IHJlcHJlc2VudCB0aGUgb3BpbmlvbnMgb2YgTW9tZW50dW0gRmluYW5jaWFs IFRlY2hub2xvZ3kgTHRkIG9yIG9mIGFueSBvdGhlciBncm91cCBjb21wYW55Lg0KX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NClVuYmVhcmFibGUgbWFpbGlu ZyBsaXN0DQpVbmJlYXJhYmxlQGlldGYub3JnPG1haWx0bzpVbmJlYXJhYmxlQGlldGYub3JnPg0K aHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby91bmJlYXJhYmxlDQoNCg0KDQoN Ci0tDQpEYXZlIFRvbmdlDQpDVE8NCltodHRwOi8vd3d3Lm1vbWVudHVtZmluYW5jaWFsdGVjaG5v bG9neS5jb20vd3AtY29udGVudC90aGVtZXMvcm9vdHMvYXNzZXRzL2ltZy9tZnQtbG9nby1lbWFp bC5wbmddDQoxMCBUZW1wbGUgQmFjayB8IEJyaXN0b2wgfCBCUzEgNkZMDQp0OiArNDQgKDApMTE3 IDI4MCA1MTIwPHRlbDolMkI0NCUyMCUyODAlMjkxMTclMjAyODAlMjA1MTIwPg0KbTogKzQ0ICgw KTc1NzcgODE1NTcwPHRlbDolMkI0NCUyMCUyODAlMjk3NTc3JTIwODE1NTcwPg0KDQpNb21lbnR1 bSBGaW5hbmNpYWwgVGVjaG5vbG9neSBMdGQgaXMgYXV0aG9yaXNlZCBhbmQgcmVndWxhdGVkIGJ5 IHRoZSBGaW5hbmNpYWwgQ29uZHVjdCBBdXRob3JpdHkgKFJlZ2lzdGVyIG51bWJlciA1NjE1Mzgp LiBSZWdpc3RlcmVkIGluIEVuZ2xhbmQgJiBXYWxlcywgY29tcGFueSByZWdpc3RyYXRpb24gbnVt YmVyIDA2OTA5NzcyLiBESVNDTEFJTUVSOiBUaGlzIGVtYWlsIChpbmNsdWRpbmcgYW55IGF0dGFj aG1lbnRzKSBpcyBzdWJqZWN0IHRvIGNvcHlyaWdodCwgYW5kIHRoZSBpbmZvcm1hdGlvbiBpbiBp dCBpcyBjb25maWRlbnRpYWwuIFVzZSBvZiB0aGlzIGVtYWlsIG9yIG9mIGFueSBpbmZvcm1hdGlv biBpbiBpdCBvdGhlciB0aGFuIGJ5IHRoZSBhZGRyZXNzZWUgaXMgdW5hdXRob3Jpc2VkIGFuZCB1 bmxhd2Z1bC4gV2hpbHN0IHJlYXNvbmFibGUgZWZmb3J0cyBhcmUgbWFkZSB0byBlbnN1cmUgdGhh dCBhbnkgYXR0YWNobWVudHMgYXJlIHZpcnVzLWZyZWUsIGl0IGlzIHRoZSByZWNpcGllbnQncyBz b2xlIHJlc3BvbnNpYmlsaXR5IHRvIHNjYW4gYWxsIGF0dGFjaG1lbnRzIGZvciB2aXJ1c2VzLiBB bGwgY2FsbHMgYW5kIGVtYWlscyB0byBhbmQgZnJvbSB0aGlzIGNvbXBhbnkgbWF5IGJlIG1vbml0 b3JlZCBhbmQgcmVjb3JkZWQgZm9yIGxlZ2l0aW1hdGUgcHVycG9zZXMgcmVsYXRpbmcgdG8gdGhp cyBjb21wYW55J3MgYnVzaW5lc3MuIEFueSBvcGluaW9ucyBleHByZXNzZWQgaW4gdGhpcyBlbWFp bCAob3IgaW4gYW55IGF0dGFjaG1lbnRzKSBhcmUgdGhvc2Ugb2YgdGhlIGF1dGhvciBhbmQgZG8g bm90IG5lY2Vzc2FyaWx5IHJlcHJlc2VudCB0aGUgb3BpbmlvbnMgb2YgTW9tZW50dW0gRmluYW5j aWFsIFRlY2hub2xvZ3kgTHRkIG9yIG9mIGFueSBvdGhlciBncm91cCBjb21wYW55Lg0KDQpfX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KVW5iZWFyYWJsZSBt YWlsaW5nIGxpc3QNClVuYmVhcmFibGVAaWV0Zi5vcmc8bWFpbHRvOlVuYmVhcmFibGVAaWV0Zi5v cmc+DQpodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3VuYmVhcmFibGUNCg0K --_000_BN3PR03MB14450B3302E670E17B54C0638C2B0BN3PR03MB1445namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPCEtLVtp ZiAhbXNvXT48c3R5bGU+dlw6KiB7YmVoYXZpb3I6dXJsKCNkZWZhdWx0I1ZNTCk7fQ0Kb1w6KiB7 YmVoYXZpb3I6dXJsKCNkZWZhdWx0I1ZNTCk7fQ0Kd1w6KiB7YmVoYXZpb3I6dXJsKCNkZWZhdWx0 I1ZNTCk7fQ0KLnNoYXBlIHtiZWhhdmlvcjp1cmwoI2RlZmF1bHQjVk1MKTt9DQo8L3N0eWxlPjwh W2VuZGlmXS0tPjxzdHlsZT48IS0tDQovKiBGb250IERlZmluaXRpb25zICovDQpAZm9udC1mYWNl DQoJe2ZvbnQtZmFtaWx5OiJDYW1icmlhIE1hdGgiOw0KCXBhbm9zZS0xOjIgNCA1IDMgNSA0IDYg MyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDYWxpYnJpOw0KCXBhbm9zZS0xOjIg MTUgNSAyIDIgMiA0IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6IlRyZWJ1Y2hl dCBNUyI7DQoJcGFub3NlLTE6MiAxMSA2IDMgMiAyIDIgMiAyIDQ7fQ0KLyogU3R5bGUgRGVmaW5p dGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWwsIGRpdi5Nc29Ob3JtYWwNCgl7bWFy Z2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEyLjBwdDsNCglm b250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIixzZXJpZjt9DQphOmxpbmssIHNwYW4uTXNvSHlw ZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpibHVlOw0KCXRleHQtZGVj b3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1zb0h5cGVybGlua0ZvbGxvd2Vk DQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpwdXJwbGU7DQoJdGV4dC1kZWNvcmF0 aW9uOnVuZGVybGluZTt9DQpwLk1zb1BsYWluVGV4dCwgbGkuTXNvUGxhaW5UZXh0LCBkaXYuTXNv UGxhaW5UZXh0DQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgltc28tc3R5bGUtbGluazoiUGxh aW4gVGV4dCBDaGFyIjsNCgltYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglm b250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnAu bXNvbm9ybWFsMCwgbGkubXNvbm9ybWFsMCwgZGl2Lm1zb25vcm1hbDANCgl7bXNvLXN0eWxlLW5h bWU6bXNvbm9ybWFsOw0KCW1zby1tYXJnaW4tdG9wLWFsdDphdXRvOw0KCW1hcmdpbi1yaWdodDow aW47DQoJbXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87DQoJbWFyZ2luLWxlZnQ6MGluOw0KCWZv bnQtc2l6ZToxMi4wcHQ7DQoJZm9udC1mYW1pbHk6IlRpbWVzIE5ldyBSb21hbiIsc2VyaWY7fQ0K c3Bhbi5ob2VuemINCgl7bXNvLXN0eWxlLW5hbWU6aG9lbnpiO30NCnNwYW4uRW1haWxTdHlsZTE5 DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsOw0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5z LXNlcmlmOw0KCWNvbG9yOiMxRjQ5N0Q7fQ0Kc3Bhbi5FbWFpbFN0eWxlMjANCgl7bXNvLXN0eWxl LXR5cGU6cGVyc29uYWwtY29tcG9zZTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJp ZjsNCgljb2xvcjp3aW5kb3d0ZXh0O30NCnNwYW4uUGxhaW5UZXh0Q2hhcg0KCXttc28tc3R5bGUt bmFtZToiUGxhaW4gVGV4dCBDaGFyIjsNCgltc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJbXNvLXN0 eWxlLWxpbms6IlBsYWluIFRleHQiOw0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlm O30NCi5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0KCWZvbnQt ZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXpl OjguNWluIDExLjBpbjsNCgltYXJnaW46MS4waW4gMS4waW4gMS4waW4gMS4waW47fQ0KZGl2Lldv cmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQotLT48L3N0eWxlPjwhLS1baWYgZ3Rl IG1zbyA5XT48eG1sPg0KPG86c2hhcGVkZWZhdWx0cyB2OmV4dD0iZWRpdCIgc3BpZG1heD0iMTAy NiIgLz4NCjwveG1sPjwhW2VuZGlmXS0tPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hh cGVsYXlvdXQgdjpleHQ9ImVkaXQiPg0KPG86aWRtYXAgdjpleHQ9ImVkaXQiIGRhdGE9IjEiIC8+ DQo8L286c2hhcGVsYXlvdXQ+PC94bWw+PCFbZW5kaWZdLS0+DQo8L2hlYWQ+DQo8Ym9keSBsYW5n PSJFTi1VUyIgbGluaz0iYmx1ZSIgdmxpbms9InB1cnBsZSI+DQo8ZGl2IGNsYXNzPSJXb3JkU2Vj dGlvbjEiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5 N0QiPkhpIEJyaWFuLDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkm cXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+ RWFybHkgYXNzaWdubWVudCBpcyBhdmFpbGFibGU7IHBsZWFzZSBzZWUgYXR0YWNoZWQuPG86cD48 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2Nv bG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Q bGFpblRleHQiPjxzcGFuIHN0eWxlPSJjb2xvcjojMUY0OTdEIj7igJw8L3NwYW4+MjQmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgdG9rZW5fYmluZGluZyAo VEVNUE9SQVJZIC0gcmVnaXN0ZXJlZCAyMDE2LTAyLTA0LCBleHBpcmVzIDIwMTctMDItMDQpJm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7DQo8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRl eHQiPltkcmFmdC1pZXRmLXRva2JpbmQtbmVnb3RpYXRpb25d4oCdPG86cD48L286cD48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4m bmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmO2NvbG9yOiMxRjQ5N0QiPkNoZWVycyw8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2Nv bG9yOiMxRjQ5N0QiPkFuZHJlaTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nh bGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkZyb206 PC9zcGFuPjwvYj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiBVbmJlYXJhYmxlIFttYWlsdG86dW5iZWFyYWJs ZS1ib3VuY2VzQGlldGYub3JnXQ0KPGI+T24gQmVoYWxmIE9mIDwvYj5CcmlhbiBDYW1wYmVsbDxi cj4NCjxiPlNlbnQ6PC9iPiBUdWVzZGF5LCBKdW5lIDIxLCAyMDE2IDE6NDggUE08YnI+DQo8Yj5U bzo8L2I+IERhdmUgVG9uZ2UgJmx0O2RhdmUudG9uZ2VAbW9tZW50dW1mdC5jby51ayZndDs8YnI+ DQo8Yj5DYzo8L2I+IEpvaG4gQnJhZGxleSAmbHQ7dmU3anRiQHZlN2p0Yi5jb20mZ3Q7OyBJRVRG IFRva2JpbmQgV0cgJmx0O3VuYmVhcmFibGVAaWV0Zi5vcmcmZ3Q7OyBCaWxsIENveCAmbHQ7d2F5 d2FyZGdlZWtAZ29vZ2xlLmNvbSZndDs8YnI+DQo8Yj5TdWJqZWN0OjwvYj4gUmU6IFtVbmJlYXJh YmxlXSBDdXJyZW50IGltcGxlbWVudGF0aW9ucyBvZiB0b2tlbiBiaW5kaW5nIHNwZWM/PG86cD48 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48 L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SW4gdGhlIGltcGxlbWVudGF0aW9ucyB0 aGF0IGFyZSBvdXQgdGhlcmUgbm93LCB3aGF0IHZhbHVlIGlzIGJlaW5nIHVzZWQgdG8gaWRlbnRp ZnkgdGhlIHRva2VuX2JpbmRpbmcgRXh0ZW5zaW9uVHlwZT8NCjxhIGhyZWY9Imh0dHBzOi8vdG9v bHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1pZXRmLXRva2JpbmQtbmVnb3RpYXRpb24tMDIjc2VjdGlv bi0yIj4NClRCTkVHTyBqdXN0IGhhcyBhIFRCRDwvYT4gcmlnaHQgbm93LiBJcyB0aGVyZSBhbnkg d29yayB1bmRlcndheSB0b3dhcmRzIGdldHRpbmcgZWFybHkgYXNzaWdubWVudCBvZiBhIEV4dGVu c2lvblR5cGUgVmFsdWUgZm9yIFRCPyBPciBpcyB0aGF0IGV2ZW4gcG9zc2libGU/DQo8bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7 PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk9uIFR1ZSwgSnVuIDIxLCAy MDE2IGF0IDEwOjEzIEFNLCBEYXZlIFRvbmdlICZsdDs8YSBocmVmPSJtYWlsdG86ZGF2ZS50b25n ZUBtb21lbnR1bWZ0LmNvLnVrIiB0YXJnZXQ9Il9ibGFuayI+ZGF2ZS50b25nZUBtb21lbnR1bWZ0 LmNvLnVrPC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8YmxvY2txdW90ZSBzdHlsZT0i Ym9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRkaW5nOjBpbiAw aW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi1yaWdodDowaW4iPg0KPGRpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1 b3Q7VHJlYnVjaGV0IE1TJnF1b3Q7LHNhbnMtc2VyaWYiPlRoYW5rcyBCaWxsIGFuZCBKb2huPG86 cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O1RyZWJ1Y2hldCBNUyZxdW90OyxzYW5zLXNl cmlmIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7VHJlYnVjaGV0IE1T JnF1b3Q7LHNhbnMtc2VyaWYiPkJpbGwgLSBsb29raW5nIGZvcndhcmQgdG8gaXQsIEknbGwgZ2l2 ZSBpdCBhIHRyeSB3aGVuIGl0cyByZWxlYXNlZC48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6 JnF1b3Q7VHJlYnVjaGV0IE1TJnF1b3Q7LHNhbnMtc2VyaWYiPkpvaG4gLSBJJ2xsIHRha2UgYSBs b29rIGF0IHRoZSB0ZXN0IHNlcnZlciBpbiBjaHJvbWl1bS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1m YW1pbHk6JnF1b3Q7VHJlYnVjaGV0IE1TJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+Jm5ic3A7PC9v OnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtUcmVidWNoZXQgTVMmcXVvdDssc2Fucy1zZXJpZiI+ SSdtIGtlZW4gdG8gaGVscCBwdXNoIGZvcndhcmQgc3VwcG9ydCwgc28gcGxlYXNlIGxldCBtZSBr bm93IGlmIHRoZXJlIGlzIGFueXRoaW5nIGVsc2UgSSBjYW4gdG8gZG8gdG8gaGVscC48bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7VHJlYnVjaGV0IE1TJnF1b3Q7LHNhbnMtc2VyaWYi PjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtUcmVidWNoZXQgTVMmcXVv dDssc2Fucy1zZXJpZiI+VGhhbmtzPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O1Ry ZWJ1Y2hldCBNUyZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiM4ODg4ODgiPjxvOnA+Jm5ic3A7PC9v OnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtUcmVidWNoZXQgTVMmcXVvdDssc2Fucy1zZXJpZjtj b2xvcjojODg4ODg4Ij5EYXZlPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4N CjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9v OnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk9uIDIxIEp1bmUgMjAxNiBhdCAx NjozNSwgSm9obiBCcmFkbGV5ICZsdDs8YSBocmVmPSJtYWlsdG86dmU3anRiQHZlN2p0Yi5jb20i IHRhcmdldD0iX2JsYW5rIj52ZTdqdGJAdmU3anRiLmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9v OnA+PC9wPg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlk ICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowaW4gMGluIDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0Ljhw dDttYXJnaW4tcmlnaHQ6MGluIj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5DdXJyZW50 bHkgaWYgeW91IGFyZSBicmF2ZSwgdGhlcmUgaXMgYSBQeXRob24gdGVzdCBzZXJ2ZXIgYXMgcGFy dCBvZiB0aGUgQ2hyb21pdW0gcHJvamVjdCBvbiBHaXRodWIgZm9yIHRlc3RpbmcuPG86cD48L286 cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGEgaHJlZj0iaHR0cHM6Ly9naXRo dWIuY29tL2Nocm9taXVtL2Nocm9taXVtIiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly9naXRodWIu Y29tL2Nocm9taXVtL2Nocm9taXVtPC9hPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5MYXN0IHRpbWUgSSB0cmllZCBpdCB5b3UgbmVlZGVkIHRv IGNoZWNrb3V0IHRoZSB3aG9sZSBwcm9qZWN0IHRvIGdldCB0aGUgdGVzdCBzZXJ2ZXIgdG8gYnVp bGQuICZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+SSB0aGluayB0aGV5IGFyZSB3b3JraW5nIG9uIG1ha2luZyB0aGF0IGVhc2llci4mbmJz cDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxv OnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ QWxzbyBhcyBwYXJ0IG9mIHRoYXQgcHJvamVjdCB0aGVyZSBpcyB0aGUgQ3JvbmV0IGh0dHAvVExT IGxpYiB0aGF0IGNhbiBiZSB1c2VkIG9uIGlPUyBhbmQgQW5kcm9pZC48bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+V2UgYXJlIGhvcGluZyB0byBp bmNsdWRlIHRoYXQgYXMgYW4gb3B0aW9uIGluIHRoZSBBcHBBdXRoIHByb2plY3QgZm9yIHRva2Vu IGJpbmRpbmcgcmVmcmVzaCBhbmQgYWNjZXNzIHRva2VucyBvbiBtb2JpbGUuPG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxhIGhyZWY9Imh0dHBz Oi8vZ2l0aHViLmNvbS9vcGVuaWQiIHRhcmdldD0iX2JsYW5rIj5odHRwczovL2dpdGh1Yi5jb20v b3BlbmlkPC9hPjxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxv OnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ V2UgYXJlIHdvcmtpbmcvbG9iYnlpbmcgdG8gZ2V0IHN1cHBvcnQgaW5jbHVkZWQgaW4gbW9yZSBw bGFjZXMgc3VjaCBhcyBQeXRob24gYW5kIEphdmEuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkkgaG9wZSB5b3UgY2FuIGNvbnRyaWJ1dGUgdG8g dGhlIFdHIGFuZCBoZWxwIHVzIG1vdmUgdGhpcyBzcGVjIHRvIGEgUkZDIHF1aWNrbHkgYnkgc2hv d2luZyBkZW1hbmQuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPlJlZ2FyZHM8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPkpvaG4gQi48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 ZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1 LjBwdCI+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5PbiBKdW4g MjEsIDIwMTYsIGF0IDEwOjU1IEFNLCBEYXZlIFRvbmdlICZsdDs8YSBocmVmPSJtYWlsdG86ZGF2 ZS50b25nZUBtb21lbnR1bWZ0LmNvLnVrIiB0YXJnZXQ9Il9ibGFuayI+ZGF2ZS50b25nZUBtb21l bnR1bWZ0LmNvLnVrPC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxk aXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O1RyZWJ1Y2hldCBNUyZxdW90OyxzYW5zLXNlcmlm Ij5IaTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtUcmVidWNoZXQgTVMmcXVvdDss c2Fucy1zZXJpZiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O1RyZWJ1 Y2hldCBNUyZxdW90OyxzYW5zLXNlcmlmIj5JJ20gY3VycmVudGx5IHdvcmtpbmcgd2l0aCB0aGUN CjxhIGhyZWY9Imh0dHBzOi8vZ2l0aHViLmNvbS9PcGVuQmFua2luZ1N0YW5kYXJkIiB0YXJnZXQ9 Il9ibGFuayI+VUsgT3BlbiBCYW5raW5nIFN0YW5kYXJkDQo8L2E+YW5kIHRoZSA8YSBocmVmPSJo dHRwOi8vb3BlbmlkLm5ldC93Zy9mYXBpLyIgdGFyZ2V0PSJfYmxhbmsiPk9wZW5JRCBGaW5hbmNp YWwgQVBJIFdHPC9hPi4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7VHJl YnVjaGV0IE1TJnF1b3Q7LHNhbnMtc2VyaWYiPlRoZSBpc3N1ZSBvZiB0b2tlbiBiaW5kaW5nIGlz IGJlaW5nIGRpc2N1c3NlZCBhbmQgSSB3YW50ZWQgdG8gdHJ5IG91dCBhbiBhY3R1YWwgcmVhbCB3 b3JsZCBpbXBsZW1lbnRhdGlvbi4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1 b3Q7VHJlYnVjaGV0IE1TJnF1b3Q7LHNhbnMtc2VyaWYiPkFmdGVyIHNvbWUgcmVzZWFyY2ggdGhl cmUgZG9uJ3Qgc2VlbSB0byBiZSBtYW55IGltcGxlbWVudGF0aW9ucyBpbiB0aGUgd2lsZCAodW5s ZXNzIEkndmUgbWlzc2VkIHNvbWV0aGluZykuPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZx dW90O1RyZWJ1Y2hldCBNUyZxdW90OyxzYW5zLXNlcmlmIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bh bj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1mYW1pbHk6JnF1b3Q7VHJlYnVjaGV0IE1TJnF1b3Q7LHNhbnMtc2VyaWYiPkl0IGlzIHN1 cHBvcnRlZCBpbiBDaHJvbWUsIGJ1dCBkb2Vzbid0IHNlZW0gdG8gYmUgc3VwcG9ydGVkIGluIE9w ZW5TU0wgeWV0IChhbmQgdGhlcmVmb3JlIG5vdCBpbiBOb2RlLkpTLCBQeXRob24sIFJ1YnksIGV0 Yy48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7VHJlYnVjaGV0IE1TJnF1b3Q7LHNh bnMtc2VyaWYiPkkndmUgb3BlbmVkIGFuIGlzc3VlIG9uIHRoZSBPcGVuU1NMIHJlcG86DQo8YSBo cmVmPSJodHRwczovL2dpdGh1Yi5jb20vb3BlbnNzbC9vcGVuc3NsL2lzc3Vlcy8xMjQyIiB0YXJn ZXQ9Il9ibGFuayI+aHR0cHM6Ly9naXRodWIuY29tL29wZW5zc2wvb3BlbnNzbC9pc3N1ZXMvMTI0 MjwvYT48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7VHJlYnVjaGV0IE1TJnF1b3Q7 LHNhbnMtc2VyaWYiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtUcmVi dWNoZXQgTVMmcXVvdDssc2Fucy1zZXJpZiI+SXMgbXkgdW5kZXJzdGFuZGluZyBjb3JyZWN0PyBI b3cgd291bGQgeW91IHJlY29tbWVuZCB0cnlpbmcgb3V0IGEgYSBsaXZlIGltcGxlbWVudGF0aW9u IG9mIHRva2VuIGJpbmRpbmc/PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O1RyZWJ1 Y2hldCBNUyZxdW90OyxzYW5zLXNlcmlmIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1p bHk6JnF1b3Q7VHJlYnVjaGV0IE1TJnF1b3Q7LHNhbnMtc2VyaWYiPlRoYW5rczxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5i c3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4tLSA8bzpwPjwvbzpw PjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojREMyOTFF Ij5EYXZlIFRvbmdlPG86cD48L286cD48L3NwYW4+PC9iPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMTYyQjQ4Ij5DVE88bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNh bnMtc2VyaWY7Y29sb3I6IzE2MkI0OCI+PGltZyBib3JkZXI9IjAiIHdpZHRoPSIxNTAiIGhlaWdo dD0iMzciIGlkPSJfeDAwMDBfaTEwMjUiIHNyYz0iaHR0cDovL3d3dy5tb21lbnR1bWZpbmFuY2lh bHRlY2hub2xvZ3kuY29tL3dwLWNvbnRlbnQvdGhlbWVzL3Jvb3RzL2Fzc2V0cy9pbWcvbWZ0LWxv Z28tZW1haWwucG5nIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzE2MkI0OCI+MTAgVGVtcGxlIEJh Y2sgfCBCcmlzdG9sIHwgQlMxIDZGTDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojREMyOTFFIj50 OiZuYnNwOzwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWls eTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxNjJCNDgiPjxhIGhyZWY9InRl bDolMkI0NCUyMCUyODAlMjkxMTclMjAyODAlMjA1MTIwIiB0YXJnZXQ9Il9ibGFuayI+JiM0Mzs0 NCAoMCkxMTcNCiAyODAgNTEyMDwvYT48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjguMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6I0RDMjkxRSI+ bTombmJzcDs8L3NwYW4+PC9iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OC4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMTYyQjQ4Ij48YSBocmVmPSJ0 ZWw6JTJCNDQlMjAlMjgwJTI5NzU3NyUyMDgxNTU3MCIgdGFyZ2V0PSJfYmxhbmsiPiYjNDM7NDQg KDApNzU3Nw0KIDgxNTU3MDwvYT48L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtm b250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxNjJCNDgiPjxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVv dDssc2Fucy1zZXJpZjtjb2xvcjojMTYyQjQ4Ij4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJp Zjtjb2xvcjojMTYyQjQ4Ij5Nb21lbnR1bSBGaW5hbmNpYWwgVGVjaG5vbG9neSBMdGQgaXMgYXV0 aG9yaXNlZCBhbmQgcmVndWxhdGVkIGJ5IHRoZSBGaW5hbmNpYWwgQ29uZHVjdCBBdXRob3JpdHkg KFJlZ2lzdGVyIG51bWJlciZuYnNwOzwvc3Bhbj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjku MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6I0RDMjkx RSI+NTYxNTM4PC9zcGFuPjwvYj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzE2MkI0OCI+KS4NCiBSZWdp c3RlcmVkIGluIEVuZ2xhbmQgJmFtcDsgV2FsZXMsIGNvbXBhbnkgcmVnaXN0cmF0aW9uIG51bWJl ciZuYnNwOzwvc3Bhbj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6I0RDMjkxRSI+MDY5MDk3NzI8L3Nw YW4+PC9iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7QXJp YWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMTYyQjQ4Ij4uJm5ic3A7PC9zcGFuPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1z ZXJpZjtjb2xvcjojODg4ODg4Ij5ESVNDTEFJTUVSOg0KIFRoaXMgZW1haWwgKGluY2x1ZGluZyBh bnkgYXR0YWNobWVudHMpIGlzIHN1YmplY3QgdG8gY29weXJpZ2h0LCBhbmQgdGhlIGluZm9ybWF0 aW9uIGluIGl0IGlzIGNvbmZpZGVudGlhbC4gVXNlIG9mIHRoaXMgZW1haWwgb3Igb2YgYW55IGlu Zm9ybWF0aW9uIGluIGl0IG90aGVyIHRoYW4gYnkgdGhlIGFkZHJlc3NlZSBpcyB1bmF1dGhvcmlz ZWQgYW5kIHVubGF3ZnVsLiBXaGlsc3QgcmVhc29uYWJsZSBlZmZvcnRzIGFyZSBtYWRlIHRvIGVu c3VyZQ0KIHRoYXQgYW55IGF0dGFjaG1lbnRzIGFyZSB2aXJ1cy1mcmVlLCBpdCBpcyB0aGUgcmVj aXBpZW50J3Mgc29sZSByZXNwb25zaWJpbGl0eSB0byBzY2FuIGFsbCBhdHRhY2htZW50cyBmb3Ig dmlydXNlcy4gQWxsIGNhbGxzIGFuZCBlbWFpbHMgdG8gYW5kIGZyb20gdGhpcyBjb21wYW55IG1h eSBiZSBtb25pdG9yZWQgYW5kIHJlY29yZGVkIGZvciBsZWdpdGltYXRlIHB1cnBvc2VzIHJlbGF0 aW5nIHRvIHRoaXMgY29tcGFueSdzIGJ1c2luZXNzLiBBbnkNCiBvcGluaW9ucyBleHByZXNzZWQg aW4gdGhpcyBlbWFpbCAob3IgaW4gYW55IGF0dGFjaG1lbnRzKSBhcmUgdGhvc2Ugb2YgdGhlIGF1 dGhvciBhbmQgZG8gbm90IG5lY2Vzc2FyaWx5IHJlcHJlc2VudCB0aGUgb3BpbmlvbnMgb2YgTW9t ZW50dW0gRmluYW5jaWFsIFRlY2hub2xvZ3kgTHRkIG9yIG9mIGFueSBvdGhlciBncm91cCBjb21w YW55Ljwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzE2MkI0OCI+PG86cD48L286cD48L3NwYW4+ PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9k aXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXzxicj4NClVuYmVhcmFibGUg bWFpbGluZyBsaXN0PGJyPg0KPGEgaHJlZj0ibWFpbHRvOlVuYmVhcmFibGVAaWV0Zi5vcmciIHRh cmdldD0iX2JsYW5rIj5VbmJlYXJhYmxlQGlldGYub3JnPC9hPjxicj4NCjxhIGhyZWY9Imh0dHBz Oi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vdW5iZWFyYWJsZSIgdGFyZ2V0PSJfYmxh bmsiPmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vdW5iZWFyYWJsZTwvYT48 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4N CjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGJyPg0KPGJyIGNs ZWFyPSJhbGwiPg0KPG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPi0tIDxv OnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0K PGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9y OiNEQzI5MUUiPkRhdmUgVG9uZ2U8bzpwPjwvbzpwPjwvc3Bhbj48L2I+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtm b250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxNjJCNDgiPkNU TzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwm cXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMTYyQjQ4Ij48aW1nIGJvcmRlcj0iMCIgd2lkdGg9IjE1 MCIgaGVpZ2h0PSIzNyIgaWQ9Il94MDAwMF9pMTAyNiIgc3JjPSJodHRwOi8vd3d3Lm1vbWVudHVt ZmluYW5jaWFsdGVjaG5vbG9neS5jb20vd3AtY29udGVudC90aGVtZXMvcm9vdHMvYXNzZXRzL2lt Zy9tZnQtbG9nby1lbWFpbC5wbmciPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMTYyQjQ4Ij4xMCBU ZW1wbGUgQmFjayB8IEJyaXN0b2wgfCBCUzEgNkZMPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiNE QzI5MUUiPnQ6Jm5ic3A7PC9zcGFuPjwvYj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzE2MkI0OCI+PGEg aHJlZj0idGVsOiUyQjQ0JTIwJTI4MCUyOTExNyUyMDI4MCUyMDUxMjAiIHRhcmdldD0iX2JsYW5r Ij4mIzQzOzQ0ICgwKTExNw0KIDI4MCA1MTIwPC9hPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6OC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjoj REMyOTFFIj5tOiZuYnNwOzwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo4LjBwdDtm b250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxNjJCNDgiPjxh IGhyZWY9InRlbDolMkI0NCUyMCUyODAlMjk3NTc3JTIwODE1NTcwIiB0YXJnZXQ9Il9ibGFuayI+ JiM0Mzs0NCAoMCk3NTc3DQogODE1NTcwPC9hPjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzE2 MkI0OCI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtB cmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxNjJCNDgiPiZuYnNwOzxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90Oyxz YW5zLXNlcmlmO2NvbG9yOiMxNjJCNDgiPk1vbWVudHVtIEZpbmFuY2lhbCBUZWNobm9sb2d5IEx0 ZCBpcyBhdXRob3Jpc2VkIGFuZCByZWd1bGF0ZWQgYnkgdGhlIEZpbmFuY2lhbCBDb25kdWN0IEF1 dGhvcml0eSAoUmVnaXN0ZXIgbnVtYmVyJm5ic3A7PC9zcGFuPjxiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xv cjojREMyOTFFIj41NjE1Mzg8L3NwYW4+PC9iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMTYyQjQ4Ij4p Lg0KIFJlZ2lzdGVyZWQgaW4gRW5nbGFuZCAmYW1wOyBXYWxlcywgY29tcGFueSByZWdpc3RyYXRp b24gbnVtYmVyJm5ic3A7PC9zcGFuPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojREMyOTFFIj4wNjkw OTc3Mjwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTom cXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxNjJCNDgiPi4mbmJzcDs8L3NwYW4+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90 OyxzYW5zLXNlcmlmO2NvbG9yOiM4ODg4ODgiPkRJU0NMQUlNRVI6DQogVGhpcyBlbWFpbCAoaW5j bHVkaW5nIGFueSBhdHRhY2htZW50cykgaXMgc3ViamVjdCB0byBjb3B5cmlnaHQsIGFuZCB0aGUg aW5mb3JtYXRpb24gaW4gaXQgaXMgY29uZmlkZW50aWFsLiBVc2Ugb2YgdGhpcyBlbWFpbCBvciBv ZiBhbnkgaW5mb3JtYXRpb24gaW4gaXQgb3RoZXIgdGhhbiBieSB0aGUgYWRkcmVzc2VlIGlzIHVu YXV0aG9yaXNlZCBhbmQgdW5sYXdmdWwuIFdoaWxzdCByZWFzb25hYmxlIGVmZm9ydHMgYXJlIG1h ZGUgdG8gZW5zdXJlDQogdGhhdCBhbnkgYXR0YWNobWVudHMgYXJlIHZpcnVzLWZyZWUsIGl0IGlz IHRoZSByZWNpcGllbnQncyBzb2xlIHJlc3BvbnNpYmlsaXR5IHRvIHNjYW4gYWxsIGF0dGFjaG1l bnRzIGZvciB2aXJ1c2VzLiBBbGwgY2FsbHMgYW5kIGVtYWlscyB0byBhbmQgZnJvbSB0aGlzIGNv bXBhbnkgbWF5IGJlIG1vbml0b3JlZCBhbmQgcmVjb3JkZWQgZm9yIGxlZ2l0aW1hdGUgcHVycG9z ZXMgcmVsYXRpbmcgdG8gdGhpcyBjb21wYW55J3MgYnVzaW5lc3MuIEFueQ0KIG9waW5pb25zIGV4 cHJlc3NlZCBpbiB0aGlzIGVtYWlsIChvciBpbiBhbnkgYXR0YWNobWVudHMpIGFyZSB0aG9zZSBv ZiB0aGUgYXV0aG9yIGFuZCBkbyBub3QgbmVjZXNzYXJpbHkgcmVwcmVzZW50IHRoZSBvcGluaW9u cyBvZiBNb21lbnR1bSBGaW5hbmNpYWwgVGVjaG5vbG9neSBMdGQgb3Igb2YgYW55IG90aGVyIGdy b3VwIGNvbXBhbnkuPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMTYyQjQ4Ij48bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9k aXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtYXJnaW4tYm90dG9tOjEyLjBwdCI+PGJyPg0KX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX188YnI+DQpVbmJlYXJhYmxlIG1haWxpbmcgbGlzdDxi cj4NCjxhIGhyZWY9Im1haWx0bzpVbmJlYXJhYmxlQGlldGYub3JnIj5VbmJlYXJhYmxlQGlldGYu b3JnPC9hPjxicj4NCjxhIGhyZWY9Imh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGlu Zm8vdW5iZWFyYWJsZSIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxt YW4vbGlzdGluZm8vdW5iZWFyYWJsZTwvYT48bzpwPjwvbzpwPjwvcD4NCjwvYmxvY2txdW90ZT4N CjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rp dj4NCjwvZGl2Pg0KPC9ib2R5Pg0KPC9odG1sPg0K --_000_BN3PR03MB14450B3302E670E17B54C0638C2B0BN3PR03MB1445namp_-- --_004_BN3PR03MB14450B3302E670E17B54C0638C2B0BN3PR03MB1445namp_ Content-Type: message/rfc822 Content-Disposition: attachment; creation-date="Tue, 21 Jun 2016 21:13:56 GMT"; modification-date="Tue, 21 Jun 2016 21:13:56 GMT" Received: from BY1PR03MB1401.namprd03.prod.outlook.com (10.162.127.143) by BLUPR03MB1396.namprd03.prod.outlook.com (10.163.81.142) with Microsoft SMTP Server (TLS) id 15.1.396.15 via Mailbox Transport; Fri, 5 Feb 2016 01:30:33 +0000 Received: from CH1PR03CA008.namprd03.prod.outlook.com (10.255.156.153) by BY1PR03MB1401.namprd03.prod.outlook.com (10.162.127.143) with Microsoft SMTP Server (TLS) id 15.1.396.15; Fri, 5 Feb 2016 01:30:32 +0000 Received: from BL2FFO11FD037.protection.gbl (10.255.156.132) by CH1PR03CA008.outlook.office365.com (10.255.156.153) with Microsoft SMTP Server (TLS) id 15.1.403.16 via Frontend Transport; Fri, 5 Feb 2016 01:30:32 +0000 Received: from mail.ietf.org (4.31.198.44) by BL2FFO11FD037.mail.protection.outlook.com (10.173.161.133) with Microsoft SMTP Server (TLS) id 15.1.409.7 via Frontend Transport; Fri, 5 Feb 2016 01:30:32 +0000 Received: by ietfa.amsl.com (Postfix, from userid 65534) id 48FB01B2C2E; Thu, 4 Feb 2016 17:30:31 -0800 (PST) Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2EE721B2C2B for ; Thu, 4 Feb 2016 17:30:31 -0800 (PST) Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zQlWxZB1KKZj for ; Thu, 4 Feb 2016 17:30:29 -0800 (PST) Received: from smtp01.icann.org (smtp01.icann.org [192.0.46.81]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B9D2C1B2C1D for ; Thu, 4 Feb 2016 17:30:29 -0800 (PST) Received: from request3.lax.icann.org (request1.lax.icann.org [10.32.11.221]) by smtp01.icann.org (8.13.8/8.13.8) with ESMTP id u151UP3g009487; Fri, 5 Feb 2016 01:30:25 GMT Received: by request3.lax.icann.org (Postfix, from userid 48) id 10D69C20295; Fri, 5 Feb 2016 01:30:25 +0000 (UTC) From: Amanda Baber via RT CC: "stephen.farrell@cs.tcd.ie" , "ve7jtb@ve7jtb.com" , "draft-ietf-tokbind-negotiation.all@ietf.org" Subject: [IANA #890903] Early code point assignment requests for "Transport Layer Security (TLS) Extensions" registry (draft-ietf-tokbind-negotiation) Thread-Topic: [IANA #890903] Early code point assignment requests for "Transport Layer Security (TLS) Extensions" registry (draft-ietf-tokbind-negotiation) Thread-Index: AQHRX7TOCR6lijagXUSzYmIPPzDP2g== Date: Fri, 5 Feb 2016 01:30:25 +0000 Message-ID: References: In-Reply-To: Reply-To: "iana-prot-param-comment@iana.org" Content-Language: en-US X-MS-Exchange-Organization-AuthSource: BL2FFO11FD037.protection.gbl X-MS-Has-Attach: X-Auto-Response-Suppress: All X-MS-Exchange-Organization-Network-Message-Id: 5d373707-b8d6-408f-00b9-08d32dcbf04f X-MS-TNEF-Correlator: received-spf: SoftFail (protection.outlook.com: domain of transitioning icann.org discourages use of 4.31.198.44 as permitted sender) x-spam-flag: NO Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 SGkgYWxsLA0KDQpJQU5BIGhhcyBtYWRlIHRoZSBmb2xsb3dpbmcgZWFybHkgYWxsb2NhdGlvbiBp biB0aGUgVExTIEV4dGVuc2lvblR5cGUgVmFsdWVzIHJlZ2lzdHJ5LCBpbiBhY2NvcmRhbmNlIHdp dGggUkZDIDcxMjA6DQoNCjI0ICAgICAgdG9rZW5fYmluZGluZyAoVEVNUE9SQVJZIC0gcmVnaXN0 ZXJlZCAyMDE2LTAyLTA0LCBleHBpcmVzIDIwMTctMDItMDQpDQpbZHJhZnQtaWV0Zi10b2tiaW5k LW5lZ290aWF0aW9uXQ0KDQpXaGVuIHRoZSBJRVNHIG5vdGlmaWVzIHVzIHRoYXQgdGhleSd2ZSBh cHByb3ZlZCB0aGUgZG9jdW1lbnQgZm9yIHB1YmxpY2F0aW9uLCB3ZSdsbCB1cGRhdGUgdGhlIHJl ZmVyZW5jZSBhbmQgcmVtb3ZlIHRoZSAidGVtcG9yYXJ5IiBub3RlLiBJZiB0aGUgZG9jdW1lbnQg aGFzbid0IGJlZW4gYXBwcm92ZWQgd2l0aGluIHJvdWdobHkgNjAgZGF5cyBvZiB0aGUgZXhwaXJh dGlvbiBkYXRlLCB3ZSdsbCBhc2sgeW91IHdoZXRoZXIgeW91IHdhbnQgdG8gcmVuZXcgdGhlIGFs bG9jYXRpb24gZm9yIG9uZSBtb3JlIHllYXIuIChFYXJseSBhbGxvY2F0aW9ucyBjYW4gYmUgcmVu ZXdlZCBvbmx5IG9uY2UuKQ0KDQpCZXN0IHJlZ2FyZHMsDQoNCkFtYW5kYSBCYWJlcg0KSUFOQSBT ZW5pb3IgU3BlY2lhbGlzdA0KSUNBTk4NCg0KT24gVHVlIEZlYiAwMiAyMzo1MDo1MCAyMDE2LCB2 ZTdqdGJAdmU3anRiLmNvbSB3cm90ZToNCj4NCj4gVGhlIFRva2JpbmQgV0cgd291bGQgbGlrZSB0 byBhc2sgZm9yIGFuIGVhcmx5IGFsbG9jYXRpb24gb2YgYW4gSUFOQQ0KPiBjb2RlIHBvaW50IGZv ciB0aGUgIlRMUyBFeHRlbnNpb24gZm9yIFRva2VuIEJpbmRpbmcgUHJvdG9jb2wNCj4gTmVnb3Rp YXRpb24iIChodHRwczovL25hMDEuc2FmZWxpbmtzLnByb3RlY3Rpb24ub3V0bG9vay5jb20vP3Vy bD1odHRwcyUzYSUyZiUyZnRvb2xzLmlldGYub3JnJTJmaHRtbCUyZmRyYWZ0LWlldGYtdG9rYmlu ZC0mZGF0YT0wMSU3YzAxJTdjQW5kcmVpLlBvcG92JTQwbWljcm9zb2Z0LmNvbSU3YzVkMzczNzA3 YjhkNjQwOGYwMGI5MDhkMzJkY2JmMDRmJTdjNzJmOTg4YmY4NmYxNDFhZjkxYWIyZDdjZDAxMWRi NDclN2MxJnNkYXRhPUhrWUxqciUyYnBaYnRzJTJmZFJLY1hTZU0xV2RPNzRUc1JaTUE0YkwyV0JZ bFo4JTNkDQo+IG5lZ290aWF0aW9uLTAyIDxodHRwczovL25hMDEuc2FmZWxpbmtzLnByb3RlY3Rp b24ub3V0bG9vay5jb20vP3VybD1odHRwcyUzYSUyZiUyZnRvb2xzLmlldGYub3JnJTJmaHRtbCUy ZmRyYWZ0LWlldGYtdG9rYmluZC0mZGF0YT0wMSU3YzAxJTdjQW5kcmVpLlBvcG92JTQwbWljcm9z b2Z0LmNvbSU3YzVkMzczNzA3YjhkNjQwOGYwMGI5MDhkMzJkY2JmMDRmJTdjNzJmOTg4YmY4NmYx NDFhZjkxYWIyZDdjZDAxMWRiNDclN2MxJnNkYXRhPUhrWUxqciUyYnBaYnRzJTJmZFJLY1hTZU0x V2RPNzRUc1JaTUE0YkwyV0JZbFo4JTNkDQo+IG5lZ290aWF0aW9uLTAyPikuIFRoaXMgZG9jdW1l bnQgZGVmaW5lcyBhIG5ldyBUTFMgZXh0ZW5zaW9uDQo+ICJ0b2tlbl9iaW5kaW5nIiwgd2hpY2gg bmVlZHMgdG8gYmUgYWRkZWQgdG8gdGhlIElBTkEgIlRyYW5zcG9ydCBMYXllcg0KPiBTZWN1cml0 eSAoVExTKSBFeHRlbnNpb25zIiByZWdpc3RyeS4NCj4NCj4gUGxlYXNlIG5vdGUgdGhhdCB0aGlz IGRvY3VtZW50IGFsc28gc2Vla3MgdG8gZXN0YWJsaXNoIGEgcmVnaXN0cnkgZm9yDQo+IGlkZW50 aWZpZXJzIG9mIFRva2VuIEJpbmRpbmcga2V5IHBhcmFtZXRlcnMgZW50aXRsZWQgIlRva2VuIEJp bmRpbmcNCj4gS2V5IFBhcmFtZXRlcnMiIHVuZGVyIHRoZSAiVG9rZW4gQmluZGluZyBQcm90b2Nv bCIgaGVhZGluZy4gVGhpcyBuZXcNCj4gcmVnaXN0cnkgaXMgbm90IHBhcnQgb2YgdGhlIGVhcmx5 IGFzc2lnbm1lbnQgcmVxdWVzdC4NCj4NCj4gQXQgdGhpcyBwb2ludCwgYXV0aG9ycyBkbyBub3Qg ZXhwZWN0IG1ham9yIGNoYW5nZXMgaW4gdGhlICJUTFMNCj4gRXh0ZW5zaW9uIGZvciBUb2tlbiBC aW5kaW5nIFByb3RvY29sIE5lZ290aWF0aW9uIiBzcGVjaWZpY2F0aW9uLiBUaGVyZQ0KPiBhcmUg YXQgbGVhc3QgdHdvIHByb3RvdHlwZSBpbXBsZW1lbnRhdGlvbnMgb2YgdGhpcyBzcGVjaWZpY2F0 aW9uIGJlaW5nDQo+IHdvcmtlZCBvbiAoYnkgR29vZ2xlIGFuZCBNaWNyb3NvZnQpLiBBbiBlYXJs eSBJQU5BIGNvZGUgcG9pbnQNCj4gYXNzaWdubWVudCB3b3VsZCBmYWNpbGl0YXRlIGltcGxlbWVu dGF0aW9uIGFuZCBkZXBsb3ltZW50IGV4cGVyaWVuY2UNCj4gcHJpb3IgdG8gdGhlIHB1YmxpY2F0 aW9uIG9mIHRoZSBSRkMuDQo+DQo+IFJlZ2FyZHMNCj4gSm9obiBCcmFkbGV5DQoNCg0KDQo= --_004_BN3PR03MB14450B3302E670E17B54C0638C2B0BN3PR03MB1445namp_-- From nobody Tue Jun 21 14:22:27 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0793612DE18 for ; Tue, 21 Jun 2016 14:22:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.711 X-Spam-Level: X-Spam-Status: No, score=-0.711 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=1.989, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=pingidentity.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id I1AtPI17yfD4 for ; Tue, 21 Jun 2016 14:22:22 -0700 (PDT) Received: from mail-it0-x232.google.com (mail-it0-x232.google.com [IPv6:2607:f8b0:4001:c0b::232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 810E612D7B2 for ; Tue, 21 Jun 2016 14:22:22 -0700 (PDT) Received: by mail-it0-x232.google.com with SMTP id g127so29196915ith.0 for ; Tue, 21 Jun 2016 14:22:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=pingidentity.com; s=gmail; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=VLtk1WuPEa6yh1/mbv1bTm4jyxvIA3J/B/yanu8baKI=; b=Pm4HMo/Asimpmjf28eo4Jlb9fJ4jW7w+/cGPzr5EezRqUmHCs32+ofThjKRxNDQwqg RT6DldhfNMMBN7p4gxOPyimEL7IxT0mDw4kYbIB84FLEHtPt+6Dtgvd02fKU0aeYzgY1 UG3nDnB06oGqtTZ3KVJHRpvbAXAvWb9ZZ0BQI= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=VLtk1WuPEa6yh1/mbv1bTm4jyxvIA3J/B/yanu8baKI=; b=g7iRalD6Murcg4fROSe9lg6kuPZ7N2vAkloMXHPkvev75N1B60U9gEcDIqnSXoCfNG 8emQNfC8JhY+EvPxPtN1w/Y+PPsGPbRj4T2Q2qaDK+sVcxgp8ThFvao+dsSahBNuW/DD cplF5SY1ykYYLyOHKL8CTXkC5Os9VqhUwTNXvTUzAZ69Mi4qodq960oltqB4f4aO6Qrj xodndsayZPF0Ia27qeBIRQ+qZEI/ZOZydJr94FfHvCdPlIeYEq34JobNrGAVnRJDtBAm lHufzYOxZ6I/xPf1EtM9FDHr0Vf16t0uCc0hQsMNd/3k7GqUPLYWLEpNOt48kqWu79v4 sqyA== X-Gm-Message-State: ALyK8tJ0Pu//sFUXqBJYCPf+DnoZ+O45e0TAW+xv3pIck1rNJxC3GQGIupy3KoCZI5GX22A+UGCW7+WzVWglQBTb X-Received: by 10.36.4.23 with SMTP id 23mr9479715itb.11.1466544141588; Tue, 21 Jun 2016 14:22:21 -0700 (PDT) MIME-Version: 1.0 Received: by 10.79.124.155 with HTTP; Tue, 21 Jun 2016 14:21:52 -0700 (PDT) In-Reply-To: References: From: Brian Campbell Date: Tue, 21 Jun 2016 15:21:52 -0600 Message-ID: To: Andrei Popov Content-Type: multipart/alternative; boundary=001a11c141b69b948b0535d06a54 Archived-At: Cc: Dave Tonge , John Bradley , IETF Tokbind WG , Bill Cox Subject: Re: [Unbearable] Current implementations of token binding spec? X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Jun 2016 21:22:26 -0000 --001a11c141b69b948b0535d06a54 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Excellent. Thanks Andrei. On Tue, Jun 21, 2016 at 3:13 PM, Andrei Popov wrote: > Hi Brian, > > > > Early assignment is available; please see attached. > > > > =E2=80=9C24 token_binding (TEMPORARY - registered 2016-02-04, exp= ires > 2017-02-04) > > [draft-ietf-tokbind-negotiation]=E2=80=9D > > > > Cheers, > > > > Andrei > > > > *From:* Unbearable [mailto:unbearable-bounces@ietf.org] *On Behalf Of *Br= ian > Campbell > *Sent:* Tuesday, June 21, 2016 1:48 PM > *To:* Dave Tonge > *Cc:* John Bradley ; IETF Tokbind WG < > unbearable@ietf.org>; Bill Cox > *Subject:* Re: [Unbearable] Current implementations of token binding spec= ? > > > > In the implementations that are out there now, what value is being used t= o > identify the token_binding ExtensionType? TBNEGO just has a TBD > > right now. Is there any work underway towards getting early assignment of= a > ExtensionType Value for TB? Or is that even possible? > > > > On Tue, Jun 21, 2016 at 10:13 AM, Dave Tonge > wrote: > > Thanks Bill and John > > > > Bill - looking forward to it, I'll give it a try when its released. > > John - I'll take a look at the test server in chromium. > > > > I'm keen to help push forward support, so please let me know if there is > anything else I can to do to help. > > > > Thanks > > > > Dave > > > > On 21 June 2016 at 16:35, John Bradley wrote: > > Currently if you are brave, there is a Python test server as part of the > Chromium project on Github for testing. > > https://github.com/chromium/chromium > > > > Last time I tried it you needed to checkout the whole project to get the > test server to build. > > I think they are working on making that easier. > > > > Also as part of that project there is the Cronet http/TLS lib that can be > used on iOS and Android. > > > > We are hoping to include that as an option in the AppAuth project for > token binding refresh and access tokens on mobile. > > > > https://github.com/openid > > > > We are working/lobbying to get support included in more places such as > Python and Java. > > > > I hope you can contribute to the WG and help us move this spec to a RFC > quickly by showing demand. > > > > Regards > > John B. > > > > > > On Jun 21, 2016, at 10:55 AM, Dave Tonge > wrote: > > > > Hi > > > > I'm currently working with the UK Open Banking Standard > and the OpenID Financial API WG > . > > The issue of token binding is being discussed and I wanted to try out an > actual real world implementation. > > After some research there don't seem to be many implementations in the > wild (unless I've missed something). > > > > It is supported in Chrome, but doesn't seem to be supported in OpenSSL ye= t > (and therefore not in Node.JS, Python, Ruby, etc. > > I've opened an issue on the OpenSSL repo: > https://github.com/openssl/openssl/issues/1242 > > > > Is my understanding correct? How would you recommend trying out a a live > implementation of token binding? > > > > Thanks > > > > -- > > *Dave Tonge* > > CTO > > 10 Temple Back | Bristol | BS1 6FL > > *t: *+44 (0)117 280 5120 <%2B44%20%280%29117%20280%205120> > > *m: *+44 (0)7577 815570 <%2B44%20%280%297577%20815570> > > > > Momentum Financial Technology Ltd is authorised and regulated by the > Financial Conduct Authority (Register number *561538*). Registered in > England & Wales, company registration number *06909772*. DISCLAIMER: This > email (including any attachments) is subject to copyright, and the > information in it is confidential. Use of this email or of any informatio= n > in it other than by the addressee is unauthorised and unlawful. Whilst > reasonable efforts are made to ensure that any attachments are virus-free= , > it is the recipient's sole responsibility to scan all attachments for > viruses. All calls and emails to and from this company may be monitored a= nd > recorded for legitimate purposes relating to this company's business. Any > opinions expressed in this email (or in any attachments) are those of the > author and do not necessarily represent the opinions of Momentum Financia= l > Technology Ltd or of any other group company. > > _______________________________________________ > Unbearable mailing list > Unbearable@ietf.org > https://www.ietf.org/mailman/listinfo/unbearable > > > > > > > > -- > > *Dave Tonge* > > CTO > > 10 Temple Back | Bristol | BS1 6FL > > *t: *+44 (0)117 280 5120 <%2B44%20%280%29117%20280%205120> > > *m: *+44 (0)7577 815570 <%2B44%20%280%297577%20815570> > > > > Momentum Financial Technology Ltd is authorised and regulated by the > Financial Conduct Authority (Register number *561538*). Registered in > England & Wales, company registration number *06909772*. DISCLAIMER: This > email (including any attachments) is subject to copyright, and the > information in it is confidential. Use of this email or of any informatio= n > in it other than by the addressee is unauthorised and unlawful. Whilst > reasonable efforts are made to ensure that any attachments are virus-free= , > it is the recipient's sole responsibility to scan all attachments for > viruses. All calls and emails to and from this company may be monitored a= nd > recorded for legitimate purposes relating to this company's business. Any > opinions expressed in this email (or in any attachments) are those of the > author and do not necessarily represent the opinions of Momentum Financia= l > Technology Ltd or of any other group company. > > > _______________________________________________ > Unbearable mailing list > Unbearable@ietf.org > https://www.ietf.org/mailman/listinfo/unbearable > > > > > ---------- Forwarded message ---------- > From: Amanda Baber via RT > To: > Cc: "stephen.farrell@cs.tcd.ie" , " > ve7jtb@ve7jtb.com" , " > draft-ietf-tokbind-negotiation.all@ietf.org" < > draft-ietf-tokbind-negotiation.all@ietf.org> > Date: Fri, 5 Feb 2016 01:30:25 +0000 > Subject: [IANA #890903] Early code point assignment requests for > "Transport Layer Security (TLS) Extensions" registry > (draft-ietf-tokbind-negotiation) > Hi all, > > IANA has made the following early allocation in the TLS ExtensionType > Values registry, in accordance with RFC 7120: > > 24 token_binding (TEMPORARY - registered 2016-02-04, expires > 2017-02-04) > [draft-ietf-tokbind-negotiation] > > When the IESG notifies us that they've approved the document for > publication, we'll update the reference and remove the "temporary" note. = If > the document hasn't been approved within roughly 60 days of the expiratio= n > date, we'll ask you whether you want to renew the allocation for one more > year. (Early allocations can be renewed only once.) > > Best regards, > > Amanda Baber > IANA Senior Specialist > ICANN > > On Tue Feb 02 23:50:50 2016, ve7jtb@ve7jtb.com wrote: > > > > The Tokbind WG would like to ask for an early allocation of an IANA > > code point for the "TLS Extension for Token Binding Protocol > > Negotiation" ( > https://na01.safelinks.protection.outlook.com/?url=3Dhttps%3a%2f%2ftools.= ietf.org%2fhtml%2fdraft-ietf-tokbind-&data=3D01%7c01%7cAndrei.Popov%40micro= soft.com%7c5d373707b8d6408f00b908d32dcbf04f%7c72f988bf86f141af91ab2d7cd011d= b47%7c1&sdata=3DHkYLjr%2bpZbts%2fdRKcXSeM1WdO74TsRZMA4bL2WBYlZ8%3d > > negotiation-02 < > https://na01.safelinks.protection.outlook.com/?url=3Dhttps%3a%2f%2ftools.= ietf.org%2fhtml%2fdraft-ietf-tokbind-&data=3D01%7c01%7cAndrei.Popov%40micro= soft.com%7c5d373707b8d6408f00b908d32dcbf04f%7c72f988bf86f141af91ab2d7cd011d= b47%7c1&sdata=3DHkYLjr%2bpZbts%2fdRKcXSeM1WdO74TsRZMA4bL2WBYlZ8%3d > > negotiation-02>). This document defines a new TLS extension > > "token_binding", which needs to be added to the IANA "Transport Layer > > Security (TLS) Extensions" registry. > > > > Please note that this document also seeks to establish a registry for > > identifiers of Token Binding key parameters entitled "Token Binding > > Key Parameters" under the "Token Binding Protocol" heading. This new > > registry is not part of the early assignment request. > > > > At this point, authors do not expect major changes in the "TLS > > Extension for Token Binding Protocol Negotiation" specification. There > > are at least two prototype implementations of this specification being > > worked on (by Google and Microsoft). An early IANA code point > > assignment would facilitate implementation and deployment experience > > prior to the publication of the RFC. > > > > Regards > > John Bradley > > > > > --001a11c141b69b948b0535d06a54 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Excellent. Thanks Andrei.

On Tue, Jun 21, 2016 at 3:13 PM, Andrei= Popov <Andrei.Popov@microsoft.com> wrote:

Hi Brian,

=C2=A0

Early assignment is available; please= see attached.

=C2=A0

=E2=80=9C24=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0 token_binding (TEMPORARY - registered 2016-02-04, = expires 2017-02-04)=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0

[draft-ietf-tokbind-negotiation]=E2=80=9D

=C2=A0

Cheers,

=C2=A0

Andrei

=C2=A0

From: Unbearable [mailto:unbearable-bounces@ie= tf.org] On Behalf Of Brian Campbell
Sent: Tuesday, June 21, 2016 1:48 PM
To: Dave Tonge <dave.tonge@momentumft.co.uk>
Cc: John Bradley <ve7jtb@ve7jtb.com>; IETF Tokbind WG <unbearable@ietf.org>; Bill Cox = <waywardgeek= @google.com>
Subject: Re: [Unbearable] Current implementations of token binding s= pec?

=C2=A0

In the implementations that are out there now, what = value is being used to identify the token_binding ExtensionType? TBNEGO just has a TBD right now. Is there any work underway towards get= ting early assignment of a ExtensionType Value for TB? Or is that even poss= ible?

=C2=A0

On Tue, Jun 21, 2016 at 10:13 AM, Dave Tonge <dave.tonge@mo= mentumft.co.uk> wrote:

Thanks Bill and John

=C2=A0

Bill - looking forward to it, I'll give it a try when its r= eleased.

John - I'll take a look at the test server in chromium.<= /u>

=C2=A0

I'm keen to help push forward support, so please let me kno= w if there is anything else I can to do to help.

=C2=A0

Thanks

=C2=A0

Dave

=C2=A0

On 21 June 2016 at 16:35, John Bradley <ve7jtb@ve7jtb.com> w= rote:

Currently if you are brave, there is a Python test s= erver as part of the Chromium project on Github for testing.<= /p>

=C2=A0

Last time I tried it you needed to checkout the whol= e project to get the test server to build. =C2=A0

I think they are working on making that easier.=C2= =A0

=C2=A0

Also as part of that project there is the Cronet htt= p/TLS lib that can be used on iOS and Android.

=C2=A0

We are hoping to include that as an option in the Ap= pAuth project for token binding refresh and access tokens on mobile.=

=C2=A0

https://github.com/openid

=C2=A0

We are working/lobbying to get support included in m= ore places such as Python and Java.

=C2=A0

I hope you can contribute to the WG and help us move= this spec to a RFC quickly by showing demand.

=C2=A0

Regards

John B.

=C2=A0

=C2=A0

On Jun 21, 2016, at 10:55 AM, Dave Tonge <dave.tonge@moment= umft.co.uk> wrote:

=C2=A0

Hi

=C2=A0

I'm currently working with the UK Ope= n Banking Standard and the OpenID= Financial API WG.=C2=A0

The issue of token binding is being discussed and I wanted to t= ry out an actual real world implementation.=C2=A0

After some research there don't seem to be many implementat= ions in the wild (unless I've missed something).

=C2=A0

It is supported in Chrome, but doesn't seem to be supported= in OpenSSL yet (and therefore not in Node.JS, Python, Ruby, etc.=

I've opened an issue on the OpenSSL repo: https://github.com/openssl/openssl/issues/1242

=C2=A0

Is my understanding correct? How would you recommend trying out= a a live implementation of token binding?

=C2=A0

Thanks

=C2=A0

--

Dave Tonge<= /p>

CTO

10 Temple Back | Bristol | BS1 6FL

=C2=A0

Momentum Financial Technology Ltd is aut= horised and regulated by the Financial Conduct Authority (Register number= =C2=A0561538). Registered in England & Wales, company registration number=C2=A006909772.=C2=A0DI= SCLAIMER: This email (including any attachments) is subject to copyright, and the in= formation in it is confidential. Use of this email or of any information in= it other than by the addressee is unauthorised and unlawful. Whilst reason= able efforts are made to ensure that any attachments are virus-free, it is the recipient's sole respon= sibility to scan all attachments for viruses. All calls and emails to and f= rom this company may be monitored and recorded for legitimate purposes rela= ting to this company's business. Any opinions expressed in this email (or in any attachments) are those of the = author and do not necessarily represent the opinions of Momentum Financial = Technology Ltd or of any other group company.<= /u>

_______________________________________________
Unbearable mailing list
Unbearable@ietf.or= g
https://www.ietf.org/mailman/listinfo/unbearable

=C2=A0



=C2=A0

--

Dave Tonge<= /p>

CTO

10 Temple Back | Bristol | BS1 6FL

=C2=A0

Momentum Financial Technology Ltd is aut= horised and regulated by the Financial Conduct Authority (Register number= =C2=A0561538). Registered in England & Wales, company registration number=C2=A006909772.=C2=A0DI= SCLAIMER: This email (including any attachments) is subject to copyright, and the in= formation in it is confidential. Use of this email or of any information in= it other than by the addressee is unauthorised and unlawful. Whilst reason= able efforts are made to ensure that any attachments are virus-free, it is the recipient's sole respon= sibility to scan all attachments for viruses. All calls and emails to and f= rom this company may be monitored and recorded for legitimate purposes rela= ting to this company's business. Any opinions expressed in this email (or in any attachments) are those of the = author and do not necessarily represent the opinions of Momentum Financial = Technology Ltd or of any other group company.<= /u>


_______________________________________________
Unbearable mailing list
Unbearable@ietf.or= g
https://www.ietf.org/mailman/listinfo/unbearable

=C2=A0



---------- Forwarded message ----------
From:=C2=A0Amanda Baber = via RT <iana-prot-pa= ram-comment@iana.org>
To:=C2=A0
Cc:=C2=A0"stephen.farrell@cs.tcd.ie" <stephen.farrell@cs.tcd.ie>, = "ve7jtb@ve7jtb.com" <= ve7jtb@ve7jtb.com>, "draft-ietf-tokbin= d-negotiation.all@ietf.org" <draft-ietf-tokbind-negotiation.all@ietf.org>
Date:=C2=A0Fri, 5 Feb 2016 01:30:25 +0000
Subject:=C2=A0[IANA #= 890903] Early code point assignment requests for "Transport Layer Secu= rity (TLS) Extensions" registry (draft-ietf-tokbind-negotiation)
Hi= all,

IANA has made the following early allocation in the TLS ExtensionType Value= s registry, in accordance with RFC 7120:

24=C2=A0 =C2=A0 =C2=A0 token_binding (TEMPORARY - registered 2016-02-04, ex= pires 2017-02-04)
[draft-ietf-tokbind-negotiation]

When the IESG notifies us that they've approved the document for public= ation, we'll update the reference and remove the "temporary" = note. If the document hasn't been approved within roughly 60 days of th= e expiration date, we'll ask you whether you want to renew the allocati= on for one more year. (Early allocations can be renewed only once.)

Best regards,

Amanda Baber
IANA Senior Specialist
ICANN

On Tue Feb 02 23:50:50 2016, ve7jtb@ve= 7jtb.com wrote:
>
> The Tokbind WG would like to ask for an early allocation of an IANA > code point for the "TLS Extension for Token Binding Protocol
> Negotiation" (http= s://na01.safelinks.protection.outlook.com/?url=3Dhttps%3a%2f%2ftools.ietf.o= rg%2fhtml%2fdraft-ietf-tokbind-&data=3D01%7c01%7cAndrei.Popov%40microso= ft.com%7c5d373707b8d6408f00b908d32dcbf04f%7c72f988bf86f141af91ab2d7cd011db4= 7%7c1&sdata=3DHkYLjr%2bpZbts%2fdRKcXSeM1WdO74TsRZMA4bL2WBYlZ8%3d > negotiation-02 <http= s://na01.safelinks.protection.outlook.com/?url=3Dhttps%3a%2f%2ftools.ietf.o= rg%2fhtml%2fdraft-ietf-tokbind-&data=3D01%7c01%7cAndrei.Popov%40microso= ft.com%7c5d373707b8d6408f00b908d32dcbf04f%7c72f988bf86f141af91ab2d7cd011db4= 7%7c1&sdata=3DHkYLjr%2bpZbts%2fdRKcXSeM1WdO74TsRZMA4bL2WBYlZ8%3d > negotiation-02>). This document defines a new TLS extension
> "token_binding", which needs to be added to the IANA "T= ransport Layer
> Security (TLS) Extensions" registry.
>
> Please note that this document also seeks to establish a registry for<= br> > identifiers of Token Binding key parameters entitled "Token Bindi= ng
> Key Parameters" under the "Token Binding Protocol" head= ing. This new
> registry is not part of the early assignment request.
>
> At this point, authors do not expect major changes in the "TLS > Extension for Token Binding Protocol Negotiation" specification. = There
> are at least two prototype implementations of this specification being=
> worked on (by Google and Microsoft). An early IANA code point
> assignment would facilitate implementation and deployment experience > prior to the publication of the RFC.
>
> Regards
> John Bradley





--001a11c141b69b948b0535d06a54-- From nobody Fri Jun 24 09:09:41 2016 Return-Path: X-Original-To: unbearable@ietf.org Delivered-To: unbearable@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id B342B12DD3F; Fri, 24 Jun 2016 09:01:00 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: "\"IETF Secretariat\"" To: , X-Test-IDTracker: no X-IETF-IDTracker: 6.24.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <20160624160100.10933.66680.idtracker@ietfa.amsl.com> Date: Fri, 24 Jun 2016 09:01:00 -0700 Archived-At: Cc: unbearable@ietf.org, stephen.farrell@cs.tcd.ie Subject: [Unbearable] tokbind - Requested session has been scheduled for IETF 96 X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Jun 2016 16:01:01 -0000 Dear Leif Johansson, The session(s) that you have requested have been scheduled. Below is the scheduled session information followed by the original request. tokbind Session 1 (2:00:00) Tuesday, Afternoon Session I 1400-1600 Room Name: Bellevue size: 200 --------------------------------------------- Request Information: --------------------------------------------------------- Working Group Name: Token Binding Area Name: Security Area Session Requester: Leif Johansson Number of Sessions: 1 Length of Session(s): 2 Hours Number of Attendees: 75 Conflicts to Avoid: First Priority: httpbis oauth jose Special Requests: Avoid entire SEC area --------------------------------------------------------- From nobody Fri Jun 24 14:50:29 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D261212DCC9 for ; Wed, 22 Jun 2016 14:57:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.909 X-Spam-Level: X-Spam-Status: No, score=-5.909 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_16=1.092, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DPqJHdCQ2CNW for ; Wed, 22 Jun 2016 14:57:21 -0700 (PDT) Received: from github-smtp2a-ext-cp1-prd.iad.github.net (github-smtp2-ext5.iad.github.net [192.30.252.196]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3614612DCB0 for ; Wed, 22 Jun 2016 14:57:20 -0700 (PDT) Date: Wed, 22 Jun 2016 14:57:18 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1466632638; bh=oKSpS5SpXDzPioTYzQMmhnR5Az1U5TEZia2yHubXOKA=; h=From:Reply-To:To:Cc:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=D83CRRxTpQARAcFmTW6ufV60EdNJlf9NlMTUpu9b9L2Rs/OSewbWPrjXRSqjCXtl3 RZW8aaFmMOklML7mQtfYxHb16+tBd2TF+LVFEZ4x2bIu+nxqfVO1DG7t8AWtSXnLra 4iYln/VdEMd0tsa48haKntn73mb3+yAB8NOpEb+A= From: Andrei-Popov To: TokenBinding/Internet-Drafts Message-ID: In-Reply-To: References: Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_576b09be8e085_39303fbabfacd2bc19075"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list X-GitHub-Sender: Andrei-Popov X-GitHub-Recipient: unbearable-ML X-Auto-Response-Suppress: All X-GitHub-Recipient-Address: unbearable@ietf.org Archived-At: X-Mailman-Approved-At: Fri, 24 Jun 2016 14:50:25 -0700 Subject: Re: [Unbearable] [TokenBinding/Internet-Drafts] added spec name acronyms (#37) X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Reply-To: TokenBinding/Internet-Drafts List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Jun 2016 21:57:23 -0000 ----==_mimepart_576b09be8e085_39303fbabfacd2bc19075 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Merged #37. --- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/TokenBinding/Internet-Drafts/pull/37#event-701150386 ----==_mimepart_576b09be8e085_39303fbabfacd2bc19075 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

Merged #37.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_576b09be8e085_39303fbabfacd2bc19075-- From nobody Fri Jun 24 14:50:32 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7B21312DA38 for ; Wed, 22 Jun 2016 16:52:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.928 X-Spam-Level: X-Spam-Status: No, score=-5.928 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_16=1.092, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id X9gvxiesbe-J for ; Wed, 22 Jun 2016 16:52:11 -0700 (PDT) Received: from github-smtp2b-ext-cp1-prd.iad.github.net (github-smtp2-ext3.iad.github.net [192.30.252.194]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EAFEC12D7AC for ; Wed, 22 Jun 2016 16:52:10 -0700 (PDT) Date: Wed, 22 Jun 2016 16:52:10 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1466639530; bh=KyBjjnsILYQ9SsZjRiKHCp+YKo6dYCKuilkl3jpI+HI=; h=From:Reply-To:To:Cc:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=cIwJlv6kwNy6wi+0buQ34KD1y0GqwBPfntXiSztM5IweHoDYCXFJNb8QDSQ85sduM SMJU/7xeSujO8zLR6QgD5ZkOH4Y3MXJ5uLOvnMpC5Qg4vJcCOUuC9pAjgwBEnMDvj+ ifarUMDihmwFTBy8ScsF2KsX4jncxQWL/a6+Z4rA= From: Andrei-Popov To: TokenBinding/Internet-Drafts Message-ID: In-Reply-To: References: Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_576b24aa13bf2_6723f85760d72b8573052"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list X-GitHub-Sender: Andrei-Popov X-GitHub-Recipient: unbearable-ML X-Auto-Response-Suppress: All X-GitHub-Recipient-Address: unbearable@ietf.org Archived-At: X-Mailman-Approved-At: Fri, 24 Jun 2016 14:50:25 -0700 Subject: Re: [Unbearable] [TokenBinding/Internet-Drafts] HTTPSTB: Add Acknowledgements (#36) X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Reply-To: TokenBinding/Internet-Drafts List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Jun 2016 23:52:12 -0000 ----==_mimepart_576b24aa13bf2_6723f85760d72b8573052 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Closed #36. --- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/TokenBinding/Internet-Drafts/issues/36#event-701242174 ----==_mimepart_576b24aa13bf2_6723f85760d72b8573052 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

Closed #36.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_576b24aa13bf2_6723f85760d72b8573052-- From nobody Fri Jun 24 14:50:36 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CFE1C12DA38 for ; Wed, 22 Jun 2016 16:52:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.908 X-Spam-Level: X-Spam-Status: No, score=-5.908 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_16=1.092, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8FJXHqH9qBnD for ; Wed, 22 Jun 2016 16:52:42 -0700 (PDT) Received: from github-smtp2a-ext-cp1-prd.iad.github.net (github-smtp2-ext7.iad.github.net [192.30.252.198]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5113012D7AC for ; Wed, 22 Jun 2016 16:52:42 -0700 (PDT) Date: Wed, 22 Jun 2016 16:52:41 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1466639561; bh=dd9YOVPFzMCxYV7s+HahXaipk6EK6b4hYGe5qRdx/Sk=; h=From:Reply-To:To:Cc:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=IxLyFyYj8iyBSBgf2LC2VgE9j9sSlRrw2bukWzSG1yoYvc8g9BkX+wOCLxCC6F2la +mB0JnZ0OEfvdCImoOWDjL+LPkJCtnBAVRDY1gJ+kRfGnfwwM7EvUNsdEudVkeqVuu HrX8AtW66MqeAuTWM3hrC++ENYG2lK0aA2R6evos= From: Andrei-Popov To: TokenBinding/Internet-Drafts Message-ID: In-Reply-To: References: Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_576b24c9a0a41_77593febac2352bc5751cd"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list X-GitHub-Sender: Andrei-Popov X-GitHub-Recipient: unbearable-ML X-Auto-Response-Suppress: All X-GitHub-Recipient-Address: unbearable@ietf.org Archived-At: X-Mailman-Approved-At: Fri, 24 Jun 2016 14:50:25 -0700 Subject: Re: [Unbearable] [TokenBinding/Internet-Drafts] HTTPSTB: make it URL-safe base64 (#27) X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Reply-To: TokenBinding/Internet-Drafts List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Jun 2016 23:52:44 -0000 ----==_mimepart_576b24c9a0a41_77593febac2352bc5751cd Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Closed #27. --- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/TokenBinding/Internet-Drafts/issues/27#event-701242499 ----==_mimepart_576b24c9a0a41_77593febac2352bc5751cd Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

Closed #27.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_576b24c9a0a41_77593febac2352bc5751cd-- From nobody Fri Jun 24 14:50:39 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1194E12D796 for ; Thu, 23 Jun 2016 13:43:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.928 X-Spam-Level: X-Spam-Status: No, score=-5.928 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_16=1.092, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sg3xCHnYydXc for ; Thu, 23 Jun 2016 13:43:55 -0700 (PDT) Received: from github-smtp2b-ext-cp1-prd.iad.github.net (github-smtp2-ext3.iad.github.net [192.30.252.194]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 72C2D12D794 for ; Thu, 23 Jun 2016 13:43:54 -0700 (PDT) Date: Thu, 23 Jun 2016 13:43:51 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1466714631; bh=DIfZwgVOYfUl9IgQ7gSzze+2hUF4DKlQsREVdUSp2/o=; h=From:Reply-To:To:Cc:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=O8BpUzdkEP4eDnj7Lb55oaFu81w7a5OFTB7LOaosLXZce3mzTYRirlQvz7B1n3CDL TOvaJI35Ytc9sH/zXCHJQ0cqrMeTAOkdIozMjrVp/KkpfS1/z5g5rur43qN22nuJTP q+AVcOIfD3+l3x0lLrk280nIXeNJxzTzaZF+4GHk= From: Andrei-Popov To: TokenBinding/Internet-Drafts Message-ID: In-Reply-To: References: Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_576c4a07a3b3c_7ab03fbea51052b8381015"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list X-GitHub-Sender: Andrei-Popov X-GitHub-Recipient: unbearable-ML X-Auto-Response-Suppress: All X-GitHub-Recipient-Address: unbearable@ietf.org Archived-At: X-Mailman-Approved-At: Fri, 24 Jun 2016 14:50:25 -0700 Subject: Re: [Unbearable] [TokenBinding/Internet-Drafts] SignatureAndHashAlgorithm no longer exists (#31) X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Reply-To: TokenBinding/Internet-Drafts List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Jun 2016 20:43:57 -0000 ----==_mimepart_576c4a07a3b3c_7ab03fbea51052b8381015 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Closed #31. --- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/TokenBinding/Internet-Drafts/pull/31#event-702449074 ----==_mimepart_576c4a07a3b3c_7ab03fbea51052b8381015 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

Closed #31.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_576c4a07a3b3c_7ab03fbea51052b8381015-- From nobody Fri Jun 24 14:50:44 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D3D6712D7D8 for ; Thu, 23 Jun 2016 13:44:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.961 X-Spam-Level: X-Spam-Status: No, score=-4.961 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_12=2.059, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hc2s-VsFN0Zq for ; Thu, 23 Jun 2016 13:44:36 -0700 (PDT) Received: from github-smtp2b-ext-cp1-prd.iad.github.net (github-smtp2-ext3.iad.github.net [192.30.252.194]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 23F3C12D79E for ; Thu, 23 Jun 2016 13:44:36 -0700 (PDT) Date: Thu, 23 Jun 2016 13:44:35 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1466714675; bh=n4pbYZCvior8UZpum7j3b/Dp7+3f+H+MDyM+DdX0bEU=; h=From:Reply-To:To:Cc:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=1bgX3/AkalsNeveWJUR+JYDugKGp2VDYISRlW9BIDiHXODp/kBOb+1Vubwf6nhsUJ ntQ9i9RwRFwwz2TfqswCyrO6LNck2zZy7i/7Ruo6CzjBOgXv7eas3bdnFJv3BzM7V5 FeDOkzRUZMSEvYckcsCF47mUG7EwR3sgILmjDajc= From: Andrei-Popov To: TokenBinding/Internet-Drafts Message-ID: In-Reply-To: References: Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_576c4a336b4b8_42f33fec999772bc4435fa"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list X-GitHub-Sender: Andrei-Popov X-GitHub-Recipient: unbearable-ML X-Auto-Response-Suppress: All X-GitHub-Recipient-Address: unbearable@ietf.org Archived-At: X-Mailman-Approved-At: Fri, 24 Jun 2016 14:50:25 -0700 Subject: Re: [Unbearable] [TokenBinding/Internet-Drafts] HTTPSTB: different text re Triple Handshake Vulnerability than TBPROTO & TBNEGO (#40) X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Reply-To: TokenBinding/Internet-Drafts List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Jun 2016 20:44:38 -0000 ----==_mimepart_576c4a336b4b8_42f33fec999772bc4435fa Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Addressed in HTTPSTB-04. --- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/TokenBinding/Internet-Drafts/issues/40#issuecomment-228177925 ----==_mimepart_576c4a336b4b8_42f33fec999772bc4435fa Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

Addressed in HTTPSTB-04.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_576c4a336b4b8_42f33fec999772bc4435fa-- From nobody Fri Jun 24 14:50:48 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A7D4512D79E for ; Thu, 23 Jun 2016 13:44:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.908 X-Spam-Level: X-Spam-Status: No, score=-5.908 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_16=1.092, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hBYU4Gl9RojA for ; Thu, 23 Jun 2016 13:44:36 -0700 (PDT) Received: from github-smtp2a-ext-cp1-prd.iad.github.net (github-smtp2-ext7.iad.github.net [192.30.252.198]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2342212D794 for ; Thu, 23 Jun 2016 13:44:36 -0700 (PDT) Date: Thu, 23 Jun 2016 13:44:35 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1466714675; bh=g/2MtIUirTe41gorhgeIwaFbMWAgCvJsP9ePNr24R/s=; h=From:Reply-To:To:Cc:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=NiuXtKs35mjXb2I1/7tNB96++EoZMBLdUfUwjr4ocO+2sieocriqjpAp9vdx1XN/6 ytSpxk/DvKhg3OHYi76aL4TBpuWU4ETCam4+vOcHsxcEAiOZgjpuPw/0Lbr2SjUigJ K7Yj7NqkIFwDVAfuvdt/IrtC33aINZFLruaQo6+0= From: Andrei-Popov To: TokenBinding/Internet-Drafts Message-ID: In-Reply-To: References: Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_576c4a3370333_66623fd46faab29c352345"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list X-GitHub-Sender: Andrei-Popov X-GitHub-Recipient: unbearable-ML X-Auto-Response-Suppress: All X-GitHub-Recipient-Address: unbearable@ietf.org Archived-At: X-Mailman-Approved-At: Fri, 24 Jun 2016 14:50:25 -0700 Subject: Re: [Unbearable] [TokenBinding/Internet-Drafts] HTTPSTB: different text re Triple Handshake Vulnerability than TBPROTO & TBNEGO (#40) X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Reply-To: TokenBinding/Internet-Drafts List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Jun 2016 20:44:39 -0000 ----==_mimepart_576c4a3370333_66623fd46faab29c352345 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Closed #40. --- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/TokenBinding/Internet-Drafts/issues/40#event-702449924 ----==_mimepart_576c4a3370333_66623fd46faab29c352345 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

Closed #40.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_576c4a3370333_66623fd46faab29c352345-- From nobody Sun Jun 26 20:19:36 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B42E012D5D3 for ; Sun, 26 Jun 2016 20:19:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id U0iAulLK6xIc for ; Sun, 26 Jun 2016 20:19:32 -0700 (PDT) Received: from mail-lf0-x231.google.com (mail-lf0-x231.google.com [IPv6:2a00:1450:4010:c07::231]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 97E5712D5C2 for ; Sun, 26 Jun 2016 20:19:31 -0700 (PDT) Received: by mail-lf0-x231.google.com with SMTP id f6so147275980lfg.0 for ; Sun, 26 Jun 2016 20:19:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=Vp+6KD5eoQcGniLEI9DH98kPfLMWhxNFpRStXJBX1mc=; b=oydZ+7V7s3zf2/TUa1jphHX6hnp87SBxzTYDVdBsKHGLLE6mxXldX19qmoyRn6jUOa lkmWKi8/xdR9Ys5b5a7oNs9SlAoFUQRrulMtokabc4i+vSVKlqw5uUF4NmhcJ+h62hQs gT8QzKZQBEOo7liPIDnULS9I708KplaytheUvREyClWiNnf22yHpmJ9Y1DcR1xOxS3x7 48ARWBm6pH5z1RamV96Pou1zY69mTF6NvGhH+bH4Hj5SXgEUzpqQxEGAO7OwBxoM5jtx aUNvCRyiqpTuqlcp/XZBWNvBNtprANRd+iD1oFBAVZXhXbPWHg1bvlG5Q2DwqQiFMYJx BHeA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=Vp+6KD5eoQcGniLEI9DH98kPfLMWhxNFpRStXJBX1mc=; b=jthn4eO0MPmHNa8ZhNmQj0XrxMXi2075cAMan29R1rBsF4+shnbyT5EAgOAngbUn7a NmX8uYh4WSS6cJRl6kJv4zRc/7yc/qFqFF5MbCBlHtXPTNndqwKwzvpCjPM7WG7DZHQJ XZ1WvC/5TOYzBH+R0XYyORRpbUu6HOOkiyDxPVMuyxi7OwZEzA0TdB7q3aHU2B7hE15y 0zdtYu4gI4/sGd7lY4Sxu/26AQv8415IvbjbT2FXBMlwSU2LVyXpVLyNbylJwBCF2l40 nuT+CUkIowMV++FZ6BQGOGSqlVd8J3aHkIBI6vC5DKNzsbiFLpYBlEPdzJEmvaBfLXG2 rSAQ== X-Gm-Message-State: ALyK8tITD3AN/EGqd1e2DgkCFhj9rHXwQKFoqnEoPs7WCvD4lPEQWAvB7UxefsMcbuxMwNLcEACL7vWUXykgNw== X-Received: by 10.46.5.71 with SMTP id 68mr4178537ljf.7.1466997569413; Sun, 26 Jun 2016 20:19:29 -0700 (PDT) MIME-Version: 1.0 Received: by 10.25.217.219 with HTTP; Sun, 26 Jun 2016 20:18:48 -0700 (PDT) In-Reply-To: References: From: Ted Lemon Date: Sun, 26 Jun 2016 23:18:48 -0400 Message-ID: To: John Bradley Content-Type: multipart/alternative; boundary=001a114a75a002f6b9053639fd58 Archived-At: Cc: Dave Tonge , unbearable@ietf.org Subject: Re: [Unbearable] Current implementations of token binding spec? X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Jun 2016 03:19:34 -0000 --001a114a75a002f6b9053639fd58 Content-Type: text/plain; charset=UTF-8 John, does that mean that there is a version of Chromium that supports token binding? On Tue, Jun 21, 2016 at 11:35 AM, John Bradley wrote: > Currently if you are brave, there is a Python test server as part of the > Chromium project on Github for testing. > https://github.com/chromium/chromium > > Last time I tried it you needed to checkout the whole project to get the > test server to build. > I think they are working on making that easier. > > Also as part of that project there is the Cronet http/TLS lib that can be > used on iOS and Android. > > We are hoping to include that as an option in the AppAuth project for > token binding refresh and access tokens on mobile. > > https://github.com/openid > > We are working/lobbying to get support included in more places such as > Python and Java. > > I hope you can contribute to the WG and help us move this spec to a RFC > quickly by showing demand. > > Regards > John B. > > > On Jun 21, 2016, at 10:55 AM, Dave Tonge > wrote: > > Hi > > I'm currently working with the UK Open Banking Standard > and the OpenID Financial API WG > . > The issue of token binding is being discussed and I wanted to try out an > actual real world implementation. > After some research there don't seem to be many implementations in the > wild (unless I've missed something). > > It is supported in Chrome, but doesn't seem to be supported in OpenSSL yet > (and therefore not in Node.JS, Python, Ruby, etc. > I've opened an issue on the OpenSSL repo: > https://github.com/openssl/openssl/issues/1242 > > Is my understanding correct? How would you recommend trying out a a live > implementation of token binding? > > Thanks > > -- > Dave Tonge > CTO > 10 Temple Back | Bristol | BS1 6FL > t: +44 (0)117 280 5120 > m: +44 (0)7577 815570 > > Momentum Financial Technology Ltd is authorised and regulated by the > Financial Conduct Authority (Register number 561538). Registered in > England & Wales, company registration number 06909772. DISCLAIMER: This > email (including any attachments) is subject to copyright, and the > information in it is confidential. Use of this email or of any information > in it other than by the addressee is unauthorised and unlawful. Whilst > reasonable efforts are made to ensure that any attachments are virus-free, > it is the recipient's sole responsibility to scan all attachments for > viruses. All calls and emails to and from this company may be monitored and > recorded for legitimate purposes relating to this company's business. Any > opinions expressed in this email (or in any attachments) are those of the > author and do not necessarily represent the opinions of Momentum Financial > Technology Ltd or of any other group company. > _______________________________________________ > Unbearable mailing list > Unbearable@ietf.org > https://www.ietf.org/mailman/listinfo/unbearable > > > > _______________________________________________ > Unbearable mailing list > Unbearable@ietf.org > https://www.ietf.org/mailman/listinfo/unbearable > > --001a114a75a002f6b9053639fd58 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
John, does that mean that there is a version of Chromium t= hat supports token binding?

On Tue, Jun 21, 2016 at 11:35 AM, John Bradley <ve7jtb@= ve7jtb.com> wrote:
Currently if you are brave, there is a Python t= est server as part of the Chromium project on Github for testing.

Last time I tried it y= ou needed to checkout the whole project to get the test server to build. = =C2=A0
I think they are working on making that easier.=C2=A0

Also as part of that project there is the Cronet http/= TLS lib that can be used on iOS and Android.

We ar= e hoping to include that as an option in the AppAuth project for token bind= ing refresh and access tokens on mobile.

https://github.com/openid<= /a>

We are working/lobbying to get support included = in more places such as Python and Java.

I hope you= can contribute to the WG and help us move this spec to a RFC quickly by sh= owing demand.

Regards
John B.
=

Hi

I'm currently = working with the UK Open Banking Standard and the OpenID Financial API WG.=C2=A0
The issue of token binding is being discussed and I wanted to try out= an actual real world implementation.=C2=A0
After some resea= rch there don't seem to be many implementations in the wild (unless I&#= 39;ve missed something).

It is supported= in Chrome, but doesn't seem to be supported in OpenSSL yet (and theref= ore not in Node.JS, Python, Ruby, etc.
I've opened an is= sue on the OpenSSL repo: https://github.com/openssl/openssl/issues/1242

Is my understanding correct? How woul= d you recommend trying out a a live implementation of token binding?
<= div class=3D"gmail_default" style=3D"font-family:'trebuchet ms',san= s-serif">
Thanks

--
Momentum Financial Technology = Ltd is authorised and regulated by the Financial Conduct Authority (Registe= r number=C2=A0561538<= /span>). Registered in England & Wales, company registration number=C2= =A006909772.= =C2=A0DISCLAIMER: This email (includ= ing any attachments) is subject to copyright, and the information in it is = confidential. Use of this email or of any information in it other than by t= he addressee is unauthorised and unlawful. Whilst reasonable efforts are ma= de to ensure that any attachments are virus-free, it is the recipient's= sole responsibility to scan all attachments for viruses. All calls and ema= ils to and from this company may be monitored and recorded for legitimate p= urposes relating to this company's business. Any opinions expressed in = this email (or in any attachments) are those of the author and do not neces= sarily represent the opinions of Momentum Financial Technology Ltd or of an= y other group company.
_______________________________________________
Unbearable mailing list<= br>Unbearable@ietf= .org
https://www.ietf.org/mailman/listinfo/unbearable


____________________= ___________________________
Unbearable mailing list
Unbearable@ietf.org
https://www.ietf.org/mailman/listinfo/unbearable=


--001a114a75a002f6b9053639fd58-- From nobody Sun Jun 26 20:21:57 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0030E12D5E7 for ; Sun, 26 Jun 2016 20:21:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=ve7jtb-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mZAQZ062raiS for ; Sun, 26 Jun 2016 20:21:53 -0700 (PDT) Received: from mail-yw0-x235.google.com (mail-yw0-x235.google.com [IPv6:2607:f8b0:4002:c05::235]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 85E9712D5D3 for ; Sun, 26 Jun 2016 20:21:53 -0700 (PDT) Received: by mail-yw0-x235.google.com with SMTP id v77so145315449ywg.0 for ; Sun, 26 Jun 2016 20:21:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ve7jtb-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc; bh=7zFwjKN5uciq5DGNIlFsD3pWo+um2McQqclJYuvJL6U=; b=gwM5r0iACiNkpKbELirui11qZQxWnLnZzh/9JeT0eD10Gyjg6wVHTASJRkyZAcie1/ csnKttNoJ62SXA/gTgQtcmQL8PgB/ZzqcDzw1XfrmqQ6QfpPsld/9Ns3xOLobSZlaZ7/ ip/QOg1Ul9Mu4zq2VXtC5j8m0pMYwFQX0walrmZGK+mxlAFd8bHQ38va/TonvwlpkhBR +jaS9LeSpBhZWs+J4TfY9VN1K5VlV7G88N5lZLXEGn6mjfOvjS4CIkl3+hJugBWMvkaN QCCIsfIgPnNE311xS3+DF0OS/orE5eLvoVB9HBFJuXkKyMMYuNDUX6N1/m6Y8MFpN6wk O7lw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc; bh=7zFwjKN5uciq5DGNIlFsD3pWo+um2McQqclJYuvJL6U=; b=UuYW9Hci06qTQKrFNZrOh5owBGVEUTr4OQj6ZiwDmgU98fjvgWcGvZSGgydt2QXv+A m+cfs43zE9naOJiklPUFXmEJB3up4oM7W5OD5BLt9BgQ2TSQdhqUdi5SCrEKmAFcQdSx aSJNIxqmcynzlSmrfj9JtGaj2O7t0Ww/cF3Fu2q+WzJQVlx2tyoPB4OBI22nfHuztS+q s1lcYffL3cmOR2xBuFwPIsfFDudRzABm/r7Twhjra2fNLDzB+0JGJrS+fK4ntGzPA4RQ d4ykqYZSupRo1kUMnseYLpWAXfhi6hCfXHTUSJxFrZVrVYIjpcifpyhc2npebJhHv+FR qsWA== X-Gm-Message-State: ALyK8tIIuzglMNn62Lx8neomqOIu9DDKaIQwdyE+GeB4I1FF5h6kN5M9sVX9NVuhxbvhhM9lcP3RRjkjVrcjHQ== MIME-Version: 1.0 X-Received: by 10.13.224.193 with SMTP id j184mr10074388ywe.198.1466997712602; Sun, 26 Jun 2016 20:21:52 -0700 (PDT) Received: by 10.37.221.132 with HTTP; Sun, 26 Jun 2016 20:21:52 -0700 (PDT) Received: by 10.37.221.132 with HTTP; Sun, 26 Jun 2016 20:21:52 -0700 (PDT) In-Reply-To: References: Date: Sun, 26 Jun 2016 22:21:52 -0500 Message-ID: From: John Bradley To: Ted Lemon Content-Type: multipart/alternative; boundary=94eb2c0649b28c002c05363a057b Archived-At: Cc: Dave Tonge , unbearable@ietf.org Subject: Re: [Unbearable] Current implementations of token binding spec? X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Jun 2016 03:21:56 -0000 --94eb2c0649b28c002c05363a057b Content-Type: text/plain; charset=UTF-8 Yes, I beleave that it is also supported in one of the beta trains of Chrome if you turn on a flag. Perhaps one of the Google people can confirm that. John B. On Jun 26, 2016 11:19 PM, "Ted Lemon" wrote: > John, does that mean that there is a version of Chromium that supports > token binding? > > On Tue, Jun 21, 2016 at 11:35 AM, John Bradley wrote: > >> Currently if you are brave, there is a Python test server as part of the >> Chromium project on Github for testing. >> https://github.com/chromium/chromium >> >> Last time I tried it you needed to checkout the whole project to get the >> test server to build. >> I think they are working on making that easier. >> >> Also as part of that project there is the Cronet http/TLS lib that can be >> used on iOS and Android. >> >> We are hoping to include that as an option in the AppAuth project for >> token binding refresh and access tokens on mobile. >> >> https://github.com/openid >> >> We are working/lobbying to get support included in more places such as >> Python and Java. >> >> I hope you can contribute to the WG and help us move this spec to a RFC >> quickly by showing demand. >> >> Regards >> John B. >> >> >> On Jun 21, 2016, at 10:55 AM, Dave Tonge >> wrote: >> >> Hi >> >> I'm currently working with the UK Open Banking Standard >> and the OpenID Financial API WG >> . >> The issue of token binding is being discussed and I wanted to try out an >> actual real world implementation. >> After some research there don't seem to be many implementations in the >> wild (unless I've missed something). >> >> It is supported in Chrome, but doesn't seem to be supported in OpenSSL >> yet (and therefore not in Node.JS, Python, Ruby, etc. >> I've opened an issue on the OpenSSL repo: >> https://github.com/openssl/openssl/issues/1242 >> >> Is my understanding correct? How would you recommend trying out a a live >> implementation of token binding? >> >> Thanks >> >> -- >> Dave Tonge >> CTO >> 10 Temple Back | Bristol | BS1 6FL >> t: +44 (0)117 280 5120 >> m: +44 (0)7577 815570 >> >> Momentum Financial Technology Ltd is authorised and regulated by the >> Financial Conduct Authority (Register number 561538). Registered in >> England & Wales, company registration number 06909772. DISCLAIMER: This >> email (including any attachments) is subject to copyright, and the >> information in it is confidential. Use of this email or of any information >> in it other than by the addressee is unauthorised and unlawful. Whilst >> reasonable efforts are made to ensure that any attachments are virus-free, >> it is the recipient's sole responsibility to scan all attachments for >> viruses. All calls and emails to and from this company may be monitored and >> recorded for legitimate purposes relating to this company's business. Any >> opinions expressed in this email (or in any attachments) are those of the >> author and do not necessarily represent the opinions of Momentum Financial >> Technology Ltd or of any other group company. >> _______________________________________________ >> Unbearable mailing list >> Unbearable@ietf.org >> https://www.ietf.org/mailman/listinfo/unbearable >> >> >> >> _______________________________________________ >> Unbearable mailing list >> Unbearable@ietf.org >> https://www.ietf.org/mailman/listinfo/unbearable >> >> > --94eb2c0649b28c002c05363a057b Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable

Yes, I beleave that it is also supported in one of the beta = trains of Chrome if you turn on a flag.=C2=A0 Perhaps one of the Google peo= ple can confirm that.

John B.

On Jun 26, 2016 11:19 PM, "Ted Lemon" = <mellon@fugue.com> wrote:
John, = does that mean that there is a version of Chromium that supports token bind= ing?

On Tue,= Jun 21, 2016 at 11:35 AM, John Bradley <ve7jtb@ve7jtb.com> = wrote:
Currently if you are brave, there is a Python test server as part of the = Chromium project on Github for testing.




https://github.com/openid

We = are working/lobbying to get support included in more places such as Python = and Java.

I hope you can contribute to the WG and = help us move this spec to a RFC quickly by showing demand.

Regards
John B.


=
On Jun 21, 2016, at 10:55 AM,= Dave Tonge <dave.tonge@momentumft.co.uk> wrote:

=
Hi

= I'm currently working with the UK Open Banking Standard and the OpenID Financial API WG.=C2=A0
The issue of token binding is being discussed and = I wanted to try out an actual real world implementation.=C2=A0

= I've opened an issue on the OpenSSL repo: https://github.com/openssl/= openssl/issues/1242

Is my understand= ing correct? How would you recommend trying out a a live implementation of = token binding?

Thanks

--
Dave Tonge
CTO
10 Templ= e Back | Bristol | BS1 6FL
= =C2=A0
Moment= um Financial Technology Ltd is authorised and regulated by the Financial Co= nduct Authority (Register number=C2=A0561538). Registered in England & Wales, company= registration number=C2=A006909772.=C2=A0DISCLAIME= R: This email (including any attachments) is subject to copyright, and the = information in it is confidential. Use of this email or of any information = in it other than by the addressee is unauthorised and unlawful. Whilst reas= onable efforts are made to ensure that any attachments are virus-free, it i= s the recipient's sole responsibility to scan all attachments for virus= es. All calls and emails to and from this company may be monitored and reco= rded for legitimate purposes relating to this company's business. Any o= pinions expressed in this email (or in any attachments) are those of the au= thor and do not necessarily represent the opinions of Momentum Financial Te= chnology Ltd or of any other group company.
<= /div>
_______________________________________________
Unbearable mailing list<= br>Unbearable@ietf= .org
https://www.ietf.org/mailman/listinfo/unbearable


____________________= ___________________________
Unbearable mailing list
Unbearable@ietf.or= g
https://www.ietf.org/mailman/listinfo/unbearable=


--94eb2c0649b28c002c05363a057b-- From nobody Sun Jun 26 20:23:29 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 033BC12D5F0 for ; Sun, 26 Jun 2016 20:23:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9_bKZYNaN2Oh for ; Sun, 26 Jun 2016 20:23:26 -0700 (PDT) Received: from mail-lf0-x236.google.com (mail-lf0-x236.google.com [IPv6:2a00:1450:4010:c07::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6620712D5E8 for ; Sun, 26 Jun 2016 20:23:25 -0700 (PDT) Received: by mail-lf0-x236.google.com with SMTP id h129so147886000lfh.1 for ; Sun, 26 Jun 2016 20:23:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=JSl5T1Ep4eEp6k78YnJRFMrr0qQ7D+idEf0b6q/NArA=; b=0D2CiidCVbWA5StEOndsPeKrr1VZd9KmKGAnHs4VSnE9OKRpfz1XJ6wUQy3SNAZ//n s94a5K4klQCWtVGMQHgoEAyE1lBzpKff1y2Owx13MJqQ35r6warBoQmER03k0iMxynH3 y1Z/xHgBQ67OswbGluQJaoKEh0sPdHbKuaKNLVHUp0xbcA7EX1l4QG+sCQe3Q6O2J3ZK s8NYvoRl8o85foRrQeWWZT7Q6Z5CMHvFQKRVvW5lC6vdtcRjFVCBthhuWBIMa77G6Eq4 KauhOjIRHb3wvak736crpAxLdS3dpGnEX57rHGynjkiOYgRDyrw+aAjV0e+Wz0TDmEUR qDkg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=JSl5T1Ep4eEp6k78YnJRFMrr0qQ7D+idEf0b6q/NArA=; b=FolyP2lecTWiqQWF/i3RRgMQNVdlcLjMGj+R9R9U57VMQG7btA8ChxImqr5j2eFPzb +01Acq8fevYuShlDacl6cRLSH3aL39cYc/nKLC+bqIH9ogqmcyPuiKyvRveiTLVj3srZ SMOxp5Pmbo+n3Qwik4umiT5kPB57kwyDWnZbeeWXuTF3PmG4sF+h2iUb0qpNSYLT1aYS VO5KFhdktFCDBjpvPtMNIv33IAHwNnKLmfjObBtdstcrJpWeu0VgaJnel6xokiNnYucn R5QUDr3pEGe6G+t+mRl2q+KFpYnMq0KEhjyiNI5k9HTA2MFp+txeHsiU2OWAqsnmFWBn JqMQ== X-Gm-Message-State: ALyK8tKdNAjdsWMWHdAMua6g9vkI9TG7PGehxcRnYIzdV0Jd85S7d7h6MX/g0XtVsMpZu2v9USAcCr2M5LTyQA== X-Received: by 10.46.0.14 with SMTP id 14mr4444080lja.60.1466997803589; Sun, 26 Jun 2016 20:23:23 -0700 (PDT) MIME-Version: 1.0 Received: by 10.25.217.219 with HTTP; Sun, 26 Jun 2016 20:22:43 -0700 (PDT) In-Reply-To: References: From: Ted Lemon Date: Sun, 26 Jun 2016 23:22:43 -0400 Message-ID: To: John Bradley Content-Type: multipart/alternative; boundary=001a1142b6f6f835c705363a0a39 Archived-At: Cc: Dave Tonge , unbearable@ietf.org Subject: Re: [Unbearable] Current implementations of token binding spec? X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Jun 2016 03:23:28 -0000 --001a1142b6f6f835c705363a0a39 Content-Type: text/plain; charset=UTF-8 Ooh, cool! I've been waiting a while for this (need the server side as well, of course)! On Sun, Jun 26, 2016 at 11:21 PM, John Bradley wrote: > Yes, I beleave that it is also supported in one of the beta trains of > Chrome if you turn on a flag. Perhaps one of the Google people can confirm > that. > > John B. > On Jun 26, 2016 11:19 PM, "Ted Lemon" wrote: > >> John, does that mean that there is a version of Chromium that supports >> token binding? >> >> On Tue, Jun 21, 2016 at 11:35 AM, John Bradley wrote: >> >>> Currently if you are brave, there is a Python test server as part of the >>> Chromium project on Github for testing. >>> https://github.com/chromium/chromium >>> >>> Last time I tried it you needed to checkout the whole project to get the >>> test server to build. >>> I think they are working on making that easier. >>> >>> Also as part of that project there is the Cronet http/TLS lib that can >>> be used on iOS and Android. >>> >>> We are hoping to include that as an option in the AppAuth project for >>> token binding refresh and access tokens on mobile. >>> >>> https://github.com/openid >>> >>> We are working/lobbying to get support included in more places such as >>> Python and Java. >>> >>> I hope you can contribute to the WG and help us move this spec to a RFC >>> quickly by showing demand. >>> >>> Regards >>> John B. >>> >>> >>> On Jun 21, 2016, at 10:55 AM, Dave Tonge >>> wrote: >>> >>> Hi >>> >>> I'm currently working with the UK Open Banking Standard >>> and the OpenID Financial API WG >>> . >>> The issue of token binding is being discussed and I wanted to try out an >>> actual real world implementation. >>> After some research there don't seem to be many implementations in the >>> wild (unless I've missed something). >>> >>> It is supported in Chrome, but doesn't seem to be supported in OpenSSL >>> yet (and therefore not in Node.JS, Python, Ruby, etc. >>> I've opened an issue on the OpenSSL repo: >>> https://github.com/openssl/openssl/issues/1242 >>> >>> Is my understanding correct? How would you recommend trying out a a live >>> implementation of token binding? >>> >>> Thanks >>> >>> -- >>> Dave Tonge >>> CTO >>> 10 Temple Back | Bristol | BS1 6FL >>> t: +44 (0)117 280 5120 >>> m: +44 (0)7577 815570 >>> >>> Momentum Financial Technology Ltd is authorised and regulated by the >>> Financial Conduct Authority (Register number 561538). Registered in >>> England & Wales, company registration number 06909772. DISCLAIMER: This >>> email (including any attachments) is subject to copyright, and the >>> information in it is confidential. Use of this email or of any information >>> in it other than by the addressee is unauthorised and unlawful. Whilst >>> reasonable efforts are made to ensure that any attachments are virus-free, >>> it is the recipient's sole responsibility to scan all attachments for >>> viruses. All calls and emails to and from this company may be monitored and >>> recorded for legitimate purposes relating to this company's business. Any >>> opinions expressed in this email (or in any attachments) are those of the >>> author and do not necessarily represent the opinions of Momentum Financial >>> Technology Ltd or of any other group company. >>> _______________________________________________ >>> Unbearable mailing list >>> Unbearable@ietf.org >>> https://www.ietf.org/mailman/listinfo/unbearable >>> >>> >>> >>> _______________________________________________ >>> Unbearable mailing list >>> Unbearable@ietf.org >>> https://www.ietf.org/mailman/listinfo/unbearable >>> >>> >> --001a1142b6f6f835c705363a0a39 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Ooh, cool!=C2=A0 I've been waiting a while for this (n= eed the server side as well, of course)!=C2=A0

On Sun, Jun 26, 2016 at 11:21 PM, John B= radley <ve7jtb@ve7jtb.com> wrote:

Yes, I beleave that it is also supported in one of t= he beta trains of Chrome if you turn on a flag.=C2=A0 Perhaps one of the Go= ogle people can confirm that.

John B.

On Jun 26, 2016 11:19 PM, "Ted Lemon" = <mellon@fugue.com<= /a>> wrote:
John, does that mean that there is a version of Chromium that s= upports token binding?

On Tue, Jun 21, 2016 at 11:35 AM, John Bradley <ve7jtb@ve7jtb.c= om> wrote:
Currently if you are brave, there is a Python test serv= er as part of the Chromium project on Github for testing.

Last time I tried it you neede= d to checkout the whole project to get the test server to build. =C2=A0
I think they are working on making that easier.=C2=A0

=
Also as part of that project there is the Cronet http/TLS lib th= at can be used on iOS and Android.

We are hoping t= o include that as an option in the AppAuth project for token binding refres= h and access tokens on mobile.

https://github.com/openid
=
We are working/lobbying to get support included in more plac= es such as Python and Java.

I hope you can contrib= ute to the WG and help us move this spec to a RFC quickly by showing demand= .

Regards
John B.


On Jun 21, = 2016, at 10:55 AM, Dave Tonge <dave.tonge@momentumft.co.uk> wrote:
Hi
=
I'm currently working with the UK Open Banking Standard <= /a>and the OpenID = Financial API WG.=C2=A0
The issue of token binding is be= ing discussed and I wanted to try out an actual real world implementation.= =C2=A0
After some research there don't seem to be many i= mplementations in the wild (unless I've missed something).

It is supported in Chrome, but doesn't seem to b= e supported in OpenSSL yet (and therefore not in Node.JS, Python, Ruby, etc= .
I've opened an issue on the OpenSSL repo: https://gi= thub.com/openssl/openssl/issues/1242

Is my understanding correct? How would you recommend trying out a a live i= mplementation of token binding?

Thanks

--
Dave Tonge
CTO
10 Temple Back | Bristol | BS1 6FL
=C2=A0
Momentum Financial Technology Ltd is authorised and regulated by t= he Financial Conduct Authority (Register number=C2=A0561538). Registered in England &= Wales, company registration number=C2=A006909772.=C2=A0DISCLAIMER: This email (including any attachments) is subject to copy= right, and the information in it is confidential. Use of this email or of a= ny information in it other than by the addressee is unauthorised and unlawf= ul. Whilst reasonable efforts are made to ensure that any attachments are v= irus-free, it is the recipient's sole responsibility to scan all attach= ments for viruses. All calls and emails to and from this company may be mon= itored and recorded for legitimate purposes relating to this company's = business. Any opinions expressed in this email (or in any attachments) are = those of the author and do not necessarily represent the opinions of Moment= um Financial Technology Ltd or of any other group company.
_______________________________________________
Unbearable mailing list<= br>Unbearable@ietf= .org
https://www.ietf.org/mailman/listinfo/unbearable


____________________= ___________________________
Unbearable mailing list
Unbearable@ietf.or= g
https://www.ietf.org/mailman/listinfo/unbearable=



--001a1142b6f6f835c705363a0a39-- From nobody Sun Jun 26 20:27:30 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 30E9812D5FD for ; Sun, 26 Jun 2016 20:27:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=ve7jtb-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fdxhiuk1C24z for ; Sun, 26 Jun 2016 20:27:26 -0700 (PDT) Received: from mail-yw0-x236.google.com (mail-yw0-x236.google.com [IPv6:2607:f8b0:4002:c05::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A812D12D5FB for ; Sun, 26 Jun 2016 20:27:25 -0700 (PDT) Received: by mail-yw0-x236.google.com with SMTP id i12so142257968ywa.1 for ; Sun, 26 Jun 2016 20:27:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ve7jtb-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc; bh=ipqHcJdBkS+KcOfWzSaYMaZpV6TJoUSQP4XEpqQ3mPU=; b=b9juQ9r1W29NWXdr8Zi6q/7mknEFqDxfj7VmiVnGX97gP4MCzxb+Mnf+9HkKp80zWk n3L5MCyOSL35/slVPgrJ2RetB05vNPAJLHirY/vDixKizOtLpdBhEy6j4a+rP8cRnpxZ eZJXHLysHexw/VTIJGnTaoEXJcibIDm6sQz3Hhh+boJLL188SxLTjWPuSpO6Tm1iFxiu SHGIBxV+KTBydrmgK/Fpy5PQSKXte1IGWm6R4I/fOcL9YlJgfH6NhKkv2mDCe986bcIf uh7Io9B1l5VUOgMM89Q06NPHxkySmrBt+pfhaLYK8Nl6qglVDX2+//h41RxDalvVCgyY l1bQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc; bh=ipqHcJdBkS+KcOfWzSaYMaZpV6TJoUSQP4XEpqQ3mPU=; b=ay/deamUtJfJnrjw9O5BFJEsNhybfzljBYJJt9ILQJwDZjJaw1FmrvB1yA37i60eb7 f2sBxS0VWd0UJBs8HANiPwfa09M7hpj1+RLI1vLY/uvSTJqCqj4WJ2sT7X37SzndRCQw 3YePgyHKjGa54I2D5y1dQARoeCL4UfVfafZfumtKxoehGnOC+011Gn+gJCVYYDJO9zB0 dmLiCXGSDP4NJER7qxD+9+eWCXBF81Q3jRvedCKYMzj384A580l4MDYDZbgS7+G+aWTX q9BlX/ZYHK7GOEjW8TcIeXMXc+hA5Kthb27f+FRjCWoFnsULF/N0qf82hxmDvuIGhbZc PMxw== X-Gm-Message-State: ALyK8tJL4gqz0WpJP/O/JG6Em/E6OJbfTUOly/VKUCCLL5dgqs0tNxb48PQ43AKJyY0F3ex2gGUH5oFhVZReHA== MIME-Version: 1.0 X-Received: by 10.129.98.87 with SMTP id w84mr10100920ywb.59.1466998044782; Sun, 26 Jun 2016 20:27:24 -0700 (PDT) Received: by 10.37.221.132 with HTTP; Sun, 26 Jun 2016 20:27:24 -0700 (PDT) Received: by 10.37.221.132 with HTTP; Sun, 26 Jun 2016 20:27:24 -0700 (PDT) In-Reply-To: References: Date: Sun, 26 Jun 2016 22:27:24 -0500 Message-ID: From: John Bradley To: Ted Lemon Content-Type: multipart/alternative; boundary=001a1147100458a97505363a19ad Archived-At: Cc: Dave Tonge , unbearable@ietf.org Subject: Re: [Unbearable] Current implementations of token binding spec? X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Jun 2016 03:27:29 -0000 --001a1147100458a97505363a19ad Content-Type: text/plain; charset=UTF-8 Yes the server side needs the most work. I would like to see a reverse proxy with Token binding support ASAP. Windows 10 also supports a earlier draft of token binding. I think MS uses it for tokens on its own sites. They haven't committed to timing on updating to the latest draft. Getting this to RFC will help with getting people to update. John B. On Jun 26, 2016 11:23 PM, "Ted Lemon" wrote: > Ooh, cool! I've been waiting a while for this (need the server side as > well, of course)! > > On Sun, Jun 26, 2016 at 11:21 PM, John Bradley wrote: > >> Yes, I beleave that it is also supported in one of the beta trains of >> Chrome if you turn on a flag. Perhaps one of the Google people can confirm >> that. >> >> John B. >> On Jun 26, 2016 11:19 PM, "Ted Lemon" wrote: >> >>> John, does that mean that there is a version of Chromium that supports >>> token binding? >>> >>> On Tue, Jun 21, 2016 at 11:35 AM, John Bradley >>> wrote: >>> >>>> Currently if you are brave, there is a Python test server as part of >>>> the Chromium project on Github for testing. >>>> https://github.com/chromium/chromium >>>> >>>> Last time I tried it you needed to checkout the whole project to get >>>> the test server to build. >>>> I think they are working on making that easier. >>>> >>>> Also as part of that project there is the Cronet http/TLS lib that can >>>> be used on iOS and Android. >>>> >>>> We are hoping to include that as an option in the AppAuth project for >>>> token binding refresh and access tokens on mobile. >>>> >>>> https://github.com/openid >>>> >>>> We are working/lobbying to get support included in more places such as >>>> Python and Java. >>>> >>>> I hope you can contribute to the WG and help us move this spec to a RFC >>>> quickly by showing demand. >>>> >>>> Regards >>>> John B. >>>> >>>> >>>> On Jun 21, 2016, at 10:55 AM, Dave Tonge >>>> wrote: >>>> >>>> Hi >>>> >>>> I'm currently working with the UK Open Banking Standard >>>> and the OpenID Financial API WG >>>> . >>>> The issue of token binding is being discussed and I wanted to try out >>>> an actual real world implementation. >>>> After some research there don't seem to be many implementations in the >>>> wild (unless I've missed something). >>>> >>>> It is supported in Chrome, but doesn't seem to be supported in OpenSSL >>>> yet (and therefore not in Node.JS, Python, Ruby, etc. >>>> I've opened an issue on the OpenSSL repo: >>>> https://github.com/openssl/openssl/issues/1242 >>>> >>>> Is my understanding correct? How would you recommend trying out a a >>>> live implementation of token binding? >>>> >>>> Thanks >>>> >>>> -- >>>> Dave Tonge >>>> CTO >>>> 10 Temple Back | Bristol | BS1 6FL >>>> t: +44 (0)117 280 5120 >>>> m: +44 (0)7577 815570 >>>> >>>> Momentum Financial Technology Ltd is authorised and regulated by the >>>> Financial Conduct Authority (Register number 561538). Registered in >>>> England & Wales, company registration number 06909772. DISCLAIMER: >>>> This email (including any attachments) is subject to copyright, and the >>>> information in it is confidential. Use of this email or of any information >>>> in it other than by the addressee is unauthorised and unlawful. Whilst >>>> reasonable efforts are made to ensure that any attachments are virus-free, >>>> it is the recipient's sole responsibility to scan all attachments for >>>> viruses. All calls and emails to and from this company may be monitored and >>>> recorded for legitimate purposes relating to this company's business. Any >>>> opinions expressed in this email (or in any attachments) are those of the >>>> author and do not necessarily represent the opinions of Momentum Financial >>>> Technology Ltd or of any other group company. >>>> _______________________________________________ >>>> Unbearable mailing list >>>> Unbearable@ietf.org >>>> https://www.ietf.org/mailman/listinfo/unbearable >>>> >>>> >>>> >>>> _______________________________________________ >>>> Unbearable mailing list >>>> Unbearable@ietf.org >>>> https://www.ietf.org/mailman/listinfo/unbearable >>>> >>>> >>> > --001a1147100458a97505363a19ad Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable

Yes the server side needs the most work.=C2=A0

I would like to see a reverse proxy with Token binding suppo= rt ASAP.=C2=A0

Windows 10 also supports a earlier draft of token binding.= =C2=A0 I think MS uses it for tokens on its own sites.=C2=A0=C2=A0 They hav= en't committed to timing on updating to the latest draft.=C2=A0

Getting this to RFC will help with getting people to update.= =C2=A0=C2=A0

John B.

On Jun 26, 2016 11:23 PM, "Ted Lemon" = <mellon@fugue.com> wrote:
Ooh, c= ool!=C2=A0 I've been waiting a while for this (need the server side as = well, of course)!=C2=A0

On Sun, Jun 26, 2016 at 11:21 PM, John Bradley <ve7jtb@ve7jtb.= com> wrote:

= Yes, I beleave that it is also supported in one of the beta trains of Chrom= e if you turn on a flag.=C2=A0 Perhaps one of the Google people can confirm= that.

John B.

On Jun 26, 2016 11:19 PM, "Ted Lemon" = <mellon@fugue.com<= /a>> wrote:
John, does that mean that there is a version of Chromium that s= upports token binding?

On Tue, Jun 21, 2016 at 11:35 AM, John Bradley <ve7jtb@ve7jtb.c= om> wrote:
Currently if you are brave, there is a Python test serv= er as part of the Chromium project on Github for testing.

Last time I tried it you neede= d to checkout the whole project to get the test server to build. =C2=A0
I think they are working on making that easier.=C2=A0

=
Also as part of that project there is the Cronet http/TLS lib th= at can be used on iOS and Android.

We are hoping t= o include that as an option in the AppAuth project for token binding refres= h and access tokens on mobile.

https://github.com/openid
=
We are working/lobbying to get support included in more plac= es such as Python and Java.

I hope you can contrib= ute to the WG and help us move this spec to a RFC quickly by showing demand= .

Regards
John B.


On Jun 21, = 2016, at 10:55 AM, Dave Tonge <dave.tonge@momentumft.co.uk> wrote:
Hi
=
I'm currently working with the UK Open Banking Standard <= /a>and the OpenID = Financial API WG.=C2=A0
The issue of token binding is be= ing discussed and I wanted to try out an actual real world implementation.= =C2=A0
After some research there don't seem to be many i= mplementations in the wild (unless I've missed something).

It is supported in Chrome, but doesn't seem to b= e supported in OpenSSL yet (and therefore not in Node.JS, Python, Ruby, etc= .
I've opened an issue on the OpenSSL repo: https://gi= thub.com/openssl/openssl/issues/1242

Is my understanding correct? How would you recommend trying out a a live i= mplementation of token binding?

Thanks

--
Dave Tonge
CTO
10 Temple Back | Bristol | BS1 6FL
=C2=A0
Momentum Financial Technology Ltd is authorised and regulated by t= he Financial Conduct Authority (Register number=C2=A0561538). Registered in England &= Wales, company registration number=C2=A006909772.=C2=A0DISCLAIMER: This email (including any attachments) is subject to copy= right, and the information in it is confidential. Use of this email or of a= ny information in it other than by the addressee is unauthorised and unlawf= ul. Whilst reasonable efforts are made to ensure that any attachments are v= irus-free, it is the recipient's sole responsibility to scan all attach= ments for viruses. All calls and emails to and from this company may be mon= itored and recorded for legitimate purposes relating to this company's = business. Any opinions expressed in this email (or in any attachments) are = those of the author and do not necessarily represent the opinions of Moment= um Financial Technology Ltd or of any other group company.
_______________________________________________
Unbearable mailing list<= br>Unbearable@ietf= .org
https://www.ietf.org/mailman/listinfo/unbearable


____________________= ___________________________
Unbearable mailing list
Unbearable@ietf.or= g
https://www.ietf.org/mailman/listinfo/unbearable=



--001a1147100458a97505363a19ad-- From nobody Mon Jun 27 03:38:13 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0A5CA12D0DE for ; Mon, 27 Jun 2016 03:38:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=momentumft.co.uk Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1A4osY_CqncJ for ; Mon, 27 Jun 2016 03:38:09 -0700 (PDT) Received: from mail-wm0-x22e.google.com (mail-wm0-x22e.google.com [IPv6:2a00:1450:400c:c09::22e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8396912D0A2 for ; Mon, 27 Jun 2016 03:38:09 -0700 (PDT) Received: by mail-wm0-x22e.google.com with SMTP id r201so108703174wme.1 for ; Mon, 27 Jun 2016 03:38:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=momentumft.co.uk; s=google; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=PI12VQxYmfdWw6fdrlXUdXUBDBU3fX5YrJLDOdSQx10=; b=Na2v8RvFxxdp0GKDvv2mcfILzq0KjrQPkzitbOmNY86r9wrJ/bSc5wLZSrLS2vS3rX zUzvjnuGdgHeKUzAk+PeDfblpLJR597s5Xvl6pUl/+qoQj9+z1M09y/tqeiRjbpkq172 HsP/V9Dme/STnbSoeU6rGPd6alyGDk9PhGrys= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=PI12VQxYmfdWw6fdrlXUdXUBDBU3fX5YrJLDOdSQx10=; b=jRoRPvnbu2sObxKQC1wSjFxI1s7RpSpN4GaO5wcRYVVg2ZwfrSDiFF5zadpKxt0TBY XL5Do8Ah5oTTzBQp0ChiZPRtKy6hMGkneORdNd0VrvVPIb3O1mJETUDX4bqxrQr7/kvG pJ9exrmjUZlmr/y2H0jp7c6fixB/wiW8Q+iOQMBfdINR8k250u8IT3myMc4PWbMaYrv+ o3QLCDDjty4nsM1JilZly7gVzpBfWT03OIsEsi+6gRt8PDQTsjNwRXjT2lZmzNVtqnUd LDgtc17DPDLv+XHxFg9erYmAWbrs7uBObIto632utKSo2Gek8g493zvQaFMClc+cqrwf 9LsA== X-Gm-Message-State: ALyK8tIgw7T8tXYKyXVnrbPP0fOcRXdrwx0Z8hWcuiY1KFHsURzFcXPGWXc9DqkFmSTIMRbTxySU3RSgpmgKwjJv X-Received: by 10.194.56.134 with SMTP id a6mr130860wjq.106.1467023887700; Mon, 27 Jun 2016 03:38:07 -0700 (PDT) MIME-Version: 1.0 Received: by 10.28.185.203 with HTTP; Mon, 27 Jun 2016 03:37:48 -0700 (PDT) In-Reply-To: References: From: Dave Tonge Date: Mon, 27 Jun 2016 11:37:48 +0100 Message-ID: To: John Bradley Content-Type: multipart/alternative; boundary=047d7b86eac0b430cc0536401ddc Archived-At: Cc: unbearable@ietf.org, Ted Lemon Subject: Re: [Unbearable] Current implementations of token binding spec? X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Jun 2016 10:38:13 -0000 --047d7b86eac0b430cc0536401ddc Content-Type: text/plain; charset=UTF-8 Token Binding can be enabled via a flag in Chrome: chrome://flags/#enable-token-binding On 27 June 2016 at 04:27, John Bradley wrote: > Yes the server side needs the most work. > > I would like to see a reverse proxy with Token binding support ASAP. > > Windows 10 also supports a earlier draft of token binding. I think MS > uses it for tokens on its own sites. They haven't committed to timing on > updating to the latest draft. > > Getting this to RFC will help with getting people to update. > > John B. > On Jun 26, 2016 11:23 PM, "Ted Lemon" wrote: > >> Ooh, cool! I've been waiting a while for this (need the server side as >> well, of course)! >> >> On Sun, Jun 26, 2016 at 11:21 PM, John Bradley wrote: >> >>> Yes, I beleave that it is also supported in one of the beta trains of >>> Chrome if you turn on a flag. Perhaps one of the Google people can confirm >>> that. >>> >>> John B. >>> On Jun 26, 2016 11:19 PM, "Ted Lemon" wrote: >>> >>>> John, does that mean that there is a version of Chromium that supports >>>> token binding? >>>> >>>> On Tue, Jun 21, 2016 at 11:35 AM, John Bradley >>>> wrote: >>>> >>>>> Currently if you are brave, there is a Python test server as part of >>>>> the Chromium project on Github for testing. >>>>> https://github.com/chromium/chromium >>>>> >>>>> Last time I tried it you needed to checkout the whole project to get >>>>> the test server to build. >>>>> I think they are working on making that easier. >>>>> >>>>> Also as part of that project there is the Cronet http/TLS lib that can >>>>> be used on iOS and Android. >>>>> >>>>> We are hoping to include that as an option in the AppAuth project for >>>>> token binding refresh and access tokens on mobile. >>>>> >>>>> https://github.com/openid >>>>> >>>>> We are working/lobbying to get support included in more places such as >>>>> Python and Java. >>>>> >>>>> I hope you can contribute to the WG and help us move this spec to a >>>>> RFC quickly by showing demand. >>>>> >>>>> Regards >>>>> John B. >>>>> >>>>> >>>>> On Jun 21, 2016, at 10:55 AM, Dave Tonge >>>>> wrote: >>>>> >>>>> Hi >>>>> >>>>> I'm currently working with the UK Open Banking Standard >>>>> and the OpenID Financial API >>>>> WG . >>>>> The issue of token binding is being discussed and I wanted to try out >>>>> an actual real world implementation. >>>>> After some research there don't seem to be many implementations in the >>>>> wild (unless I've missed something). >>>>> >>>>> It is supported in Chrome, but doesn't seem to be supported in OpenSSL >>>>> yet (and therefore not in Node.JS, Python, Ruby, etc. >>>>> I've opened an issue on the OpenSSL repo: >>>>> https://github.com/openssl/openssl/issues/1242 >>>>> >>>>> Is my understanding correct? How would you recommend trying out a a >>>>> live implementation of token binding? >>>>> >>>>> Thanks >>>>> >>>>> -- >>>>> Dave Tonge >>>>> CTO >>>>> 10 Temple Back | Bristol | BS1 6FL >>>>> t: +44 (0)117 280 5120 >>>>> m: +44 (0)7577 815570 >>>>> >>>>> Momentum Financial Technology Ltd is authorised and regulated by the >>>>> Financial Conduct Authority (Register number 561538). Registered in >>>>> England & Wales, company registration number 06909772. DISCLAIMER: >>>>> This email (including any attachments) is subject to copyright, and the >>>>> information in it is confidential. Use of this email or of any information >>>>> in it other than by the addressee is unauthorised and unlawful. Whilst >>>>> reasonable efforts are made to ensure that any attachments are virus-free, >>>>> it is the recipient's sole responsibility to scan all attachments for >>>>> viruses. All calls and emails to and from this company may be monitored and >>>>> recorded for legitimate purposes relating to this company's business. Any >>>>> opinions expressed in this email (or in any attachments) are those of the >>>>> author and do not necessarily represent the opinions of Momentum Financial >>>>> Technology Ltd or of any other group company. >>>>> _______________________________________________ >>>>> Unbearable mailing list >>>>> Unbearable@ietf.org >>>>> https://www.ietf.org/mailman/listinfo/unbearable >>>>> >>>>> >>>>> >>>>> _______________________________________________ >>>>> Unbearable mailing list >>>>> Unbearable@ietf.org >>>>> https://www.ietf.org/mailman/listinfo/unbearable >>>>> >>>>> >>>> >> -- Dave Tonge CTO 10 Temple Back | Bristol | BS1 6FL t: +44 (0)117 280 5120 m: +44 (0)7577 815570 Momentum Financial Technology Ltd is authorised and regulated by the Financial Conduct Authority (Register number 561538). Registered in England & Wales, company registration number 06909772. DISCLAIMER: This email (including any attachments) is subject to copyright, and the information in it is confidential. Use of this email or of any information in it other than by the addressee is unauthorised and unlawful. Whilst reasonable efforts are made to ensure that any attachments are virus-free, it is the recipient's sole responsibility to scan all attachments for viruses. All calls and emails to and from this company may be monitored and recorded for legitimate purposes relating to this company's business. Any opinions expressed in this email (or in any attachments) are those of the author and do not necessarily represent the opinions of Momentum Financial Technology Ltd or of any other group company. --047d7b86eac0b430cc0536401ddc Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Token Binding can be enabled via a flag in Chrom= e:=C2=A0chrome://flags/#enable-token-binding



On 27 June 2016 at 04:27, John Bradley <ve7jtb@ve7jtb.com> wrote:

Yes the server s= ide needs the most work.=C2=A0

I would like to see a reverse proxy with Token binding suppo= rt ASAP.=C2=A0

Windows 10 also supports a earlier draft of token binding.= =C2=A0 I think MS uses it for tokens on its own sites.=C2=A0=C2=A0 They hav= en't committed to timing on updating to the latest draft.=C2=A0

Getting this to RFC will help with getting people to update.= =C2=A0=C2=A0

John B.

On Jun 26, 2016 11:23 PM, "Ted Lemon" = <mellon@fugue.com<= /a>> wrote:
Ooh, cool!=C2=A0 I've been waiting a while for this (need t= he server side as well, of course)!=C2=A0
<= br>
On Sun, Jun 26, 2016 at 11:21 PM, John Bradle= y <ve7jtb@ve7jtb.com> wrote:

Yes, I beleave that it is also supported in one of the be= ta trains of Chrome if you turn on a flag.=C2=A0 Perhaps one of the Google = people can confirm that.

John B.

On Jun 26, 2016 11:19 PM, "Ted Lemon" = <mellon@fugue.com<= /a>> wrote:
John, does that mean that there is a version of Chromium that s= upports token binding?

On Tue, Jun 21, 2016 at 11:35 AM, John Bradley <ve7jtb@ve7jtb.c= om> wrote:
Currently if you are brave, there is a Python test serv= er as part of the Chromium project on Github for testing.

Last time I tried it you neede= d to checkout the whole project to get the test server to build. =C2=A0
I think they are working on making that easier.=C2=A0

=
Also as part of that project there is the Cronet http/TLS lib th= at can be used on iOS and Android.

We are hoping t= o include that as an option in the AppAuth project for token binding refres= h and access tokens on mobile.

https://github.com/openid
=
We are working/lobbying to get support included in more plac= es such as Python and Java.

I hope you can contrib= ute to the WG and help us move this spec to a RFC quickly by showing demand= .

Regards
John B.


On Jun 21, = 2016, at 10:55 AM, Dave Tonge <dave.tonge@momentumft.co.uk> wrote:
Hi
=
I'm currently working with the UK Open Banking Standard <= /a>and the OpenID = Financial API WG.=C2=A0
The issue of token binding is be= ing discussed and I wanted to try out an actual real world implementation.= =C2=A0
After some research there don't seem to be many i= mplementations in the wild (unless I've missed something).

It is supported in Chrome, but doesn't seem to b= e supported in OpenSSL yet (and therefore not in Node.JS, Python, Ruby, etc= .
I've opened an issue on the OpenSSL repo: https://gi= thub.com/openssl/openssl/issues/1242

Is my understanding correct? How would you recommend trying out a a live i= mplementation of token binding?

Thanks

--
Dave Tonge
CTO
10 Temple Back | Bristol | BS1 6FL
=C2=A0
Momentum Financial Technology Ltd is authorised and regulated by t= he Financial Conduct Authority (Register number=C2=A0561538). Registered in England &= Wales, company registration number=C2=A006909772.=C2=A0DISCLAIMER: This email (including any attachments) is subject to copy= right, and the information in it is confidential. Use of this email or of a= ny information in it other than by the addressee is unauthorised and unlawf= ul. Whilst reasonable efforts are made to ensure that any attachments are v= irus-free, it is the recipient's sole responsibility to scan all attach= ments for viruses. All calls and emails to and from this company may be mon= itored and recorded for legitimate purposes relating to this company's = business. Any opinions expressed in this email (or in any attachments) are = those of the author and do not necessarily represent the opinions of Moment= um Financial Technology Ltd or of any other group company.
_______________________________________________
Unbearable mailing list<= br>Unbearable@ietf= .org
https://www.ietf.org/mailman/listinfo/unbearable


____________________= ___________________________
Unbearable mailing list
Unbearable@ietf.or= g
https://www.ietf.org/mailman/listinfo/unbearable=






--
=
Dave Tonge
CTO
=
10 Temple Back | Bristol | BS1 6FL
t:=C2=A0+44 (0)117 280 5120
m:=C2=A0+44 (0)7577 815570
=C2=A0
Momentum Financial Technology Ltd is authorised and regulated by the Fi= nancial Conduct Authority (Register number=C2=A0561538). Registered in England & Wale= s, company registration number=C2=A006909772.=C2=A0DISCLAIMER: This email (including any attachments) is subject to copyright= , and the information in it is confidential. Use of this email or of any in= formation in it other than by the addressee is unauthorised and unlawful. W= hilst reasonable efforts are made to ensure that any attachments are virus-= free, it is the recipient's sole responsibility to scan all attachments= for viruses. All calls and emails to and from this company may be monitore= d and recorded for legitimate purposes relating to this company's busin= ess. Any opinions expressed in this email (or in any attachments) are those= of the author and do not necessarily represent the opinions of Momentum Fi= nancial Technology Ltd or of any other group company.
--047d7b86eac0b430cc0536401ddc-- From nobody Mon Jun 27 10:16:46 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6313E12D889 for ; Mon, 27 Jun 2016 10:16:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AyE3Ed9IQiah for ; Mon, 27 Jun 2016 10:16:40 -0700 (PDT) Received: from na01-bn1-obe.outbound.protection.outlook.com (mail-bn1on0718.outbound.protection.outlook.com [IPv6:2a01:111:f400:fc10::718]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8CC7F12D886 for ; Mon, 27 Jun 2016 10:16:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=n+hYxxMkdGh5IR3GyZfBTaBkmuEuYWUtSEYz+KMbfIE=; b=XIQTBjqhFDDC3cd7pZeozjgpdUI8LCR6tuAwl0NmpZp7z4Xmq8PzaSIRAE4D72hmN2eeWu0jTYIjMG8fxEFDE+LZUiJKN0LDL+Zy7y3TrtccthEjrvN46Slq4bxvjKB3xvqPGBk0bYkpYrmqCg9lkUEv9qz9A+wpLNzCSxUGIVI= Received: from BN3PR03MB1445.namprd03.prod.outlook.com (10.163.34.28) by BN3PR03MB1445.namprd03.prod.outlook.com (10.163.34.28) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.528.16; Mon, 27 Jun 2016 17:16:20 +0000 Received: from BN3PR03MB1445.namprd03.prod.outlook.com ([10.163.34.28]) by BN3PR03MB1445.namprd03.prod.outlook.com ([10.163.34.28]) with mapi id 15.01.0528.017; Mon, 27 Jun 2016 17:16:20 +0000 From: Andrei Popov To: John Bradley , Ted Lemon Thread-Topic: [Unbearable] Current implementations of token binding spec? Thread-Index: AQHRy81dQsbyqtIbvUuuTDArSnajE5/0DZWAgAigDQCAAADbAIAAAD2AgAABTwCAAONIUA== Date: Mon, 27 Jun 2016 17:16:19 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Andrei.Popov@microsoft.com; x-originating-ip: [2001:4898:80e8:e::1d2] x-ms-office365-filtering-correlation-id: 2f247e76-4fc6-4800-de92-08d39eaec1ce x-microsoft-exchange-diagnostics: 1; BN3PR03MB1445; 6:74vBpC6uqQU47MatMY7JhJaTupDgsp8jslrOLCFV87hfa6AqtOpYgknexWuFpcKS6ZPQ9ZTaSYb96YwxNfzsstNSN8usjNxxC1La7EHVtLx0n1GxqB7tITABZ6FWpuVBUoe/EnB9mV/NhozjCp/aad1lzoK+TYbbkhMmuJjCzMVi0vQtsC4zL9LhoM0J9ckKZIWqk/Q8wKCuudvo84bLGNRHJuY2An2rJkn9K8pFDfT/37GBrNBVz/Q4nqP16gorye+PwOyKKpIJu1AUZ8JI6tShuO9DlU3VJkHWsEkmgOjOeCa57v+/hVAtuCHZvMjcss9KIvfS5g0PvkqDKMvi2Q==; 5:bJhA6rb3DVSvTDuIgvQkCxkOoEr33Qc+j5Lp48v99YdnVZY+WzB38T/n8l4I2BpeaAIdjA0Q7q23V3ARyvmu+69HljkREv9Yv0x3MeSS8Q7yVs09Yls9NDqGJO1xZc4wGQAsok/0AEJ+R/wF3whHFA==; 24:ANrG2VgOFYvbRW7V0yATXuLfWTkiRQRED3Kpy6ZHsQ1iGMA1ZUJVqCJJD3+SHbJmLtpk3peNk1uSdTtqraDvsY4aLlMdcOHxGV2W3yQhjro=; 7:mdslEX7LTLYK1VsCcW0lPGQF+wTPMnUPoVhdXEefmiYxsGRSFNtbVFSUrcW46/T4vscurl6iunRR7v6yFW112WR+uhPjbOlLSfQJai+Ad7FL49uM/BttR7+Xsy50iMVUcl6Q2D4C3vp3GYexERRd7eumCQbnjMHSDS9pI1izMFRs93k5ijF2M6MEwhIPpCqmGmg3XLKOq7W9tc67M2esLf5VPfSQih05FHIjgCZiuktAMOUBEMRd37SN5rPlieaU x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:BN3PR03MB1445; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(158342451672863)(166708455590820)(21748063052155); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(601004)(2401047)(8121501046)(5005006)(10201501046)(3002001)(6055026)(61426038)(61427038); SRVR:BN3PR03MB1445; BCL:0; PCL:0; RULEID:; SRVR:BN3PR03MB1445; x-forefront-prvs: 09860C2161 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(7916002)(24454002)(38564003)(189002)(199003)(377454003)(2900100001)(189998001)(19617315012)(2950100001)(99286002)(68736007)(10090500001)(6116002)(102836003)(15395725005)(16236675004)(790700001)(74316001)(9686002)(76576001)(122556002)(8936002)(77096005)(3660700001)(5002640100001)(19300405004)(19580405001)(19580395003)(15975445007)(8990500004)(106356001)(7906003)(10400500002)(105586002)(10290500002)(93886004)(7736002)(7696003)(5003600100003)(97736004)(5001770100001)(3280700002)(2906002)(7846002)(8676002)(11100500001)(87936001)(54356999)(76176999)(92566002)(5890100001)(81156014)(19625215002)(50986999)(81166006)(101416001)(106116001)(5005710100001)(4326007)(86612001)(586003)(33656002)(86362001)(3826002); DIR:OUT; SFP:1102; SCL:1; SRVR:BN3PR03MB1445; H:BN3PR03MB1445.namprd03.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:1; LANG:en; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_BN3PR03MB144500B4817EB08ED040DBDB8C210BN3PR03MB1445namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 27 Jun 2016 17:16:20.0468 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN3PR03MB1445 Archived-At: Cc: Dave Tonge , "unbearable@ietf.org" Subject: Re: [Unbearable] Current implementations of token binding spec? X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Jun 2016 17:16:44 -0000 --_000_BN3PR03MB144500B4817EB08ED040DBDB8C210BN3PR03MB1445namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 w5ggIFdpbmRvd3MgMTAgYWxzbyBzdXBwb3J0cyBhIGVhcmxpZXIgZHJhZnQgb2YgdG9rZW4gYmlu ZGluZy4gIEkgdGhpbmsgTVMgdXNlcyBpdCBmb3IgdG9rZW5zIG9uIGl0cyBvd24gc2l0ZXMuDQpU aGlzIGlzIGNvcnJlY3QuDQoNCg0Kw5ggIEdldHRpbmcgdGhpcyB0byBSRkMgd2lsbCBoZWxwIHdp dGggZ2V0dGluZyBwZW9wbGUgdG8gdXBkYXRlLg0KSXQgZmVlbHMgbGlrZSBpdOKAmXMgdGltZSwg dG9vOiB3ZeKAmXZlIGJlZW4gdHdlYWtpbmcgdGhlIGxhbmd1YWdlIHNpbmNlIDIwMTUsIHdpdGhv dXQgYW55IGJpdHMtb24tdGhlLXdpcmUgY2hhbmdlcy4NCg0KQ2hlZXJzLA0KDQpBbmRyZWkNCg0K RnJvbTogVW5iZWFyYWJsZSBbbWFpbHRvOnVuYmVhcmFibGUtYm91bmNlc0BpZXRmLm9yZ10gT24g QmVoYWxmIE9mIEpvaG4gQnJhZGxleQ0KU2VudDogU3VuZGF5LCBKdW5lIDI2LCAyMDE2IDg6Mjcg UE0NClRvOiBUZWQgTGVtb24gPG1lbGxvbkBmdWd1ZS5jb20+DQpDYzogRGF2ZSBUb25nZSA8ZGF2 ZS50b25nZUBtb21lbnR1bWZ0LmNvLnVrPjsgdW5iZWFyYWJsZUBpZXRmLm9yZw0KU3ViamVjdDog UmU6IFtVbmJlYXJhYmxlXSBDdXJyZW50IGltcGxlbWVudGF0aW9ucyBvZiB0b2tlbiBiaW5kaW5n IHNwZWM/DQoNCg0KWWVzIHRoZSBzZXJ2ZXIgc2lkZSBuZWVkcyB0aGUgbW9zdCB3b3JrLg0KDQpJ IHdvdWxkIGxpa2UgdG8gc2VlIGEgcmV2ZXJzZSBwcm94eSB3aXRoIFRva2VuIGJpbmRpbmcgc3Vw cG9ydCBBU0FQLg0KDQpXaW5kb3dzIDEwIGFsc28gc3VwcG9ydHMgYSBlYXJsaWVyIGRyYWZ0IG9m IHRva2VuIGJpbmRpbmcuICBJIHRoaW5rIE1TIHVzZXMgaXQgZm9yIHRva2VucyBvbiBpdHMgb3du IHNpdGVzLiAgIFRoZXkgaGF2ZW4ndCBjb21taXR0ZWQgdG8gdGltaW5nIG9uIHVwZGF0aW5nIHRv IHRoZSBsYXRlc3QgZHJhZnQuDQoNCkdldHRpbmcgdGhpcyB0byBSRkMgd2lsbCBoZWxwIHdpdGgg Z2V0dGluZyBwZW9wbGUgdG8gdXBkYXRlLg0KDQpKb2huIEIuDQpPbiBKdW4gMjYsIDIwMTYgMTE6 MjMgUE0sICJUZWQgTGVtb24iIDxtZWxsb25AZnVndWUuY29tPG1haWx0bzptZWxsb25AZnVndWUu Y29tPj4gd3JvdGU6DQpPb2gsIGNvb2whICBJJ3ZlIGJlZW4gd2FpdGluZyBhIHdoaWxlIGZvciB0 aGlzIChuZWVkIHRoZSBzZXJ2ZXIgc2lkZSBhcyB3ZWxsLCBvZiBjb3Vyc2UpIQ0KDQpPbiBTdW4s IEp1biAyNiwgMjAxNiBhdCAxMToyMSBQTSwgSm9obiBCcmFkbGV5IDx2ZTdqdGJAdmU3anRiLmNv bTxtYWlsdG86dmU3anRiQHZlN2p0Yi5jb20+PiB3cm90ZToNCg0KWWVzLCBJIGJlbGVhdmUgdGhh dCBpdCBpcyBhbHNvIHN1cHBvcnRlZCBpbiBvbmUgb2YgdGhlIGJldGEgdHJhaW5zIG9mIENocm9t ZSBpZiB5b3UgdHVybiBvbiBhIGZsYWcuICBQZXJoYXBzIG9uZSBvZiB0aGUgR29vZ2xlIHBlb3Bs ZSBjYW4gY29uZmlybSB0aGF0Lg0KDQpKb2huIEIuDQpPbiBKdW4gMjYsIDIwMTYgMTE6MTkgUE0s ICJUZWQgTGVtb24iIDxtZWxsb25AZnVndWUuY29tPG1haWx0bzptZWxsb25AZnVndWUuY29tPj4g d3JvdGU6DQpKb2huLCBkb2VzIHRoYXQgbWVhbiB0aGF0IHRoZXJlIGlzIGEgdmVyc2lvbiBvZiBD aHJvbWl1bSB0aGF0IHN1cHBvcnRzIHRva2VuIGJpbmRpbmc/DQoNCk9uIFR1ZSwgSnVuIDIxLCAy MDE2IGF0IDExOjM1IEFNLCBKb2huIEJyYWRsZXkgPHZlN2p0YkB2ZTdqdGIuY29tPG1haWx0bzp2 ZTdqdGJAdmU3anRiLmNvbT4+IHdyb3RlOg0KQ3VycmVudGx5IGlmIHlvdSBhcmUgYnJhdmUsIHRo ZXJlIGlzIGEgUHl0aG9uIHRlc3Qgc2VydmVyIGFzIHBhcnQgb2YgdGhlIENocm9taXVtIHByb2pl Y3Qgb24gR2l0aHViIGZvciB0ZXN0aW5nLg0KaHR0cHM6Ly9naXRodWIuY29tL2Nocm9taXVtL2No cm9taXVtDQoNCkxhc3QgdGltZSBJIHRyaWVkIGl0IHlvdSBuZWVkZWQgdG8gY2hlY2tvdXQgdGhl IHdob2xlIHByb2plY3QgdG8gZ2V0IHRoZSB0ZXN0IHNlcnZlciB0byBidWlsZC4NCkkgdGhpbmsg dGhleSBhcmUgd29ya2luZyBvbiBtYWtpbmcgdGhhdCBlYXNpZXIuDQoNCkFsc28gYXMgcGFydCBv ZiB0aGF0IHByb2plY3QgdGhlcmUgaXMgdGhlIENyb25ldCBodHRwL1RMUyBsaWIgdGhhdCBjYW4g YmUgdXNlZCBvbiBpT1MgYW5kIEFuZHJvaWQuDQoNCldlIGFyZSBob3BpbmcgdG8gaW5jbHVkZSB0 aGF0IGFzIGFuIG9wdGlvbiBpbiB0aGUgQXBwQXV0aCBwcm9qZWN0IGZvciB0b2tlbiBiaW5kaW5n IHJlZnJlc2ggYW5kIGFjY2VzcyB0b2tlbnMgb24gbW9iaWxlLg0KDQpodHRwczovL2dpdGh1Yi5j b20vb3BlbmlkDQoNCldlIGFyZSB3b3JraW5nL2xvYmJ5aW5nIHRvIGdldCBzdXBwb3J0IGluY2x1 ZGVkIGluIG1vcmUgcGxhY2VzIHN1Y2ggYXMgUHl0aG9uIGFuZCBKYXZhLg0KDQpJIGhvcGUgeW91 IGNhbiBjb250cmlidXRlIHRvIHRoZSBXRyBhbmQgaGVscCB1cyBtb3ZlIHRoaXMgc3BlYyB0byBh IFJGQyBxdWlja2x5IGJ5IHNob3dpbmcgZGVtYW5kLg0KDQpSZWdhcmRzDQpKb2huIEIuDQoNCg0K T24gSnVuIDIxLCAyMDE2LCBhdCAxMDo1NSBBTSwgRGF2ZSBUb25nZSA8ZGF2ZS50b25nZUBtb21l bnR1bWZ0LmNvLnVrPG1haWx0bzpkYXZlLnRvbmdlQG1vbWVudHVtZnQuY28udWs+PiB3cm90ZToN Cg0KSGkNCg0KSSdtIGN1cnJlbnRseSB3b3JraW5nIHdpdGggdGhlIFVLIE9wZW4gQmFua2luZyBT dGFuZGFyZCA8aHR0cHM6Ly9naXRodWIuY29tL09wZW5CYW5raW5nU3RhbmRhcmQ+IGFuZCB0aGUg T3BlbklEIEZpbmFuY2lhbCBBUEkgV0c8aHR0cDovL29wZW5pZC5uZXQvd2cvZmFwaS8+Lg0KVGhl IGlzc3VlIG9mIHRva2VuIGJpbmRpbmcgaXMgYmVpbmcgZGlzY3Vzc2VkIGFuZCBJIHdhbnRlZCB0 byB0cnkgb3V0IGFuIGFjdHVhbCByZWFsIHdvcmxkIGltcGxlbWVudGF0aW9uLg0KQWZ0ZXIgc29t ZSByZXNlYXJjaCB0aGVyZSBkb24ndCBzZWVtIHRvIGJlIG1hbnkgaW1wbGVtZW50YXRpb25zIGlu IHRoZSB3aWxkICh1bmxlc3MgSSd2ZSBtaXNzZWQgc29tZXRoaW5nKS4NCg0KSXQgaXMgc3VwcG9y dGVkIGluIENocm9tZSwgYnV0IGRvZXNuJ3Qgc2VlbSB0byBiZSBzdXBwb3J0ZWQgaW4gT3BlblNT TCB5ZXQgKGFuZCB0aGVyZWZvcmUgbm90IGluIE5vZGUuSlMsIFB5dGhvbiwgUnVieSwgZXRjLg0K SSd2ZSBvcGVuZWQgYW4gaXNzdWUgb24gdGhlIE9wZW5TU0wgcmVwbzogaHR0cHM6Ly9naXRodWIu Y29tL29wZW5zc2wvb3BlbnNzbC9pc3N1ZXMvMTI0Mg0KDQpJcyBteSB1bmRlcnN0YW5kaW5nIGNv cnJlY3Q/IEhvdyB3b3VsZCB5b3UgcmVjb21tZW5kIHRyeWluZyBvdXQgYSBhIGxpdmUgaW1wbGVt ZW50YXRpb24gb2YgdG9rZW4gYmluZGluZz8NCg0KVGhhbmtzDQoNCi0tDQpEYXZlIFRvbmdlDQpD VE8NCjEwIFRlbXBsZSBCYWNrIHwgQnJpc3RvbCB8IEJTMSA2RkwNCnQ6ICs0NCAoMCkxMTcgMjgw IDUxMjA8dGVsOiUyQjQ0JTIwJTI4MCUyOTExNyUyMDI4MCUyMDUxMjA+DQptOiArNDQgKDApNzU3 NyA4MTU1NzA8dGVsOiUyQjQ0JTIwJTI4MCUyOTc1NzclMjA4MTU1NzA+DQoNCk1vbWVudHVtIEZp bmFuY2lhbCBUZWNobm9sb2d5IEx0ZCBpcyBhdXRob3Jpc2VkIGFuZCByZWd1bGF0ZWQgYnkgdGhl IEZpbmFuY2lhbCBDb25kdWN0IEF1dGhvcml0eSAoUmVnaXN0ZXIgbnVtYmVyIDU2MTUzOCkuIFJl Z2lzdGVyZWQgaW4gRW5nbGFuZCAmIFdhbGVzLCBjb21wYW55IHJlZ2lzdHJhdGlvbiBudW1iZXIg MDY5MDk3NzIuIERJU0NMQUlNRVI6IFRoaXMgZW1haWwgKGluY2x1ZGluZyBhbnkgYXR0YWNobWVu dHMpIGlzIHN1YmplY3QgdG8gY29weXJpZ2h0LCBhbmQgdGhlIGluZm9ybWF0aW9uIGluIGl0IGlz IGNvbmZpZGVudGlhbC4gVXNlIG9mIHRoaXMgZW1haWwgb3Igb2YgYW55IGluZm9ybWF0aW9uIGlu IGl0IG90aGVyIHRoYW4gYnkgdGhlIGFkZHJlc3NlZSBpcyB1bmF1dGhvcmlzZWQgYW5kIHVubGF3 ZnVsLiBXaGlsc3QgcmVhc29uYWJsZSBlZmZvcnRzIGFyZSBtYWRlIHRvIGVuc3VyZSB0aGF0IGFu eSBhdHRhY2htZW50cyBhcmUgdmlydXMtZnJlZSwgaXQgaXMgdGhlIHJlY2lwaWVudCdzIHNvbGUg cmVzcG9uc2liaWxpdHkgdG8gc2NhbiBhbGwgYXR0YWNobWVudHMgZm9yIHZpcnVzZXMuIEFsbCBj YWxscyBhbmQgZW1haWxzIHRvIGFuZCBmcm9tIHRoaXMgY29tcGFueSBtYXkgYmUgbW9uaXRvcmVk IGFuZCByZWNvcmRlZCBmb3IgbGVnaXRpbWF0ZSBwdXJwb3NlcyByZWxhdGluZyB0byB0aGlzIGNv bXBhbnkncyBidXNpbmVzcy4gQW55IG9waW5pb25zIGV4cHJlc3NlZCBpbiB0aGlzIGVtYWlsIChv ciBpbiBhbnkgYXR0YWNobWVudHMpIGFyZSB0aG9zZSBvZiB0aGUgYXV0aG9yIGFuZCBkbyBub3Qg bmVjZXNzYXJpbHkgcmVwcmVzZW50IHRoZSBvcGluaW9ucyBvZiBNb21lbnR1bSBGaW5hbmNpYWwg VGVjaG5vbG9neSBMdGQgb3Igb2YgYW55IG90aGVyIGdyb3VwIGNvbXBhbnkuDQpfX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KVW5iZWFyYWJsZSBtYWlsaW5n IGxpc3QNClVuYmVhcmFibGVAaWV0Zi5vcmc8bWFpbHRvOlVuYmVhcmFibGVAaWV0Zi5vcmc+DQpo dHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3VuYmVhcmFibGUNCg0KDQpfX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KVW5iZWFyYWJsZSBt YWlsaW5nIGxpc3QNClVuYmVhcmFibGVAaWV0Zi5vcmc8bWFpbHRvOlVuYmVhcmFibGVAaWV0Zi5v cmc+DQpodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3VuYmVhcmFibGUNCg0K DQo= --_000_BN3PR03MB144500B4817EB08ED040DBDB8C210BN3PR03MB1445namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 V2luZ2RpbmdzOw0KCXBhbm9zZS0xOjUgMCAwIDAgMCAwIDAgMCAwIDA7fQ0KQGZvbnQtZmFjZQ0K CXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2IDMg MiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1 IDUgMiAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJUcmVidWNoZXQg TVMiOw0KCXBhbm9zZS0xOjIgMTEgNiAzIDIgMiAyIDIgMiA0O30NCi8qIFN0eWxlIERlZmluaXRp b25zICovDQpwLk1zb05vcm1hbCwgbGkuTXNvTm9ybWFsLCBkaXYuTXNvTm9ybWFsDQoJe21hcmdp bjowaW47DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMi4wcHQ7DQoJZm9u dC1mYW1pbHk6IlRpbWVzIE5ldyBSb21hbiIsc2VyaWY7fQ0KYTpsaW5rLCBzcGFuLk1zb0h5cGVy bGluaw0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6Ymx1ZTsNCgl0ZXh0LWRlY29y YXRpb246dW5kZXJsaW5lO30NCmE6dmlzaXRlZCwgc3Bhbi5Nc29IeXBlcmxpbmtGb2xsb3dlZA0K CXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6cHVycGxlOw0KCXRleHQtZGVjb3JhdGlv bjp1bmRlcmxpbmU7fQ0KcA0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJbXNvLW1hcmdpbi10 b3AtYWx0OmF1dG87DQoJbWFyZ2luLXJpZ2h0OjBpbjsNCgltc28tbWFyZ2luLWJvdHRvbS1hbHQ6 YXV0bzsNCgltYXJnaW4tbGVmdDowaW47DQoJZm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWls eToiVGltZXMgTmV3IFJvbWFuIixzZXJpZjt9DQpwLk1zb0xpc3RQYXJhZ3JhcGgsIGxpLk1zb0xp c3RQYXJhZ3JhcGgsIGRpdi5Nc29MaXN0UGFyYWdyYXBoDQoJe21zby1zdHlsZS1wcmlvcml0eToz NDsNCgltYXJnaW4tdG9wOjBpbjsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1hcmdpbi1ib3R0b206 MGluOw0KCW1hcmdpbi1sZWZ0Oi41aW47DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQt c2l6ZToxMi4wcHQ7DQoJZm9udC1mYW1pbHk6IlRpbWVzIE5ldyBSb21hbiIsc2VyaWY7fQ0KcC5t c29ub3JtYWwwLCBsaS5tc29ub3JtYWwwLCBkaXYubXNvbm9ybWFsMA0KCXttc28tc3R5bGUtbmFt ZTptc29ub3JtYWw7DQoJbXNvLW1hcmdpbi10b3AtYWx0OmF1dG87DQoJbWFyZ2luLXJpZ2h0OjBp bjsNCgltc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzsNCgltYXJnaW4tbGVmdDowaW47DQoJZm9u dC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIixzZXJpZjt9DQpz cGFuLkVtYWlsU3R5bGUxOQ0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1yZXBseTsNCglmb250 LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjp3aW5kb3d0ZXh0O30NCi5Nc29D aHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0KCWZvbnQtZmFtaWx5OiJD YWxpYnJpIixzYW5zLXNlcmlmO30NCkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjguNWluIDEx LjBpbjsNCgltYXJnaW46MS4waW4gMS4waW4gMS4waW4gMS4waW47fQ0KZGl2LldvcmRTZWN0aW9u MQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQovKiBMaXN0IERlZmluaXRpb25zICovDQpAbGlzdCBs MA0KCXttc28tbGlzdC1pZDoxMDI4OTkyOTQ1Ow0KCW1zby1saXN0LXR5cGU6aHlicmlkOw0KCW1z by1saXN0LXRlbXBsYXRlLWlkczo2NTcxMjU1NTggODkzNzk5Mjg0IDY3Njk4NjkxIDY3Njk4Njkz IDY3Njk4Njg5IDY3Njk4NjkxIDY3Njk4NjkzIDY3Njk4Njg5IDY3Njk4NjkxIDY3Njk4NjkzO30N CkBsaXN0IGwwOmxldmVsMQ0KCXttc28tbGV2ZWwtc3RhcnQtYXQ6MTA1MTsNCgltc28tbGV2ZWwt bnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674OYOw0KCW1zby1sZXZlbC10 YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWlu ZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzOw0KCW1zby1mYXJlYXN0LWZvbnQt ZmFtaWx5OkNhbGlicmk7DQoJbXNvLWJpZGktZm9udC1mYW1pbHk6IlRpbWVzIE5ldyBSb21hbiI7 fQ0KQGxpc3QgbDA6bGV2ZWwyDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCglt c28tbGV2ZWwtdGV4dDpvOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1u dW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6 IkNvdXJpZXIgTmV3Ijt9DQpAbGlzdCBsMDpsZXZlbDMNCgl7bXNvLWxldmVsLW51bWJlci1mb3Jt YXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9u ZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWlu Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMDpsZXZlbDQNCgl7bXNvLWxldmVs LW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwt dGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1p bmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMDpsZXZlbDUNCgl7 bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Om87DQoJbXNv LWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0K CXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseToiQ291cmllciBOZXciO30NCkBsaXN0 IGwwOmxldmVsNg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVs LXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXIt cG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6V2luZ2Rp bmdzO30NCkBsaXN0IGwwOmxldmVsNw0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7 DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1s ZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1m YW1pbHk6U3ltYm9sO30NCkBsaXN0IGwwOmxldmVsOA0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1h dDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6bzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsN Cgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0K CWZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyI7fQ0KQGxpc3QgbDA6bGV2ZWw5DQoJe21zby1sZXZl bC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVs LXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQt aW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0Kb2wNCgl7bWFyZ2luLWJv dHRvbTowaW47fQ0KdWwNCgl7bWFyZ2luLWJvdHRvbTowaW47fQ0KLS0+PC9zdHlsZT48IS0tW2lm IGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlZGVmYXVsdHMgdjpleHQ9ImVkaXQiIHNwaWRtYXg9 IjEwMjYiIC8+DQo8L3htbD48IVtlbmRpZl0tLT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxv OnNoYXBlbGF5b3V0IHY6ZXh0PSJlZGl0Ij4NCjxvOmlkbWFwIHY6ZXh0PSJlZGl0IiBkYXRhPSIx IiAvPg0KPC9vOnNoYXBlbGF5b3V0PjwveG1sPjwhW2VuZGlmXS0tPg0KPC9oZWFkPg0KPGJvZHkg bGFuZz0iRU4tVVMiIGxpbms9ImJsdWUiIHZsaW5rPSJwdXJwbGUiPg0KPGRpdiBjbGFzcz0iV29y ZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBoIiBzdHlsZT0idGV4dC1pbmRl bnQ6LS4yNWluO21zby1saXN0OmwwIGxldmVsMSBsZm8xIj48IVtpZiAhc3VwcG9ydExpc3RzXT48 c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6V2luZ2RpbmdzIj48c3BhbiBzdHlsZT0ibXNvLWxpc3Q6 SWdub3JlIj7DmDxzcGFuIHN0eWxlPSJmb250OjcuMHB0ICZxdW90O1RpbWVzIE5ldyBSb21hbiZx dW90OyI+Jm5ic3A7DQo8L3NwYW4+PC9zcGFuPjwvc3Bhbj48IVtlbmRpZl0+V2luZG93cyAxMCBh bHNvIHN1cHBvcnRzIGEgZWFybGllciBkcmFmdCBvZiB0b2tlbiBiaW5kaW5nLiZuYnNwOyBJIHRo aW5rIE1TIHVzZXMgaXQgZm9yIHRva2VucyBvbiBpdHMgb3duIHNpdGVzLiZuYnNwOyZuYnNwOzxv OnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5UaGlz IGlzIGNvcnJlY3QuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZx dW90OyxzYW5zLXNlcmlmIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvTGlzdFBhcmFncmFwaCIgc3R5bGU9InRleHQtaW5kZW50Oi0uMjVpbjttc28tbGlzdDpsMCBs ZXZlbDEgbGZvMSI+PCFbaWYgIXN1cHBvcnRMaXN0c10+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6V2luZ2RpbmdzIj48c3BhbiBzdHlsZT0ibXNvLWxpc3Q6SWdub3Jl Ij7DmDxzcGFuIHN0eWxlPSJmb250OjcuMHB0ICZxdW90O1RpbWVzIE5ldyBSb21hbiZxdW90OyI+ Jm5ic3A7DQo8L3NwYW4+PC9zcGFuPjwvc3Bhbj48IVtlbmRpZl0+R2V0dGluZyB0aGlzIHRvIFJG QyB3aWxsIGhlbHAgd2l0aCBnZXR0aW5nIHBlb3BsZSB0byB1cGRhdGUuPHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlm Ij48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMt c2VyaWYiPkl0IGZlZWxzIGxpa2UgaXTigJlzIHRpbWUsIHRvbzogd2XigJl2ZSBiZWVuIHR3ZWFr aW5nIHRoZSBsYW5ndWFnZSBzaW5jZSAyMDE1LCB3aXRob3V0IGFueSBiaXRzLW9uLXRoZS13aXJl IGNoYW5nZXMuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD YWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkNoZWVycyw8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+Jm5ic3A7PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+QW5kcmVpPG86 cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlm Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1 b3Q7LHNhbnMtc2VyaWYiPkZyb206PC9zcGFuPjwvYj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiBVbmJlYXJh YmxlIFttYWlsdG86dW5iZWFyYWJsZS1ib3VuY2VzQGlldGYub3JnXQ0KPGI+T24gQmVoYWxmIE9m IDwvYj5Kb2huIEJyYWRsZXk8YnI+DQo8Yj5TZW50OjwvYj4gU3VuZGF5LCBKdW5lIDI2LCAyMDE2 IDg6MjcgUE08YnI+DQo8Yj5Ubzo8L2I+IFRlZCBMZW1vbiAmbHQ7bWVsbG9uQGZ1Z3VlLmNvbSZn dDs8YnI+DQo8Yj5DYzo8L2I+IERhdmUgVG9uZ2UgJmx0O2RhdmUudG9uZ2VAbW9tZW50dW1mdC5j by51ayZndDs7IHVuYmVhcmFibGVAaWV0Zi5vcmc8YnI+DQo8Yj5TdWJqZWN0OjwvYj4gUmU6IFtV bmJlYXJhYmxlXSBDdXJyZW50IGltcGxlbWVudGF0aW9ucyBvZiB0b2tlbiBiaW5kaW5nIHNwZWM/ PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8 L286cD48L3A+DQo8cD5ZZXMgdGhlIHNlcnZlciBzaWRlIG5lZWRzIHRoZSBtb3N0IHdvcmsuJm5i c3A7IDxvOnA+PC9vOnA+PC9wPg0KPHA+SSB3b3VsZCBsaWtlIHRvIHNlZSBhIHJldmVyc2UgcHJv eHkgd2l0aCBUb2tlbiBiaW5kaW5nIHN1cHBvcnQgQVNBUC4mbmJzcDsgPG86cD48L286cD48L3A+ DQo8cD5XaW5kb3dzIDEwIGFsc28gc3VwcG9ydHMgYSBlYXJsaWVyIGRyYWZ0IG9mIHRva2VuIGJp bmRpbmcuJm5ic3A7IEkgdGhpbmsgTVMgdXNlcyBpdCBmb3IgdG9rZW5zIG9uIGl0cyBvd24gc2l0 ZXMuJm5ic3A7Jm5ic3A7IFRoZXkgaGF2ZW4ndCBjb21taXR0ZWQgdG8gdGltaW5nIG9uIHVwZGF0 aW5nIHRvIHRoZSBsYXRlc3QgZHJhZnQuJm5ic3A7DQo8bzpwPjwvbzpwPjwvcD4NCjxwPkdldHRp bmcgdGhpcyB0byBSRkMgd2lsbCBoZWxwIHdpdGggZ2V0dGluZyBwZW9wbGUgdG8gdXBkYXRlLiZu YnNwOyZuYnNwOyA8bzpwPjwvbzpwPjwvcD4NCjxwPkpvaG4gQi4gPG86cD48L286cD48L3A+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+T24gSnVuIDI2LCAyMDE2IDExOjIzIFBNLCAmcXVv dDtUZWQgTGVtb24mcXVvdDsgJmx0OzxhIGhyZWY9Im1haWx0bzptZWxsb25AZnVndWUuY29tIj5t ZWxsb25AZnVndWUuY29tPC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8YmxvY2txdW90 ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRk aW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi1yaWdodDowaW4i Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk9vaCwgY29vbCEmbmJzcDsgSSd2ZSBiZWVu IHdhaXRpbmcgYSB3aGlsZSBmb3IgdGhpcyAobmVlZCB0aGUgc2VydmVyIHNpZGUgYXMgd2VsbCwg b2YgY291cnNlKSEmbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPk9uIFN1biwgSnVuIDI2LCAyMDE2IGF0IDExOjIxIFBNLCBKb2huIEJyYWRsZXkgJmx0 OzxhIGhyZWY9Im1haWx0bzp2ZTdqdGJAdmU3anRiLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPnZlN2p0 YkB2ZTdqdGIuY29tPC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8YmxvY2txdW90ZSBz dHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRkaW5n OjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi1yaWdodDowaW4iPg0K PHA+WWVzLCBJIGJlbGVhdmUgdGhhdCBpdCBpcyBhbHNvIHN1cHBvcnRlZCBpbiBvbmUgb2YgdGhl IGJldGEgdHJhaW5zIG9mIENocm9tZSBpZiB5b3UgdHVybiBvbiBhIGZsYWcuJm5ic3A7IFBlcmhh cHMgb25lIG9mIHRoZSBHb29nbGUgcGVvcGxlIGNhbiBjb25maXJtIHRoYXQuDQo8bzpwPjwvbzpw PjwvcD4NCjxwPkpvaG4gQi4gPG86cD48L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj5PbiBKdW4gMjYsIDIwMTYgMTE6MTkgUE0sICZxdW90O1RlZCBM ZW1vbiZxdW90OyAmbHQ7PGEgaHJlZj0ibWFpbHRvOm1lbGxvbkBmdWd1ZS5jb20iIHRhcmdldD0i X2JsYW5rIj5tZWxsb25AZnVndWUuY29tPC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8 YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAx LjBwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi1y aWdodDowaW4iPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkpvaG4sIGRvZXMgdGhhdCBt ZWFuIHRoYXQgdGhlcmUgaXMgYSB2ZXJzaW9uIG9mIENocm9taXVtIHRoYXQgc3VwcG9ydHMgdG9r ZW4gYmluZGluZz88bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi Pk9uIFR1ZSwgSnVuIDIxLCAyMDE2IGF0IDExOjM1IEFNLCBKb2huIEJyYWRsZXkgJmx0OzxhIGhy ZWY9Im1haWx0bzp2ZTdqdGJAdmU3anRiLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPnZlN2p0YkB2ZTdq dGIuY29tPC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8YmxvY2txdW90ZSBzdHlsZT0i Ym9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRkaW5nOjBpbiAw aW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi1yaWdodDowaW4iPg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPkN1cnJlbnRseSBpZiB5b3UgYXJlIGJyYXZlLCB0aGVyZSBp cyBhIFB5dGhvbiB0ZXN0IHNlcnZlciBhcyBwYXJ0IG9mIHRoZSBDaHJvbWl1bSBwcm9qZWN0IG9u IEdpdGh1YiBmb3IgdGVzdGluZy48bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48YSBocmVmPSJodHRwczovL2dpdGh1Yi5jb20vY2hyb21pdW0vY2hyb21pdW0iIHRh cmdldD0iX2JsYW5rIj5odHRwczovL2dpdGh1Yi5jb20vY2hyb21pdW0vY2hyb21pdW08L2E+PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZu YnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkxhc3Qg dGltZSBJIHRyaWVkIGl0IHlvdSBuZWVkZWQgdG8gY2hlY2tvdXQgdGhlIHdob2xlIHByb2plY3Qg dG8gZ2V0IHRoZSB0ZXN0IHNlcnZlciB0byBidWlsZC4gJm5ic3A7PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JIHRoaW5rIHRoZXkgYXJlIHdvcmtp bmcgb24gbWFraW5nIHRoYXQgZWFzaWVyLiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5BbHNvIGFzIHBhcnQgb2YgdGhhdCBwcm9qZWN0 IHRoZXJlIGlzIHRoZSBDcm9uZXQgaHR0cC9UTFMgbGliIHRoYXQgY2FuIGJlIHVzZWQgb24gaU9T IGFuZCBBbmRyb2lkLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj5XZSBhcmUgaG9waW5nIHRvIGluY2x1ZGUgdGhhdCBhcyBhbiBvcHRpb24gaW4g dGhlIEFwcEF1dGggcHJvamVjdCBmb3IgdG9rZW4gYmluZGluZyByZWZyZXNoIGFuZCBhY2Nlc3Mg dG9rZW5zIG9uIG1vYmlsZS48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PGEgaHJlZj0iaHR0cHM6Ly9naXRodWIuY29tL29wZW5pZCIgdGFyZ2V0 PSJfYmxhbmsiPmh0dHBzOi8vZ2l0aHViLmNvbS9vcGVuaWQ8L2E+PG86cD48L286cD48L3A+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5XZSBhcmUgd29ya2luZy9sb2JieWluZyB0byBn ZXQgc3VwcG9ydCBpbmNsdWRlZCBpbiBtb3JlIHBsYWNlcyBzdWNoIGFzIFB5dGhvbiBhbmQgSmF2 YS48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxv OnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ SSBob3BlIHlvdSBjYW4gY29udHJpYnV0ZSB0byB0aGUgV0cgYW5kIGhlbHAgdXMgbW92ZSB0aGlz IHNwZWMgdG8gYSBSRkMgcXVpY2tseSBieSBzaG93aW5nIGRlbWFuZC48bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+UmVnYXJkczxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Sm9obiBCLjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8 L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNw OzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFy Z2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPk9uIEp1biAyMSwgMjAxNiwgYXQgMTA6NTUgQU0sIERhdmUg VG9uZ2UgJmx0OzxhIGhyZWY9Im1haWx0bzpkYXZlLnRvbmdlQG1vbWVudHVtZnQuY28udWsiIHRh cmdldD0iX2JsYW5rIj5kYXZlLnRvbmdlQG1vbWVudHVtZnQuY28udWs8L2E+Jmd0OyB3cm90ZTo8 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8 L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7 VHJlYnVjaGV0IE1TJnF1b3Q7LHNhbnMtc2VyaWYiPkhpPG86cD48L286cD48L3NwYW4+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFt aWx5OiZxdW90O1RyZWJ1Y2hldCBNUyZxdW90OyxzYW5zLXNlcmlmIj48bzpwPiZuYnNwOzwvbzpw Pjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7VHJlYnVjaGV0IE1TJnF1b3Q7LHNhbnMtc2VyaWYiPkkn bSBjdXJyZW50bHkgd29ya2luZyB3aXRoIHRoZQ0KPGEgaHJlZj0iaHR0cHM6Ly9naXRodWIuY29t L09wZW5CYW5raW5nU3RhbmRhcmQiIHRhcmdldD0iX2JsYW5rIj5VSyBPcGVuIEJhbmtpbmcgU3Rh bmRhcmQNCjwvYT5hbmQgdGhlIDxhIGhyZWY9Imh0dHA6Ly9vcGVuaWQubmV0L3dnL2ZhcGkvIiB0 YXJnZXQ9Il9ibGFuayI+T3BlbklEIEZpbmFuY2lhbCBBUEkgV0c8L2E+LiZuYnNwOzxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtUcmVidWNoZXQgTVMmcXVvdDssc2Fucy1zZXJpZiI+ VGhlIGlzc3VlIG9mIHRva2VuIGJpbmRpbmcgaXMgYmVpbmcgZGlzY3Vzc2VkIGFuZCBJIHdhbnRl ZCB0byB0cnkgb3V0IGFuIGFjdHVhbCByZWFsIHdvcmxkIGltcGxlbWVudGF0aW9uLiZuYnNwOzxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtUcmVidWNoZXQgTVMmcXVvdDssc2Fucy1z ZXJpZiI+QWZ0ZXIgc29tZSByZXNlYXJjaCB0aGVyZSBkb24ndCBzZWVtIHRvIGJlIG1hbnkgaW1w bGVtZW50YXRpb25zIGluIHRoZSB3aWxkICh1bmxlc3MgSSd2ZSBtaXNzZWQgc29tZXRoaW5nKS48 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7VHJlYnVjaGV0IE1TJnF1b3Q7LHNhbnMt c2VyaWYiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtUcmVidWNoZXQg TVMmcXVvdDssc2Fucy1zZXJpZiI+SXQgaXMgc3VwcG9ydGVkIGluIENocm9tZSwgYnV0IGRvZXNu J3Qgc2VlbSB0byBiZSBzdXBwb3J0ZWQgaW4gT3BlblNTTCB5ZXQgKGFuZCB0aGVyZWZvcmUgbm90 IGluIE5vZGUuSlMsIFB5dGhvbiwgUnVieSwgZXRjLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWls eTomcXVvdDtUcmVidWNoZXQgTVMmcXVvdDssc2Fucy1zZXJpZiI+SSd2ZSBvcGVuZWQgYW4gaXNz dWUgb24gdGhlIE9wZW5TU0wgcmVwbzoNCjxhIGhyZWY9Imh0dHBzOi8vZ2l0aHViLmNvbS9vcGVu c3NsL29wZW5zc2wvaXNzdWVzLzEyNDIiIHRhcmdldD0iX2JsYW5rIj5odHRwczovL2dpdGh1Yi5j b20vb3BlbnNzbC9vcGVuc3NsL2lzc3Vlcy8xMjQyPC9hPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZh bWlseTomcXVvdDtUcmVidWNoZXQgTVMmcXVvdDssc2Fucy1zZXJpZiI+PG86cD4mbmJzcDs8L286 cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O1RyZWJ1Y2hldCBNUyZxdW90OyxzYW5zLXNlcmlmIj5J cyBteSB1bmRlcnN0YW5kaW5nIGNvcnJlY3Q/IEhvdyB3b3VsZCB5b3UgcmVjb21tZW5kIHRyeWlu ZyBvdXQgYSBhIGxpdmUgaW1wbGVtZW50YXRpb24gb2YgdG9rZW4gYmluZGluZz88bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7VHJlYnVjaGV0IE1TJnF1b3Q7LHNhbnMtc2VyaWYiPjxv OnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtUcmVidWNoZXQgTVMmcXVvdDss c2Fucy1zZXJpZiI+VGhhbmtzPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPi0tIDxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0K PGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtBcmlhbCZx dW90OyxzYW5zLXNlcmlmO2NvbG9yOiNEQzI5MUUiPkRhdmUgVG9uZ2U8bzpwPjwvbzpwPjwvc3Bh bj48L2I+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNl cmlmO2NvbG9yOiMxNjJCNDgiPkNUTzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMTYyQjQ4Ij48bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7 LHNhbnMtc2VyaWY7Y29sb3I6IzE2MkI0OCI+MTAgVGVtcGxlIEJhY2sgfCBCcmlzdG9sIHwgQlMx IDZGTDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojREMyOTFFIj50OiZuYnNwOzwvc3Bhbj48L2I+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90 OyxzYW5zLXNlcmlmO2NvbG9yOiMxNjJCNDgiPjxhIGhyZWY9InRlbDolMkI0NCUyMCUyODAlMjkx MTclMjAyODAlMjA1MTIwIiB0YXJnZXQ9Il9ibGFuayI+JiM0Mzs0NCAoMCkxMTcNCiAyODAgNTEy MDwvYT48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjguMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6I0RDMjkxRSI+bTombmJzcDs8L3NwYW4+PC9i PjxzcGFuIHN0eWxlPSJmb250LXNpemU6OC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVv dDssc2Fucy1zZXJpZjtjb2xvcjojMTYyQjQ4Ij48YSBocmVmPSJ0ZWw6JTJCNDQlMjAlMjgwJTI5 NzU3NyUyMDgxNTU3MCIgdGFyZ2V0PSJfYmxhbmsiPiYjNDM7NDQgKDApNzU3Nw0KIDgxNTU3MDwv YT48L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtB cmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxNjJCNDgiPjxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xv cjojMTYyQjQ4Ij4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMTYyQjQ4Ij5N b21lbnR1bSBGaW5hbmNpYWwgVGVjaG5vbG9neSBMdGQgaXMgYXV0aG9yaXNlZCBhbmQgcmVndWxh dGVkIGJ5IHRoZSBGaW5hbmNpYWwgQ29uZHVjdCBBdXRob3JpdHkgKFJlZ2lzdGVyIG51bWJlciZu YnNwOzwvc3Bhbj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6I0RDMjkxRSI+NTYxNTM4PC9zcGFuPjwv Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1 b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzE2MkI0OCI+KS4NCiBSZWdpc3RlcmVkIGluIEVuZ2xhbmQg JmFtcDsgV2FsZXMsIGNvbXBhbnkgcmVnaXN0cmF0aW9uIG51bWJlciZuYnNwOzwvc3Bhbj48Yj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7 LHNhbnMtc2VyaWY7Y29sb3I6I0RDMjkxRSI+MDY5MDk3NzI8L3NwYW4+PC9iPjxzcGFuIHN0eWxl PSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJp Zjtjb2xvcjojMTYyQjQ4Ij4uJm5ic3A7PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojODg4ODg4 Ij5ESVNDTEFJTUVSOg0KIFRoaXMgZW1haWwgKGluY2x1ZGluZyBhbnkgYXR0YWNobWVudHMpIGlz IHN1YmplY3QgdG8gY29weXJpZ2h0LCBhbmQgdGhlIGluZm9ybWF0aW9uIGluIGl0IGlzIGNvbmZp ZGVudGlhbC4gVXNlIG9mIHRoaXMgZW1haWwgb3Igb2YgYW55IGluZm9ybWF0aW9uIGluIGl0IG90 aGVyIHRoYW4gYnkgdGhlIGFkZHJlc3NlZSBpcyB1bmF1dGhvcmlzZWQgYW5kIHVubGF3ZnVsLiBX aGlsc3QgcmVhc29uYWJsZSBlZmZvcnRzIGFyZSBtYWRlIHRvIGVuc3VyZQ0KIHRoYXQgYW55IGF0 dGFjaG1lbnRzIGFyZSB2aXJ1cy1mcmVlLCBpdCBpcyB0aGUgcmVjaXBpZW50J3Mgc29sZSByZXNw b25zaWJpbGl0eSB0byBzY2FuIGFsbCBhdHRhY2htZW50cyBmb3IgdmlydXNlcy4gQWxsIGNhbGxz IGFuZCBlbWFpbHMgdG8gYW5kIGZyb20gdGhpcyBjb21wYW55IG1heSBiZSBtb25pdG9yZWQgYW5k IHJlY29yZGVkIGZvciBsZWdpdGltYXRlIHB1cnBvc2VzIHJlbGF0aW5nIHRvIHRoaXMgY29tcGFu eSdzIGJ1c2luZXNzLiBBbnkNCiBvcGluaW9ucyBleHByZXNzZWQgaW4gdGhpcyBlbWFpbCAob3Ig aW4gYW55IGF0dGFjaG1lbnRzKSBhcmUgdGhvc2Ugb2YgdGhlIGF1dGhvciBhbmQgZG8gbm90IG5l Y2Vzc2FyaWx5IHJlcHJlc2VudCB0aGUgb3BpbmlvbnMgb2YgTW9tZW50dW0gRmluYW5jaWFsIFRl Y2hub2xvZ3kgTHRkIG9yIG9mIGFueSBvdGhlciBncm91cCBjb21wYW55Ljwvc3Bhbj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMt c2VyaWY7Y29sb3I6IzE2MkI0OCI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rp dj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2 Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fXzxicj4NClVuYmVhcmFibGUgbWFpbGluZyBsaXN0PGJyPg0K PGEgaHJlZj0ibWFpbHRvOlVuYmVhcmFibGVAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj5VbmJl YXJhYmxlQGlldGYub3JnPC9hPjxicj4NCjxhIGhyZWY9Imh0dHBzOi8vd3d3LmlldGYub3JnL21h aWxtYW4vbGlzdGluZm8vdW5iZWFyYWJsZSIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vd3d3Lmll dGYub3JnL21haWxtYW4vbGlzdGluZm8vdW5iZWFyYWJsZTwvYT48bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZu YnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtYXJnaW4tYm90dG9tOjEyLjBwdCI+PGJyPg0KX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX188YnI+DQpVbmJlYXJhYmxlIG1haWxpbmcgbGlz dDxicj4NCjxhIGhyZWY9Im1haWx0bzpVbmJlYXJhYmxlQGlldGYub3JnIiB0YXJnZXQ9Il9ibGFu ayI+VW5iZWFyYWJsZUBpZXRmLm9yZzwvYT48YnI+DQo8YSBocmVmPSJodHRwczovL3d3dy5pZXRm Lm9yZy9tYWlsbWFuL2xpc3RpbmZvL3VuYmVhcmFibGUiIHRhcmdldD0iX2JsYW5rIj5odHRwczov L3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3VuYmVhcmFibGU8L2E+PG86cD48L286cD48 L3A+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5i c3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9k aXY+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5i c3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9i b2R5Pg0KPC9odG1sPg0K --_000_BN3PR03MB144500B4817EB08ED040DBDB8C210BN3PR03MB1445namp_-- From nobody Mon Jun 27 10:17:44 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4DDBF12D885 for ; Mon, 27 Jun 2016 10:17:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.126 X-Spam-Level: X-Spam-Status: No, score=-4.126 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-1.426, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fZ6q_DBzZqmd for ; Mon, 27 Jun 2016 10:17:39 -0700 (PDT) Received: from mail-vk0-x235.google.com (mail-vk0-x235.google.com [IPv6:2607:f8b0:400c:c05::235]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A238712D88A for ; Mon, 27 Jun 2016 10:17:37 -0700 (PDT) Received: by mail-vk0-x235.google.com with SMTP id j3so28108632vkb.0 for ; Mon, 27 Jun 2016 10:17:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=kodg0A7Tuim+7yRA8d03VMOtb5byn0o6YyXl+aN2uoM=; b=jeUndEX78LrCa22Vf17S1S3PQo/q6QTMBlO2qS3Y+cKG/HVziygJr+HLCkS4+lcLv8 zN9aN1z532FoFrHy+juZ2528jRBzfqCIC0bpMwBq3jkgGqjTltq2t+G9XlJN0iKJtM1s qwHpvfWrEQYMbnqGNsqWf3ZuvFn6KpSKMFcdLNE0Sc/A0ehDiR3WKahuzOCQu124+6qB tpkaEI1aYz5ebkokX4mNIiVcp3ZsZU/3F85KsUaLAGeSEt8A4d6/Z+46+eg9V5505Pun oDgV/qDOyUyysPYql0ezRZ8hc5b+WhqUlqx3+zyT7oKBUwReDHEVXY170fflou7/uVOB Ix1w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=kodg0A7Tuim+7yRA8d03VMOtb5byn0o6YyXl+aN2uoM=; b=W5iNg9E5rUfkdwVAVn4Xlzat8onef5BQ+FxSDGRosxAbfGSQKbTmeutYnr1dxSBZUx jr+8qBT28J94Ojn6/2tqqECbNRo4M0fWvoqphyQaXiO0GSjvYi5m7Hi+HAAEthjqy84+ KyQz9pb0D3XKRANCJKZNJ/TLvlZbUonLVLYUqapW+8dW3LtnbOtvJKXSkTpI9JfKRm6V ZOiCDlNTRaORtCylde9dsZ5P2mpLy0k8ddd4ydQ3W1fpGQC+R1TUNjAT0WUQhpY/o75c zrSkE8Da3zhVslg8zIIfaC42YsKgc3p52ht+2Y1syZDR6DJxoQN1AL5HOz7d2mxdGEuy AvJg== X-Gm-Message-State: ALyK8tLHTwOD0LsTq0Sd0kI+g6jdsMke9EYLucbAAPri3t4E0qsbRoH2/Kh73C54UM9T6YPy656G8h4PZYa8lr4u X-Received: by 10.31.51.68 with SMTP id z65mr7777870vkz.10.1467047856414; Mon, 27 Jun 2016 10:17:36 -0700 (PDT) MIME-Version: 1.0 Received: by 10.31.51.69 with HTTP; Mon, 27 Jun 2016 10:17:16 -0700 (PDT) In-Reply-To: References: From: Nick Harper Date: Mon, 27 Jun 2016 10:17:16 -0700 Message-ID: To: Dave Tonge Content-Type: multipart/alternative; boundary=001a1144a44e5a25a1053645b231 Archived-At: Cc: John Bradley , IETF Tokbind WG , Ted Lemon Subject: Re: [Unbearable] Current implementations of token binding spec? X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Jun 2016 17:17:42 -0000 --001a1144a44e5a25a1053645b231 Content-Type: text/plain; charset=UTF-8 Chromium has support for draft 05 of Token Binding, although our signature construction is incorrect (it is a DER-encoded ECDSA-Sig-Value instead of the raw 32-byte integers R and S). I will be updating it to draft 06 (to fix the signature format). On Mon, Jun 27, 2016 at 3:37 AM, Dave Tonge wrote: > Token Binding can be enabled via a flag in > Chrome: chrome://flags/#enable-token-binding > > > > On 27 June 2016 at 04:27, John Bradley wrote: > >> Yes the server side needs the most work. >> >> I would like to see a reverse proxy with Token binding support ASAP. >> >> Windows 10 also supports a earlier draft of token binding. I think MS >> uses it for tokens on its own sites. They haven't committed to timing on >> updating to the latest draft. >> >> Getting this to RFC will help with getting people to update. >> >> John B. >> On Jun 26, 2016 11:23 PM, "Ted Lemon" wrote: >> >>> Ooh, cool! I've been waiting a while for this (need the server side as >>> well, of course)! >>> >>> On Sun, Jun 26, 2016 at 11:21 PM, John Bradley >>> wrote: >>> >>>> Yes, I beleave that it is also supported in one of the beta trains of >>>> Chrome if you turn on a flag. Perhaps one of the Google people can confirm >>>> that. >>>> >>>> John B. >>>> On Jun 26, 2016 11:19 PM, "Ted Lemon" wrote: >>>> >>>>> John, does that mean that there is a version of Chromium that supports >>>>> token binding? >>>>> >>>>> On Tue, Jun 21, 2016 at 11:35 AM, John Bradley >>>>> wrote: >>>>> >>>>>> Currently if you are brave, there is a Python test server as part of >>>>>> the Chromium project on Github for testing. >>>>>> https://github.com/chromium/chromium >>>>>> >>>>>> Last time I tried it you needed to checkout the whole project to get >>>>>> the test server to build. >>>>>> I think they are working on making that easier. >>>>>> >>>>>> Also as part of that project there is the Cronet http/TLS lib that >>>>>> can be used on iOS and Android. >>>>>> >>>>>> We are hoping to include that as an option in the AppAuth project for >>>>>> token binding refresh and access tokens on mobile. >>>>>> >>>>>> https://github.com/openid >>>>>> >>>>>> We are working/lobbying to get support included in more places such >>>>>> as Python and Java. >>>>>> >>>>>> I hope you can contribute to the WG and help us move this spec to a >>>>>> RFC quickly by showing demand. >>>>>> >>>>>> Regards >>>>>> John B. >>>>>> >>>>>> >>>>>> On Jun 21, 2016, at 10:55 AM, Dave Tonge >>>>>> wrote: >>>>>> >>>>>> Hi >>>>>> >>>>>> I'm currently working with the UK Open Banking Standard >>>>>> and the OpenID Financial API >>>>>> WG . >>>>>> The issue of token binding is being discussed and I wanted to try out >>>>>> an actual real world implementation. >>>>>> After some research there don't seem to be many implementations in >>>>>> the wild (unless I've missed something). >>>>>> >>>>>> It is supported in Chrome, but doesn't seem to be supported in >>>>>> OpenSSL yet (and therefore not in Node.JS, Python, Ruby, etc. >>>>>> I've opened an issue on the OpenSSL repo: >>>>>> https://github.com/openssl/openssl/issues/1242 >>>>>> >>>>>> Is my understanding correct? How would you recommend trying out a a >>>>>> live implementation of token binding? >>>>>> >>>>>> Thanks >>>>>> >>>>>> -- >>>>>> Dave Tonge >>>>>> CTO >>>>>> 10 Temple Back | Bristol | BS1 6FL >>>>>> t: +44 (0)117 280 5120 >>>>>> m: +44 (0)7577 815570 >>>>>> >>>>>> Momentum Financial Technology Ltd is authorised and regulated by the >>>>>> Financial Conduct Authority (Register number 561538). Registered in >>>>>> England & Wales, company registration number 06909772. DISCLAIMER: >>>>>> This email (including any attachments) is subject to copyright, and the >>>>>> information in it is confidential. Use of this email or of any information >>>>>> in it other than by the addressee is unauthorised and unlawful. Whilst >>>>>> reasonable efforts are made to ensure that any attachments are virus-free, >>>>>> it is the recipient's sole responsibility to scan all attachments for >>>>>> viruses. All calls and emails to and from this company may be monitored and >>>>>> recorded for legitimate purposes relating to this company's business. Any >>>>>> opinions expressed in this email (or in any attachments) are those of the >>>>>> author and do not necessarily represent the opinions of Momentum Financial >>>>>> Technology Ltd or of any other group company. >>>>>> _______________________________________________ >>>>>> Unbearable mailing list >>>>>> Unbearable@ietf.org >>>>>> https://www.ietf.org/mailman/listinfo/unbearable >>>>>> >>>>>> >>>>>> >>>>>> _______________________________________________ >>>>>> Unbearable mailing list >>>>>> Unbearable@ietf.org >>>>>> https://www.ietf.org/mailman/listinfo/unbearable >>>>>> >>>>>> >>>>> >>> > > > -- > Dave Tonge > CTO > 10 Temple Back | Bristol | BS1 6FL > t: +44 (0)117 280 5120 > m: +44 (0)7577 815570 > > Momentum Financial Technology Ltd is authorised and regulated by the > Financial Conduct Authority (Register number 561538). Registered in > England & Wales, company registration number 06909772. DISCLAIMER: This > email (including any attachments) is subject to copyright, and the > information in it is confidential. Use of this email or of any information > in it other than by the addressee is unauthorised and unlawful. Whilst > reasonable efforts are made to ensure that any attachments are virus-free, > it is the recipient's sole responsibility to scan all attachments for > viruses. All calls and emails to and from this company may be monitored and > recorded for legitimate purposes relating to this company's business. Any > opinions expressed in this email (or in any attachments) are those of the > author and do not necessarily represent the opinions of Momentum Financial > Technology Ltd or of any other group company. > > _______________________________________________ > Unbearable mailing list > Unbearable@ietf.org > https://www.ietf.org/mailman/listinfo/unbearable > > --001a1144a44e5a25a1053645b231 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Chromium has support for draft 05 of Token Binding, althou= gh our signature construction is incorrect (it is a DER-encoded ECDSA-Sig-V= alue instead of the raw 32-byte integers R and S). I will be updating it to= draft 06 (to fix the signature format).
On Mon, Jun 27, 2016 at 3:37 AM, Dave Tonge <dave.tonge@momentumft.co.uk> wrote:
Token Binding can be enable= d via a flag in Chrome:=C2=A0chrome://flags/#enable-token-binding



On 27 Jun= e 2016 at 04:27, John Bradley <ve7jtb@ve7jtb.com> wrote:
=

Yes the server side needs the= most work.=C2=A0

I would like to see a reverse proxy with Token binding suppo= rt ASAP.=C2=A0

Windows 10 also supports a earlier draft of token binding.= =C2=A0 I think MS uses it for tokens on its own sites.=C2=A0=C2=A0 They hav= en't committed to timing on updating to the latest draft.=C2=A0

Getting this to RFC will help with getting people to update.= =C2=A0=C2=A0

John B.

On Jun 26, 2016 11:23 PM, "Ted Lemon" = <mellon@fugue.com<= /a>> wrote:
Ooh, cool!=C2=A0 I've been waiting a while for this (need t= he server side as well, of course)!=C2=A0
<= br>
On Sun, Jun 26, 2016 at 11:21 PM, John Bradle= y <ve7jtb@ve7jtb.com> wrote:

Yes, I beleave that it is also supported in one of the be= ta trains of Chrome if you turn on a flag.=C2=A0 Perhaps one of the Google = people can confirm that.

John B.

On Jun 26, 2016 11:19 PM, "Ted Lemon" = <mellon@fugue.com<= /a>> wrote:
John, does that mean that there is a version of Chromium that s= upports token binding?

On Tue, Jun 21, 2016 at 11:35 AM, John Bradley <ve7jtb@ve7jtb.c= om> wrote:
Currently if you are brave, there is a Python test serv= er as part of the Chromium project on Github for testing.

Last time I tried it you neede= d to checkout the whole project to get the test server to build. =C2=A0
I think they are working on making that easier.=C2=A0

=
Also as part of that project there is the Cronet http/TLS lib th= at can be used on iOS and Android.

We are hoping t= o include that as an option in the AppAuth project for token binding refres= h and access tokens on mobile.

https://github.com/openid
=
We are working/lobbying to get support included in more plac= es such as Python and Java.

I hope you can contrib= ute to the WG and help us move this spec to a RFC quickly by showing demand= .

Regards
John B.


On Jun 21, = 2016, at 10:55 AM, Dave Tonge <dave.tonge@momentumft.co.uk> wrote:
Hi
=
I'm currently working with the UK Open Banking Standard <= /a>and the OpenID = Financial API WG.=C2=A0
The issue of token binding is be= ing discussed and I wanted to try out an actual real world implementation.= =C2=A0
After some research there don't seem to be many i= mplementations in the wild (unless I've missed something).

It is supported in Chrome, but doesn't seem to b= e supported in OpenSSL yet (and therefore not in Node.JS, Python, Ruby, etc= .
I've opened an issue on the OpenSSL repo: https://gi= thub.com/openssl/openssl/issues/1242

Is my understanding correct? How would you recommend trying out a a live i= mplementation of token binding?

Thanks

--
Dave Tonge
CTO
10 Temple Back | Bristol | BS1 6FL
=C2=A0
Momentum Financial Technology Ltd is authorised and regulated by t= he Financial Conduct Authority (Register number=C2=A0561538). Registered in England &= Wales, company registration number=C2=A006909772.=C2=A0DISCLAIMER: This email (including any attachments) is subject to copy= right, and the information in it is confidential. Use of this email or of a= ny information in it other than by the addressee is unauthorised and unlawf= ul. Whilst reasonable efforts are made to ensure that any attachments are v= irus-free, it is the recipient's sole responsibility to scan all attach= ments for viruses. All calls and emails to and from this company may be mon= itored and recorded for legitimate purposes relating to this company's = business. Any opinions expressed in this email (or in any attachments) are = those of the author and do not necessarily represent the opinions of Moment= um Financial Technology Ltd or of any other group company.
_______________________________________________
Unbearable mailing list<= br>Unbearable@ietf= .org
https://www.ietf.org/mailman/listinfo/unbearable


____________________= ___________________________
Unbearable mailing list
Unbearable@ietf.or= g
https://www.ietf.org/mailman/listinfo/unbearable=






--
=
Dave Tonge
CTO
10 Temple Back | Bristol | BS1 6FL
=C2=A0
Momentum Financial Technology Ltd is authorised and regulated b= y the Financial Conduct Authority (Register number=C2=A0561538). Registered in England &a= mp; Wales, company registration number=C2=A006909772.=C2=A0DISCLAIMER: This email (including any attachments) is subject to c= opyright, and the information in it is confidential. Use of this email or o= f any information in it other than by the addressee is unauthorised and unl= awful. Whilst reasonable efforts are made to ensure that any attachments ar= e virus-free, it is the recipient's sole responsibility to scan all att= achments for viruses. All calls and emails to and from this company may be = monitored and recorded for legitimate purposes relating to this company'= ;s business. Any opinions expressed in this email (or in any attachments) a= re those of the author and do not necessarily represent the opinions of Mom= entum Financial Technology Ltd or of any other group company.
<= /div>

_______________________________________________
Unbearable mailing list
Unbearable@ietf.org
https://www.ietf.org/mailman/listinfo/unbearable=


--001a1144a44e5a25a1053645b231-- From nobody Wed Jun 29 18:50:23 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 32B5E12D77B for ; Wed, 29 Jun 2016 18:50:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.002 X-Spam-Level: X-Spam-Status: No, score=-2.002 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zmu7_JpJbetG for ; Wed, 29 Jun 2016 18:50:00 -0700 (PDT) Received: from na01-by2-obe.outbound.protection.outlook.com (mail-by2on0132.outbound.protection.outlook.com [207.46.100.132]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id ACC1C12D757 for ; Wed, 29 Jun 2016 18:50:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=q5BOGNh3kmzzxv0/70GML1ahSyM/X+18kumQAo4jTvw=; b=H7/cWdIZJT6VjogTtkdv5WGgmBqrR/tTvoyV5FRtSorqR5bWXtdP3mPN6ZL+MDPFywAX6KC5fjy/OHa6xdDML+D0CpDTW2P41TgZBzwUN+Z6aAukVPNfMxclPR1BbYEaasOmUfpoWHFkFt7ewYwWLrPdkORpGQrJRzscLcXfOSQ= Received: from SN1PR0301MB1645.namprd03.prod.outlook.com (10.162.130.139) by SN1PR0301MB1646.namprd03.prod.outlook.com (10.162.130.140) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.523.12; Thu, 30 Jun 2016 01:49:59 +0000 Received: from SN1PR0301MB1645.namprd03.prod.outlook.com ([10.162.130.139]) by SN1PR0301MB1645.namprd03.prod.outlook.com ([10.162.130.139]) with mapi id 15.01.0523.024; Thu, 30 Jun 2016 01:49:58 +0000 From: Mike Jones To: "unbearable@ietf.org" Thread-Topic: Description of first-party scenarios missing from draft-ietf-tokbind-https Thread-Index: AdHScT5VfaxlF1SlRsGA7dfqW+naAA== Date: Thu, 30 Jun 2016 01:49:58 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Michael.Jones@microsoft.com; x-originating-ip: [2001:4898:80e8:9::650] x-ms-office365-filtering-correlation-id: d16e0372-47f6-4065-e7d4-08d3a088d805 x-microsoft-exchange-diagnostics: 1; SN1PR0301MB1646; 6:itd47qnJuK8huaQlVN5/yj0bClO3pgi/9zZR5UmUYeEr7DboDUzF0xbZTCUyhiYhvWo35c/FL4TPO2L4ebG/kk9R2UBNmqc26D+VHmcVKzty7Pfb8JKTGUGFBjNV9HWzc0TelfUz9n2STG1JmSzoFlxaZVKG2e5D6hIIz5UkKELJpDlslhk3FAhf7O3tQ93btY+vVBqVhLSCmvK3hKjZ0Bp4cKrj3Yw20HrWRFFfgTnLZmEfaqrVXHuOvEQ8Ij9sXaRfRKQeXJ6YI/k5NaSUrsTteF+7/8cAATRnHE3+23ak/0rcqgErTQl0+Pox1FN21vpO8Yt8QE8yN3gKEFopgJyGc2lCmcj4rXKGdzLDQKE=; 5:7FzTVbjUWz/x9CX19tpyeiNQuxwM+9mJwM/eo/4pkgIyZ45hIwXWjHKnU4Yo4KslbbWEXA3/JVKxj0SO9RD0a6/b9avlmcY/SPI+bC9d+N02AoVXIKg18xvAXhVmh4TTeeOyH7MTAtcRfGt67FT1GQ==; 24:ZYk+XcGJaHjZ7i4NT1TXCxnwFHBcTkRBKH2md/V0Gqy1wxWgRbLfWSIrK6mXb5sFajRMI4ji3qdLNjGAi3VQEafEe5Wct0Cp+A6Cqk7M13A=; 7:IO+AU2qfJFN1zAqBJNAixoukLKjiE/ouRVNm4ZNO4ycy3SWY+SyWrwW8i7XmalHd6WTETgOKKD2OmQ/8+qlCNdKw2KIvZjcsYg5GnVaK2GmgI5YDDUxzcrYtl4C/4MTDDG16/EAXSE/pej5KvE/CgJQ7T4DnO7RbpfkpYBX5jxNDGoXRkZGef8AHe3lvFeE53D7uSqXclZBzdtT2QDls4UyD+fEFEOMC35LRlosVQavaodjAilEob9w+oYQsvVp453MdleFBoyLM59Zrurg8tIfZ34DCYyckJ4etpo6U9yg= x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:SN1PR0301MB1646; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(158342451672863)(192374486261705)(21748063052155); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(601004)(2401047)(5005006)(8121501046)(10201501046)(3002001)(6055026)(61426038)(61427038); SRVR:SN1PR0301MB1646; BCL:0; PCL:0; RULEID:; SRVR:SN1PR0301MB1646; x-forefront-prvs: 0989A7979C x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(6009001)(7916002)(189002)(199003)(101416001)(5002640100001)(450100001)(586003)(86362001)(76576001)(790700001)(19625215002)(33656002)(16236675004)(86612001)(2501003)(87936001)(77096005)(102836003)(19300405004)(15975445007)(6116002)(2900100001)(74316001)(97736004)(3660700001)(54356999)(99286002)(8990500004)(68736007)(9686002)(189998001)(229853001)(105586002)(2906002)(5630700001)(107886002)(7736002)(110136002)(7696003)(10400500002)(230783001)(50986999)(5005710100001)(7846002)(10090500001)(106356001)(19580395003)(5003600100003)(2351001)(92566002)(122556002)(1730700003)(10290500002)(3280700002)(8676002)(81166006)(5640700001)(81156014)(8936002)(3826002); DIR:OUT; SFP:1102; SCL:1; SRVR:SN1PR0301MB1646; H:SN1PR0301MB1645.namprd03.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:1; LANG:en; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_SN1PR0301MB1645E3C5FDDBAE53110CFBD4F5240SN1PR0301MB1645_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 30 Jun 2016 01:49:58.8082 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN1PR0301MB1646 Archived-At: Subject: [Unbearable] Description of first-party scenarios missing from draft-ietf-tokbind-https X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 30 Jun 2016 01:50:08 -0000 --_000_SN1PR0301MB1645E3C5FDDBAE53110CFBD4F5240SN1PR0301MB1645_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable The abstract of draft-ietf-tokbind-https says: We describe both _first-party_ as well as _federated_ scenarios. In a first-party scenario, an HTTP server issues a security token (such as a cookie) to a client, and expects the client to send the security token back to the server at a later time in order to authenticate. Binding the token to the TLS connection between client and server protects the security token from theft, and ensures that the security token can only be used by the client that it was issued to. And indeed, Section 3 and Section 4.4 do a great job describing federated s= cenarios. Reading the spec, I expected there to be a parallel section to Section 3 be= fore it called something like "First-Party Use Cases". This would describe= how to use Token Binding for first-party use cases, such as cookies or OAu= th refresh tokens. But that section is missing, despite the abstract sayin= g that it would exist. Can this get written soon? Thanks, -- Mike --_000_SN1PR0301MB1645E3C5FDDBAE53110CFBD4F5240SN1PR0301MB1645_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

The abstract of draft-ietf-tokbind-https says:<= /o:p>

 

   We describe both _first-party_ as= well as _federated_ scenarios.  In

   a first-party scenario, an HTTP s= erver issues a security token (such

   as a cookie) to a client, and exp= ects the client to send the security

   token back to the server at a lat= er time in order to authenticate.

   Binding the token to the TLS conn= ection between client and server

   protects the security token from = theft, and ensures that the security

   token can only be used by the cli= ent that it was issued to.

 

And indeed, Section 3 and Section = 4.4 do a great job describing federated scenarios.

 

Reading the spec, I expected there= to be a parallel section to Section 3 before it called something like R= 20;First-Party Use Cases”.  This would describe how to use Token= Binding for first-party use cases, such as cookies or OAuth refresh tokens.  But that section is missing, despite the abstr= act saying that it would exist.

 

Can this get written soon?

 

     &nbs= p;            &= nbsp;           &nbs= p;            &= nbsp;           &nbs= p;        Thanks,

     &nbs= p;            &= nbsp;           &nbs= p;            &= nbsp;           &nbs= p;        -- Mike

 

--_000_SN1PR0301MB1645E3C5FDDBAE53110CFBD4F5240SN1PR0301MB1645_-- From nobody Thu Jun 30 13:56:15 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9297E12B064 for ; Thu, 30 Jun 2016 13:56:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.002 X-Spam-Level: X-Spam-Status: No, score=-2.002 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (768-bit key) header.d=kingsmountain.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oo9VRaZJG7G3 for ; Thu, 30 Jun 2016 13:56:13 -0700 (PDT) Received: from gproxy9-pub.mail.unifiedlayer.com (gproxy9-pub.mail.unifiedlayer.com [69.89.20.122]) by ietfa.amsl.com (Postfix) with SMTP id C554312B038 for ; Thu, 30 Jun 2016 13:56:12 -0700 (PDT) Received: (qmail 18356 invoked by uid 0); 30 Jun 2016 20:56:11 -0000 Received: from unknown (HELO cmgw3) (10.0.90.84) by gproxy9.mail.unifiedlayer.com with SMTP; 30 Jun 2016 20:56:11 -0000 Received: from box514.bluehost.com ([74.220.219.114]) by cmgw3 with id D8w61t00e2UhLwi018w9VN; Thu, 30 Jun 2016 14:56:11 -0600 X-Authority-Analysis: v=2.1 cv=KpLehwmN c=1 sm=1 tr=0 a=9W6Fsu4pMcyimqnCr1W0/w==:117 a=9W6Fsu4pMcyimqnCr1W0/w==:17 a=L9H7d07YOLsA:10 a=9cW_t1CCXrUA:10 a=s5jvgZ67dGcA:10 a=IkcTkHD0fZMA:10 a=XYUc-DgfXtMA:10 a=pD_ry4oyNxEA:10 a=yMhMjlubAAAA:8 a=NEAV23lmAAAA:8 a=wLSjOpjS6war9NOobdIA:9 a=QEXdDO2ut3YA:10 a=BKKCjISod1eDJeS0ORpz:22 a=Bn2pgwyD2vrAyMmN8A2t:22 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=kingsmountain.com; s=default; h=MIME-Version:Content-Type:In-Reply-To: Subject:To:From:Message-ID:Date; bh=rBYOhn3La24H6VcV6vGMC4WfHadKfQhm1ljC327n4B4=; b=h224YmTrNNiLOZGZA2X8FrV4F8 Bv6fsk93nHyEDynnOB4vNuDXOLQ2GyZ3U3h5NnmTxc8z+RanVF4xa0+NobENSn3AuHzSFAws6hnJn lRmsoUA6T+6isho5csVTJGT9F; Received: from [127.0.0.1] (port=57232 helo=box514.bluehost.com) by box514.bluehost.com with esmtpsa (TLSv1:ECDHE-RSA-AES256-SHA:256) (Exim 4.86_2) (envelope-from ) id 1bIj0I-0004rd-LS for unbearable@ietf.org; Thu, 30 Jun 2016 14:56:06 -0600 Received: from 73.202.80.238 ([73.202.80.238]) by box514.bluehost.com (Horde Framework) with HTTP; Thu, 30 Jun 2016 14:56:04 -0600 Date: Thu, 30 Jun 2016 14:56:04 -0600 Message-ID: <20160630145604.Horde.ntybcCZRUmPGaJ6X3GxxZeC@box514.bluehost.com> From: jeff.hodges@kingsmountain.com To: unbearable@ietf.org In-Reply-To: User-Agent: Horde Application Framework 5 Content-Type: text/plain; charset=utf-8; format=flowed; DelSp=Yes MIME-Version: 1.0 Content-Disposition: inline X-Identified-User: {:box514.bluehost.com:kingsmou:kingsmountain.com} {sentby:program running on server} X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - box514.bluehost.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - kingsmountain.com X-Source-IP: 127.0.0.1 X-Exim-ID: 1bIj0I-0004rd-LS X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: (box514.bluehost.com) [127.0.0.1]:57232 X-Source-Auth: jeff.hodges@kingsmountain.com X-Email-Count: 0 X-Source-Cap: a2luZ3Ntb3U7a2luZ3Ntb3U7Ym94NTE0LmJsdWVob3N0LmNvbQ== Archived-At: Subject: Re: [Unbearable] Description of first-party scenarios missing from draft-ietf-tokbind-https X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 30 Jun 2016 20:56:14 -0000 Quoting Mike Jones : > The abstract of draft-ietf-tokbind-https says: > > We describe both _first-party_ as well as _federated_ scenarios. In > a first-party scenario, an HTTP server issues a security token (such > as a cookie) to a client, and expects the client to send the security > token back to the server at a later time in order to authenticate. > Binding the token to the TLS connection between client and server > protects the security token from theft, and ensures that the security > token can only be used by the client that it was issued to. > > And indeed, Section 3 and Section 4.4 do a great job describing > federated scenarios. > > Reading the spec, I expected there to be a parallel section to > Section 3 before it called something like "First-Party Use Cases". > This would describe how to use Token Binding for first-party use > cases, such as cookies or OAuth refresh tokens. But that section is > missing, despite the abstract saying that it would exist. > > Can this get written soon? issue submitted. HTTPSTB: first-party sec token use cases #43 https://github.com/TokenBinding/Internet-Drafts/issues/43 I will take a stab at it. =JeffH