From nobody Thu Dec 1 14:15:43 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 76F67129481 for ; Thu, 1 Dec 2016 14:15:41 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.099 X-Spam-Level: X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_SORBS_SPAM=0.5] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NpPDUgcfMjE8 for ; Thu, 1 Dec 2016 14:15:38 -0800 (PST) Received: from smtp3-g21.free.fr (smtp3-g21.free.fr [212.27.42.3]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 243C51299BE for ; Thu, 1 Dec 2016 14:15:38 -0800 (PST) Received: from zimbra57-e10.priv.proxad.net (unknown [172.20.243.207]) by smtp3-g21.free.fr (Postfix) with ESMTP id 31C3313F89A for ; Thu, 1 Dec 2016 23:15:36 +0100 (CET) Date: Thu, 1 Dec 2016 23:15:35 +0100 (CET) From: denis.ietf@free.fr To: unbearable@ietf.org Message-ID: <62118133.744729264.1480630535283.JavaMail.root@zimbra57-e10.priv.proxad.net> In-Reply-To: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-Originating-IP: [200.2.228.2] X-Mailer: Zimbra 7.2.0-GA2598 (zclient/7.2.0-GA2598) X-Authenticated-User: denis.ietf@free.fr Archived-At: Subject: [Unbearable] =?utf-8?q?Re=C2=A0=3A__Re_=3A_Answer_to_WGLC_for_cor?= =?utf-8?q?e_document_set?= X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 01 Dec 2016 22:15:41 -0000 I believe that there is indeed a solution to defeat the ABC attack. Saying in the security considerations section that the mechanism is vulnera= ble while there would exist a mechanism that is immune might not be the bes= t approach. Whatever kind of cryptography is being used there is not solution without t= he use of a secure element that does much more than protecting secret or pr= ivate keys. The solution cannot be based on the use of TLS. It would need to be based o= n the use of a specific element contained in the access token. Hence the ne= ed to standardize this element,e.g. using the JWT format. The whole approach or architecture would be quite different from the curren= t approach. Denis ----- Mail d'origine ----- De: John Bradley =C3=80: Denis Envoy=C3=A9: Thu, 01 Dec 2016 02:54:16 +0100 (CET) Objet: Re: [Unbearable] Re : Answer to WGLC for core document set I suppose that Alice could extract the EKM from her session and send it to Bob to sign and produce the token binding header that Alice would need to send with the token. Are you saying that there is a solution to this sort of collision or that we need to say that we don't prevent it. I am just north of Patagonia in Chile myself a nice time of year to visit. Regards JOHN B On Nov 30, 2016 22:06, wrote: > Bob's private key needs to be used to sign the EKM for Alice's TLS sessio= n > where she would present the cookie or token. > > Otherwise the server that receives the bound token will reject it because > Alice cannot prove possession of the token binding ID associated with tha= t > token. > > Alice needs to provide her key material to Bob or Bob needs to provide hi= s > to Alice for your collision to work. > > Regards > John B. > > On Nov 30, 2016 21:36, wrote: > >> For this attack to work Bob would also need to transmit the token bindin= g >> keys for the issued token to Alice. >> >> Is that what you mean by the collision attack? >> >> Would addressing in security considerations that this won't protect >> against user collision unless the token binding keys are stored in some >> sort of secure storage and not extractable by the user, satisfy your >> concern, Or are you imagining some other method of binding the token. >> >> Regards >> John B >> >> On Nov 30, 2016 19:22, wrote: >> >>> This set of documents failed to meet the terms of r=C3=A9f=C3=A9rences = of the WG >>> charter. >>> >>> It is not resistant to the ABC attack (Alice and Bob collusion attack). >>> In this attack Bob who is older than 18 colloborates with Alice and >>> transmits a token to Alice who is only 14 so that she can d=C3=A9monstr= ateur to >>> a RS that she is older than 18. >>> >>> This kind of attack is not even mentionned in the security >>> considerations section. >>> >>> This set of documents should not be progressed to IETF last call unless >>> the attack can be countered. >>> >>> Denis >>> >> >>> >> > This starts a working group last call for the following documents: >>> >> > >>> >> > draft-ietf-tokbind-https-06 >>> >> > draft-ietf-tokbind-negotiation-05 >>> >> > draft-ietf-tokbind-protocol-10 >>> >> > >>> >> > Any comments should be send to the list before EOB November 30th >>> >> >>> >> >>> >> Ok, I have some modest editorial comments/polishing I'm trying to ge= t >>> >> done, but the 2 week WGLC is sorta short given us american's feast o= f >>> >> thanksgiving last week and various end-of-year corporate must-dos. >>> I'll get >>> >> my comments in by the end of this week, I trust that'll be ok. >>> >> >>> >> thanks, >>> >> >>> >> =3DJeffH >>> >> >>> >> _______________________________________________ >>> >> Unbearable mailing list >>> >> Unbearable@ietf.org >>> >> https://www.ietf.org/mailman/listinfo/unbearable >>> >> >>> > >>> > >>> > >>> > -- >>> > [image: Ping Identity] >>> > >>> > Brian Campbell >>> > Distinguished Engineer >>> > bcampbell@pingidentity.com >>> > w: +1 720.317.2061 <(720)%20317-2061> >>> > c: +1 303.918.9415 <(303)%20918-9415> >>> > Connect with us: [image: Glassdoor logo] >>> > >> -EI_IE380907.11,24.htm> [image: >>> > LinkedIn logo] [image: >>> twitter >>> > logo] [image: facebook logo] >>> > [image: youtube logo] >>> > [image: Google+ logo] >>> > [image: Blog logo= ] >>> > >>> > >>> > _______________________________________________ >>> > Unbearable mailing list >>> > Unbearable@ietf.org >>> > https://www.ietf.org/mailman/listinfo/unbearable >>> > >>> > >>> > >>> >>> >>> -- >>> [image: Ping Identity] >>> >>> Brian Campbell >>> Distinguished Engineer >>> bcampbell@pingidentity.com >>> w: +1 720.317.2061 >>> c: +1 303.918.9415 >>> Connect with us: [image: Glassdoor logo] >>> >> -EI_IE380907.11,24.htm> >>> [image: >>> LinkedIn logo] [image: twitter >>> logo] [image: facebook logo] >>> [image: youtube logo] >>> [image: Google+ logo] >>> [image: Blog logo] >>> >>> >>> >>> From nobody Thu Dec 1 14:46:50 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0001E1299DB for ; Thu, 1 Dec 2016 14:46:44 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=ve7jtb-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 33w3pXWr6Sbl for ; Thu, 1 Dec 2016 14:46:40 -0800 (PST) Received: from mail-qt0-x22a.google.com (mail-qt0-x22a.google.com [IPv6:2607:f8b0:400d:c0d::22a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5669B1294A3 for ; Thu, 1 Dec 2016 14:45:54 -0800 (PST) Received: by mail-qt0-x22a.google.com with SMTP id c47so235923198qtc.2 for ; Thu, 01 Dec 2016 14:45:54 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ve7jtb-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=gUaAXbSnV1ouVnaRe5B6vvHCEoCujsXhWzMe/2LO7WM=; b=nPtpdIdMevc/cQz+n3be/J4s8C9TOuZHVOfNaFQprA2HPes7CLuJmMc5YfAHhH1/e/ 3PYUVgXjKsBzJ8ToovW54zrGoI/mr0g1J3Vh0cEH7StGFe7hVnd5kux+lL1C8aaiU8D9 rCXKCd1hJfO04oZHtM4TycTQm+9zLwLLUwoNDmn3Mwf0VInUTZa7rIw8T8DMbiqdUG/G QMwazRDYj4/pwp0Xn0ysz4PPjl+ez1j6DoHaTMAmR4QIUXRh7d++pq5PpyV9le1vQodi +Ilj8qmmAZU7WdROc7FojTTuTYa/48pd+VI6agwzGOmuqI01QO35RF1HwGchdo7IAk6q cDYA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=gUaAXbSnV1ouVnaRe5B6vvHCEoCujsXhWzMe/2LO7WM=; b=JTF7CwbMnaNI+zp7l3lBa2D4sni2K5brzSRW3N9y2hDn7bHUj3O9f7PTEZv/viGeof J7lhcmh1Myx9d2+h6oO0DgSB+BJzFcfHfnkMaMgpZdHM7lNQoaajMjc5u+k5gU3G0kNw uTZrtXAKUtS/ab1C4Yz5pS0dlCnE8uiPEVxmmi7AKOrciiRF35B5A7y0jLDjdwtYJcI0 avprjztmt6OwZhqs8fLcI0LCKliJekFZTTXoFAimp0rY49Epowm4mQYhJv0B7jmSDV7y VoBD9BdgWyY+nE6sAj+sZklFwsSs+wGm5CS+0D/mjo5sZiyepYOYD+xuNdksv4haala6 +X+g== X-Gm-Message-State: AKaTC01/stFFP8usufZ44Bp3JJIYNS+07QJpmSwQPI0Y/xtmF45OB50zuVMqDD0mbYWCEQzB X-Received: by 10.237.59.119 with SMTP id q52mr35643944qte.225.1480632353913; Thu, 01 Dec 2016 14:45:53 -0800 (PST) Received: from [192.168.8.100] ([181.201.191.149]) by smtp.gmail.com with ESMTPSA id 53sm1219160qtm.5.2016.12.01.14.45.51 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 01 Dec 2016 14:45:52 -0800 (PST) From: John Bradley Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_25B6C716-0DFD-42C6-B278-DADCE2F3DFA5" Mime-Version: 1.0 (Mac OS X Mail 10.1 \(3251\)) Date: Thu, 1 Dec 2016 19:45:50 -0300 In-Reply-To: <62118133.744729264.1480630535283.JavaMail.root@zimbra57-e10.priv.proxad.net> To: denis.ietf@free.fr References: <62118133.744729264.1480630535283.JavaMail.root@zimbra57-e10.priv.proxad.net> X-Mailer: Apple Mail (2.3251) Archived-At: Cc: unbearable@ietf.org Subject: Re: [Unbearable] =?utf-8?q?Re=C2=A0=3A__Re_=3A_Answer_to_WGLC_for_cor?= =?utf-8?q?e_document_set?= X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 01 Dec 2016 22:46:45 -0000 --Apple-Mail=_25B6C716-0DFD-42C6-B278-DADCE2F3DFA5 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 You should probably be looking at the Token binding drafts in the the = OAuth WG. This WG is only defining the method for tying tokens to the transport = layer. =20 It is up to other protocols like OAuth to define how to use those = bindings.=20 The JWT PoP spec https://tools.ietf.org/html/rfc7800 = lays the foundation for a = confirmation claim in JWT, and is not specific to token binding. That = may be part of what you are looking for. As I don=E2=80=99t know what your proposal to address collision is I = really cant speculate on it at this point. Regards John B. > On Dec 1, 2016, at 7:15 PM, denis.ietf@free.fr wrote: >=20 > I believe that there is indeed a solution to defeat the ABC attack. >=20 > Saying in the security considerations section that the mechanism is = vulnerable while there would exist a mechanism that is immune might not = be the best approach. >=20 > Whatever kind of cryptography is being used there is not solution = without the use of a secure element that does much more than protecting = secret or private keys. >=20 > The solution cannot be based on the use of TLS. It would need to be = based on the use of a specific element contained in the access token. = Hence the need to standardize this element,e.g. using the JWT format. >=20 > The whole approach or architecture would be quite different from the = current approach. >=20 > Denis >=20 >=20 > ----- Mail d'origine ----- > De: John Bradley > =C3=80: Denis > Envoy=C3=A9: Thu, 01 Dec 2016 02:54:16 +0100 (CET) > Objet: Re: [Unbearable] Re : Answer to WGLC for core document set >=20 > I suppose that Alice could extract the EKM from her session and send = it to > Bob to sign and produce the token binding header that Alice would need = to > send with the token. >=20 > Are you saying that there is a solution to this sort of collision or = that > we need to say that we don't prevent it. >=20 > I am just north of Patagonia in Chile myself a nice time of year to = visit. >=20 > Regards > JOHN B >=20 > On Nov 30, 2016 22:06, wrote: >=20 >> Bob's private key needs to be used to sign the EKM for Alice's TLS = session >> where she would present the cookie or token. >>=20 >> Otherwise the server that receives the bound token will reject it = because >> Alice cannot prove possession of the token binding ID associated with = that >> token. >>=20 >> Alice needs to provide her key material to Bob or Bob needs to = provide his >> to Alice for your collision to work. >>=20 >> Regards >> John B. >>=20 >> On Nov 30, 2016 21:36, wrote: >>=20 >>> For this attack to work Bob would also need to transmit the token = binding >>> keys for the issued token to Alice. >>>=20 >>> Is that what you mean by the collision attack? >>>=20 >>> Would addressing in security considerations that this won't protect >>> against user collision unless the token binding keys are stored in = some >>> sort of secure storage and not extractable by the user, satisfy your >>> concern, Or are you imagining some other method of binding the = token. >>>=20 >>> Regards >>> John B >>>=20 >>> On Nov 30, 2016 19:22, wrote: >>>=20 >>>> This set of documents failed to meet the terms of r=C3=A9f=C3=A9rence= s of the WG >>>> charter. >>>>=20 >>>> It is not resistant to the ABC attack (Alice and Bob collusion = attack). >>>> In this attack Bob who is older than 18 colloborates with Alice and >>>> transmits a token to Alice who is only 14 so that she can = d=C3=A9monstrateur to >>>> a RS that she is older than 18. >>>>=20 >>>> This kind of attack is not even mentionned in the security >>>> considerations section. >>>>=20 >>>> This set of documents should not be progressed to IETF last call = unless >>>> the attack can be countered. >>>>=20 >>>> Denis >>>>>>=20 >>>>>>> This starts a working group last call for the following = documents: >>>>>>>=20 >>>>>>> draft-ietf-tokbind-https-06 >>>>>>> draft-ietf-tokbind-negotiation-05 >>>>>>> draft-ietf-tokbind-protocol-10 >>>>>>>=20 >>>>>>> Any comments should be send to the list before EOB November 30th >>>>>>=20 >>>>>>=20 >>>>>> Ok, I have some modest editorial comments/polishing I'm trying to = get >>>>>> done, but the 2 week WGLC is sorta short given us american's = feast of >>>>>> thanksgiving last week and various end-of-year corporate = must-dos. >>>> I'll get >>>>>> my comments in by the end of this week, I trust that'll be ok. >>>>>>=20 >>>>>> thanks, >>>>>>=20 >>>>>> =3DJeffH >>>>>>=20 >>>>>> _______________________________________________ >>>>>> Unbearable mailing list >>>>>> Unbearable@ietf.org >>>>>> https://www.ietf.org/mailman/listinfo/unbearable >>>>>>=20 >>>>>=20 >>>>>=20 >>>>>=20 >>>>> -- >>>>> [image: Ping Identity] >>>>> >>>>> Brian Campbell >>>>> Distinguished Engineer >>>>> bcampbell@pingidentity.com >>>>> w: +1 720.317.2061 <(720)%20317-2061> >>>>> c: +1 303.918.9415 <(303)%20918-9415> >>>>> Connect with us: [image: Glassdoor logo] >>>>> >>> -EI_IE380907.11,24.htm> [image: >>>>> LinkedIn logo] [image: >>>> twitter >>>>> logo] [image: facebook logo] >>>>> [image: youtube logo] >>>>> [image: Google+ = logo] >>>>> [image: Blog = logo] >>>>> >>>>> >>>>> _______________________________________________ >>>>> Unbearable mailing list >>>>> Unbearable@ietf.org >>>>> https://www.ietf.org/mailman/listinfo/unbearable >>>>>=20 >>>>>=20 >>>>>=20 >>>>=20 >>>>=20 >>>> -- >>>> [image: Ping Identity] >>>> >>>> Brian Campbell >>>> Distinguished Engineer >>>> bcampbell@pingidentity.com >>>> w: +1 720.317.2061 >>>> c: +1 303.918.9415 >>>> Connect with us: [image: Glassdoor logo] >>>> >>> -EI_IE380907.11,24.htm> >>>> [image: >>>> LinkedIn logo] [image: = twitter >>>> logo] [image: facebook logo] >>>> [image: youtube logo] >>>> [image: Google+ logo] >>>> [image: Blog = logo] >>>> >>>> >>>>=20 >>>>=20 >=20 > _______________________________________________ > Unbearable mailing list > Unbearable@ietf.org > https://www.ietf.org/mailman/listinfo/unbearable --Apple-Mail=_25B6C716-0DFD-42C6-B278-DADCE2F3DFA5 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 You should probably be looking at the Token binding drafts in = the the OAuth WG.

This= WG is only defining the method for tying tokens to the transport layer. =  

It is = up to other protocols like OAuth to define how to use those = bindings. 

The JWT PoP spec https://tools.ietf.org/html/rfc7800 lays the = foundation for a confirmation claim in JWT, and is not specific to token = binding.  That may be part of what you are looking for.

As I don=E2=80=99t know = what your proposal to address collision is I really cant speculate on it = at this point.

Regards
John B.

On = Dec 1, 2016, at 7:15 PM, denis.ietf@free.fr wrote:

I = believe that there is indeed a solution to defeat the ABC attack.

Saying in the security considerations section = that the mechanism is vulnerable while there would exist a mechanism = that is immune might not be the best approach.

Whatever kind of cryptography is being used there is not = solution without the use of a secure element that does much more than = protecting secret or private keys.

The = solution cannot be based on the use of TLS. It would need to be based on = the use of a specific element contained in the access token. Hence the = need to standardize this element,e.g. using the JWT format.

The whole approach or architecture would be = quite different from the current approach.

Denis


----- Mail = d'origine -----
De: John Bradley <ve7jtb@ve7jtb.com>
=C3=80: Denis <denis.ietf@free.fr>
Envoy=C3=A9: Thu, 01 = Dec 2016 02:54:16 +0100 (CET)
Objet: Re: [Unbearable] Re : = Answer to WGLC for core document set

I = suppose that Alice could extract the EKM from her session and send it = to
Bob to sign and produce the token binding header that = Alice would need to
send with the token.

Are you saying that there is a solution to this sort of = collision or that
we need to say that we don't prevent = it.

I am just north of Patagonia in Chile = myself a nice time of year to visit.

Regards
JOHN B

On = Nov 30, 2016 22:06, <denis.ietf@free.fr> wrote:

Bob's private key needs = to be used to sign the EKM for Alice's TLS session
where = she would present the cookie or token.

Otherwise the server that receives the bound token will = reject it because
Alice cannot prove possession of the = token binding ID associated with that
token.

Alice needs to provide her key material to Bob = or Bob needs to provide his
to Alice for your collision to = work.

Regards
John B.

On Nov 30, 2016 21:36, <denis.ietf@free.fr> = wrote:

For this attack to work Bob would also need to transmit the = token binding
keys for the issued token to Alice.

Is that what you mean by the collision = attack?

Would addressing in security = considerations that this won't protect
against user = collision unless the token binding keys are stored in some
sort of secure storage and not extractable by the user, = satisfy your
concern, Or are you imagining some other = method of binding the token.

Regards
John B

On Nov 30, 2016 19:22, = <denis.ietf@free.fr> wrote:

This set of documents = failed to meet the terms of r=C3=A9f=C3=A9rences of the WG
charter.

It is not resistant to = the ABC attack (Alice and Bob collusion attack).
In this = attack Bob who is older than 18 colloborates with Alice and
transmits a token to Alice who is only 14 so that she can = d=C3=A9monstrateur to
a RS that she is older than 18.

This kind of attack is not even mentionned in = the security
considerations section.

This set of documents should not be progressed to IETF last = call unless
the attack can be countered.

Denis

This starts a working group last call for the = following documents:

draft-ietf-tokbind-https-06
draft-ietf-tokbind-negotiation-05
draft-ietf-tokbind-protocol-10

Any= comments should be send to the list before EOB November 30th


Ok, I have some = modest editorial comments/polishing I'm trying to get
done, = but the 2 week WGLC is sorta short given us american's feast of
thanksgiving last week and various end-of-year corporate = must-dos.
I'll get
my comments in by the end of this week, I trust that'll be = ok.

thanks,

=3DJeffH

_______________________________________________
Unbearable mailing list
Unbearable@ietf.org
https://www.ietf.org/mailman/listinfo/unbearable




--
<https://www.pingidentity.com/>[image: Ping = Identity]
<https://www.pingidentity.com/>
Brian = Campbell
Distinguished Engineer
bcampbell@pingidentity.com
w: +1 = 720.317.2061 <(720)%20317-2061>
c: +1 303.918.9415 = <(303)%20918-9415>
Connect with us: [image: = Glassdoor logo]
<https://www.glassdoor.com/Overview/Working-at-Ping-Identity=
-EI_IE380907.11,24.htm> [image:
LinkedIn logo] <https://www.linkedin.com/company/21870> [image:
twitter
logo] <https://twitter.com/pingidentity> [image: facebook = logo]
<https://www.facebook.com/pingidentitypage> [image: = youtube logo]
<https://www.youtube.com/user/PingIdentityTV> [image: = Google+ logo]
<https://plus.google.com/u/0/114266977739397708540> = [image: Blog logo]
<https://www.pingidentity.com/en/blog.html>
<https://www.pingidentity.com/en/about.html>
_______________________________________________
Unbearable mailing list
Unbearable@ietf.org
https://www.ietf.org/mailman/listinfo/unbearable





--
<https://www.pingidentity.com>[image: Ping Identity]
<https://www.pingidentity.com>
Brian = Campbell
Distinguished Engineer
bcampbell@pingidentity.com
w: +1 = 720.317.2061
c: +1 303.918.9415
Connect with = us: [image: Glassdoor logo]
<https://www.glassdoor.com/Overview/Working-at-Ping-Identity=
-EI_IE380907.11,24.htm>
[image:
LinkedIn logo] <https://www.linkedin.com/company/21870> = [image: twitter
logo] = <https://twitter.com/pingidentity> [image: facebook logo]
<https://www.facebook.com/pingidentitypage> [image: = youtube logo]
<https://www.youtube.com/user/PingIdentityTV> [image: = Google+ logo]
<https://plus.google.com/u/0/114266977739397708540> = [image: Blog logo]
<https://www.pingidentity.com/en/blog.html>
<https://www.pingidentity.com/en/about.html>



_______________________________________________
Unbearable mailing list
Unbearable@ietf.org
https://www.ietf.org/mailman/listinfo/unbearable

= --Apple-Mail=_25B6C716-0DFD-42C6-B278-DADCE2F3DFA5-- From nobody Thu Dec 1 16:53:53 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 099EC129A1A for ; Thu, 1 Dec 2016 16:53:43 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.402 X-Spam-Level: X-Spam-Status: No, score=-1.402 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, RCVD_IN_SORBS_SPAM=0.5, SPF_PASS=-0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iEBpCRi4piM3 for ; Thu, 1 Dec 2016 16:53:41 -0800 (PST) Received: from gproxy9-pub.mail.unifiedlayer.com (gproxy9-pub.mail.unifiedlayer.com [69.89.20.122]) by ietfa.amsl.com (Postfix) with SMTP id D21F8129A15 for ; Thu, 1 Dec 2016 16:53:40 -0800 (PST) Received: (qmail 22022 invoked by uid 0); 2 Dec 2016 00:53:32 -0000 Received: from unknown (HELO cmgw3) (10.0.90.84) by gproxy9.mail.unifiedlayer.com with SMTP; 2 Dec 2016 00:53:32 -0000 Received: from box514.bluehost.com ([74.220.219.114]) by cmgw3 with id EotU1u00D2UhLwi01otX2K; Thu, 01 Dec 2016 17:53:32 -0700 X-Authority-Analysis: v=2.1 cv=K/+xQUmI c=1 sm=1 tr=0 a=9W6Fsu4pMcyimqnCr1W0/w==:117 a=9W6Fsu4pMcyimqnCr1W0/w==:17 a=L9H7d07YOLsA:10 a=9cW_t1CCXrUA:10 a=s5jvgZ67dGcA:10 a=IkcTkHD0fZMA:10 a=n5n_aSjo0skA:10 a=2LNh4rWnEF8A:10 a=48vgC7mUAAAA:8 a=qdfBi7Tq5m2037Gifu0A:9 a=QEXdDO2ut3YA:10 a=w1C3t2QeGrPiZgrLijVG:22 Received: from [173.224.162.69] (port=11844 helo=[10.225.80.40]) by box514.bluehost.com with esmtpsa (TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128) (Exim 4.86_1) (envelope-from ) id 1cCc6S-0002TV-9Y; Thu, 01 Dec 2016 17:53:28 -0700 To: John Bradley , "denis.ietf@free.fr" , "unbearable@ietf.org" From: =JeffH Message-ID: <2b2e9680-be7e-84f7-230b-f0c2af9aaf41@KingsMountain.com> Date: Thu, 1 Dec 2016 16:53:27 -0800 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:45.0) Gecko/20100101 Thunderbird/45.5.0 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - box514.bluehost.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - KingsMountain.com X-BWhitelist: no X-Source-IP: 173.224.162.69 X-Exim-ID: 1cCc6S-0002TV-9Y X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: ([10.225.80.40]) [173.224.162.69]:11844 X-Source-Auth: jeff.hodges+kingsmountain.com X-Email-Count: 3 X-Source-Cap: a2luZ3Ntb3U7a2luZ3Ntb3U7Ym94NTE0LmJsdWVob3N0LmNvbQ== Archived-At: Subject: Re: [Unbearable] =?utf-8?q?Re=C2=A0=3A_Re_=3A_Answer_to_WGLC_for_core?= =?utf-8?q?_document_set?= X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 02 Dec 2016 00:53:43 -0000 JohnB said on Thursday, December 1, 2016 at 2:45 PM: > This WG is only defining the method for tying tokens to the transport > layer. well, actually, we are not defining _how_ security tokens (or app protocol messages or whatever) might be bound to TLS using Token Binding IDs. Rather, we are defining the _means_ for applications and app protocols to define that, as appropriate for their situations. > It is up to other protocols like OAuth to define how to use those > bindings. yes, where s/bindings/token binding IDs/ > [Denis] should probably be looking at the Token binding drafts in the > the OAuth WG. Agreed. denis.ietf@free.fr wrote on Wednesday, November 30, 2016 at 4:36 PM: > > Bob is willing to collaborateurs [collude] with Alice. > > He does not need to give away any secret but only using his secret > key to compute everything that Alice is needing. Though, one can architect things at the app layer such that the Token Binding IDs are bound into app layer artifacts, AND the app layer has other safeguards, such that a collusion attack is infeasible. For example, in.. denis.ietf@free.fr wrote on Friday, November 18, 2016 at 10:57 PM: > > In this scenario Bob is willing to collaborate with Alice so that he > can export a token that can be re-used by Alice. Alice will not > necessarily impersonate Bob but will only be re-using a token that > has been legitimately originally obtained by Bob. If this token > contains an attribute saying "older than 18", Alice can present it > to a protected resource that can remember this attribute. If she is > older than 18 today, tomorrow she will obviously be older than 18 > and such an attribute does not need to be renewed. So she can keep > advantage of it until she will really be 18. ..if the app layer and its security tokens are designed such that they are not only bound to a given Token Binding ID (TBID), but they are also bound to attributes of Bob's account, and integrity-protected (e.g.: the sec tokens are HMAC'd with a per-account secret key that's known only to the server), then Alice's replay of Bob's sec token, along with the generated-in-collusion-with-Bob Token Binding Message (TBM), in the context of Alice's account, will be detectable even though the TBID in the sec token and the TBM match. I don't think its the job of the Token Binding specs themselves to solve this, rather it is the job of app layer specs that are making use of Token Binding. Note that -tokbind-https (HTTPSTB) defines only the conveyance of the TBM in the context of HTTPS -- it does not define how one goes about embedding TBIDs in cookies, JWTs, HTTP message, or whatever is being schlepped around within/over HTTP. Specifying such is the job of the stuff built on top of HTTP, e.g... > The JWT PoP spec https://tools.ietf.org/html/rfc7800 lays the > foundation for a confirmation claim in JWT, and is not specific to > token binding. That may be part of what you are looking for. that all said, the Tokbind specs could perhaps better explain some of these nuances, eg in sec cons. Thanks for bringing up collusion attacks. HTH, =JeffH From nobody Tue Dec 6 12:36:30 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 26BD1129BE6 for ; Tue, 6 Dec 2016 12:36:28 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.902 X-Spam-Level: X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zT0eZI8EEtX3 for ; Tue, 6 Dec 2016 12:36:26 -0800 (PST) Received: from gproxy7-pub.mail.unifiedlayer.com (gproxy7-pub.mail.unifiedlayer.com [70.40.196.235]) by ietfa.amsl.com (Postfix) with SMTP id 48DFD129BD7 for ; Tue, 6 Dec 2016 12:36:26 -0800 (PST) Received: (qmail 7690 invoked by uid 0); 6 Dec 2016 20:36:23 -0000 Received: from unknown (HELO CMOut01) (10.0.90.82) by gproxy7.mail.unifiedlayer.com with SMTP; 6 Dec 2016 20:36:23 -0000 Received: from box514.bluehost.com ([74.220.219.114]) by CMOut01 with id GkcJ1u0062UhLwi01kcMg8; Tue, 06 Dec 2016 13:36:21 -0700 X-Authority-Analysis: v=2.1 cv=E8Je+8tl c=1 sm=1 tr=0 a=9W6Fsu4pMcyimqnCr1W0/w==:117 a=9W6Fsu4pMcyimqnCr1W0/w==:17 a=L9H7d07YOLsA:10 a=9cW_t1CCXrUA:10 a=s5jvgZ67dGcA:10 a=IkcTkHD0fZMA:10 a=n5n_aSjo0skA:10 a=NEAV23lmAAAA:8 a=4ZDdAZLOAAAA:8 a=GBiFfGfH8GMg9zOn91gA:9 a=QEXdDO2ut3YA:10 a=Bn2pgwyD2vrAyMmN8A2t:22 a=ms4y0dK72A0a-LjZ2Cu-:22 Received: from [173.224.162.69] (port=19396 helo=[10.225.80.48]) by box514.bluehost.com with esmtpsa (TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128) (Exim 4.86_1) (envelope-from ) id 1cEMTL-0000Bl-Is for unbearable@ietf.org; Tue, 06 Dec 2016 13:36:19 -0700 To: IETF TokBind WG From: =JeffH Message-ID: <5807ff47-4222-221b-6332-263825417861@KingsMountain.com> Date: Tue, 6 Dec 2016 12:36:17 -0800 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:45.0) Gecko/20100101 Thunderbird/45.5.1 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - box514.bluehost.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - KingsMountain.com X-BWhitelist: no X-Source-IP: 173.224.162.69 X-Exim-ID: 1cEMTL-0000Bl-Is X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: ([10.225.80.48]) [173.224.162.69]:19396 X-Source-Auth: jeff.hodges+kingsmountain.com X-Email-Count: 1 X-Source-Cap: a2luZ3Ntb3U7a2luZ3Ntb3U7Ym94NTE0LmJsdWVob3N0LmNvbQ== Archived-At: Subject: [Unbearable] PR#82: TBPROTO: update ECPoint.point to be in X9.62 format with leading 0x04 byte X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 06 Dec 2016 20:36:28 -0000 PR#82: TBPROTO: update ECPoint.point to be in X9.62 format with leading 0x04 byte, fixes #62 https://github.com/TokenBinding/Internet-Drafts/pull/82 see also: https://github.com/TokenBinding/Internet-Drafts/issues/62 I seem to recall we discussed this in Seoul ietf-97, but neither my notes or the minutes seem to have captured that portion of the discussion. In any case, in case we can get rough consensus to make have the ECPoint.point format match that of X9.62 (and SEC1-v2 S 2.3.3 [1]), this PR#82 implements that. HTH, =JeffH [1] http://www.secg.org/sec1-v2.pdf From nobody Tue Dec 6 14:12:05 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 753CA1295B0 for ; Tue, 6 Dec 2016 14:12:04 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.003 X-Spam-Level: X-Spam-Status: No, score=-2.003 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mjUX-vzJfnoi for ; Tue, 6 Dec 2016 14:12:02 -0800 (PST) Received: from NAM02-CY1-obe.outbound.protection.outlook.com (mail-cys01nam02on0117.outbound.protection.outlook.com [104.47.37.117]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 22BE01295FE for ; Tue, 6 Dec 2016 14:12:02 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=FNiL23KsNh/aTA2TnO6MKyTYvxHOux36IZBU3cPNAjI=; b=UPZdS4iRXFm3SooKY9p14+yaV/iGX5JGOrOkwb17VhgyKO9kGW/vFK1n0HqoQaN7AWbhJmxKODFinud/lTCvVfWN9YLAubPKEkAszXTXOEPEBENJiX0JZmzjmMJCXydZ2WbGaKV4kbeEM4bv9jokXQ0nLt6e3lKO27kpKApDG4c= Received: from BN3PR0301MB0836.namprd03.prod.outlook.com (10.160.154.146) by BN3PR0301MB0833.namprd03.prod.outlook.com (10.160.154.143) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.693.12; Tue, 6 Dec 2016 22:12:00 +0000 Received: from BN3PR0301MB0836.namprd03.prod.outlook.com ([10.160.154.146]) by BN3PR0301MB0836.namprd03.prod.outlook.com ([10.160.154.146]) with mapi id 15.01.0693.009; Tue, 6 Dec 2016 22:11:59 +0000 From: Andrei Popov To: =JeffH , IETF TokBind WG , Nick Harper , Brian Campbell , John Bradley , "Leif Johansson" Thread-Topic: [Unbearable] PR#82: TBPROTO: update ECPoint.point to be in X9.62 format with leading 0x04 byte Thread-Index: AQHSUABw2mLEmfSiTEOKTqPUud+2daD7epow Date: Tue, 6 Dec 2016 22:11:59 +0000 Message-ID: References: <5807ff47-4222-221b-6332-263825417861@KingsMountain.com> In-Reply-To: <5807ff47-4222-221b-6332-263825417861@KingsMountain.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Andrei.Popov@microsoft.com; x-originating-ip: [2001:4898:80e8:9::1d2] x-microsoft-exchange-diagnostics: 1; BN3PR0301MB0833; 7:vtKu6bA/hqNpJ90vXuHL4ywcPGW/g9/mpRK+ditNSvqmZ5VD8SFWYLb7Rw/10FzfHP6osmK61SPZ0DCIJUT5t8c4o9TEI7BG/D2sjgwYxUhQr3XmT5w5zhH8zWvxkXkzVfFhNRPiEoatwodHXcdeJWVOxmR82nSUQ5QEQ9/3lfw9GgVZrK1u6KZ6JFA08w9eM0u/HBuXM3iB2mC4gPm20VOSEqJdzfTYgUSEkb+U5j/BfUr+926Jl+7zAmQPHAJIVoNe4YdO42L/pWRYeuI7++9T8wf3cExIbMIi5UOBuf8abPXlo0QNgzhs6GywozzISIbzbx93lwpELJyJuIryZyMn+aq0ynFxIwVjzbPIyKKcm3/ynNQgzsLv0ywGjA5o x-ms-office365-filtering-correlation-id: dec7b049-e0b4-405b-fe6a-08d41e24e667 x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001); SRVR:BN3PR0301MB0833; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(166708455590820)(100405760836317); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040375)(601004)(2401047)(5005006)(8121501046)(3002001)(10201501046)(6055026)(61426038)(61427038)(6041248)(20161123564025)(20161123555025)(20161123560025)(20161123562025)(6042181)(6047074)(6072148); SRVR:BN3PR0301MB0833; BCL:0; PCL:0; RULEID:; SRVR:BN3PR0301MB0833; x-forefront-prvs: 01480965DA x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(6009001)(7916002)(189002)(13464003)(377454003)(199003)(97736004)(77096006)(2420400007)(5660300001)(6506006)(305945005)(92566002)(76176999)(189998001)(81166006)(6116002)(2906002)(7846002)(5001770100001)(54356999)(86612001)(8936002)(7736002)(86362001)(9686002)(7696004)(106116001)(122556002)(74316002)(102836003)(229853002)(8676002)(15650500001)(105586002)(76576001)(10090500001)(101416001)(50986999)(2950100002)(3280700002)(38730400001)(107886002)(99286002)(10290500002)(33656002)(10710500007)(8990500004)(81156014)(5005710100001)(3660700001)(68736007)(2900100001)(106356001)(7110500001); DIR:OUT; SFP:1102; SCL:1; SRVR:BN3PR0301MB0833; H:BN3PR0301MB0836.namprd03.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:1; LANG:en; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 06 Dec 2016 22:11:59.6813 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN3PR0301MB0833 Archived-At: Subject: Re: [Unbearable] PR#82: TBPROTO: update ECPoint.point to be in X9.62 format with leading 0x04 byte X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 06 Dec 2016 22:12:04 -0000 This change would add a fixed-value (0x04), 1-byte prefix to the encoding o= f the ecdsap256 TB IDs. This 1-byte prefix would not serve any purpose in the Token Binding protoco= l, except that it would enable us to call our ECPoint representation "uncom= pressed point format per ANSI.X9-62.2005". The above label does not mean much to me, so I would rather not add the fix= ed-value prefix that implementations will simply skip. However, I think we should discuss this on the unbearable mailing list and = ask our chairs to gauge WG consensus, so that we can resolve this one way o= r the other. Thanks, Andrei -----Original Message----- From: Unbearable [mailto:unbearable-bounces@ietf.org] On Behalf Of =3DJeffH Sent: Tuesday, December 6, 2016 12:36 PM To: IETF TokBind WG Subject: [Unbearable] PR#82: TBPROTO: update ECPoint.point to be in X9.62 f= ormat with leading 0x04 byte PR#82: TBPROTO: update ECPoint.point to be in X9.62 format with leading 0x04 byte, fixes #62 https://github.com/TokenBinding/Internet-Drafts/pull/82 see also: https://github.com/TokenBinding/Internet-Drafts/issues/62 I seem to recall we discussed this in Seoul ietf-97, but neither my notes o= r the minutes seem to have captured that portion of the discussion. In any case, in case we can get rough consensus to make have the ECPoint.po= int format match that of X9.62 (and SEC1-v2 S 2.3.3 [1]), this PR#82 imple= ments that. HTH, =3DJeffH [1] http://www.secg.org/sec1-v2.pdf _______________________________________________ Unbearable mailing list Unbearable@ietf.org https://www.ietf.org/mailman/listinfo/unbearable From nobody Tue Dec 6 14:20:30 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E67DA1294B5 for ; Tue, 6 Dec 2016 14:20:28 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.902 X-Spam-Level: X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rkEsxXpn0GVA for ; Tue, 6 Dec 2016 14:20:27 -0800 (PST) Received: from gproxy7-pub.mail.unifiedlayer.com (gproxy7-pub.mail.unifiedlayer.com [70.40.196.235]) by ietfa.amsl.com (Postfix) with SMTP id 4AE381295B0 for ; Tue, 6 Dec 2016 14:20:27 -0800 (PST) Received: (qmail 26715 invoked by uid 0); 6 Dec 2016 22:20:24 -0000 Received: from unknown (HELO CMOut01) (10.0.90.82) by gproxy7.mail.unifiedlayer.com with SMTP; 6 Dec 2016 22:20:24 -0000 Received: from box514.bluehost.com ([74.220.219.114]) by CMOut01 with id GmLK1u00c2UhLwi01mLNwE; Tue, 06 Dec 2016 15:20:23 -0700 X-Authority-Analysis: v=2.1 cv=E8Je+8tl c=1 sm=1 tr=0 a=9W6Fsu4pMcyimqnCr1W0/w==:117 a=9W6Fsu4pMcyimqnCr1W0/w==:17 a=L9H7d07YOLsA:10 a=9cW_t1CCXrUA:10 a=s5jvgZ67dGcA:10 a=IkcTkHD0fZMA:10 a=n5n_aSjo0skA:10 a=NEAV23lmAAAA:8 a=Yxzc30jP1nEoYC0av5IA:9 a=QEXdDO2ut3YA:10 a=j28js0pa1TsA:10 a=Bn2pgwyD2vrAyMmN8A2t:22 Received: from [173.224.162.69] (port=57810 helo=[10.225.80.48]) by box514.bluehost.com with esmtpsa (TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128) (Exim 4.86_1) (envelope-from ) id 1cEO60-0002HK-S1 for unbearable@ietf.org; Tue, 06 Dec 2016 15:20:20 -0700 To: IETF TokBind WG From: =JeffH Message-ID: <1fdac9be-16e4-158b-3c14-ec298aca36b3@KingsMountain.com> Date: Tue, 6 Dec 2016 14:20:16 -0800 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:45.0) Gecko/20100101 Thunderbird/45.5.1 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - box514.bluehost.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - KingsMountain.com X-BWhitelist: no X-Source-IP: 173.224.162.69 X-Exim-ID: 1cEO60-0002HK-S1 X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: ([10.225.80.48]) [173.224.162.69]:57810 X-Source-Auth: jeff.hodges+kingsmountain.com X-Email-Count: 1 X-Source-Cap: a2luZ3Ntb3U7a2luZ3Ntb3U7Ym94NTE0LmJsdWVob3N0LmNvbQ== Archived-At: Subject: [Unbearable] PR#83: TBPROTO: HTTPSTB: renego polishing X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 06 Dec 2016 22:20:29 -0000 TBPROTO: HTTPSTB: renego polishing https://github.com/TokenBinding/Internet-Drafts/pull/83 this PR encompases some modest polishing of the recently-added TLS renegotiation language in TBPROTO & HTTPSTB, and clarification of the splitting of TBM across renego boundaries, plus some other minor editorial cleanups. From nobody Tue Dec 6 14:22:27 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1BCA31295AD for ; Tue, 6 Dec 2016 14:22:26 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vEIgwuO_KEVV for ; Tue, 6 Dec 2016 14:22:24 -0800 (PST) Received: from mail-qt0-x229.google.com (mail-qt0-x229.google.com [IPv6:2607:f8b0:400d:c0d::229]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E853212959F for ; Tue, 6 Dec 2016 14:22:23 -0800 (PST) Received: by mail-qt0-x229.google.com with SMTP id c47so361099973qtc.2 for ; Tue, 06 Dec 2016 14:22:23 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=flYifKFcijYpUJSHl7c7dJcFiqq3gMpihBUaBK10tHY=; b=K6zP8+HFVTjalvHGhJ0F4oGy+BAFmv5GhwO/x+u7L8ayfR+YXwbJIE3PP5hfT5fxNR fO+bZ1us6BuWV5vQIq8cjKmo9AchzxWmQKHnpxMpFtJi+8ydDAgf13F1docaYfn+fJKX m4qVq14bBGdUx9gDkDn4Lrxl2Q/g8MjN/zf8QqHt0kG4rB1E3DdRV83VvQ+2zBdxf1vH oLBd4R+KDDfOFvfHkFyflnmQTbsLC+8wnzzox8M55FqkOY3P4Fy/0r0P/wQCmsg8AxIK Rjmr1Apfof3joSYwsTw/lupJ5lFtOSlQSwHph0+HrdnqdeO9JZ7fo0UdIGMWkCjujSH3 yNNA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=flYifKFcijYpUJSHl7c7dJcFiqq3gMpihBUaBK10tHY=; b=jk1Z+yEcMMXgbcZ6Y3bIrrTaV8QtFU7jIZojgnJHzc6sXmDqeFESQkrLwpgrX7b+U6 ntvxjRKNpb14+rwoMsbrXQuy7S4Cb2F+473JpP8uGXqFpXkqtRpDO8/RCphPi7hBpoPl sCe9sEKyrVC68OJbMcqT+efivMrHSDeBxNbqtQOYtxLkO1WqC5ryIsuboYmiImksIo7w ZWhvV0pUYnh/lwkNWjBHt0dJXc27uYdm0wQfQZABfsVOsPdc/I/spQa+YOXAX/JbJK3e xSu/CPPsCULKNTMH419zdLJqnTCPzWSEpzeAtQ2cnL7UpifA1k/V/JMlIE3Zi5t7zTgD KtlQ== X-Gm-Message-State: AKaTC03tWhq9rxA/tMaZ4EgeHQZbFzPvxHfdNxNqLnxqPny1RmrF8nESDRJoETbm8F0ZCAoJdXzn2RwW5LGcnw== X-Received: by 10.200.46.249 with SMTP id i54mr57363796qta.13.1481062943165; Tue, 06 Dec 2016 14:22:23 -0800 (PST) MIME-Version: 1.0 Received: by 10.140.38.233 with HTTP; Tue, 6 Dec 2016 14:22:22 -0800 (PST) In-Reply-To: <5807ff47-4222-221b-6332-263825417861@KingsMountain.com> References: <5807ff47-4222-221b-6332-263825417861@KingsMountain.com> From: Martin Thomson Date: Wed, 7 Dec 2016 07:22:22 +0900 Message-ID: To: "=JeffH" Content-Type: text/plain; charset=UTF-8 Archived-At: Cc: IETF TokBind WG Subject: Re: [Unbearable] PR#82: TBPROTO: update ECPoint.point to be in X9.62 format with leading 0x04 byte X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 06 Dec 2016 22:22:26 -0000 On 7 December 2016 at 05:36, =JeffH wrote: > PR#82: TBPROTO: update ECPoint.point to be in X9.62 format with leading 0x04 > byte, fixes #62 > https://github.com/TokenBinding/Internet-Drafts/pull/82 Thanks Jeff, I think that this is a good idea. There is more value in uniformity than in any narrow notion of optimality From nobody Tue Dec 6 14:31:28 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 45C49129CBC for ; Tue, 6 Dec 2016 14:31:27 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.596 X-Spam-Level: X-Spam-Status: No, score=-5.596 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-2.896, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FwS5a8Uy6cps for ; Tue, 6 Dec 2016 14:31:25 -0800 (PST) Received: from mail-io0-x232.google.com (mail-io0-x232.google.com [IPv6:2607:f8b0:4001:c06::232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AC605129B1C for ; Tue, 6 Dec 2016 14:31:20 -0800 (PST) Received: by mail-io0-x232.google.com with SMTP id l140so65224068iol.3 for ; Tue, 06 Dec 2016 14:31:20 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=qlxZ3NgBWb54HOe6cMRGtm05iDA6uhCYNLgBqvb1TTo=; b=mLkPqmNjcyPG6ADAaxqPKrCJBcoyK4ORGhrBw+tZHr5A3zCMOIXmssw3YoSTBxMqS1 kIZga4jofwr3W33wgj7lG2+/rMe66GiAFfR9MmKLOe7zVsU3xOMDS8x8zyzJEJApf1tD +pLgJJmzeEXf+mR0gATGzakmmLwm7/d156L+Da9vy08LmXfHynK+KmrTGezJWWyL9iHf nT/mqrAkArkbmQr/qmmvnbqSk6JJIWzOBxYnrVqN+DyJESNkmLYYhkmVQp67mqQVNQMr iTC9TJWqeofz4RvShj3Vxb6hzV7SGCnbyMAP1gMTeFqcA590S3MU8ULyaXQ12uKb8GI/ Ib8A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=qlxZ3NgBWb54HOe6cMRGtm05iDA6uhCYNLgBqvb1TTo=; b=HZ5ST+UTEPZBR2ii7HhXxvFPJYJlE39vshbGSo+MRzSaLeyf1DlaPZ4Ctu2ZRIgEoH 4NMcNvGQIjfM5HAE4Pg0nbPt0LVH9+RXrQG7IMINQ4MkNzZdM5TTKua3C3Nw3dOYhq6T uL1fxr7xGJHdyBPS/GwChZgWPy+JjPOx9kIoanHlEL2cnFYfZ7t2SBvMgduJaUfpcEjD Qi8TWae5VM98WxiS1mTkcQe/2j0rNFsTKEsK7Of/RGJb291WAnksp0Pw11e7SLFZmhPm U7I/25RohOqP+9tQpViERl4vsS4vUsJsq+AEXOAHNTKwA0zhk+Fube+hgQMPSbTf6fDh qjRA== X-Gm-Message-State: AKaTC037+Kz9Oiac0jG2KGKxipNckRr2TNOrbfuCL2dMg+RMjMp5ga5dOG/wJN+g5m/zILSBWGb6bQAqOOnsWNbT X-Received: by 10.107.138.10 with SMTP id m10mr16216639iod.188.1481063479784; Tue, 06 Dec 2016 14:31:19 -0800 (PST) MIME-Version: 1.0 Received: by 10.64.152.41 with HTTP; Tue, 6 Dec 2016 14:31:19 -0800 (PST) In-Reply-To: References: <5807ff47-4222-221b-6332-263825417861@KingsMountain.com> From: Bill Cox Date: Tue, 6 Dec 2016 14:31:19 -0800 Message-ID: To: Martin Thomson Content-Type: multipart/alternative; boundary=001a113f22489ab984054304f686 Archived-At: Cc: IETF TokBind WG , =JeffH Subject: Re: [Unbearable] PR#82: TBPROTO: update ECPoint.point to be in X9.62 format with leading 0x04 byte X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 06 Dec 2016 22:31:27 -0000 --001a113f22489ab984054304f686 Content-Type: text/plain; charset=UTF-8 Well... this would be a binary incompatible change, meaning I'd have to start over with syncing with Chrome. The powers-that-be require that any change I make takes several weeks to go live. I can have Google support for the -10 version global sometime in Jan if we do not make this change. Bill On Tue, Dec 6, 2016 at 2:22 PM, Martin Thomson wrote: > On 7 December 2016 at 05:36, =JeffH wrote: > > PR#82: TBPROTO: update ECPoint.point to be in X9.62 format with leading > 0x04 > > byte, fixes #62 > > https://github.com/TokenBinding/Internet-Drafts/pull/82 > > Thanks Jeff, I think that this is a good idea. There is more value in > uniformity than in any narrow notion of optimality > > _______________________________________________ > Unbearable mailing list > Unbearable@ietf.org > https://www.ietf.org/mailman/listinfo/unbearable > --001a113f22489ab984054304f686 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Well... this would be a binary incompatible change, meanin= g I'd have to start over with syncing with Chrome.=C2=A0 The powers-tha= t-be require that any change I make takes several weeks to go live.=C2=A0 I= can have Google support for the -10 version global sometime in Jan if we d= o not make this change.

Bill

On Tue, Dec 6, 2016 at 2:22 PM, M= artin Thomson <martin.thomson@gmail.com> wrote:
On 7 December 2016 at 05:36, = =3DJeffH <Jeff.Hodges@k= ingsmountain.com> wrote:
> PR#82: TBPROTO: update ECPoint.point to be in X9.62 format with leadin= g 0x04
> byte, fixes #62
> https://github.com/TokenBinding/Int= ernet-Drafts/pull/82

Thanks Jeff, I think that this is a good idea.=C2=A0 There is more v= alue in
uniformity than in any narrow notion of optimality

_______________________________________________
Unbearable mailing list
Unbearable@ietf.org
https://www.ietf.org/mailman/listinfo/unbearabl= e

--001a113f22489ab984054304f686-- From nobody Tue Dec 6 14:45:25 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 319C8129B15 for ; Tue, 6 Dec 2016 14:45:24 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.003 X-Spam-Level: X-Spam-Status: No, score=-2.003 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ltaPfxaJZyQE for ; Tue, 6 Dec 2016 14:45:21 -0800 (PST) Received: from NAM02-SN1-obe.outbound.protection.outlook.com (mail-sn1nam02on0127.outbound.protection.outlook.com [104.47.36.127]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 642971295AD for ; Tue, 6 Dec 2016 14:45:20 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=ZTmRzy9t2SXU3HiSPeevTLP2SjeXP2wL7eacXfPEIso=; b=bUtDxe7AQoaylBx/XbpO4/KZeN0hg53/izBH31YVROsKnOiOg1F2LeckQPSirqSiHhGnPV4ECAmLYyMC4HNmZOa05Ly7KmvyC0yknef7j05B+GEy/lhxvbpF6RaHeAVUl4/7GFJrkabKknc99aXm+kzmAUA+InShKOOI42AVSPs= Received: from BN3PR0301MB0836.namprd03.prod.outlook.com (10.160.154.146) by BN3PR0301MB0836.namprd03.prod.outlook.com (10.160.154.146) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.693.12; Tue, 6 Dec 2016 22:45:16 +0000 Received: from BN3PR0301MB0836.namprd03.prod.outlook.com ([10.160.154.146]) by BN3PR0301MB0836.namprd03.prod.outlook.com ([10.160.154.146]) with mapi id 15.01.0693.009; Tue, 6 Dec 2016 22:45:16 +0000 From: Andrei Popov To: =JeffH , IETF TokBind WG Thread-Topic: [Unbearable] PR#83: TBPROTO: HTTPSTB: renego polishing Thread-Index: AQHSUA75Lxiq61f8T0CAnBsrlcybeKD7hEQw Date: Tue, 6 Dec 2016 22:45:16 +0000 Message-ID: References: <1fdac9be-16e4-158b-3c14-ec298aca36b3@KingsMountain.com> In-Reply-To: <1fdac9be-16e4-158b-3c14-ec298aca36b3@KingsMountain.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Andrei.Popov@microsoft.com; x-originating-ip: [2001:4898:80e8:9::1d2] x-microsoft-exchange-diagnostics: 1; BN3PR0301MB0836; 7:UNO7GbbDF4JSt7hey6TTBSq1P3XokPD7V/0znwYWkkkF+2M2TtIFdpOW265Eo//54/iNmKCIQefjOO7Ci3s5H8tyFqe9DhpSffXKextmnd0oXqvK3OeVUtzweMPfXr2zU9/8YvnO06pXW3df8vkxtn2qG8TTeI7K35NCi+rhdbGSPmNyeXqYaGbhzrb6BBOIBvNRpmOtIKmsVxE+8lEsxzVlY1cuLzLylRueNlkgams5o5dzjlzbpBCICmckj7mF6Mx6zVdwhxV291ncUdTctiW8V41he0ClJbDoI0IVci+IBzFfBYtFMQy3V2q1oNqk10WuL9bvtC+A7n1MqQ9OUnE/saPb1EunC2gazdDbnOvSt27LF5mrkDuk1PHsNHOY x-ms-office365-filtering-correlation-id: ec066a39-9dda-4018-02f2-08d41e298c61 x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001); SRVR:BN3PR0301MB0836; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(166708455590820); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040375)(601004)(2401047)(5005006)(8121501046)(3002001)(10201501046)(6055026)(61426038)(61427038)(6041248)(20161123560025)(20161123555025)(20161123562025)(20161123564025)(6072148)(6047074)(6042181); SRVR:BN3PR0301MB0836; BCL:0; PCL:0; RULEID:; SRVR:BN3PR0301MB0836; x-forefront-prvs: 01480965DA x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(6009001)(7916002)(189002)(377454003)(13464003)(199003)(102836003)(8676002)(81166006)(81156014)(8990500004)(2900100001)(5660300001)(3660700001)(10090500001)(74316002)(99286002)(106116001)(105586002)(2906002)(10290500002)(106356001)(6506006)(38730400001)(5005710100001)(122556002)(97736004)(2950100002)(6116002)(229853002)(7696004)(189998001)(101416001)(5001770100001)(86612001)(92566002)(50986999)(54356999)(86362001)(76176999)(305945005)(9686002)(68736007)(3280700002)(7846002)(33656002)(76576001)(8936002)(107886002)(77096006)(7736002); DIR:OUT; SFP:1102; SCL:1; SRVR:BN3PR0301MB0836; H:BN3PR0301MB0836.namprd03.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:1; LANG:en; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 06 Dec 2016 22:45:16.1867 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN3PR0301MB0836 Archived-At: Subject: Re: [Unbearable] PR#83: TBPROTO: HTTPSTB: renego polishing X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 06 Dec 2016 22:45:24 -0000 At a glance, looks good to me; will merge in the next revision of the docs. Thanks, Andrei -----Original Message----- From: Unbearable [mailto:unbearable-bounces@ietf.org] On Behalf Of =3DJeffH Sent: Tuesday, December 6, 2016 2:20 PM To: IETF TokBind WG Subject: [Unbearable] PR#83: TBPROTO: HTTPSTB: renego polishing TBPROTO: HTTPSTB: renego polishing https://github.com/TokenBinding/Internet-Drafts/pull/83 this PR encompases some modest polishing of the recently-added TLS renegoti= ation language in TBPROTO & HTTPSTB, and clarification of the splitting of = TBM across renego boundaries, plus some other minor editorial cleanups. _______________________________________________ Unbearable mailing list Unbearable@ietf.org https://www.ietf.org/mailman/listinfo/unbearable From nobody Tue Dec 6 14:53:07 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B98071295BD for ; Tue, 6 Dec 2016 14:53:05 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.596 X-Spam-Level: X-Spam-Status: No, score=-5.596 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-2.896, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NHgHY7qR6bBL for ; Tue, 6 Dec 2016 14:53:03 -0800 (PST) Received: from mail-qt0-x231.google.com (mail-qt0-x231.google.com [IPv6:2607:f8b0:400d:c0d::231]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 64ADC1295AD for ; Tue, 6 Dec 2016 14:53:03 -0800 (PST) Received: by mail-qt0-x231.google.com with SMTP id p16so360749271qta.0 for ; Tue, 06 Dec 2016 14:53:03 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=LcC9z+J02LhK44PukIO0g//z1e5J1eCYzDrOpO8vHvw=; b=RKSZphpi3qLwUXXGA5DfccNtV3Eq5AzE4qLInKW8Pb6OLtDmRo14hamIA79csxnLGf +bUj15KmS5A09Os3EAykmYFvGnZstXGf2RXx5m1HpIVhF+uPl6brJgkcZkoTvCT1Y/ux jsUcuYTKSj0E6KPjkHg00KOaRU8E5oEFenh/mSIh4LlS+ICk/Cwzcj7aqeYRSTMPbwoW w6RHgQLUt71LKSpUEehtnw5kerekaHobPaie551Rmdz5NXZ0N+tDHkkKM0hqcuPXTBZ6 vcb21LJgr2xOR6/tRTyyFENX1dCHwAftTs8zAz8Gkuu35BGeRQs4zqa6BTj2paCEGkkB UFEw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=LcC9z+J02LhK44PukIO0g//z1e5J1eCYzDrOpO8vHvw=; b=Zi2SNRFWSlwaFosubR0+KefYa64z7LfHpKxK6I+tte3cGhnSfiThDlpcSM6aloFRht X/CI5tLuWi39J9O8P8tF+R52bjeqwhyLL2WPBtUs88qrfU05/NatGFUXB8zaLboc8VFQ kHjN32chPdV1dqniaUbvf2nZxEN44y+W+ZXukydRaZcgPZEJiSjKWkPvwQReQxNsqzeS Zlg1Wv5sH3kDYaNNSCdvTrTLPxLk98vV7Q6pYgjiH5KE//QgPyG0YtOc79odgswQHwMN 6A0Uv/lE9iILcnNNth6ABZ+8Ys+MQmL9c59c+G+SlF8kq12ZKfr8NjfeuKP18KyRalZN 9c3Q== X-Gm-Message-State: AKaTC01UvJ6uxUECemLAg1+s9qYzYaMZGec6UmysATNTod40+gyLZ2YEsPNtWh1APLip4hGUS1Oi3+780qIvJjtj X-Received: by 10.200.56.228 with SMTP id g33mr65171499qtc.140.1481064782453; Tue, 06 Dec 2016 14:53:02 -0800 (PST) MIME-Version: 1.0 Received: by 10.140.17.52 with HTTP; Tue, 6 Dec 2016 14:52:42 -0800 (PST) In-Reply-To: References: <5807ff47-4222-221b-6332-263825417861@KingsMountain.com> From: Nick Harper Date: Tue, 6 Dec 2016 14:52:42 -0800 Message-ID: To: Martin Thomson Content-Type: multipart/alternative; boundary=001a1141d0b43fb36f0543054422 Archived-At: Cc: IETF TokBind WG , =JeffH Subject: Re: [Unbearable] PR#82: TBPROTO: update ECPoint.point to be in X9.62 format with leading 0x04 byte X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 06 Dec 2016 22:53:06 -0000 --001a1141d0b43fb36f0543054422 Content-Type: text/plain; charset=UTF-8 I agree with Martin and Jeff. Let's use pre-existing standards unless there's a good reason not to. On Tue, Dec 6, 2016 at 2:22 PM, Martin Thomson wrote: > On 7 December 2016 at 05:36, =JeffH wrote: > > PR#82: TBPROTO: update ECPoint.point to be in X9.62 format with leading > 0x04 > > byte, fixes #62 > > https://github.com/TokenBinding/Internet-Drafts/pull/82 > > Thanks Jeff, I think that this is a good idea. There is more value in > uniformity than in any narrow notion of optimality > > _______________________________________________ > Unbearable mailing list > Unbearable@ietf.org > https://www.ietf.org/mailman/listinfo/unbearable > --001a1141d0b43fb36f0543054422 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
I agree with Martin and Jeff. Let's use pre-existing s= tandards unless there's a good reason not to.

On Tue, Dec 6, 2016 at 2:22 PM, Marti= n Thomson <martin.thomson@gmail.com> wrote:
On 7 December 2016 at 05:36, =3DJ= effH <Jeff.Hodges@kings= mountain.com> wrote:
> PR#82: TBPROTO: update ECPoint.point to be in X9.62 format with leadin= g 0x04
> byte, fixes #62
> https://github.com/TokenBinding/Int= ernet-Drafts/pull/82

Thanks Jeff, I think that this is a good idea.=C2=A0 There is more v= alue in
uniformity than in any narrow notion of optimality

_______________________________________________
Unbearable mailing list
Unbearable@ietf.org
https://www.ietf.org/mailman/listinfo/unbearabl= e

--001a1141d0b43fb36f0543054422-- From nobody Tue Dec 6 15:28:40 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F12041295EF for ; Tue, 6 Dec 2016 15:28:38 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.69 X-Spam-Level: X-Spam-Status: No, score=-2.69 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, T_REMOTE_IMAGE=0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=pingidentity.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mBqMuermTugG for ; Tue, 6 Dec 2016 15:28:36 -0800 (PST) Received: from mail-io0-x231.google.com (mail-io0-x231.google.com [IPv6:2607:f8b0:4001:c06::231]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BFC2A1295CB for ; Tue, 6 Dec 2016 15:28:34 -0800 (PST) Received: by mail-io0-x231.google.com with SMTP id c21so627054437ioj.1 for ; Tue, 06 Dec 2016 15:28:34 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=pingidentity.com; s=gmail; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=YVVlUSCEPBuZA6SyRRdRqQ0mPJeAKk3CL+KFWl/+1is=; b=nPIX3i2KQqVFJvTvJ99vBfVN3fsstsjP5Ol+3L+/IxehYfM0O7vwj42yu/0JeB+ze7 RYbt9Ut1wyUgHhQt3k0eCpC4IQ5x1OQEDuxBD8vS8XstotQP+vABqWKQshpEz46r09oR 00eZexv7d6aRPhDTo1yecfB3lVyM3yQits+Aw= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=YVVlUSCEPBuZA6SyRRdRqQ0mPJeAKk3CL+KFWl/+1is=; b=E4eBIurrpb5Z1gdGDvmql4rFGGyRyqfyGtdRoEypV0IvapOqXr6waHfXNBeIRDGv0C LtQsHC6pCJu5nwIY/HhXK9Zon3f+Iq90D8N/KlmNwm44m/v9ARW8JK49qyc6+VmN5ZXq 7yyoCS1nPPw1cH4SRi+8on84AIaawtqKDCA7DJfNdeie9aZMGJONndHuZ652GebEQGI8 Zl/cKN1lugXryMAo0HXSReyMAjlcO6EA+55bj0dHSTOfZuN+DKDGgF6xpQ2z2fRirNze LLXE8nAH9iAddDjPeTu2jSpDYQAOuLFXhYYBzPU2q1WT07I50HwoY/1zxtan3lsVy/8l GBYg== X-Gm-Message-State: AKaTC02Nv4DKtcPSu8HxmbwU3Hhg5OgJ4RE23EKYNSpDa8tdEtBbpoznFg1tQOXtdZVXr8yM4aymv39WfkNI2aWs X-Received: by 10.36.139.4 with SMTP id g4mr1031210ite.35.1481066914003; Tue, 06 Dec 2016 15:28:34 -0800 (PST) MIME-Version: 1.0 Received: by 10.79.208.118 with HTTP; Tue, 6 Dec 2016 15:28:03 -0800 (PST) In-Reply-To: References: <5807ff47-4222-221b-6332-263825417861@KingsMountain.com> From: Brian Campbell Date: Tue, 6 Dec 2016 16:28:03 -0700 Message-ID: To: Nick Harper Content-Type: multipart/alternative; boundary=94eb2c04abb84c63e7054305c362 Archived-At: Cc: IETF TokBind WG , Martin Thomson , =JeffH Subject: Re: [Unbearable] PR#82: TBPROTO: update ECPoint.point to be in X9.62 format with leading 0x04 byte X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 06 Dec 2016 23:28:39 -0000 --94eb2c04abb84c63e7054305c362 Content-Type: text/plain; charset=UTF-8 However, in this case, there's not a compelling reason to use that preexisting standard either. Value comes from using preexisting standards when there exist reusable abstractions/implementations of the standard. I've not seen that to be the case and X9.62 just becomes extra baggage. X9.62 2005 isn't exactly easily accessible either - I've not been able to find a copy that doesn't require $100 payment. As Andre has said, the only thing that using the X9.62 format seems to do is allow TB to call the ECPoint representation "uncompressed point format per ANSI.X9-62.2005". I don't see the value in that. It'd also be an incompatible change (as Bill points out). That's a good reason, to me anyway, to not make the change at this late stage in the process. And yes it's only 1 byte but it's a unnecessary byte that's just going to be ignored. I just don't see a benefit to adding that. I'd prefer that we leave it as currently defined. Noting that there exist multiple independent interoperable implementations of the current draft. On Tue, Dec 6, 2016 at 3:52 PM, Nick Harper wrote: > I agree with Martin and Jeff. Let's use pre-existing standards unless > there's a good reason not to. > > On Tue, Dec 6, 2016 at 2:22 PM, Martin Thomson > wrote: > >> On 7 December 2016 at 05:36, =JeffH >> wrote: >> > PR#82: TBPROTO: update ECPoint.point to be in X9.62 format with leading >> 0x04 >> > byte, fixes #62 >> > https://github.com/TokenBinding/Internet-Drafts/pull/82 >> >> Thanks Jeff, I think that this is a good idea. There is more value in >> uniformity than in any narrow notion of optimality >> >> _______________________________________________ >> Unbearable mailing list >> Unbearable@ietf.org >> https://www.ietf.org/mailman/listinfo/unbearable >> > > > _______________________________________________ > Unbearable mailing list > Unbearable@ietf.org > https://www.ietf.org/mailman/listinfo/unbearable > > -- [image: Ping Identity] Brian Campbell Distinguished Engineer bcampbell@pingidentity.com w: +1 720.317.2061 c: +1 303.918.9415 Connect with us: [image: Glassdoor logo] [image: LinkedIn logo] [image: twitter logo] [image: facebook logo] [image: youtube logo] [image: Google+ logo] [image: Blog logo] --94eb2c04abb84c63e7054305c362 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
However, in this case, there's not= a compelling reason to use that preexisting standard either.=C2=A0
Value comes from using preexisting standards when there exist r= eusable abstractions/implementations of the standard. I've not seen tha= t to be the case and X9.62 just becomes extra baggage.

X9= .62 2005 isn't exactly easily accessible either - I've not been abl= e to find a copy that doesn't require $100 payment.

As An= dre has said, the only thing that using the X9.62 format seems to do is all= ow TB to call the ECPoint representation "uncompressed point format pe= r ANSI.X9-62.2005". I don't see the value in that.

It'd also be an incompatible change (as Bill points out). Tha= t's a good reason, to me anyway, to not make the change at this late st= age in the process.

And yes it's only 1 byte but it's= a unnecessary byte that's just going to be ignored. I just don't s= ee a benefit to adding that.

I'd prefer that we leave it a= s currently defined. Noting that there exist multiple independent interoper= able implementations of the current draft.






On Tue, Dec 6, 2016 at 3:52 PM, Nick Harper <nharper@google.com> wrote:
I ag= ree with Martin and Jeff. Let's use pre-existing standards unless there= 's a good reason not to.

On Tue, Dec 6, 2016 at 2:22 PM, Martin Th= omson <martin.thomson@gmail.com> wrote:
On 7 December 2016= at 05:36, =3DJeffH <Jeff.Hodges@kingsmountain.com> wrote:
> PR#82: TBPROTO: update ECPoint.point to be in X9.62 format with leadin= g 0x04
> byte, fixes #62
> https://github.com/TokenBinding/Int= ernet-Drafts/pull/82

Thanks Jeff, I think that this is a good idea.=C2=A0 There is more v= alue in
uniformity than in any narrow notion of optimality

_______________________________________________
Unbearable mailing list
Unbearable@ietf.or= g
https://www.ietf.org/mailman/listinfo/unbearabl= e


_______________________________________________
Unbearable mailing list
Unbearable@ietf.org
https://www.ietf.org/mailman/listinfo/unbearabl= e




--
= = = <= img src=3D"https://www.pingidentity.com/content/dam/pic/images/misc/Ping_Si= gnature_2016_pingcorpvideo_redbutton.png"> --94eb2c04abb84c63e7054305c362-- From nobody Tue Dec 6 15:50:53 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CC1D9129600 for ; Tue, 6 Dec 2016 15:50:51 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.689 X-Spam-Level: X-Spam-Status: No, score=-2.689 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, T_REMOTE_IMAGE=0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KAB6xv_jFIP5 for ; Tue, 6 Dec 2016 15:50:49 -0800 (PST) Received: from mail-qt0-x22b.google.com (mail-qt0-x22b.google.com [IPv6:2607:f8b0:400d:c0d::22b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 36CF31295FF for ; Tue, 6 Dec 2016 15:50:49 -0800 (PST) Received: by mail-qt0-x22b.google.com with SMTP id w33so362425293qtc.3 for ; Tue, 06 Dec 2016 15:50:49 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=4odZqt0YEW/yssukkXhSGhP8r4IjKrIyJkqIkYMXzYk=; b=J5Q09BVMg/jWFLNz0W14x+jVJTHm1OxI9DreEOzh666OZkAB0YNPnCp+Px100gC5HR +WtSVOqw7xV4vLGE2oyh0REghXFAyl4UoUkNTJQrWopdaPq4HmFm5POiVw8yuhzwoQK8 biHa8qn9krJIvY8eA0m+W/Biy4wKTkJA2tUfHnFMlt79Mg4VzSaHjef9StsFMw3ErDlK 9AlR96j2yktMbTygIU3/CfUWk8RS2nY0bYBonwEYAIFiiQd6emjXa1dOszNx9ujSCzRM VYK7Tm7ipSZSgLSiBMY9VwUMbcKPJ6JItsrLEXaqF6/VOQ2kqkti4XkGGUL+Ncz7LPtF bTeQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=4odZqt0YEW/yssukkXhSGhP8r4IjKrIyJkqIkYMXzYk=; b=AwJ9rvtWpPaDIPJXzhxR4QQGtYWICI1gpxOKl/kvxIJNyGeiGXhD+j3kXTOXOLlmbu NIpjG1op2n9WVTCpCVLxaMdbTyPcH3+CAgVwUtPeeSjv6fKOYv9GPG2bN9gcMwsbLACk jqb3Jr/seb+E3zU6q+AFRAOWVQ9ov9+YXjZZCFg8YGHqCwC1yWa7bbf2CV1umHZqCKGY tJEYoWsp1ZtmrO7ZDDiPAA6t4wmQ8xI5u5LPNkNVLwEkI23TUnV8zv43TBKrpSrkQ7GV 8UnerHD9+TcZYqmZLWccNw2nN4lWouj/TIJLz6c2VxNtpM3BB8xo9CnNhbAcuo9ib1QF Cn6g== X-Gm-Message-State: AKaTC02InkrOOBx+94pInPKxRXlKBHZXN5Qa86LkhOYybk++SzHqqOOI1j+wyl6aaYgf5KgRll0/q4HFpJTKrw== X-Received: by 10.200.35.14 with SMTP id a14mr57474331qta.159.1481068248381; Tue, 06 Dec 2016 15:50:48 -0800 (PST) MIME-Version: 1.0 Received: by 10.140.38.233 with HTTP; Tue, 6 Dec 2016 15:50:48 -0800 (PST) In-Reply-To: References: <5807ff47-4222-221b-6332-263825417861@KingsMountain.com> From: Martin Thomson Date: Wed, 7 Dec 2016 08:50:48 +0900 Message-ID: To: Brian Campbell Content-Type: multipart/alternative; boundary=001a113f34ced53d9c05430612c4 Archived-At: Cc: IETF TokBind WG , =JeffH , Nick Harper Subject: Re: [Unbearable] PR#82: TBPROTO: update ECPoint.point to be in X9.62 format with leading 0x04 byte X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 06 Dec 2016 23:50:52 -0000 --001a113f34ced53d9c05430612c4 Content-Type: text/plain; charset=UTF-8 This is a false economy: anyone who is using existing code will likely have a library that produces X9.62. All of the languages/libraries I'm aware of natively support that format; only a few have native access to X and Y. In those languages/libraries, dealing with the custom format is more work. Access to the spec isn't needed, Jeff included a nice definition. (I've never seen a copy myself and I haven't felt any pain.) I think that the relevant concern is Bill's. On 7 December 2016 at 08:28, Brian Campbell wrote: > However, in this case, there's not a compelling reason to use that > preexisting standard either. > > Value comes from using preexisting standards when there exist reusable > abstractions/implementations of the standard. I've not seen that to be the > case and X9.62 just becomes extra baggage. > > X9.62 2005 isn't exactly easily accessible either - I've not been able to > find a copy that doesn't require $100 payment. > > As Andre has said, the only thing that using the X9.62 format seems to do > is allow TB to call the ECPoint representation "uncompressed point format > per ANSI.X9-62.2005". I don't see the value in that. > > It'd also be an incompatible change (as Bill points out). That's a good > reason, to me anyway, to not make the change at this late stage in the > process. > > And yes it's only 1 byte but it's a unnecessary byte that's just going to > be ignored. I just don't see a benefit to adding that. > > I'd prefer that we leave it as currently defined. Noting that there exist > multiple independent interoperable implementations of the current draft. > > > > > > > > On Tue, Dec 6, 2016 at 3:52 PM, Nick Harper wrote: > >> I agree with Martin and Jeff. Let's use pre-existing standards unless >> there's a good reason not to. >> >> On Tue, Dec 6, 2016 at 2:22 PM, Martin Thomson >> wrote: >> >>> On 7 December 2016 at 05:36, =JeffH >>> wrote: >>> > PR#82: TBPROTO: update ECPoint.point to be in X9.62 format with >>> leading 0x04 >>> > byte, fixes #62 >>> > https://github.com/TokenBinding/Internet-Drafts/pull/82 >>> >>> Thanks Jeff, I think that this is a good idea. There is more value in >>> uniformity than in any narrow notion of optimality >>> >>> _______________________________________________ >>> Unbearable mailing list >>> Unbearable@ietf.org >>> https://www.ietf.org/mailman/listinfo/unbearable >>> >> >> >> _______________________________________________ >> Unbearable mailing list >> Unbearable@ietf.org >> https://www.ietf.org/mailman/listinfo/unbearable >> >> > > > -- > [image: Ping Identity] > > Brian Campbell > Distinguished Engineer > bcampbell@pingidentity.com > w: +1 720.317.2061 > c: +1 303.918.9415 > Connect with us: [image: Glassdoor logo] > [image: > LinkedIn logo] [image: twitter > logo] [image: facebook logo] > [image: youtube logo] > [image: Google+ logo] > [image: Blog logo] > > > --001a113f34ced53d9c05430612c4 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
This is a false economy: anyone who is using exi= sting code will likely have a library that produces X9.62.=C2=A0 All of the= languages/libraries I'm aware of natively support that format; only a = few have native access to X and Y.=C2=A0 In those languages/libraries, deal= ing with the custom format is more work.

Access to the spec is= n't needed, Jeff included a nice definition.=C2=A0 (I've never seen= a copy myself and I haven't felt any pain.)

I think that = the relevant concern is Bill's.


On 7 December 2016 at 08:28, Bri= an Campbell <bcampbell@pingidentity.com> wrote:
=
However= , in this case, there's not a compelling reason to use that preexisting= standard either.=C2=A0

Value comes from using preexisti= ng standards when there exist reusable abstractions/implementations of the = standard. I've not seen that to be the case and X9.62 just becomes extr= a baggage.

X9.62 2005 isn't exactly easily accessible= either - I've not been able to find a copy that doesn't require $1= 00 payment.

As Andre has said, the only thing that using the = X9.62 format seems to do is allow TB to call the ECPoint representation &qu= ot;uncompressed point format per ANSI.X9-62.2005". I don't see the= value in that.

It'd also be an incompatible change (as Bill points out). Tha= t's a good reason, to me anyway, to not make the change at this late st= age in the process.

And yes it's only 1 byte but it's= a unnecessary byte that's just going to be ignored. I just don't s= ee a benefit to adding that.

I'd prefer that we leave it a= s currently defined. Noting that there exist multiple independent interoper= able implementations of the current draft.





<= br>
On Tue, Dec 6, 2016 at 3:52 PM, Nick Harper <= span dir=3D"ltr"><nharper@google.com> wrote:
I agree with Martin and Jeff. Let's use pre-existing= standards unless there's a good reason not to.

On Tue, Dec 6, 2016 at 2:22 P= M, Martin Thomson <martin.thomson@gmail.com> wrote:
On 7 December 2016 at 05:36, =3DJeffH <Jeff.Hodges@kingsmountain= .com> wrote:
> PR#82: TBPROTO: update ECPoint.point to be in X9.62 format with leadin= g 0x04
> byte, fixes #62
> https://github.com/TokenBinding/Int= ernet-Drafts/pull/82

Thanks Jeff, I think that this is a good idea.=C2=A0 There is more v= alue in
uniformity than in any narrow notion of optimality

_______________________________________________
Unbearable mailing list
Unbearable@ietf.or= g
https://www.ietf.org/mailman/listinfo/unbearabl= e


_______________________________________________
Unbearable mailing list
Unbearable@ietf.or= g
https://www.ietf.org/mailman/listinfo/unbearabl= e




--
3D"Ping
Brian Campbell
Distinguished Engineer =
bcampbell@pingidentity.com
w: +1 720.317.2061
c: +1 = 303.918.9415
=
Connect with us: 3D"Glassdoor 3D"LinkedIn = 3D"twitter= 3D"facebook 3D"youtube 3D"Google+= 3D"Blog
= <= img>
--001a113f34ced53d9c05430612c4-- From nobody Tue Dec 6 15:56:53 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 19964129600 for ; Tue, 6 Dec 2016 15:56:52 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.586 X-Spam-Level: X-Spam-Status: No, score=-5.586 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-2.896, SPF_PASS=-0.001, T_REMOTE_IMAGE=0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OAD7aA8zQypY for ; Tue, 6 Dec 2016 15:56:49 -0800 (PST) Received: from mail-io0-x22f.google.com (mail-io0-x22f.google.com [IPv6:2607:f8b0:4001:c06::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 21E7E12956A for ; Tue, 6 Dec 2016 15:56:49 -0800 (PST) Received: by mail-io0-x22f.google.com with SMTP id a124so683433387ioe.2 for ; Tue, 06 Dec 2016 15:56:49 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=7/OBCZDZDgM7/6Mkpi3a86WBAgoxIEvqt7gZddChu10=; b=oM4dUI2ei400j1LQtJr8TutZjr9uSQF5Nd5mHVrooFWO+ko9wQfk3w3a/vSTW5fOQJ rAZMoNpcUOx1UX6gccdbaXP07e89BOicsjGo+15Ao4PyiSzxDffwdosHa6hJX+j1Id9L 6bmnSKqZWbBiNlvFA/5s6G9pnehZPShoYTqpFlmH9kdQs//DpcFBG0qUWHQO8PqHzi5n n/HOICews3keD3nDpJmkoBJUFOWzj7f/IemJ8CI9PK2A7BwO9/1T7mqMRFVZkP8M8iV3 OYxYU9LXvYzTgCh3RD0/q08NPouzGG9uAjEIQ7NUylgxNMU5ob3gJSWD/eWWFaL94R/i 6oGQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=7/OBCZDZDgM7/6Mkpi3a86WBAgoxIEvqt7gZddChu10=; b=B6xOPlhJuOCBKEmyjebIOHjF+g4rViL2RH2RogSPn4ryaVaQ405DXdWuu+cS3pUlYf XTTkHuXRDAwIF8U9VVbTG5X/RLlQ4F0wu2UqrLBsmaAc9NaJl89ae7qoyUheRZ6CkBOm Q1NtfYvV0OybPL0ceva0OkuDUb+3R4Cqwvi9AERGOQ0mhPr8rw6xHHKzW0aZChyjUeG6 zdRASCJCpYEwaCQy2F+Jx4/E494FZzqxKAdy4/mokBGCzMd93ITaY27xjge4BJDVyk92 laLPu1u7GnaTRPrqaYG96Q9HCIJxDFTFAwwcOeg9UqtT0S3/MTGIekUWWCvmc8tD28ro kRMw== X-Gm-Message-State: AKaTC00dMJARR7tsHNrNEgQelicN5f/+FksGM4/AykCIBmkgYThYkYjLtKRQ6A1jFP9pYc+KEkqw3LXKsNwECZlP X-Received: by 10.107.138.10 with SMTP id m10mr16482454iod.188.1481068608315; Tue, 06 Dec 2016 15:56:48 -0800 (PST) MIME-Version: 1.0 Received: by 10.64.152.41 with HTTP; Tue, 6 Dec 2016 15:56:47 -0800 (PST) In-Reply-To: References: <5807ff47-4222-221b-6332-263825417861@KingsMountain.com> From: Bill Cox Date: Tue, 6 Dec 2016 15:56:47 -0800 Message-ID: To: Martin Thomson Content-Type: multipart/alternative; boundary=001a113f224849abc6054306286e Archived-At: Cc: IETF TokBind WG , Brian Campbell , Nick Harper , =JeffH Subject: Re: [Unbearable] PR#82: TBPROTO: update ECPoint.point to be in X9.62 format with leading 0x04 byte X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 06 Dec 2016 23:56:52 -0000 --001a113f224849abc6054306286e Content-Type: text/plain; charset=UTF-8 All they have to do is strip off the leading 0x04. It does not make sense to me to use a pseudo-standard for EC, but a custom format for RSA. On Tue, Dec 6, 2016 at 3:50 PM, Martin Thomson wrote: > This is a false economy: anyone who is using existing code will likely > have a library that produces X9.62. All of the languages/libraries I'm > aware of natively support that format; only a few have native access to X > and Y. In those languages/libraries, dealing with the custom format is > more work. > > Access to the spec isn't needed, Jeff included a nice definition. (I've > never seen a copy myself and I haven't felt any pain.) > > I think that the relevant concern is Bill's. > > > On 7 December 2016 at 08:28, Brian Campbell > wrote: > >> However, in this case, there's not a compelling reason to use that >> preexisting standard either. >> >> Value comes from using preexisting standards when there exist reusable >> abstractions/implementations of the standard. I've not seen that to be the >> case and X9.62 just becomes extra baggage. >> >> X9.62 2005 isn't exactly easily accessible either - I've not been able to >> find a copy that doesn't require $100 payment. >> >> As Andre has said, the only thing that using the X9.62 format seems to do >> is allow TB to call the ECPoint representation "uncompressed point format >> per ANSI.X9-62.2005". I don't see the value in that. >> >> It'd also be an incompatible change (as Bill points out). That's a good >> reason, to me anyway, to not make the change at this late stage in the >> process. >> >> And yes it's only 1 byte but it's a unnecessary byte that's just going to >> be ignored. I just don't see a benefit to adding that. >> >> I'd prefer that we leave it as currently defined. Noting that there exist >> multiple independent interoperable implementations of the current draft. >> >> >> >> >> >> >> >> On Tue, Dec 6, 2016 at 3:52 PM, Nick Harper wrote: >> >>> I agree with Martin and Jeff. Let's use pre-existing standards unless >>> there's a good reason not to. >>> >>> On Tue, Dec 6, 2016 at 2:22 PM, Martin Thomson >> > wrote: >>> >>>> On 7 December 2016 at 05:36, =JeffH >>>> wrote: >>>> > PR#82: TBPROTO: update ECPoint.point to be in X9.62 format with >>>> leading 0x04 >>>> > byte, fixes #62 >>>> > https://github.com/TokenBinding/Internet-Drafts/pull/82 >>>> >>>> Thanks Jeff, I think that this is a good idea. There is more value in >>>> uniformity than in any narrow notion of optimality >>>> >>>> _______________________________________________ >>>> Unbearable mailing list >>>> Unbearable@ietf.org >>>> https://www.ietf.org/mailman/listinfo/unbearable >>>> >>> >>> >>> _______________________________________________ >>> Unbearable mailing list >>> Unbearable@ietf.org >>> https://www.ietf.org/mailman/listinfo/unbearable >>> >>> >> >> >> -- >> [image: Ping Identity] >> >> Brian Campbell >> Distinguished Engineer >> bcampbell@pingidentity.com >> w: +1 720.317.2061 <(720)%20317-2061> >> c: +1 303.918.9415 <(303)%20918-9415> >> Connect with us: [image: Glassdoor logo] >> [image: >> LinkedIn logo] [image: twitter >> logo] [image: facebook logo] >> [image: youtube logo] >> [image: Google+ logo] >> [image: Blog logo] >> >> >> > > > _______________________________________________ > Unbearable mailing list > Unbearable@ietf.org > https://www.ietf.org/mailman/listinfo/unbearable > > --001a113f224849abc6054306286e Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
All they have to do is strip off the leading 0x04.=C2=A0 I= t does not make sense to me to use a pseudo-standard for EC, but a custom f= ormat for RSA.

On Tue, Dec 6, 2016 at 3:50 PM, Martin Thomson <martin.thomson@g= mail.com> wrote:
This is a false economy: anyone who is using existing co= de will likely have a library that produces X9.62.=C2=A0 All of the languag= es/libraries I'm aware of natively support that format; only a few have= native access to X and Y.=C2=A0 In those languages/libraries, dealing with= the custom format is more work.

Access to the spec isn't = needed, Jeff included a nice definition.=C2=A0 (I've never seen a copy = myself and I haven't felt any pain.)

I think that the rele= vant concern is Bill's.


On 7 December 2016 at 08:28, Brian Campb= ell <bcampbell@pingidentity.com> wrote:
However, in thi= s case, there's not a compelling reason to use that preexisting standar= d either.=C2=A0

Value comes from using preexisting stand= ards when there exist reusable abstractions/implementations of the standard= . I've not seen that to be the case and X9.62 just becomes extra baggag= e.

X9.62 2005 isn't exactly easily accessible either = - I've not been able to find a copy that doesn't require $100 payme= nt.

As Andre has said, the only thing that using the X9.62 fo= rmat seems to do is allow TB to call the ECPoint representation "uncom= pressed point format per ANSI.X9-62.2005". I don't see the value i= n that.

It'd also be an incompatible change (as Bill points out). Tha= t's a good reason, to me anyway, to not make the change at this late st= age in the process.

And yes it's only 1 byte but it's= a unnecessary byte that's just going to be ignored. I just don't s= ee a benefit to adding that.

I'd prefer that we leave it a= s currently defined. Noting that there exist multiple independent interoper= able implementations of the current draft.





<= div>

O= n Tue, Dec 6, 2016 at 3:52 PM, Nick Harper <nharper@google.com> wrote:
I agree with= Martin and Jeff. Let's use pre-existing standards unless there's a= good reason not to.

On Tue, Dec 6, 2016 at 2:22 PM, Martin Thomson <mart= in.thomson@gmail.com> wrote:
= On 7 December 2016 at 05:36, =3DJeffH <Jeff.Hodges@kingsmountain.com> wrote:
> PR#82: TBPROTO: update ECPoint.point to be in X9.62 format with leadin= g 0x04
> byte, fixes #62
> https://github.com/TokenBinding/Int= ernet-Drafts/pull/82

Thanks Jeff, I think that this is a good idea.=C2=A0 There is more v= alue in
uniformity than in any narrow notion of optimality

_______________________________________________
Unbearable mailing list
Unbearable@ietf.or= g
https://www.ietf.org/mailman/listinfo/unbearabl= e


_______________________________________________
Unbearable mailing list
Unbearable@ietf.or= g
https://www.ietf.org/mailman/listinfo/unbearabl= e




--
3D"Ping =
Brian Campbell
Distinguished Engineer <= br> bcampbell@pingidentity.com =
w: +1 720.317.2061
c: +1 303.918.= 9415
= =
Connect with us: 3D"Glassdoor= 3D"LinkedIn<= /a> 3D"t= 3D"faceboo= 3D"youtu= 3D"= <= a href=3D"https://www.pingidentity.com/en/blog.html" style=3D"text-decorati= on:none;margin-right:16px" title=3D"Ping Blog" target=3D"_blank">3D"Blog
= 3D"Ping =
Brian Campbell
Distinguish= ed Engineer
bcampbell@ping= identity.com
w: +1 720.317.2061 =
c: +1 303.918.9415
=
Connect with us: 3D"Glassdoor 3D"LinkedIn = 3D"twitter 3D"facebook 3D"youtube 3D"Google+ = 3D"Blog
<= /td>


_______________________________________________
Unbearable mailing list
Unbearable@ietf.org
https://www.ietf.org/mailman/listinfo/unbearabl= e


--001a113f224849abc6054306286e-- From nobody Tue Dec 6 16:08:05 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 50438129506 for ; Tue, 6 Dec 2016 16:08:03 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.012 X-Spam-Level: X-Spam-Status: No, score=-1.012 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=1.989, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H5=-1, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YILCe9XQ1vxn for ; Tue, 6 Dec 2016 16:08:00 -0800 (PST) Received: from NAM01-SN1-obe.outbound.protection.outlook.com (mail-sn1nam01on0115.outbound.protection.outlook.com [104.47.32.115]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EC6FE1295F7 for ; Tue, 6 Dec 2016 16:07:59 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=snSGbkAoZGwMXQJR6gGBTcdHdcRjdw3tuVWjzi/zKJU=; b=nvVI503Kdhiy65pX3pLevO71HpBBj3ZZOxkv9FDl8fkX4vGXlbZxYNIbJhqdpKe9fPFZr/SCDXV2pAtFA8gocM95xyiw54l8GlaMj+ffKgb5/GUDnquRtp6/GDFUmysOB3NztVPXiNuiDvKZdu/79hS2j296K8/K1tdbEvh81x4= Received: from BN3PR0301MB0836.namprd03.prod.outlook.com (10.160.154.146) by BN3PR0301MB0833.namprd03.prod.outlook.com (10.160.154.143) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.693.12; Wed, 7 Dec 2016 00:07:53 +0000 Received: from BN3PR0301MB0836.namprd03.prod.outlook.com ([10.160.154.146]) by BN3PR0301MB0836.namprd03.prod.outlook.com ([10.160.154.146]) with mapi id 15.01.0693.009; Wed, 7 Dec 2016 00:07:53 +0000 From: Andrei Popov To: Bill Cox , Martin Thomson Thread-Topic: [Unbearable] PR#82: TBPROTO: update ECPoint.point to be in X9.62 format with leading 0x04 byte Thread-Index: AQHSUABw2mLEmfSiTEOKTqPUud+2daD7fmwAgAAIegCAAAnggIAABlsAgAABrICAAAEAoA== Date: Wed, 7 Dec 2016 00:07:53 +0000 Message-ID: References: <5807ff47-4222-221b-6332-263825417861@KingsMountain.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Andrei.Popov@microsoft.com; x-originating-ip: [2001:4898:80e8:9::1d2] x-microsoft-exchange-diagnostics: 1; BN3PR0301MB0833; 7:HFCNLXl0vo+EE5FFec3HXIfYC57pqsuKDpVofPm7IMTuNRQqwWMli+XIqXUPL89cOTxhztP84GrmOTwvpGdCJkToRPXfllWRjWR0pU74zPnw7qwd5k0uRKR6syvKZbmMNlvYq8D+OnySffWjjmINrd2fgUOp3WidyhpeloyRuVFYbzG2rLVvfv/MbmKq7I4YEoMQ2soxBei9refc61MNS/22pmXnCgB+txRm0Mgh9Z4sd7yonewu5w4WduK3IjXfpjErtVLLtUbKIttyEqVLc3gyqYYToRnfHWHBpzXSX4tcc7NZe4m9l0YUeWYswKJFqPY8w1de+JMdjAD8fGPBVrcsllQyZ8VdpvvwFKixu/U+FQtyM3Q2+OUO8LMGDs7h x-ms-office365-filtering-correlation-id: 6c0e9b02-3a8a-4472-d4ce-08d41e351703 x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001); SRVR:BN3PR0301MB0833; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(166708455590820)(258669246490384)(211936372134217)(21748063052155)(21532816269658); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040375)(601004)(2401047)(5005006)(8121501046)(3002001)(10201501046)(6055026)(61426038)(61427038)(6041248)(20161123564025)(20161123555025)(20161123560025)(20161123562025)(6042181)(6047074)(6072148); SRVR:BN3PR0301MB0833; BCL:0; PCL:0; RULEID:; SRVR:BN3PR0301MB0833; x-forefront-prvs: 01494FA7F7 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(7916002)(24454002)(189002)(52314003)(51444003)(199003)(377454003)(77096006)(97736004)(5660300001)(2420400007)(6506006)(92566002)(7906003)(76176999)(189998001)(81166006)(6116002)(2906002)(7846002)(86612001)(5001770100001)(54356999)(8936002)(7736002)(86362001)(9686002)(7696004)(106116001)(606004)(122556002)(74316002)(39060400001)(4326007)(102836003)(229853002)(8676002)(15650500001)(105586002)(76576001)(10090500001)(101416001)(50986999)(2950100002)(3280700002)(93886004)(38730400001)(99286002)(790700001)(10290500002)(33656002)(10710500007)(8990500004)(81156014)(5005710100001)(3660700001)(106356001)(2900100001)(7110500001)(68736007); DIR:OUT; SFP:1102; SCL:1; SRVR:BN3PR0301MB0833; H:BN3PR0301MB0836.namprd03.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:1; LANG:en; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_BN3PR0301MB0836800B7BF58AA0B9E481C88C850BN3PR0301MB0836_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 07 Dec 2016 00:07:53.3372 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN3PR0301MB0833 Archived-At: Cc: IETF TokBind WG , Brian Campbell , =JeffH , Nick Harper Subject: Re: [Unbearable] PR#82: TBPROTO: update ECPoint.point to be in X9.62 format with leading 0x04 byte X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Dec 2016 00:08:03 -0000 --_000_BN3PR0301MB0836800B7BF58AA0B9E481C88C850BN3PR0301MB0836_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 w5ggIOKApmFueW9uZSB3aG8gaXMgdXNpbmcgZXhpc3RpbmcgY29kZSB3aWxsIGxpa2VseSBoYXZl IGEgbGlicmFyeSB0aGF0IHByb2R1Y2VzIFg5LjYyLg0KVGhpcyBpcyBub3QgbmVjZXNzYXJpbHkg dGhlIGNhc2U6IEkgbWFpbnRhaW4gZXhpc3RpbmcgVExTIGNvZGUgdGhhdCBwcm9kdWNlcyBhbmQg Y29uc3VtZXMgWDkuNjIsIGJ1dCBJIGhhdmUgdG8gYWRkL3N0cmlwIHRoZSAweDA0IGluIG15IGNv ZGUuIFRoZSBjcnlwdG8gbGlicmFyaWVzIGluIFdpbmRvd3MgZG9u4oCZdCBoYW5kbGUgMHgwNCBm b3IgbWUuDQpJbiBwcmFjdGljZSwgSeKAmWQgcmF0aGVyIG5vdCBhZGQgYSB1c2VsZXNzIGJ5dGUg b3IgY2hhbmdlIHRoZSB3aXJlIGZvcm1hdCB3aXRob3V0IGEgZ29vZCB0ZWNobmljYWwgcmVhc29u IChJTUhPIGJlaW5nIGFibGUgdG8gcmVmZXJlbmNlIFg5LjYyIGlzIG5vdCBhIGdvb2QgdGVjaG5p Y2FsIHJlYXNvbikuDQoNCkNoZWVycywNCg0KQW5kcmVpDQoNCkZyb206IFVuYmVhcmFibGUgW21h aWx0bzp1bmJlYXJhYmxlLWJvdW5jZXNAaWV0Zi5vcmddIE9uIEJlaGFsZiBPZiBCaWxsIENveA0K U2VudDogVHVlc2RheSwgRGVjZW1iZXIgNiwgMjAxNiAzOjU3IFBNDQpUbzogTWFydGluIFRob21z b24gPG1hcnRpbi50aG9tc29uQGdtYWlsLmNvbT4NCkNjOiBJRVRGIFRva0JpbmQgV0cgPHVuYmVh cmFibGVAaWV0Zi5vcmc+OyBCcmlhbiBDYW1wYmVsbCA8YmNhbXBiZWxsQHBpbmdpZGVudGl0eS5j b20+OyBOaWNrIEhhcnBlciA8bmhhcnBlckBnb29nbGUuY29tPjsgPUplZmZIIDxKZWZmLkhvZGdl c0BraW5nc21vdW50YWluLmNvbT4NClN1YmplY3Q6IFJlOiBbVW5iZWFyYWJsZV0gUFIjODI6IFRC UFJPVE86IHVwZGF0ZSBFQ1BvaW50LnBvaW50IHRvIGJlIGluIFg5LjYyIGZvcm1hdCB3aXRoIGxl YWRpbmcgMHgwNCBieXRlDQoNCkFsbCB0aGV5IGhhdmUgdG8gZG8gaXMgc3RyaXAgb2ZmIHRoZSBs ZWFkaW5nIDB4MDQuICBJdCBkb2VzIG5vdCBtYWtlIHNlbnNlIHRvIG1lIHRvIHVzZSBhIHBzZXVk by1zdGFuZGFyZCBmb3IgRUMsIGJ1dCBhIGN1c3RvbSBmb3JtYXQgZm9yIFJTQS4NCg0KT24gVHVl LCBEZWMgNiwgMjAxNiBhdCAzOjUwIFBNLCBNYXJ0aW4gVGhvbXNvbiA8bWFydGluLnRob21zb25A Z21haWwuY29tPG1haWx0bzptYXJ0aW4udGhvbXNvbkBnbWFpbC5jb20+PiB3cm90ZToNClRoaXMg aXMgYSBmYWxzZSBlY29ub215OiBhbnlvbmUgd2hvIGlzIHVzaW5nIGV4aXN0aW5nIGNvZGUgd2ls bCBsaWtlbHkgaGF2ZSBhIGxpYnJhcnkgdGhhdCBwcm9kdWNlcyBYOS42Mi4gIEFsbCBvZiB0aGUg bGFuZ3VhZ2VzL2xpYnJhcmllcyBJJ20gYXdhcmUgb2YgbmF0aXZlbHkgc3VwcG9ydCB0aGF0IGZv cm1hdDsgb25seSBhIGZldyBoYXZlIG5hdGl2ZSBhY2Nlc3MgdG8gWCBhbmQgWS4gIEluIHRob3Nl IGxhbmd1YWdlcy9saWJyYXJpZXMsIGRlYWxpbmcgd2l0aCB0aGUgY3VzdG9tIGZvcm1hdCBpcyBt b3JlIHdvcmsuDQpBY2Nlc3MgdG8gdGhlIHNwZWMgaXNuJ3QgbmVlZGVkLCBKZWZmIGluY2x1ZGVk IGEgbmljZSBkZWZpbml0aW9uLiAgKEkndmUgbmV2ZXIgc2VlbiBhIGNvcHkgbXlzZWxmIGFuZCBJ IGhhdmVuJ3QgZmVsdCBhbnkgcGFpbi4pDQpJIHRoaW5rIHRoYXQgdGhlIHJlbGV2YW50IGNvbmNl cm4gaXMgQmlsbCdzLg0KDQoNCk9uIDcgRGVjZW1iZXIgMjAxNiBhdCAwODoyOCwgQnJpYW4gQ2Ft cGJlbGwgPGJjYW1wYmVsbEBwaW5naWRlbnRpdHkuY29tPG1haWx0bzpiY2FtcGJlbGxAcGluZ2lk ZW50aXR5LmNvbT4+IHdyb3RlOg0KSG93ZXZlciwgaW4gdGhpcyBjYXNlLCB0aGVyZSdzIG5vdCBh IGNvbXBlbGxpbmcgcmVhc29uIHRvIHVzZSB0aGF0IHByZWV4aXN0aW5nIHN0YW5kYXJkIGVpdGhl ci4NClZhbHVlIGNvbWVzIGZyb20gdXNpbmcgcHJlZXhpc3Rpbmcgc3RhbmRhcmRzIHdoZW4gdGhl cmUgZXhpc3QgcmV1c2FibGUgYWJzdHJhY3Rpb25zL2ltcGxlbWVudGF0aW9ucyBvZiB0aGUgc3Rh bmRhcmQuIEkndmUgbm90IHNlZW4gdGhhdCB0byBiZSB0aGUgY2FzZSBhbmQgWDkuNjIganVzdCBi ZWNvbWVzIGV4dHJhIGJhZ2dhZ2UuDQoNClg5LjYyIDIwMDUgaXNuJ3QgZXhhY3RseSBlYXNpbHkg YWNjZXNzaWJsZSBlaXRoZXIgLSBJJ3ZlIG5vdCBiZWVuIGFibGUgdG8gZmluZCBhIGNvcHkgdGhh dCBkb2Vzbid0IHJlcXVpcmUgJDEwMCBwYXltZW50Lg0KQXMgQW5kcmUgaGFzIHNhaWQsIHRoZSBv bmx5IHRoaW5nIHRoYXQgdXNpbmcgdGhlIFg5LjYyIGZvcm1hdCBzZWVtcyB0byBkbyBpcyBhbGxv dyBUQiB0byBjYWxsIHRoZSBFQ1BvaW50IHJlcHJlc2VudGF0aW9uICJ1bmNvbXByZXNzZWQgcG9p bnQgZm9ybWF0IHBlciBBTlNJLlg5LTYyLjIwMDUiLiBJIGRvbid0IHNlZSB0aGUgdmFsdWUgaW4g dGhhdC4NCkl0J2QgYWxzbyBiZSBhbiBpbmNvbXBhdGlibGUgY2hhbmdlIChhcyBCaWxsIHBvaW50 cyBvdXQpLiBUaGF0J3MgYSBnb29kIHJlYXNvbiwgdG8gbWUgYW55d2F5LCB0byBub3QgbWFrZSB0 aGUgY2hhbmdlIGF0IHRoaXMgbGF0ZSBzdGFnZSBpbiB0aGUgcHJvY2Vzcy4NCkFuZCB5ZXMgaXQn cyBvbmx5IDEgYnl0ZSBidXQgaXQncyBhIHVubmVjZXNzYXJ5IGJ5dGUgdGhhdCdzIGp1c3QgZ29p bmcgdG8gYmUgaWdub3JlZC4gSSBqdXN0IGRvbid0IHNlZSBhIGJlbmVmaXQgdG8gYWRkaW5nIHRo YXQuDQpJJ2QgcHJlZmVyIHRoYXQgd2UgbGVhdmUgaXQgYXMgY3VycmVudGx5IGRlZmluZWQuIE5v dGluZyB0aGF0IHRoZXJlIGV4aXN0IG11bHRpcGxlIGluZGVwZW5kZW50IGludGVyb3BlcmFibGUg aW1wbGVtZW50YXRpb25zIG9mIHRoZSBjdXJyZW50IGRyYWZ0Lg0KDQoNCg0KDQpPbiBUdWUsIERl YyA2LCAyMDE2IGF0IDM6NTIgUE0sIE5pY2sgSGFycGVyIDxuaGFycGVyQGdvb2dsZS5jb208bWFp bHRvOm5oYXJwZXJAZ29vZ2xlLmNvbT4+IHdyb3RlOg0KSSBhZ3JlZSB3aXRoIE1hcnRpbiBhbmQg SmVmZi4gTGV0J3MgdXNlIHByZS1leGlzdGluZyBzdGFuZGFyZHMgdW5sZXNzIHRoZXJlJ3MgYSBn b29kIHJlYXNvbiBub3QgdG8uDQoNCk9uIFR1ZSwgRGVjIDYsIDIwMTYgYXQgMjoyMiBQTSwgTWFy dGluIFRob21zb24gPG1hcnRpbi50aG9tc29uQGdtYWlsLmNvbTxtYWlsdG86bWFydGluLnRob21z b25AZ21haWwuY29tPj4gd3JvdGU6DQpPbiA3IERlY2VtYmVyIDIwMTYgYXQgMDU6MzYsID1KZWZm SCA8SmVmZi5Ib2RnZXNAa2luZ3Ntb3VudGFpbi5jb208bWFpbHRvOkplZmYuSG9kZ2VzQGtpbmdz bW91bnRhaW4uY29tPj4gd3JvdGU6DQo+IFBSIzgyOiBUQlBST1RPOiB1cGRhdGUgRUNQb2ludC5w b2ludCB0byBiZSBpbiBYOS42MiBmb3JtYXQgd2l0aCBsZWFkaW5nIDB4MDQNCj4gYnl0ZSwgZml4 ZXMgIzYyDQo+IGh0dHBzOi8vZ2l0aHViLmNvbS9Ub2tlbkJpbmRpbmcvSW50ZXJuZXQtRHJhZnRz L3B1bGwvODINCg0KVGhhbmtzIEplZmYsIEkgdGhpbmsgdGhhdCB0aGlzIGlzIGEgZ29vZCBpZGVh LiAgVGhlcmUgaXMgbW9yZSB2YWx1ZSBpbg0KdW5pZm9ybWl0eSB0aGFuIGluIGFueSBuYXJyb3cg bm90aW9uIG9mIG9wdGltYWxpdHkNCg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX18NClVuYmVhcmFibGUgbWFpbGluZyBsaXN0DQpVbmJlYXJhYmxlQGlldGYu b3JnPG1haWx0bzpVbmJlYXJhYmxlQGlldGYub3JnPg0KaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFp bG1hbi9saXN0aW5mby91bmJlYXJhYmxlDQoNCg0KX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX18NClVuYmVhcmFibGUgbWFpbGluZyBsaXN0DQpVbmJlYXJhYmxl QGlldGYub3JnPG1haWx0bzpVbmJlYXJhYmxlQGlldGYub3JnPg0KaHR0cHM6Ly93d3cuaWV0Zi5v cmcvbWFpbG1hbi9saXN0aW5mby91bmJlYXJhYmxlDQoNCg0KLS0NCjxodHRwczovL3d3dy5waW5n aWRlbnRpdHkuY29tPg0KDQpCcmlhbiBDYW1wYmVsbA0KRGlzdGluZ3Vpc2hlZCBFbmdpbmVlcg0K YmNhbXBiZWxsQHBpbmdpZGVudGl0eS5jb20NCnc6ICsxIDcyMC4zMTcuMjA2MQ0KYzogKzEgMzAz LjkxOC45NDE1IDxodHRwczovL3d3dy5waW5naWRlbnRpdHkuY29tPg0KDQoNCkNvbm5lY3Qgd2l0 aCB1czogPGh0dHBzOi8vd3d3LnBpbmdpZGVudGl0eS5jb20+DQoNCjxodHRwczovL3d3dy5waW5n aWRlbnRpdHkuY29tPg0KDQogPGh0dHBzOi8vd3d3LnBpbmdpZGVudGl0eS5jb20+DQoNCl9fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQpVbmJlYXJhYmxlIG1h aWxpbmcgbGlzdA0KVW5iZWFyYWJsZUBpZXRmLm9yZw0KaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFp bG1hbi9saXN0aW5mby91bmJlYXJhYmxlPGh0dHBzOi8vd3d3LnBpbmdpZGVudGl0eS5jb20+DQoN CiA8aHR0cHM6Ly93d3cucGluZ2lkZW50aXR5LmNvbT4NCg== --_000_BN3PR0301MB0836800B7BF58AA0B9E481C88C850BN3PR0301MB0836_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 V2luZ2RpbmdzOw0KCXBhbm9zZS0xOjUgMCAwIDAgMCAwIDAgMCAwIDA7fQ0KQGZvbnQtZmFjZQ0K CXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2IDMg MiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1 IDUgMiAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWws IGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0 b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcg Um9tYW4iLHNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXBy aW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQph OnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5 Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnAuTXNv TGlzdFBhcmFncmFwaCwgbGkuTXNvTGlzdFBhcmFncmFwaCwgZGl2Lk1zb0xpc3RQYXJhZ3JhcGgN Cgl7bXNvLXN0eWxlLXByaW9yaXR5OjM0Ow0KCW1hcmdpbi10b3A6MGluOw0KCW1hcmdpbi1yaWdo dDowaW47DQoJbWFyZ2luLWJvdHRvbTowaW47DQoJbWFyZ2luLWxlZnQ6LjVpbjsNCgltYXJnaW4t Ym90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGltZXMg TmV3IFJvbWFuIixzZXJpZjt9DQpwLm1zb25vcm1hbDAsIGxpLm1zb25vcm1hbDAsIGRpdi5tc29u b3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCgltc28tbWFyZ2luLXRvcC1hbHQ6 YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0K CW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1l cyBOZXcgUm9tYW4iLHNlcmlmO30NCnNwYW4uaG9lbnpiDQoJe21zby1zdHlsZS1uYW1lOmhvZW56 Yjt9DQpzcGFuLm0xMjE3NjQ2MzU4NjQ1MTYyNzA0aG9lbnpiDQoJe21zby1zdHlsZS1uYW1lOm1f MTIxNzY0NjM1ODY0NTE2MjcwNGhvZW56Yjt9DQpzcGFuLkVtYWlsU3R5bGUyMA0KCXttc28tc3R5 bGUtdHlwZTpwZXJzb25hbC1yZXBseTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJp ZjsNCgljb2xvcjp3aW5kb3d0ZXh0O30NCi5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBl OmV4cG9ydC1vbmx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCkBwYWdl IFdvcmRTZWN0aW9uMQ0KCXtzaXplOjguNWluIDExLjBpbjsNCgltYXJnaW46MS4waW4gMS4waW4g MS4waW4gMS4waW47fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQov KiBMaXN0IERlZmluaXRpb25zICovDQpAbGlzdCBsMA0KCXttc28tbGlzdC1pZDoxOTMzMjQ2NTYz Ow0KCW1zby1saXN0LXR5cGU6aHlicmlkOw0KCW1zby1saXN0LXRlbXBsYXRlLWlkczotMjEyOTUx NjMwNCAtMTg3MDM1MTI1MCA2NzY5ODY5MSA2NzY5ODY5MyA2NzY5ODY4OSA2NzY5ODY5MSA2NzY5 ODY5MyA2NzY5ODY4OSA2NzY5ODY5MSA2NzY5ODY5Mzt9DQpAbGlzdCBsMDpsZXZlbDENCgl7bXNv LWxldmVsLXN0YXJ0LWF0OjA7DQoJbXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1z by1sZXZlbC10ZXh0Ou+DmDsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwt bnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5 OldpbmdkaW5nczsNCgltc28tZmFyZWFzdC1mb250LWZhbWlseTpDYWxpYnJpOw0KCW1zby1iaWRp LWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iO30NCkBsaXN0IGwwOmxldmVsMg0KCXttc28t bGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6bzsNCgltc28tbGV2 ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4 dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyI7fQ0KQGxpc3QgbDA6 bGV2ZWwzDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4 dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3Np dGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7 fQ0KQGxpc3QgbDA6bGV2ZWw0DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCglt c28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVs LW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWls eTpTeW1ib2w7fQ0KQGxpc3QgbDA6bGV2ZWw1DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1 bGxldDsNCgltc28tbGV2ZWwtdGV4dDpvOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1z by1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9u dC1mYW1pbHk6IkNvdXJpZXIgTmV3Ijt9DQpAbGlzdCBsMDpsZXZlbDYNCgl7bXNvLWxldmVsLW51 bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFi LXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRl bnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMDpsZXZlbDcNCgl7 bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCglt c28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7 DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMDps ZXZlbDgNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0 Om87DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlv bjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseToiQ291cmllciBOZXci O30NCkBsaXN0IGwwOmxldmVsOQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJ bXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZl bC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1p bHk6V2luZ2RpbmdzO30NCm9sDQoJe21hcmdpbi1ib3R0b206MGluO30NCnVsDQoJe21hcmdpbi1i b3R0b206MGluO30NCi0tPjwvc3R5bGU+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFw ZWRlZmF1bHRzIHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2IiAvPg0KPC94bWw+PCFbZW5kaWZd LS0+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWxheW91dCB2OmV4dD0iZWRpdCI+ DQo8bzppZG1hcCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4NCjwvbzpzaGFwZWxheW91dD48L3ht bD48IVtlbmRpZl0tLT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9IkVOLVVTIiBsaW5rPSJibHVlIiB2 bGluaz0icHVycGxlIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNv TGlzdFBhcmFncmFwaCIgc3R5bGU9InRleHQtaW5kZW50Oi0uMjVpbjttc28tbGlzdDpsMCBsZXZl bDEgbGZvMSI+PCFbaWYgIXN1cHBvcnRMaXN0c10+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6V2luZ2RpbmdzIj48c3BhbiBzdHlsZT0ibXNvLWxpc3Q6SWdub3JlIj7D mDxzcGFuIHN0eWxlPSJmb250OjcuMHB0ICZxdW90O1RpbWVzIE5ldyBSb21hbiZxdW90OyI+Jm5i c3A7DQo8L3NwYW4+PC9zcGFuPjwvc3Bhbj48IVtlbmRpZl0+4oCmYW55b25lIHdobyBpcyB1c2lu ZyBleGlzdGluZyBjb2RlIHdpbGwgbGlrZWx5IGhhdmUgYSBsaWJyYXJ5IHRoYXQgcHJvZHVjZXMg WDkuNjIuJm5ic3A7PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPlRoaXMgaXMgbm90IG5lY2Vzc2FyaWx5 IHRoZSBjYXNlOiBJIG1haW50YWluIGV4aXN0aW5nIFRMUyBjb2RlIHRoYXQgcHJvZHVjZXMgYW5k IGNvbnN1bWVzIFg5LjYyLCBidXQgSSBoYXZlIHRvIGFkZC9zdHJpcCB0aGUgMHgwNCBpbiBteSBj b2RlLiBUaGUgY3J5cHRvIGxpYnJhcmllcyBpbiBXaW5kb3dzDQogZG9u4oCZdCBoYW5kbGUgMHgw NCBmb3IgbWUuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmIj5JbiBwcmFjdGljZSwgSeKAmWQgcmF0aGVyIG5vdCBhZGQgYSB1c2VsZXNz IGJ5dGUgb3IgY2hhbmdlIHRoZSB3aXJlIGZvcm1hdCB3aXRob3V0IGEgZ29vZCB0ZWNobmljYWwg cmVhc29uIChJTUhPIGJlaW5nIGFibGUgdG8gcmVmZXJlbmNlIFg5LjYyIGlzIG5vdCBhIGdvb2Qg dGVjaG5pY2FsIHJlYXNvbikuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2Fs aWJyaSZxdW90OyxzYW5zLXNlcmlmIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkNoZWVycyw8bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+Jm5ic3A7 PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+ QW5kcmVpPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90Oyxz YW5zLXNlcmlmIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD YWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkZyb206PC9zcGFuPjwvYj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYi PiBVbmJlYXJhYmxlIFttYWlsdG86dW5iZWFyYWJsZS1ib3VuY2VzQGlldGYub3JnXQ0KPGI+T24g QmVoYWxmIE9mIDwvYj5CaWxsIENveDxicj4NCjxiPlNlbnQ6PC9iPiBUdWVzZGF5LCBEZWNlbWJl ciA2LCAyMDE2IDM6NTcgUE08YnI+DQo8Yj5Ubzo8L2I+IE1hcnRpbiBUaG9tc29uICZsdDttYXJ0 aW4udGhvbXNvbkBnbWFpbC5jb20mZ3Q7PGJyPg0KPGI+Q2M6PC9iPiBJRVRGIFRva0JpbmQgV0cg Jmx0O3VuYmVhcmFibGVAaWV0Zi5vcmcmZ3Q7OyBCcmlhbiBDYW1wYmVsbCAmbHQ7YmNhbXBiZWxs QHBpbmdpZGVudGl0eS5jb20mZ3Q7OyBOaWNrIEhhcnBlciAmbHQ7bmhhcnBlckBnb29nbGUuY29t Jmd0OzsgPUplZmZIICZsdDtKZWZmLkhvZGdlc0BraW5nc21vdW50YWluLmNvbSZndDs8YnI+DQo8 Yj5TdWJqZWN0OjwvYj4gUmU6IFtVbmJlYXJhYmxlXSBQUiM4MjogVEJQUk9UTzogdXBkYXRlIEVD UG9pbnQucG9pbnQgdG8gYmUgaW4gWDkuNjIgZm9ybWF0IHdpdGggbGVhZGluZyAweDA0IGJ5dGU8 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwv bzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5BbGwgdGhleSBoYXZlIHRvIGRv IGlzIHN0cmlwIG9mZiB0aGUgbGVhZGluZyAweDA0LiZuYnNwOyBJdCBkb2VzIG5vdCBtYWtlIHNl bnNlIHRvIG1lIHRvIHVzZSBhIHBzZXVkby1zdGFuZGFyZCBmb3IgRUMsIGJ1dCBhIGN1c3RvbSBm b3JtYXQgZm9yIFJTQS48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPk9uIFR1ZSwgRGVjIDYsIDIwMTYgYXQgMzo1MCBQTSwgTWFydGluIFRob21zb24gJmx0Ozxh IGhyZWY9Im1haWx0bzptYXJ0aW4udGhvbXNvbkBnbWFpbC5jb20iIHRhcmdldD0iX2JsYW5rIj5t YXJ0aW4udGhvbXNvbkBnbWFpbC5jb208L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjxi bG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEu MHB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXJp Z2h0OjBpbiI+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibWFyZ2luLWJvdHRvbToxMi4wcHQiPlRoaXMgaXMgYSBmYWxzZSBlY29ub215OiBhbnlvbmUg d2hvIGlzIHVzaW5nIGV4aXN0aW5nIGNvZGUgd2lsbCBsaWtlbHkgaGF2ZSBhIGxpYnJhcnkgdGhh dCBwcm9kdWNlcyBYOS42Mi4mbmJzcDsgQWxsIG9mIHRoZSBsYW5ndWFnZXMvbGlicmFyaWVzIEkn bSBhd2FyZSBvZiBuYXRpdmVseSBzdXBwb3J0IHRoYXQgZm9ybWF0OyBvbmx5IGEgZmV3IGhhdmUg bmF0aXZlIGFjY2Vzcw0KIHRvIFggYW5kIFkuJm5ic3A7IEluIHRob3NlIGxhbmd1YWdlcy9saWJy YXJpZXMsIGRlYWxpbmcgd2l0aCB0aGUgY3VzdG9tIGZvcm1hdCBpcyBtb3JlIHdvcmsuPG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tYm90 dG9tOjEyLjBwdCI+QWNjZXNzIHRvIHRoZSBzcGVjIGlzbid0IG5lZWRlZCwgSmVmZiBpbmNsdWRl ZCBhIG5pY2UgZGVmaW5pdGlvbi4mbmJzcDsgKEkndmUgbmV2ZXIgc2VlbiBhIGNvcHkgbXlzZWxm IGFuZCBJIGhhdmVuJ3QgZmVsdCBhbnkgcGFpbi4pPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPkkgdGhpbmsgdGhhdCB0aGUgcmVsZXZhbnQgY29uY2VybiBpcyBC aWxsJ3MuPG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4m bmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk9u IDcgRGVjZW1iZXIgMjAxNiBhdCAwODoyOCwgQnJpYW4gQ2FtcGJlbGwgJmx0OzxhIGhyZWY9Im1h aWx0bzpiY2FtcGJlbGxAcGluZ2lkZW50aXR5LmNvbSIgdGFyZ2V0PSJfYmxhbmsiPmJjYW1wYmVs bEBwaW5naWRlbnRpdHkuY29tPC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8YmxvY2tx dW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtw YWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi1yaWdodDow aW4iPg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibWFyZ2luLWJvdHRvbToxMi4wcHQiPkhvd2V2ZXIsIGluIHRoaXMgY2FzZSwg dGhlcmUncyBub3QgYSBjb21wZWxsaW5nIHJlYXNvbiB0byB1c2UgdGhhdCBwcmVleGlzdGluZyBz dGFuZGFyZCBlaXRoZXIuJm5ic3A7DQo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPlZhbHVlIGNvbWVzIGZyb20gdXNpbmcgcHJlZXhpc3Rpbmcgc3Rh bmRhcmRzIHdoZW4gdGhlcmUgZXhpc3QgcmV1c2FibGUgYWJzdHJhY3Rpb25zL2ltcGxlbWVudGF0 aW9ucyBvZiB0aGUgc3RhbmRhcmQuIEkndmUgbm90IHNlZW4gdGhhdCB0byBiZSB0aGUgY2FzZSBh bmQgWDkuNjIganVzdCBiZWNvbWVzIGV4dHJhIGJhZ2dhZ2UuPG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWJvdHRvbToxMi4w cHQiPjxicj4NClg5LjYyIDIwMDUgaXNuJ3QgZXhhY3RseSBlYXNpbHkgYWNjZXNzaWJsZSBlaXRo ZXIgLSBJJ3ZlIG5vdCBiZWVuIGFibGUgdG8gZmluZCBhIGNvcHkgdGhhdCBkb2Vzbid0IHJlcXVp cmUgJDEwMCBwYXltZW50Lg0KPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtYXJnaW4tYm90dG9tOjEyLjBwdCI+QXMgQW5kcmUgaGFzIHNhaWQsIHRo ZSBvbmx5IHRoaW5nIHRoYXQgdXNpbmcgdGhlIFg5LjYyIGZvcm1hdCBzZWVtcyB0byBkbyBpcyBh bGxvdyBUQiB0byBjYWxsIHRoZSBFQ1BvaW50IHJlcHJlc2VudGF0aW9uICZxdW90O3VuY29tcHJl c3NlZCBwb2ludCBmb3JtYXQgcGVyIEFOU0kuWDktNjIuMjAwNSZxdW90Oy4gSSBkb24ndCBzZWUg dGhlIHZhbHVlIGluIHRoYXQuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtYXJnaW4tYm90dG9tOjEyLjBwdCI+SXQnZCBhbHNvIGJlIGFuIGluY29t cGF0aWJsZSBjaGFuZ2UgKGFzIEJpbGwgcG9pbnRzIG91dCkuIFRoYXQncyBhIGdvb2QgcmVhc29u LCB0byBtZSBhbnl3YXksIHRvIG5vdCBtYWtlIHRoZSBjaGFuZ2UgYXQgdGhpcyBsYXRlIHN0YWdl IGluIHRoZSBwcm9jZXNzLg0KPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtYXJnaW4tYm90dG9tOjEyLjBwdCI+QW5kIHllcyBpdCdzIG9ubHkgMSBi eXRlIGJ1dCBpdCdzIGEgdW5uZWNlc3NhcnkgYnl0ZSB0aGF0J3MganVzdCBnb2luZyB0byBiZSBp Z25vcmVkLiBJIGp1c3QgZG9uJ3Qgc2VlIGEgYmVuZWZpdCB0byBhZGRpbmcgdGhhdC48bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1ib3R0 b206MTIuMHB0Ij5JJ2QgcHJlZmVyIHRoYXQgd2UgbGVhdmUgaXQgYXMgY3VycmVudGx5IGRlZmlu ZWQuIE5vdGluZyB0aGF0IHRoZXJlIGV4aXN0IG11bHRpcGxlIGluZGVwZW5kZW50IGludGVyb3Bl cmFibGUgaW1wbGVtZW50YXRpb25zIG9mIHRoZSBjdXJyZW50IGRyYWZ0Lg0KPGJyPg0KPGJyPg0K PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdp bi1ib3R0b206MTIuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWJvdHRvbToxMi4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5PbiBUdWUsIERlYyA2LCAyMDE2IGF0IDM6NTIgUE0sIE5p Y2sgSGFycGVyICZsdDs8YSBocmVmPSJtYWlsdG86bmhhcnBlckBnb29nbGUuY29tIiB0YXJnZXQ9 Il9ibGFuayI+bmhhcnBlckBnb29nbGUuY29tPC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+ DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0ND QyAxLjBwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdp bi1yaWdodDowaW4iPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkkgYWdyZWUgd2l0aCBN YXJ0aW4gYW5kIEplZmYuIExldCdzIHVzZSBwcmUtZXhpc3Rpbmcgc3RhbmRhcmRzIHVubGVzcyB0 aGVyZSdzIGEgZ29vZCByZWFzb24gbm90IHRvLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+T24gVHVlLCBEZWMgNiwgMjAxNiBhdCAyOjIyIFBNLCBNYXJ0aW4g VGhvbXNvbiAmbHQ7PGEgaHJlZj0ibWFpbHRvOm1hcnRpbi50aG9tc29uQGdtYWlsLmNvbSIgdGFy Z2V0PSJfYmxhbmsiPm1hcnRpbi50aG9tc29uQGdtYWlsLmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+ PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7 Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0 O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi1yaWdodDowaW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+T24gNyBEZWNlbWJlciAyMDE2IGF0IDA1OjM2LCA9SmVmZkggJmx0OzxhIGhyZWY9Im1haWx0 bzpKZWZmLkhvZGdlc0BraW5nc21vdW50YWluLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPkplZmYuSG9k Z2VzQGtpbmdzbW91bnRhaW4uY29tPC9hPiZndDsgd3JvdGU6PGJyPg0KJmd0OyBQUiM4MjogVEJQ Uk9UTzogdXBkYXRlIEVDUG9pbnQucG9pbnQgdG8gYmUgaW4gWDkuNjIgZm9ybWF0IHdpdGggbGVh ZGluZyAweDA0PGJyPg0KJmd0OyBieXRlLCBmaXhlcyAjNjI8YnI+DQomZ3Q7IDxhIGhyZWY9Imh0 dHBzOi8vZ2l0aHViLmNvbS9Ub2tlbkJpbmRpbmcvSW50ZXJuZXQtRHJhZnRzL3B1bGwvODIiIHRh cmdldD0iX2JsYW5rIj4NCmh0dHBzOi8vZ2l0aHViLmNvbS9Ub2tlbkJpbmRpbmcvSW50ZXJuZXQt RHJhZnRzL3B1bGwvODI8L2E+PGJyPg0KPGJyPg0KVGhhbmtzIEplZmYsIEkgdGhpbmsgdGhhdCB0 aGlzIGlzIGEgZ29vZCBpZGVhLiZuYnNwOyBUaGVyZSBpcyBtb3JlIHZhbHVlIGluPGJyPg0KdW5p Zm9ybWl0eSB0aGFuIGluIGFueSBuYXJyb3cgbm90aW9uIG9mIG9wdGltYWxpdHk8bzpwPjwvbzpw PjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGJyPg0KX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX188YnI+DQpVbmJlYXJhYmxlIG1h aWxpbmcgbGlzdDxicj4NCjxhIGhyZWY9Im1haWx0bzpVbmJlYXJhYmxlQGlldGYub3JnIiB0YXJn ZXQ9Il9ibGFuayI+VW5iZWFyYWJsZUBpZXRmLm9yZzwvYT48YnI+DQo8YSBocmVmPSJodHRwczov L3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3VuYmVhcmFibGUiIHRhcmdldD0iX2JsYW5r Ij5odHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3VuYmVhcmFibGU8L2E+PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8L2Rp dj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8 L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tYm90dG9tOjEyLjBwdCI+ PGJyPg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX188YnI+ DQpVbmJlYXJhYmxlIG1haWxpbmcgbGlzdDxicj4NCjxhIGhyZWY9Im1haWx0bzpVbmJlYXJhYmxl QGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+VW5iZWFyYWJsZUBpZXRmLm9yZzwvYT48YnI+DQo8 YSBocmVmPSJodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3VuYmVhcmFibGUi IHRhcmdldD0iX2JsYW5rIj5odHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3Vu YmVhcmFibGU8L2E+PG86cD48L286cD48L3A+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxicj4NCjxiciBjbGVhcj0iYWxsIj4NCjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBjbGFzcz0ibTEyMTc2NDYzNTg2NDUxNjI3MDRob2VuemIiPjxzcGFuIHN0eWxlPSJjb2xvcjoj ODg4ODg4Ij4tLQ0KPG86cD48L286cD48L3NwYW4+PC9zcGFuPjwvcD4NCjxkaXY+DQo8ZGl2Pg0K PHRhYmxlIGNsYXNzPSJNc29Ob3JtYWxUYWJsZSIgYm9yZGVyPSIwIiBjZWxsc3BhY2luZz0iMCIg Y2VsbHBhZGRpbmc9IjAiIHN0eWxlPSJib3JkZXItY29sbGFwc2U6Y29sbGFwc2UiPg0KPHRib2R5 Pg0KPHRyPg0KPHRkIHdpZHRoPSIxMTMiIHN0eWxlPSJ3aWR0aDo4NC43NXB0O3BhZGRpbmc6MGlu IDBpbiAwaW4gMGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxhIGhyZWY9Imh0dHBzOi8vd3d3 LnBpbmdpZGVudGl0eS5jb20iIHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iY29sb3I6d2lu ZG93dGV4dDt0ZXh0LWRlY29yYXRpb246bm9uZSI+PG86cD48L286cD48L3NwYW4+PC9hPjwvcD4N CjwvdGQ+DQo8dGQgc3R5bGU9InBhZGRpbmc6MGluIDBpbiAwaW4gMGluIj4NCjx0YWJsZSBjbGFz cz0iTXNvTm9ybWFsVGFibGUiIGJvcmRlcj0iMCIgY2VsbHBhZGRpbmc9IjAiPg0KPHRib2R5Pg0K PHRyPg0KPHRkIHZhbGlnbj0idG9wIiBzdHlsZT0icGFkZGluZzouNzVwdCAuNzVwdCAuNzVwdCAu NzVwdCI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEw LjVwdDtmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiNFNjFE M0MiPjxhIGhyZWY9Imh0dHBzOi8vd3d3LnBpbmdpZGVudGl0eS5jb20iIHRhcmdldD0iX2JsYW5r Ij48c3BhbiBzdHlsZT0iY29sb3I6I0U2MUQzQzt0ZXh0LWRlY29yYXRpb246bm9uZSI+QnJpYW4g Q2FtcGJlbGw8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7VGltZXMgTmV3IFJvbWFuJnF1b3Q7LHNlcmlmO2NvbG9yOndpbmRvd3RleHQ7Zm9udC13 ZWlnaHQ6bm9ybWFsO3RleHQtZGVjb3JhdGlvbjpub25lIj4NCjxicj4NCjwvc3Bhbj48c3BhbiBz dHlsZT0iY29sb3I6YmxhY2s7Zm9udC13ZWlnaHQ6bm9ybWFsO3RleHQtZGVjb3JhdGlvbjpub25l Ij5EaXN0aW5ndWlzaGVkIEVuZ2luZWVyPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O1RpbWVzIE5ldyBSb21hbiZxdW90OyxzZXJpZjtjb2xvcjp3 aW5kb3d0ZXh0O2ZvbnQtd2VpZ2h0Om5vcm1hbDt0ZXh0LWRlY29yYXRpb246bm9uZSI+DQo8YnI+ DQo8L3NwYW4+PHNwYW4gc3R5bGU9ImNvbG9yOndpbmRvd3RleHQ7Zm9udC13ZWlnaHQ6bm9ybWFs O3RleHQtZGVjb3JhdGlvbjpub25lIj48dT48c3BhbiBzdHlsZT0iY29sb3I6Ymx1ZSI+YmNhbXBi ZWxsQHBpbmdpZGVudGl0eS5jb208L3NwYW4+PC91Pjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjEyLjBwdDtmb250LWZhbWlseTomcXVvdDtUaW1lcyBOZXcgUm9tYW4mcXVvdDssc2VyaWY7 Y29sb3I6d2luZG93dGV4dDtmb250LXdlaWdodDpub3JtYWw7dGV4dC1kZWNvcmF0aW9uOm5vbmUi Pg0KPGJyPg0KPC9zcGFuPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjaztmb250LXdlaWdodDpub3Jt YWw7dGV4dC1kZWNvcmF0aW9uOm5vbmUiPnc6IDx1PjxzcGFuIHN0eWxlPSJjb2xvcjpibHVlIj4m IzQzOzEgNzIwLjMxNy4yMDYxPC9zcGFuPjwvdT48L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMi4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VGltZXMgTmV3IFJvbWFuJnF1b3Q7LHNlcmlmO2Nv bG9yOndpbmRvd3RleHQ7Zm9udC13ZWlnaHQ6bm9ybWFsO3RleHQtZGVjb3JhdGlvbjpub25lIj4N Cjxicj4NCjwvc3Bhbj48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2s7Zm9udC13ZWlnaHQ6bm9ybWFs O3RleHQtZGVjb3JhdGlvbjpub25lIj5jOiA8dT48c3BhbiBzdHlsZT0iY29sb3I6Ymx1ZSI+JiM0 MzsxIDMwMy45MTguOTQxNTwvc3Bhbj48L3U+PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTIuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1RpbWVzIE5ldyBSb21hbiZxdW90OyxzZXJpZjtjb2xv cjp3aW5kb3d0ZXh0O2ZvbnQtd2VpZ2h0Om5vcm1hbDt0ZXh0LWRlY29yYXRpb246bm9uZSI+DQo8 bzpwPjwvbzpwPjwvc3Bhbj48L2E+PC9zcGFuPjwvYj48L3A+DQo8L3RkPg0KPC90cj4NCjwvdGJv ZHk+DQo8L3RhYmxlPg0KPC90ZD4NCjwvdHI+DQo8dHI+DQo8dGQgY29sc3Bhbj0iMiIgc3R5bGU9 InBhZGRpbmc6MGluIDBpbiAwaW4gMGluIj4NCjx0YWJsZSBjbGFzcz0iTXNvTm9ybWFsVGFibGUi IGJvcmRlcj0iMCIgY2VsbHNwYWNpbmc9IjAiIGNlbGxwYWRkaW5nPSIwIiB3aWR0aD0iMTAwJSIg c3R5bGU9IndpZHRoOjEwMC4wJTtib3JkZXItY29sbGFwc2U6Y29sbGFwc2UiPg0KPHRib2R5Pg0K PHRyIHN0eWxlPSJoZWlnaHQ6MzAuMHB0Ij4NCjx0ZCBzdHlsZT0icGFkZGluZzouNzVwdCAuNzVw dCAuNzVwdCAuNzVwdDtoZWlnaHQ6MzAuMHB0Ij4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtYXJnaW4tdG9wOjYuMHB0Ij48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjVwdDtmb250 LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiM0MDQ3NEIiPjxhIGhy ZWY9Imh0dHBzOi8vd3d3LnBpbmdpZGVudGl0eS5jb20iIHRhcmdldD0iX2JsYW5rIj48c3BhbiBz dHlsZT0iY29sb3I6IzQwNDc0Qjt0ZXh0LWRlY29yYXRpb246bm9uZSI+Q29ubmVjdCB3aXRoIHVz Og0KPG86cD48L286cD48L3NwYW4+PC9hPjwvc3Bhbj48L2I+PC9wPg0KPC90ZD4NCjx0ZCBzdHls ZT0icGFkZGluZzozLjBwdCAwaW4gMGluIDE1LjBwdDtoZWlnaHQ6MzAuMHB0Ij4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tdG9wOjYuMHB0Ij48YSBocmVmPSJodHRwczovL3d3 dy5waW5naWRlbnRpdHkuY29tIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNvbG9yOndp bmRvd3RleHQ7dGV4dC1kZWNvcmF0aW9uOm5vbmUiPjxvOnA+PC9vOnA+PC9zcGFuPjwvYT48L3A+ DQo8L3RkPg0KPC90cj4NCjwvdGJvZHk+DQo8L3RhYmxlPg0KPC90ZD4NCjwvdHI+DQo8L3Rib2R5 Pg0KPC90YWJsZT4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojODg4 ODg4Ij48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48YSBocmVmPSJodHRwczovL3d3dy5waW5naWRlbnRpdHkuY29tIiB0YXJnZXQ9Il9ibGFuayI+ PHNwYW4gc3R5bGU9ImNvbG9yOndpbmRvd3RleHQ7dGV4dC1kZWNvcmF0aW9uOm5vbmUiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9zcGFuPjwvYT48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bWFyZ2luLWJvdHRvbToxMi4wcHQiPjxhIGhyZWY9Imh0dHBzOi8vd3d3LnBpbmdpZGVudGl0eS5j b20iIHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iY29sb3I6d2luZG93dGV4dDt0ZXh0LWRl Y29yYXRpb246bm9uZSI+PGJyPg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX188YnI+DQpVbmJlYXJhYmxlIG1haWxpbmcgbGlzdDxicj4NCjx1PjxzcGFuIHN0 eWxlPSJjb2xvcjpibHVlIj5VbmJlYXJhYmxlQGlldGYub3JnPC9zcGFuPjwvdT48YnI+DQo8dT48 c3BhbiBzdHlsZT0iY29sb3I6Ymx1ZSI+aHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0 aW5mby91bmJlYXJhYmxlPC9zcGFuPjwvdT48bzpwPjwvbzpwPjwvc3Bhbj48L2E+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PGEgaHJlZj0iaHR0cHM6Ly93d3cucGluZ2lkZW50aXR5LmNvbSIg dGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJjb2xvcjp3aW5kb3d0ZXh0O3RleHQtZGVjb3Jh dGlvbjpub25lIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L2E+PC9wPg0KPC9kaXY+DQo8L2Rp dj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4N CjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_BN3PR0301MB0836800B7BF58AA0B9E481C88C850BN3PR0301MB0836_-- From nobody Tue Dec 6 16:19:16 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 30FDA12960F for ; Tue, 6 Dec 2016 16:19:15 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.902 X-Spam-Level: X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PKqp6ed1rga3 for ; Tue, 6 Dec 2016 16:19:13 -0800 (PST) Received: from gproxy10-pub.mail.unifiedlayer.com (gproxy10-pub.mail.unifiedlayer.com [69.89.20.226]) by ietfa.amsl.com (Postfix) with SMTP id CF912129609 for ; Tue, 6 Dec 2016 16:19:13 -0800 (PST) Received: (qmail 18107 invoked by uid 0); 7 Dec 2016 00:19:07 -0000 Received: from unknown (HELO cmgw4) (10.0.90.85) by gproxy10.mail.unifiedlayer.com with SMTP; 7 Dec 2016 00:19:07 -0000 Received: from box514.bluehost.com ([74.220.219.114]) by cmgw4 with id GoK31u00r2UhLwi01oK6EL; Tue, 06 Dec 2016 17:19:07 -0700 X-Authority-Analysis: v=2.1 cv=Zpp+dbLG c=1 sm=1 tr=0 a=9W6Fsu4pMcyimqnCr1W0/w==:117 a=9W6Fsu4pMcyimqnCr1W0/w==:17 a=L9H7d07YOLsA:10 a=9cW_t1CCXrUA:10 a=s5jvgZ67dGcA:10 a=IkcTkHD0fZMA:10 a=n5n_aSjo0skA:10 a=wGBWgB3dBq9-TzKcqFgA:9 a=QEXdDO2ut3YA:10 Received: from [173.224.162.69] (port=52524 helo=[10.225.80.48]) by box514.bluehost.com with esmtpsa (TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128) (Exim 4.86_1) (envelope-from ) id 1cEPwt-0005J1-KV for unbearable@ietf.org; Tue, 06 Dec 2016 17:19:03 -0700 To: IETF TokBind WG From: =JeffH Message-ID: <8a72d013-6af2-943c-6620-9d4bb0eb6fd0@KingsMountain.com> Date: Tue, 6 Dec 2016 16:19:02 -0800 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:45.0) Gecko/20100101 Thunderbird/45.5.1 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - box514.bluehost.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - KingsMountain.com X-BWhitelist: no X-Source-IP: 173.224.162.69 X-Exim-ID: 1cEPwt-0005J1-KV X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: ([10.225.80.48]) [173.224.162.69]:52524 X-Source-Auth: jeff.hodges+kingsmountain.com X-Email-Count: 1 X-Source-Cap: a2luZ3Ntb3U7a2luZ3Ntb3U7Ym94NTE0LmJsdWVob3N0LmNvbQ== Archived-At: Subject: Re: [Unbearable] PR#82: TBPROTO: update ECPoint.point to be in X9.62 format with leading 0x04 byte X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Dec 2016 00:19:15 -0000 fyi/fwiw, personally I can go either way on this one -- there's reasonable arguments on both sides, but we haven't decided. So I hacked up the PR as a forcing function... Perhaps the chairs need to run a "call for consensus" ? =JeffH From nobody Tue Dec 6 19:24:10 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C7689129653 for ; Tue, 6 Dec 2016 19:24:09 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.003 X-Spam-Level: X-Spam-Status: No, score=-0.003 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=1.989, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KisDvIkXfKcq for ; Tue, 6 Dec 2016 19:24:07 -0800 (PST) Received: from NAM01-BN3-obe.outbound.protection.outlook.com (mail-bn3nam01on0096.outbound.protection.outlook.com [104.47.33.96]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F13791295B5 for ; Tue, 6 Dec 2016 19:24:06 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=MMQST3l4ya4pZ1KXVETnUgjDdwvMPk0VMOpOt/DXlZw=; b=dndUdm9LneMPTvjjRI02XgxT73z4N8MQR3LnokXaaCCCbxrL5qHd138xNttEJ3mnFOn0Y+IcsFQVeU1OzGBEEEvFwZuGbJWSVZad3fGER/Gd1w9yeSv22xUDpGf3zPXISb3vX8b7HU5jrIe2HMJ/A17sMGDm7mspNL/pKEN+K98= Received: from BN3PR03MB2355.namprd03.prod.outlook.com (10.166.74.150) by BN3PR0301MB0834.namprd03.prod.outlook.com (10.160.154.144) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.693.12; Wed, 7 Dec 2016 03:24:00 +0000 Received: from BN3PR03MB2355.namprd03.prod.outlook.com ([10.166.74.150]) by BN3PR03MB2355.namprd03.prod.outlook.com ([10.166.74.150]) with mapi id 15.01.0761.017; Wed, 7 Dec 2016 03:24:00 +0000 From: Mike Jones To: Andrei Popov , Bill Cox , Martin Thomson Thread-Topic: [Unbearable] PR#82: TBPROTO: update ECPoint.point to be in X9.62 format with leading 0x04 byte Thread-Index: AQHSUABwBuKUfEYRb0aOrIbdTSjw0qD7fmwAgAAIegCAAAnggIAABlsAgAABrICAAAMagIAANo5A Date: Wed, 7 Dec 2016 03:23:59 +0000 Message-ID: References: <5807ff47-4222-221b-6332-263825417861@KingsMountain.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Michael.Jones@microsoft.com; x-originating-ip: [50.47.80.137] x-microsoft-exchange-diagnostics: 1; BN3PR0301MB0834; 7:7WfuuyVqZa44fuBztWKitjYw9g429GraYPCT3jsDStSEWXiTLucnf1Is0JlGROhqwjeGJacKK189GLmxtTDRMXKyQSbIGbcsg6wZG1bxX0V/LUTI7K4OTZ5NUr4EEtOy4OFmKnfqw6sGI9XVkcv+eYSPR2A7fc4NqPWiT0Qk2DTx6Px7lR2foaT2q8IqF5S5mOArRpFZwV6FTZHpmvzEUKU5UUNi52wrx5ddrC7ksUa/swBUq3VMg3OjRZgwAAAmaiIYuUbilWZfLAwK7kNT7plq36b4ZwUg3GAzDoAMZVjsM0vJu1FgEZUox1pF+10wAk6sjiirbjRLqrJOWg7qQ+pbQMmdJNYJMWCWe1JKpspfZFlJa9U7MHU4TcceW0/Q x-ms-office365-filtering-correlation-id: 6c517762-3d3f-4f5b-306b-08d41e507c78 x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001); SRVR:BN3PR0301MB0834; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(166708455590820)(258669246490384)(211936372134217)(21748063052155)(21532816269658); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040375)(601004)(2401047)(8121501046)(5005006)(3002001)(10201501046)(6055026)(61426038)(61427038)(6041248)(20161123564025)(20161123555025)(20161123560025)(20161123562025)(20161123558021)(6042181)(6047074)(6072148); SRVR:BN3PR0301MB0834; BCL:0; PCL:0; RULEID:; SRVR:BN3PR0301MB0834; x-forefront-prvs: 01494FA7F7 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(7916002)(52314003)(51444003)(199003)(377454003)(189002)(24454002)(3846002)(5660300001)(2561002)(6506006)(6116002)(105586002)(97736004)(2906002)(4326007)(8936002)(2900100001)(74316002)(7736002)(2421001)(189998001)(66066001)(7696004)(38730400001)(3660700001)(7846002)(81156014)(77096006)(10090500001)(790700001)(86612001)(81166006)(101416001)(92566002)(76176999)(15650500001)(76576001)(122556002)(93886004)(10710500007)(50986999)(10290500002)(99286002)(8676002)(5001770100001)(229853002)(7906003)(86362001)(54356999)(68736007)(2420400007)(102836003)(19609705001)(5005710100001)(3280700002)(606004)(1511001)(39060400001)(33656002)(8990500004)(106356001)(106116001)(7110500001)(2950100002)(9686002); DIR:OUT; SFP:1102; SCL:1; SRVR:BN3PR0301MB0834; H:BN3PR03MB2355.namprd03.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; A:1; MX:1; LANG:en; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_BN3PR03MB235513ED73A136578EBCADC2F5850BN3PR03MB2355namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 07 Dec 2016 03:23:59.8799 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN3PR0301MB0834 Archived-At: Cc: IETF TokBind WG , Brian Campbell , Nick Harper , =JeffH Subject: Re: [Unbearable] PR#82: TBPROTO: update ECPoint.point to be in X9.62 format with leading 0x04 byte X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Dec 2016 03:24:10 -0000 --_000_BN3PR03MB235513ED73A136578EBCADC2F5850BN3PR03MB2355namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SSBhZ3JlZSB0aGF0IGFkZGluZyBhIGJ5dGUgdG8gYWxsIHRoZSBwYWNrZXRzIGZvciBubyBhY3R1 YWwgZ2FpbiBpcyBhIGJhZCB0cmFkZW9mZi4gIEkgYWR2b2NhdGUgdGhhdCB0aGluZ3Mgc3RheSBh cyB0aGV5IGFyZS4NCg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgIC0tIE1pa2UNCg0KRnJvbTogVW5iZWFyYWJsZSBbbWFpbHRvOnVuYmVhcmFi bGUtYm91bmNlc0BpZXRmLm9yZ10gT24gQmVoYWxmIE9mIEFuZHJlaSBQb3Bvdg0KU2VudDogVHVl c2RheSwgRGVjZW1iZXIgNiwgMjAxNiA0OjA4IFBNDQpUbzogQmlsbCBDb3ggPHdheXdhcmRnZWVr QGdvb2dsZS5jb20+OyBNYXJ0aW4gVGhvbXNvbiA8bWFydGluLnRob21zb25AZ21haWwuY29tPg0K Q2M6IElFVEYgVG9rQmluZCBXRyA8dW5iZWFyYWJsZUBpZXRmLm9yZz47IEJyaWFuIENhbXBiZWxs IDxiY2FtcGJlbGxAcGluZ2lkZW50aXR5LmNvbT47ID1KZWZmSCA8SmVmZi5Ib2RnZXNAa2luZ3Nt b3VudGFpbi5jb20+OyBOaWNrIEhhcnBlciA8bmhhcnBlckBnb29nbGUuY29tPg0KU3ViamVjdDog UmU6IFtVbmJlYXJhYmxlXSBQUiM4MjogVEJQUk9UTzogdXBkYXRlIEVDUG9pbnQucG9pbnQgdG8g YmUgaW4gWDkuNjIgZm9ybWF0IHdpdGggbGVhZGluZyAweDA0IGJ5dGUNCg0KDQogICogICDigKZh bnlvbmUgd2hvIGlzIHVzaW5nIGV4aXN0aW5nIGNvZGUgd2lsbCBsaWtlbHkgaGF2ZSBhIGxpYnJh cnkgdGhhdCBwcm9kdWNlcyBYOS42Mi4NClRoaXMgaXMgbm90IG5lY2Vzc2FyaWx5IHRoZSBjYXNl OiBJIG1haW50YWluIGV4aXN0aW5nIFRMUyBjb2RlIHRoYXQgcHJvZHVjZXMgYW5kIGNvbnN1bWVz IFg5LjYyLCBidXQgSSBoYXZlIHRvIGFkZC9zdHJpcCB0aGUgMHgwNCBpbiBteSBjb2RlLiBUaGUg Y3J5cHRvIGxpYnJhcmllcyBpbiBXaW5kb3dzIGRvbuKAmXQgaGFuZGxlIDB4MDQgZm9yIG1lLg0K SW4gcHJhY3RpY2UsIEnigJlkIHJhdGhlciBub3QgYWRkIGEgdXNlbGVzcyBieXRlIG9yIGNoYW5n ZSB0aGUgd2lyZSBmb3JtYXQgd2l0aG91dCBhIGdvb2QgdGVjaG5pY2FsIHJlYXNvbiAoSU1ITyBi ZWluZyBhYmxlIHRvIHJlZmVyZW5jZSBYOS42MiBpcyBub3QgYSBnb29kIHRlY2huaWNhbCByZWFz b24pLg0KDQpDaGVlcnMsDQoNCkFuZHJlaQ0KDQpGcm9tOiBVbmJlYXJhYmxlIFttYWlsdG86dW5i ZWFyYWJsZS1ib3VuY2VzQGlldGYub3JnXSBPbiBCZWhhbGYgT2YgQmlsbCBDb3gNClNlbnQ6IFR1 ZXNkYXksIERlY2VtYmVyIDYsIDIwMTYgMzo1NyBQTQ0KVG86IE1hcnRpbiBUaG9tc29uIDxtYXJ0 aW4udGhvbXNvbkBnbWFpbC5jb208bWFpbHRvOm1hcnRpbi50aG9tc29uQGdtYWlsLmNvbT4+DQpD YzogSUVURiBUb2tCaW5kIFdHIDx1bmJlYXJhYmxlQGlldGYub3JnPG1haWx0bzp1bmJlYXJhYmxl QGlldGYub3JnPj47IEJyaWFuIENhbXBiZWxsIDxiY2FtcGJlbGxAcGluZ2lkZW50aXR5LmNvbTxt YWlsdG86YmNhbXBiZWxsQHBpbmdpZGVudGl0eS5jb20+PjsgTmljayBIYXJwZXIgPG5oYXJwZXJA Z29vZ2xlLmNvbTxtYWlsdG86bmhhcnBlckBnb29nbGUuY29tPj47ID1KZWZmSCA8SmVmZi5Ib2Rn ZXNAa2luZ3Ntb3VudGFpbi5jb208bWFpbHRvOkplZmYuSG9kZ2VzQGtpbmdzbW91bnRhaW4uY29t Pj4NClN1YmplY3Q6IFJlOiBbVW5iZWFyYWJsZV0gUFIjODI6IFRCUFJPVE86IHVwZGF0ZSBFQ1Bv aW50LnBvaW50IHRvIGJlIGluIFg5LjYyIGZvcm1hdCB3aXRoIGxlYWRpbmcgMHgwNCBieXRlDQoN CkFsbCB0aGV5IGhhdmUgdG8gZG8gaXMgc3RyaXAgb2ZmIHRoZSBsZWFkaW5nIDB4MDQuICBJdCBk b2VzIG5vdCBtYWtlIHNlbnNlIHRvIG1lIHRvIHVzZSBhIHBzZXVkby1zdGFuZGFyZCBmb3IgRUMs IGJ1dCBhIGN1c3RvbSBmb3JtYXQgZm9yIFJTQS4NCg0KT24gVHVlLCBEZWMgNiwgMjAxNiBhdCAz OjUwIFBNLCBNYXJ0aW4gVGhvbXNvbiA8bWFydGluLnRob21zb25AZ21haWwuY29tPG1haWx0bzpt YXJ0aW4udGhvbXNvbkBnbWFpbC5jb20+PiB3cm90ZToNClRoaXMgaXMgYSBmYWxzZSBlY29ub215 OiBhbnlvbmUgd2hvIGlzIHVzaW5nIGV4aXN0aW5nIGNvZGUgd2lsbCBsaWtlbHkgaGF2ZSBhIGxp YnJhcnkgdGhhdCBwcm9kdWNlcyBYOS42Mi4gIEFsbCBvZiB0aGUgbGFuZ3VhZ2VzL2xpYnJhcmll cyBJJ20gYXdhcmUgb2YgbmF0aXZlbHkgc3VwcG9ydCB0aGF0IGZvcm1hdDsgb25seSBhIGZldyBo YXZlIG5hdGl2ZSBhY2Nlc3MgdG8gWCBhbmQgWS4gIEluIHRob3NlIGxhbmd1YWdlcy9saWJyYXJp ZXMsIGRlYWxpbmcgd2l0aCB0aGUgY3VzdG9tIGZvcm1hdCBpcyBtb3JlIHdvcmsuDQpBY2Nlc3Mg dG8gdGhlIHNwZWMgaXNuJ3QgbmVlZGVkLCBKZWZmIGluY2x1ZGVkIGEgbmljZSBkZWZpbml0aW9u LiAgKEkndmUgbmV2ZXIgc2VlbiBhIGNvcHkgbXlzZWxmIGFuZCBJIGhhdmVuJ3QgZmVsdCBhbnkg cGFpbi4pDQpJIHRoaW5rIHRoYXQgdGhlIHJlbGV2YW50IGNvbmNlcm4gaXMgQmlsbCdzLg0KDQoN Ck9uIDcgRGVjZW1iZXIgMjAxNiBhdCAwODoyOCwgQnJpYW4gQ2FtcGJlbGwgPGJjYW1wYmVsbEBw aW5naWRlbnRpdHkuY29tPG1haWx0bzpiY2FtcGJlbGxAcGluZ2lkZW50aXR5LmNvbT4+IHdyb3Rl Og0KSG93ZXZlciwgaW4gdGhpcyBjYXNlLCB0aGVyZSdzIG5vdCBhIGNvbXBlbGxpbmcgcmVhc29u IHRvIHVzZSB0aGF0IHByZWV4aXN0aW5nIHN0YW5kYXJkIGVpdGhlci4NClZhbHVlIGNvbWVzIGZy b20gdXNpbmcgcHJlZXhpc3Rpbmcgc3RhbmRhcmRzIHdoZW4gdGhlcmUgZXhpc3QgcmV1c2FibGUg YWJzdHJhY3Rpb25zL2ltcGxlbWVudGF0aW9ucyBvZiB0aGUgc3RhbmRhcmQuIEkndmUgbm90IHNl ZW4gdGhhdCB0byBiZSB0aGUgY2FzZSBhbmQgWDkuNjIganVzdCBiZWNvbWVzIGV4dHJhIGJhZ2dh Z2UuDQoNClg5LjYyIDIwMDUgaXNuJ3QgZXhhY3RseSBlYXNpbHkgYWNjZXNzaWJsZSBlaXRoZXIg LSBJJ3ZlIG5vdCBiZWVuIGFibGUgdG8gZmluZCBhIGNvcHkgdGhhdCBkb2Vzbid0IHJlcXVpcmUg JDEwMCBwYXltZW50Lg0KQXMgQW5kcmUgaGFzIHNhaWQsIHRoZSBvbmx5IHRoaW5nIHRoYXQgdXNp bmcgdGhlIFg5LjYyIGZvcm1hdCBzZWVtcyB0byBkbyBpcyBhbGxvdyBUQiB0byBjYWxsIHRoZSBF Q1BvaW50IHJlcHJlc2VudGF0aW9uICJ1bmNvbXByZXNzZWQgcG9pbnQgZm9ybWF0IHBlciBBTlNJ Llg5LTYyLjIwMDUiLiBJIGRvbid0IHNlZSB0aGUgdmFsdWUgaW4gdGhhdC4NCkl0J2QgYWxzbyBi ZSBhbiBpbmNvbXBhdGlibGUgY2hhbmdlIChhcyBCaWxsIHBvaW50cyBvdXQpLiBUaGF0J3MgYSBn b29kIHJlYXNvbiwgdG8gbWUgYW55d2F5LCB0byBub3QgbWFrZSB0aGUgY2hhbmdlIGF0IHRoaXMg bGF0ZSBzdGFnZSBpbiB0aGUgcHJvY2Vzcy4NCkFuZCB5ZXMgaXQncyBvbmx5IDEgYnl0ZSBidXQg aXQncyBhIHVubmVjZXNzYXJ5IGJ5dGUgdGhhdCdzIGp1c3QgZ29pbmcgdG8gYmUgaWdub3JlZC4g SSBqdXN0IGRvbid0IHNlZSBhIGJlbmVmaXQgdG8gYWRkaW5nIHRoYXQuDQpJJ2QgcHJlZmVyIHRo YXQgd2UgbGVhdmUgaXQgYXMgY3VycmVudGx5IGRlZmluZWQuIE5vdGluZyB0aGF0IHRoZXJlIGV4 aXN0IG11bHRpcGxlIGluZGVwZW5kZW50IGludGVyb3BlcmFibGUgaW1wbGVtZW50YXRpb25zIG9m IHRoZSBjdXJyZW50IGRyYWZ0Lg0KDQoNCg0KT24gVHVlLCBEZWMgNiwgMjAxNiBhdCAzOjUyIFBN LCBOaWNrIEhhcnBlciA8bmhhcnBlckBnb29nbGUuY29tPG1haWx0bzpuaGFycGVyQGdvb2dsZS5j b20+PiB3cm90ZToNCkkgYWdyZWUgd2l0aCBNYXJ0aW4gYW5kIEplZmYuIExldCdzIHVzZSBwcmUt ZXhpc3Rpbmcgc3RhbmRhcmRzIHVubGVzcyB0aGVyZSdzIGEgZ29vZCByZWFzb24gbm90IHRvLg0K DQpPbiBUdWUsIERlYyA2LCAyMDE2IGF0IDI6MjIgUE0sIE1hcnRpbiBUaG9tc29uIDxtYXJ0aW4u dGhvbXNvbkBnbWFpbC5jb208bWFpbHRvOm1hcnRpbi50aG9tc29uQGdtYWlsLmNvbT4+IHdyb3Rl Og0KT24gNyBEZWNlbWJlciAyMDE2IGF0IDA1OjM2LCA9SmVmZkggPEplZmYuSG9kZ2VzQGtpbmdz bW91bnRhaW4uY29tPG1haWx0bzpKZWZmLkhvZGdlc0BraW5nc21vdW50YWluLmNvbT4+IHdyb3Rl Og0KPiBQUiM4MjogVEJQUk9UTzogdXBkYXRlIEVDUG9pbnQucG9pbnQgdG8gYmUgaW4gWDkuNjIg Zm9ybWF0IHdpdGggbGVhZGluZyAweDA0DQo+IGJ5dGUsIGZpeGVzICM2Mg0KPiBodHRwczovL2dp dGh1Yi5jb20vVG9rZW5CaW5kaW5nL0ludGVybmV0LURyYWZ0cy9wdWxsLzgyDQoNClRoYW5rcyBK ZWZmLCBJIHRoaW5rIHRoYXQgdGhpcyBpcyBhIGdvb2QgaWRlYS4gIFRoZXJlIGlzIG1vcmUgdmFs dWUgaW4NCnVuaWZvcm1pdHkgdGhhbiBpbiBhbnkgbmFycm93IG5vdGlvbiBvZiBvcHRpbWFsaXR5 DQoNCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQpVbmJl YXJhYmxlIG1haWxpbmcgbGlzdA0KVW5iZWFyYWJsZUBpZXRmLm9yZzxtYWlsdG86VW5iZWFyYWJs ZUBpZXRmLm9yZz4NCmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vdW5iZWFy YWJsZQ0KDQoNCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f DQpVbmJlYXJhYmxlIG1haWxpbmcgbGlzdA0KVW5iZWFyYWJsZUBpZXRmLm9yZzxtYWlsdG86VW5i ZWFyYWJsZUBpZXRmLm9yZz4NCmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8v dW5iZWFyYWJsZQ0KDQoNCi0tDQoNCkJyaWFuIENhbXBiZWxsDQpEaXN0aW5ndWlzaGVkIEVuZ2lu ZWVyDQpiY2FtcGJlbGxAcGluZ2lkZW50aXR5LmNvbQ0KdzogKzEgNzIwLjMxNy4yMDYxDQpjOiAr MSAzMDMuOTE4Ljk0MTUgPGh0dHBzOi8vd3d3LnBpbmdpZGVudGl0eS5jb20+DQoNCg0KQ29ubmVj dCB3aXRoIHVzOiA8aHR0cHM6Ly93d3cucGluZ2lkZW50aXR5LmNvbT4NCg0KDQoNCg0KX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NClVuYmVhcmFibGUgbWFp bGluZyBsaXN0DQpVbmJlYXJhYmxlQGlldGYub3JnDQpodHRwczovL3d3dy5pZXRmLm9yZy9tYWls bWFuL2xpc3RpbmZvL3VuYmVhcmFibGU8aHR0cHM6Ly93d3cucGluZ2lkZW50aXR5LmNvbT4NCg== --_000_BN3PR03MB235513ED73A136578EBCADC2F5850BN3PR03MB2355namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 V2luZ2RpbmdzOw0KCXBhbm9zZS0xOjUgMCAwIDAgMCAwIDAgMCAwIDA7fQ0KQGZvbnQtZmFjZQ0K CXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2IDMg MiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1 IDUgMiAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWws IGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0 b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcg Um9tYW4iLHNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXBy aW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQph OnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5 Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnAuTXNv TGlzdFBhcmFncmFwaCwgbGkuTXNvTGlzdFBhcmFncmFwaCwgZGl2Lk1zb0xpc3RQYXJhZ3JhcGgN Cgl7bXNvLXN0eWxlLXByaW9yaXR5OjM0Ow0KCW1hcmdpbi10b3A6MGluOw0KCW1hcmdpbi1yaWdo dDowaW47DQoJbWFyZ2luLWJvdHRvbTowaW47DQoJbWFyZ2luLWxlZnQ6LjVpbjsNCgltYXJnaW4t Ym90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGltZXMg TmV3IFJvbWFuIixzZXJpZjt9DQpwLm1zb25vcm1hbDAsIGxpLm1zb25vcm1hbDAsIGRpdi5tc29u b3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCgltc28tbWFyZ2luLXRvcC1hbHQ6 YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0K CW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1l cyBOZXcgUm9tYW4iLHNlcmlmO30NCnNwYW4uaG9lbnpiDQoJe21zby1zdHlsZS1uYW1lOmhvZW56 Yjt9DQpzcGFuLm0xMjE3NjQ2MzU4NjQ1MTYyNzA0aG9lbnpiDQoJe21zby1zdHlsZS1uYW1lOm1f MTIxNzY0NjM1ODY0NTE2MjcwNGhvZW56Yjt9DQpzcGFuLkVtYWlsU3R5bGUyMQ0KCXttc28tc3R5 bGUtdHlwZTpwZXJzb25hbDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCglj b2xvcjp3aW5kb3d0ZXh0O30NCnNwYW4uRW1haWxTdHlsZTI0DQoJe21zby1zdHlsZS10eXBlOnBl cnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9y OiMwMDIwNjA7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7 DQoJZm9udC1zaXplOjEwLjBwdDt9DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo4LjVpbiAx MS4waW47DQoJbWFyZ2luOjEuMGluIDEuMGluIDEuMGluIDEuMGluO30NCmRpdi5Xb3JkU2VjdGlv bjENCgl7cGFnZTpXb3JkU2VjdGlvbjE7fQ0KLyogTGlzdCBEZWZpbml0aW9ucyAqLw0KQGxpc3Qg bDANCgl7bXNvLWxpc3QtaWQ6MTkzMzI0NjU2MzsNCgltc28tbGlzdC10eXBlOmh5YnJpZDsNCglt c28tbGlzdC10ZW1wbGF0ZS1pZHM6LTIxMjk1MTYzMDQgLTE4NzAzNTEyNTAgNjc2OTg2OTEgNjc2 OTg2OTMgNjc2OTg2ODkgNjc2OTg2OTEgNjc2OTg2OTMgNjc2OTg2ODkgNjc2OTg2OTEgNjc2OTg2 OTM7fQ0KQGxpc3QgbDA6bGV2ZWwxDQoJe21zby1sZXZlbC1zdGFydC1hdDowOw0KCW1zby1sZXZl bC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvg5g7DQoJbXNvLWxldmVs LXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQt aW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7DQoJbXNvLWZhcmVhc3QtZm9u dC1mYW1pbHk6Q2FsaWJyaTsNCgltc28tYmlkaS1mb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFu Ijt9DQpAbGlzdCBsMDpsZXZlbDINCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0K CW1zby1sZXZlbC10ZXh0Om87DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVs LW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWls eToiQ291cmllciBOZXciO30NCkBsaXN0IGwwOmxldmVsMw0KCXttc28tbGV2ZWwtbnVtYmVyLWZv cm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDpu b25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1 aW47DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwwOmxldmVsNA0KCXttc28tbGV2 ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZl bC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0 LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwwOmxldmVsNQ0K CXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6bzsNCglt c28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7 DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyI7fQ0KQGxp c3QgbDA6bGV2ZWw2DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2 ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJl ci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseTpXaW5n ZGluZ3M7fQ0KQGxpc3QgbDA6bGV2ZWw3DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxl dDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNv LWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250 LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDA6bGV2ZWw4DQoJe21zby1sZXZlbC1udW1iZXItZm9y bWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDpvOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25l Ow0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47 DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3Ijt9DQpAbGlzdCBsMDpsZXZlbDkNCgl7bXNvLWxl dmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2 ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4 dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpvbA0KCXttYXJnaW4t Ym90dG9tOjBpbjt9DQp1bA0KCXttYXJnaW4tYm90dG9tOjBpbjt9DQotLT48L3N0eWxlPjwhLS1b aWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVkZWZhdWx0cyB2OmV4dD0iZWRpdCIgc3BpZG1h eD0iMTAyNiIgLz4NCjwveG1sPjwhW2VuZGlmXS0tPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0K PG86c2hhcGVsYXlvdXQgdjpleHQ9ImVkaXQiPg0KPG86aWRtYXAgdjpleHQ9ImVkaXQiIGRhdGE9 IjEiIC8+DQo8L286c2hhcGVsYXlvdXQ+PC94bWw+PCFbZW5kaWZdLS0+DQo8L2hlYWQ+DQo8Ym9k eSBsYW5nPSJFTi1VUyIgbGluaz0iYmx1ZSIgdmxpbms9InB1cnBsZSI+DQo8ZGl2IGNsYXNzPSJX b3JkU2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9y OiMwMDIwNjAiPkkgYWdyZWUgdGhhdCBhZGRpbmcgYSBieXRlIHRvIGFsbCB0aGUgcGFja2V0cyBm b3Igbm8gYWN0dWFsIGdhaW4gaXMgYSBiYWQgdHJhZGVvZmYuJm5ic3A7IEkgYWR2b2NhdGUgdGhh dCB0aGluZ3Mgc3RheSBhcyB0aGV5IGFyZS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzAwMjA2MCI+PG86cD4mbmJzcDs8 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2Nv bG9yOiMwMDIwNjAiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAtLSBN aWtlPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGEgbmFtZT0i X01haWxFbmRDb21wb3NlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzAwMjA2MCI+PG86cD4mbmJz cDs8L286cD48L3NwYW4+PC9hPjwvcD4NCjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxF bmRDb21wb3NlIj48L3NwYW4+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVy LXRvcDpzb2xpZCAjRTFFMUUxIDEuMHB0O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4iPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5Gcm9tOjwvc3Bhbj48L2I+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmIj4gVW5iZWFyYWJsZSBbbWFpbHRvOnVuYmVhcmFibGUtYm91bmNlc0BpZXRm Lm9yZ10NCjxiPk9uIEJlaGFsZiBPZiA8L2I+QW5kcmVpIFBvcG92PGJyPg0KPGI+U2VudDo8L2I+ IFR1ZXNkYXksIERlY2VtYmVyIDYsIDIwMTYgNDowOCBQTTxicj4NCjxiPlRvOjwvYj4gQmlsbCBD b3ggJmx0O3dheXdhcmRnZWVrQGdvb2dsZS5jb20mZ3Q7OyBNYXJ0aW4gVGhvbXNvbiAmbHQ7bWFy dGluLnRob21zb25AZ21haWwuY29tJmd0Ozxicj4NCjxiPkNjOjwvYj4gSUVURiBUb2tCaW5kIFdH ICZsdDt1bmJlYXJhYmxlQGlldGYub3JnJmd0OzsgQnJpYW4gQ2FtcGJlbGwgJmx0O2JjYW1wYmVs bEBwaW5naWRlbnRpdHkuY29tJmd0OzsgPUplZmZIICZsdDtKZWZmLkhvZGdlc0BraW5nc21vdW50 YWluLmNvbSZndDs7IE5pY2sgSGFycGVyICZsdDtuaGFycGVyQGdvb2dsZS5jb20mZ3Q7PGJyPg0K PGI+U3ViamVjdDo8L2I+IFJlOiBbVW5iZWFyYWJsZV0gUFIjODI6IFRCUFJPVE86IHVwZGF0ZSBF Q1BvaW50LnBvaW50IHRvIGJlIGluIFg5LjYyIGZvcm1hdCB3aXRoIGxlYWRpbmcgMHgwNCBieXRl PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHVsIHN0eWxlPSJtYXJnaW4tdG9wOjBpbiIgdHlw ZT0iZGlzYyI+DQo8bGkgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJtYXJnaW4tbGVm dDowaW47bXNvLWxpc3Q6bDAgbGV2ZWwxIGxmbzIiPuKApmFueW9uZSB3aG8gaXMgdXNpbmcgZXhp c3RpbmcgY29kZSB3aWxsIGxpa2VseSBoYXZlIGEgbGlicmFyeSB0aGF0IHByb2R1Y2VzIFg5LjYy LiZuYnNwOzxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nh bGlicmkmcXVvdDssc2Fucy1zZXJpZiI+PG86cD48L286cD48L3NwYW4+PC9saT48L3VsPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5UaGlzIGlzIG5vdCBuZWNlc3Nhcmls eSB0aGUgY2FzZTogSSBtYWludGFpbiBleGlzdGluZyBUTFMgY29kZSB0aGF0IHByb2R1Y2VzIGFu ZCBjb25zdW1lcyBYOS42MiwgYnV0IEkgaGF2ZSB0byBhZGQvc3RyaXAgdGhlIDB4MDQgaW4gbXkg Y29kZS4gVGhlIGNyeXB0byBsaWJyYXJpZXMgaW4gV2luZG93cw0KIGRvbuKAmXQgaGFuZGxlIDB4 MDQgZm9yIG1lLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssc2Fucy1zZXJpZiI+SW4gcHJhY3RpY2UsIEnigJlkIHJhdGhlciBub3QgYWRkIGEgdXNlbGVz cyBieXRlIG9yIGNoYW5nZSB0aGUgd2lyZSBmb3JtYXQgd2l0aG91dCBhIGdvb2QgdGVjaG5pY2Fs IHJlYXNvbiAoSU1ITyBiZWluZyBhYmxlIHRvIHJlZmVyZW5jZSBYOS42MiBpcyBub3QgYSBnb29k IHRlY2huaWNhbCByZWFzb24pLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nh bGlicmkmcXVvdDssc2Fucy1zZXJpZiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5DaGVlcnMsPG86cD48L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj48bzpwPiZuYnNw OzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYi PkFuZHJlaTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5Gcm9tOjwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlm Ij4gVW5iZWFyYWJsZSBbPGEgaHJlZj0ibWFpbHRvOnVuYmVhcmFibGUtYm91bmNlc0BpZXRmLm9y ZyI+bWFpbHRvOnVuYmVhcmFibGUtYm91bmNlc0BpZXRmLm9yZzwvYT5dDQo8Yj5PbiBCZWhhbGYg T2YgPC9iPkJpbGwgQ294PGJyPg0KPGI+U2VudDo8L2I+IFR1ZXNkYXksIERlY2VtYmVyIDYsIDIw MTYgMzo1NyBQTTxicj4NCjxiPlRvOjwvYj4gTWFydGluIFRob21zb24gJmx0OzxhIGhyZWY9Im1h aWx0bzptYXJ0aW4udGhvbXNvbkBnbWFpbC5jb20iPm1hcnRpbi50aG9tc29uQGdtYWlsLmNvbTwv YT4mZ3Q7PGJyPg0KPGI+Q2M6PC9iPiBJRVRGIFRva0JpbmQgV0cgJmx0OzxhIGhyZWY9Im1haWx0 bzp1bmJlYXJhYmxlQGlldGYub3JnIj51bmJlYXJhYmxlQGlldGYub3JnPC9hPiZndDs7IEJyaWFu IENhbXBiZWxsICZsdDs8YSBocmVmPSJtYWlsdG86YmNhbXBiZWxsQHBpbmdpZGVudGl0eS5jb20i PmJjYW1wYmVsbEBwaW5naWRlbnRpdHkuY29tPC9hPiZndDs7IE5pY2sgSGFycGVyICZsdDs8YSBo cmVmPSJtYWlsdG86bmhhcnBlckBnb29nbGUuY29tIj5uaGFycGVyQGdvb2dsZS5jb208L2E+Jmd0 OzsNCiA9SmVmZkggJmx0OzxhIGhyZWY9Im1haWx0bzpKZWZmLkhvZGdlc0BraW5nc21vdW50YWlu LmNvbSI+SmVmZi5Ib2RnZXNAa2luZ3Ntb3VudGFpbi5jb208L2E+Jmd0Ozxicj4NCjxiPlN1Ympl Y3Q6PC9iPiBSZTogW1VuYmVhcmFibGVdIFBSIzgyOiBUQlBST1RPOiB1cGRhdGUgRUNQb2ludC5w b2ludCB0byBiZSBpbiBYOS42MiBmb3JtYXQgd2l0aCBsZWFkaW5nIDB4MDQgYnl0ZTxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9w Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkFsbCB0aGV5IGhhdmUgdG8gZG8gaXMgc3Ry aXAgb2ZmIHRoZSBsZWFkaW5nIDB4MDQuJm5ic3A7IEl0IGRvZXMgbm90IG1ha2Ugc2Vuc2UgdG8g bWUgdG8gdXNlIGEgcHNldWRvLXN0YW5kYXJkIGZvciBFQywgYnV0IGEgY3VzdG9tIGZvcm1hdCBm b3IgUlNBLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+T24g VHVlLCBEZWMgNiwgMjAxNiBhdCAzOjUwIFBNLCBNYXJ0aW4gVGhvbXNvbiAmbHQ7PGEgaHJlZj0i bWFpbHRvOm1hcnRpbi50aG9tc29uQGdtYWlsLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPm1hcnRpbi50 aG9tc29uQGdtYWlsLmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPGJsb2NrcXVv dGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFk ZGluZzowaW4gMGluIDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tdG9wOjUuMHB0 O21hcmdpbi1yaWdodDowaW47bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPGRpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWJvdHRvbToxMi4wcHQiPlRo aXMgaXMgYSBmYWxzZSBlY29ub215OiBhbnlvbmUgd2hvIGlzIHVzaW5nIGV4aXN0aW5nIGNvZGUg d2lsbCBsaWtlbHkgaGF2ZSBhIGxpYnJhcnkgdGhhdCBwcm9kdWNlcyBYOS42Mi4mbmJzcDsgQWxs IG9mIHRoZSBsYW5ndWFnZXMvbGlicmFyaWVzIEknbSBhd2FyZSBvZiBuYXRpdmVseSBzdXBwb3J0 IHRoYXQgZm9ybWF0OyBvbmx5IGEgZmV3IGhhdmUgbmF0aXZlIGFjY2Vzcw0KIHRvIFggYW5kIFku Jm5ic3A7IEluIHRob3NlIGxhbmd1YWdlcy9saWJyYXJpZXMsIGRlYWxpbmcgd2l0aCB0aGUgY3Vz dG9tIGZvcm1hdCBpcyBtb3JlIHdvcmsuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tYm90dG9tOjEyLjBwdCI+QWNjZXNzIHRvIHRoZSBz cGVjIGlzbid0IG5lZWRlZCwgSmVmZiBpbmNsdWRlZCBhIG5pY2UgZGVmaW5pdGlvbi4mbmJzcDsg KEkndmUgbmV2ZXIgc2VlbiBhIGNvcHkgbXlzZWxmIGFuZCBJIGhhdmVuJ3QgZmVsdCBhbnkgcGFp bi4pPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkkgdGhpbmsg dGhhdCB0aGUgcmVsZXZhbnQgY29uY2VybiBpcyBCaWxsJ3MuPG86cD48L286cD48L3A+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk9uIDcgRGVjZW1iZXIgMjAxNiBhdCAwODoyOCwg QnJpYW4gQ2FtcGJlbGwgJmx0OzxhIGhyZWY9Im1haWx0bzpiY2FtcGJlbGxAcGluZ2lkZW50aXR5 LmNvbSIgdGFyZ2V0PSJfYmxhbmsiPmJjYW1wYmVsbEBwaW5naWRlbnRpdHkuY29tPC9hPiZndDsg d3JvdGU6PG86cD48L286cD48L3A+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9y ZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0O21h cmdpbi1sZWZ0OjQuOHB0O21hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLXJpZ2h0OjBpbjttYXJnaW4t Ym90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1ib3R0b206MTIuMHB0Ij5Ib3dldmVyLCBpbiB0 aGlzIGNhc2UsIHRoZXJlJ3Mgbm90IGEgY29tcGVsbGluZyByZWFzb24gdG8gdXNlIHRoYXQgcHJl ZXhpc3Rpbmcgc3RhbmRhcmQgZWl0aGVyLiZuYnNwOw0KPG86cD48L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5WYWx1ZSBjb21lcyBmcm9tIHVzaW5nIHByZWV4 aXN0aW5nIHN0YW5kYXJkcyB3aGVuIHRoZXJlIGV4aXN0IHJldXNhYmxlIGFic3RyYWN0aW9ucy9p bXBsZW1lbnRhdGlvbnMgb2YgdGhlIHN0YW5kYXJkLiBJJ3ZlIG5vdCBzZWVuIHRoYXQgdG8gYmUg dGhlIGNhc2UgYW5kIFg5LjYyIGp1c3QgYmVjb21lcyBleHRyYSBiYWdnYWdlLjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1i b3R0b206MTIuMHB0Ij48YnI+DQpYOS42MiAyMDA1IGlzbid0IGV4YWN0bHkgZWFzaWx5IGFjY2Vz c2libGUgZWl0aGVyIC0gSSd2ZSBub3QgYmVlbiBhYmxlIHRvIGZpbmQgYSBjb3B5IHRoYXQgZG9l c24ndCByZXF1aXJlICQxMDAgcGF5bWVudC4NCjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWJvdHRvbToxMi4wcHQiPkFzIEFuZHJlIGhh cyBzYWlkLCB0aGUgb25seSB0aGluZyB0aGF0IHVzaW5nIHRoZSBYOS42MiBmb3JtYXQgc2VlbXMg dG8gZG8gaXMgYWxsb3cgVEIgdG8gY2FsbCB0aGUgRUNQb2ludCByZXByZXNlbnRhdGlvbiAmcXVv dDt1bmNvbXByZXNzZWQgcG9pbnQgZm9ybWF0IHBlciBBTlNJLlg5LTYyLjIwMDUmcXVvdDsuIEkg ZG9uJ3Qgc2VlIHRoZSB2YWx1ZSBpbiB0aGF0LjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWJvdHRvbToxMi4wcHQiPkl0J2QgYWxzbyBi ZSBhbiBpbmNvbXBhdGlibGUgY2hhbmdlIChhcyBCaWxsIHBvaW50cyBvdXQpLiBUaGF0J3MgYSBn b29kIHJlYXNvbiwgdG8gbWUgYW55d2F5LCB0byBub3QgbWFrZSB0aGUgY2hhbmdlIGF0IHRoaXMg bGF0ZSBzdGFnZSBpbiB0aGUgcHJvY2Vzcy4NCjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWJvdHRvbToxMi4wcHQiPkFuZCB5ZXMgaXQn cyBvbmx5IDEgYnl0ZSBidXQgaXQncyBhIHVubmVjZXNzYXJ5IGJ5dGUgdGhhdCdzIGp1c3QgZ29p bmcgdG8gYmUgaWdub3JlZC4gSSBqdXN0IGRvbid0IHNlZSBhIGJlbmVmaXQgdG8gYWRkaW5nIHRo YXQuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt YXJnaW4tYm90dG9tOjEyLjBwdCI+SSdkIHByZWZlciB0aGF0IHdlIGxlYXZlIGl0IGFzIGN1cnJl bnRseSBkZWZpbmVkLiBOb3RpbmcgdGhhdCB0aGVyZSBleGlzdCBtdWx0aXBsZSBpbmRlcGVuZGVu dCBpbnRlcm9wZXJhYmxlIGltcGxlbWVudGF0aW9ucyBvZiB0aGUgY3VycmVudCBkcmFmdC4NCjxv OnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4t Ym90dG9tOjEyLjBwdCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1hcmdpbi1ib3R0b206MTIuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwv cD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+T24gVHVlLCBEZWMgNiwgMjAxNiBhdCAzOjUyIFBNLCBOaWNr IEhhcnBlciAmbHQ7PGEgaHJlZj0ibWFpbHRvOm5oYXJwZXJAZ29vZ2xlLmNvbSIgdGFyZ2V0PSJf YmxhbmsiPm5oYXJwZXJAZ29vZ2xlLmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0K PGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0Mg MS4wcHQ7cGFkZGluZzowaW4gMGluIDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4t dG9wOjUuMHB0O21hcmdpbi1yaWdodDowaW47bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+SSBhZ3JlZSB3aXRoIE1hcnRpbiBhbmQgSmVmZi4gTGV0J3Mg dXNlIHByZS1leGlzdGluZyBzdGFuZGFyZHMgdW5sZXNzIHRoZXJlJ3MgYSBnb29kIHJlYXNvbiBu b3QgdG8uPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5PbiBU dWUsIERlYyA2LCAyMDE2IGF0IDI6MjIgUE0sIE1hcnRpbiBUaG9tc29uICZsdDs8YSBocmVmPSJt YWlsdG86bWFydGluLnRob21zb25AZ21haWwuY29tIiB0YXJnZXQ9Il9ibGFuayI+bWFydGluLnRo b21zb25AZ21haWwuY29tPC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPGRp dj4NCjxibG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0ND Q0NDIDEuMHB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFy Z2luLXRvcDo1LjBwdDttYXJnaW4tcmlnaHQ6MGluO21hcmdpbi1ib3R0b206NS4wcHQiPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+T24gNyBEZWNlbWJlciAyMDE2IGF0IDA1OjM2LCA9SmVmZkggJmx0 OzxhIGhyZWY9Im1haWx0bzpKZWZmLkhvZGdlc0BraW5nc21vdW50YWluLmNvbSIgdGFyZ2V0PSJf YmxhbmsiPkplZmYuSG9kZ2VzQGtpbmdzbW91bnRhaW4uY29tPC9hPiZndDsgd3JvdGU6PGJyPg0K Jmd0OyBQUiM4MjogVEJQUk9UTzogdXBkYXRlIEVDUG9pbnQucG9pbnQgdG8gYmUgaW4gWDkuNjIg Zm9ybWF0IHdpdGggbGVhZGluZyAweDA0PGJyPg0KJmd0OyBieXRlLCBmaXhlcyAjNjI8YnI+DQom Z3Q7IDxhIGhyZWY9Imh0dHBzOi8vZ2l0aHViLmNvbS9Ub2tlbkJpbmRpbmcvSW50ZXJuZXQtRHJh ZnRzL3B1bGwvODIiIHRhcmdldD0iX2JsYW5rIj4NCmh0dHBzOi8vZ2l0aHViLmNvbS9Ub2tlbkJp bmRpbmcvSW50ZXJuZXQtRHJhZnRzL3B1bGwvODI8L2E+PGJyPg0KPGJyPg0KVGhhbmtzIEplZmYs IEkgdGhpbmsgdGhhdCB0aGlzIGlzIGEgZ29vZCBpZGVhLiZuYnNwOyBUaGVyZSBpcyBtb3JlIHZh bHVlIGluPGJyPg0KdW5pZm9ybWl0eSB0aGFuIGluIGFueSBuYXJyb3cgbm90aW9uIG9mIG9wdGlt YWxpdHk8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PGJyPg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX188YnI+ DQpVbmJlYXJhYmxlIG1haWxpbmcgbGlzdDxicj4NCjxhIGhyZWY9Im1haWx0bzpVbmJlYXJhYmxl QGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+VW5iZWFyYWJsZUBpZXRmLm9yZzwvYT48YnI+DQo8 YSBocmVmPSJodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3VuYmVhcmFibGUi IHRhcmdldD0iX2JsYW5rIj5odHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3Vu YmVhcmFibGU8L2E+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3Rl Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJz cDs8L286cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4t Ym90dG9tOjEyLjBwdCI+PGJyPg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX188YnI+DQpVbmJlYXJhYmxlIG1haWxpbmcgbGlzdDxicj4NCjxhIGhyZWY9Im1h aWx0bzpVbmJlYXJhYmxlQGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+VW5iZWFyYWJsZUBpZXRm Lm9yZzwvYT48YnI+DQo8YSBocmVmPSJodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3Rp bmZvL3VuYmVhcmFibGUiIHRhcmdldD0iX2JsYW5rIj5odHRwczovL3d3dy5pZXRmLm9yZy9tYWls bWFuL2xpc3RpbmZvL3VuYmVhcmFibGU8L2E+PG86cD48L286cD48L3A+DQo8L2Jsb2NrcXVvdGU+ DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxicj4NCjxiciBjbGVhcj0iYWxsIj4NCjxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBjbGFzcz0ibTEyMTc2NDYzNTg2NDUxNjI3MDRob2VuemIiPjxzcGFu IHN0eWxlPSJjb2xvcjojODg4ODg4Ij4tLQ0KPG86cD48L286cD48L3NwYW4+PC9zcGFuPjwvcD4N CjxkaXY+DQo8ZGl2Pg0KPHRhYmxlIGNsYXNzPSJNc29Ob3JtYWxUYWJsZSIgYm9yZGVyPSIwIiBj ZWxsc3BhY2luZz0iMCIgY2VsbHBhZGRpbmc9IjAiIHN0eWxlPSJib3JkZXItY29sbGFwc2U6Y29s bGFwc2UiPg0KPHRib2R5Pg0KPHRyPg0KPHRkIHdpZHRoPSIxMTMiIHN0eWxlPSJ3aWR0aDo4NC43 NXB0O3BhZGRpbmc6MGluIDBpbiAwaW4gMGluIj48L3RkPg0KPHRkIHN0eWxlPSJwYWRkaW5nOjBp biAwaW4gMGluIDBpbiI+DQo8dGFibGUgY2xhc3M9Ik1zb05vcm1hbFRhYmxlIiBib3JkZXI9IjAi IGNlbGxzcGFjaW5nPSI0IiBjZWxscGFkZGluZz0iMCI+DQo8dGJvZHk+DQo8dHI+DQo8dGQgdmFs aWduPSJ0b3AiIHN0eWxlPSJwYWRkaW5nOi43NXB0IC43NXB0IC43NXB0IC43NXB0Ij4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuNXB0O2ZvbnQtZmFt aWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6I0U2MUQzQyI+PGEgaHJlZj0i aHR0cHM6Ly93d3cucGluZ2lkZW50aXR5LmNvbSIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxl PSJjb2xvcjojRTYxRDNDO3RleHQtZGVjb3JhdGlvbjpub25lIj5CcmlhbiBDYW1wYmVsbDwvc3Bh bj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtmb250LWZhbWlseTomcXVvdDtUaW1lcyBO ZXcgUm9tYW4mcXVvdDssc2VyaWY7Y29sb3I6d2luZG93dGV4dDtmb250LXdlaWdodDpub3JtYWw7 dGV4dC1kZWNvcmF0aW9uOm5vbmUiPg0KPGJyPg0KPC9zcGFuPjxzcGFuIHN0eWxlPSJjb2xvcjpi bGFjaztmb250LXdlaWdodDpub3JtYWw7dGV4dC1kZWNvcmF0aW9uOm5vbmUiPkRpc3Rpbmd1aXNo ZWQgRW5naW5lZXI8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7VGltZXMgTmV3IFJvbWFuJnF1b3Q7LHNlcmlmO2NvbG9yOndpbmRvd3RleHQ7Zm9u dC13ZWlnaHQ6bm9ybWFsO3RleHQtZGVjb3JhdGlvbjpub25lIj4NCjxicj4NCjwvc3Bhbj48c3Bh biBzdHlsZT0iZm9udC13ZWlnaHQ6bm9ybWFsIj5iY2FtcGJlbGxAcGluZ2lkZW50aXR5LmNvbTwv c3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtmb250LWZhbWlseTomcXVvdDtUaW1l cyBOZXcgUm9tYW4mcXVvdDssc2VyaWY7Y29sb3I6d2luZG93dGV4dDtmb250LXdlaWdodDpub3Jt YWw7dGV4dC1kZWNvcmF0aW9uOm5vbmUiPg0KPGJyPg0KPC9zcGFuPjxzcGFuIHN0eWxlPSJjb2xv cjpibGFjaztmb250LXdlaWdodDpub3JtYWw7dGV4dC1kZWNvcmF0aW9uOm5vbmUiPnc6IDwvc3Bh bj4NCjxzcGFuIHN0eWxlPSJmb250LXdlaWdodDpub3JtYWwiPiYjNDM7MSA3MjAuMzE3LjIwNjE8 L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VGlt ZXMgTmV3IFJvbWFuJnF1b3Q7LHNlcmlmO2NvbG9yOndpbmRvd3RleHQ7Zm9udC13ZWlnaHQ6bm9y bWFsO3RleHQtZGVjb3JhdGlvbjpub25lIj4NCjxicj4NCjwvc3Bhbj48c3BhbiBzdHlsZT0iY29s b3I6YmxhY2s7Zm9udC13ZWlnaHQ6bm9ybWFsO3RleHQtZGVjb3JhdGlvbjpub25lIj5jOiA8L3Nw YW4+DQo8c3BhbiBzdHlsZT0iZm9udC13ZWlnaHQ6bm9ybWFsIj4mIzQzOzEgMzAzLjkxOC45NDE1 PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1Rp bWVzIE5ldyBSb21hbiZxdW90OyxzZXJpZjtjb2xvcjp3aW5kb3d0ZXh0O2ZvbnQtd2VpZ2h0Om5v cm1hbDt0ZXh0LWRlY29yYXRpb246bm9uZSI+DQo8L3NwYW4+PC9hPjwvc3Bhbj48L2I+PHNwYW4g Y2xhc3M9Ik1zb0h5cGVybGluayI+PHNwYW4gc3R5bGU9ImNvbG9yOndpbmRvd3RleHQ7dGV4dC1k ZWNvcmF0aW9uOm5vbmUiPjxvOnA+PC9vOnA+PC9zcGFuPjwvc3Bhbj48L3A+DQo8L3RkPg0KPC90 cj4NCjwvdGJvZHk+DQo8L3RhYmxlPg0KPC90ZD4NCjwvdHI+DQo8dHI+DQo8dGQgY29sc3Bhbj0i MiIgc3R5bGU9InBhZGRpbmc6MGluIDBpbiAwaW4gMGluIj4NCjx0YWJsZSBjbGFzcz0iTXNvTm9y bWFsVGFibGUiIGJvcmRlcj0iMCIgY2VsbHNwYWNpbmc9IjAiIGNlbGxwYWRkaW5nPSIwIiB3aWR0 aD0iMTAwJSIgc3R5bGU9IndpZHRoOjEwMC4wJTtib3JkZXItY29sbGFwc2U6Y29sbGFwc2UiPg0K PHRib2R5Pg0KPHRyIHN0eWxlPSJoZWlnaHQ6MzAuMHB0Ij4NCjx0ZCBzdHlsZT0icGFkZGluZzou NzVwdCAuNzVwdCAuNzVwdCAuNzVwdDtoZWlnaHQ6MzAuMHB0Ij4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtYXJnaW4tdG9wOjYuMHB0Ij48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEw LjVwdDtmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiM0MDQ3 NEIiPjxhIGhyZWY9Imh0dHBzOi8vd3d3LnBpbmdpZGVudGl0eS5jb20iIHRhcmdldD0iX2JsYW5r Ij48c3BhbiBzdHlsZT0iY29sb3I6IzQwNDc0Qjt0ZXh0LWRlY29yYXRpb246bm9uZSI+Q29ubmVj dCB3aXRoIHVzOg0KPC9zcGFuPjwvYT48c3BhbiBjbGFzcz0iTXNvSHlwZXJsaW5rIj48c3BhbiBz dHlsZT0iY29sb3I6IzQwNDc0Qjt0ZXh0LWRlY29yYXRpb246bm9uZSI+PG86cD48L286cD48L3Nw YW4+PC9zcGFuPjwvc3Bhbj48L2I+PC9wPg0KPC90ZD4NCjx0ZCBzdHlsZT0icGFkZGluZzozLjBw dCAwaW4gMGluIDE1LjBwdDtoZWlnaHQ6MzAuMHB0Ij48L3RkPg0KPC90cj4NCjwvdGJvZHk+DQo8 L3RhYmxlPg0KPC90ZD4NCjwvdHI+DQo8L3Rib2R5Pg0KPC90YWJsZT4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIGNsYXNzPSJNc29IeXBlcmxpbmsiPjxzcGFuIHN0eWxlPSJjb2xvcjp3aW5k b3d0ZXh0O3RleHQtZGVjb3JhdGlvbjpub25lIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1ib3R0b206MTIuMHB0 Ij48YSBocmVmPSJodHRwczovL3d3dy5waW5naWRlbnRpdHkuY29tIiB0YXJnZXQ9Il9ibGFuayI+ PHNwYW4gc3R5bGU9ImNvbG9yOndpbmRvd3RleHQ7dGV4dC1kZWNvcmF0aW9uOm5vbmUiPjxicj4N Cl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fPGJyPg0KVW5i ZWFyYWJsZSBtYWlsaW5nIGxpc3Q8YnI+DQo8L3NwYW4+VW5iZWFyYWJsZUBpZXRmLm9yZzxzcGFu IHN0eWxlPSJjb2xvcjp3aW5kb3d0ZXh0O3RleHQtZGVjb3JhdGlvbjpub25lIj48YnI+DQo8L3Nw YW4+aHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby91bmJlYXJhYmxlPC9hPjxz cGFuIGNsYXNzPSJNc29IeXBlcmxpbmsiPjxzcGFuIHN0eWxlPSJjb2xvcjp3aW5kb3d0ZXh0O3Rl eHQtZGVjb3JhdGlvbjpub25lIj48bzpwPjwvbzpwPjwvc3Bhbj48L3NwYW4+PC9wPg0KPC9kaXY+ DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2tx dW90ZT4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_BN3PR03MB235513ED73A136578EBCADC2F5850BN3PR03MB2355namp_-- From nobody Wed Dec 7 05:34:11 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 684EF129999 for ; Wed, 7 Dec 2016 05:34:10 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.701 X-Spam-Level: X-Spam-Status: No, score=-0.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=1.989, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=pingidentity.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bFH9Du7HyXgi for ; Wed, 7 Dec 2016 05:34:07 -0800 (PST) Received: from mail-io0-x230.google.com (mail-io0-x230.google.com [IPv6:2607:f8b0:4001:c06::230]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 32F771296F5 for ; Wed, 7 Dec 2016 05:34:06 -0800 (PST) Received: by mail-io0-x230.google.com with SMTP id c21so655446135ioj.1 for ; Wed, 07 Dec 2016 05:34:06 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=pingidentity.com; s=gmail; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=DMXDJn0R8mp32gqki6PUgkBaYScHm+6THtVKD4q0R54=; b=ipWHMK6ZYed1svHFZaWjY/YHZ4b1wELbWIUq6BesNEeg9AB0D59p96Bt97WLJrXueE GEcFCiuahOBOFKwqwKUidHSTk1Qf/HEgEtZR5gzq8OBlYCU6R8XMA8LsCFR4CRLFrGPo Xs3EycTHyK1oJiU9UiOmN0DTtuWSW69Co0v1s= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=DMXDJn0R8mp32gqki6PUgkBaYScHm+6THtVKD4q0R54=; b=SHm2OyYvSDhx8gG4xiM2RGpdTuOLLnGuZxNrOzm9z0zWjNUb60MBXMJfctDGp98E/U b+hxRh2k1zTQaTM+kKQRo8OandRuOu2PxvClUg7fFDkhNJd6whSEb6P/ui0zb62oePX6 t7s2GC2Dym3s+Odbdk3kAFqz3Y5GY0US+tRq24DQW8dn2jXsqhCKhFeG/WKHZtKzBCrl RYajMru2cOLWqLri30liihSoc9tka2XRbTnKZPzKOoCds9RIprx91YzG+j3471xpxrL2 8PrOIgORyuG4XuVQVxLT9Lo8O9KHh4eBiWfQQ53jXoCFYeWGNhJ75vD9El+0/0q/eUft qQPQ== X-Gm-Message-State: AKaTC00CQhI6WGaCVUqks5e2AVMjLXG5fyUlK2odmMMQ1zOq6ViMCRaOl7Q79UjKyhOmx5Mqd3Omve/pbS5+HZjT X-Received: by 10.36.139.4 with SMTP id g4mr2164871ite.35.1481117644638; Wed, 07 Dec 2016 05:34:04 -0800 (PST) MIME-Version: 1.0 Received: by 10.79.208.118 with HTTP; Wed, 7 Dec 2016 05:33:34 -0800 (PST) In-Reply-To: References: <5807ff47-4222-221b-6332-263825417861@KingsMountain.com> From: Brian Campbell Date: Wed, 7 Dec 2016 06:33:34 -0700 Message-ID: To: Andrei Popov Content-Type: multipart/alternative; boundary=94eb2c04abb814672f054311933b Archived-At: Cc: IETF TokBind WG , Martin Thomson , =JeffH , Nick Harper , Bill Cox Subject: Re: [Unbearable] PR#82: TBPROTO: update ECPoint.point to be in X9.62 format with leading 0x04 byte X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Dec 2016 13:34:10 -0000 --94eb2c04abb814672f054311933b Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable In working on a sever side implementation in Java I've not found API support for the X9.62 format. So that generalization might be a bit too broad. On Tue, Dec 6, 2016 at 5:07 PM, Andrei Popov wrote: > =C3=98 =E2=80=A6anyone who is using existing code will likely have a lib= rary that > produces X9.62. > > This is not necessarily the case: I maintain existing TLS code that > produces and consumes X9.62, but I have to add/strip the 0x04 in my code. > The crypto libraries in Windows don=E2=80=99t handle 0x04 for me. > > In practice, I=E2=80=99d rather not add a useless byte or change the wire= format > without a good technical reason (IMHO being able to reference X9.62 is no= t > a good technical reason). > > > > Cheers, > > > > Andrei > > > > *From:* Unbearable [mailto:unbearable-bounces@ietf.org] *On Behalf Of *Bi= ll > Cox > *Sent:* Tuesday, December 6, 2016 3:57 PM > *To:* Martin Thomson > *Cc:* IETF TokBind WG ; Brian Campbell < > bcampbell@pingidentity.com>; Nick Harper ; =3DJeffH < > Jeff.Hodges@kingsmountain.com> > *Subject:* Re: [Unbearable] PR#82: TBPROTO: update ECPoint.point to be in > X9.62 format with leading 0x04 byte > > > > All they have to do is strip off the leading 0x04. It does not make sens= e > to me to use a pseudo-standard for EC, but a custom format for RSA. > > > > On Tue, Dec 6, 2016 at 3:50 PM, Martin Thomson > wrote: > > This is a false economy: anyone who is using existing code will likely > have a library that produces X9.62. All of the languages/libraries I'm > aware of natively support that format; only a few have native access to X > and Y. In those languages/libraries, dealing with the custom format is > more work. > > Access to the spec isn't needed, Jeff included a nice definition. (I've > never seen a copy myself and I haven't felt any pain.) > > I think that the relevant concern is Bill's. > > > > > > On 7 December 2016 at 08:28, Brian Campbell > wrote: > > However, in this case, there's not a compelling reason to use that > preexisting standard either. > > Value comes from using preexisting standards when there exist reusable > abstractions/implementations of the standard. I've not seen that to be th= e > case and X9.62 just becomes extra baggage. > > > X9.62 2005 isn't exactly easily accessible either - I've not been able to > find a copy that doesn't require $100 payment. > > As Andre has said, the only thing that using the X9.62 format seems to do > is allow TB to call the ECPoint representation "uncompressed point format > per ANSI.X9-62.2005". I don't see the value in that. > > It'd also be an incompatible change (as Bill points out). That's a good > reason, to me anyway, to not make the change at this late stage in the > process. > > And yes it's only 1 byte but it's a unnecessary byte that's just going to > be ignored. I just don't see a benefit to adding that. > > I'd prefer that we leave it as currently defined. Noting that there exist > multiple independent interoperable implementations of the current draft. > > > > > > > > On Tue, Dec 6, 2016 at 3:52 PM, Nick Harper wrote: > > I agree with Martin and Jeff. Let's use pre-existing standards unless > there's a good reason not to. > > > > On Tue, Dec 6, 2016 at 2:22 PM, Martin Thomson > wrote: > > On 7 December 2016 at 05:36, =3DJeffH wro= te: > > PR#82: TBPROTO: update ECPoint.point to be in X9.62 format with leading > 0x04 > > byte, fixes #62 > > https://github.com/TokenBinding/Internet-Drafts/pull/82 > > Thanks Jeff, I think that this is a good idea. There is more value in > uniformity than in any narrow notion of optimality > > > _______________________________________________ > Unbearable mailing list > Unbearable@ietf.org > https://www.ietf.org/mailman/listinfo/unbearable > > > > > _______________________________________________ > Unbearable mailing list > Unbearable@ietf.org > https://www.ietf.org/mailman/listinfo/unbearable > > > > -- > > > > > > > > *Brian Campbell Distinguished Engineer bcampbell@pingidentity.com w: +1 > 720.317.2061 c: +1 303.918.9415 * > > *Connect with us: * > > > > > > > _______________________________________________ > Unbearable mailing list > *Unbearable@ietf.org* > *https://www.ietf.org/mailman/listinfo/unbearable* > > > > > --94eb2c04abb814672f054311933b Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
In working on a sever side implementation in Java I've= not found API support for the X9.62 format. So that generalization might b= e a bit too broad.

=C2=A0

On Tue, Dec 6, 2016 at 5:07 PM, Andrei Popov <Andrei.Popov@microsoft.com> wrote:

=C3=98=C2=A0 =E2=80=A6anyone who is using existing code will= likely have a library that produces X9.62.=C2=A0

This is not necessarily the case: I maintain existi= ng TLS code that produces and consumes X9.62, but I have to add/strip the 0= x04 in my code. The crypto libraries in Windows don=E2=80=99t handle 0x04 for me.

In practice, I=E2=80=99d rather not add a useless b= yte or change the wire format without a good technical reason (IMHO being a= ble to reference X9.62 is not a good technical reason).

=C2=A0

Cheers,

=C2=A0

Andrei

=C2=A0

From: Unbearable [mailto:unbearable-bounces@ietf.org] On Behalf Of Bill Cox
Sent: Tuesday, December 6, 2016 3:57 PM
To: Martin Thomson <martin.thomson@gmail.com>
Cc: IETF TokBind WG <unbearable@ietf.org>; Brian Campbell <bcampbell@pingidentity.co= m>; Nick Harper <nharper@google.com>; =3DJeffH <Jeff.Hodges@kingsmountain.com<= wbr>>
Subject: Re: [Unbearable] PR#82: TBPROTO: update ECPoint.point to be= in X9.62 format with leading 0x04 byte

=C2=A0

All they have to do is strip off the leading 0x04.= =C2=A0 It does not make sense to me to use a pseudo-standard for EC, but a = custom format for RSA.

=C2=A0

On Tue, Dec 6, 2016 at 3:50 PM, Martin Thomson <<= a href=3D"mailto:martin.thomson@gmail.com" target=3D"_blank">martin.thomson= @gmail.com> wrote:

This is a false econo= my: anyone who is using existing code will likely have a library that produ= ces X9.62.=C2=A0 All of the languages/libraries I'm aware of natively s= upport that format; only a few have native access to X and Y.=C2=A0 In those languages/libraries, dealing with the custom fo= rmat is more work.

Access to the spec is= n't needed, Jeff included a nice definition.=C2=A0 (I've never seen= a copy myself and I haven't felt any pain.)

I think that the relevant concern is Bill's.<= /u>

=C2=A0

=C2=A0

On 7 December 2016 at 08:28, Brian Campbell <bcampbell@pingi= dentity.com> wrote:

However, in this case= , there's not a compelling reason to use that preexisting standard eith= er.=C2=A0

Value comes from using preexisting standards when th= ere exist reusable abstractions/implementations of the standard. I've n= ot seen that to be the case and X9.62 just becomes extra baggage.=


X9.62 2005 isn't exactly easily accessible either - I've not been a= ble to find a copy that doesn't require $100 payment.

As Andre has said, th= e only thing that using the X9.62 format seems to do is allow TB to call th= e ECPoint representation "uncompressed point format per ANSI.X9-62.200= 5". I don't see the value in that.

It'd also be an i= ncompatible change (as Bill points out). That's a good reason, to me an= yway, to not make the change at this late stage in the process.

And yes it's only= 1 byte but it's a unnecessary byte that's just going to be ignored= . I just don't see a benefit to adding that.

I'd prefer that w= e leave it as currently defined. Noting that there exist multiple independe= nt interoperable implementations of the current draft.

=C2=A0<= /p>

=C2=A0<= /p>

=C2=A0

On Tue, Dec 6, 2016 at 3:52 PM, Nick Harper <nharper@google.com&= gt; wrote:

I agree with Martin and Jeff. Let's use pre-exis= ting standards unless there's a good reason not to.

=C2=A0

On Tue, Dec 6, 2016 at 2:22 PM, Martin Thomson <<= a href=3D"mailto:martin.thomson@gmail.com" target=3D"_blank">martin.thomson= @gmail.com> wrote:

On 7 December 2016 at 05:36, =3DJeffH <Jeff.Hodges@kingsm= ountain.com> wrote:
> PR#82: TBPROTO: update ECPoint.point to be in X9.62 format with leadin= g 0x04
> byte, fixes #62
> https://github.com/TokenBinding/Internet-Drafts/pull/82

Thanks Jeff, I think that this is a good idea.=C2=A0 There is more value in=
uniformity than in any narrow notion of optimality


_______________________________________________
Unbearable mailing list
Unbearable@ietf.or= g
https://www.ietf.org/mailman/listinfo/unbearable=

=C2=A0


_______________________________________________
Unbearable mailing list
Unbearable@ietf.or= g
https://www.ietf.org/mailman/listinfo/unbearable=



--


--94eb2c04abb814672f054311933b-- From nobody Wed Dec 7 09:04:37 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A47E2129470 for ; Wed, 7 Dec 2016 09:04:35 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.902 X-Spam-Level: X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TcsCgubU_S9H for ; Wed, 7 Dec 2016 09:04:31 -0800 (PST) Received: from gproxy4-pub.mail.unifiedlayer.com (gproxy4-pub.mail.unifiedlayer.com [69.89.23.142]) by ietfa.amsl.com (Postfix) with SMTP id 7F758129502 for ; Wed, 7 Dec 2016 09:04:31 -0800 (PST) Received: (qmail 21388 invoked by uid 0); 7 Dec 2016 17:04:29 -0000 Received: from unknown (HELO cmgw2) (10.0.90.83) by gproxy4.mail.unifiedlayer.com with SMTP; 7 Dec 2016 17:04:29 -0000 Received: from box514.bluehost.com ([74.220.219.114]) by cmgw2 with id H53T1u01b2UhLwi0153Wm2; Wed, 07 Dec 2016 10:03:31 -0700 X-Authority-Analysis: v=2.1 cv=YNIMl32x c=1 sm=1 tr=0 a=9W6Fsu4pMcyimqnCr1W0/w==:117 a=9W6Fsu4pMcyimqnCr1W0/w==:17 a=L9H7d07YOLsA:10 a=9cW_t1CCXrUA:10 a=s5jvgZ67dGcA:10 a=IkcTkHD0fZMA:10 a=n5n_aSjo0skA:10 a=Yd9bt2Xig6AVYXRRojUA:9 a=QEXdDO2ut3YA:10 a=bUTTWJhTz5cA:10 Received: from [173.224.162.69] (port=61051 helo=[10.225.80.126]) by box514.bluehost.com with esmtpsa (TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128) (Exim 4.86_1) (envelope-from ) id 1cEfcv-0007fW-BX for unbearable@ietf.org; Wed, 07 Dec 2016 10:03:29 -0700 To: IETF TokBind WG From: =JeffH Message-ID: <3bf18084-83ef-2609-c361-44c6db2ad321@KingsMountain.com> Date: Wed, 7 Dec 2016 09:03:31 -0800 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:45.0) Gecko/20100101 Thunderbird/45.5.1 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - box514.bluehost.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - KingsMountain.com X-BWhitelist: no X-Source-IP: 173.224.162.69 X-Exim-ID: 1cEfcv-0007fW-BX X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: ([10.225.80.126]) [173.224.162.69]:61051 X-Source-Auth: jeff.hodges+kingsmountain.com X-Email-Count: 1 X-Source-Cap: a2luZ3Ntb3U7a2luZ3Ntb3U7Ym94NTE0LmJsdWVob3N0LmNvbQ== Archived-At: Subject: Re: [Unbearable] PR#82: TBPROTO: update ECPoint.point to be in X9.62 format with leading 0x04 byte X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Dec 2016 17:04:35 -0000 Seems to me that given the input from several implementors that they are parsing/constructing the ECC public key "by hand" in any case that we ought to leave well enough alone and close this PR#82. =JeffH From nobody Wed Dec 7 14:41:29 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5E47B1295B3 for ; Wed, 7 Dec 2016 14:41:27 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.598 X-Spam-Level: X-Spam-Status: No, score=0.598 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, TVD_SPACE_RATIO=0.001, TVD_SPACE_RATIO_MINFP=2.497] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com; domainkeys=pass (1024-bit key) header.sender=Jeff.Hodges=kingsmountain.com@github.com header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UbhkzptrBNap for ; Wed, 7 Dec 2016 14:41:25 -0800 (PST) Received: from m69-170.mailgun.net (m69-170.mailgun.net [166.78.69.170]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1A6CC1295E2 for ; Wed, 7 Dec 2016 14:41:24 -0800 (PST) DKIM-Signature: a=rsa-sha256; v=1; c=relaxed/relaxed; d=github.com; q=dns/txt; s=mailo; t=1481150484; h=Content-Transfer-Encoding: Content-Type: Mime-Version: Subject: Message-ID: To: Reply-To: From: Date: Sender; bh=wdCRkp1bq0g9jriIooE54XQnYvJwyfdvPbBmPKi4pt0=; b=XCNN+/UoB6dBUrONVA5/CxCMvbsR5AP5jbYcd7XnE28gAV3l6Yrad13vjs7pPKp63JwNyWN0 fG4CRCb3lc6HbFVi5thVnJb+FFsYluaIxhgexsTUuVFJjhBsU7K9h7zJIW3kz1t2D+uB3OZA FG6o2T0ybHMxM4liJqNyeWrdafc= DomainKey-Signature: a=rsa-sha1; c=nofws; d=github.com; s=mailo; q=dns; h=Sender: Date: From: Reply-To: To: Message-ID: Subject: Mime-Version: Content-Type: Content-Transfer-Encoding; b=gEKHFgQopB6MLP89JWl7wSf8Y7GRv9ZRNMxnD2iyWc60Ns3s47GZ8aoDCoy4js4he0yZ3T BbeBQ2TyAjdSOx2bcwJeGlAzXakOPmTnXRJBRXuG8xZ8mmp41Gi6m3fjPcFTKJ+aRd8kgv6T DJrhYLKD4t37++8Fg9RzkWeg0dFKw= Sender: Jeff.Hodges=kingsmountain.com@github.com X-Mailgun-Sending-Ip: 166.78.69.170 X-Mailgun-Sid: WyIzMTNlNyIsICJ1bmJlYXJhYmxlQGlldGYub3JnIiwgIjQwZiJd Received: from github.com (Unknown [192.30.252.42]) by mxa.mailgun.org with ESMTP id 58489013.7efc7843d840-in03; Wed, 07 Dec 2016 22:41:23 -0000 (UTC) Date: Wed, 07 Dec 2016 14:41:23 -0800 From: equalsJeffH To: unbearable@ietf.org Message-ID: <584890131ce6e_228d3f838decb13491290@hookshot-fe-6dbb0c4.cp1-iad.github.net.mail> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="--==_mimepart_584890131cad5_228d3f838decb1349115"; charset=UTF-8 Content-Transfer-Encoding: 7bit Archived-At: Subject: [Unbearable] [TokenBinding/Internet-Drafts] X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: equalsJeffH List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Dec 2016 22:41:27 -0000 ----==_mimepart_584890131cad5_228d3f838decb1349115 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Branch: refs/heads/equalsJeffH-HTTPSTB-#33-scoping Home: https://github.com/TokenBinding/Internet-Drafts ----==_mimepart_584890131cad5_228d3f838decb1349115-- From nobody Thu Dec 8 12:02:01 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A29511294FA for ; Thu, 8 Dec 2016 12:02:00 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.902 X-Spam-Level: X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IIgyaNMUHSCR for ; Thu, 8 Dec 2016 12:01:59 -0800 (PST) Received: from gproxy10-pub.mail.unifiedlayer.com (gproxy10-pub.mail.unifiedlayer.com [69.89.20.226]) by ietfa.amsl.com (Postfix) with SMTP id B68B2129577 for ; Thu, 8 Dec 2016 12:01:58 -0800 (PST) Received: (qmail 9298 invoked by uid 0); 8 Dec 2016 20:01:58 -0000 Received: from unknown (HELO cmgw4) (10.0.90.85) by gproxy10.mail.unifiedlayer.com with SMTP; 8 Dec 2016 20:01:58 -0000 Received: from box514.bluehost.com ([74.220.219.114]) by cmgw4 with id HY1E1u00l2UhLwi01Y1H00; Thu, 08 Dec 2016 13:01:18 -0700 X-Authority-Analysis: v=2.1 cv=Zpp+dbLG c=1 sm=1 tr=0 a=9W6Fsu4pMcyimqnCr1W0/w==:117 a=9W6Fsu4pMcyimqnCr1W0/w==:17 a=L9H7d07YOLsA:10 a=9cW_t1CCXrUA:10 a=s5jvgZ67dGcA:10 a=IkcTkHD0fZMA:10 a=n5n_aSjo0skA:10 a=ic3j8lRSwMveVA9WG5EA:9 a=QEXdDO2ut3YA:10 a=P_49oEG5JZEA:10 Received: from c-73-202-80-238.hsd1.ca.comcast.net ([73.202.80.238]:52321 helo=[192.168.11.53]) by box514.bluehost.com with esmtpsa (TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128) (Exim 4.86_1) (envelope-from ) id 1cF4sU-00049y-Bc for unbearable@ietf.org; Thu, 08 Dec 2016 13:01:14 -0700 To: IETF TokBind WG From: =JeffH Message-ID: <8d6d2dc0-a16b-32ea-5e8d-5bfde54c1c2c@KingsMountain.com> Date: Thu, 8 Dec 2016 12:01:13 -0800 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:45.0) Gecko/20100101 Thunderbird/45.5.1 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - box514.bluehost.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - KingsMountain.com X-BWhitelist: no X-Source-IP: 73.202.80.238 X-Exim-ID: 1cF4sU-00049y-Bc X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: c-73-202-80-238.hsd1.ca.comcast.net ([192.168.11.53]) [73.202.80.238]:52321 X-Source-Auth: jeff.hodges+kingsmountain.com X-Email-Count: 1 X-Source-Cap: a2luZ3Ntb3U7a2luZ3Ntb3U7Ym94NTE0LmJsdWVob3N0LmNvbQ== Archived-At: Subject: [Unbearable] PR#84: TBPROTO: WGLC: editorial cleanup 1 X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Dec 2016 20:02:00 -0000 TBPROTO v11 -> v12: Editorial polishing of Abstract, Intro, Overview, Security-TokenReplay HTH, =JeffH From nobody Thu Dec 8 12:06:27 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 40FF81295FC for ; Thu, 8 Dec 2016 12:06:25 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.902 X-Spam-Level: X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ePyPmVdHV5PY for ; Thu, 8 Dec 2016 12:06:23 -0800 (PST) Received: from gproxy9-pub.mail.unifiedlayer.com (gproxy9-pub.mail.unifiedlayer.com [69.89.20.122]) by ietfa.amsl.com (Postfix) with SMTP id AC413129543 for ; Thu, 8 Dec 2016 12:06:23 -0800 (PST) Received: (qmail 25887 invoked by uid 0); 8 Dec 2016 20:06:23 -0000 Received: from unknown (HELO cmgw3) (10.0.90.84) by gproxy9.mail.unifiedlayer.com with SMTP; 8 Dec 2016 20:06:23 -0000 Received: from box514.bluehost.com ([74.220.219.114]) by cmgw3 with id HY5t1u01A2UhLwi01Y5xAn; Thu, 08 Dec 2016 13:05:58 -0700 X-Authority-Analysis: v=2.1 cv=S7ZKnucP c=1 sm=1 tr=0 a=9W6Fsu4pMcyimqnCr1W0/w==:117 a=9W6Fsu4pMcyimqnCr1W0/w==:17 a=L9H7d07YOLsA:10 a=9cW_t1CCXrUA:10 a=s5jvgZ67dGcA:10 a=IkcTkHD0fZMA:10 a=n5n_aSjo0skA:10 a=48vgC7mUAAAA:8 a=unXiOksb1c6wLPr3tzcA:9 a=QEXdDO2ut3YA:10 a=w1C3t2QeGrPiZgrLijVG:22 Received: from c-73-202-80-238.hsd1.ca.comcast.net ([73.202.80.238]:52346 helo=[192.168.11.53]) by box514.bluehost.com with esmtpsa (TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128) (Exim 4.86_1) (envelope-from ) id 1cF4wz-0007MB-Er for unbearable@ietf.org; Thu, 08 Dec 2016 13:05:53 -0700 From: =JeffH To: IETF TokBind WG Message-ID: Date: Thu, 8 Dec 2016 12:05:52 -0800 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:45.0) Gecko/20100101 Thunderbird/45.5.1 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - box514.bluehost.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - KingsMountain.com X-BWhitelist: no X-Source-IP: 73.202.80.238 X-Exim-ID: 1cF4wz-0007MB-Er X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: c-73-202-80-238.hsd1.ca.comcast.net ([192.168.11.53]) [73.202.80.238]:52346 X-Source-Auth: jeff.hodges+kingsmountain.com X-Email-Count: 2 X-Source-Cap: a2luZ3Ntb3U7a2luZ3Ntb3U7Ym94NTE0LmJsdWVob3N0LmNvbQ== Archived-At: Subject: [Unbearable] WGLC comments on -tokbind-protocol-11 - S 4.2 Server Processing Rules X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Dec 2016 20:06:25 -0000 S 4.2. Server Processing Rules https://tools.ietf.org/html/draft-ietf-tokbind-protocol-11#section-4.2 this section only tangentially stipulates that the server must actually verify the signatures in a Token Binding Message (TBM). the relevant parag is this one.. If the Token Binding message does not contain at least one TokenBinding structure, or if a signature contained in any TokenBinding structure is invalid, the server MUST reject the binding. ..which implies that the server ought to check the signatures on any TokenBindings (TBs) in a TBM. Is this sufficiently explicit (I have my doubts)? (there is also a non-normative mention of the server validating signatures in TBM in 3d parag of Overview) also in this section, "rejection" of token bindings (and by implication, a containing TBM) is defined only at the end of S 4.2. Suggest moving it up to the beginning of the section, e.g., as a "Note". Also the term "reject" implies conveying some info to the client in response, but that is not uniformly the case, as the actual form "rejection" might take is left up to the server-side app-layer and one of the example options is "failing requests". I would use appropriate forms of the term "not accept" instead of "reject", and explain that "non acceptance" can take several forms (ie the ones already listed), as well as including "rejection". Finally, the present initial parag, which is the triple-handshake-admonition, could also be made a "Note:" and shortened up since the admonition proper is (duplicated) in Sec Cons. Should xref to sec cons "for details". OR, we could remove it from here, since it is duplicated in TBPROTO sec cons, and also in TBNEGO. HTH, =JeffH From nobody Thu Dec 8 12:10:50 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 72C7A1295FC for ; Thu, 8 Dec 2016 12:10:49 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.902 X-Spam-Level: X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sEczG9W5WU9D for ; Thu, 8 Dec 2016 12:10:47 -0800 (PST) Received: from gproxy10-pub.mail.unifiedlayer.com (gproxy10-pub.mail.unifiedlayer.com [69.89.20.226]) by ietfa.amsl.com (Postfix) with SMTP id AF20012956F for ; Thu, 8 Dec 2016 12:10:47 -0800 (PST) Received: (qmail 21702 invoked by uid 0); 8 Dec 2016 20:10:47 -0000 Received: from unknown (HELO cmgw4) (10.0.90.85) by gproxy10.mail.unifiedlayer.com with SMTP; 8 Dec 2016 20:10:47 -0000 Received: from box514.bluehost.com ([74.220.219.114]) by cmgw4 with id HYAi1u00z2UhLwi01YAl60; Thu, 08 Dec 2016 13:10:45 -0700 X-Authority-Analysis: v=2.1 cv=Zpp+dbLG c=1 sm=1 tr=0 a=9W6Fsu4pMcyimqnCr1W0/w==:117 a=9W6Fsu4pMcyimqnCr1W0/w==:17 a=L9H7d07YOLsA:10 a=9cW_t1CCXrUA:10 a=s5jvgZ67dGcA:10 a=IkcTkHD0fZMA:10 a=n5n_aSjo0skA:10 a=NEAV23lmAAAA:8 a=riJ5O8nRL5UphCpjmdoA:9 a=QEXdDO2ut3YA:10 a=ViSl_XOHMMEA:10 a=Bn2pgwyD2vrAyMmN8A2t:22 Received: from c-73-202-80-238.hsd1.ca.comcast.net ([73.202.80.238]:52460 helo=[192.168.11.53]) by box514.bluehost.com with esmtpsa (TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128) (Exim 4.86_1) (envelope-from ) id 1cF51e-0003Kr-DN for unbearable@ietf.org; Thu, 08 Dec 2016 13:10:42 -0700 From: =JeffH To: IETF TokBind WG Message-ID: Date: Thu, 8 Dec 2016 12:10:41 -0800 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:45.0) Gecko/20100101 Thunderbird/45.5.1 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - box514.bluehost.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - KingsMountain.com X-BWhitelist: no X-Source-IP: 73.202.80.238 X-Exim-ID: 1cF51e-0003Kr-DN X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: c-73-202-80-238.hsd1.ca.comcast.net ([192.168.11.53]) [73.202.80.238]:52460 X-Source-Auth: jeff.hodges+kingsmountain.com X-Email-Count: 3 X-Source-Cap: a2luZ3Ntb3U7a2luZ3Ntb3U7Ym94NTE0LmJsdWVob3N0LmNvbQ== Archived-At: Subject: [Unbearable] PR#84: TBPROTO: WGLC: editorial cleanup 1 X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Dec 2016 20:10:49 -0000 [ oops, a link would be helpful... ] TBPROTO v11 -> v12: Editorial polishing of Abstract, Intro, Overview, Security-TokenReplay https://github.com/TokenBinding/Internet-Drafts/pull/84 HTH, =JeffH From nobody Thu Dec 8 12:17:32 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 88BA91294A4 for ; Thu, 8 Dec 2016 12:17:31 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.003 X-Spam-Level: X-Spam-Status: No, score=-2.003 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZtFRBwtsxsiN for ; Thu, 8 Dec 2016 12:17:30 -0800 (PST) Received: from NAM01-BN3-obe.outbound.protection.outlook.com (mail-bn3nam01on0096.outbound.protection.outlook.com [104.47.33.96]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F09BC12953B for ; Thu, 8 Dec 2016 12:17:29 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=ao/lWkCloKjPWaWiWy8F3w7dCsAJ3CvMMZNhLTGkhOg=; b=oZtZZX9aQR8q6rml0cM4bDpfK1aMnP0pbMp90bBNloyPuw0jh/gGX6ly0FAohyHk5uIDgG8QaSXR5FwudzrC20JnEy3NVZuT1+ls83PSVdyVFdaxZ9oCPliGXvdeIrBSx11EOYSajD5HPXEl8P7Y5biq9DtKoUmq1maCENcgJro= Received: from BN3PR0301MB0836.namprd03.prod.outlook.com (10.160.154.146) by BN3PR0301MB0833.namprd03.prod.outlook.com (10.160.154.143) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.693.12; Thu, 8 Dec 2016 20:17:27 +0000 Received: from BN3PR0301MB0836.namprd03.prod.outlook.com ([10.160.154.146]) by BN3PR0301MB0836.namprd03.prod.outlook.com ([10.160.154.146]) with mapi id 15.01.0693.009; Thu, 8 Dec 2016 20:17:27 +0000 From: Andrei Popov To: =JeffH , IETF TokBind WG Thread-Topic: [Unbearable] WGLC comments on -tokbind-protocol-11 - S 4.2 Server Processing Rules Thread-Index: AQHSUY6T5fOvBcFlKkyGGWuaw+Z/GqD+exSA Date: Thu, 8 Dec 2016 20:17:26 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Andrei.Popov@microsoft.com; x-originating-ip: [2001:4898:80e8:8::1d2] x-microsoft-exchange-diagnostics: 1; BN3PR0301MB0833; 7:XMpzQwiA0EsBa1PYC1Y4dddAihTZ3UpdfUb3rma/XS0IEKIPWDtQJj0UjrlFav7ECziisZsQ/k4iGCuQ0rBUgyy2W1l5u+CPPyH7QLa8xJiG54QReMXNoHOcih9iqt1dBC8VCOZmuDbmPrBA2DTntjHjycfPIPqDEkdXU9jnVJ/dLet0EuGGOv1iZywesfLQT9c6arl2vpqwrNjscykMGeJRhJUDQJexLmA5LEi3DfUqzXlgz4iR0Pe4tnOgYIA3Ts6mK37bsgs1am88D73G872DU0UYJozvN/Yz3w9TOHTfzcssqcOITKbUjFYeBHKCWnQy7laM4aPL8H1/xeenX07CuJH/1tzypDVaZA09r8FymA1CP1IZr5b0iGWWoEyf x-ms-office365-filtering-correlation-id: 9d9a8dd6-49bd-4fe8-039c-08d41fa73af6 x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001); SRVR:BN3PR0301MB0833; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(158342451672863); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040375)(601004)(2401047)(5005006)(8121501046)(10201501046)(3002001)(6055026)(61426038)(61427038)(6041248)(20161123560025)(20161123562025)(20161123555025)(20161123564025)(6042181)(6047074)(6072148); SRVR:BN3PR0301MB0833; BCL:0; PCL:0; RULEID:; SRVR:BN3PR0301MB0833; x-forefront-prvs: 0150F3F97D x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(6009001)(7916002)(189002)(199003)(99286002)(38730400001)(3280700002)(107886002)(10090500001)(101416001)(76576001)(50986999)(105586002)(5005710100001)(8990500004)(68736007)(3660700001)(6436002)(2900100001)(33656002)(2950100002)(10290500002)(81156014)(102836003)(92566002)(189998001)(81166006)(76176999)(305945005)(106356001)(97736004)(6506006)(9686002)(77096006)(106116001)(2906002)(122556002)(6116002)(86612001)(74316002)(229853002)(8936002)(7696004)(5001770100001)(7736002)(230783001)(86362001)(5660300001)(54356999); DIR:OUT; SFP:1102; SCL:1; SRVR:BN3PR0301MB0833; H:BN3PR0301MB0836.namprd03.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:1; LANG:en; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 08 Dec 2016 20:17:26.6689 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN3PR0301MB0833 Archived-At: Subject: Re: [Unbearable] WGLC comments on -tokbind-protocol-11 - S 4.2 Server Processing Rules X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Dec 2016 20:17:31 -0000 > Also the term "reject" implies conveying some info to the client in respo= nse... Merriam-Webster thinks "reject" means "refuse to accept, consider, submit t= o, take for some purpose, or use", no implied obligation to respond. So I mildly prefer "reject" to "not accept" for brevity and avoidance of ex= tra negation:). Cheers, Andrei From nobody Sun Dec 11 15:21:58 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5600512951B for ; Sun, 11 Dec 2016 15:21:57 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.402 X-Spam-Level: X-Spam-Status: No, score=-1.402 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, RCVD_IN_SORBS_SPAM=0.5, SPF_PASS=-0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2DfUYrWA7S-c for ; Sun, 11 Dec 2016 15:21:56 -0800 (PST) Received: from gproxy7-pub.mail.unifiedlayer.com (gproxy7-pub.mail.unifiedlayer.com [70.40.196.235]) by ietfa.amsl.com (Postfix) with SMTP id 547121294A4 for ; Sun, 11 Dec 2016 15:21:56 -0800 (PST) Received: (qmail 28327 invoked by uid 0); 11 Dec 2016 23:21:48 -0000 Received: from unknown (HELO cmgw2) (10.0.90.83) by gproxy7.mail.unifiedlayer.com with SMTP; 11 Dec 2016 23:21:48 -0000 Received: from box514.bluehost.com ([74.220.219.114]) by cmgw2 with id JnMj1u00F2UhLwi01nMm4p; Sun, 11 Dec 2016 16:21:46 -0700 X-Authority-Analysis: v=2.1 cv=Zvl+dbLG c=1 sm=1 tr=0 a=9W6Fsu4pMcyimqnCr1W0/w==:117 a=9W6Fsu4pMcyimqnCr1W0/w==:17 a=L9H7d07YOLsA:10 a=9cW_t1CCXrUA:10 a=s5jvgZ67dGcA:10 a=IkcTkHD0fZMA:10 a=n5n_aSjo0skA:10 a=_6VNfjujGmLUXPzratYA:9 a=QEXdDO2ut3YA:10 Received: from c-73-202-80-238.hsd1.ca.comcast.net ([73.202.80.238]:62822 helo=[192.168.11.53]) by box514.bluehost.com with esmtpsa (TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128) (Exim 4.86_1) (envelope-from ) id 1cGDRA-0002kT-UW for unbearable@ietf.org; Sun, 11 Dec 2016 16:21:45 -0700 From: =JeffH To: IETF TokBind WG Message-ID: Date: Sun, 11 Dec 2016 15:21:44 -0800 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:45.0) Gecko/20100101 Thunderbird/45.5.1 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - box514.bluehost.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - KingsMountain.com X-BWhitelist: no X-Source-IP: 73.202.80.238 X-Exim-ID: 1cGDRA-0002kT-UW X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: c-73-202-80-238.hsd1.ca.comcast.net ([192.168.11.53]) [73.202.80.238]:62822 X-Source-Auth: jeff.hodges+kingsmountain.com X-Email-Count: 1 X-Source-Cap: a2luZ3Ntb3U7a2luZ3Ntb3U7Ym94NTE0LmJsdWVob3N0LmNvbQ== Archived-At: Subject: [Unbearable] WGLC comments on -tokbind-protocol-11 - S 4.2 Server Processing Rules X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 11 Dec 2016 23:21:57 -0000 >> Also the term "reject" implies conveying some info to the client in >> response... > > Merriam-Webster thinks "reject" means "refuse to accept, consider, > submit to, take for some purpose, or use", no implied obligation to > respond. > So I mildly prefer "reject" to "not accept" for brevity and > avoidance of extra negation:). yeah, ok, I can live with 'reject'. =JeffH From nobody Tue Dec 13 08:29:55 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0E2D0129429 for ; Tue, 13 Dec 2016 08:29:54 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.596 X-Spam-Level: X-Spam-Status: No, score=-5.596 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-2.896, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7XcMBvbveJcM for ; Tue, 13 Dec 2016 08:29:51 -0800 (PST) Received: from mail-io0-x231.google.com (mail-io0-x231.google.com [IPv6:2607:f8b0:4001:c06::231]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1E8AA129BAF for ; Tue, 13 Dec 2016 08:29:06 -0800 (PST) Received: by mail-io0-x231.google.com with SMTP id d9so232244169ioe.0 for ; Tue, 13 Dec 2016 08:29:06 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:from:date:message-id:subject:to; bh=bnsKTdgtYKnoeTPmaXfLBrk2OfRZV1u4K4535tTEHBw=; b=k6CPuT3FcCJzqG37kXG0edevhMQQ5NeVREcbNCzR1NaNTj/O4jfigDFw28fvoEoDkd gHC1szaTHxRkLblKhHlnZYEdSTrRiuUigsnwqNZ9qvgbzgNMqnAuDlW6m66SDWdxhDsv HwC5jsJE9L2EaEzbuvf5ji3rat0YC/0md4a2Z//DW8FbA/4/pN1jHPa0ZFzkiHcUZD7x u9hS4GfZF0ZcqJ5HU5IPwzpMFg4UHCFZxtRoVTYsGlw7YyL5pzJ+YmLzYJWTXWFaovrp K3hzy5jtO/XUXtLbRNCV4q9DlofpcwkLNCrG5aL7q3+8DTliH/u5pg8MI97rF29HUc9e Q+mw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=bnsKTdgtYKnoeTPmaXfLBrk2OfRZV1u4K4535tTEHBw=; b=LnehqMkIYGcukDsA7QvDyNkErZG0+jxn+1eIWJ7NYg2czfqCb0egCAMmsXgIf3H5Wb IZ9E7OPn+EWAAhY68HBXkcp+9PLM1AYEB0p9mFRZLmwzlDi687fHDCndKiSfBE8YSaUr 9xEX8y2S6f6MRjoz7zdkmXjDH8HGcQR3jdcmEJbxAGFJDA7Bh9Q2fr1iqda2MhLx4F2H FkLYZpAsaFXfq4iHmO5KcKu80PI4+5loQF0yOvyWX6KRG1dqTedPMFKxH4u4H7X4cUzm qkYv2204gSTU3vNfhlGm4BnkXPc4Lp3p7I0C50PvwDDYsWsvYztEDrQNvYG9mT5oyhL8 xrsA== X-Gm-Message-State: AKaTC03Ji+fsg+vuhzyVUr6/Q/gJwSvmT3Ypsita395FGPQJ58n2pnaqkyUlQ6+b9qU/JDchyJNfsjmYhlyzMYn1 X-Received: by 10.36.193.197 with SMTP id e188mr2872121itg.99.1481646544396; Tue, 13 Dec 2016 08:29:04 -0800 (PST) MIME-Version: 1.0 Received: by 10.64.152.41 with HTTP; Tue, 13 Dec 2016 08:29:03 -0800 (PST) From: Bill Cox Date: Tue, 13 Dec 2016 08:29:03 -0800 Message-ID: To: Tokbind WG Content-Type: multipart/alternative; boundary=94eb2c054732f66bc205438cb72d Archived-At: Subject: [Unbearable] Mismatches between negotiated version and TB header format X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 13 Dec 2016 16:29:54 -0000 --94eb2c054732f66bc205438cb72d Content-Type: text/plain; charset=UTF-8 Approximately 1% of the token binding requests hitting Google, after negotiating version 0.10, have an out-of-date token-binding header format. They come from multiple companies and a variety of products. Vin and I looked into these, and IMO it looks like this is going to be a bit of an ongoing headache for token binding. The problem is that most current implementations bury token-binding negotiation way down in the SSL layer, while token-binding headers are generated in a higher-level HTTP library. Unfortunately, it is very easy for these to get out of sync. The SSL layer often has security updates independently of the HTTP library, so it is common to see quite new SSL libraries under quite old HTP libraries. One way to deal with this is to use a common library for both token-binding negotiation and header generation/parsing. This is in theory simple to do. However, at large companies, this can be difficult. In particular, the OpenSSL custom-extension API is not usually exported into typical C++, Java, or C# wrappers, and direct access to the SSLContext object is often not permitted. This means that token-binding negotiation has to be built into the lower level library, which does not generally export functions like generate/parse token-binding headers. This problem will get worse if we switch to native baked-in token-binding negotiation in OpenSSL and other libraries. I do not have a good solution to propose for this. Some ideas are: - bury the whole token-binding library down in the network stack, and export token-binding classes. - have networking libraries export custom extension APIs. - have token-binding HTTP libraries compare their version against the negotiated version - add the token-binding version to headers so that servers can detect the mismatch more easily Thoughts? Bill --94eb2c054732f66bc205438cb72d Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Approximately 1% of the token binding requests hitting Goo= gle, after negotiating version 0.10, have an out-of-date token-binding head= er format.=C2=A0 They come from multiple companies and a variety of product= s.=C2=A0 Vin and I looked into these, and IMO it looks like this is going t= o be a bit of an ongoing headache for token binding.

The= problem is that most current implementations bury token-binding negotiatio= n way down in the SSL layer, while token-binding headers are generated in a= higher-level HTTP library.=C2=A0 Unfortunately, it is very easy for these = to get out of sync.=C2=A0 The SSL layer often has security updates independ= ently of the HTTP library, so it is common to see quite new SSL libraries u= nder quite old HTP libraries.

One way to deal with= this is to use a common library for both token-binding negotiation and hea= der generation/parsing.=C2=A0 This is in theory simple to do.=C2=A0 However= , at large companies, this can be difficult.=C2=A0 In particular, the OpenS= SL custom-extension API is not usually exported into typical C++, Java, or = C# wrappers, and direct access to the SSLContext object is often not permit= ted.=C2=A0 This means that token-binding negotiation has to be built into t= he lower level library, which does not generally export functions like gene= rate/parse token-binding headers.

This problem wil= l get worse if we switch to native baked-in token-binding negotiation in Op= enSSL and other libraries.=C2=A0 I do not have a good solution to propose f= or this.=C2=A0 Some ideas are:

- bury the whole to= ken-binding library down in the network stack, and export token-binding cla= sses.
- have networking libraries export custom extension APIs.
- have token-binding HTTP libraries compare their version against = the negotiated version
- add the token-binding version to headers= so that servers can detect the mismatch more easily

Thoughts?

Bill
--94eb2c054732f66bc205438cb72d-- From nobody Tue Dec 13 10:30:48 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 812BE12945A for ; Tue, 13 Dec 2016 10:30:46 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.002 X-Spam-Level: X-Spam-Status: No, score=-2.002 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RR-lk8SQCGn4 for ; Tue, 13 Dec 2016 10:30:43 -0800 (PST) Received: from NAM03-DM3-obe.outbound.protection.outlook.com (mail-dm3nam03on0104.outbound.protection.outlook.com [104.47.41.104]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AB7B712711D for ; Tue, 13 Dec 2016 10:30:43 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=ko2sgeGmFJRPSNZsEjic8MFjZ+bXfUdq1ZRzdZVKYXM=; b=GdXmQ90PdXVOE1StAnxkZWkoLGlCcNgLR7oj6xMPFg4Zj99PSjay+RWlmYULtcyWHRibuuIJHy7ia4+xKciigXdpLulgbEyukI3xMpP2mWflmTZamnnKO0v6R3SV+75R/WjJtXVH8CAINig9rqL4JbNNFxyGERivJGQSuXltNV4= Received: from CY1PR0301MB0842.namprd03.prod.outlook.com (10.160.163.148) by CY1PR0301MB0844.namprd03.prod.outlook.com (10.160.163.150) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.771.8; Tue, 13 Dec 2016 18:30:42 +0000 Received: from CY1PR0301MB0842.namprd03.prod.outlook.com ([10.160.163.148]) by CY1PR0301MB0842.namprd03.prod.outlook.com ([10.160.163.148]) with mapi id 15.01.0771.014; Tue, 13 Dec 2016 18:30:42 +0000 From: Andrei Popov To: Bill Cox , Tokbind WG Thread-Topic: [Unbearable] Mismatches between negotiated version and TB header format Thread-Index: AQHSVV4mvvH8D2rWpUKezMWNTZR5qaEGMQ0A Date: Tue, 13 Dec 2016 18:30:42 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Andrei.Popov@microsoft.com; x-originating-ip: [50.46.229.189] x-ms-office365-filtering-correlation-id: 6eb4ab2f-a6d2-4c62-17a6-08d42386254a x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001); SRVR:CY1PR0301MB0844; x-microsoft-exchange-diagnostics: 1; CY1PR0301MB0844; 7:MiY640j3FUprRS21+sFp7+oDTIu375XAHQuu6X/R/IaerP/StOlHbjk5ku/1alp56F84mq5i4AHx5I/BLEh9WE8EYvpl+A3vO6Pyyuwu9PmPw8j8/0G1ziOremWA27wvjhogxBKdI2CG5XGFyLeL5RQWbHrxYwS6pAX1S6gAoT4lf8F6sCvikMPQ+ddLhW++g9gzucbrN9HI3KyWn7W7xiqxb7qcpNKNPwcMJXLV9h4ZUDbeXjAQn6UAS10HV8Tq9tE72szPnK323hUkbK1AJ5kO06glEdGonccmNLjyxOrnngKFQ85XaMDqfHJR9Kck7aNIBEq34mtJeWVD/o1kMMdndwQr23KpKXUFxDjYnl+F/5dgXly1YXH1NUHRVjAdjKOnA3nyUhAteKGC5jqlK9znFq9UsLjO1eBVmXrwjXRVnJitKn/fzXbQGudEmySb+/o3YQczta/fb6/r17LDUqrKEZ+2L5aB02gJOvdXeiU= x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(192374486261705)(21748063052155)(21532816269658); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040375)(601004)(2401047)(5005006)(8121501046)(3002001)(10201501046)(6055026)(61426038)(61427038)(6041248)(20161123560025)(20161123555025)(20161123562025)(20161123564025)(6072148)(6047074); SRVR:CY1PR0301MB0844; BCL:0; PCL:0; RULEID:; SRVR:CY1PR0301MB0844; x-forefront-prvs: 01559F388D x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(6009001)(7916002)(39840400002)(39850400002)(39860400002)(39410400002)(39450400003)(377454003)(189002)(199003)(50986999)(76176999)(38730400001)(54356999)(6506006)(3660700001)(77096006)(790700001)(102836003)(6116002)(2900100001)(3280700002)(3846002)(189998001)(10090500001)(8936002)(92566002)(9686002)(556974002)(101416001)(68736007)(107886002)(10290500002)(97736004)(5005710100001)(33656002)(229853002)(5001770100001)(8990500004)(81156014)(5660300001)(81166006)(76576001)(74316002)(2906002)(106116001)(106356001)(99286002)(66066001)(86362001)(7696004)(122556002)(6436002)(105586002)(86612001)(2950100002)(7736002); DIR:OUT; SFP:1102; SCL:1; SRVR:CY1PR0301MB0844; H:CY1PR0301MB0842.namprd03.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:1; LANG:en; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_CY1PR0301MB08427EED37C034EC72296EA98C9B0CY1PR0301MB0842_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 13 Dec 2016 18:30:42.2934 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY1PR0301MB0844 Archived-At: Subject: Re: [Unbearable] Mismatches between negotiated version and TB header format X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 13 Dec 2016 18:30:46 -0000 --_000_CY1PR0301MB08427EED37C034EC72296EA98C9B0CY1PR0301MB0842_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 VG8gbWUsIHRoaXMgaXMgbW9yZSBvZiBhIGdyb3d0aCBwcm9ibGVtIHRoYXQgd2XigJlsbCBnZXQg b3ZlciBvbmNlIHRoZXJlIGlzIGFuIFJGQy4NCg0KRS5nLiB0aGVyZSB3ZXJlIHNvbWUgaW50ZXJu YWwgV2luZG93cyBidWlsZHMgdGhhdCBhZHZlcnRpc2VkIDAuOCwgYnV0IHNlbnQgMC4yIFRCIG1l c3NhZ2VzLCBiZWNhdXNlIGl0IHdhcyBtb3JlIGNvbnZlbmllbnQgZm9yIHVzIHRvIHNlcXVlbmNl IFRCIHVwZGF0ZSB0aGlzIHdheS4NClRoZXNlIGJ1aWxkcyBhcmUgbm90IGludGVuZGVkIGZvciBw cm9kdWN0aW9uIHVzZSwgYW5kIHNlbGYtaG9zdGVycyBkaWQgbm90IHN1ZmZlciBmcm9tIHRoaXMs IGJlY2F1c2UgdGhlcmUgd2VyZSBubyBUQiBzZXJ2ZXJzIGF0IHRoZSB0aW1lLCBleGNlcHQgZm9y IHRlc3QgZGVwbG95bWVudHMuDQpHb2luZyBmb3J3YXJkLCB0aGVzZSBidWlsZHMgc2ltcGx5IGdl dCBwaGFzZWQgb3V0IG9mIGNpcmN1bGF0aW9uLiBBbmQgaWYgdGhleSBmYWlsIHRvIGNvbm5lY3Qg dG8gc2l0ZXMsIHRoZXnigJlsbCBkaXNhcHBlYXIgc29vbmVyLg0KDQpFaXRoZXIgb2YgdGhlIHBy b3Bvc2VkIHNvbHV0aW9ucyB3b3JrLCBidXQgSSB0aGluayBpdOKAmXMgdXAgdG8gdGhlIGltcGxl bWVudGF0aW9uIHRvIGNob29zZSB3aGljaCBhcHByb2FjaCBpcyBiZXN0IGZvciB0aGVtLg0KDQpD aGVlcnMsDQoNCkFuZHJlaQ0KDQpGcm9tOiBVbmJlYXJhYmxlIFttYWlsdG86dW5iZWFyYWJsZS1i b3VuY2VzQGlldGYub3JnXSBPbiBCZWhhbGYgT2YgQmlsbCBDb3gNClNlbnQ6IFR1ZXNkYXksIERl Y2VtYmVyIDEzLCAyMDE2IDg6MjkgQU0NClRvOiBUb2tiaW5kIFdHIDx1bmJlYXJhYmxlQGlldGYu b3JnPg0KU3ViamVjdDogW1VuYmVhcmFibGVdIE1pc21hdGNoZXMgYmV0d2VlbiBuZWdvdGlhdGVk IHZlcnNpb24gYW5kIFRCIGhlYWRlciBmb3JtYXQNCg0KQXBwcm94aW1hdGVseSAxJSBvZiB0aGUg dG9rZW4gYmluZGluZyByZXF1ZXN0cyBoaXR0aW5nIEdvb2dsZSwgYWZ0ZXIgbmVnb3RpYXRpbmcg dmVyc2lvbiAwLjEwLCBoYXZlIGFuIG91dC1vZi1kYXRlIHRva2VuLWJpbmRpbmcgaGVhZGVyIGZv cm1hdC4gIFRoZXkgY29tZSBmcm9tIG11bHRpcGxlIGNvbXBhbmllcyBhbmQgYSB2YXJpZXR5IG9m IHByb2R1Y3RzLiAgVmluIGFuZCBJIGxvb2tlZCBpbnRvIHRoZXNlLCBhbmQgSU1PIGl0IGxvb2tz IGxpa2UgdGhpcyBpcyBnb2luZyB0byBiZSBhIGJpdCBvZiBhbiBvbmdvaW5nIGhlYWRhY2hlIGZv ciB0b2tlbiBiaW5kaW5nLg0KDQpUaGUgcHJvYmxlbSBpcyB0aGF0IG1vc3QgY3VycmVudCBpbXBs ZW1lbnRhdGlvbnMgYnVyeSB0b2tlbi1iaW5kaW5nIG5lZ290aWF0aW9uIHdheSBkb3duIGluIHRo ZSBTU0wgbGF5ZXIsIHdoaWxlIHRva2VuLWJpbmRpbmcgaGVhZGVycyBhcmUgZ2VuZXJhdGVkIGlu IGEgaGlnaGVyLWxldmVsIEhUVFAgbGlicmFyeS4gIFVuZm9ydHVuYXRlbHksIGl0IGlzIHZlcnkg ZWFzeSBmb3IgdGhlc2UgdG8gZ2V0IG91dCBvZiBzeW5jLiAgVGhlIFNTTCBsYXllciBvZnRlbiBo YXMgc2VjdXJpdHkgdXBkYXRlcyBpbmRlcGVuZGVudGx5IG9mIHRoZSBIVFRQIGxpYnJhcnksIHNv IGl0IGlzIGNvbW1vbiB0byBzZWUgcXVpdGUgbmV3IFNTTCBsaWJyYXJpZXMgdW5kZXIgcXVpdGUg b2xkIEhUUCBsaWJyYXJpZXMuDQoNCk9uZSB3YXkgdG8gZGVhbCB3aXRoIHRoaXMgaXMgdG8gdXNl IGEgY29tbW9uIGxpYnJhcnkgZm9yIGJvdGggdG9rZW4tYmluZGluZyBuZWdvdGlhdGlvbiBhbmQg aGVhZGVyIGdlbmVyYXRpb24vcGFyc2luZy4gIFRoaXMgaXMgaW4gdGhlb3J5IHNpbXBsZSB0byBk by4gIEhvd2V2ZXIsIGF0IGxhcmdlIGNvbXBhbmllcywgdGhpcyBjYW4gYmUgZGlmZmljdWx0LiAg SW4gcGFydGljdWxhciwgdGhlIE9wZW5TU0wgY3VzdG9tLWV4dGVuc2lvbiBBUEkgaXMgbm90IHVz dWFsbHkgZXhwb3J0ZWQgaW50byB0eXBpY2FsIEMrKywgSmF2YSwgb3IgQyMgd3JhcHBlcnMsIGFu ZCBkaXJlY3QgYWNjZXNzIHRvIHRoZSBTU0xDb250ZXh0IG9iamVjdCBpcyBvZnRlbiBub3QgcGVy bWl0dGVkLiAgVGhpcyBtZWFucyB0aGF0IHRva2VuLWJpbmRpbmcgbmVnb3RpYXRpb24gaGFzIHRv IGJlIGJ1aWx0IGludG8gdGhlIGxvd2VyIGxldmVsIGxpYnJhcnksIHdoaWNoIGRvZXMgbm90IGdl bmVyYWxseSBleHBvcnQgZnVuY3Rpb25zIGxpa2UgZ2VuZXJhdGUvcGFyc2UgdG9rZW4tYmluZGlu ZyBoZWFkZXJzLg0KDQpUaGlzIHByb2JsZW0gd2lsbCBnZXQgd29yc2UgaWYgd2Ugc3dpdGNoIHRv IG5hdGl2ZSBiYWtlZC1pbiB0b2tlbi1iaW5kaW5nIG5lZ290aWF0aW9uIGluIE9wZW5TU0wgYW5k IG90aGVyIGxpYnJhcmllcy4gIEkgZG8gbm90IGhhdmUgYSBnb29kIHNvbHV0aW9uIHRvIHByb3Bv c2UgZm9yIHRoaXMuICBTb21lIGlkZWFzIGFyZToNCg0KLSBidXJ5IHRoZSB3aG9sZSB0b2tlbi1i aW5kaW5nIGxpYnJhcnkgZG93biBpbiB0aGUgbmV0d29yayBzdGFjaywgYW5kIGV4cG9ydCB0b2tl bi1iaW5kaW5nIGNsYXNzZXMuDQotIGhhdmUgbmV0d29ya2luZyBsaWJyYXJpZXMgZXhwb3J0IGN1 c3RvbSBleHRlbnNpb24gQVBJcy4NCi0gaGF2ZSB0b2tlbi1iaW5kaW5nIEhUVFAgbGlicmFyaWVz IGNvbXBhcmUgdGhlaXIgdmVyc2lvbiBhZ2FpbnN0IHRoZSBuZWdvdGlhdGVkIHZlcnNpb24NCi0g YWRkIHRoZSB0b2tlbi1iaW5kaW5nIHZlcnNpb24gdG8gaGVhZGVycyBzbyB0aGF0IHNlcnZlcnMg Y2FuIGRldGVjdCB0aGUgbWlzbWF0Y2ggbW9yZSBlYXNpbHkNCg0KVGhvdWdodHM/DQoNCkJpbGwN Cg== --_000_CY1PR0301MB08427EED37C034EC72296EA98C9B0CY1PR0301MB0842_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIixzZXJpZjt9 DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCglj b2xvcjojMDU2M0MxOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBz cGFuLk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xv cjojOTU0RjcyOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KcC5tc29ub3JtYWwwLCBs aS5tc29ub3JtYWwwLCBkaXYubXNvbm9ybWFsMA0KCXttc28tc3R5bGUtbmFtZTptc29ub3JtYWw7 DQoJbXNvLW1hcmdpbi10b3AtYWx0OmF1dG87DQoJbWFyZ2luLXJpZ2h0OjBpbjsNCgltc28tbWFy Z2luLWJvdHRvbS1hbHQ6YXV0bzsNCgltYXJnaW4tbGVmdDowaW47DQoJZm9udC1zaXplOjEyLjBw dDsNCglmb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIixzZXJpZjt9DQpzcGFuLkVtYWlsU3R5 bGUxOA0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1yZXBseTsNCglmb250LWZhbWlseToiQ2Fs aWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjp3aW5kb3d0ZXh0O30NCi5Nc29DaHBEZWZhdWx0DQoJ e21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5z LXNlcmlmO30NCkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjguNWluIDExLjBpbjsNCgltYXJn aW46MS4waW4gMS4waW4gMS4waW4gMS4waW47fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldv cmRTZWN0aW9uMTt9DQotLT48L3N0eWxlPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hh cGVkZWZhdWx0cyB2OmV4dD0iZWRpdCIgc3BpZG1heD0iMTAyNiIgLz4NCjwveG1sPjwhW2VuZGlm XS0tPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVsYXlvdXQgdjpleHQ9ImVkaXQi Pg0KPG86aWRtYXAgdjpleHQ9ImVkaXQiIGRhdGE9IjEiIC8+DQo8L286c2hhcGVsYXlvdXQ+PC94 bWw+PCFbZW5kaWZdLS0+DQo8L2hlYWQ+DQo8Ym9keSBsYW5nPSJFTi1VUyIgbGluaz0iIzA1NjND MSIgdmxpbms9IiM5NTRGNzIiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+VG8gbWUsIHRoaXMgaXMgbW9yZSBvZiBhIGdy b3d0aCBwcm9ibGVtIHRoYXQgd2XigJlsbCBnZXQgb3ZlciBvbmNlIHRoZXJlIGlzIGFuIFJGQy48 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2Vy aWYiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssc2Fucy1zZXJpZiI+RS5nLiB0aGVyZSB3ZXJlIHNvbWUgaW50ZXJuYWwgV2luZG93cyBidWls ZHMgdGhhdCBhZHZlcnRpc2VkIDAuOCwgYnV0IHNlbnQgMC4yIFRCIG1lc3NhZ2VzLCBiZWNhdXNl IGl0IHdhcyBtb3JlIGNvbnZlbmllbnQgZm9yIHVzIHRvIHNlcXVlbmNlIFRCIHVwZGF0ZSB0aGlz IHdheS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNh bnMtc2VyaWYiPlRoZXNlIGJ1aWxkcyBhcmUgbm90IGludGVuZGVkIGZvciBwcm9kdWN0aW9uIHVz ZSwgYW5kIHNlbGYtaG9zdGVycyBkaWQgbm90IHN1ZmZlciBmcm9tIHRoaXMsIGJlY2F1c2UgdGhl cmUgd2VyZSBubyBUQiBzZXJ2ZXJzIGF0IHRoZSB0aW1lLCBleGNlcHQgZm9yIHRlc3QgZGVwbG95 bWVudHMuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGEgbmFt ZT0iX01haWxFbmRDb21wb3NlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkdvaW5nIGZvcndhcmQsIHRoZXNl IGJ1aWxkcyBzaW1wbHkgZ2V0IHBoYXNlZCBvdXQgb2YgY2lyY3VsYXRpb24uIEFuZCBpZiB0aGV5 IGZhaWwgdG8gY29ubmVjdCB0byBzaXRlcywgdGhleeKAmWxsIGRpc2FwcGVhciBzb29uZXIuPG86 cD48L286cD48L3NwYW4+PC9hPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJtc28tYm9va21hcms6X01haWxFbmRDb21wb3NlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+Jm5i c3A7PC9vOnA+PC9zcGFuPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsRW5kQ29tcG9zZSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5FaXRo ZXIgb2YgdGhlIHByb3Bvc2VkIHNvbHV0aW9ucyB3b3JrLCBidXQgSSB0aGluayBpdOKAmXMgdXAg dG8gdGhlIGltcGxlbWVudGF0aW9uIHRvIGNob29zZSB3aGljaCBhcHByb2FjaCBpcyBiZXN0IGZv ciB0aGVtLjxvOnA+PC9vOnA+PC9zcGFuPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsRW5kQ29tcG9zZSI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbEVuZENvbXBvc2UiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fu cy1zZXJpZiI+Q2hlZXJzLDxvOnA+PC9vOnA+PC9zcGFuPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsRW5kQ29tcG9zZSI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbEVuZENvbXBvc2Ui PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkm cXVvdDssc2Fucy1zZXJpZiI+QW5kcmVpPG86cD48L286cD48L3NwYW4+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxFbmRDb21w b3NlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxp YnJpJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvc3Bhbj48L3A+ DQo8c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsRW5kQ29tcG9zZSI+PC9zcGFuPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5Gcm9tOjwvc3Bhbj48L2I+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmIj4gVW5iZWFyYWJsZSBbbWFpbHRvOnVuYmVhcmFibGUtYm91bmNlc0BpZXRm Lm9yZ10NCjxiPk9uIEJlaGFsZiBPZiA8L2I+QmlsbCBDb3g8YnI+DQo8Yj5TZW50OjwvYj4gVHVl c2RheSwgRGVjZW1iZXIgMTMsIDIwMTYgODoyOSBBTTxicj4NCjxiPlRvOjwvYj4gVG9rYmluZCBX RyAmbHQ7dW5iZWFyYWJsZUBpZXRmLm9yZyZndDs8YnI+DQo8Yj5TdWJqZWN0OjwvYj4gW1VuYmVh cmFibGVdIE1pc21hdGNoZXMgYmV0d2VlbiBuZWdvdGlhdGVkIHZlcnNpb24gYW5kIFRCIGhlYWRl ciBmb3JtYXQ8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpw PiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5BcHByb3hpbWF0 ZWx5IDElIG9mIHRoZSB0b2tlbiBiaW5kaW5nIHJlcXVlc3RzIGhpdHRpbmcgR29vZ2xlLCBhZnRl ciBuZWdvdGlhdGluZyB2ZXJzaW9uIDAuMTAsIGhhdmUgYW4gb3V0LW9mLWRhdGUgdG9rZW4tYmlu ZGluZyBoZWFkZXIgZm9ybWF0LiZuYnNwOyBUaGV5IGNvbWUgZnJvbSBtdWx0aXBsZSBjb21wYW5p ZXMgYW5kIGEgdmFyaWV0eSBvZiBwcm9kdWN0cy4mbmJzcDsgVmluIGFuZCBJIGxvb2tlZCBpbnRv IHRoZXNlLA0KIGFuZCBJTU8gaXQgbG9va3MgbGlrZSB0aGlzIGlzIGdvaW5nIHRvIGJlIGEgYml0 IG9mIGFuIG9uZ29pbmcgaGVhZGFjaGUgZm9yIHRva2VuIGJpbmRpbmcuPG86cD48L286cD48L3A+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5UaGUgcHJvYmxlbSBpcyB0aGF0IG1vc3Qg Y3VycmVudCBpbXBsZW1lbnRhdGlvbnMgYnVyeSB0b2tlbi1iaW5kaW5nIG5lZ290aWF0aW9uIHdh eSBkb3duIGluIHRoZSBTU0wgbGF5ZXIsIHdoaWxlIHRva2VuLWJpbmRpbmcgaGVhZGVycyBhcmUg Z2VuZXJhdGVkIGluIGEgaGlnaGVyLWxldmVsIEhUVFAgbGlicmFyeS4mbmJzcDsgVW5mb3J0dW5h dGVseSwgaXQgaXMgdmVyeSBlYXN5IGZvciB0aGVzZSB0byBnZXQgb3V0IG9mDQogc3luYy4mbmJz cDsgVGhlIFNTTCBsYXllciBvZnRlbiBoYXMgc2VjdXJpdHkgdXBkYXRlcyBpbmRlcGVuZGVudGx5 IG9mIHRoZSBIVFRQIGxpYnJhcnksIHNvIGl0IGlzIGNvbW1vbiB0byBzZWUgcXVpdGUgbmV3IFNT TCBsaWJyYXJpZXMgdW5kZXIgcXVpdGUgb2xkIEhUUCBsaWJyYXJpZXMuPG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk9uZSB3YXkgdG8gZGVhbCB3 aXRoIHRoaXMgaXMgdG8gdXNlIGEgY29tbW9uIGxpYnJhcnkgZm9yIGJvdGggdG9rZW4tYmluZGlu ZyBuZWdvdGlhdGlvbiBhbmQgaGVhZGVyIGdlbmVyYXRpb24vcGFyc2luZy4mbmJzcDsgVGhpcyBp cyBpbiB0aGVvcnkgc2ltcGxlIHRvIGRvLiZuYnNwOyBIb3dldmVyLCBhdCBsYXJnZSBjb21wYW5p ZXMsIHRoaXMgY2FuIGJlIGRpZmZpY3VsdC4mbmJzcDsgSW4gcGFydGljdWxhciwgdGhlIE9wZW5T U0wgY3VzdG9tLWV4dGVuc2lvbg0KIEFQSSBpcyBub3QgdXN1YWxseSBleHBvcnRlZCBpbnRvIHR5 cGljYWwgQyYjNDM7JiM0MzssIEphdmEsIG9yIEMjIHdyYXBwZXJzLCBhbmQgZGlyZWN0IGFjY2Vz cyB0byB0aGUgU1NMQ29udGV4dCBvYmplY3QgaXMgb2Z0ZW4gbm90IHBlcm1pdHRlZC4mbmJzcDsg VGhpcyBtZWFucyB0aGF0IHRva2VuLWJpbmRpbmcgbmVnb3RpYXRpb24gaGFzIHRvIGJlIGJ1aWx0 IGludG8gdGhlIGxvd2VyIGxldmVsIGxpYnJhcnksIHdoaWNoIGRvZXMgbm90IGdlbmVyYWxseSBl eHBvcnQNCiBmdW5jdGlvbnMgbGlrZSBnZW5lcmF0ZS9wYXJzZSB0b2tlbi1iaW5kaW5nIGhlYWRl cnMuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PlRoaXMgcHJvYmxlbSB3aWxsIGdldCB3b3JzZSBpZiB3ZSBzd2l0Y2ggdG8gbmF0aXZlIGJha2Vk LWluIHRva2VuLWJpbmRpbmcgbmVnb3RpYXRpb24gaW4gT3BlblNTTCBhbmQgb3RoZXIgbGlicmFy aWVzLiZuYnNwOyBJIGRvIG5vdCBoYXZlIGEgZ29vZCBzb2x1dGlvbiB0byBwcm9wb3NlIGZvciB0 aGlzLiZuYnNwOyBTb21lIGlkZWFzIGFyZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+LSBidXJ5IHRoZSB3aG9sZSB0b2tlbi1iaW5kaW5nIGxp YnJhcnkgZG93biBpbiB0aGUgbmV0d29yayBzdGFjaywgYW5kIGV4cG9ydCB0b2tlbi1iaW5kaW5n IGNsYXNzZXMuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj4tIGhhdmUgbmV0d29ya2luZyBsaWJyYXJpZXMgZXhwb3J0IGN1c3RvbSBleHRlbnNpb24g QVBJcy48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi Pi0gaGF2ZSB0b2tlbi1iaW5kaW5nIEhUVFAgbGlicmFyaWVzIGNvbXBhcmUgdGhlaXIgdmVyc2lv biBhZ2FpbnN0IHRoZSBuZWdvdGlhdGVkIHZlcnNpb248bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPi0gYWRkIHRoZSB0b2tlbi1iaW5kaW5nIHZlcnNp b24gdG8gaGVhZGVycyBzbyB0aGF0IHNlcnZlcnMgY2FuIGRldGVjdCB0aGUgbWlzbWF0Y2ggbW9y ZSBlYXNpbHk8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+VGhvdWdodHM/PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPkJpbGw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4N CjwvYm9keT4NCjwvaHRtbD4NCg== --_000_CY1PR0301MB08427EED37C034EC72296EA98C9B0CY1PR0301MB0842_-- From nobody Tue Dec 13 13:09:20 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 47AC4129BDF for ; Tue, 13 Dec 2016 13:09:19 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.402 X-Spam-Level: X-Spam-Status: No, score=-1.402 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, RCVD_IN_SORBS_SPAM=0.5, SPF_PASS=-0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id S4uukQWZtksT for ; Tue, 13 Dec 2016 13:09:17 -0800 (PST) Received: from gproxy5-pub.mail.unifiedlayer.com (gproxy5-pub.mail.unifiedlayer.com [67.222.38.55]) by ietfa.amsl.com (Postfix) with SMTP id 048FA129B96 for ; Tue, 13 Dec 2016 13:07:25 -0800 (PST) Received: (qmail 16948 invoked by uid 0); 13 Dec 2016 21:07:25 -0000 Received: from unknown (HELO cmgw2) (10.0.90.83) by gproxy5.mail.unifiedlayer.com with SMTP; 13 Dec 2016 21:07:25 -0000 Received: from box514.bluehost.com ([74.220.219.114]) by cmgw2 with id KZ7J1u00h2UhLwi01Z7MzT; Tue, 13 Dec 2016 14:07:22 -0700 X-Authority-Analysis: v=2.1 cv=Zvl+dbLG c=1 sm=1 tr=0 a=9W6Fsu4pMcyimqnCr1W0/w==:117 a=9W6Fsu4pMcyimqnCr1W0/w==:17 a=L9H7d07YOLsA:10 a=9cW_t1CCXrUA:10 a=s5jvgZ67dGcA:10 a=IkcTkHD0fZMA:10 a=n5n_aSjo0skA:10 a=NEAV23lmAAAA:8 a=48vgC7mUAAAA:8 a=qo-T5no3uvtSOHcF5_UA:9 a=QEXdDO2ut3YA:10 a=Bn2pgwyD2vrAyMmN8A2t:22 a=w1C3t2QeGrPiZgrLijVG:22 Received: from [173.224.162.79] (port=36810 helo=[192.168.90.221]) by box514.bluehost.com with esmtpsa (TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128) (Exim 4.86_1) (envelope-from ) id 1cGuIB-0004jj-TH for unbearable@ietf.org; Tue, 13 Dec 2016 14:07:19 -0700 From: =JeffH To: IETF TokBind WG Message-ID: Date: Tue, 13 Dec 2016 13:07:17 -0800 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:45.0) Gecko/20100101 Thunderbird/45.5.1 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - box514.bluehost.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - KingsMountain.com X-BWhitelist: no X-Source-IP: 173.224.162.79 X-Exim-ID: 1cGuIB-0004jj-TH X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: ([192.168.90.221]) [173.224.162.79]:36810 X-Source-Auth: jeff.hodges+kingsmountain.com X-Email-Count: 1 X-Source-Cap: a2luZ3Ntb3U7a2luZ3Ntb3U7Ym94NTE0LmJsdWVob3N0LmNvbQ== Archived-At: Subject: [Unbearable] HTTPSTB: WGLC: web origin -> eTLD+1 X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 13 Dec 2016 21:09:19 -0000 https://github.com/TokenBinding/Internet-Drafts/issues/85 In section "2.1. HTTPS Token Binding Key Pair Scoping" we say.. The Token Binding key pair scoping for those key pairs generated by Web browsers in the context of the first-party and federation use cases defined in this specification (below), and to be used for binding HTTP cookies MUST be at the granularity of "effective top- level domain (public suffix) + 1" (eTLD+1), i.e., at the same granularity at which cookies can be set (see [RFC6265]). Note the eTLD+1 requirement above. Then, in section "5.3. HTTP Redirects" , we say (emphasis added).. The TokenBindingMessage SHOULD contain a TokenBinding with TokenBindingType referred_token_binding. If included, this TokenBinding MUST be signed with the Token Binding key used by the client for connections between itself and the Token Consumer (more specifically, the *web origin* that issued the Include-Referred-Token-Binding-ID response header field). The Token Binding ID established by this TokenBinding is called a Referred Token Binding ID. As described above, the TokenBindingMessage MUST additionally contain a Provided Token Binding ID, i.e., a TokenBinding structure with TokenBindingType provided_token_binding, which MUST be signed with the Token Binding key used by the client for connections between itself and the Token Provider (more specifically, the *web origin* that the token request is being sent to). ..and note the use of the term "web origin". In total, there are 7 occurrences of "origin" or "web origin" in HTTPSTB. I propose to change the occurrences of "web origin" to "eTLD+1". From nobody Tue Dec 13 13:24:48 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 90D76129AC2 for ; Tue, 13 Dec 2016 13:24:47 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.402 X-Spam-Level: X-Spam-Status: No, score=-1.402 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, RCVD_IN_SORBS_SPAM=0.5, SPF_PASS=-0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PgFt1H6fUItM for ; Tue, 13 Dec 2016 13:24:46 -0800 (PST) Received: from gproxy5-pub.mail.unifiedlayer.com (gproxy5-pub.mail.unifiedlayer.com [67.222.38.55]) by ietfa.amsl.com (Postfix) with SMTP id 39313129AB0 for ; Tue, 13 Dec 2016 13:24:36 -0800 (PST) Received: (qmail 23122 invoked by uid 0); 13 Dec 2016 21:24:36 -0000 Received: from unknown (HELO cmgw2) (10.0.90.83) by gproxy5.mail.unifiedlayer.com with SMTP; 13 Dec 2016 21:24:36 -0000 Received: from box514.bluehost.com ([74.220.219.114]) by cmgw2 with id KZQX1u00L2UhLwi01ZQamw; Tue, 13 Dec 2016 14:24:34 -0700 X-Authority-Analysis: v=2.1 cv=Zvl+dbLG c=1 sm=1 tr=0 a=9W6Fsu4pMcyimqnCr1W0/w==:117 a=9W6Fsu4pMcyimqnCr1W0/w==:17 a=L9H7d07YOLsA:10 a=9cW_t1CCXrUA:10 a=s5jvgZ67dGcA:10 a=IkcTkHD0fZMA:10 a=n5n_aSjo0skA:10 a=NEAV23lmAAAA:8 a=5A-yo6Amt2u7ccTm9TkA:9 a=QEXdDO2ut3YA:10 a=Bn2pgwyD2vrAyMmN8A2t:22 Received: from [173.224.162.79] (port=30134 helo=[192.168.90.221]) by box514.bluehost.com with esmtpsa (TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128) (Exim 4.86_1) (envelope-from ) id 1cGuYq-000702-SW for unbearable@ietf.org; Tue, 13 Dec 2016 14:24:32 -0700 To: IETF TokBind WG References: From: =JeffH Message-ID: <445d4108-6ef4-31cd-7bab-9cc54a29011b@KingsMountain.com> Date: Tue, 13 Dec 2016 13:24:30 -0800 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:45.0) Gecko/20100101 Thunderbird/45.5.1 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - box514.bluehost.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - KingsMountain.com X-BWhitelist: no X-Source-IP: 173.224.162.79 X-Exim-ID: 1cGuYq-000702-SW X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: ([192.168.90.221]) [173.224.162.79]:30134 X-Source-Auth: jeff.hodges+kingsmountain.com X-Email-Count: 2 X-Source-Cap: a2luZ3Ntb3U7a2luZ3Ntb3U7Ym94NTE0LmJsdWVob3N0LmNvbQ== Archived-At: Subject: Re: [Unbearable] HTTPSTB: WGLC: web origin -> eTLD+1 X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 13 Dec 2016 21:24:47 -0000 On 12/13/16 1:07 PM, =JeffH wrote: > https://github.com/TokenBinding/Internet-Drafts/issues/85 > [...] > > ..and note the use of the term "web origin". > > In total, there are 7 occurrences of "origin" or "web origin" in > HTTPSTB. > > I propose to change the occurrences of "web origin" to "eTLD+1". Oops, sent too soon, have updated the issue to read.. I propose to change the occurrences of "web origin" to "eTLD+1" or "server", as appropriate. From nobody Tue Dec 13 18:11:24 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1C8C8129421 for ; Tue, 13 Dec 2016 18:11:22 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com; domainkeys=pass (1024-bit key) header.sender=andreipo=microsoft.com@github.com header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9fyJLE82dAjV for ; Tue, 13 Dec 2016 18:11:19 -0800 (PST) Received: from m71-131.mailgun.net (m71-131.mailgun.net [166.78.71.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A8518129696 for ; Tue, 13 Dec 2016 18:11:19 -0800 (PST) DKIM-Signature: a=rsa-sha256; v=1; c=relaxed/relaxed; d=github.com; q=dns/txt; s=mailo; t=1481681479; h=Content-Transfer-Encoding: Content-Type: Mime-Version: Subject: Message-ID: To: Reply-To: From: Date: Sender; bh=MSNwS60toFU5Qmg+GKekP9NWYLxfm1SMSLUIoHnFLq4=; b=FU3NUutf4e5z6UcovG548YPgMYNYmkbyaZiEH/ON+8oZPM+5W9Tv8ZPqJeeYIurIggVHT8iX DxT7M5AJN44fcCh7q9dIdkzXsW2I1PBJJshfVgk3Z2hoAbVnnq+WFdJhVXoYtPx1tfrAeqAS oZU0asH7bxCylfmnXZK0YrZqX00= DomainKey-Signature: a=rsa-sha1; c=nofws; d=github.com; s=mailo; q=dns; h=Sender: Date: From: Reply-To: To: Message-ID: Subject: Mime-Version: Content-Type: Content-Transfer-Encoding; b=xxYJy8HPAnsVWmXEdYGRDQlaVUodfxWe/jEZpjsbojeEeD2RdXVlsPfMoOTZKF0wYr2IsK jemsnVTNRMc+nxSHv6KI23X+AQEG8j0OFeDEC971OL++3g0rsoH7G8k0qH5fEDNQjHF7yBw2 P1RwLXak9+AlhMqelSlsaGrAMOq+0= Sender: andreipo=microsoft.com@github.com X-Mailgun-Sending-Ip: 166.78.71.131 X-Mailgun-Sid: WyIzMTNlNyIsICJ1bmJlYXJhYmxlQGlldGYub3JnIiwgIjQwZiJd Received: from github.com (Unknown [192.30.252.45]) by mxa.mailgun.org with ESMTP id 5850aa46.7f554cdbcc30-smtp-out-n01; Wed, 14 Dec 2016 02:11:18 -0000 (UTC) Date: Tue, 13 Dec 2016 18:11:18 -0800 From: Andrei Popov To: unbearable@ietf.org Message-ID: <5850aa469e6f2_3dfc3fc20ae4f12c112b2@hookshot-fe3-cp1-prd.iad.github.net.mail> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="--==_mimepart_5850aa469e240_3dfc3fc20ae4f12c111fa"; charset=UTF-8 Content-Transfer-Encoding: 7bit Archived-At: Subject: [Unbearable] [TokenBinding/Internet-Drafts] 8673df: renamed -protocol-11 to -12 X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: Andrei Popov List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 14 Dec 2016 02:11:22 -0000 ----==_mimepart_5850aa469e240_3dfc3fc20ae4f12c111fa Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Branch: refs/heads/master Home: https://github.com/TokenBinding/Internet-Drafts Commit: 8673df6f35fbd5fc4e18eb205c11158bd0bfe499 https://github.com/TokenBinding/Internet-Drafts/commit/8673df6f35fbd5fc4e18eb205c11158bd0bfe499 Author: JeffH Date: 2016-11-29 (Tue, 29 Nov 2016) Changed paths: R draft-ietf-tokbind-protocol-11.xml A draft-ietf-tokbind-protocol-12.xml Log Message: ----------- renamed -protocol-11 to -12 Commit: dd13746546ed64dc4f245aa669722b0973c601dd https://github.com/TokenBinding/Internet-Drafts/commit/dd13746546ed64dc4f245aa669722b0973c601dd Author: JeffH Date: 2016-11-29 (Tue, 29 Nov 2016) Changed paths: M draft-ietf-tokbind-protocol-12.xml Log Message: ----------- edit renego and EKM 1st parag Commit: a4d9b687b2dbd92911307a9bc0907a013a7b1a69 https://github.com/TokenBinding/Internet-Drafts/commit/a4d9b687b2dbd92911307a9bc0907a013a7b1a69 Author: JeffH Date: 2016-12-06 (Tue, 06 Dec 2016) Changed paths: M draft-ietf-tokbind-protocol-12.xml Log Message: ----------- edit renego and EKM 1st & 2nd parag Commit: c91f6c6b76baadf269e686b7ea33bd7142e9b750 https://github.com/TokenBinding/Internet-Drafts/commit/c91f6c6b76baadf269e686b7ea33bd7142e9b750 Author: JeffH Date: 2016-12-06 (Tue, 06 Dec 2016) Changed paths: M draft-ietf-tokbind-protocol-12.xml Log Message: ----------- fixup figure to not overrun right margin Commit: f05fac18d8e308e5a07aa8a1f1204229253f8d04 https://github.com/TokenBinding/Internet-Drafts/commit/f05fac18d8e308e5a07aa8a1f1204229253f8d04 Author: JeffH Date: 2016-12-06 (Tue, 06 Dec 2016) Changed paths: M draft-ietf-tokbind-protocol-12.xml Log Message: ----------- TBPROTO:alphabetize acks Commit: 05a4a958628bb766b0016efdb72fad365bfe22ab https://github.com/TokenBinding/Internet-Drafts/commit/05a4a958628bb766b0016efdb72fad365bfe22ab Author: JeffH Date: 2016-12-06 (Tue, 06 Dec 2016) Changed paths: R draft-ietf-tokbind-https-07.xml A draft-ietf-tokbind-https-08.xml Log Message: ----------- initiate HTTPSTB -08 Commit: a47ccca86cde07bb2b72338f4f0375c094aee018 https://github.com/TokenBinding/Internet-Drafts/commit/a47ccca86cde07bb2b72338f4f0375c094aee018 Author: JeffH Date: 2016-12-06 (Tue, 06 Dec 2016) Changed paths: M draft-ietf-tokbind-https-08.xml M draft-ietf-tokbind-protocol-12.xml Log Message: ----------- init HTTPSTB -08 and minor edit in TBPROTO Commit: 10b1f2d2091000e73f7872da8e639b33e8c545c5 https://github.com/TokenBinding/Internet-Drafts/commit/10b1f2d2091000e73f7872da8e639b33e8c545c5 Author: JeffH Date: 2016-12-06 (Tue, 06 Dec 2016) Changed paths: M draft-ietf-tokbind-https-08.xml Log Message: ----------- add explanation of splitting across renego boundaries Commit: b69ce3843620bd7f30e1af6a7ceac604dd142314 https://github.com/TokenBinding/Internet-Drafts/commit/b69ce3843620bd7f30e1af6a7ceac604dd142314 Author: JeffH Date: 2016-12-06 (Tue, 06 Dec 2016) Changed paths: M draft-ietf-tokbind-https-08.xml Log Message: ----------- comment out unused &RFC6750; ref Commit: 717450776b1a09864b5dd955a0f3a390016e25dd https://github.com/TokenBinding/Internet-Drafts/commit/717450776b1a09864b5dd955a0f3a390016e25dd Author: JeffH Date: 2016-12-06 (Tue, 06 Dec 2016) Changed paths: M draft-ietf-tokbind-protocol-12.xml Log Message: ----------- minor edits Commit: b3acdc272bcbff22f7f7398f6d86fae42224a8ea https://github.com/TokenBinding/Internet-Drafts/commit/b3acdc272bcbff22f7f7398f6d86fae42224a8ea Author: JeffH Date: 2016-12-06 (Tue, 06 Dec 2016) Changed paths: M draft-ietf-tokbind-https-08.xml Log Message: ----------- alphabetize acks Commit: 4aed8333cac9100849eef07be51fffd7d99b99e3 https://github.com/TokenBinding/Internet-Drafts/commit/4aed8333cac9100849eef07be51fffd7d99b99e3 Author: JeffH Date: 2016-12-06 (Tue, 06 Dec 2016) Changed paths: M draft-ietf-tokbind-protocol-12.xml Log Message: ----------- may->MAY thx @martinthomson Commit: 2363454cd79f82bee42c6fd403dc8f3ba0c77b2a https://github.com/TokenBinding/Internet-Drafts/commit/2363454cd79f82bee42c6fd403dc8f3ba0c77b2a Author: JeffH Date: 2016-12-06 (Tue, 06 Dec 2016) Changed paths: M draft-ietf-tokbind-protocol-12.xml Log Message: ----------- applying further polish, thx @martinthomson, @andrei-popov, @nharper Commit: 6dcb8e9b21398eec9ea07bf140e07a478d4b0b76 https://github.com/TokenBinding/Internet-Drafts/commit/6dcb8e9b21398eec9ea07bf140e07a478d4b0b76 Author: Andrei Popov Date: 2016-12-13 (Tue, 13 Dec 2016) Changed paths: R draft-ietf-tokbind-https-07.xml A draft-ietf-tokbind-https-08.xml R draft-ietf-tokbind-protocol-11.xml A draft-ietf-tokbind-protocol-12.xml Log Message: ----------- Merge branch 'equalsJeffH-TBPROTO-HTTPSTB-renego-edits' Commit: 43e6d1f78f1452b1193ebc02ddc33da314f60d99 https://github.com/TokenBinding/Internet-Drafts/commit/43e6d1f78f1452b1193ebc02ddc33da314f60d99 Author: Andrei Popov Date: 2016-12-13 (Tue, 13 Dec 2016) Changed paths: M README.md M draft-ietf-tokbind-https-08.xml M draft-ietf-tokbind-protocol-12.xml Log Message: ----------- Merging PR #83 Compare: https://github.com/TokenBinding/Internet-Drafts/compare/3648bf1cfc50...43e6d1f78f14 ----==_mimepart_5850aa469e240_3dfc3fc20ae4f12c111fa-- From nobody Tue Dec 13 18:19:02 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8B33D1294B3 for ; Tue, 13 Dec 2016 18:19:00 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.003 X-Spam-Level: X-Spam-Status: No, score=-2.003 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vx3KJnQL8qpM for ; Tue, 13 Dec 2016 18:18:57 -0800 (PST) Received: from NAM01-BN3-obe.outbound.protection.outlook.com (mail-bn3nam01on0105.outbound.protection.outlook.com [104.47.33.105]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5F0DF129420 for ; Tue, 13 Dec 2016 18:18:57 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=XOEMDnG+wNhewoHKC1FXv34zAiIPma1cAyt6n1N8HVU=; b=JsPPWEeCviqcukLd2aIzdNM2TSmvKWq/Xeq0A0bZzWi+qgFQQSAkzK3kJX1zYmhE2ZEuQE1CkkxyAvjfonzmJqQWp/RZT7d7KQakUlHV8tiNLHScKWOLKztsKx8Z4q3xtca5aLjOPkX62wHqEGFwfBLSGnJKcQXGlUK3G4z+fnc= Received: from CY1PR0301MB0842.namprd03.prod.outlook.com (10.160.163.148) by CY1PR0301MB0844.namprd03.prod.outlook.com (10.160.163.150) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.771.8; Wed, 14 Dec 2016 02:18:55 +0000 Received: from CY1PR0301MB0842.namprd03.prod.outlook.com ([10.160.163.148]) by CY1PR0301MB0842.namprd03.prod.outlook.com ([10.160.163.148]) with mapi id 15.01.0771.014; Wed, 14 Dec 2016 02:18:55 +0000 From: Andrei Popov To: =JeffH , IETF TokBind WG Thread-Topic: [Unbearable] PR#83: TBPROTO: HTTPSTB: renego polishing Thread-Index: AQHSUA75Lxiq61f8T0CAnBsrlcybeKD7hEQwgAs8QFA= Date: Wed, 14 Dec 2016 02:18:55 +0000 Message-ID: References: <1fdac9be-16e4-158b-3c14-ec298aca36b3@KingsMountain.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Andrei.Popov@microsoft.com; x-originating-ip: [2001:4898:80e8:8::1d2] x-ms-office365-filtering-correlation-id: b7412e44-4281-4f86-30d3-08d423c78e10 x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001); SRVR:CY1PR0301MB0844; x-microsoft-exchange-diagnostics: 1; CY1PR0301MB0844; 7:0utg0fEBUXGrIvl7olfZI3ncEL/aXbktqTkcp4htW787DgB7M0qoRoM5tvdSEW10HgKLY2pL60T+q/bA4JozdHrT7UVSBFQNEyb8larXvWt0h8rs/3BMFGXHxPt/QnS2sBeHMDdBTqOR+Hzg31Ook5RIvta+vvBqCYKRL4svc3yKZjjhdU4J/7Y49jpmlgsXJtRb3Fz6eDy0sIXznFOVJ7nBLN59aAcZIEH2zN0syZ6/XzHfIvDPHXIPTDYpe3fAzMQxbyiz7C1A6pc2diIpv/bw0Yx+8Y1mApAfNDeSp16sh2h5Dk2mrBPw8pf5g1Rm5zJIIipexx7RKTlYlBZ34myK6H58z0Ew29FMnXFSTKUd5iZQTeyNynormyBbRT4oiSLvDMAxh7p7e1fQjKpqwHLI9Rmat0cM2qXrYoPzS+d2EO1cABd7+jb7A0yVUYeiwSBpPlT3Oj2joRlNAuQMjvo7MhnucjLQj4cQR1dKyBE= x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(166708455590820); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040375)(601004)(2401047)(5005006)(8121501046)(3002001)(10201501046)(6055026)(61426038)(61427038)(6041248)(20161123555025)(20161123560025)(20161123562025)(20161123564025)(6042181)(6072148)(6047074); SRVR:CY1PR0301MB0844; BCL:0; PCL:0; RULEID:; SRVR:CY1PR0301MB0844; x-forefront-prvs: 01565FED4C x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(6009001)(7916002)(377454003)(189002)(199003)(13464003)(50986999)(76176999)(38730400001)(54356999)(6506006)(3660700001)(102836003)(3900700001)(77096006)(6116002)(2900100001)(3280700002)(189998001)(10090500001)(92566002)(8936002)(9686002)(107886002)(101416001)(68736007)(33656002)(97736004)(10290500002)(229853002)(5005710100001)(5001770100001)(8676002)(5660300001)(81156014)(81166006)(8990500004)(76576001)(74316002)(106116001)(2906002)(106356001)(99286002)(305945005)(6436002)(122556002)(7696004)(86362001)(105586002)(7736002)(86612001); DIR:OUT; SFP:1102; SCL:1; SRVR:CY1PR0301MB0844; H:CY1PR0301MB0842.namprd03.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:1; LANG:en; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 14 Dec 2016 02:18:55.1739 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY1PR0301MB0844 Archived-At: Subject: Re: [Unbearable] PR#83: TBPROTO: HTTPSTB: renego polishing X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 14 Dec 2016 02:19:00 -0000 Merged on GitHub. Will look at PR #84 tomorrow. Thanks, Andrei -----Original Message----- From: Andrei Popov=20 Sent: Tuesday, December 6, 2016 2:45 PM To: '=3DJeffH' ; IETF TokBind WG Subject: RE: [Unbearable] PR#83: TBPROTO: HTTPSTB: renego polishing At a glance, looks good to me; will merge in the next revision of the docs. Thanks, Andrei -----Original Message----- From: Unbearable [mailto:unbearable-bounces@ietf.org] On Behalf Of =3DJeffH Sent: Tuesday, December 6, 2016 2:20 PM To: IETF TokBind WG Subject: [Unbearable] PR#83: TBPROTO: HTTPSTB: renego polishing TBPROTO: HTTPSTB: renego polishing https://github.com/TokenBinding/Internet-Drafts/pull/83 this PR encompases some modest polishing of the recently-added TLS renegoti= ation language in TBPROTO & HTTPSTB, and clarification of the splitting of = TBM across renego boundaries, plus some other minor editorial cleanups. _______________________________________________ Unbearable mailing list Unbearable@ietf.org https://www.ietf.org/mailman/listinfo/unbearable From nobody Wed Dec 14 02:01:53 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 71ACD1299F7 for ; Wed, 14 Dec 2016 02:01:51 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.821 X-Spam-Level: X-Spam-Status: No, score=-1.821 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_NEUTRAL=0.779] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=sunet-se.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id k-zc8NQRPOXV for ; Wed, 14 Dec 2016 02:01:48 -0800 (PST) Received: from mail-qt0-x229.google.com (mail-qt0-x229.google.com [IPv6:2607:f8b0:400d:c0d::229]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 74EB712958D for ; Wed, 14 Dec 2016 02:01:44 -0800 (PST) Received: by mail-qt0-x229.google.com with SMTP id n6so13608154qtd.1 for ; Wed, 14 Dec 2016 02:01:44 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sunet-se.20150623.gappssmtp.com; s=20150623; h=subject:references:to:from:message-id:date:user-agent:mime-version :in-reply-to:content-transfer-encoding; bh=Or9iV3wAXQdLR85clHt0jB6GkZI49b5WMeNezS9CpbA=; b=UTMQIyodcNwTIXQEqUHVtQYlvM77sVL7gWft2EY/rqp5ahx28Bz2oBh5l6V9yGQeDZ +N3We1oyljZjL5xN+lTVJi3gIASJjWR5NdcTKqmbS0q5siRyOYcpsHGoJCopcUjq95l+ oLcxqu+5BBlF0T95E2BM53CTOUCFG0t+jJc7Q+GJjAYoqVhJ3K65k7EwAvO6Iq8c53EI 4G52JZrKkBaE0+8psewb18I9slkmz60ZrQnMSgZUHnSy5Gw4bbRqPEk9adLv/2TNj/PY 0/PJ9JCqaK1hQx4lcdZftPTB2n6VVoq6L7pwi9DKhTeKvvkYTqzF5J4PPPflrVH6Z+O/ tUlw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:references:to:from:message-id:date :user-agent:mime-version:in-reply-to:content-transfer-encoding; bh=Or9iV3wAXQdLR85clHt0jB6GkZI49b5WMeNezS9CpbA=; b=frhBzspnCtkX6n0hepLP1lDPZkx9Sy9xFOrHocSuK6HiYzqxaHYKbmkRkyX3ElDHz5 bCXH2Apexzy8Pmuv9ecFpOvTIBh70g9mjy7uJF60vuWV1pUc+TWqtFmKI9QM5vHkybdk UncA7ITJXLdi7n7r4XNhqI65BfaVkZ5qN4DUSKgPh5KVozzg8UNYMRr9YGmHMlDDI+kr 1L7S0XyQlufJIt2pGXNEx4WyzHGEYnj+WIxiEf/+3vNku8J94l/j+oqiwqFGNS8WTZyA fh23Kz47Nv4qQpB4R/u96MIrKa7S42veUSnI/Ri+EdZSDcn+84oyaW6JQ70pLbNM/FMo SXEQ== X-Gm-Message-State: AKaTC01pDovUaVCBtGLqh64XYtAst2bLtmsivwiAyi0cE5VYfCbCNxXwd1mUtz6oqyS36w== X-Received: by 10.46.77.9 with SMTP id a9mr44670990ljb.25.1481709703802; Wed, 14 Dec 2016 02:01:43 -0800 (PST) Received: from ?IPv6:2001:700:1:111:6c82:5e87:19e4:f8c4? ([2001:700:1:111:6c82:5e87:19e4:f8c4]) by smtp.gmail.com with ESMTPSA id 1sm1925429ljo.16.2016.12.14.02.01.42 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 14 Dec 2016 02:01:42 -0800 (PST) References: <7BF64F8A-94EF-400A-87D8-545286EB81C0@iana.org> To: unbearable@ietf.org From: Leif Johansson X-Forwarded-Message-Id: <7BF64F8A-94EF-400A-87D8-545286EB81C0@iana.org> Message-ID: Date: Wed, 14 Dec 2016 11:01:42 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.5.1 MIME-Version: 1.0 In-Reply-To: <7BF64F8A-94EF-400A-87D8-545286EB81C0@iana.org> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit Archived-At: Subject: [Unbearable] Fwd: Upcoming Parameter Expiration: Early IANA Allocation for draft-ietf-tokbind-negotiation X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 14 Dec 2016 10:01:51 -0000 I assume we want to extend the early IANA allocation? Feel free to tell me or John if there is any reason not to as for an extension. Cheers Leif -------- Forwarded Message -------- Subject: Upcoming Parameter Expiration: Early IANA Allocation for draft-ietf-tokbind-negotiation Resent-Date: Tue, 13 Dec 2016 23:28:36 -0800 (PST) Resent-From: alias-bounces@ietf.org Resent-To: andreipo@microsoft.com, mnystrom@microsoft.com, balfanz@google.com, agl@google.com, ve7jtb@ve7jtb.com, leifj@sunet.se, Kathleen.Moriarty.ietf@gmail.com, stephen.farrell@cs.tcd.ie Date: Wed, 14 Dec 2016 07:28:32 +0000 From: Amanda Baber To: draft-ietf-tokbind-negotiation.all@ietf.org CC: Michelle Cotton Dear Authors/Chairs/ADs: The following registration made on behalf of draft-ietf-tokbind-negotiation is set to expire on 2017-02-04: Registry: ExtensionType Values URL: http://www.iana.org/assignments/tls-extensiontype-values Assignment: 24 token_binding (TEMPORARY - registered 2016-02-04, expires 2017-02-04) [draft-ietf-tokbind-negotiation] If the document won’t be approved by the IESG before 2017-02-04, it is possible to request that this allocation be renewed for one more year. If the chairs believe that the RFC 7120 requirements for early allocation have been met, and the AD concurs, we can update the registry now to move the expiration date forward to 2018-02-04. Please let us know whether you want to renew or let the allocation expire. Please see RFC 7120, and particularly Section 3.3, for rules concerning the renewal of early allocations: http://www.rfc-editor.org/rfc/rfc7120.txt Please note that a second renewal (from 2018 until 2019) would require permission from the IESG. Best regards, Amanda Baber Lead IANA Services Specialist PTI From nobody Wed Dec 14 10:11:14 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0CB4E129422 for ; Wed, 14 Dec 2016 10:11:13 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.022 X-Spam-Level: X-Spam-Status: No, score=-2.022 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mMluz_U91qkU for ; Wed, 14 Dec 2016 10:11:11 -0800 (PST) Received: from NAM01-SN1-obe.outbound.protection.outlook.com (mail-sn1nam01on0105.outbound.protection.outlook.com [104.47.32.105]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EACA0129415 for ; Wed, 14 Dec 2016 10:11:10 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=EHk3n1Yr54r2NKlwosPZzCGtDwN3DU0je2yRpIbibsk=; b=C0+gIo7Tx1D2mRLYvPNFph59S7wqfoycY4D4m+piAvnvv7w/w4ACKrDfZkEpltuXbi2jx53AMfQj85ZefQEWehLuxMaJTq5jbQWQQOOMf+7e2n3jSAqfb81iTgyxTmYcm64UMJzxWyyS37uQ1LNvmZL53El8gqa70a3AfhSmSak= Received: from CY1PR0301MB0842.namprd03.prod.outlook.com (10.160.163.148) by CY1PR0301MB0841.namprd03.prod.outlook.com (10.160.163.147) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.771.8; Wed, 14 Dec 2016 18:11:08 +0000 Received: from CY1PR0301MB0842.namprd03.prod.outlook.com ([10.160.163.148]) by CY1PR0301MB0842.namprd03.prod.outlook.com ([10.160.163.148]) with mapi id 15.01.0771.014; Wed, 14 Dec 2016 18:11:08 +0000 From: Andrei Popov To: Leif Johansson , "unbearable@ietf.org" Thread-Topic: [Unbearable] Fwd: Upcoming Parameter Expiration: Early IANA Allocation for draft-ietf-tokbind-negotiation Thread-Index: AQHSVdusuk0nN4sNyUawYw3hbiolyqEHNmwAgACIW1A= Date: Wed, 14 Dec 2016 18:11:08 +0000 Message-ID: References: <7BF64F8A-94EF-400A-87D8-545286EB81C0@iana.org> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Andrei.Popov@microsoft.com; x-originating-ip: [131.107.159.203] x-ms-office365-filtering-correlation-id: b9fa1d4f-c54e-4530-8716-08d4244c93e5 x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001); SRVR:CY1PR0301MB0841; x-microsoft-exchange-diagnostics: 1; CY1PR0301MB0841; 7:1pW/yB2/tQVLINiFI/kDmlOVgDec4VrtaVVods9LxIX0cwsHzdi0Ov378Tx2dKuXUpRxjwS3dEe01zRi2OAl3UEVFiWG/no8kvsSCC1qBbcpJPZ514xy48kiq/XXB6GCjKH+ME4US8IntBr5XM0yF92XVa5tbxyJw876TpohZEs58FkocOQSH6hTRdmyeHTIvCq9Z0hqOSe4q4+GdXd0IJvhI2ggu+AZA4m0PYSJJasbFxYRPzHe8RyAjk6Gf2vijCqt6Rsrjb2CbRDebNjM0yRi9AtL+4vbd+UeX5kOwrs+STc/qKPMpHioXEsftQY3cRK4X0/Jj1LhEuo3cRsPinn2Pp9o31fND9J+mjGLTCcXO1gQMv4NtMyjimRH/kyzeoYTk9g5mT/ZXqIj7NeSD5bABz2GHLqIB0tY/aTy1JSVzJq9qemkfVl2bxLEwV0r/9HwVaTkQxxYcss99mUegV8pKIk5J71LsL56+751T5Q= x-o365ent-eop-header: Message processed by - O365_ENT: Allow from ranges (Engineering ONLY) x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(32856632585715)(211936372134217)(69029272430364)(1591387915157); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040375)(601004)(2401047)(5005006)(8121501046)(3002001)(10201501046)(6055026)(61426038)(61427038)(6041248)(20161123555025)(20161123560025)(20161123562025)(20161123564025)(6042181)(6072148)(6047074); SRVR:CY1PR0301MB0841; BCL:0; PCL:0; RULEID:; SRVR:CY1PR0301MB0841; x-forefront-prvs: 01565FED4C x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(6009001)(7916002)(13464003)(377454003)(377424004)(189002)(199003)(7736002)(66066001)(230783001)(3846002)(6116002)(102836003)(1720100001)(6436002)(77096006)(6506006)(86362001)(8936002)(25786008)(8676002)(38730400001)(2501003)(68736007)(81166006)(3280700002)(9686002)(86612001)(3660700001)(229853002)(105586002)(99286002)(92566002)(101416001)(2950100002)(189998001)(5001770100001)(97736004)(107886002)(54356999)(76176999)(2900100001)(106116001)(106356001)(50986999)(74316002)(305945005)(122556002)(2906002)(33656002)(7696004)(76576001)(8990500004)(10290500002)(5005710100001)(81156014)(5660300001)(10090500001)(562404015); DIR:OUT; SFP:1102; SCL:1; SRVR:CY1PR0301MB0841; H:CY1PR0301MB0842.namprd03.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:1; LANG:en; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 14 Dec 2016 18:11:08.1568 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY1PR0301MB0841 Archived-At: Subject: Re: [Unbearable] Fwd: Upcoming Parameter Expiration: Early IANA Allocation for draft-ietf-tokbind-negotiation X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 14 Dec 2016 18:11:13 -0000 SSBob3BlIHdlJ2xsIGJlIGRvbmUgYnkgMjAxNy0wMi0wNDsgaGF2aW5nIHNhaWQgdGhhdCwgaXQg c2VlbXMgc2FmZXIgdG8gZXh0ZW5kLCBqdXN0IGluIGNhc2UuLi4NCg0KQ2hlZXJzLA0KDQpBbmRy ZWkNCg0KLS0tLS1PcmlnaW5hbCBNZXNzYWdlLS0tLS0NCkZyb206IFVuYmVhcmFibGUgW21haWx0 bzp1bmJlYXJhYmxlLWJvdW5jZXNAaWV0Zi5vcmddIE9uIEJlaGFsZiBPZiBMZWlmIEpvaGFuc3Nv bg0KU2VudDogV2VkbmVzZGF5LCBEZWNlbWJlciAxNCwgMjAxNiAyOjAyIEFNDQpUbzogdW5iZWFy YWJsZUBpZXRmLm9yZw0KU3ViamVjdDogW1VuYmVhcmFibGVdIEZ3ZDogVXBjb21pbmcgUGFyYW1l dGVyIEV4cGlyYXRpb246IEVhcmx5IElBTkEgQWxsb2NhdGlvbiBmb3IgZHJhZnQtaWV0Zi10b2ti aW5kLW5lZ290aWF0aW9uDQoNCg0KSSBhc3N1bWUgd2Ugd2FudCB0byBleHRlbmQgdGhlIGVhcmx5 IElBTkEgYWxsb2NhdGlvbj8gRmVlbCBmcmVlIHRvIHRlbGwgbWUgb3IgSm9obiBpZiB0aGVyZSBp cyBhbnkgcmVhc29uIG5vdCB0byBhcyBmb3IgYW4gZXh0ZW5zaW9uLg0KDQoJQ2hlZXJzIExlaWYN Cg0KDQotLS0tLS0tLSBGb3J3YXJkZWQgTWVzc2FnZSAtLS0tLS0tLQ0KU3ViamVjdDogVXBjb21p bmcgUGFyYW1ldGVyIEV4cGlyYXRpb246IEVhcmx5IElBTkEgQWxsb2NhdGlvbiBmb3IgZHJhZnQt aWV0Zi10b2tiaW5kLW5lZ290aWF0aW9uDQpSZXNlbnQtRGF0ZTogVHVlLCAxMyBEZWMgMjAxNiAy MzoyODozNiAtMDgwMCAoUFNUKQ0KUmVzZW50LUZyb206IGFsaWFzLWJvdW5jZXNAaWV0Zi5vcmcN ClJlc2VudC1UbzogYW5kcmVpcG9AbWljcm9zb2Z0LmNvbSwgbW55c3Ryb21AbWljcm9zb2Z0LmNv bSwgYmFsZmFuekBnb29nbGUuY29tLCBhZ2xAZ29vZ2xlLmNvbSwgdmU3anRiQHZlN2p0Yi5jb20s IGxlaWZqQHN1bmV0LnNlLCBLYXRobGVlbi5Nb3JpYXJ0eS5pZXRmQGdtYWlsLmNvbSwgc3RlcGhl bi5mYXJyZWxsQGNzLnRjZC5pZQ0KRGF0ZTogV2VkLCAxNCBEZWMgMjAxNiAwNzoyODozMiArMDAw MA0KRnJvbTogQW1hbmRhIEJhYmVyIDxhbWFuZGEuYmFiZXJAaWFuYS5vcmc+DQpUbzogZHJhZnQt aWV0Zi10b2tiaW5kLW5lZ290aWF0aW9uLmFsbEBpZXRmLm9yZw0KPGRyYWZ0LWlldGYtdG9rYmlu ZC1uZWdvdGlhdGlvbi5hbGxAaWV0Zi5vcmc+DQpDQzogTWljaGVsbGUgQ290dG9uIDxtaWNoZWxs ZS5jb3R0b25AaWFuYS5vcmc+DQoNCkRlYXIgQXV0aG9ycy9DaGFpcnMvQURzOg0KIFRoZSBmb2xs b3dpbmcgcmVnaXN0cmF0aW9uIG1hZGUgb24gYmVoYWxmIG9mIGRyYWZ0LWlldGYtdG9rYmluZC1u ZWdvdGlhdGlvbiBpcyBzZXQgdG8gZXhwaXJlIG9uIDIwMTctMDItMDQ6DQogUmVnaXN0cnk6IEV4 dGVuc2lvblR5cGUgVmFsdWVzDQpVUkw6IGh0dHA6Ly93d3cuaWFuYS5vcmcvYXNzaWdubWVudHMv dGxzLWV4dGVuc2lvbnR5cGUtdmFsdWVzDQpBc3NpZ25tZW50OiAyNCAgdG9rZW5fYmluZGluZyAo VEVNUE9SQVJZIC0gcmVnaXN0ZXJlZCAyMDE2LTAyLTA0LCBleHBpcmVzIDIwMTctMDItMDQpICBb ZHJhZnQtaWV0Zi10b2tiaW5kLW5lZ290aWF0aW9uXSBJZiB0aGUgZG9jdW1lbnQgd29u4oCZdCBi ZSBhcHByb3ZlZCBieSB0aGUgSUVTRyBiZWZvcmUgMjAxNy0wMi0wNCwgaXQgaXMgcG9zc2libGUg dG8gcmVxdWVzdCB0aGF0IHRoaXMgYWxsb2NhdGlvbiBiZSByZW5ld2VkIGZvciBvbmUgbW9yZSB5 ZWFyLg0KSWYgdGhlIGNoYWlycyBiZWxpZXZlIHRoYXQgdGhlIFJGQyA3MTIwIHJlcXVpcmVtZW50 cyBmb3IgZWFybHkgYWxsb2NhdGlvbiBoYXZlIGJlZW4gbWV0LCBhbmQgdGhlIEFEIGNvbmN1cnMs IHdlIGNhbiB1cGRhdGUgdGhlIHJlZ2lzdHJ5IG5vdyB0byBtb3ZlIHRoZSBleHBpcmF0aW9uIGRh dGUgZm9yd2FyZCB0byAyMDE4LTAyLTA0LiBQbGVhc2UgbGV0IHVzIGtub3cgd2hldGhlciB5b3Ug d2FudCB0byByZW5ldyBvciBsZXQgdGhlIGFsbG9jYXRpb24gZXhwaXJlLg0KDQpQbGVhc2Ugc2Vl IFJGQyA3MTIwLCBhbmQgcGFydGljdWxhcmx5IFNlY3Rpb24gMy4zLCBmb3IgcnVsZXMgY29uY2Vy bmluZyB0aGUgcmVuZXdhbCBvZiBlYXJseSBhbGxvY2F0aW9uczoNCiBodHRwOi8vd3d3LnJmYy1l ZGl0b3Iub3JnL3JmYy9yZmM3MTIwLnR4dA0KDQpQbGVhc2Ugbm90ZSB0aGF0IGEgc2Vjb25kIHJl bmV3YWwgKGZyb20gMjAxOCB1bnRpbCAyMDE5KSB3b3VsZCByZXF1aXJlIHBlcm1pc3Npb24gZnJv bSB0aGUgSUVTRy4NCiBCZXN0IHJlZ2FyZHMsDQogQW1hbmRhIEJhYmVyDQpMZWFkIElBTkEgU2Vy dmljZXMgU3BlY2lhbGlzdA0KUFRJDQoNCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fDQpVbmJlYXJhYmxlIG1haWxpbmcgbGlzdA0KVW5iZWFyYWJsZUBpZXRm Lm9yZw0KaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby91bmJlYXJhYmxlDQo= From nobody Wed Dec 14 10:16:25 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C9A0E129678 for ; Wed, 14 Dec 2016 10:16:23 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=ve7jtb-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id moOwiPp-zEte for ; Wed, 14 Dec 2016 10:16:21 -0800 (PST) Received: from mail-it0-x234.google.com (mail-it0-x234.google.com [IPv6:2607:f8b0:4001:c0b::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5BD171297F0 for ; Wed, 14 Dec 2016 10:16:20 -0800 (PST) Received: by mail-it0-x234.google.com with SMTP id j191so7597109ita.1 for ; Wed, 14 Dec 2016 10:16:20 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ve7jtb-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=b6+fD4inSwgE5VnGLQEBlqW12LtX1tu8euVAjAEQcX8=; b=HOHJw+7rRb1avnHP6d1kmm9rf4FPpviitd9IglbWRXINXxZcTyoaQKnOvsLhLipo1G l6PBaGzbZE75fPkeB03K4LN06gx3EXKMXk+fvqnb7V1KAoxXTgUDJt34Y+2Jg5xi2LHq 7rEgDA0JsYvp0KbiSYfeTG9tI5h2fop2IhdCE+tmcBl4SoVgTh+s2sief3WZZWGMKZM1 pMVHFHHS19s6+fO8YA9/dDnQX7mnwxGrl116vh8tr/tp5D+3DOkJtzBBVtSIIqU2KG5A e1rZ5zDsHiPF9H8OQIbvE46T3sd8pMQW4UU8aBcL8TpPERhAysGfB6Gzmyg4vWo1EnmJ IOEA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=b6+fD4inSwgE5VnGLQEBlqW12LtX1tu8euVAjAEQcX8=; b=VIqGN4PLzZp8qsHDZARPWPSBwj22eufXrT0NY8au3CGACdKRI6VX6QsS1Fwl2/RPOJ iy2EK1Jow7Lkp7FCQQdFpAgM8EckpbC9q7KKsx53tKMwaeF0NpApk+fdNSGbZdJLQWLB tsnpGKrmIxqUb9+rqMfJum22LntSkJV9/tZWPnU60Lx+FmJtB7PYoSa/0+aR1NbKFvGl HFUgdt575oH4nvVh73djQoyhLzgRDPVGnds5TRrcUgZMpPHae78dct1U3EcK0U2apuNJ woS7z6Ja8nL2B4UyaJ6Sb6TGcftOGERyU7Mk4IaqCYAZ7tsIodLd/gTecoIXFxatab0m b7fg== X-Gm-Message-State: AKaTC039mlGl8UPshrJiQilPnqbvB7uIAUdviWp4gBxiNa9QaR401+UuMCW63WLUZOFFrsR4x0ll6o464zTjvZPC X-Received: by 10.36.138.67 with SMTP id v64mr8452702itd.39.1481739380166; Wed, 14 Dec 2016 10:16:20 -0800 (PST) MIME-Version: 1.0 Received: by 10.79.38.65 with HTTP; Wed, 14 Dec 2016 10:16:19 -0800 (PST) X-Originating-IP: [172.56.12.234] Received: by 10.79.38.65 with HTTP; Wed, 14 Dec 2016 10:16:19 -0800 (PST) In-Reply-To: References: <7BF64F8A-94EF-400A-87D8-545286EB81C0@iana.org> From: John Bradley Date: Wed, 14 Dec 2016 15:16:19 -0300 Message-ID: To: Andrei Popov Content-Type: multipart/alternative; boundary=94eb2c08eab867d9fc0543a25580 Archived-At: Cc: unbearable@ietf.org, Leif Johansson Subject: Re: [Unbearable] Fwd: Upcoming Parameter Expiration: Early IANA Allocation for draft-ietf-tokbind-negotiation X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 14 Dec 2016 18:16:24 -0000 --94eb2c08eab867d9fc0543a25580 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable We should ask for an extension. Just in case we wind up spending some time enjoying a dialog with the IESG . On Dec 14, 2016 15:11, "Andrei Popov" wrote: > I hope we'll be done by 2017-02-04; having said that, it seems safer to > extend, just in case... > > Cheers, > > Andrei > > -----Original Message----- > From: Unbearable [mailto:unbearable-bounces@ietf.org] On Behalf Of Leif > Johansson > Sent: Wednesday, December 14, 2016 2:02 AM > To: unbearable@ietf.org > Subject: [Unbearable] Fwd: Upcoming Parameter Expiration: Early IANA > Allocation for draft-ietf-tokbind-negotiation > > > I assume we want to extend the early IANA allocation? Feel free to tell m= e > or John if there is any reason not to as for an extension. > > Cheers Leif > > > -------- Forwarded Message -------- > Subject: Upcoming Parameter Expiration: Early IANA Allocation for > draft-ietf-tokbind-negotiation > Resent-Date: Tue, 13 Dec 2016 23:28:36 -0800 (PST) > Resent-From: alias-bounces@ietf.org > Resent-To: andreipo@microsoft.com, mnystrom@microsoft.com, > balfanz@google.com, agl@google.com, ve7jtb@ve7jtb.com, leifj@sunet.se, > Kathleen.Moriarty.ietf@gmail.com, stephen.farrell@cs.tcd.ie > Date: Wed, 14 Dec 2016 07:28:32 +0000 > From: Amanda Baber > To: draft-ietf-tokbind-negotiation.all@ietf.org > > CC: Michelle Cotton > > Dear Authors/Chairs/ADs: > The following registration made on behalf of > draft-ietf-tokbind-negotiation is set to expire on 2017-02-04: > Registry: ExtensionType Values > URL: http://www.iana.org/assignments/tls-extensiontype-values > Assignment: 24 token_binding (TEMPORARY - registered 2016-02-04, expires > 2017-02-04) [draft-ietf-tokbind-negotiation] If the document won=E2=80= =99t be > approved by the IESG before 2017-02-04, it is possible to request that th= is > allocation be renewed for one more year. > If the chairs believe that the RFC 7120 requirements for early allocation > have been met, and the AD concurs, we can update the registry now to move > the expiration date forward to 2018-02-04. Please let us know whether you > want to renew or let the allocation expire. > > Please see RFC 7120, and particularly Section 3.3, for rules concerning > the renewal of early allocations: > http://www.rfc-editor.org/rfc/rfc7120.txt > > Please note that a second renewal (from 2018 until 2019) would require > permission from the IESG. > Best regards, > Amanda Baber > Lead IANA Services Specialist > PTI > > _______________________________________________ > Unbearable mailing list > Unbearable@ietf.org > https://www.ietf.org/mailman/listinfo/unbearable > _______________________________________________ > Unbearable mailing list > Unbearable@ietf.org > https://www.ietf.org/mailman/listinfo/unbearable > --94eb2c08eab867d9fc0543a25580 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
We should ask for an extension.=C2=A0 Just in case we win= d up spending some time enjoying a dialog with the IESG .

On Dec 14, 2016 15:11, &quo= t;Andrei Popov" <Andr= ei.Popov@microsoft.com> wrote:
I hope we'll be done by 2017-02-04; having said that,= it seems safer to extend, just in case...

Cheers,

Andrei

-----Original Message-----
From: Unbearable [mailto:unb= earable-bounces@ietf.org] On Behalf Of Leif Johansson
Sent: Wednesday, December 14, 2016 2:02 AM
To: unbearable@ietf.org
Subject: [Unbearable] Fwd: Upcoming Parameter Expiration: Early IANA Alloca= tion for draft-ietf-tokbind-negotiation


I assume we want to extend the early IANA allocation? Feel free to tell me = or John if there is any reason not to as for an extension.

=C2=A0 =C2=A0 =C2=A0 =C2=A0 Cheers Leif


-------- Forwarded Message --------
Subject: Upcoming Parameter Expiration: Early IANA Allocation for draft-iet= f-tokbind-negotiation
Resent-Date: Tue, 13 Dec 2016 23:28:36 -0800 (PST)
Resent-From: alias-bounces@ietf.o= rg
Resent-To: andreipo@microsoft.com= , mnystrom@microsoft.com,= balfanz@google.com, agl@google.com, ve7jtb@ve7jtb.com, leifj@sunet.se= , Kathleen.Moriarty= .ietf@gmail.com, step= hen.farrell@cs.tcd.ie
Date: Wed, 14 Dec 2016 07:28:32 +0000
From: Amanda Baber <amanda.babe= r@iana.org>
To: draft-ie= tf-tokbind-negotiation.all@ietf.org
<draft-ie= tf-tokbind-negotiation.all@ietf.org>
CC: Michelle Cotton <michell= e.cotton@iana.org>

Dear Authors/Chairs/ADs:
=C2=A0The following registration made on behalf of draft-ietf-tokbind-negot= iation is set to expire on 2017-02-04:
=C2=A0Registry: ExtensionType Values
URL: http://www.iana.org/assignments/tl= s-extensiontype-values
Assignment: 24=C2=A0 token_binding (TEMPORARY - registered 2016-02-04, expi= res 2017-02-04)=C2=A0 [draft-ietf-tokbind-negotiation] If the document= won=E2=80=99t be approved by the IESG before 2017-02-04, it is possible to= request that this allocation be renewed for one more year.
If the chairs believe that the RFC 7120 requirements for early allocation h= ave been met, and the AD concurs, we can update the registry now to move th= e expiration date forward to 2018-02-04. Please let us know whether you wan= t to renew or let the allocation expire.

Please see RFC 7120, and particularly Section 3.3, for rules concerning the= renewal of early allocations:
=C2=A0http://www.rfc-editor.org/rfc/rfc7120.txt
Please note that a second renewal (from 2018 until 2019) would require perm= ission from the IESG.
=C2=A0Best regards,
=C2=A0Amanda Baber
Lead IANA Services Specialist
PTI

_______________________________________________
Unbearable mailing list
Unbearable@ietf.org
https://www.ietf.org/mailman/listinfo/unbearabl= e
_______________________________________________
Unbearable mailing list
Unbearable@ietf.org
https://www.ietf.org/mailman/listinfo/unbearabl= e
--94eb2c08eab867d9fc0543a25580-- From nobody Wed Dec 14 17:34:12 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6A4501297ED for ; Wed, 14 Dec 2016 17:34:11 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.402 X-Spam-Level: X-Spam-Status: No, score=-1.402 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, RCVD_IN_SORBS_SPAM=0.5, SPF_PASS=-0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sRANBDc2CsbE for ; Wed, 14 Dec 2016 17:34:10 -0800 (PST) Received: from gproxy6-pub.mail.unifiedlayer.com (gproxy6-pub.mail.unifiedlayer.com [67.222.39.168]) by ietfa.amsl.com (Postfix) with SMTP id 0C4291297D6 for ; Wed, 14 Dec 2016 17:34:10 -0800 (PST) Received: (qmail 27499 invoked by uid 0); 15 Dec 2016 01:34:08 -0000 Received: from unknown (HELO cmgw4) (10.0.90.85) by gproxy6.mail.unifiedlayer.com with SMTP; 15 Dec 2016 01:34:08 -0000 Received: from box514.bluehost.com ([74.220.219.114]) by cmgw4 with id L1a41u0112UhLwi011a7Qk; Wed, 14 Dec 2016 18:34:07 -0700 X-Authority-Analysis: v=2.1 cv=DKocvU9b c=1 sm=1 tr=0 a=9W6Fsu4pMcyimqnCr1W0/w==:117 a=9W6Fsu4pMcyimqnCr1W0/w==:17 a=L9H7d07YOLsA:10 a=9cW_t1CCXrUA:10 a=s5jvgZ67dGcA:10 a=IkcTkHD0fZMA:10 a=n5n_aSjo0skA:10 a=NEAV23lmAAAA:8 a=p5ugdl_cTobyrZ82vekA:9 a=QEXdDO2ut3YA:10 a=vkb-mSBwfwsA:10 a=Bn2pgwyD2vrAyMmN8A2t:22 Received: from [173.224.162.69] (port=39653 helo=[10.225.80.104]) by box514.bluehost.com with esmtpsa (TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128) (Exim 4.86_1) (envelope-from ) id 1cHKvs-0006MI-QK for unbearable@ietf.org; Wed, 14 Dec 2016 18:34:04 -0700 To: IETF TokBind WG From: =JeffH Message-ID: Date: Wed, 14 Dec 2016 17:34:00 -0800 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:45.0) Gecko/20100101 Thunderbird/45.5.1 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - box514.bluehost.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - KingsMountain.com X-BWhitelist: no X-Source-IP: 173.224.162.69 X-Exim-ID: 1cHKvs-0006MI-QK X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: ([10.225.80.104]) [173.224.162.69]:39653 X-Source-Auth: jeff.hodges+kingsmountain.com X-Email-Count: 1 X-Source-Cap: a2luZ3Ntb3U7a2luZ3Ntb3U7Ym94NTE0LmJsdWVob3N0LmNvbQ== Archived-At: Subject: [Unbearable] PR#86: HTTPSTB WGLC editorial cleanup 1 X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Dec 2016 01:34:11 -0000 HTTPSTB WGLC editorial cleanup 1 https://github.com/TokenBinding/Internet-Drafts/pull/86 v08 2016-12-14 Jeff Hodges Various editorial cleanups. See link above for details. HTH, =JeffH From nobody Wed Dec 14 18:12:41 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E5EF2129F50 for ; Wed, 14 Dec 2016 18:12:39 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.402 X-Spam-Level: X-Spam-Status: No, score=-1.402 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, RCVD_IN_SORBS_SPAM=0.5, SPF_PASS=-0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rdAIErYrHI37 for ; Wed, 14 Dec 2016 18:12:38 -0800 (PST) Received: from gproxy1.mail.unifiedlayer.com (gproxy1-pub.mail.unifiedlayer.com [69.89.25.95]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DC6AC129C32 for ; Wed, 14 Dec 2016 18:12:38 -0800 (PST) Received: from cmgw3 (cmgw4 [10.0.90.84]) by gproxy1.mail.unifiedlayer.com (Postfix) with ESMTP id 6583D17A102 for ; Wed, 14 Dec 2016 18:51:41 -0700 (MST) Received: from box514.bluehost.com ([74.220.219.114]) by cmgw3 with id L1re1u00E2UhLwi011rhmQ; Wed, 14 Dec 2016 18:51:41 -0700 X-Authority-Analysis: v=2.1 cv=G8WPTbU5 c=1 sm=1 tr=0 a=9W6Fsu4pMcyimqnCr1W0/w==:117 a=9W6Fsu4pMcyimqnCr1W0/w==:17 a=L9H7d07YOLsA:10 a=9cW_t1CCXrUA:10 a=s5jvgZ67dGcA:10 a=IkcTkHD0fZMA:10 a=n5n_aSjo0skA:10 a=NEAV23lmAAAA:8 a=48vgC7mUAAAA:8 a=cVOB2INJkgI_Yj8HFUQA:9 a=4yNjsdIyFOWXwuyL:21 a=gGBo2qPvVmethHND:21 a=QEXdDO2ut3YA:10 a=Bn2pgwyD2vrAyMmN8A2t:22 a=w1C3t2QeGrPiZgrLijVG:22 Received: from [173.224.162.69] (port=28376 helo=[10.225.80.104]) by box514.bluehost.com with esmtpsa (TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128) (Exim 4.86_1) (envelope-from ) id 1cHLCs-0006aM-6N for unbearable@ietf.org; Wed, 14 Dec 2016 18:51:38 -0700 To: IETF TokBind WG From: =JeffH Message-ID: <619a8df6-6ab5-2a4b-6237-e7e78382ca79@KingsMountain.com> Date: Wed, 14 Dec 2016 17:51:37 -0800 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:45.0) Gecko/20100101 Thunderbird/45.5.1 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - box514.bluehost.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - KingsMountain.com X-BWhitelist: no X-Source-IP: 173.224.162.69 X-Exim-ID: 1cHLCs-0006aM-6N X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: ([10.225.80.104]) [173.224.162.69]:28376 X-Source-Auth: jeff.hodges+kingsmountain.com X-Email-Count: 3 X-Source-Cap: a2luZ3Ntb3U7a2luZ3Ntb3U7Ym94NTE0LmJsdWVob3N0LmNvbQ== Archived-At: Subject: [Unbearable] HTTPSTB: TODO remains wrt specifying sec-token-binding header field behavior X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Dec 2016 02:12:40 -0000 HTTPSTB: TODO remains wrt specifying sec-token-binding header field behavior https://github.com/TokenBinding/Internet-Drafts/issues/88 this TODO remains in HTTPSTB: [[TODO: possibly add further considerations wrt the behavior of the above header fields, per https://tools.ietf.org/html/rfc7231#section-8.3]] In glancing at the bullet list at the end of we don't address the first item (and we should), and may arguably need to address others. hth, =JeffH From nobody Wed Dec 14 18:26:03 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A4E2612955F for ; Wed, 14 Dec 2016 18:26:01 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.402 X-Spam-Level: X-Spam-Status: No, score=-1.402 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, RCVD_IN_SORBS_SPAM=0.5, SPF_PASS=-0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eAP-UxdFJu3C for ; Wed, 14 Dec 2016 18:26:00 -0800 (PST) Received: from gproxy1.mail.unifiedlayer.com (gproxy1-pub.mail.unifiedlayer.com [69.89.25.95]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 95F56129526 for ; Wed, 14 Dec 2016 18:26:00 -0800 (PST) Received: from cmgw3 (cmgw4 [10.0.90.84]) by gproxy1.mail.unifiedlayer.com (Postfix) with ESMTP id DF0FE177624 for ; Wed, 14 Dec 2016 18:43:21 -0700 (MST) Received: from box514.bluehost.com ([74.220.219.114]) by cmgw3 with id L1jH1u00Z2UhLwi011jLzZ; Wed, 14 Dec 2016 18:43:21 -0700 X-Authority-Analysis: v=2.1 cv=G8WPTbU5 c=1 sm=1 tr=0 a=9W6Fsu4pMcyimqnCr1W0/w==:117 a=9W6Fsu4pMcyimqnCr1W0/w==:17 a=L9H7d07YOLsA:10 a=9cW_t1CCXrUA:10 a=s5jvgZ67dGcA:10 a=IkcTkHD0fZMA:10 a=n5n_aSjo0skA:10 a=NEAV23lmAAAA:8 a=2lzUTMoIUj50UbPlFCQA:9 a=QEXdDO2ut3YA:10 a=Bn2pgwyD2vrAyMmN8A2t:22 Received: from [173.224.162.69] (port=9070 helo=[10.225.80.104]) by box514.bluehost.com with esmtpsa (TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128) (Exim 4.86_1) (envelope-from ) id 1cHL4n-0002j7-LE for unbearable@ietf.org; Wed, 14 Dec 2016 18:43:17 -0700 To: IETF TokBind WG From: =JeffH Message-ID: <6bca6ada-3ff1-34a6-ad2c-b5c1ff1bd581@KingsMountain.com> Date: Wed, 14 Dec 2016 17:43:16 -0800 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:45.0) Gecko/20100101 Thunderbird/45.5.1 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - box514.bluehost.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - KingsMountain.com X-BWhitelist: no X-Source-IP: 173.224.162.69 X-Exim-ID: 1cHL4n-0002j7-LE X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: ([10.225.80.104]) [173.224.162.69]:9070 X-Source-Auth: jeff.hodges+kingsmountain.com X-Email-Count: 2 X-Source-Cap: a2luZ3Ntb3U7a2luZ3Ntb3U7Ym94NTE0LmJsdWVob3N0LmNvbQ== Archived-At: Subject: [Unbearable] HTTPSTB: TBPROTO: "token binding key" terminology ambiguity X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Dec 2016 02:26:01 -0000 HTTPSTB: TBPROTO: "token binding key" terminology ambiguity and impedance mismatch... TBPROTO (-tokbind-protocol) uses "token binding key" to sometimes refer to the TB private key or sometimes to TB key pair HTTPSTB (-tokbind-https) uses "token binding key" to sometimes refer to a "Token Binding ID" (aka a TB public key), and may use the former phrase in other ways also... issue #87 https://github.com/TokenBinding/Internet-Drafts/issues/87 hth, =JeffH From nobody Wed Dec 14 18:32:24 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C1981129BE1 for ; Wed, 14 Dec 2016 18:32:23 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com; domainkeys=pass (1024-bit key) header.sender=andreipo=microsoft.com@github.com header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3267sxr_-boZ for ; Wed, 14 Dec 2016 18:32:21 -0800 (PST) Received: from m69-169.mailgun.net (m69-169.mailgun.net [166.78.69.169]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 97280129F2F for ; Wed, 14 Dec 2016 18:32:20 -0800 (PST) DKIM-Signature: a=rsa-sha256; v=1; c=relaxed/relaxed; d=github.com; q=dns/txt; s=mailo; t=1481769140; h=Content-Transfer-Encoding: Content-Type: Mime-Version: Subject: Message-ID: To: Reply-To: From: Date: Sender; bh=M8/QegHhPPYQAEnM61DKywDws+CZ3JAlltihVHYhWY8=; b=bXbwftkm1deM9uZfI5dzavAl79VIqatNDVXtBb8K3zEjdakhMujgmlZE7TwpoZ7PPylwnYCH lg8taJS0S7ABwMv77QoWFJCy3a8hFFVW66oZwx3OG66+JzIVL07X+jsBNqeclFQZHVCYjNDS bf8mchwfJ1jwASr0+UMLaG6FnJA= DomainKey-Signature: a=rsa-sha1; c=nofws; d=github.com; s=mailo; q=dns; h=Sender: Date: From: Reply-To: To: Message-ID: Subject: Mime-Version: Content-Type: Content-Transfer-Encoding; b=RkFeLroWZJ5ByLBnA7X5x/Y4CYdDN0q+MZFx5V9iwJMEr5R+bS7zJg5r86TIu71E6g7VTw 3G9qZ6dYIZn5hGR5dtk2FZwJ6ydj0Wmw/Wt96aQ5RaFUg/PWzvtRhX/pL/zsLqdpF1arouQe wJpAPg54BimiZ2RPgYAV1IAFFIA9c= Sender: andreipo=microsoft.com@github.com X-Mailgun-Sending-Ip: 166.78.69.169 X-Mailgun-Sid: WyIzMTNlNyIsICJ1bmJlYXJhYmxlQGlldGYub3JnIiwgIjQwZiJd Received: from github.com (Unknown [192.30.252.42]) by mxa.mailgun.org with ESMTP id 585200b3.7f42ce62da50-smtp-out-n03; Thu, 15 Dec 2016 02:32:19 -0000 (UTC) Date: Wed, 14 Dec 2016 18:32:19 -0800 From: Andrei Popov To: unbearable@ietf.org Message-ID: <585200b39d4cd_22043fb5ebe6313449310@hookshot-fe1-cp1-prd.iad.github.net.mail> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="--==_mimepart_585200b39d012_22043fb5ebe6313449251"; charset=UTF-8 Content-Transfer-Encoding: 7bit Archived-At: Subject: [Unbearable] [TokenBinding/Internet-Drafts] 073287: polish 1st parag X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: Andrei Popov List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Dec 2016 02:32:24 -0000 ----==_mimepart_585200b39d012_22043fb5ebe6313449251 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Branch: refs/heads/master Home: https://github.com/TokenBinding/Internet-Drafts Commit: 073287fae1a1230f51e97c01a3fb19e106de2013 https://github.com/TokenBinding/Internet-Drafts/commit/073287fae1a1230f51e97c01a3fb19e106de2013 Author: JeffH Date: 2016-02-20 (Sat, 20 Feb 2016) Changed paths: M draft-ietf-tokbind-protocol-04.xml Log Message: ----------- polish 1st parag Commit: 35139e0712bc605523ba956ea7add513fdde7bf3 https://github.com/TokenBinding/Internet-Drafts/commit/35139e0712bc605523ba956ea7add513fdde7bf3 Author: JeffH Date: 2016-03-24 (Thu, 24 Mar 2016) Changed paths: M README.md R draft-ietf-tokbind-https-02.xml A draft-ietf-tokbind-https-03.xml Log Message: ----------- merge upstream/master Commit: 6973649252dcef8e07c07baaf9b4de90785bdae4 https://github.com/TokenBinding/Internet-Drafts/commit/6973649252dcef8e07c07baaf9b4de90785bdae4 Author: JeffH Date: 2016-06-29 (Wed, 29 Jun 2016) Changed paths: A CONTRIBUTING.md M README.md R draft-ietf-tokbind-https-03.xml A draft-ietf-tokbind-https-04.xml R draft-ietf-tokbind-protocol-04.xml A draft-ietf-tokbind-protocol-06.xml Log Message: ----------- merge master into here Commit: a539c27829214e2f7dcf628fd8f4236b8cab0e7e https://github.com/TokenBinding/Internet-Drafts/commit/a539c27829214e2f7dcf628fd8f4236b8cab0e7e Author: JeffH Date: 2016-12-06 (Tue, 06 Dec 2016) Changed paths: M README.md R draft-ietf-tokbind-https-04.xml A draft-ietf-tokbind-https-07.xml R draft-ietf-tokbind-negotiation-02.xml A draft-ietf-tokbind-negotiation-06.xml R draft-ietf-tokbind-protocol-06.xml A draft-ietf-tokbind-protocol-11.xml Log Message: ----------- Merge branch 'master' into IntroEdits Commit: b83c41b74e1d77dbbf457e70840e0577268082b3 https://github.com/TokenBinding/Internet-Drafts/commit/b83c41b74e1d77dbbf457e70840e0577268082b3 Author: JeffH Date: 2016-12-08 (Thu, 08 Dec 2016) Changed paths: R draft-ietf-tokbind-protocol-11.xml A draft-ietf-tokbind-protocol-12.xml Log Message: ----------- TBPROTO: init -12 Commit: 28f0f7a36d0d4bc4465fe0af0c7eb5fa6688701d https://github.com/TokenBinding/Internet-Drafts/commit/28f0f7a36d0d4bc4465fe0af0c7eb5fa6688701d Author: JeffH Date: 2016-12-08 (Thu, 08 Dec 2016) Changed paths: M draft-ietf-tokbind-protocol-12.xml Log Message: ----------- TBPROTO: Introduction polishing Commit: 71d50b3dfa041bdece446c39cc0974fbb2c51135 https://github.com/TokenBinding/Internet-Drafts/commit/71d50b3dfa041bdece446c39cc0974fbb2c51135 Author: JeffH Date: 2016-12-08 (Thu, 08 Dec 2016) Changed paths: M draft-ietf-tokbind-protocol-12.xml Log Message: ----------- TBPROTO: Overview polishing Commit: 561dedc230f8d696c9412af2ab1a13ef059c441b https://github.com/TokenBinding/Internet-Drafts/commit/561dedc230f8d696c9412af2ab1a13ef059c441b Author: JeffH Date: 2016-12-08 (Thu, 08 Dec 2016) Changed paths: M draft-ietf-tokbind-protocol-12.xml Log Message: ----------- TBPROTO: section TBMessage-TBID polishing Commit: 7646215d6538584f6726bf21eaa81a7f8ecc7dba https://github.com/TokenBinding/Internet-Drafts/commit/7646215d6538584f6726bf21eaa81a7f8ecc7dba Author: JeffH Date: 2016-12-08 (Thu, 08 Dec 2016) Changed paths: M draft-ietf-tokbind-protocol-12.xml Log Message: ----------- TBPROTO: polish abstract Commit: ddfbcdd203c7ebe68f3e3eb9294cdf9feccf7670 https://github.com/TokenBinding/Internet-Drafts/commit/ddfbcdd203c7ebe68f3e3eb9294cdf9feccf7670 Author: JeffH Date: 2016-12-08 (Thu, 08 Dec 2016) Changed paths: M draft-ietf-tokbind-protocol-12.xml Log Message: ----------- TBPROTO: minor cleanups Commit: 2ee9b888ea51930ad6b643ed870569580531dc7f https://github.com/TokenBinding/Internet-Drafts/commit/2ee9b888ea51930ad6b643ed870569580531dc7f Author: JeffH Date: 2016-12-08 (Thu, 08 Dec 2016) Changed paths: M draft-ietf-tokbind-protocol-12.xml Log Message: ----------- TBPROTO: polish section Security-TokenReplay Commit: acf9f035dd0eaeec5bb7aa52d2ef5ec400f2e8f8 https://github.com/TokenBinding/Internet-Drafts/commit/acf9f035dd0eaeec5bb7aa52d2ef5ec400f2e8f8 Author: JeffH Date: 2016-12-08 (Thu, 08 Dec 2016) Changed paths: M draft-ietf-tokbind-protocol-12.xml Log Message: ----------- TBPROTO: update change log Commit: b6511d7f74bb12108448a6227a4f26ec2e5cfa8e https://github.com/TokenBinding/Internet-Drafts/commit/b6511d7f74bb12108448a6227a4f26ec2e5cfa8e Author: JeffH Date: 2016-12-09 (Fri, 09 Dec 2016) Changed paths: M draft-ietf-tokbind-protocol-12.xml Log Message: ----------- TBPROTO: spelling fixups Commit: 38ab396d5be34de1c6afca6c889286615dd26ce5 https://github.com/TokenBinding/Internet-Drafts/commit/38ab396d5be34de1c6afca6c889286615dd26ce5 Author: Andrei Popov Date: 2016-12-14 (Wed, 14 Dec 2016) Changed paths: M draft-ietf-tokbind-protocol-12.xml Log Message: ----------- Merge branch 'TBPROTO-cleanup1' of https://github.com/equalsJeffH/Internet-Drafts into equalsJeffH-TBPROTO-cleanup1 Commit: 807d884a3efd4910e4cc23eba33dd831081ec4e2 https://github.com/TokenBinding/Internet-Drafts/commit/807d884a3efd4910e4cc23eba33dd831081ec4e2 Author: Andrei Popov Date: 2016-12-14 (Wed, 14 Dec 2016) Changed paths: M draft-ietf-tokbind-protocol-12.xml Log Message: ----------- Merge branch 'equalsJeffH-TBPROTO-cleanup1' Commit: 4a9ca7c5262380f6048a78712e14b53dc5101411 https://github.com/TokenBinding/Internet-Drafts/commit/4a9ca7c5262380f6048a78712e14b53dc5101411 Author: Andrei Popov Date: 2016-12-14 (Wed, 14 Dec 2016) Changed paths: M draft-ietf-tokbind-protocol-12.xml Log Message: ----------- Merging PR #84 Compare: https://github.com/TokenBinding/Internet-Drafts/compare/43e6d1f78f14...4a9ca7c52623 ----==_mimepart_585200b39d012_22043fb5ebe6313449251-- From nobody Wed Dec 14 18:44:04 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 472101294F8 for ; Wed, 14 Dec 2016 18:44:03 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.003 X-Spam-Level: X-Spam-Status: No, score=-2.003 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id V7NjVbMBwJ4D for ; Wed, 14 Dec 2016 18:44:01 -0800 (PST) Received: from NAM03-BY2-obe.outbound.protection.outlook.com (mail-by2nam03on0099.outbound.protection.outlook.com [104.47.42.99]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 60953129469 for ; Wed, 14 Dec 2016 18:44:01 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=/chAZrzhnrlvJHF3BCXE6RNwXNiVtTiF/DHeRwS1lC4=; b=Z0uzUGGIC8vU0UM3hOrQt3UOvTCZ3jjH4EcJK88GCLi37zqfwkVy0+acMw0g61S8dhZMRPMigLti63vLQ3Au5qUNZgSQXZT0WcxD/sDPJAOVnGD9hroWIjvsaZz+sAza8gQMq71tvyY520RHDjLJx44qcAkG+2Qe7w88NWxIUXQ= Received: from CY1PR0301MB0842.namprd03.prod.outlook.com (10.160.163.148) by CY1PR0301MB0842.namprd03.prod.outlook.com (10.160.163.148) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.771.8; Thu, 15 Dec 2016 02:43:58 +0000 Received: from CY1PR0301MB0842.namprd03.prod.outlook.com ([10.160.163.148]) by CY1PR0301MB0842.namprd03.prod.outlook.com ([10.160.163.148]) with mapi id 15.01.0771.014; Thu, 15 Dec 2016 02:43:58 +0000 From: Andrei Popov To: =JeffH , IETF TokBind WG Thread-Topic: [Unbearable] PR#83: TBPROTO: HTTPSTB: renego polishing Thread-Index: AQHSUA75Lxiq61f8T0CAnBsrlcybeKD7hEQwgAs8QFCAAZlhkA== Date: Thu, 15 Dec 2016 02:43:58 +0000 Message-ID: References: <1fdac9be-16e4-158b-3c14-ec298aca36b3@KingsMountain.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Andrei.Popov@microsoft.com; x-originating-ip: [131.107.159.203] x-ms-office365-filtering-correlation-id: 8557b267-c5cb-4cc6-3f5b-08d42494385a x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001); SRVR:CY1PR0301MB0842; x-microsoft-exchange-diagnostics: 1; CY1PR0301MB0842; 7:fd7WB3xt0cKXCn8d6gI9UPTFSiAdsSRfynZcNLrjImx86A+wAHD9wZ7laDuVi20IkhW30yRb56KoURIhxn41iT7VC3qNwp+mjdV7HC3Ioj0pU9+q7v+Lswt49LyDzfp1gCCI/AmdA4yTiUdL4PMQ9CeWQTK8quNvWiliBT15WHzn+R+ewxuhLMol3+1OI0XNhn4ozuOSjllVuab87bESNMweFpAw1e6g/unH/7o+YP/DSZQCo4XXCMSf2fJW63biPPW8IgxWkAfI/3xSqRr3eLkP5lNGCkiPRvg4+uNQW03RBqQIMd5JKKRSZzik88CaFzlH7TIym+QFM529ulBNFmy4eP9MsFRKTEKGjoTxNLfIoCQlHxPrf9nI0q2hbQWMN5d2quqJxzfHQvVR9iNinWgy3WJYDT0P8J12fF72XaLqu6v2Up4Q/HmMph8zw+DU2S0TVnnFBf9Kt8c4iVGs8ZeZl3SnI0/UkrphSKqu9a4= x-o365ent-eop-header: Message processed by - O365_ENT: Allow from ranges (Engineering ONLY) x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:; x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040375)(601004)(2401047)(8121501046)(5005006)(3002001)(10201501046)(6055026)(61426038)(61427038)(6041248)(20161123564025)(20161123562025)(20161123560025)(20161123555025)(6047074)(6072148); SRVR:CY1PR0301MB0842; BCL:0; PCL:0; RULEID:; SRVR:CY1PR0301MB0842; x-forefront-prvs: 0157DEB61B x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(6009001)(7916002)(39410400002)(39450400003)(39840400002)(39850400002)(39860400002)(199003)(377454003)(189002)(13464003)(92566002)(99286002)(122556002)(74316002)(305945005)(105586002)(7736002)(3846002)(6116002)(102836003)(25786008)(6436002)(38730400001)(3900700001)(86362001)(77096006)(229853002)(6506006)(106356001)(106116001)(7696004)(76576001)(86612001)(189998001)(101416001)(33656002)(54356999)(5660300001)(76176999)(66066001)(50986999)(107886002)(3280700002)(8936002)(2906002)(81156014)(97736004)(9686002)(8990500004)(5005710100001)(3660700001)(68736007)(81166006)(558084003)(8676002)(10290500002)(10090500001)(5001770100001)(2900100001); DIR:OUT; SFP:1102; SCL:1; SRVR:CY1PR0301MB0842; H:CY1PR0301MB0842.namprd03.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; A:1; MX:1; LANG:en; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 15 Dec 2016 02:43:58.3169 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY1PR0301MB0842 Archived-At: Subject: Re: [Unbearable] PR#83: TBPROTO: HTTPSTB: renego polishing X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Dec 2016 02:44:03 -0000 Also merged PR #84. -----Original Message----- From: Andrei Popov=20 Sent: Tuesday, December 13, 2016 6:19 PM To: '=3DJeffH' ; 'IETF TokBind WG' Subject: RE: [Unbearable] PR#83: TBPROTO: HTTPSTB: renego polishing Merged on GitHub. Will look at PR #84 tomorrow. Thanks, Andrei From nobody Thu Dec 15 08:34:24 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 83A2612953E for ; Wed, 14 Dec 2016 10:34:58 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.455 X-Spam-Level: X-Spam-Status: No, score=-5.455 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_20=1.546, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GscKz2tJLKYx for ; Wed, 14 Dec 2016 10:34:57 -0800 (PST) Received: from github-smtp2b-ext-cp1-prd.iad.github.net (github-smtp2-ext3.iad.github.net [192.30.252.194]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EA92F12944B for ; Wed, 14 Dec 2016 10:34:56 -0800 (PST) Date: Wed, 14 Dec 2016 10:34:56 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1481740496; bh=wqQcNdQT92pLvpawzUR+2mEOAFWUBiufpDK8tkdRMUw=; h=From:Reply-To:To:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=rmAR0dvuo4s8rCITPAKH1xBQfvZybPP1moJJAjp0VahoLoHk537Y/2Z0E/H6HI0zc Exn53Zi14jGRXx8GRd14o2y9xaJFfImbV2t92tQ9vk8vYqoduDwYBzqjHgwadDGmgG tiW5DxZfnOvxBmCX04XMCY9K6VsDvs6E1PcG8nsQ= From: Andrei-Popov To: TokenBinding/Internet-Drafts Message-ID: In-Reply-To: References: Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_585190d023cbf_174303f7e68549130350428"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list X-GitHub-Sender: Andrei-Popov X-GitHub-Recipient: unbearable-ML X-Auto-Response-Suppress: All X-GitHub-Recipient-Address: unbearable@ietf.org Archived-At: X-Mailman-Approved-At: Thu, 15 Dec 2016 08:34:21 -0800 Subject: Re: [Unbearable] [TokenBinding/Internet-Drafts] HTTPSTB: WGLC: web origin -> server or eTLD+1 (#85) X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Reply-To: TokenBinding/Internet-Drafts List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 14 Dec 2016 18:34:58 -0000 ----==_mimepart_585190d023cbf_174303f7e68549130350428 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit I think this change would make the language more concrete and more consistent. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/TokenBinding/Internet-Drafts/issues/85#issuecomment-267116679 ----==_mimepart_585190d023cbf_174303f7e68549130350428 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

I think this change would make the language more concrete and more consistent.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_585190d023cbf_174303f7e68549130350428-- From nobody Thu Dec 15 08:34:28 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5563B1297CD for ; Wed, 14 Dec 2016 17:32:22 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7.02 X-Spam-Level: X-Spam-Status: No, score=-7.02 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3GaChBg-84k2 for ; Wed, 14 Dec 2016 17:32:19 -0800 (PST) Received: from github-smtp2a-ext-cp1-prd.iad.github.net (github-smtp2-ext7.iad.github.net [192.30.252.198]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7B25B12944F for ; Wed, 14 Dec 2016 17:32:19 -0800 (PST) Date: Wed, 14 Dec 2016 17:32:18 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1481765538; bh=nGwin/dBNNCyoLxc5GKY1W44JqB5VhrkEeALorO9aiE=; h=From:Reply-To:To:Cc:Subject:List-ID:List-Archive:List-Post: List-Unsubscribe:From; b=dO8aiOf5L/dVzICU77E6PluSkl/Zwj1MQxedwG9nJFfT6H9kae9roVFiI1UNVz/p8 MCEB8sl58VjWt2aMMXxRF9NgjpLQ8EAOOr98LrBiaZXLD3109DklmccrSLML2JfZHP 5dlIZ1JhYs/iUuSyl3Q64hURg63+IlARN6o7Og70= From: =JeffH To: TokenBinding/Internet-Drafts Message-ID: Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_5851f2a2ad4ca_4cc33fa32ca33130861099"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list X-GitHub-Sender: equalsJeffH X-GitHub-Recipient: unbearable-ML X-GitHub-Reason: subscribed X-Auto-Response-Suppress: All X-GitHub-Recipient-Address: unbearable@ietf.org Archived-At: X-Mailman-Approved-At: Thu, 15 Dec 2016 08:34:21 -0800 Cc: Subscribed Subject: [Unbearable] [TokenBinding/Internet-Drafts] HTTPSTB WGLC editorial cleanup 1 (#86) X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Reply-To: TokenBinding/Internet-Drafts List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Dec 2016 01:32:22 -0000 ----==_mimepart_5851f2a2ad4ca_4cc33fa32ca33130861099 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit v08 2016-12-14 Jeff Hodges Various editorial cleanups. You can view, comment on, or merge this pull request online at: https://github.com/TokenBinding/Internet-Drafts/pull/86 -- Commit Summary -- * HTTPSTB: init -08 * HTTPSTB: spelling fixups * HTTPSTB: may->MAY in section 2. The Sec-Token-Binding Header Field * HTTPSTB: fix minor grammar * HTTPSTB: polish 'Security Token Replay' section * HTTPSTB: minor clarifying edit * HTTPSTB: origin->{eTLD+1,server}, as appropriate, fixes #85 * Merge branch 'master' into HTTPSTB-cleanup1 * HTTPSTB: TB msg -> TB structure in sensitivity of TB hdr section * HTTPSTB: key -> key pairs in privacy-cons * HTTPSTB: equate 'first-party' to 'same-site' in 1st-party use cases * HTTPSTB: update change log -- File Changes -- M draft-ietf-tokbind-https-08.xml (58) -- Patch Links -- https://github.com/TokenBinding/Internet-Drafts/pull/86.patch https://github.com/TokenBinding/Internet-Drafts/pull/86.diff -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/TokenBinding/Internet-Drafts/pull/86 ----==_mimepart_5851f2a2ad4ca_4cc33fa32ca33130861099 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

v08 2016-12-14 Jeff Hodges Various editorial cleanups.

You can view, comment on, or merge this pull request online at:

  https://github.com/TokenBinding/Internet-Drafts/pull/86

Commit Summary

  • HTTPSTB: init -08
  • HTTPSTB: spelling fixups
  • HTTPSTB: may->MAY in section 2. The Sec-Token-Binding Header Field
  • HTTPSTB: fix minor grammar
  • HTTPSTB: polish 'Security Token Replay' section
  • HTTPSTB: minor clarifying edit
  • HTTPSTB: origin->{eTLD+1,server}, as appropriate, fixes #85
  • Merge branch 'master' into HTTPSTB-cleanup1
  • HTTPSTB: TB msg -> TB structure in sensitivity of TB hdr section
  • HTTPSTB: key -> key pairs in privacy-cons
  • HTTPSTB: equate 'first-party' to 'same-site' in 1st-party use cases
  • HTTPSTB: update change log

File Changes

Patch Links:

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_5851f2a2ad4ca_4cc33fa32ca33130861099-- From nobody Thu Dec 15 08:34:31 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4C8B81297CD for ; Wed, 14 Dec 2016 17:42:28 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.383 X-Spam-Level: X-Spam-Status: No, score=-5.383 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mG9JrQYUgZMV for ; Wed, 14 Dec 2016 17:42:26 -0800 (PST) Received: from github-smtp2b-ext-cp1-prd.iad.github.net (github-smtp2-ext6.iad.github.net [192.30.252.197]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C9B15129F0F for ; Wed, 14 Dec 2016 17:42:05 -0800 (PST) Date: Wed, 14 Dec 2016 17:42:04 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1481766124; bh=Qkdn7IJCyV8KKXCjXUtS+1GlyDT7dRQvnNIACg4qIfg=; h=From:Reply-To:To:Cc:Subject:List-ID:List-Archive:List-Post: List-Unsubscribe:From; b=JFYHtJ4lMjUPG5TFxECMUgN9ORTVCon85tJ2PofWbmRRvTRhIpDdLntY/X0/IXz7p 5WckhCpMsh8AEtR6KutDHC/1HNeOXw4xpsLFgzCj7/UQCEAnBc7MjKWkCKl4VzwLM6 8lluOTd23FmHxFYgachqCs+unsYgB5nbmRXKAZ2w= From: =JeffH To: TokenBinding/Internet-Drafts Message-ID: Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_5851f4ecee458_21eee3f92328311306488a1"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list X-GitHub-Sender: equalsJeffH X-GitHub-Recipient: unbearable-ML X-GitHub-Reason: subscribed X-Auto-Response-Suppress: All X-GitHub-Recipient-Address: unbearable@ietf.org Archived-At: X-Mailman-Approved-At: Thu, 15 Dec 2016 08:34:21 -0800 Cc: Subscribed Subject: [Unbearable] [TokenBinding/Internet-Drafts] HTTPSTB: TBPROTO: "token binding key" terminology ambiguity.. (#87) X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Reply-To: TokenBinding/Internet-Drafts List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Dec 2016 01:42:28 -0000 ----==_mimepart_5851f4ecee458_21eee3f92328311306488a1 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit ..and impedance mismatch... TBPROTO (-tokbind-protocol) uses "token binding key" to sometimes refer to the TB private key or sometimes to TB key pair HTTPSTB (-tokbind-https) uses "token binding key" to sometimes refer to a "Token Binding ID" (aka a TB public key), and may use the former phrase in other ways also... -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/TokenBinding/Internet-Drafts/issues/87 ----==_mimepart_5851f4ecee458_21eee3f92328311306488a1 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

..and impedance mismatch...

TBPROTO (-tokbind-protocol) uses "token binding key" to sometimes refer to the TB private key or sometimes to TB key pair

HTTPSTB (-tokbind-https) uses "token binding key" to sometimes refer to a "Token Binding ID" (aka a TB public key), and may use the former phrase in other ways also...

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_5851f4ecee458_21eee3f92328311306488a1-- From nobody Thu Dec 15 08:34:33 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 32D67129F69 for ; Wed, 14 Dec 2016 17:45:01 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.512 X-Spam-Level: X-Spam-Status: No, score=-3.512 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_28=1.404, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-2.896, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mtyRaMyYdJPO for ; Wed, 14 Dec 2016 17:44:59 -0800 (PST) Received: from o10.sgmail.github.com (o10.sgmail.github.com [167.89.101.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3E0BC129F84 for ; Wed, 14 Dec 2016 17:44:23 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=RTIS2sNFY9mw28fpl15Uo9g2uBY=; b=wDHlWG3CM7eEkIDX 1q5SjWFMnycLe9QQI7oIrW38s/OSqG4+jDf1CTPDNQl0HKrqPSX7b/4kJjF7UGuz 47iT3+/zn9FWtwIviz0RFhPZme5Jhy1qtoXrQuyGdpU7CUEyqtGuUJry6KU0MRkZ O27UKWGsJf4pV2wLX8nckBRgvOY= Received: by filter0853p1mdw1.sendgrid.net with SMTP id filter0853p1mdw1-6921-5851F576-20 2016-12-15 01:44:22.296254911 +0000 UTC Received: from github-smtp2a-ext-cp1-prd.iad.github.net (github-smtp2a-ext-cp1-prd.iad.github.net [192.30.253.16]) by ismtpd0002p1iad1.sendgrid.net (SG) with ESMTP id jGRMoiXFRD-em8vRqAjPUA for ; Thu, 15 Dec 2016 01:44:22.300 +0000 (UTC) Date: Wed, 14 Dec 2016 17:44:22 -0800 From: Nick Harper To: TokenBinding/Internet-Drafts Message-ID: In-Reply-To: References: Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_5851f57631548_77163fe49ee2913c3689c4"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list X-GitHub-Sender: nharper X-GitHub-Recipient: unbearable-ML X-GitHub-Reason: subscribed X-Auto-Response-Suppress: All X-GitHub-Recipient-Address: unbearable@ietf.org X-SG-EID: 9Yqp9dCIIwZxB0MVAPExrXlt7a4/46ALD9aG/N3UOYoSFbC1OsvJmpVZwT6WX1JQDFec/7M0UrBGgJ Z+4sxzlXNslrLatfP3q6fGdrO/Eh6MxOjxJqt4i/GO0RVREPbux+MyW0fgPj6KJQI8KmPH25bMT/OC sXUagofRIZqYXCFL895T6UB+mUp8kFnAqpbCvvg7YrW2M1Ua6m+d6X9poq8maoCUUEvJYfNc7LncB4 c= Archived-At: X-Mailman-Approved-At: Thu, 15 Dec 2016 08:34:21 -0800 Cc: Subscribed Subject: Re: [Unbearable] [TokenBinding/Internet-Drafts] HTTPSTB WGLC editorial cleanup 1 (#86) X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Reply-To: TokenBinding/Internet-Drafts List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Dec 2016 01:45:01 -0000 ----==_mimepart_5851f57631548_77163fe49ee2913c3689c4 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit nharper commented on this pull request. > @@ -571,25 +572,25 @@ TokenBinding MUST be signed with the Token Binding key used by the client for connections between itself and the Token Consumer (more specifically, the - web origin that issued the Include-Referred-Token-Binding-ID - response header field). The Token Binding ID established by this + server that issued the Include-Referred-Token-Binding-ID + response header field, whose hostname ). The Token Binding ID established by this Is something missing after "whose hostname"? -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/TokenBinding/Internet-Drafts/pull/86#pullrequestreview-13046432 ----==_mimepart_5851f57631548_77163fe49ee2913c3689c4 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

@nharper commented on this pull request.

In draft-ietf-tokbind-https-08.xml:

> @@ -571,25 +572,25 @@
         TokenBinding MUST be signed 
 	with the Token Binding key used by the client for connections
 	between itself and the Token Consumer (more specifically, the
-	web origin that issued the Include-Referred-Token-Binding-ID
-	response header field). The Token Binding ID established by this
+	server that issued the Include-Referred-Token-Binding-ID
+	response header field, whose hostname ). The Token Binding ID established by this

Is something missing after "whose hostname"?

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_5851f57631548_77163fe49ee2913c3689c4-- From nobody Thu Dec 15 08:34:36 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CD02A129EEF for ; Wed, 14 Dec 2016 17:50:35 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.383 X-Spam-Level: X-Spam-Status: No, score=-5.383 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id c4uFNJ3rGQ8J for ; Wed, 14 Dec 2016 17:50:33 -0800 (PST) Received: from github-smtp2a-ext-cp1-prd.iad.github.net (github-smtp2-ext1.iad.github.net [192.30.252.192]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C642C1297D6 for ; Wed, 14 Dec 2016 17:50:33 -0800 (PST) Date: Wed, 14 Dec 2016 17:50:32 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1481766633; bh=RHybh9qRvhDynz/gbBy7A8LI+eBFgMaE4cGyny6dSj0=; h=From:Reply-To:To:Cc:Subject:List-ID:List-Archive:List-Post: List-Unsubscribe:From; b=hgpZ64Bm2ackA4ORtnLZE/xjR8JR7j95IaHNgQrQHzlBJ8bmVoyMB1ZExEN264y3o FvwgmG6dC6y2dJUGBrdrLS3arZyovB2KpnQyg7v9v6phynnioWF6eiFh5irngr/D1q UXa6ZePCFEryHzE8DNYTySKI5bON6s1t1ZGRvrRM= From: =JeffH To: TokenBinding/Internet-Drafts Message-ID: Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_5851f6e8efa40_5bc33fa504a63130452336"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list X-GitHub-Sender: equalsJeffH X-GitHub-Recipient: unbearable-ML X-GitHub-Reason: subscribed X-Auto-Response-Suppress: All X-GitHub-Recipient-Address: unbearable@ietf.org Archived-At: X-Mailman-Approved-At: Thu, 15 Dec 2016 08:34:21 -0800 Cc: Subscribed Subject: [Unbearable] [TokenBinding/Internet-Drafts] HTTPSTB: TODO remains wrt specifying sec-token-binding header field behavior (#88) X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Reply-To: TokenBinding/Internet-Drafts List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Dec 2016 01:50:36 -0000 ----==_mimepart_5851f6e8efa40_5bc33fa504a63130452336 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit this TODO remains in HTTPSTB > [[TODO: possibly add further considerations wrt the behavior of the above header fields, per ]] In glancing at the bullet list at the end of https://tools.ietf.org/html/rfc7231#section-8.3.1 we don't address the first item (and we should), and may arguably need to address others. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/TokenBinding/Internet-Drafts/issues/88 ----==_mimepart_5851f6e8efa40_5bc33fa504a63130452336 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

this TODO remains in HTTPSTB

[[TODO: possibly add further considerations wrt the behavior of the above header fields, per https://tools.ietf.org/html/rfc7231#section-8.3]]

In glancing at the bullet list at the end of https://tools.ietf.org/html/rfc7231#section-8.3.1 we don't address the first item (and we should), and may arguably need to address others.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_5851f6e8efa40_5bc33fa504a63130452336-- From nobody Thu Dec 15 08:34:38 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 95797129F4B for ; Wed, 14 Dec 2016 18:32:21 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.383 X-Spam-Level: X-Spam-Status: No, score=-5.383 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wmzYVSJ870ib for ; Wed, 14 Dec 2016 18:32:20 -0800 (PST) Received: from github-smtp2b-ext-cp1-prd.iad.github.net (github-smtp2-ext3.iad.github.net [192.30.252.194]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EC105129BE1 for ; Wed, 14 Dec 2016 18:32:19 -0800 (PST) Date: Wed, 14 Dec 2016 18:32:18 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1481769138; bh=OIs4LONZS3KWOg9nnwKBUVgvgEke7FbszOJUcGuTUKc=; h=From:Reply-To:To:Cc:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=oNBO7erVk3Q1dmDM2WubsCJt1GzD6eO9DZAI+6MzzskJPikvDbMVQ2Z6TzmA56O3L lDbBW9O69bEGyjL2ItW3+Nx+EKYyvXBZG6N0wALqtMAAZBqCxOp18vzevBAz4eDwYn JoyDDKUx0vG4D35rAgPMhafr8e8mgalNuZtjJkOY= From: Andrei-Popov To: TokenBinding/Internet-Drafts Message-ID: In-Reply-To: References: Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_585200b2e72a1_158173f862d5f3140180876"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list X-GitHub-Sender: Andrei-Popov X-GitHub-Recipient: unbearable-ML X-GitHub-Reason: subscribed X-Auto-Response-Suppress: All X-GitHub-Recipient-Address: unbearable@ietf.org Archived-At: X-Mailman-Approved-At: Thu, 15 Dec 2016 08:34:21 -0800 Cc: Subscribed Subject: Re: [Unbearable] [TokenBinding/Internet-Drafts] TBPROTO: WGLC editorial cleanup 1 (#84) X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Reply-To: TokenBinding/Internet-Drafts List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Dec 2016 02:32:21 -0000 ----==_mimepart_585200b2e72a1_158173f862d5f3140180876 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Merged #84. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/TokenBinding/Internet-Drafts/pull/84#event-894626147 ----==_mimepart_585200b2e72a1_158173f862d5f3140180876 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

Merged #84.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_585200b2e72a1_158173f862d5f3140180876-- From nobody Thu Dec 15 09:48:19 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EF8E912940E for ; Thu, 15 Dec 2016 09:48:17 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.902 X-Spam-Level: X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nvzeolttAZx3 for ; Thu, 15 Dec 2016 09:48:16 -0800 (PST) Received: from gproxy6-pub.mail.unifiedlayer.com (gproxy6-pub.mail.unifiedlayer.com [67.222.39.168]) by ietfa.amsl.com (Postfix) with SMTP id 46CEA129996 for ; Thu, 15 Dec 2016 09:48:15 -0800 (PST) Received: (qmail 13240 invoked by uid 0); 15 Dec 2016 17:48:13 -0000 Received: from unknown (HELO cmgw2) (10.0.90.83) by gproxy6.mail.unifiedlayer.com with SMTP; 15 Dec 2016 17:48:13 -0000 Received: from box514.bluehost.com ([74.220.219.114]) by cmgw2 with id LHo81u00g2UhLwi01HoB34; Thu, 15 Dec 2016 10:48:11 -0700 X-Authority-Analysis: v=2.1 cv=Zvl+dbLG c=1 sm=1 tr=0 a=9W6Fsu4pMcyimqnCr1W0/w==:117 a=9W6Fsu4pMcyimqnCr1W0/w==:17 a=L9H7d07YOLsA:10 a=9cW_t1CCXrUA:10 a=s5jvgZ67dGcA:10 a=IkcTkHD0fZMA:10 a=n5n_aSjo0skA:10 a=NEAV23lmAAAA:8 a=OzRFGcyKt8HJQhB9ODAA:9 a=QEXdDO2ut3YA:10 a=Bn2pgwyD2vrAyMmN8A2t:22 Received: from [173.224.162.69] (port=1186 helo=[10.225.80.85]) by box514.bluehost.com with esmtpsa (TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128) (Exim 4.86_1) (envelope-from ) id 1cHa8X-0002Od-UI; Thu, 15 Dec 2016 10:48:09 -0700 To: Andrei Popov From: =JeffH Message-ID: <35c60a82-fed1-0708-21ba-dca471043c2c@KingsMountain.com> Date: Thu, 15 Dec 2016 09:48:08 -0800 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:45.0) Gecko/20100101 Thunderbird/45.5.1 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - box514.bluehost.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - KingsMountain.com X-BWhitelist: no X-Source-IP: 173.224.162.69 X-Exim-ID: 1cHa8X-0002Od-UI X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: ([10.225.80.85]) [173.224.162.69]:1186 X-Source-Auth: jeff.hodges+kingsmountain.com X-Email-Count: 2 X-Source-Cap: a2luZ3Ntb3U7a2luZ3Ntb3U7Ym94NTE0LmJsdWVob3N0LmNvbQ== Archived-At: Cc: IETF TokBind WG Subject: [Unbearable] wrt merges of PRs #83 & #84 X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Dec 2016 17:48:18 -0000 Andrei wrote: > [#83] Merged on GitHub. Will look at PR #84 tomorrow. > ... > Also merged PR #84. thanks for merging those in, Andrei. Unfortunately, in examining the resultant commits in the github repo made to both draft-ietf-tokbind-https-08.xml and draft-ietf-tokbind-protocol-12.xml, it seems at least some of the commits I had made were undone by these commits of yours when ostensibly merging the pull requests.. Merging PR #83 Merging PR #84 It seems that what might've happened with the 43e6d1f #83 commit above is that you updated the README.md (which I'd neglected to do, sorry) and also edited -tokbind-https on your local repo clone and but had not pulled in all the changes from the PR before pushing back to the remote (I've seen this happen before). And perhaps something similar happened for the 4a9ca7c #84 commit. thanks, hth, =JeffH From nobody Thu Dec 15 10:53:23 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A1586129443 for ; Thu, 15 Dec 2016 10:53:22 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.022 X-Spam-Level: X-Spam-Status: No, score=-2.022 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CCkmfjeAR1fq for ; Thu, 15 Dec 2016 10:53:20 -0800 (PST) Received: from NAM03-CO1-obe.outbound.protection.outlook.com (mail-co1nam03on0117.outbound.protection.outlook.com [104.47.40.117]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8226E129423 for ; Thu, 15 Dec 2016 10:53:20 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=d4PS/d9vFEySDXoTnvOmlJyply//w/FBp6J2Bpx+C9c=; b=NdVv2tMThmnyn4AkX1hbLx0FDAooHEsaFw2+f3QrSesDQ2hxXQ0WCwrH4TQl2+TxHU81Snlc+WVsX+3SAbXqO7FudLLtgXGPoz5jFnDv+6OAiDoFGxBNjAGbuKUXbkQEiUBsOmn14U6KDu1U0w7h3+Qx2EtVrPmnvKEGwPiU/Og= Received: from CY1PR0301MB0842.namprd03.prod.outlook.com (10.160.163.148) by CY1PR0301MB0841.namprd03.prod.outlook.com (10.160.163.147) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.771.8; Thu, 15 Dec 2016 18:53:19 +0000 Received: from CY1PR0301MB0842.namprd03.prod.outlook.com ([10.160.163.148]) by CY1PR0301MB0842.namprd03.prod.outlook.com ([10.160.163.148]) with mapi id 15.01.0771.014; Thu, 15 Dec 2016 18:53:19 +0000 From: Andrei Popov To: =JeffH Thread-Topic: wrt merges of PRs #83 & #84 Thread-Index: AQHSVvtqzGpaa+Rdy0SHEPa/yXsGkaEJWjtQ Date: Thu, 15 Dec 2016 18:53:19 +0000 Message-ID: References: <35c60a82-fed1-0708-21ba-dca471043c2c@KingsMountain.com> In-Reply-To: <35c60a82-fed1-0708-21ba-dca471043c2c@KingsMountain.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Andrei.Popov@microsoft.com; x-originating-ip: [131.107.159.203] x-ms-office365-filtering-correlation-id: c5b7f3de-e2c3-48bd-8069-08d4251ba2f5 x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001); SRVR:CY1PR0301MB0841; x-microsoft-exchange-diagnostics: 1; CY1PR0301MB0841; 7:jw/+aw9PLryvQwoTsnaqDAT4lV4gfqL/kU1hWZn2CKZCk794o3g3zIf3hvHS55LanqiABv1b3YPAsYLOPyvnT0adtZkjwIlnhA2R+4Ps69Zbub6GfBJVKWwKrEyslioPOSUEOaDjG/N1IweSE1qdS1/FhQqyIFXut09O3Qs1LKW8V78V+pC0RAHWQHAHQSEbn72QIUj5IAdzCD5ww0Yg5emOIyKXvD0qiQPJrrbHVUjyF6FVQpSMN8XVp1b4MNaUwRPYV/+ctHHmu2Vq5pyE1OKeF6oNQP/ZyTNBOON9ElGoqiBSEICOIwfjPGZ1NvPjMAXG9k+DOBwUdQd5RXAIo1WsNs80yr08YYHnef/NVtgEoI+DxMVtLYuzvH0ckbp/6BVWz7raOgABFRqE4E4gb8bp1QGEJPpxZvByHbWGzVmjAFAM0fzyJ7svEeNKVI/JAG/2hTYsYKRT8+IBMK/KAXaio5F62rd2Z7e8xGN13dU= x-o365ent-eop-header: Message processed by - O365_ENT: Allow from ranges (Engineering ONLY) x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(166708455590820)(111885846020525); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040375)(601004)(2401047)(5005006)(8121501046)(3002001)(10201501046)(6055026)(61426038)(61427038)(6041248)(20161123562025)(20161123555025)(20161123564025)(20161123560025)(6047074)(6072148); SRVR:CY1PR0301MB0841; BCL:0; PCL:0; RULEID:; SRVR:CY1PR0301MB0841; x-forefront-prvs: 0157DEB61B x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(6009001)(7916002)(39450400003)(39410400002)(39860400002)(39850400002)(39840400002)(24454002)(189002)(199003)(13464003)(377454003)(76176999)(99286002)(54356999)(2900100001)(106116001)(105586002)(6916009)(92566002)(4326007)(101416001)(2950100002)(81156014)(189998001)(97736004)(5005710100001)(110136003)(7696004)(305945005)(33656002)(76576001)(5660300001)(74316002)(10090500001)(8990500004)(10290500002)(50986999)(2906002)(106356001)(122556002)(102836003)(6116002)(7736002)(8676002)(66066001)(3280700002)(3846002)(229853002)(9686002)(86612001)(68736007)(38730400001)(86362001)(6436002)(81166006)(8936002)(77096006)(25786008)(3660700001)(6506006); DIR:OUT; SFP:1102; SCL:1; SRVR:CY1PR0301MB0841; H:CY1PR0301MB0842.namprd03.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:1; LANG:en; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 15 Dec 2016 18:53:19.1953 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY1PR0301MB0841 Archived-At: Cc: IETF TokBind WG Subject: Re: [Unbearable] wrt merges of PRs #83 & #84 X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Dec 2016 18:53:22 -0000 V2hpbGUgbWVyZ2luZyB0aGUgY2hhbmdlcywgSSBlZGl0ZWQgdGhlbSBmb3IgdGVjaG5pY2FsIGNv cnJlY3RuZXNzLCBldGMuIFNvbWUgb2YgdGhlIGNoYW5nZXMgaW4gdGhlIFBScyBkaWRuJ3QgbWFr ZSBzZW5zZSB0byBtZS4gSWYgdGhlcmUncyBzb21ldGhpbmcgcGFydGljdWxhcmx5IGltcG9ydGFu dCB0byB5b3UgdGhhdCBJIHVuZGlkLCBsZXQncyBkaXNjdXNzLg0KDQpDaGVlcnMsDQoNCkFuZHJl aQ0KDQotLS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0tLQ0KRnJvbTogPUplZmZIIFttYWlsdG86SmVm Zi5Ib2RnZXNAS2luZ3NNb3VudGFpbi5jb21dIA0KU2VudDogVGh1cnNkYXksIERlY2VtYmVyIDE1 LCAyMDE2IDk6NDggQU0NClRvOiBBbmRyZWkgUG9wb3YgPEFuZHJlaS5Qb3BvdkBtaWNyb3NvZnQu Y29tPg0KQ2M6IElFVEYgVG9rQmluZCBXRyA8dW5iZWFyYWJsZUBpZXRmLm9yZz4NClN1YmplY3Q6 IHdydCBtZXJnZXMgb2YgUFJzICM4MyAmICM4NA0KDQpBbmRyZWkgd3JvdGU6DQogPiBbIzgzXSBN ZXJnZWQgb24gR2l0SHViLiBXaWxsIGxvb2sgYXQgUFIgIzg0IHRvbW9ycm93Lg0KID4gLi4uDQog PiBBbHNvIG1lcmdlZCBQUiAjODQuDQoNCnRoYW5rcyBmb3IgbWVyZ2luZyB0aG9zZSBpbiwgQW5k cmVpLg0KDQpVbmZvcnR1bmF0ZWx5LCBpbiBleGFtaW5pbmcgdGhlIHJlc3VsdGFudCBjb21taXRz IGluIHRoZSBnaXRodWIgcmVwbyBtYWRlIHRvIGJvdGggZHJhZnQtaWV0Zi10b2tiaW5kLWh0dHBz LTA4LnhtbCBhbmQgZHJhZnQtaWV0Zi10b2tiaW5kLXByb3RvY29sLTEyLnhtbCwgaXQgc2VlbXMg YXQgbGVhc3Qgc29tZSBvZiB0aGUgY29tbWl0cyBJIGhhZCBtYWRlIHdlcmUgdW5kb25lIGJ5IHRo ZXNlIGNvbW1pdHMgb2YgeW91cnMgd2hlbiBvc3RlbnNpYmx5IG1lcmdpbmcgdGhlIHB1bGwgcmVx dWVzdHMuLg0KDQogICBNZXJnaW5nIFBSICM4Mw0KIA0KPGh0dHBzOi8vZ2l0aHViLmNvbS9Ub2tl bkJpbmRpbmcvSW50ZXJuZXQtRHJhZnRzL2NvbW1pdC80M2U2ZDFmNzhmMTQ1MmIxMTkzZWJjMDJk ZGMzM2RhMzE0ZjYwZDk5Pg0KDQogICBNZXJnaW5nIFBSICM4NA0KIA0KPGh0dHBzOi8vZ2l0aHVi LmNvbS9Ub2tlbkJpbmRpbmcvSW50ZXJuZXQtRHJhZnRzL2NvbW1pdC80YTljYTdjNTI2MjM4MGY2 MDQ4YTc4NzEyZTE0YjUzZGM1MTAxNDExPg0KDQoNCkl0IHNlZW1zIHRoYXQgd2hhdCBtaWdodCd2 ZSBoYXBwZW5lZCB3aXRoIHRoZSA0M2U2ZDFmICM4MyBjb21taXQgYWJvdmUgaXMgdGhhdCB5b3Ug dXBkYXRlZCB0aGUgUkVBRE1FLm1kICh3aGljaCBJJ2QgbmVnbGVjdGVkIHRvIGRvLCBzb3JyeSkg YW5kIGFsc28gZWRpdGVkIC10b2tiaW5kLWh0dHBzIG9uIHlvdXIgbG9jYWwgcmVwbyBjbG9uZSBh bmQgYnV0IGhhZCBub3QgcHVsbGVkIGluIGFsbCB0aGUgY2hhbmdlcyBmcm9tIHRoZSBQUiBiZWZv cmUgcHVzaGluZyBiYWNrIHRvIHRoZSByZW1vdGUgKEkndmUgc2VlbiB0aGlzIGhhcHBlbiBiZWZv cmUpLg0KDQpBbmQgcGVyaGFwcyBzb21ldGhpbmcgc2ltaWxhciBoYXBwZW5lZCBmb3IgdGhlIDRh OWNhN2MgIzg0IGNvbW1pdC4NCg0KdGhhbmtzLCBodGgsDQoNCj1KZWZmSA0K From nobody Thu Dec 15 11:38:00 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D3A8C129972 for ; Thu, 15 Dec 2016 11:37:58 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.902 X-Spam-Level: X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1oLM_a3IMCjz for ; Thu, 15 Dec 2016 11:37:57 -0800 (PST) Received: from gproxy6-pub.mail.unifiedlayer.com (gproxy6-pub.mail.unifiedlayer.com [67.222.39.168]) by ietfa.amsl.com (Postfix) with SMTP id 587DE1298AC for ; Thu, 15 Dec 2016 11:37:57 -0800 (PST) Received: (qmail 1356 invoked by uid 0); 15 Dec 2016 19:37:55 -0000 Received: from unknown (HELO cmgw2) (10.0.90.83) by gproxy6.mail.unifiedlayer.com with SMTP; 15 Dec 2016 19:37:55 -0000 Received: from box514.bluehost.com ([74.220.219.114]) by cmgw2 with id LKdq1u00a2UhLwi01Kdtnn; Thu, 15 Dec 2016 12:37:53 -0700 X-Authority-Analysis: v=2.1 cv=Zvl+dbLG c=1 sm=1 tr=0 a=9W6Fsu4pMcyimqnCr1W0/w==:117 a=9W6Fsu4pMcyimqnCr1W0/w==:17 a=L9H7d07YOLsA:10 a=9cW_t1CCXrUA:10 a=s5jvgZ67dGcA:10 a=IkcTkHD0fZMA:10 a=n5n_aSjo0skA:10 a=NEAV23lmAAAA:8 a=9nWYXU6ZPQ6Bh39V-ZwA:9 a=QEXdDO2ut3YA:10 a=Bn2pgwyD2vrAyMmN8A2t:22 Received: from [173.224.162.69] (port=19820 helo=[10.225.80.85]) by box514.bluehost.com with esmtpsa (TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128) (Exim 4.86_1) (envelope-from ) id 1cHbqi-0006bt-AS; Thu, 15 Dec 2016 12:37:52 -0700 To: Andrei Popov From: =JeffH Message-ID: Date: Thu, 15 Dec 2016 11:37:51 -0800 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:45.0) Gecko/20100101 Thunderbird/45.5.1 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - box514.bluehost.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - KingsMountain.com X-BWhitelist: no X-Source-IP: 173.224.162.69 X-Exim-ID: 1cHbqi-0006bt-AS X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: ([10.225.80.85]) [173.224.162.69]:19820 X-Source-Auth: jeff.hodges+kingsmountain.com X-Email-Count: 2 X-Source-Cap: a2luZ3Ntb3U7a2luZ3Ntb3U7Ym94NTE0LmJsdWVob3N0LmNvbQ== Archived-At: Cc: IETF TokBind WG Subject: Re: [Unbearable] wrt merges of PRs #83 & #84 X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Dec 2016 19:37:59 -0000 > While merging the changes, I edited them for technical correctness, > etc. Some of the changes in the PRs didn't make sense to me. hm, I'm used to folks asking questions regarding proposed changes rather than indicating they're merged while silently dropping some number of them on the floor. e.g.: https://github.com/TokenBinding/Internet-Drafts/pull/86#pullrequestreview-13046432 > If there's something particularly important to you that I undid, > let's discuss. If others review the proposed edits and wish to lend support for those that were not incorporated to master, then I'll discuss. Otherwise, in the interest of finishing the specs, I can live with it. Though, i'm curious wrt what you considered 'technically incorrect'. =JeffH From nobody Thu Dec 15 12:03:12 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 630EF129541 for ; Thu, 15 Dec 2016 12:03:11 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.003 X-Spam-Level: X-Spam-Status: No, score=-2.003 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id o8sAJo7Bb_Oo for ; Thu, 15 Dec 2016 12:03:09 -0800 (PST) Received: from NAM02-BL2-obe.outbound.protection.outlook.com (mail-bl2nam02on0092.outbound.protection.outlook.com [104.47.38.92]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8B9A1129478 for ; Thu, 15 Dec 2016 12:03:09 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=dCE4wIyJpgbQvzieS5pUvXH1XeGMfn/3MvlB9WFvCrE=; b=Q1TeQ7QgThBXA/F3CgPK4bOMyYx/NH4C4y1fBwv0EcS5HDBY4ZP4eM7k6oD+Ou9XKeVAKT2e8xByNOLSrSIWBjN/E+S/b/yjSwOhfYRqwAUMQj9IZgBUCeCT2vS7hHdS02Nxucb8CJmdP56n8UjgFM2KYe5p7Y41BbXYaxPgt+I= Received: from CY1PR0301MB0842.namprd03.prod.outlook.com (10.160.163.148) by CY1PR0301MB0844.namprd03.prod.outlook.com (10.160.163.150) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.771.8; Thu, 15 Dec 2016 20:03:08 +0000 Received: from CY1PR0301MB0842.namprd03.prod.outlook.com ([10.160.163.148]) by CY1PR0301MB0842.namprd03.prod.outlook.com ([10.160.163.148]) with mapi id 15.01.0771.014; Thu, 15 Dec 2016 20:03:07 +0000 From: Andrei Popov To: =JeffH Thread-Topic: [Unbearable] wrt merges of PRs #83 & #84 Thread-Index: AQHSVwrC/XbaKlMiOku9031rtkmqz6EJZ/UA Date: Thu, 15 Dec 2016 20:03:07 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Andrei.Popov@microsoft.com; x-originating-ip: [131.107.159.203] x-ms-office365-filtering-correlation-id: 0eef4f80-0021-4dbc-e343-08d42525634b x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001); SRVR:CY1PR0301MB0844; x-microsoft-exchange-diagnostics: 1; CY1PR0301MB0844; 7:jijDrCjiSi54EBWm53w+Az7t/V6ooE1Wzqhgl9MFMYEH1Pq8/ZEhfRaxJuEqY3WB5wRXdE2FKL07a2hQrhyUzZNZa1gFO6GIb6fT1b+xWGaAPceSsmZHE0K4PhFqDElh2Rz2DOhxJz2WSik1fkFbzd/1LOez3zxnmPzeBd1eRvSzHvCPTvFM+vm5h+6Hs2iWFCHmTdbqHqoswnQmKfSPEBi91z3MZA38x+r7vCXUBQpl14QLTwAxq1fKTKsQiH9OpYnaxtp3rnSDL5xuNKpPulJxfarAy1qA4qCuzVa/DfyuR/HN761oAJqFOAfljP0jGMegtGUWKZjj8bQgwOMfasIUYak76tbDpIdRZUjj8hJxG0X38s76jDFH9COlT7o/uYw2N1CvJ4XYQxPcfecO0TpyVDwqt+fwLRyjZE4u6/bsuIvQ2tXt7XvgGJ8y3UMn8fzbtnP7k6uPD4H7mgv/Qdf2ln/JO4ys5G7rP28+2iM= x-o365ent-eop-header: Message processed by - O365_ENT: Allow from ranges (Engineering ONLY) x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:; x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040375)(601004)(2401047)(5005006)(8121501046)(3002001)(10201501046)(6055026)(61426038)(61427038)(6041248)(20161123555025)(20161123560025)(20161123564025)(20161123562025)(6072148)(6047074); SRVR:CY1PR0301MB0844; BCL:0; PCL:0; RULEID:; SRVR:CY1PR0301MB0844; x-forefront-prvs: 0157DEB61B x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(6009001)(7916002)(39410400002)(39860400002)(39450400003)(39850400002)(39840400002)(189002)(199003)(74316002)(76576001)(2906002)(2950100002)(4326007)(8676002)(106356001)(106116001)(5660300001)(81166006)(8990500004)(81156014)(110136003)(6916009)(99286002)(7736002)(25786008)(86612001)(105586002)(7696004)(305945005)(86362001)(6436002)(66066001)(122556002)(77096006)(76176999)(6116002)(102836003)(189998001)(3846002)(8936002)(3280700002)(2900100001)(38730400001)(3660700001)(54356999)(6506006)(50986999)(10090500001)(101416001)(97736004)(5005710100001)(92566002)(10290500002)(229853002)(68736007)(33656002)(9686002); DIR:OUT; SFP:1102; SCL:1; SRVR:CY1PR0301MB0844; H:CY1PR0301MB0842.namprd03.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:1; LANG:en; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 15 Dec 2016 20:03:07.3736 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY1PR0301MB0844 Archived-At: Cc: IETF TokBind WG Subject: Re: [Unbearable] wrt merges of PRs #83 & #84 X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Dec 2016 20:03:11 -0000 > hm, I'm used to folks asking questions regarding proposed changes rather = than indicating they're merged while silently dropping some number of them = on the floor. Sorry about the silent aspect, should have noted in e-mail that there were = parts I changed/omitted. Will do next time. Generally, an editor has to harmonize the proposed changes with the rest of= the document, can't usually merge PRs as is. > Though, i'm curious wrt what you considered 'technically incorrect'. Most of the changes I dropped or adjusted were inconsequential (line-breaks= , etc. that complicate review but ultimately get handled by xml2rfc). There were a few things I rephrased, like "TLS record layer fragmentation o= f client messages", "not accepts" vs. "rejects", "makes detectable" vs. "pr= events", "key parameter", etc. And there were a few things I had to add, e.g. README changes. But again, this is just an editor's draft on Github, please review and sugg= est further edits if I've omitted something really important. Cheers, Andrei From nobody Thu Dec 15 12:35:54 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0DE32126CD8 for ; Thu, 15 Dec 2016 12:35:53 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.902 X-Spam-Level: X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8ddzOlHeyAeU for ; Thu, 15 Dec 2016 12:35:51 -0800 (PST) Received: from gproxy5-pub.mail.unifiedlayer.com (gproxy5-pub.mail.unifiedlayer.com [67.222.38.55]) by ietfa.amsl.com (Postfix) with SMTP id D9AF2129468 for ; Thu, 15 Dec 2016 12:35:50 -0800 (PST) Received: (qmail 9428 invoked by uid 0); 15 Dec 2016 20:35:47 -0000 Received: from unknown (HELO cmgw3) (10.0.90.84) by gproxy5.mail.unifiedlayer.com with SMTP; 15 Dec 2016 20:35:47 -0000 Received: from box514.bluehost.com ([74.220.219.114]) by cmgw3 with id LLbk1u0082UhLwi01Lbn4K; Thu, 15 Dec 2016 13:35:47 -0700 X-Authority-Analysis: v=2.1 cv=G8WPTbU5 c=1 sm=1 tr=0 a=9W6Fsu4pMcyimqnCr1W0/w==:117 a=9W6Fsu4pMcyimqnCr1W0/w==:17 a=L9H7d07YOLsA:10 a=9cW_t1CCXrUA:10 a=s5jvgZ67dGcA:10 a=IkcTkHD0fZMA:10 a=n5n_aSjo0skA:10 a=NEAV23lmAAAA:8 a=FUAjlETniY4hYevsx7sA:9 a=QEXdDO2ut3YA:10 a=idMGFmfAIR4A:10 a=Bn2pgwyD2vrAyMmN8A2t:22 Received: from [173.224.162.69] (port=2307 helo=[10.225.80.85]) by box514.bluehost.com with esmtpsa (TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128) (Exim 4.86_1) (envelope-from ) id 1cHcki-0006jk-5c for unbearable@ietf.org; Thu, 15 Dec 2016 13:35:44 -0700 To: IETF TokBind WG From: =JeffH Message-ID: Date: Thu, 15 Dec 2016 12:35:41 -0800 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:45.0) Gecko/20100101 Thunderbird/45.5.1 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - box514.bluehost.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - KingsMountain.com X-BWhitelist: no X-Source-IP: 173.224.162.69 X-Exim-ID: 1cHcki-0006jk-5c X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: ([10.225.80.85]) [173.224.162.69]:2307 X-Source-Auth: jeff.hodges+kingsmountain.com X-Email-Count: 1 X-Source-Cap: a2luZ3Ntb3U7a2luZ3Ntb3U7Ym94NTE0LmJsdWVob3N0LmNvbQ== Archived-At: Subject: Re: [Unbearable] PR#82: TBPROTO: update ECPoint.point to be in X9.62 format with leading 0x04 byte X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Dec 2016 20:35:53 -0000 https://github.com/TokenBinding/Internet-Drafts/pull/82#issuecomment-267436429 I'd written on 7-Dec-2016.. > Seems to me that given the input from several implementors that they > are parsing/constructing the ECC public key "by hand" in any case > that we ought to leave well enough alone and close this PR#82. ..and no one has disagreed with it, so am closing this PR. =JeffH From nobody Thu Dec 15 12:48:19 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C26CC12969C for ; Thu, 15 Dec 2016 11:28:22 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.793 X-Spam-Level: X-Spam-Status: No, score=-5.793 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_28=1.404, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-0.001, RP_MATCHES_RCVD=-2.896, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mXSS3RLlFpNI for ; Thu, 15 Dec 2016 11:28:21 -0800 (PST) Received: from o6.sgmail.github.com (o6.sgmail.github.com [192.254.113.101]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1DF0E12965B for ; Thu, 15 Dec 2016 11:28:21 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=uAvwuIHN7fHdIDiVRnn8gJb/bww=; b=MUXq7tNnqcl//jfx MjdAq2MREDy6sz7oUCxqSqhhieV0mS+tdW+Q56LXvLv1P4eBSAYX6Pj2/zlSNxHm mcW4NfhzrdYeV9/71wcNGFxDttykA4mpDlXTu5MAf6H+ziiuxp1DX11Q2mbbx8rr jz8tBLsxrCHAn1qEudOrHVeJkcs= Received: by filter0803p1mdw1.sendgrid.net with SMTP id filter0803p1mdw1-5356-5852EED3-43 2016-12-15 19:28:19.526111952 +0000 UTC Received: from github-smtp2b-ext-cp1-prd.iad.github.net (github-smtp2b-ext-cp1-prd.iad.github.net [192.30.253.17]) by ismtpd0006p1iad1.sendgrid.net (SG) with ESMTP id OtovMjqnSWq2DkXA7ZFoMw for ; Thu, 15 Dec 2016 19:28:19.473 +0000 (UTC) Date: Thu, 15 Dec 2016 11:28:18 -0800 From: =JeffH To: TokenBinding/Internet-Drafts Message-ID: In-Reply-To: References: Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_5852eed2a8df7_4c5a3fa65b2c9138762a0"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list X-GitHub-Sender: equalsJeffH X-GitHub-Recipient: unbearable-ML X-GitHub-Reason: subscribed X-Auto-Response-Suppress: All X-GitHub-Recipient-Address: unbearable@ietf.org X-SG-EID: 9Yqp9dCIIwZxB0MVAPExrXlt7a4/46ALD9aG/N3UOYr8BttZI4GD/utqtg5fypv1xJCQq7gOnoPCow oTD88wKff9syzdj0TJMzt/C3HR2eMQmwMZI8E2vQGrIjvaeU0ATMV0G0Kr7KmtrZflCs/5eI0GN7Tu z5p07UyV6GNx0C4lBf2FGHv05Ry/ubleFhYZ4EDLfyNLX8Siycn689OSYw== Archived-At: X-Mailman-Approved-At: Thu, 15 Dec 2016 12:48:16 -0800 Cc: Subscribed Subject: Re: [Unbearable] [TokenBinding/Internet-Drafts] HTTPSTB WGLC editorial cleanup 1 (#86) X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Reply-To: TokenBinding/Internet-Drafts List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Dec 2016 19:28:23 -0000 ----==_mimepart_5852eed2a8df7_4c5a3fa65b2c9138762a0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit equalsJeffH commented on this pull request. > @@ -571,25 +572,25 @@ TokenBinding MUST be signed with the Token Binding key used by the client for connections between itself and the Token Consumer (more specifically, the - web origin that issued the Include-Referred-Token-Binding-ID - response header field). The Token Binding ID established by this + server that issued the Include-Referred-Token-Binding-ID + response header field, whose hostname ). The Token Binding ID established by this yes, thx, that's busted, propose to fix by deleting `, whose hostname`. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/TokenBinding/Internet-Drafts/pull/86 ----==_mimepart_5852eed2a8df7_4c5a3fa65b2c9138762a0 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

@equalsJeffH commented on this pull request.

In draft-ietf-tokbind-https-08.xml:

> @@ -571,25 +572,25 @@
         TokenBinding MUST be signed 
 	with the Token Binding key used by the client for connections
 	between itself and the Token Consumer (more specifically, the
-	web origin that issued the Include-Referred-Token-Binding-ID
-	response header field). The Token Binding ID established by this
+	server that issued the Include-Referred-Token-Binding-ID
+	response header field, whose hostname ). The Token Binding ID established by this

yes, thx, that's busted, propose to fix by deleting , whose hostname.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_5852eed2a8df7_4c5a3fa65b2c9138762a0-- From nobody Thu Dec 15 12:48:24 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 950C91299AA for ; Thu, 15 Dec 2016 12:21:22 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.616 X-Spam-Level: X-Spam-Status: No, score=-5.616 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_28=1.404, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xhpSshHs_kV4 for ; Thu, 15 Dec 2016 12:21:20 -0800 (PST) Received: from github-smtp2a-ext-cp1-prd.iad.github.net (github-smtp2-ext4.iad.github.net [192.30.252.195]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3986B1296A7 for ; Thu, 15 Dec 2016 12:20:54 -0800 (PST) Date: Thu, 15 Dec 2016 12:20:53 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1481833253; bh=9aON7/gf5W7nlfFPXFcW6QnQ32+vod1U1QaGLTSUPow=; h=From:Reply-To:To:Cc:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=1g8jcxy88aX6d1QfD613onCsfkbotGgt+ppF0k/ic/hkXRqaRG+mZIKDY23hoepD9 Tkvfpy+BnSLcHREXxO2ivnby6TZrpc/CLCyZXC1lbiGLnWwOkjWVG9IHaIuoJV13IT usEN4NBgJRxSRAYyuMOF7uMWIFUBOMijvwfuGI9Q= From: =JeffH To: TokenBinding/Internet-Drafts Message-ID: In-Reply-To: References: Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_5852fb252a25c_7c713fd199b971341045e6"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list X-GitHub-Sender: equalsJeffH X-GitHub-Recipient: unbearable-ML X-GitHub-Reason: push X-Auto-Response-Suppress: All X-GitHub-Recipient-Address: unbearable@ietf.org Archived-At: X-Mailman-Approved-At: Thu, 15 Dec 2016 12:48:16 -0800 Cc: Push Subject: Re: [Unbearable] [TokenBinding/Internet-Drafts] HTTPSTB WGLC editorial cleanup 1 (#86) X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Reply-To: TokenBinding/Internet-Drafts List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Dec 2016 20:21:22 -0000 ----==_mimepart_5852fb252a25c_7c713fd199b971341045e6 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit @equalsJeffH pushed 2 commits. 1be576f Merge branch 'master' into HTTPSTB-cleanup1 178104c HTTPSTB: delete dangling -- You are receiving this because you are subscribed to this thread. View it on GitHub: https://github.com/TokenBinding/Internet-Drafts/pull/86/files/e5d37ae47198a326a0153052154c60acfd57074d..178104c70e2f7e329cd7e6633277f082e2a9cf5e ----==_mimepart_5852fb252a25c_7c713fd199b971341045e6 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

@equalsJeffH pushed 2 commits.

  • 1be576f Merge branch 'master' into HTTPSTB-cleanup1
  • 178104c HTTPSTB: delete dangling

—
You are receiving this because you are subscribed to this thread.
View it on GitHub or mute the thread.

----==_mimepart_5852fb252a25c_7c713fd199b971341045e6-- From nobody Thu Dec 15 12:48:27 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B92A6129654 for ; Thu, 15 Dec 2016 12:33:42 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.097 X-Spam-Level: X-Spam-Status: No, score=-5.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_28=1.404, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H2=-0.001, RCVD_IN_SORBS_SPAM=0.5, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UkeBnmmWk0fr for ; Thu, 15 Dec 2016 12:33:41 -0800 (PST) Received: from github-smtp2b-ext-cp1-prd.iad.github.net (github-smtp2-ext2.iad.github.net [192.30.252.193]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0BFBA129468 for ; Thu, 15 Dec 2016 12:33:41 -0800 (PST) Date: Thu, 15 Dec 2016 12:33:40 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1481834020; bh=16U8R75VKswk6XTVlckAtSiWIGo948exHWI6E9M3tfI=; h=From:Reply-To:To:Cc:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=smFR/bUTAkGDR/o1hbY2+q08iNifVK9Rzb0bTmlShe0cI3ZqGuhr9eusBL/VJNX6q 4yYk+kL6+2ViI/ogjkYrY8t/GSBfYQpy9Prq+cdXyzu6sFXyhsN0SFBqUE622ymr98 6FzCg8CbL9wtIKnsq57EME4T79rU1xhq+2BP+JcQ= From: =JeffH To: TokenBinding/Internet-Drafts Message-ID: In-Reply-To: References: Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_5852fe24690e7_49783fd9cb5071407393"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list X-GitHub-Sender: equalsJeffH X-GitHub-Recipient: unbearable-ML X-GitHub-Reason: subscribed X-Auto-Response-Suppress: All X-GitHub-Recipient-Address: unbearable@ietf.org Archived-At: X-Mailman-Approved-At: Thu, 15 Dec 2016 12:48:16 -0800 Cc: Subscribed Subject: Re: [Unbearable] =?utf-8?q?=5BTokenBinding/Internet-Drafts=5D_TBPROTO?= =?utf-8?q?=3A_update_ECPoint=2Epoint_to_be_in_X9=2E62_format_with?= =?utf-8?b?4oCmICgjODIp?= X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Reply-To: TokenBinding/Internet-Drafts List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Dec 2016 20:33:42 -0000 ----==_mimepart_5852fe24690e7_49783fd9cb5071407393 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit as noted in https://www.ietf.org/mail-archive/web/unbearable/current/msg01033.html (I wrote on 7-Dec-2016): > Seems to me that given the input from several implementors that they are parsing/constructing the ECC public key "by hand" in any case that we ought to leave well enough alone and close this PR#82. ..and no one has disagreed with it, so am closing this PR. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/TokenBinding/Internet-Drafts/pull/82#issuecomment-267436429 ----==_mimepart_5852fe24690e7_49783fd9cb5071407393 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable

as noted in https://www.ietf.org/mail-archive/web/unbearable= /current/msg01033.html (I wrote on 7-Dec-2016):

Seems to me that given the input from several implementors that they a= re parsing/constructing the ECC public key "by hand" in any case that we = ought to leave well enough alone and close this PR#82.

..and no one has disagreed with it, so am closing this PR.

&m= dash;
You are receiving this because you are subscribed to this thre= ad.
Reply to this email directly, view it on GitHu= b, or mute the thread.<= img alt=3D"" height=3D"1" src=3D"https://github.com/notifications/beacon/= ARwnT3DLJgXhmDkeVg5bwP3lRsSzmXo1ks5rIaQkgaJpZM4LFyBR.gif" width=3D"1" /><= /p>

= ----==_mimepart_5852fe24690e7_49783fd9cb5071407393-- From nobody Thu Dec 15 12:48:29 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1DDBF129654 for ; Thu, 15 Dec 2016 12:33:48 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.579 X-Spam-Level: X-Spam-Status: No, score=-5.579 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-0.001, RP_MATCHES_RCVD=-2.896, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id f9snRqnNsX2b for ; Thu, 15 Dec 2016 12:33:46 -0800 (PST) Received: from o3.sgmail.github.com (o3.sgmail.github.com [192.254.112.98]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BF3DB129468 for ; Thu, 15 Dec 2016 12:33:45 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=4U5S+f9HiS8eHHmxhHKCrj9oqVg=; b=YvA3Fve0lezECLCX BrYU6KfQziw+4Wtx4zVNe1KKCjQRBdgSAzSe83xlkBvsbEX8mv1H+4lLLth1asCi 8Zyml5MFEpP/5xI2sVL6faaa4VInASDuKCMQBv2SfVBBg3psQd2gWecoqvzeCnSA 0W3eqvacbibiiKNc9wBAjqaMvv8= Received: by filter0884p1mdw1.sendgrid.net with SMTP id filter0884p1mdw1-2322-5852FE24-42 2016-12-15 20:33:40.557919035 +0000 UTC Received: from github-smtp2b-ext-cp1-prd.iad.github.net (github-smtp2b-ext-cp1-prd.iad.github.net [192.30.253.17]) by ismtpd0006p1iad1.sendgrid.net (SG) with ESMTP id mlSMf3QaT-as20CUvKoz_Q for ; Thu, 15 Dec 2016 20:33:40.511 +0000 (UTC) Date: Thu, 15 Dec 2016 12:33:40 -0800 From: =JeffH To: TokenBinding/Internet-Drafts Message-ID: In-Reply-To: References: Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_5852fe246db5e_26f13fd42786b13c1132220"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list X-GitHub-Sender: equalsJeffH X-GitHub-Recipient: unbearable-ML X-GitHub-Reason: subscribed X-Auto-Response-Suppress: All X-GitHub-Recipient-Address: unbearable@ietf.org X-SG-EID: 9Yqp9dCIIwZxB0MVAPExrXlt7a4/46ALD9aG/N3UOYpk93A9cCOcDfCRdCsPmUH5Gcpc+5/k0mo1XA AGWcWFsXd2QmLacfTe1eIkPg+NUxrNxPR4P0Z3jDATJ2USGxck7q5x2fLTAsPyiYYfGtSJzglUY0Z/ 1c3c2Zq24Tyr1tneHzcjW20Po09ZS2OtgvAK2Pw1MYbAchzUlB6JHswqZg== Archived-At: X-Mailman-Approved-At: Thu, 15 Dec 2016 12:48:16 -0800 Cc: Subscribed Subject: Re: [Unbearable] =?utf-8?q?=5BTokenBinding/Internet-Drafts=5D_TBPROTO?= =?utf-8?q?=3A_update_ECPoint=2Epoint_to_be_in_X9=2E62_format_with?= =?utf-8?b?4oCmICgjODIp?= X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Reply-To: TokenBinding/Internet-Drafts List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Dec 2016 20:33:48 -0000 ----==_mimepart_5852fe246db5e_26f13fd42786b13c1132220 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Closed #82. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/TokenBinding/Internet-Drafts/pull/82#event-895818640 ----==_mimepart_5852fe246db5e_26f13fd42786b13c1132220 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

Closed #82.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_5852fe246db5e_26f13fd42786b13c1132220-- From nobody Thu Dec 15 12:48:31 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C81E91298C2 for ; Thu, 15 Dec 2016 12:42:24 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.383 X-Spam-Level: X-Spam-Status: No, score=-5.383 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id M-Sy1c3FalPs for ; Thu, 15 Dec 2016 12:42:22 -0800 (PST) Received: from github-smtp2b-ext-cp1-prd.iad.github.net (github-smtp2-ext3.iad.github.net [192.30.252.194]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E6B31129473 for ; Thu, 15 Dec 2016 12:42:21 -0800 (PST) Date: Thu, 15 Dec 2016 12:42:21 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1481834541; bh=CQo6E8ABVr2tqIlTmYdn6wtVQLnmDv4PMyvMC0j7Uvk=; h=From:Reply-To:To:Cc:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=ek+bOMzooZSYk4Kqr3yPp7tBoAlUyA8iJ74UcxfIzOWO35l6lzf8sZnARuA9btX2+ /FA2K+e0aPhV4zOD4jtAPnXLJkbCCZ+H60hGpUIk8h14+XzZigmFuEC+bCyiyPJzAm 3MP7pRdcs3Pc93EK5haXS4kdv40k9fVGuRyPtk3U= From: =JeffH To: TokenBinding/Internet-Drafts Message-ID: In-Reply-To: References: Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_5853002d4b411_1ef363fa42ef5113c5645cf"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list X-GitHub-Sender: equalsJeffH X-GitHub-Recipient: unbearable-ML X-GitHub-Reason: subscribed X-Auto-Response-Suppress: All X-GitHub-Recipient-Address: unbearable@ietf.org Archived-At: X-Mailman-Approved-At: Thu, 15 Dec 2016 12:48:16 -0800 Cc: Subscribed Subject: Re: [Unbearable] [TokenBinding/Internet-Drafts] TBPROTO: Not using uncompressed point from X9.62 (#62) X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Reply-To: TokenBinding/Internet-Drafts List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Dec 2016 20:42:24 -0000 ----==_mimepart_5853002d4b411_1ef363fa42ef5113c5645cf Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Closed #62. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/TokenBinding/Internet-Drafts/issues/62#event-895829968 ----==_mimepart_5853002d4b411_1ef363fa42ef5113c5645cf Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

Closed #62.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_5853002d4b411_1ef363fa42ef5113c5645cf-- From nobody Thu Dec 15 12:48:34 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 30DE1129473 for ; Thu, 15 Dec 2016 12:42:59 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.598 X-Spam-Level: X-Spam-Status: No, score=-5.598 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-2.896, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SAzRPG20dp9Z for ; Thu, 15 Dec 2016 12:42:57 -0800 (PST) Received: from o5.sgmail.github.com (o5.sgmail.github.com [192.254.113.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DFEB6129446 for ; Thu, 15 Dec 2016 12:42:56 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=3zk9NlleQrNxL3qi35yJkm1cA3k=; b=vhUKQUz/+ZAm9OQX GO/HCh12HVKLKwqRIrjGS2iYuXx95rwVqZt1SzvsvrbzA7PrRhb6TzvoQFRHepRy luGgmKmAxgkXjwq3ObPzvF1CPQUoFU1TQ2emOzTKl5tiDS2mqhGHlaHojjfNq8Lm oo798tHdXt2UArpWHMmxaIHZZ2o= Received: by filter0542p1mdw1.sendgrid.net with SMTP id filter0542p1mdw1-31623-5853002D-45 2016-12-15 20:42:21.495067425 +0000 UTC Received: from github-smtp2b-ext-cp1-prd.iad.github.net (github-smtp2b-ext-cp1-prd.iad.github.net [192.30.253.17]) by ismtpd0004p1iad1.sendgrid.net (SG) with ESMTP id lapLLAJEQD2WIWv91fPzZw for ; Thu, 15 Dec 2016 20:42:21.448 +0000 (UTC) Date: Thu, 15 Dec 2016 12:42:21 -0800 From: =JeffH To: TokenBinding/Internet-Drafts Message-ID: In-Reply-To: References: Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_5853002d5bacb_20bf3fbe15af513c160878"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list X-GitHub-Sender: equalsJeffH X-GitHub-Recipient: unbearable-ML X-GitHub-Reason: subscribed X-Auto-Response-Suppress: All X-GitHub-Recipient-Address: unbearable@ietf.org X-SG-EID: 9Yqp9dCIIwZxB0MVAPExrXlt7a4/46ALD9aG/N3UOYrc4EIqrwcIPomWbR6mwAkqghUlRdvhiUlmk3 tW1Q+a31FAVSgEYWo/FmwIuaE8woaczeeQ0gOVe5tlOpkWdr0yj8NAgUhEpmCb0YqrNmYX8t1VQThU 5d1kuE6hX5qXYKvEs4HexOKFbJQkbDk5LRMC+RfPNOMOeaKQA4qKCfT6VA== Archived-At: X-Mailman-Approved-At: Thu, 15 Dec 2016 12:48:16 -0800 Cc: Subscribed Subject: Re: [Unbearable] [TokenBinding/Internet-Drafts] TBPROTO: Not using uncompressed point from X9.62 (#62) X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Reply-To: TokenBinding/Internet-Drafts List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Dec 2016 20:42:59 -0000 ----==_mimepart_5853002d5bacb_20bf3fbe15af513c160878 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Though, after further discussion and review by the WG of PR#82, we have decided to not do this. see thread on mailing list beginning here.. https://www.ietf.org/mail-archive/web/unbearable/current/msg01019.html -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/TokenBinding/Internet-Drafts/issues/62#issuecomment-267438444 ----==_mimepart_5853002d5bacb_20bf3fbe15af513c160878 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable

Though, after further discussion and review by the WG of PR#82, we have = decided to not do this. see thread on mailing list beginning here..

https://www.ietf.org/mail-archive/web/unbearable/current/msg0101= 9.html

&mda= sh;
You are receiving this because you are subscribed to this thread.<= br />Reply to this email directly, view it on GitHub,= or mute the thread.3D=

= ----==_mimepart_5853002d5bacb_20bf3fbe15af513c160878-- From nobody Thu Dec 15 12:48:37 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8A013129473 for ; Thu, 15 Dec 2016 12:43:16 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.351 X-Spam-Level: X-Spam-Status: No, score=-3.351 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_20=1.546, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, RP_MATCHES_RCVD=-2.896, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id m_rWB7q6XrSY for ; Thu, 15 Dec 2016 12:43:15 -0800 (PST) Received: from o8.sgmail.github.com (o8.sgmail.github.com [167.89.101.199]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EE40A129446 for ; Thu, 15 Dec 2016 12:43:14 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=JQPN8gmpd5vaPPDtlpU8dB3/EWQ=; b=PjcknPVZmWJ5qU69 E9InvMiqL08fvfL8j3KP2hpBYl2P8QKtrNNyUYDwaS1qirsBIpQ4Sa+IEo8oeuEM HxX5BHnetXHnnZW3CwQ5O9xJCPysBvXpxNkwOLmcaZKQiEC6dfUJ7wwhPBgAKoOw D+vIEZ55IWt8nWQv+03u0HSp+2A= Received: by filter0462p1mdw1.sendgrid.net with SMTP id filter0462p1mdw1-27320-58530058-62 2016-12-15 20:43:04.986139891 +0000 UTC Received: from github-smtp2b-ext-cp1-prd.iad.github.net (github-smtp2b-ext-cp1-prd.iad.github.net [192.30.253.17]) by ismtpd0003p1iad1.sendgrid.net (SG) with ESMTP id G-Iu-DFuTHioh3kunyS_LA for ; Thu, 15 Dec 2016 20:43:04.987 +0000 (UTC) Date: Thu, 15 Dec 2016 12:43:04 -0800 From: =JeffH To: TokenBinding/Internet-Drafts Message-ID: In-Reply-To: References: Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_585300586aa06_60f33f922d4931401018c7"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list X-GitHub-Sender: equalsJeffH X-GitHub-Recipient: unbearable-ML X-GitHub-Reason: subscribed X-Auto-Response-Suppress: All X-GitHub-Recipient-Address: unbearable@ietf.org X-SG-EID: 9Yqp9dCIIwZxB0MVAPExrXlt7a4/46ALD9aG/N3UOYrWGpnzvP0KHLDDMnLm0XNl3zIxNFKM5cJXoA c7rPIA0VXCQ9KkLW8J9TJy3AoS3fbI3pr54a6TXqpSxjVI/I8pntCm/eE8nRYSHf3zt5xVxJ0RjT3b TuRHvwpjneTR7Pyb09MYntSj7Oaql3Up4mgH7EcWULIPuXfSgH0GMdJ1CA== Archived-At: X-Mailman-Approved-At: Thu, 15 Dec 2016 12:48:16 -0800 Cc: Subscribed Subject: Re: [Unbearable] [TokenBinding/Internet-Drafts] TBPROTO: TLS extension is not generic because the requirement is not generic (#65) X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Reply-To: TokenBinding/Internet-Drafts List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Dec 2016 20:43:16 -0000 ----==_mimepart_585300586aa06_60f33f922d4931401018c7 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit shall we close this issue? -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/TokenBinding/Internet-Drafts/issues/65#issuecomment-267438600 ----==_mimepart_585300586aa06_60f33f922d4931401018c7 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

shall we close this issue?

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_585300586aa06_60f33f922d4931401018c7-- From nobody Thu Dec 15 12:48:39 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 970DA129958 for ; Thu, 15 Dec 2016 12:44:35 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.402 X-Spam-Level: X-Spam-Status: No, score=-5.402 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ACUM2_VUBhLi for ; Thu, 15 Dec 2016 12:44:33 -0800 (PST) Received: from github-smtp2a-ext-cp1-prd.iad.github.net (github-smtp2-ext4.iad.github.net [192.30.252.195]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 48972129473 for ; Thu, 15 Dec 2016 12:44:33 -0800 (PST) Date: Thu, 15 Dec 2016 12:44:32 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1481834672; bh=w618/AvUm48UTUuCxQjjAddMGqunfp2/Eyx8Zg4cVwY=; h=From:Reply-To:To:Cc:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=cgp0j/Jb61G5B3zfPZp9YKP5y7h3P7OOtPAlxPBC5VNllmeXsR7jlPKFGoDq9q0ZJ o8/BKO0A5qXXVpNo9hANE900Rc1OAZ12cQFG7pkGeE4eedVy7GT/f8qTpV1egCPadg n52P9iztfFp6bmvgwjgivQD+HvXcv8pA/VJvgrdM= From: =JeffH To: TokenBinding/Internet-Drafts Message-ID: In-Reply-To: References: Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_585300b0a2727_5a4d3fde0c00513412164f3"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list X-GitHub-Sender: equalsJeffH X-GitHub-Recipient: unbearable-ML X-GitHub-Reason: subscribed X-Auto-Response-Suppress: All X-GitHub-Recipient-Address: unbearable@ietf.org Archived-At: X-Mailman-Approved-At: Thu, 15 Dec 2016 12:48:16 -0800 Cc: Subscribed Subject: Re: [Unbearable] [TokenBinding/Internet-Drafts] HTTPSTB: Origin binding (#69) X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Reply-To: TokenBinding/Internet-Drafts List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Dec 2016 20:44:35 -0000 ----==_mimepart_585300b0a2727_5a4d3fde0c00513412164f3 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Closed #69. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/TokenBinding/Internet-Drafts/issues/69#event-895832656 ----==_mimepart_585300b0a2727_5a4d3fde0c00513412164f3 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

Closed #69.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_585300b0a2727_5a4d3fde0c00513412164f3-- From nobody Thu Dec 15 12:48:41 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 96C9F12951B for ; Thu, 15 Dec 2016 12:44:56 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.298 X-Spam-Level: X-Spam-Status: No, score=-3.298 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-2.896, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qRJPeXA9WNDm for ; Thu, 15 Dec 2016 12:44:55 -0800 (PST) Received: from o11.sgmail.github.com (o11.sgmail.github.com [167.89.101.202]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DB723126CD8 for ; Thu, 15 Dec 2016 12:44:54 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=kc+AufQz1kaFW9VD5cwTahR4QnQ=; b=AQksA4Gxzgob6MKY vbAGD+yM+294CEw4aNocUPQ38F12xA614+ufkb1ZKGA3hrvYvTsmvpfRqwCy88ta 5W5jvZzwDZnRTA7KANyOkx/NjUHZptiHAYOFaSB3XbwGA1bxSxnJ45u6R2jxNwpt shfr8+k+BWF3IHnVJfspgivWHcw= Received: by filter0912p1mdw1.sendgrid.net with SMTP id filter0912p1mdw1-16106-585300B1-37 2016-12-15 20:44:33.414447348 +0000 UTC Received: from github-smtp2b-ext-cp1-prd.iad.github.net (github-smtp2b-ext-cp1-prd.iad.github.net [192.30.253.17]) by ismtpd0001p1iad1.sendgrid.net (SG) with ESMTP id tooh-9YFRmWWJMi3LSJc1Q for ; Thu, 15 Dec 2016 20:44:33.387 +0000 (UTC) Date: Thu, 15 Dec 2016 12:44:32 -0800 From: =JeffH To: TokenBinding/Internet-Drafts Message-ID: In-Reply-To: References: Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_585300b0c0d77_223c3f844fe69138877164"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list X-GitHub-Sender: equalsJeffH X-GitHub-Recipient: unbearable-ML X-GitHub-Reason: subscribed X-Auto-Response-Suppress: All X-GitHub-Recipient-Address: unbearable@ietf.org X-SG-EID: 9Yqp9dCIIwZxB0MVAPExrXlt7a4/46ALD9aG/N3UOYom6cafqtWYvO6hU00AHnf4KTe8xGrvpTZNOh gpx4pOVVAuX8ExA2Wj6s1MhNKklTMtTpE+QkJQIRQnug388HbKbbroslAPp3nRpt1JLE8YXSAcOu7L jXkRCEWCRfDTCMVoJdhchSsqi4TCcasetPpYugjeYkE5HHkrrUgAd415Bg== Archived-At: X-Mailman-Approved-At: Thu, 15 Dec 2016 12:48:16 -0800 Cc: Subscribed Subject: Re: [Unbearable] [TokenBinding/Internet-Drafts] HTTPSTB: Origin binding (#69) X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Reply-To: TokenBinding/Internet-Drafts List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Dec 2016 20:44:56 -0000 ----==_mimepart_585300b0c0d77_223c3f844fe69138877164 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit closing this issue given @Andrei-Popov 's comment above, two thumbs-up, and no dissension. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/TokenBinding/Internet-Drafts/issues/69#issuecomment-267438960 ----==_mimepart_585300b0c0d77_223c3f844fe69138877164 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

closing this issue given @Andrei-Popov 's comment above, two thumbs-up, and no dissension.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_585300b0c0d77_223c3f844fe69138877164-- From nobody Thu Dec 15 12:48:43 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7075F12948F for ; Thu, 15 Dec 2016 12:46:29 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.897 X-Spam-Level: X-Spam-Status: No, score=-4.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, RP_MATCHES_RCVD=-2.896, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OlqzOL2qKH5p for ; Thu, 15 Dec 2016 12:46:27 -0800 (PST) Received: from o9.sgmail.github.com (o9.sgmail.github.com [167.89.101.2]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3CA07129473 for ; Thu, 15 Dec 2016 12:46:26 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=KTzws78Dd3fSQ5VFd+joYFH50rc=; b=YYwsEUEeZqxGeFGm jCSNAMCmWc6MnsNX3+W6zUobwhnkblYh5IY7zy/7Ve1RwF1a1XS0K919evMQYNXN i74YT9B5n3/SVJgGrd29JZbwlX5EM0Via5/k27eB+VBOyOZCE3VUYhKS978PzY+a kjg+m1I9Ejsffxoof6/K/sHsuzA= Received: by filter0421p1mdw1.sendgrid.net with SMTP id filter0421p1mdw1-13988-58530120-31 2016-12-15 20:46:24.830401394 +0000 UTC Received: from github-smtp2b-ext-cp1-prd.iad.github.net (github-smtp2b-ext-cp1-prd.iad.github.net [192.30.253.17]) by ismtpd0004p1iad1.sendgrid.net (SG) with ESMTP id wP_fTZOATJWDBXYA0cjRYA for ; Thu, 15 Dec 2016 20:46:24.790 +0000 (UTC) Date: Thu, 15 Dec 2016 12:46:24 -0800 From: Andrei-Popov To: TokenBinding/Internet-Drafts Message-ID: In-Reply-To: References: Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_58530120adcdc_7cd23fe98ea6913858524f"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list X-GitHub-Sender: Andrei-Popov X-GitHub-Recipient: unbearable-ML X-GitHub-Reason: subscribed X-Auto-Response-Suppress: All X-GitHub-Recipient-Address: unbearable@ietf.org X-SG-EID: 9Yqp9dCIIwZxB0MVAPExrXlt7a4/46ALD9aG/N3UOYr+vwd/Vm/Srnw6eSig+nxJ6yrJm9rusofjNS i8xsBNhyj7J9WNYWsI/FMgymJGM2D4AZ87LyzqrLjZMlSn8dVCcruYqSbisB/YfVdItZnAH3WScfH0 mw6OWgPL8UXvq6aSwqThrt7daXDarwOJLQrw272QG28oXraew/1Asjx8JkG0YSd0vhqA/G7RV65FnH Q= Archived-At: X-Mailman-Approved-At: Thu, 15 Dec 2016 12:48:16 -0800 Cc: Subscribed Subject: Re: [Unbearable] [TokenBinding/Internet-Drafts] TBPROTO: TLS extension is not generic because the requirement is not generic (#65) X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Reply-To: TokenBinding/Internet-Drafts List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Dec 2016 20:46:29 -0000 ----==_mimepart_58530120adcdc_7cd23fe98ea6913858524f Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Both #65 and #69 seem intractable to me. From: =3DJeffH [mailto:notifications@github.com] Sent: Thursday, December 15, 2016 12:43 PM To: TokenBinding/Internet-Drafts Cc: Andrei Popov ; Comment Subject: Re: [TokenBinding/Internet-Drafts] TBPROTO: TLS extension is not g= eneric because the requirement is not generic (#65) shall we close this issue? =E2=80=94 You are receiving this because you commented. Reply to this email directly, view it on GitHub, or mute the thread<= https://github.com/notifications/unsubscribe-auth/AKho9XYbpZAQpTAuwxrbxBIkA= GwgoHtlks5rIaZYgaJpZM4Jexf7>. --=20 You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/TokenBinding/Internet-Drafts/issues/65#issuecomment-2674= 39371= ----==_mimepart_58530120adcdc_7cd23fe98ea6913858524f Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Both #65 and #69 seem intractable to me.

From: =3DJeffH [mailto:notifications@github.com]
Sent: Thursday, December 15, 2016 12:43 PM
To: TokenBinding/Internet-Drafts <Internet-Drafts@noreply.github.com>
Cc: Andrei Popov <Andrei.Popov@microsoft.com>; Comment <comment@no= reply.github.com>
Subject: Re: [TokenBinding/Internet-Drafts] TBPROTO: TLS extension is not g= eneric because the requirement is not generic (#65)


shall we close this issue?

=E2=80=94
You are receiving this because you commented.
Reply to this email directly, view it on GitHub<https://github.com/Token= Binding/Internet-Drafts/issues/65#issuecomment-267438600>, or mute the t= hread<https://github.com/notifications/unsubscribe-auth/AKho9XYbpZAQpTAu= wxrbxBIkAGwgoHtlks5rIaZYgaJpZM4Jexf7>.

&mda= sh;
You are receiving this because you are subscribed to this thread.<= br />Reply to this email directly, view it on GitHub,= or mute the thread.3D=

= ----==_mimepart_58530120adcdc_7cd23fe98ea6913858524f-- From nobody Mon Dec 19 11:26:47 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D2B401295DC for ; Mon, 19 Dec 2016 11:26:45 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=pingidentity.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6ygWSxdJ8asS for ; Mon, 19 Dec 2016 11:26:44 -0800 (PST) Received: from mail-it0-x232.google.com (mail-it0-x232.google.com [IPv6:2607:f8b0:4001:c0b::232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F390C1295C4 for ; Mon, 19 Dec 2016 11:26:43 -0800 (PST) Received: by mail-it0-x232.google.com with SMTP id c20so66419846itb.0 for ; Mon, 19 Dec 2016 11:26:43 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=pingidentity.com; s=gmail; h=mime-version:from:date:message-id:subject:to; bh=vkkI7ELyIg3mufvYqCeqHO76hD586fMWFxG7MkxExD0=; b=ax1CUoZXCTB27my6oWvpS9lQN4TgxZ0fitSQJOO4TiUSsFMM//F3fnqx4v4icI/iSJ 2Dged3KGptN1KcjlNzuLfEPAIXawtmH3H2arbFZyTObMDvzzcNMurxv5Xs+oK9Ntc2gF k5Xp+BxHKhHahOBGCZJwZgb2w0kvq6qiLdHa8= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=vkkI7ELyIg3mufvYqCeqHO76hD586fMWFxG7MkxExD0=; b=CqvCVHBkm5By+rkh+GdBvJZVF5mwNj67JuRqjrgvKQtVHdpdTmlOzcNX5LD7jkOJPi CbCicPE/3fjS/zrCd7bx8O7KW92e6FqsWQ6bb/M//gbRRkGqx5RuPwGAIy2wwCdO3nlO Er1NA511Id08hbjMg2bY4FmAOgU51RQ1Gsk6BLKpbekwau6YBa5XGrnA5eB6HDqGRgFL 4el35IJ20q5m9PHYr03jIj1AD5nfiJ6+0ApSjfhCpmAQ38FKpC4jB6XNErwlu6V90r7+ DVCosCZoE8CQNV58ZwwnVr3iJA6b/YwC+vvu5/N6wXHkHQeNEo55C1dYd8CdyH/uJ413 Tn+g== X-Gm-Message-State: AKaTC02rLRE045eHehKeRARUBvwfRzVZS2uQ1kOVJnNIQdhbO9HOGA8P7BteyFDV1IOC8gyc/mCDSGtzsBcQSCyI X-Received: by 10.36.57.75 with SMTP id l72mr18418150ita.11.1482175602789; Mon, 19 Dec 2016 11:26:42 -0800 (PST) MIME-Version: 1.0 Received: by 10.79.31.5 with HTTP; Mon, 19 Dec 2016 11:26:12 -0800 (PST) From: Brian Campbell Date: Mon, 19 Dec 2016 12:26:12 -0700 Message-ID: To: IETF Tokbind WG Content-Type: multipart/alternative; boundary=001a114a9a304ca485054407e6ad Archived-At: Subject: [Unbearable] (late) WGLC nit on TBNEGO X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 19 Dec 2016 19:26:46 -0000 --001a114a9a304ca485054407e6ad Content-Type: text/plain; charset=UTF-8 TBNEGO sec 6.2 mentions "these TLS versions" but other than in the section title doesn't say what those versions are. Astute readers can figure it out from the section title or also content in section 4 but it does reads somewhat awkward as it is now. I'd suggest adding wording similar to TBPROTO sec 7.5 and HTTPSTB sec 7.2 that has "in TLS 1.2 and older TLS versions" earlier in the paragraph. And maybe even going so far as having those three sections just have identical text. https://tools.ietf.org/html/draft-ietf-tokbind-negotiation-06#section-6.2 6.2. Triple Handshake Vulnerability in TLS 1.2 and Older TLS Versions The Token Binding protocol relies on the TLS Exporters [RFC5705] to associate a TLS connection with a Token Binding. The triple handshake attack [TRIPLE-HS] is a known TLS protocol vulnerability allowing the attacker to synchronize exported keying material between TLS connections. The attacker can then successfully replay bound tokens. For this reason, the Token Binding protocol MUST NOT be negotiated with these TLS versions, unless the Extended Master Secret [RFC7627] and Renegotiation Indication [RFC5746] TLS extensions have also been negotiated. https://tools.ietf.org/html/draft-ietf-tokbind-protocol-11#section-7.5 7.5. Triple Handshake Vulnerability in TLS 1.2 and Older TLS Versions The Token Binding protocol relies on the exported keying material (EKM) to associate a TLS connection with a Token Binding. The triple handshake attack [TRIPLE-HS] is a known vulnerability in TLS 1.2 and older TLS versions, allowing the attacker to synchronize keying material between TLS connections. The attacker can then successfully replay bound tokens. For this reason, the Token Binding protocol MUST NOT be negotiated with these TLS versions, unless the Extended Master Secret [RFC7627] and Renegotiation Indication [RFC5746] TLS extensions have also been negotiated. https://tools.ietf.org/html/draft-ietf-tokbind-https-07#section-7.2 7.2. Triple Handshake Vulnerability in TLS 1.2 and Older TLS Versions The Token Binding protocol relies on the exported key material (EKM) value [RFC5705] to associate a TLS connection with a TLS Token Binding. The triple handshake attack [TRIPLE-HS] is a known vulnerability in TLS 1.2 and older TLS versions, allowing the attacker to synchronize keying material between TLS connections. The attacker can then successfully replay bound tokens. For this reason, the Token Binding protocol MUST NOT be negotiated with these TLS versions, unless the Extended Master Secret [RFC7627] and Renegotiation Indication [RFC5746] TLS extensions have also been negotiated. --001a114a9a304ca485054407e6ad Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
TBNEGO sec 6.2 mentions "these TLS ver= sions" but other than in the section title doesn't say what those = versions are. Astute readers can figure it out from the section title or al= so content in section 4 but it does reads somewhat awkward as it is now. I&= #39;d suggest adding wording similar to TBPROTO sec 7.5 and HTTPSTB sec 7.2 that has "in TLS 1.2 and older TLS versions"= ; earlier in the paragraph. And maybe even going so far as having those thr= ee sections just have identical text. =C2=A0

https://too= ls.ietf.org/html/draft-ietf-tokbind-negotiation-06#section-6.2
6.2.= =C2=A0 Triple Handshake Vulnerability in TLS 1.2 and Older TLS Versions
=
=C2=A0=C2=A0 The Token Binding protocol relies on the TLS Exporters [RF= C5705] to
=C2=A0=C2=A0 associate a TLS connection with a Token Binding.= =C2=A0 The triple
=C2=A0=C2=A0 handshake attack [TRIPLE-HS] is a known T= LS protocol vulnerability
=C2=A0=C2=A0 allowing the attacker to synchron= ize exported keying material between
=C2=A0=C2=A0 TLS connections.=C2=A0= The attacker can then successfully replay bound
=C2=A0=C2=A0 tokens.=C2= =A0 For this reason, the Token Binding protocol MUST NOT be
=C2=A0=C2=A0= negotiated with these TLS versions, unless the Extended Master Secret
= =C2=A0=C2=A0 [RFC7627] and Renegotiation Indication [RFC5746] TLS extension= s have
=C2=A0=C2=A0 also been negotiated.


https://too= ls.ietf.org/html/draft-ietf-tokbind-protocol-11#section-7.5
7.5.=C2= =A0 Triple Handshake Vulnerability in TLS 1.2 and Older TLS Versions
=C2=A0=C2=A0 The Token Binding protocol relies on the exported keying mate= rial
=C2=A0=C2=A0 (EKM) to associate a TLS connection with a Token Bindi= ng.=C2=A0 The triple
=C2=A0=C2=A0 handshake attack [TRIPLE-HS] is a know= n vulnerability in TLS 1.2 and
=C2=A0=C2=A0 older TLS versions, allowing= the attacker to synchronize keying
=C2=A0=C2=A0 material between TLS co= nnections.=C2=A0 The attacker can then successfully
=C2=A0=C2=A0 replay = bound tokens.=C2=A0 For this reason, the Token Binding protocol
=C2=A0= =C2=A0 MUST NOT be negotiated with these TLS versions, unless the Extended<= br>=C2=A0=C2=A0 Master Secret [RFC7627] and Renegotiation Indication [RFC57= 46] TLS
=C2=A0=C2=A0 extensions have also been negotiated.


https://tools.ietf.org/html/draft-ietf-tokbind-https-07#section-7.2<= br>7.2.=C2=A0 Triple Handshake Vulnerability in TLS 1.2 and Older TLS Versi= ons

=C2=A0=C2=A0 The Token Binding protocol relies on the exported k= ey material (EKM)
=C2=A0=C2=A0 value [RFC5705] to associate a TLS connec= tion with a TLS Token
=C2=A0=C2=A0 Binding.=C2=A0 The triple handshake a= ttack [TRIPLE-HS] is a known
=C2=A0=C2=A0 vulnerability in TLS 1.2 and o= lder TLS versions, allowing the
=C2=A0=C2=A0 attacker to synchronize key= ing material between TLS connections.=C2=A0 The
=C2=A0=C2=A0 attacker ca= n then successfully replay bound tokens.=C2=A0 For this reason,
=C2=A0= =C2=A0 the Token Binding protocol MUST NOT be negotiated with these TLS
= =C2=A0=C2=A0 versions, unless the Extended Master Secret [RFC7627] and
= =C2=A0=C2=A0 Renegotiation Indication [RFC5746] TLS extensions have also be= en
=C2=A0=C2=A0 negotiated.


--001a114a9a304ca485054407e6ad-- From nobody Mon Dec 19 11:39:46 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 560F31295FB for ; Mon, 19 Dec 2016 11:39:45 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.002 X-Spam-Level: X-Spam-Status: No, score=-2.002 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mCg2J629VyHk for ; Mon, 19 Dec 2016 11:39:43 -0800 (PST) Received: from NAM02-BL2-obe.outbound.protection.outlook.com (mail-bl2nam02on0102.outbound.protection.outlook.com [104.47.38.102]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B6CB91295EE for ; Mon, 19 Dec 2016 11:39:42 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=Yw+Zqu8ClgU19hVdW2xM9mTbMkH4upt5FlY8qmjbAAg=; b=c+afXERvo/DEfrL2yCb6/SiHb6zKY8t3rwgMSfGAB0dFaF2iTQuUNdxgBDOPvakVSVeavaAHjAKkXpNGV78bs9Kk3/tqG4HB5/EFX9q7ZCjE4lN+AGXj2p3VLYj2pbmTpHgqrsRcP/aAf50hZLegxPjn2rqEJ5iZKCYLwWkfVIc= Received: from CY1PR0301MB0842.namprd03.prod.outlook.com (10.160.163.148) by CY1PR0301MB0843.namprd03.prod.outlook.com (10.160.163.149) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.789.14; Mon, 19 Dec 2016 19:39:38 +0000 Received: from CY1PR0301MB0842.namprd03.prod.outlook.com ([10.160.163.148]) by CY1PR0301MB0842.namprd03.prod.outlook.com ([10.160.163.148]) with mapi id 15.01.0789.018; Mon, 19 Dec 2016 19:39:38 +0000 From: Andrei Popov To: Brian Campbell , IETF Tokbind WG Thread-Topic: [Unbearable] (late) WGLC nit on TBNEGO Thread-Index: AQHSWi3gZpKzb7ukQkWKpeoPtNoJgaEPqqnQ Date: Mon, 19 Dec 2016 19:39:37 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Andrei.Popov@microsoft.com; x-originating-ip: [2001:4898:80e8:a::1d2] x-ms-office365-filtering-correlation-id: 9a53abf1-57bc-46de-1b51-08d42846c4c3 x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001); SRVR:CY1PR0301MB0843; x-microsoft-exchange-diagnostics: 1; CY1PR0301MB0843; 7:hLzMXCrydhnnZGF6tHpfw+OmZ6ASJhYUrAHdWJXfZlFQhUU3Dtl2ogOY0z+WyUESWpjItlAfRkQ+YTIglw8WWzvOBatf/xfmGeypwr9OiaRYs7jkYbVLrInV97DkctgyAMlevtPjSqokCAngvO0dvzeBa5KgVVN+iYU5X6NAdx5+znu3cSYxtWIye4yEOTn3Z0OukshvqmKrNi6c6+mGlH76LHMtKz2gGiStNFQ3I2RNACCHPdqMaNxfYIN0HzTEO+bCw1zOZwG7rDxcPcdxOTHZ+akiDqFrPhqYNNSlDtMj6HgaFGKN7dwD/PBq42JGQWKXbboltezxAkcmFoyhFxXjBFMd+M4gRGPA2QMrlsztVuDvfING9IbB4zDLXW/BpyX8+1/d5z7vj0hkDOG1OHSa0CU+lJRVo9yfs1Lb31wbB0GUUPRvDSACO6+4cP0Sg98B1Xp2zJj+/eSCE6teYSS9a7+khRuowphltyAR0Zs= x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(21748063052155); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040375)(601004)(2401047)(8121501046)(5005006)(3002001)(10201501046)(6055026)(61426038)(61427038)(6041248)(20161123562025)(20161123555025)(20161123564025)(20161123560025)(6042181)(6072148)(6047074); SRVR:CY1PR0301MB0843; BCL:0; PCL:0; RULEID:; SRVR:CY1PR0301MB0843; x-forefront-prvs: 01613DFDC8 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(7916002)(189002)(199003)(377454003)(6436002)(7906003)(10290500002)(5005710100001)(8676002)(122556002)(68736007)(105586002)(99286002)(7736002)(106116001)(10090500001)(81166006)(8936002)(189998001)(9686002)(81156014)(50986999)(19609705001)(74316002)(76176999)(76576001)(3280700002)(3660700001)(106356001)(101416001)(54356999)(86612001)(86362001)(2906002)(92566002)(2900100001)(6116002)(102836003)(790700001)(33656002)(229853002)(5660300001)(77096006)(606005)(38730400001)(6506006)(8990500004)(25786008)(97736004)(5001770100001)(107886002)(7696004)(2950100002); DIR:OUT; SFP:1102; SCL:1; SRVR:CY1PR0301MB0843; H:CY1PR0301MB0842.namprd03.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:1; LANG:en; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_CY1PR0301MB0842196A4EBA78B0359BFC308C910CY1PR0301MB0842_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 19 Dec 2016 19:39:37.7563 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY1PR0301MB0843 Archived-At: Subject: Re: [Unbearable] (late) WGLC nit on TBNEGO X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 19 Dec 2016 19:39:45 -0000 --_000_CY1PR0301MB0842196A4EBA78B0359BFC308C910CY1PR0301MB0842_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 R29vZCBwb2ludCwgdGhhbmtzLCBCcmlhbiwgZm9yIGNhdGNoaW5nIHRoaXMuIFdpbGwgZml4IGlu IHRoZSBuZXh0IHJldmlzaW9uLg0KDQpDaGVlcnMsDQoNCkFuZHJlaQ0KDQpGcm9tOiBVbmJlYXJh YmxlIFttYWlsdG86dW5iZWFyYWJsZS1ib3VuY2VzQGlldGYub3JnXSBPbiBCZWhhbGYgT2YgQnJp YW4gQ2FtcGJlbGwNClNlbnQ6IE1vbmRheSwgRGVjZW1iZXIgMTksIDIwMTYgMTE6MjYgQU0NClRv OiBJRVRGIFRva2JpbmQgV0cgPHVuYmVhcmFibGVAaWV0Zi5vcmc+DQpTdWJqZWN0OiBbVW5iZWFy YWJsZV0gKGxhdGUpIFdHTEMgbml0IG9uIFRCTkVHTw0KDQpUQk5FR08gc2VjIDYuMjxodHRwczov L3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQtaWV0Zi10b2tiaW5kLW5lZ290aWF0aW9uLTA2I3Nl Y3Rpb24tNi4yPiBtZW50aW9ucyAidGhlc2UgVExTIHZlcnNpb25zIiBidXQgb3RoZXIgdGhhbiBp biB0aGUgc2VjdGlvbiB0aXRsZSBkb2Vzbid0IHNheSB3aGF0IHRob3NlIHZlcnNpb25zIGFyZS4g QXN0dXRlIHJlYWRlcnMgY2FuIGZpZ3VyZSBpdCBvdXQgZnJvbSB0aGUgc2VjdGlvbiB0aXRsZSBv ciBhbHNvIGNvbnRlbnQgaW4gc2VjdGlvbiA0IGJ1dCBpdCBkb2VzIHJlYWRzIHNvbWV3aGF0IGF3 a3dhcmQgYXMgaXQgaXMgbm93LiBJJ2Qgc3VnZ2VzdCBhZGRpbmcgd29yZGluZyBzaW1pbGFyIHRv IFRCUFJPVE8gc2VjIDcuNTxodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQtaWV0Zi10 b2tiaW5kLXByb3RvY29sLTExI3NlY3Rpb24tNy41PiBhbmQgSFRUUFNUQiBzZWMgNy4yPGh0dHBz Oi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1pZXRmLXRva2JpbmQtaHR0cHMtMDcjc2VjdGlv bi03LjI+IHRoYXQgaGFzICJpbiBUTFMgMS4yIGFuZCBvbGRlciBUTFMgdmVyc2lvbnMiIGVhcmxp ZXIgaW4gdGhlIHBhcmFncmFwaC4gQW5kIG1heWJlIGV2ZW4gZ29pbmcgc28gZmFyIGFzIGhhdmlu ZyB0aG9zZSB0aHJlZSBzZWN0aW9ucyBqdXN0IGhhdmUgaWRlbnRpY2FsIHRleHQuDQoNCmh0dHBz Oi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1pZXRmLXRva2JpbmQtbmVnb3RpYXRpb24tMDYj c2VjdGlvbi02LjINCjYuMi4gIFRyaXBsZSBIYW5kc2hha2UgVnVsbmVyYWJpbGl0eSBpbiBUTFMg MS4yIGFuZCBPbGRlciBUTFMgVmVyc2lvbnMNCg0KICAgVGhlIFRva2VuIEJpbmRpbmcgcHJvdG9j b2wgcmVsaWVzIG9uIHRoZSBUTFMgRXhwb3J0ZXJzIFtSRkM1NzA1XSB0bw0KICAgYXNzb2NpYXRl IGEgVExTIGNvbm5lY3Rpb24gd2l0aCBhIFRva2VuIEJpbmRpbmcuICBUaGUgdHJpcGxlDQogICBo YW5kc2hha2UgYXR0YWNrIFtUUklQTEUtSFNdIGlzIGEga25vd24gVExTIHByb3RvY29sIHZ1bG5l cmFiaWxpdHkNCiAgIGFsbG93aW5nIHRoZSBhdHRhY2tlciB0byBzeW5jaHJvbml6ZSBleHBvcnRl ZCBrZXlpbmcgbWF0ZXJpYWwgYmV0d2Vlbg0KICAgVExTIGNvbm5lY3Rpb25zLiAgVGhlIGF0dGFj a2VyIGNhbiB0aGVuIHN1Y2Nlc3NmdWxseSByZXBsYXkgYm91bmQNCiAgIHRva2Vucy4gIEZvciB0 aGlzIHJlYXNvbiwgdGhlIFRva2VuIEJpbmRpbmcgcHJvdG9jb2wgTVVTVCBOT1QgYmUNCiAgIG5l Z290aWF0ZWQgd2l0aCB0aGVzZSBUTFMgdmVyc2lvbnMsIHVubGVzcyB0aGUgRXh0ZW5kZWQgTWFz dGVyIFNlY3JldA0KICAgW1JGQzc2MjddIGFuZCBSZW5lZ290aWF0aW9uIEluZGljYXRpb24gW1JG QzU3NDZdIFRMUyBleHRlbnNpb25zIGhhdmUNCiAgIGFsc28gYmVlbiBuZWdvdGlhdGVkLg0KDQoN Cmh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1pZXRmLXRva2JpbmQtcHJvdG9jb2wt MTEjc2VjdGlvbi03LjUNCjcuNS4gIFRyaXBsZSBIYW5kc2hha2UgVnVsbmVyYWJpbGl0eSBpbiBU TFMgMS4yIGFuZCBPbGRlciBUTFMgVmVyc2lvbnMNCg0KICAgVGhlIFRva2VuIEJpbmRpbmcgcHJv dG9jb2wgcmVsaWVzIG9uIHRoZSBleHBvcnRlZCBrZXlpbmcgbWF0ZXJpYWwNCiAgIChFS00pIHRv IGFzc29jaWF0ZSBhIFRMUyBjb25uZWN0aW9uIHdpdGggYSBUb2tlbiBCaW5kaW5nLiAgVGhlIHRy aXBsZQ0KICAgaGFuZHNoYWtlIGF0dGFjayBbVFJJUExFLUhTXSBpcyBhIGtub3duIHZ1bG5lcmFi aWxpdHkgaW4gVExTIDEuMiBhbmQNCiAgIG9sZGVyIFRMUyB2ZXJzaW9ucywgYWxsb3dpbmcgdGhl IGF0dGFja2VyIHRvIHN5bmNocm9uaXplIGtleWluZw0KICAgbWF0ZXJpYWwgYmV0d2VlbiBUTFMg Y29ubmVjdGlvbnMuICBUaGUgYXR0YWNrZXIgY2FuIHRoZW4gc3VjY2Vzc2Z1bGx5DQogICByZXBs YXkgYm91bmQgdG9rZW5zLiAgRm9yIHRoaXMgcmVhc29uLCB0aGUgVG9rZW4gQmluZGluZyBwcm90 b2NvbA0KICAgTVVTVCBOT1QgYmUgbmVnb3RpYXRlZCB3aXRoIHRoZXNlIFRMUyB2ZXJzaW9ucywg dW5sZXNzIHRoZSBFeHRlbmRlZA0KICAgTWFzdGVyIFNlY3JldCBbUkZDNzYyN10gYW5kIFJlbmVn b3RpYXRpb24gSW5kaWNhdGlvbiBbUkZDNTc0Nl0gVExTDQogICBleHRlbnNpb25zIGhhdmUgYWxz byBiZWVuIG5lZ290aWF0ZWQuDQoNCg0KaHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0 LWlldGYtdG9rYmluZC1odHRwcy0wNyNzZWN0aW9uLTcuMg0KNy4yLiAgVHJpcGxlIEhhbmRzaGFr ZSBWdWxuZXJhYmlsaXR5IGluIFRMUyAxLjIgYW5kIE9sZGVyIFRMUyBWZXJzaW9ucw0KDQogICBU aGUgVG9rZW4gQmluZGluZyBwcm90b2NvbCByZWxpZXMgb24gdGhlIGV4cG9ydGVkIGtleSBtYXRl cmlhbCAoRUtNKQ0KICAgdmFsdWUgW1JGQzU3MDVdIHRvIGFzc29jaWF0ZSBhIFRMUyBjb25uZWN0 aW9uIHdpdGggYSBUTFMgVG9rZW4NCiAgIEJpbmRpbmcuICBUaGUgdHJpcGxlIGhhbmRzaGFrZSBh dHRhY2sgW1RSSVBMRS1IU10gaXMgYSBrbm93bg0KICAgdnVsbmVyYWJpbGl0eSBpbiBUTFMgMS4y IGFuZCBvbGRlciBUTFMgdmVyc2lvbnMsIGFsbG93aW5nIHRoZQ0KICAgYXR0YWNrZXIgdG8gc3lu Y2hyb25pemUga2V5aW5nIG1hdGVyaWFsIGJldHdlZW4gVExTIGNvbm5lY3Rpb25zLiAgVGhlDQog ICBhdHRhY2tlciBjYW4gdGhlbiBzdWNjZXNzZnVsbHkgcmVwbGF5IGJvdW5kIHRva2Vucy4gIEZv ciB0aGlzIHJlYXNvbiwNCiAgIHRoZSBUb2tlbiBCaW5kaW5nIHByb3RvY29sIE1VU1QgTk9UIGJl IG5lZ290aWF0ZWQgd2l0aCB0aGVzZSBUTFMNCiAgIHZlcnNpb25zLCB1bmxlc3MgdGhlIEV4dGVu ZGVkIE1hc3RlciBTZWNyZXQgW1JGQzc2MjddIGFuZA0KICAgUmVuZWdvdGlhdGlvbiBJbmRpY2F0 aW9uIFtSRkM1NzQ2XSBUTFMgZXh0ZW5zaW9ucyBoYXZlIGFsc28gYmVlbg0KICAgbmVnb3RpYXRl ZC4NCg0K --_000_CY1PR0301MB0842196A4EBA78B0359BFC308C910CY1PR0301MB0842_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIixzZXJpZjt9 DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCglj b2xvcjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFu Lk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpw dXJwbGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLm1zb25vcm1hbDAsIGxpLm1z b25vcm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCglt c28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTIuMHB0Ow0K CWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iLHNlcmlmO30NCnNwYW4uRW1haWxTdHlsZTE4 DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJp IixzYW5zLXNlcmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNv LXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2Vy aWY7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjox LjBpbiAxLjBpbiAxLjBpbiAxLjBpbjt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNl Y3Rpb24xO30NCi0tPjwvc3R5bGU+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWRl ZmF1bHRzIHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2IiAvPg0KPC94bWw+PCFbZW5kaWZdLS0+ PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWxheW91dCB2OmV4dD0iZWRpdCI+DQo8 bzppZG1hcCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4NCjwvbzpzaGFwZWxheW91dD48L3htbD48 IVtlbmRpZl0tLT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9IkVOLVVTIiBsaW5rPSJibHVlIiB2bGlu az0icHVycGxlIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxp YnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkdvb2QgcG9pbnQsIHRoYW5rcywgQnJpYW4sIGZvciBjYXRj aGluZyB0aGlzLiBXaWxsIGZpeCBpbiB0aGUgbmV4dCByZXZpc2lvbi48bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+Jm5ic3A7 PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+ Q2hlZXJzLDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2Fs aWJyaSZxdW90OyxzYW5zLXNlcmlmIj5BbmRyZWk8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+RnJvbTo8L3Nw YW4+PC9iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nh bGlicmkmcXVvdDssc2Fucy1zZXJpZiI+IFVuYmVhcmFibGUgW21haWx0bzp1bmJlYXJhYmxlLWJv dW5jZXNAaWV0Zi5vcmddDQo8Yj5PbiBCZWhhbGYgT2YgPC9iPkJyaWFuIENhbXBiZWxsPGJyPg0K PGI+U2VudDo8L2I+IE1vbmRheSwgRGVjZW1iZXIgMTksIDIwMTYgMTE6MjYgQU08YnI+DQo8Yj5U bzo8L2I+IElFVEYgVG9rYmluZCBXRyAmbHQ7dW5iZWFyYWJsZUBpZXRmLm9yZyZndDs8YnI+DQo8 Yj5TdWJqZWN0OjwvYj4gW1VuYmVhcmFibGVdIChsYXRlKSBXR0xDIG5pdCBvbiBUQk5FR088bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpw PjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWJvdHRvbTox Mi4wcHQiPjxhIGhyZWY9Imh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1pZXRmLXRv a2JpbmQtbmVnb3RpYXRpb24tMDYjc2VjdGlvbi02LjIiPlRCTkVHTyBzZWMgNi4yPC9hPiBtZW50 aW9ucyAmcXVvdDt0aGVzZSBUTFMgdmVyc2lvbnMmcXVvdDsgYnV0IG90aGVyIHRoYW4gaW4gdGhl IHNlY3Rpb24gdGl0bGUgZG9lc24ndCBzYXkgd2hhdCB0aG9zZSB2ZXJzaW9ucyBhcmUuIEFzdHV0 ZQ0KIHJlYWRlcnMgY2FuIGZpZ3VyZSBpdCBvdXQgZnJvbSB0aGUgc2VjdGlvbiB0aXRsZSBvciBh bHNvIGNvbnRlbnQgaW4gc2VjdGlvbiA0IGJ1dCBpdCBkb2VzIHJlYWRzIHNvbWV3aGF0IGF3a3dh cmQgYXMgaXQgaXMgbm93LiBJJ2Qgc3VnZ2VzdCBhZGRpbmcgd29yZGluZyBzaW1pbGFyIHRvDQo8 YSBocmVmPSJodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQtaWV0Zi10b2tiaW5kLXBy b3RvY29sLTExI3NlY3Rpb24tNy41Ij4NClRCUFJPVE8gc2VjIDcuNTwvYT4gYW5kIDxhIGhyZWY9 Imh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1pZXRmLXRva2JpbmQtaHR0cHMtMDcj c2VjdGlvbi03LjIiPg0KSFRUUFNUQiBzZWMgNy4yPC9hPiB0aGF0IGhhcyAmcXVvdDtpbiBUTFMg MS4yIGFuZCBvbGRlciBUTFMgdmVyc2lvbnMmcXVvdDsgZWFybGllciBpbiB0aGUgcGFyYWdyYXBo LiBBbmQgbWF5YmUgZXZlbiBnb2luZyBzbyBmYXIgYXMgaGF2aW5nIHRob3NlIHRocmVlIHNlY3Rp b25zIGp1c3QgaGF2ZSBpZGVudGljYWwgdGV4dC4gJm5ic3A7DQo8YnI+DQo8YnI+DQo8YSBocmVm PSJodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQtaWV0Zi10b2tiaW5kLW5lZ290aWF0 aW9uLTA2I3NlY3Rpb24tNi4yIj5odHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQtaWV0 Zi10b2tiaW5kLW5lZ290aWF0aW9uLTA2I3NlY3Rpb24tNi4yPC9hPjxicj4NCjYuMi4mbmJzcDsg VHJpcGxlIEhhbmRzaGFrZSBWdWxuZXJhYmlsaXR5IGluIFRMUyAxLjIgYW5kIE9sZGVyIFRMUyBW ZXJzaW9uczxicj4NCjxicj4NCiZuYnNwOyZuYnNwOyBUaGUgVG9rZW4gQmluZGluZyBwcm90b2Nv bCByZWxpZXMgb24gdGhlIFRMUyBFeHBvcnRlcnMgW1JGQzU3MDVdIHRvPGJyPg0KJm5ic3A7Jm5i c3A7IGFzc29jaWF0ZSBhIFRMUyBjb25uZWN0aW9uIHdpdGggYSBUb2tlbiBCaW5kaW5nLiZuYnNw OyBUaGUgdHJpcGxlPGJyPg0KJm5ic3A7Jm5ic3A7IGhhbmRzaGFrZSBhdHRhY2sgW1RSSVBMRS1I U10gaXMgYSBrbm93biBUTFMgcHJvdG9jb2wgdnVsbmVyYWJpbGl0eTxicj4NCiZuYnNwOyZuYnNw OyBhbGxvd2luZyB0aGUgYXR0YWNrZXIgdG8gc3luY2hyb25pemUgZXhwb3J0ZWQga2V5aW5nIG1h dGVyaWFsIGJldHdlZW48YnI+DQombmJzcDsmbmJzcDsgVExTIGNvbm5lY3Rpb25zLiZuYnNwOyBU aGUgYXR0YWNrZXIgY2FuIHRoZW4gc3VjY2Vzc2Z1bGx5IHJlcGxheSBib3VuZDxicj4NCiZuYnNw OyZuYnNwOyB0b2tlbnMuJm5ic3A7IEZvciB0aGlzIHJlYXNvbiwgdGhlIFRva2VuIEJpbmRpbmcg cHJvdG9jb2wgTVVTVCBOT1QgYmU8YnI+DQombmJzcDsmbmJzcDsgbmVnb3RpYXRlZCB3aXRoIHRo ZXNlIFRMUyB2ZXJzaW9ucywgdW5sZXNzIHRoZSBFeHRlbmRlZCBNYXN0ZXIgU2VjcmV0PGJyPg0K Jm5ic3A7Jm5ic3A7IFtSRkM3NjI3XSBhbmQgUmVuZWdvdGlhdGlvbiBJbmRpY2F0aW9uIFtSRkM1 NzQ2XSBUTFMgZXh0ZW5zaW9ucyBoYXZlPGJyPg0KJm5ic3A7Jm5ic3A7IGFsc28gYmVlbiBuZWdv dGlhdGVkLjxicj4NCjxicj4NCjxicj4NCjxhIGhyZWY9Imh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcv aHRtbC9kcmFmdC1pZXRmLXRva2JpbmQtcHJvdG9jb2wtMTEjc2VjdGlvbi03LjUiPmh0dHBzOi8v dG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1pZXRmLXRva2JpbmQtcHJvdG9jb2wtMTEjc2VjdGlv bi03LjU8L2E+PGJyPg0KNy41LiZuYnNwOyBUcmlwbGUgSGFuZHNoYWtlIFZ1bG5lcmFiaWxpdHkg aW4gVExTIDEuMiBhbmQgT2xkZXIgVExTIFZlcnNpb25zPGJyPg0KPGJyPg0KJm5ic3A7Jm5ic3A7 IFRoZSBUb2tlbiBCaW5kaW5nIHByb3RvY29sIHJlbGllcyBvbiB0aGUgZXhwb3J0ZWQga2V5aW5n IG1hdGVyaWFsPGJyPg0KJm5ic3A7Jm5ic3A7IChFS00pIHRvIGFzc29jaWF0ZSBhIFRMUyBjb25u ZWN0aW9uIHdpdGggYSBUb2tlbiBCaW5kaW5nLiZuYnNwOyBUaGUgdHJpcGxlPGJyPg0KJm5ic3A7 Jm5ic3A7IGhhbmRzaGFrZSBhdHRhY2sgW1RSSVBMRS1IU10gaXMgYSBrbm93biB2dWxuZXJhYmls aXR5IGluIFRMUyAxLjIgYW5kPGJyPg0KJm5ic3A7Jm5ic3A7IG9sZGVyIFRMUyB2ZXJzaW9ucywg YWxsb3dpbmcgdGhlIGF0dGFja2VyIHRvIHN5bmNocm9uaXplIGtleWluZzxicj4NCiZuYnNwOyZu YnNwOyBtYXRlcmlhbCBiZXR3ZWVuIFRMUyBjb25uZWN0aW9ucy4mbmJzcDsgVGhlIGF0dGFja2Vy IGNhbiB0aGVuIHN1Y2Nlc3NmdWxseTxicj4NCiZuYnNwOyZuYnNwOyByZXBsYXkgYm91bmQgdG9r ZW5zLiZuYnNwOyBGb3IgdGhpcyByZWFzb24sIHRoZSBUb2tlbiBCaW5kaW5nIHByb3RvY29sPGJy Pg0KJm5ic3A7Jm5ic3A7IE1VU1QgTk9UIGJlIG5lZ290aWF0ZWQgd2l0aCB0aGVzZSBUTFMgdmVy c2lvbnMsIHVubGVzcyB0aGUgRXh0ZW5kZWQ8YnI+DQombmJzcDsmbmJzcDsgTWFzdGVyIFNlY3Jl dCBbUkZDNzYyN10gYW5kIFJlbmVnb3RpYXRpb24gSW5kaWNhdGlvbiBbUkZDNTc0Nl0gVExTPGJy Pg0KJm5ic3A7Jm5ic3A7IGV4dGVuc2lvbnMgaGF2ZSBhbHNvIGJlZW4gbmVnb3RpYXRlZC48YnI+ DQo8YnI+DQo8YnI+DQo8YSBocmVmPSJodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQt aWV0Zi10b2tiaW5kLWh0dHBzLTA3I3NlY3Rpb24tNy4yIj5odHRwczovL3Rvb2xzLmlldGYub3Jn L2h0bWwvZHJhZnQtaWV0Zi10b2tiaW5kLWh0dHBzLTA3I3NlY3Rpb24tNy4yPC9hPjxicj4NCjcu Mi4mbmJzcDsgVHJpcGxlIEhhbmRzaGFrZSBWdWxuZXJhYmlsaXR5IGluIFRMUyAxLjIgYW5kIE9s ZGVyIFRMUyBWZXJzaW9uczxicj4NCjxicj4NCiZuYnNwOyZuYnNwOyBUaGUgVG9rZW4gQmluZGlu ZyBwcm90b2NvbCByZWxpZXMgb24gdGhlIGV4cG9ydGVkIGtleSBtYXRlcmlhbCAoRUtNKTxicj4N CiZuYnNwOyZuYnNwOyB2YWx1ZSBbUkZDNTcwNV0gdG8gYXNzb2NpYXRlIGEgVExTIGNvbm5lY3Rp b24gd2l0aCBhIFRMUyBUb2tlbjxicj4NCiZuYnNwOyZuYnNwOyBCaW5kaW5nLiZuYnNwOyBUaGUg dHJpcGxlIGhhbmRzaGFrZSBhdHRhY2sgW1RSSVBMRS1IU10gaXMgYSBrbm93bjxicj4NCiZuYnNw OyZuYnNwOyB2dWxuZXJhYmlsaXR5IGluIFRMUyAxLjIgYW5kIG9sZGVyIFRMUyB2ZXJzaW9ucywg YWxsb3dpbmcgdGhlPGJyPg0KJm5ic3A7Jm5ic3A7IGF0dGFja2VyIHRvIHN5bmNocm9uaXplIGtl eWluZyBtYXRlcmlhbCBiZXR3ZWVuIFRMUyBjb25uZWN0aW9ucy4mbmJzcDsgVGhlPGJyPg0KJm5i c3A7Jm5ic3A7IGF0dGFja2VyIGNhbiB0aGVuIHN1Y2Nlc3NmdWxseSByZXBsYXkgYm91bmQgdG9r ZW5zLiZuYnNwOyBGb3IgdGhpcyByZWFzb24sPGJyPg0KJm5ic3A7Jm5ic3A7IHRoZSBUb2tlbiBC aW5kaW5nIHByb3RvY29sIE1VU1QgTk9UIGJlIG5lZ290aWF0ZWQgd2l0aCB0aGVzZSBUTFM8YnI+ DQombmJzcDsmbmJzcDsgdmVyc2lvbnMsIHVubGVzcyB0aGUgRXh0ZW5kZWQgTWFzdGVyIFNlY3Jl dCBbUkZDNzYyN10gYW5kPGJyPg0KJm5ic3A7Jm5ic3A7IFJlbmVnb3RpYXRpb24gSW5kaWNhdGlv biBbUkZDNTc0Nl0gVExTIGV4dGVuc2lvbnMgaGF2ZSBhbHNvIGJlZW48YnI+DQombmJzcDsmbmJz cDsgbmVnb3RpYXRlZC48YnI+DQo8YnI+DQo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+ DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_CY1PR0301MB0842196A4EBA78B0359BFC308C910CY1PR0301MB0842_-- From nobody Mon Dec 19 14:20:34 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 71B1A129473 for ; Thu, 15 Dec 2016 12:54:11 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.883 X-Spam-Level: X-Spam-Status: No, score=-4.883 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H2=-0.001, RCVD_IN_SORBS_SPAM=0.5, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1f7HXl2GnB8N for ; Thu, 15 Dec 2016 12:54:10 -0800 (PST) Received: from github-smtp2b-ext-cp1-prd.iad.github.net (github-smtp2-ext2.iad.github.net [192.30.252.193]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F4128129B4B for ; Thu, 15 Dec 2016 12:53:21 -0800 (PST) Date: Thu, 15 Dec 2016 12:53:21 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1481835201; bh=e2LkIWOtuMAKmUpLjJ5GWmtDJn5+zaa+mlqiPj6qUdE=; h=From:Reply-To:To:Cc:In-Reply-To:References:Subject:List-ID: List-Archive:List-Post:List-Unsubscribe:From; b=yHTRjYd8AIgRMz3nGZX2JWSCqEq2gg/WQr0DsX1E2z51cpgNa7ZuOOyTGr0LDwasQ UcicAgxiOZotcgW+b6xyjLKcgxTt4zS6gJXoA/e6kK94weC3Fh7c50XWjIyFTgZGKq 5aElZhMrtCQmZLR8jc1/Gk/xN4c2//8rFMJaK0m4= From: =JeffH To: TokenBinding/Internet-Drafts Message-ID: In-Reply-To: References: Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_585302c12fa5f_60f63f922d493140297654"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list X-GitHub-Sender: equalsJeffH X-GitHub-Recipient: unbearable-ML X-GitHub-Reason: subscribed X-Auto-Response-Suppress: All X-GitHub-Recipient-Address: unbearable@ietf.org Archived-At: X-Mailman-Approved-At: Mon, 19 Dec 2016 14:20:33 -0800 Cc: Subscribed Subject: Re: [Unbearable] [TokenBinding/Internet-Drafts] TBPROTO: TLS extension is not generic because the requirement is not generic (#65) X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Reply-To: TokenBinding/Internet-Drafts List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Dec 2016 20:54:11 -0000 ----==_mimepart_585302c12fa5f_60f63f922d493140297654 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Closed #65. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/TokenBinding/Internet-Drafts/issues/65#event-895843687 ----==_mimepart_585302c12fa5f_60f63f922d493140297654 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

Closed #65.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_585302c12fa5f_60f63f922d493140297654-- From nobody Mon Dec 19 14:20:38 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3DA82129651 for ; Mon, 19 Dec 2016 14:15:02 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7.001 X-Spam-Level: X-Spam-Status: No, score=-7.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Slxcg23Znwuk for ; Mon, 19 Dec 2016 14:15:00 -0800 (PST) Received: from github-smtp2a-ext-cp1-prd.iad.github.net (github-smtp2-ext8.iad.github.net [192.30.252.199]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B8DC81294B0 for ; Mon, 19 Dec 2016 14:15:00 -0800 (PST) Date: Mon, 19 Dec 2016 14:14:59 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=github.com; s=pf2014; t=1482185699; bh=D0N/NSiit4LPujbusse7cYLxnFdi+7/buJDAEBZFxqU=; h=From:Reply-To:To:Cc:Subject:List-ID:List-Archive:List-Post: List-Unsubscribe:From; b=TdJbgfu0CPcOjJJRXuUcmCUsLmzc4dMpDiI1jmz5IVC9lL2Vp2I4MbEyv6abEa0MA 67JqxKmkjRoJgRheHK08mqOsGRmaWIPIeBSgcmeAH8a1SAtGI9EY6QMXQoicZGOnIJ wzcvy4g/CFDhp9LDq36bsW3G0ARzlNrNIoho6Kis= From: Brian Campbell To: TokenBinding/Internet-Drafts Message-ID: Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_58585be38afbf_3e923fcfb7fb313493632"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list X-GitHub-Sender: b---c X-GitHub-Recipient: unbearable-ML X-GitHub-Reason: subscribed X-Auto-Response-Suppress: All X-GitHub-Recipient-Address: unbearable@ietf.org Archived-At: X-Mailman-Approved-At: Mon, 19 Dec 2016 14:20:33 -0800 Cc: Subscribed Subject: [Unbearable] [TokenBinding/Internet-Drafts] OAuth is authorization protocol (#89) X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Reply-To: TokenBinding/Internet-Drafts List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 19 Dec 2016 22:15:02 -0000 ----==_mimepart_58585be38afbf_3e923fcfb7fb313493632 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable and problems have arisen from misusing it for authentication (see https:/= /oauth.net/articles/authentication/ for example). While this is a bit of = nit, I worry that wording like =E2=80=9C... to cryptographically bind aut= hentication tokens (such as cookies and OAuth tokens) to ..." in the HTTP= STB abstract might contribute to the misconception. This commit just adds= "or authorization" to the sentence in the abstract. You can view, comment on, or merge this pull request online at: https://github.com/TokenBinding/Internet-Drafts/pull/89 -- Commit Summary -- * OAuth is authorization protocol and problems have arisen from misusin= g it for authentication (see https://oauth.net/articles/authentication/ f= or example). While this is a bit of nit, I worry that wording like =E2=80= =9C... to cryptographically bind authentication tokens (such as cookies a= nd OAuth tokens) to ..." in the HTTPSTB abstract might contribute to the = misconception. This commit just adds "or authorization" to the sentence i= n the abstract. -- File Changes -- M draft-ietf-tokbind-https-08.xml (2) -- Patch Links -- https://github.com/TokenBinding/Internet-Drafts/pull/89.patch https://github.com/TokenBinding/Internet-Drafts/pull/89.diff -- = You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/TokenBinding/Internet-Drafts/pull/89 ----==_mimepart_58585be38afbf_3e923fcfb7fb313493632 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable

and problems have arisen from misusing it for authentication (see https://oauth.net/arti= cles/authentication/ for example). While this is a bit of nit, I worr= y that wording like =E2=80=9C... to cryptographically bind authentication= tokens (such as cookies and OAuth tokens) to ..." in the HTTPSTB abstrac= t might contribute to the misconception. This commit just adds "or author= ization" to the sentence in the abstract.

You can view, comment on, or merge this pull request online at:

  https://github.com/TokenBinding/Internet-Drafts/pull/89

=

Commit Summary

  • OAuth is authorization protocol and problems have arisen from misus= ing it for authentication (see https://oauth.net/articles/authentication/= for example). While this is a bit of nit, I worry that wording like =E2=80= =9C... to cryptographically bind authentication tokens (such as cookies a= nd OAuth tokens) to ..." in the HTTPSTB abstract might contribute to= the misconception. This commit just adds "or authorization" to= the sentence in the abstract.

File Changes

Patch Links:

&m= dash;
You are receiving this because you are subscribed to this thre= ad.
Reply to this email directly, view it on GitHub, or mute the thread.3D""

----==_mimepart_58585be38afbf_3e923fcfb7fb313493632-- From nobody Mon Dec 19 14:20:43 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C67C1129423 for ; Mon, 19 Dec 2016 14:18:22 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.555 X-Spam-Level: X-Spam-Status: No, score=-3.555 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_20=1.546, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, RP_MATCHES_RCVD=-3.1, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Dn9M2GviRJbr for ; Mon, 19 Dec 2016 14:18:21 -0800 (PST) Received: from o9.sgmail.github.com (o9.sgmail.github.com [167.89.101.2]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 70C20129422 for ; Mon, 19 Dec 2016 14:18:21 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=github.com; h=from:reply-to:to:cc:in-reply-to:references:subject:mime-version:content-type:content-transfer-encoding:list-id:list-archive:list-post:list-unsubscribe; s=s20150108; bh=G4+emEruqFh3a5HkemVMDxDYxvk=; b=UXCiKF3Ru+eqY3bV Xl4LQcDHW38mi0yKl5PD6iWTs4uTn87Xinr3605FBnDGF/6MN9ti221K3z3O7fJN cSr97HE0mz42rMQ5Blw4UpBClNDn+rc+WAFU0JFcEBc7jco1IxX4Yo/KS6QfwRhb PzFkZ796hjfdk8qwB2tTMDwkwT4= Received: by filter0922p1mdw1.sendgrid.net with SMTP id filter0922p1mdw1-32688-58585CAA-6A 2016-12-19 22:18:18.452097143 +0000 UTC Received: from github-smtp2a-ext-cp1-prd.iad.github.net (github-smtp2a-ext-cp1-prd.iad.github.net [192.30.253.16]) by ismtpd0004p1iad1.sendgrid.net (SG) with ESMTP id ttDESKsWTjaF_kZMU84Edw for ; Mon, 19 Dec 2016 22:18:18.373 +0000 (UTC) Date: Mon, 19 Dec 2016 14:18:18 -0800 From: Brian Campbell To: TokenBinding/Internet-Drafts Message-ID: In-Reply-To: References: Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_58585caa4735f_7253fa69fa1b1407052e"; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: list X-GitHub-Sender: b---c X-GitHub-Recipient: unbearable-ML X-GitHub-Reason: subscribed X-Auto-Response-Suppress: All X-GitHub-Recipient-Address: unbearable@ietf.org X-SG-EID: 9Yqp9dCIIwZxB0MVAPExrXlt7a4/46ALD9aG/N3UOYozBAUiXiTK9Iocy7Fqb8A4EXJcUQwrlC5cEp +/lC9I302a3f0iVYneh+sTxMkgTvOKURAcT2Wh36To6kl3ijT8kZvPLoElVT1+0wnFm7+h3BaXpqCP IHGQBBglJqjd8mQnkSD517DG6oYpygW6bl+daBpm/8K5KaAfe+3SHq4nQzUMxmyBQOH+rclqvclUuK A= Archived-At: X-Mailman-Approved-At: Mon, 19 Dec 2016 14:20:33 -0800 Cc: Subscribed Subject: Re: [Unbearable] [TokenBinding/Internet-Drafts] OAuth is authorization protocol (#89) X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Reply-To: TokenBinding/Internet-Drafts List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 19 Dec 2016 22:18:23 -0000 ----==_mimepart_58585caa4735f_7253fa69fa1b1407052e Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit part of (late, sorry!) WGLC review -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/TokenBinding/Internet-Drafts/pull/89#issuecomment-268095000 ----==_mimepart_58585caa4735f_7253fa69fa1b1407052e Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

part of (late, sorry!) WGLC review

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

----==_mimepart_58585caa4735f_7253fa69fa1b1407052e-- From nobody Mon Dec 19 14:39:22 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2EB6F129432 for ; Mon, 19 Dec 2016 14:39:21 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=pingidentity.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2OJRPU-KK_6c for ; Mon, 19 Dec 2016 14:39:20 -0800 (PST) Received: from mail-io0-x232.google.com (mail-io0-x232.google.com [IPv6:2607:f8b0:4001:c06::232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DF29F129406 for ; Mon, 19 Dec 2016 14:39:19 -0800 (PST) Received: by mail-io0-x232.google.com with SMTP id p42so165263237ioo.1 for ; Mon, 19 Dec 2016 14:39:19 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=pingidentity.com; s=gmail; h=mime-version:from:date:message-id:subject:to; bh=tD9zqfM3O1qgsJa20c4oZ2YOUT96VKzwwsOkzqQUQM4=; b=iYSxOhghYneWgVT66/Vybmy1kpbauC/4aOep+pN9Lgl7ObOWfrCPqxCPnexb5vRn3m TThnPnLcJRuHXJLb5yU7Op0vobjb0XcjAMJb4HVN1cy3ubiO8vYM9Sf6elI3ArR/SQHK DVGtVRDguehRLE8ozBZh5ZXJDIDm4wtZEcZ34= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=tD9zqfM3O1qgsJa20c4oZ2YOUT96VKzwwsOkzqQUQM4=; b=pTFy0i/17Psj8Kzm3l6zuwoxoLY6sIeVibQSqYnhA+9NwHF4CGZ6uHY0Yi8Tmh5zlt SJno9jYvG8QmFYD7pfLZ4wX/zCYL7SnPtskOMi4fqB/OzrlZPp9ZX68JsUXw3Hrr7s20 +TxSZr6kmXkfPQkAShBg/qoQE+pyCqxcCnHq6ROctHnSpY5gOVNdoZxNbO6pH52aWsxj 4jv57lqTicl0Clbes+AY8GbLsSwKeFIsmrnkCFaVK/RYpTQH1aHVNBzc/fxG5GOHT7n/ n4u+xZi84E53/oCGty4KyzFeZD7KM+sNPQRXkYt4+KNHFOhbU+HJWCDNGbb/eFM3Kk2s ZGSg== X-Gm-Message-State: AKaTC01b0EsoO5zR6dv+q6Xrr7McuD2UhMNQvDOV0l26co53SZpPd0ow9rrm4gAQSojZHUbCDtJdkkn3lJGkGgif X-Received: by 10.107.141.211 with SMTP id p202mr17044670iod.47.1482187159185; Mon, 19 Dec 2016 14:39:19 -0800 (PST) MIME-Version: 1.0 Received: by 10.79.31.5 with HTTP; Mon, 19 Dec 2016 14:38:48 -0800 (PST) From: Brian Campbell Date: Mon, 19 Dec 2016 15:38:48 -0700 Message-ID: To: IETF Tokbind WG Content-Type: multipart/alternative; boundary=94eb2c062c9e1d43df05440a9798 Archived-At: Subject: [Unbearable] Two little PRs for (late) WGLC X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 19 Dec 2016 22:39:21 -0000 --94eb2c062c9e1d43df05440a9798 Content-Type: text/plain; charset=UTF-8 Both pull requests are very small. Being a little unsure about github's notifications to the list I thought I should sent a note here too just for posterity. https://github.com/TokenBinding/Internet-Drafts/pull/89 https://github.com/TokenBinding/Internet-Drafts/pull/90 --94eb2c062c9e1d43df05440a9798 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Both pull requests are very small. Being a little unsure a= bout github's notifications to the list I thought I should sent a note = here too just for posterity.

https://github.com/TokenBinding/Internet-Draf= ts/pull/89
https://github.com/TokenBinding/Internet-Drafts/pull/90
<= br>
--94eb2c062c9e1d43df05440a9798-- From nobody Mon Dec 19 15:30:03 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6A6DC129513 for ; Mon, 19 Dec 2016 15:30:01 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=pingidentity.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id E74TJfuJoC6T for ; Mon, 19 Dec 2016 15:30:00 -0800 (PST) Received: from mail-io0-x22b.google.com (mail-io0-x22b.google.com [IPv6:2607:f8b0:4001:c06::22b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0730F1295D6 for ; Mon, 19 Dec 2016 15:30:00 -0800 (PST) Received: by mail-io0-x22b.google.com with SMTP id h30so166026112iod.2 for ; Mon, 19 Dec 2016 15:29:59 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=pingidentity.com; s=gmail; h=mime-version:from:date:message-id:subject:to; bh=J/mrwlm+MGxB/kgmJenTCBEgMvCZMZT0C5dYd+N1+l0=; b=nas1Gfc9WIB9czyeiMXjtjPSdOaZAoD0rw2A3GydPr7FAezOWkR4OMH2nV473jzTlQ QCnQoYYtgByX8dCQdUHkYnctKyTdNzIBKIgphntK+6+vT1jLEl9KWD/xRah7B+qZ8kQG mYe7aoOgS/tTJA4Z2igfpXbvDnR3hx5HKOrI4= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=J/mrwlm+MGxB/kgmJenTCBEgMvCZMZT0C5dYd+N1+l0=; b=f+beAwZktX1J4zWKwPKbmN9GiDR2+qd//aXgVuxkr1X4AR2hchZ+lTNLFHPZkfAjwA DiOIurq3AL8RmjiRxeui2CaEBiO+0RxhRiOT/PnoctLSy0r98bt55uOGcm9NXbWqp2IX KMD5VB8vDfdnPXusPD+I9sgC7xTW2Hi/i1czTWK/jh7shYCcF25lgx0NYPnDD53CmGRw yu6GG1b4ghybnmSrENVsSiGYIOAZflUziSEU7JMefbu0q8dydi/SWQ/Me1/5NMMlt8Nq 0AAHateKEuVCBjEocHIBqeUxxchnHr0H0SYgnEc5bEieZPP9mQ5WVyYToRASeK0CiDYl l3kA== X-Gm-Message-State: AIkVDXKxPR39XuE9ZBxHaxdtp9evkifY+NCpxdFrOOYxbbFAn26lq590Tf3H9buRlRk7oN5tOyyjcO4BWHhHrvCK X-Received: by 10.107.13.137 with SMTP id 131mr17445274ion.122.1482190198930; Mon, 19 Dec 2016 15:29:58 -0800 (PST) MIME-Version: 1.0 Received: by 10.79.31.5 with HTTP; Mon, 19 Dec 2016 15:29:28 -0800 (PST) From: Brian Campbell Date: Mon, 19 Dec 2016 16:29:28 -0700 Message-ID: To: IETF Tokbind WG Content-Type: multipart/alternative; boundary=001a113fdfd44c185805440b4c96 Archived-At: Subject: [Unbearable] (late, sorry) WGLC question on establishing the binding or not X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 19 Dec 2016 23:30:01 -0000 --001a113fdfd44c185805440b4c96 Content-Type: text/plain; charset=UTF-8 What should a server do if it receives an HTTP request without a Sec-Token-Binding header on a TLS connection where token binding was negotiated in the handshake? As far as I can tell from my reading, the drafts don't explicitly say (TBPROTO 4.2 doesn't cover it, for example). I'm guessing that it is to allow for how TB version negotiation is intended to work - i.e. client sends version 1.1 in the TB extension, server responds with version 1.0, but the client only supports 1.1 so the binding isn't established and no TokenBindingMessage is sent. I can't wrap my head around what exactly, if anything, is wrong with all that but it's always felt a little off to me. Nick sort of mentioned it on the list back in August but it was kinda lost as part of a larger conversation about the versioning. Should the server behavior in that situation be more explicitly covered in the spec(s)? I'm thinking maybe so. The case where the client and server both indicate exactly the same versions during negotiation but no TokenBindingMessage is sent, for example, seems like it should be a failure condition in the same vein as a mismatch between the negotiated TokenBindingKeyParameters and in the the TokenBindingKeyParameters of the provided_token_binding TokenBindingID. Please correct me, if I'm off the rails here. But explain why. And I do think that my uncertainty/confusion does suggest that some kind of clarification in the draft(s) would be useful. Thanks, Brian --001a113fdfd44c185805440b4c96 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
What should a server do if it receives an HTTP reques= t without a Sec-Token-Binding header on a TLS connection where token bindin= g was negotiated in the handshake?


Should the server behavior in that sit= uation be more explicitly covered in the spec(s)? I'm thinking maybe so= . The case where the client and server both indicate exactly the same versi= ons during negotiation but no TokenBindingMessage is sent, for example, see= ms like it should be a failure condition in the same vein as a mismatch bet= ween the negotiated TokenBindingKeyParameters and in the the TokenBindingKe= yParameters of the=C2=A0 provided_token_binding TokenBindingID.

Please correct me, if I'm off the rails here. But explain why. = And I do think that my uncertainty/confusion does suggest that some kind of= clarification in the draft(s) would be useful.=C2=A0

Thanks,
Brian



=
--001a113fdfd44c185805440b4c96-- From nobody Mon Dec 19 16:37:22 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CB6AE1296C8 for ; Mon, 19 Dec 2016 16:37:20 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.021 X-Spam-Level: X-Spam-Status: No, score=-2.021 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yChMHOKpjyaT for ; Mon, 19 Dec 2016 16:37:18 -0800 (PST) Received: from NAM02-CY1-obe.outbound.protection.outlook.com (mail-cys01nam02on0094.outbound.protection.outlook.com [104.47.37.94]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 96B32129673 for ; Mon, 19 Dec 2016 16:37:18 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=7EkC8pyfNwKbu5YQO3w6GGVIjxzYR4bWmygrRfT8QU0=; b=eeThgpk+bVScgmIU6a2dlCuAcj+lrew10H00U+YlW07nWUA1yLVX9y8UrKbe3eZSIVz3wUqo6u0b1XHazhaV0FymzZq+AKMkQefYkMOCK4DiSJ1CeYHt4p2QjO+fGdRquO0Lr6lXji1TDuxUEgYUHTMqGRfr6rBSBdkVwJnVJGQ= Received: from CY1PR0301MB0842.namprd03.prod.outlook.com (10.160.163.148) by CY1PR0301MB0842.namprd03.prod.outlook.com (10.160.163.148) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.789.14; Tue, 20 Dec 2016 00:37:17 +0000 Received: from CY1PR0301MB0842.namprd03.prod.outlook.com ([10.160.163.148]) by CY1PR0301MB0842.namprd03.prod.outlook.com ([10.160.163.148]) with mapi id 15.01.0789.018; Tue, 20 Dec 2016 00:37:17 +0000 From: Andrei Popov To: Brian Campbell , IETF Tokbind WG Thread-Topic: [Unbearable] (late, sorry) WGLC question on establishing the binding or not Thread-Index: AQHSWk/Xa4Bgm4OKW0O/J2N+5Yt5aKEP9qyw Date: Tue, 20 Dec 2016 00:37:16 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Andrei.Popov@microsoft.com; x-originating-ip: [2001:4898:80e8:a::1d2] x-ms-office365-filtering-correlation-id: 108bce54-27c8-49da-dd35-08d4287059d7 x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001); SRVR:CY1PR0301MB0842; x-microsoft-exchange-diagnostics: 1; CY1PR0301MB0842; 7:/kzr06bYcb93u1bPte1vO1HVJHXg0xK5pCbXdfYEqKfDJXjpH4X8nZvk1ipnFm9r6trOvot3h61SXgVRXjN9co2ozHDdnET1P3TlmnWdTlfJ1cKYmUdSuFBBZlU0PfYq3+K01Q07lao0+5QAmYg5mxeKy3F3hkyuiIprRNRTpSvlsk/k37TYfVxnVB+NL8yuGqKZtli67M3cAu65pxNdDDS/QViUHvBB7cleUc+ZXRBsWJ92zrufy03gj8eqZKoquSKMIgt8mKOFiEkjpVzvM8ZVUqoNx+OHB5JIrvflRRTSyTnWqJx5dExQcCWaQOYtTkc0DLzyMH89nd7gbdwpU+/aIhwHV2hNx3PWPUDHBNT27sahy8yw9JGxbp3XVD2lLRquek1xUTyvNYN4eqr2mA53TJRlWNJVPoTShDFMYyvLVI1oQgugQNyjLlHJGM3ZUII+TYqVg3IrqlTNt738O0rXFuWmKerBc1gwxsMhMv4= x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(158342451672863)(21748063052155); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040375)(601004)(2401047)(5005006)(8121501046)(10201501046)(3002001)(6055026)(61426038)(61427038)(6041248)(20161123560025)(20161123564025)(20161123562025)(20161123555025)(6072148)(6047074); SRVR:CY1PR0301MB0842; BCL:0; PCL:0; RULEID:; SRVR:CY1PR0301MB0842; x-forefront-prvs: 0162ACCC24 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(6009001)(7916002)(39840400002)(39850400002)(39410400002)(39860400002)(39450400003)(199003)(189002)(106116001)(9686002)(68736007)(33656002)(8936002)(2906002)(105586002)(102836003)(74316002)(122556002)(7736002)(790700001)(8990500004)(6116002)(10090500001)(2900100001)(5005710100001)(10290500002)(92566002)(81166006)(5660300001)(6506006)(38730400001)(3660700001)(81156014)(6436002)(25786008)(229853002)(76576001)(77096006)(3280700002)(7696004)(86612001)(86362001)(189998001)(97736004)(107886002)(5001770100001)(99286002)(54356999)(2950100002)(76176999)(101416001)(50986999)(106356001); DIR:OUT; SFP:1102; SCL:1; SRVR:CY1PR0301MB0842; H:CY1PR0301MB0842.namprd03.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; A:1; MX:1; LANG:en; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_CY1PR0301MB08427626BD31DB029C1754D98C900CY1PR0301MB0842_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 20 Dec 2016 00:37:16.9665 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY1PR0301MB0842 Archived-At: Subject: Re: [Unbearable] (late, sorry) WGLC question on establishing the binding or not X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 20 Dec 2016 00:37:21 -0000 --_000_CY1PR0301MB08427626BD31DB029C1754D98C900CY1PR0301MB0842_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 w5ggIFdoYXQgc2hvdWxkIGEgc2VydmVyIGRvIGlmIGl0IHJlY2VpdmVzIGFuIEhUVFAgcmVxdWVz dCB3aXRob3V0IGEgU2VjLVRva2VuLUJpbmRpbmcgaGVhZGVyIG9uIGEgVExTIGNvbm5lY3Rpb24g d2hlcmUgdG9rZW4gYmluZGluZyB3YXMgbmVnb3RpYXRlZCBpbiB0aGUgaGFuZHNoYWtlPw0KVGhp cyBtZWFucyBUQiBpcyBub3QgZXN0YWJsaXNoZWQgd2l0aCB0aGlzIGNsaWVudCwgc2VlIFRCTkVH Tzog4oCcSWYgdGhlIGNsaWVudCBkb2VzIG5vdCBzdXBwb3J0IHRoZSBUb2tlbiBCaW5kaW5nIHBy b3RvY29sIHZlcnNpb24gc2VsZWN0ZWQgYnkgdGhlIHNlcnZlciwgdGhlbiB0aGUgY29ubmVjdGlv biBwcm9jZWVkcyB3aXRob3V0IFRva2VuIEJpbmRpbmcu4oCdDQoNCsOYICBUaGUgY2FzZSB3aGVy ZSB0aGUgY2xpZW50IGFuZCBzZXJ2ZXIgYm90aCBpbmRpY2F0ZSBleGFjdGx5IHRoZSBzYW1lIHZl cnNpb25zIGR1cmluZyBuZWdvdGlhdGlvbiBidXQgbm8gVG9rZW5CaW5kaW5nTWVzc2FnZSBpcyBz ZW50LCBmb3IgZXhhbXBsZSwgc2VlbXMgbGlrZSBpdCBzaG91bGQgYmUgYSBmYWlsdXJlIGNvbmRp dGlvbiBpbiB0aGUgc2FtZSB2ZWluIGFzIGEgbWlzbWF0Y2ggYmV0d2VlbiB0aGUgbmVnb3RpYXRl ZCBUb2tlbkJpbmRpbmdLZXlQYXJhbWV0ZXJzIGFuZCBpbiB0aGUgdGhlIFRva2VuQmluZGluZ0tl eVBhcmFtZXRlcnMgb2YgdGhlICBwcm92aWRlZF90b2tlbl9iaW5kaW5nIFRva2VuQmluZGluZ0lE Lg0KDQpXZSBjb3VsZCBzcGVjaWFsLWNhc2UgYW5kIHNheSB0aGF0IGlmIGEgc2VydmVyIHBpY2tz IHRoZSBleGFjdCBUQiB2ZXJzaW9uIGEgY2xpZW50IHNlbnQsIGFuZCB0aGUgY2xpZW504oCZcyBz dWJzZXF1ZW50IHJlcXVlc3QgZG9lcyBub3QgY29udGFpbiB0aGUgVEIgbWVzc2FnZSwgdGhlbiB0 aGUgcmVxdWVzdCBNVVNUIGJlIHJlamVjdGVkLg0KSG93ZXZlciwgaW4gcHJhY3RpY2UgdGhpcyBm ZWVscyBsaWtlIGEgZmFpbHVyZSBjYXNlIGZvciBubyBnb29kIHJlYXNvbi4NCg0KSSB0aGluayB3 ZSBoYXZlIDQgcG9zc2liaWxpdGllczoNCg0KMS4gICAgICAgVGhlIGNsaWVudCBzZW5kcyBhIFRC IG1lc3NhZ2UgYW5kIGEgYm91bmQgdG9rZW4gPT4gdGhlIHNlcnZlciB2ZXJpZmllcyBwZXIgVEJQ Uk9UTy4NCg0KMi4gICAgICAgVGhlIGNsaWVudCBzZW5kcyBhIFRCIG1lc3NhZ2UgYW5kIG5vIGJv dW5kIHRva2VuID0+IHRoZSBzZXJ2ZXIgdmVyaWZpZXMgcGVyIFRCUFJPVE8uDQoNCjMuICAgICAg IFRoZSBjbGllbnQgc2VuZHMgbm8gVEIgbWVzc2FnZSBhbmQgYSBib3VuZCB0b2tlbiA9PiB0aGUg c2VydmVyIHJlamVjdHMgcGVyIFRCUFJPVE8uDQoNCjQuICAgICAgIFRoZSBjbGllbnQgc2VuZHMg bm8gVEIgbWVzc2FnZSBhbmQgbm8gYm91bmQgdG9rZW4gPT4gd2UgY291bGQgcmVxdWlyZSB0aGF0 IHRoaXMgYmUgcmVqZWN0ZWQsIGlmIHRoZSBzZXJ2ZXIgcGlja2VkIHRoZSBjbGllbnTigJlzIG9m ZmVyZWQgVEIgdmVyc2lvbiwgYnV0IHdoeSBjcmVhdGUgdGhpcyBmYWlsdXJlIGNhc2U/DQoNCkNo ZWVycywNCg0KQW5kcmVpDQo= --_000_CY1PR0301MB08427626BD31DB029C1754D98C900CY1PR0301MB0842_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 V2luZ2RpbmdzOw0KCXBhbm9zZS0xOjUgMCAwIDAgMCAwIDAgMCAwIDA7fQ0KQGZvbnQtZmFjZQ0K CXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2IDMg MiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6IkNhbGlicmkgTGlnaHQiOw0KCXBhbm9z ZS0xOjIgMTUgMyAyIDIgMiA0IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2Fs aWJyaTsNCglwYW5vc2UtMToyIDE1IDUgMiAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0 aW9ucyAqLw0KcC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJn aW46MGluOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZv bnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iLHNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBl cmxpbmsNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNv cmF0aW9uOnVuZGVybGluZTt9DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQN Cgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRp b246dW5kZXJsaW5lO30NCnAuTXNvTGlzdFBhcmFncmFwaCwgbGkuTXNvTGlzdFBhcmFncmFwaCwg ZGl2Lk1zb0xpc3RQYXJhZ3JhcGgNCgl7bXNvLXN0eWxlLXByaW9yaXR5OjM0Ow0KCW1hcmdpbi10 b3A6MGluOw0KCW1hcmdpbi1yaWdodDowaW47DQoJbWFyZ2luLWJvdHRvbTowaW47DQoJbWFyZ2lu LWxlZnQ6LjVpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEyLjBwdDsN Cglmb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIixzZXJpZjt9DQpwLm1zb25vcm1hbDAsIGxp Lm1zb25vcm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsN Cgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJn aW4tYm90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTIuMHB0 Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iLHNlcmlmO30NCnNwYW4uRW1haWxTdHls ZTE4DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxp YnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0KLk1zb0NocERlZmF1bHQNCgl7 bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6 OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBpbiAxLjBpbiAxLjBpbjt9DQpkaXYuV29y ZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi8qIExpc3QgRGVmaW5pdGlvbnMgKi8N CkBsaXN0IGwwDQoJe21zby1saXN0LWlkOjg0NTkwMjY4NDsNCgltc28tbGlzdC10eXBlOmh5YnJp ZDsNCgltc28tbGlzdC10ZW1wbGF0ZS1pZHM6LTIwNzM3ODU3NzggNjc2OTg3MDMgNjc2OTg3MTMg Njc2OTg3MTUgNjc2OTg3MDMgNjc2OTg3MTMgNjc2OTg3MTUgNjc2OTg3MDMgNjc2OTg3MTMgNjc2 OTg3MTU7fQ0KQGxpc3QgbDA6bGV2ZWwxDQoJe21zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1z by1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47fQ0KQGxp c3QgbDA6bGV2ZWwyDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmFscGhhLWxvd2VyOw0KCW1z by1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsN Cgl0ZXh0LWluZGVudDotLjI1aW47fQ0KQGxpc3QgbDA6bGV2ZWwzDQoJe21zby1sZXZlbC1udW1i ZXItZm9ybWF0OnJvbWFuLWxvd2VyOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1s ZXZlbC1udW1iZXItcG9zaXRpb246cmlnaHQ7DQoJdGV4dC1pbmRlbnQ6LTkuMHB0O30NCkBsaXN0 IGwwOmxldmVsNA0KCXttc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVy LXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluO30NCkBsaXN0IGwwOmxldmVsNQ0K CXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDphbHBoYS1sb3dlcjsNCgltc28tbGV2ZWwtdGFiLXN0 b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6 LS4yNWluO30NCkBsaXN0IGwwOmxldmVsNg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpyb21h bi1sb3dlcjsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBv c2l0aW9uOnJpZ2h0Ow0KCXRleHQtaW5kZW50Oi05LjBwdDt9DQpAbGlzdCBsMDpsZXZlbDcNCgl7 bXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0 Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjt9DQpAbGlzdCBsMDpsZXZlbDgNCgl7bXNvLWxldmVsLW51 bWJlci1mb3JtYXQ6YWxwaGEtbG93ZXI7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNv LWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjt9DQpAbGlz dCBsMDpsZXZlbDkNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6cm9tYW4tbG93ZXI7DQoJbXNv LWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpyaWdodDsN Cgl0ZXh0LWluZGVudDotOS4wcHQ7fQ0KQGxpc3QgbDENCgl7bXNvLWxpc3QtaWQ6MTAwNTEzNTY2 NTsNCgltc28tbGlzdC10eXBlOmh5YnJpZDsNCgltc28tbGlzdC10ZW1wbGF0ZS1pZHM6LTY3Mzk0 MDE2MiAxMTk1NTEyMTQwIDY3Njk4NjkxIDY3Njk4NjkzIDY3Njk4Njg5IDY3Njk4NjkxIDY3Njk4 NjkzIDY3Njk4Njg5IDY3Njk4NjkxIDY3Njk4NjkzO30NCkBsaXN0IGwxOmxldmVsMQ0KCXttc28t bGV2ZWwtc3RhcnQtYXQ6NTsNCgltc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNv LWxldmVsLXRleHQ674OYOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1u dW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6 V2luZ2RpbmdzOw0KCW1zby1mYXJlYXN0LWZvbnQtZmFtaWx5OkNhbGlicmk7DQoJbXNvLWJpZGkt Zm9udC1mYW1pbHk6IlRpbWVzIE5ldyBSb21hbiI7fQ0KQGxpc3QgbDE6bGV2ZWwyDQoJe21zby1s ZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDpvOw0KCW1zby1sZXZl bC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0 LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3Ijt9DQpAbGlzdCBsMTps ZXZlbDMNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0 Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0 aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9 DQpAbGlzdCBsMTpsZXZlbDQNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1z by1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwt bnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5 OlN5bWJvbDt9DQpAbGlzdCBsMTpsZXZlbDUNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVs bGV0Ow0KCW1zby1sZXZlbC10ZXh0Om87DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNv LWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250 LWZhbWlseToiQ291cmllciBOZXciO30NCkBsaXN0IGwxOmxldmVsNg0KCXttc28tbGV2ZWwtbnVt YmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWIt c3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVu dDotLjI1aW47DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwxOmxldmVsNw0KCXtt c28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1z by1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsN Cgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwxOmxl dmVsOA0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6 bzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9u OmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyI7 fQ0KQGxpc3QgbDE6bGV2ZWw5DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCglt c28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVs LW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWls eTpXaW5nZGluZ3M7fQ0Kb2wNCgl7bWFyZ2luLWJvdHRvbTowaW47fQ0KdWwNCgl7bWFyZ2luLWJv dHRvbTowaW47fQ0KLS0+PC9zdHlsZT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBl ZGVmYXVsdHMgdjpleHQ9ImVkaXQiIHNwaWRtYXg9IjEwMjYiIC8+DQo8L3htbD48IVtlbmRpZl0t LT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlbGF5b3V0IHY6ZXh0PSJlZGl0Ij4N CjxvOmlkbWFwIHY6ZXh0PSJlZGl0IiBkYXRhPSIxIiAvPg0KPC9vOnNoYXBlbGF5b3V0PjwveG1s PjwhW2VuZGlmXS0tPg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0iRU4tVVMiIGxpbms9ImJsdWUiIHZs aW5rPSJwdXJwbGUiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29M aXN0UGFyYWdyYXBoIiBzdHlsZT0ibWFyZ2luLWJvdHRvbToxMi4wcHQ7dGV4dC1pbmRlbnQ6LS4y NWluO21zby1saXN0OmwxIGxldmVsMSBsZm8xIj4NCjwhW2lmICFzdXBwb3J0TGlzdHNdPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OldpbmdkaW5ncyI+PHNwYW4gc3R5 bGU9Im1zby1saXN0Oklnbm9yZSI+w5g8c3BhbiBzdHlsZT0iZm9udDo3LjBwdCAmcXVvdDtUaW1l cyBOZXcgUm9tYW4mcXVvdDsiPiZuYnNwOw0KPC9zcGFuPjwvc3Bhbj48L3NwYW4+PCFbZW5kaWZd PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkg TGlnaHQmcXVvdDssc2Fucy1zZXJpZiI+V2hhdCBzaG91bGQgYSBzZXJ2ZXIgZG8gaWYgaXQgcmVj ZWl2ZXMgYW4gSFRUUCByZXF1ZXN0IHdpdGhvdXQgYSBTZWMtVG9rZW4tQmluZGluZyBoZWFkZXIg b24gYSBUTFMgY29ubmVjdGlvbiB3aGVyZSB0b2tlbiBiaW5kaW5nIHdhcyBuZWdvdGlhdGVkIGlu IHRoZSBoYW5kc2hha2U/DQo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibWFyZ2luLWJvdHRvbToxMi4wcHQiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkgTGlnaHQmcXVvdDssc2Fucy1zZXJpZiI+ VGhpcyBtZWFucyBUQiBpcyBub3QgZXN0YWJsaXNoZWQgd2l0aCB0aGlzIGNsaWVudCwgc2VlIFRC TkVHTzo8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q2FsaWJyaSBMaWdodCZxdW90OyxzYW5zLXNlcmlmIj4NCjwvc3Bhbj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpIExpZ2h0JnF1b3Q7LHNh bnMtc2VyaWYiPuKAnElmIHRoZSBjbGllbnQgZG9lcyBub3Qgc3VwcG9ydCB0aGUgVG9rZW4gQmlu ZGluZyBwcm90b2NvbCB2ZXJzaW9uIHNlbGVjdGVkIGJ5IHRoZSBzZXJ2ZXIsIHRoZW4gdGhlIGNv bm5lY3Rpb24gcHJvY2VlZHMgd2l0aG91dCBUb2tlbiBCaW5kaW5nLuKAnTwvc3Bhbj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpIExpZ2h0JnF1 b3Q7LHNhbnMtc2VyaWYiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29MaXN0 UGFyYWdyYXBoIiBzdHlsZT0idGV4dC1pbmRlbnQ6LS4yNWluO21zby1saXN0OmwxIGxldmVsMSBs Zm8xIj48IVtpZiAhc3VwcG9ydExpc3RzXT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTpXaW5nZGluZ3MiPjxzcGFuIHN0eWxlPSJtc28tbGlzdDpJZ25vcmUiPsOYPHNw YW4gc3R5bGU9ImZvbnQ6Ny4wcHQgJnF1b3Q7VGltZXMgTmV3IFJvbWFuJnF1b3Q7Ij4mbmJzcDsN Cjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwhW2VuZGlmXT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpIExpZ2h0JnF1b3Q7LHNhbnMtc2VyaWYiPlRo ZSBjYXNlIHdoZXJlIHRoZSBjbGllbnQgYW5kIHNlcnZlciBib3RoIGluZGljYXRlIGV4YWN0bHkg dGhlIHNhbWUgdmVyc2lvbnMgZHVyaW5nIG5lZ290aWF0aW9uIGJ1dCBubyBUb2tlbkJpbmRpbmdN ZXNzYWdlIGlzIHNlbnQsIGZvciBleGFtcGxlLCBzZWVtcyBsaWtlDQogaXQgc2hvdWxkIGJlIGEg ZmFpbHVyZSBjb25kaXRpb24gaW4gdGhlIHNhbWUgdmVpbiBhcyBhIG1pc21hdGNoIGJldHdlZW4g dGhlIG5lZ290aWF0ZWQgVG9rZW5CaW5kaW5nS2V5UGFyYW1ldGVycyBhbmQgaW4gdGhlIHRoZSBU b2tlbkJpbmRpbmdLZXlQYXJhbWV0ZXJzIG9mIHRoZSZuYnNwOyBwcm92aWRlZF90b2tlbl9iaW5k aW5nIFRva2VuQmluZGluZ0lELjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nh bGlicmkgTGlnaHQmcXVvdDssc2Fucy1zZXJpZiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSBMaWdodCZxdW90OyxzYW5zLXNlcmlmIj5XZSBjb3VsZCBz cGVjaWFsLWNhc2UgYW5kIHNheSB0aGF0IGlmIGEgc2VydmVyIHBpY2tzIHRoZSBleGFjdCBUQiB2 ZXJzaW9uIGEgY2xpZW50IHNlbnQsIGFuZCB0aGUgY2xpZW504oCZcyBzdWJzZXF1ZW50IHJlcXVl c3QgZG9lcyBub3QgY29udGFpbiB0aGUgVEIgbWVzc2FnZSwgdGhlbiB0aGUNCiByZXF1ZXN0IE1V U1QgYmUgcmVqZWN0ZWQuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJy aSBMaWdodCZxdW90OyxzYW5zLXNlcmlmIj5Ib3dldmVyLCBpbiBwcmFjdGljZSB0aGlzIGZlZWxz IGxpa2UgYSBmYWlsdXJlIGNhc2UgZm9yIG5vIGdvb2QgcmVhc29uLjxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkgTGlnaHQmcXVvdDssc2Fucy1zZXJpZiI+PG86cD4m bmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSBMaWdodCZxdW90Oyxz YW5zLXNlcmlmIj5JIHRoaW5rIHdlIGhhdmUgNCBwb3NzaWJpbGl0aWVzOjxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBoIiBzdHlsZT0idGV4dC1pbmRlbnQ6 LS4yNWluO21zby1saXN0OmwwIGxldmVsMSBsZm8yIj48IVtpZiAhc3VwcG9ydExpc3RzXT48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpIExpZ2h0 JnF1b3Q7LHNhbnMtc2VyaWYiPjxzcGFuIHN0eWxlPSJtc28tbGlzdDpJZ25vcmUiPjEuPHNwYW4g c3R5bGU9ImZvbnQ6Ny4wcHQgJnF1b3Q7VGltZXMgTmV3IFJvbWFuJnF1b3Q7Ij4mbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsNCjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwhW2VuZGlm XT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp IExpZ2h0JnF1b3Q7LHNhbnMtc2VyaWYiPlRoZSBjbGllbnQgc2VuZHMgYSBUQiBtZXNzYWdlIGFu ZCBhIGJvdW5kIHRva2VuID0mZ3Q7IHRoZSBzZXJ2ZXIgdmVyaWZpZXMgcGVyIFRCUFJPVE8uPG86 cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJ0 ZXh0LWluZGVudDotLjI1aW47bXNvLWxpc3Q6bDAgbGV2ZWwxIGxmbzIiPjwhW2lmICFzdXBwb3J0 TGlzdHNdPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nh bGlicmkgTGlnaHQmcXVvdDssc2Fucy1zZXJpZiI+PHNwYW4gc3R5bGU9Im1zby1saXN0Oklnbm9y ZSI+Mi48c3BhbiBzdHlsZT0iZm9udDo3LjBwdCAmcXVvdDtUaW1lcyBOZXcgUm9tYW4mcXVvdDsi PiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOw0KPC9zcGFuPjwvc3Bhbj48L3Nw YW4+PCFbZW5kaWZdPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkgTGlnaHQmcXVvdDssc2Fucy1zZXJpZiI+VGhlIGNsaWVudCBzZW5kcyBhIFRC IG1lc3NhZ2UgYW5kIG5vIGJvdW5kIHRva2VuID0mZ3Q7IHRoZSBzZXJ2ZXIgdmVyaWZpZXMgcGVy IFRCUFJPVE8uPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb0xpc3RQYXJhZ3Jh cGgiIHN0eWxlPSJ0ZXh0LWluZGVudDotLjI1aW47bXNvLWxpc3Q6bDAgbGV2ZWwxIGxmbzIiPjwh W2lmICFzdXBwb3J0TGlzdHNdPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O0NhbGlicmkgTGlnaHQmcXVvdDssc2Fucy1zZXJpZiI+PHNwYW4gc3R5bGU9Im1z by1saXN0Oklnbm9yZSI+My48c3BhbiBzdHlsZT0iZm9udDo3LjBwdCAmcXVvdDtUaW1lcyBOZXcg Um9tYW4mcXVvdDsiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOw0KPC9zcGFu Pjwvc3Bhbj48L3NwYW4+PCFbZW5kaWZdPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0NhbGlicmkgTGlnaHQmcXVvdDssc2Fucy1zZXJpZiI+VGhlIGNsaWVu dCBzZW5kcyBubyBUQiBtZXNzYWdlIGFuZCBhIGJvdW5kIHRva2VuID0mZ3Q7IHRoZSBzZXJ2ZXIg cmVqZWN0cyBwZXIgVEJQUk9UTy48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv TGlzdFBhcmFncmFwaCIgc3R5bGU9InRleHQtaW5kZW50Oi0uMjVpbjttc28tbGlzdDpsMCBsZXZl bDEgbGZvMiI+PCFbaWYgIXN1cHBvcnRMaXN0c10+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSBMaWdodCZxdW90OyxzYW5zLXNlcmlmIj48c3Bh biBzdHlsZT0ibXNvLWxpc3Q6SWdub3JlIj40LjxzcGFuIHN0eWxlPSJmb250OjcuMHB0ICZxdW90 O1RpbWVzIE5ldyBSb21hbiZxdW90OyI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7DQo8L3NwYW4+PC9zcGFuPjwvc3Bhbj48IVtlbmRpZl0+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSBMaWdodCZxdW90OyxzYW5zLXNlcmlm Ij5UaGUgY2xpZW50IHNlbmRzIG5vIFRCIG1lc3NhZ2UgYW5kIG5vIGJvdW5kIHRva2VuID0mZ3Q7 IHdlIGNvdWxkIHJlcXVpcmUgdGhhdCB0aGlzIGJlIHJlamVjdGVkLCBpZiB0aGUgc2VydmVyIHBp Y2tlZCB0aGUgY2xpZW504oCZcyBvZmZlcmVkIFRCIHZlcnNpb24sIGJ1dCB3aHkgY3JlYXRlDQog dGhpcyBmYWlsdXJlIGNhc2U/PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2Fs aWJyaSBMaWdodCZxdW90OyxzYW5zLXNlcmlmIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpIExpZ2h0JnF1b3Q7LHNhbnMtc2VyaWYiPkNoZWVycyw8bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpIExpZ2h0JnF1b3Q7LHNhbnMt c2VyaWYiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkg TGlnaHQmcXVvdDssc2Fucy1zZXJpZiI+QW5kcmVpPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9k aXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_CY1PR0301MB08427626BD31DB029C1754D98C900CY1PR0301MB0842_-- From nobody Tue Dec 20 11:54:35 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 60A731295AE for ; Tue, 20 Dec 2016 11:54:32 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=pingidentity.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UnRIEUQRCZVM for ; Tue, 20 Dec 2016 11:54:30 -0800 (PST) Received: from mail-it0-x22f.google.com (mail-it0-x22f.google.com [IPv6:2607:f8b0:4001:c0b::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8BF4E12941D for ; Tue, 20 Dec 2016 11:54:30 -0800 (PST) Received: by mail-it0-x22f.google.com with SMTP id 75so65156500ite.1 for ; Tue, 20 Dec 2016 11:54:30 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=pingidentity.com; s=gmail; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=ACO6Jitz1vhtwEEk8/hi3em4CxbT/RJSJzxcbHuMLvk=; b=CkKOIMz6JqxpVITsTLhNHxeAK17ilcLrZUc2NcLV7B4V0LrxxYG1gjZkgsbqq6jZ5U nPR3LaEeA/cOMWiC2WLTR4bXO+ipplW1AZx8Dts4XV0GHRDmroO1sh9WqWWG1sZhRNE9 iT6uBVBFv+F1JQK8gMIrY6kDtG8KqI2ZpCQWs= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=ACO6Jitz1vhtwEEk8/hi3em4CxbT/RJSJzxcbHuMLvk=; b=Yhy1WzW0XxvdykNRAzXyKitTP7MP1DwqbS/OXh8RUeowSbltxS2m1tjtkHnerAjV8J TjkK1KMrN0Qz//NGIPvHH0bP7Q4BHAeE1AVcPw5fBIwCXnhUen3Zaq4FWa8JVuW9uJVN JJmxDn2Hq8FRqpLuXmWDMPzxurqlATLCuevSub4mx4BSIYUguDjpXJ4CwCINRTUpgUha M+nd4L3lw8yeibsroYVpdoRW1Qp+gPwho9eKA0M2oSbWNDzEbCPT2rEFrzkTUejSA9CK v70SwnOlInrBBg63eLqtRl8VzpVOsoJ9JYleUFDFnWBKdZj7G/sJabVO6I0/wJMpYCH/ vvnQ== X-Gm-Message-State: AIkVDXJz2l12eNDLcsv5ryqKhOxm6eeAksM9LoXwWngD1o8XTVbuspcykNpB8ytDBwOBRgNSWDPDOY2XzRB23Yqb X-Received: by 10.36.148.84 with SMTP id j81mr1957162ite.35.1482263669731; Tue, 20 Dec 2016 11:54:29 -0800 (PST) MIME-Version: 1.0 Received: by 10.79.31.5 with HTTP; Tue, 20 Dec 2016 11:53:59 -0800 (PST) In-Reply-To: References: From: Brian Campbell Date: Tue, 20 Dec 2016 12:53:59 -0700 Message-ID: To: Andrei Popov Content-Type: multipart/alternative; boundary=94eb2c0ef0e27facae05441c674e Archived-At: Cc: IETF Tokbind WG Subject: Re: [Unbearable] (late, sorry) WGLC question on establishing the binding or not X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 20 Dec 2016 19:54:32 -0000 --94eb2c0ef0e27facae05441c674e Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Thanks Andrei, some further discussion inline... On Mon, Dec 19, 2016 at 5:37 PM, Andrei Popov wrote: > =C3=98 What should a server do if it receives an HTTP request without a > Sec-Token-Binding header on a TLS connection where token binding was > negotiated in the handshake? > > This means TB is not established with this client, see TBNEGO: =E2=80=9CI= f the > client does not support the Token Binding protocol version selected by th= e > server, then the connection proceeds without Token Binding.=E2=80=9D > I knew I'd seen something like that somewhere but couldn't conjure it up. Thanks for the pointer/reminder. But in defense of my own dumb question, that clearly covers the case where the client doesn't support the TB version that the server chose. But doesn't address the case where the client and server both indicate exactly the same versions during negotiation but no TB message is sent at the application layer. =C3=98 The case where the client and server both indicate exactly the same > versions during negotiation but no TokenBindingMessage is sent, for > example, seems like it should be a failure condition in the same vein as = a > mismatch between the negotiated TokenBindingKeyParameters and in the the > TokenBindingKeyParameters of the provided_token_binding TokenBindingID. > > > > We could special-case and say that if a server picks the exact TB version > a client sent, and the client=E2=80=99s subsequent request does not conta= in the TB > message, then the request MUST be rejected. > > However, in practice this feels like a failure case for no good reason. > > > > I think we have 4 possibilities: > > 1. The client sends a TB message and a bound token =3D> the server > verifies per TBPROTO. > > 2. The client sends a TB message and no bound token =3D> the server > verifies per TBPROTO. > > 3. The client sends no TB message and a bound token =3D> the server > rejects per TBPROTO. > > 4. The client sends no TB message and no bound token =3D> we could > require that this be rejected, if the server picked the client=E2=80=99s = offered TB > version, but why create this failure case? > I'm not sure to be honest. That's why I'm asking. I don't fully understand the reasoning behind the requirements that exist between the handshake negotiation to checking the TB message. And the treatment of this case feels a bit inconsistent to me. If TB was not negotiated but a TB message is sent, reject the bindings. If TB was negotiated but the keyparams of the provided TB in the TB message doesn't match the negotiated keyparams, reject the bindings. When the TB version negotiated is identical but a TB message isn't sent, it would seem to suggest at least a misbehaving client. Maybe that's okay though. Even as I write it, it doesn't seem as inconsistent as it did in my mind before. But I'm asking to try and better understand the ramifications of the case. And the others. Are there implications beyond a misbehaving client in the case of a mismatch between the key parameters type that was negotiated and the key parameters type of the provided_token_binding in the TB message? --94eb2c0ef0e27facae05441c674e Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Thanks Andrei, some further discussion inline...
=

On Mon, Dec 19, 2= 016 at 5:37 PM, Andrei Popov <Andrei.Popov@microsoft.com><= /span> wrote:

=C3=98=C2=A0 What should a server do if it receives an = HTTP request without a Sec-Token-Binding header on a TLS connection where t= oken binding was negotiated in the handshake?

This means TB is n= ot established with this client, see TBNEGO: =E2=80=9CIf the client does not support the Token Binding proto= col version selected by the server, then the connection proceeds without To= ken Binding.=E2=80=9D

I knew I'= d seen something like that somewhere but couldn't conjure it up. Thanks= for the pointer/reminder.

But in defense of my own dumb = question, that clearly covers the case where the client doesn't support= the TB version that the server chose. But doesn't address the case whe= re the client and server both indicate exactly the same versions during neg= otiation but no TB message is sent at the application layer.=C2=A0


=C3=98=C2=A0 The case where the client and server both = indicate exactly the same versions during negotiation but no TokenBindingMe= ssage is sent, for example, seems like it should be a failure condition in the same vein as a mismatch between th= e negotiated TokenBindingKeyParameters and in the the TokenBindingKeyParame= ters of the=C2=A0 provided_token_binding TokenBindingID.

=C2=A0

We could special-case and say that if a server = picks the exact TB version a client sent, and the client=E2=80=99s subseque= nt request does not contain the TB message, then the request MUST be rejected.

However, in practice this feels like a failure = case for no good reason.

=C2=A0

I think we have 4 possibilities:<= /span>

1.=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 The client sends a TB message and a bound = token =3D> the server verifies per TBPROTO.

2.=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 The client sends a TB message and no bound= token =3D> the server verifies per TBPROTO.

3.=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 The client sends no TB message and a bound= token =3D> the server rejects per TBPROTO.

4.=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 The client sends no TB message and no boun= d token =3D> we could require that this be rejected, if the server picke= d the client=E2=80=99s offered TB version, but why create this failure case?

I'm not sur= e to be honest. That's why I'm asking. I don't fully understand= the reasoning behind the requirements that exist between the handshake neg= otiation to checking the TB message. And the treatment of this case feels a= bit inconsistent to me. If TB was not negotiated but a TB message is sent,= reject the bindings. If TB was negotiated but the keyparams of the provide= d TB in the TB message doesn't match the negotiated keyparams, reject t= he bindings. When the TB version negotiated is identical but a TB message i= sn't sent, it would seem to suggest at least a misbehaving client. Mayb= e that's okay though. Even as I write it, it doesn't seem as incons= istent as it did in my mind before. But I'm asking to try and better un= derstand the ramifications of the case. And the others. Are there implicati= ons beyond a misbehaving client in the case of a mismatch between the key p= arameters type that was negotiated and the key parameters type of the provi= ded_token_binding in the TB message?




<= div>
=C2=A0

--94eb2c0ef0e27facae05441c674e-- From nobody Tue Dec 20 12:04:44 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4649D1295E5 for ; Tue, 20 Dec 2016 12:04:43 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.8 X-Spam-Level: X-Spam-Status: No, score=-5.8 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-3.1, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sO-zQ7rmvx_8 for ; Tue, 20 Dec 2016 12:04:41 -0800 (PST) Received: from mail-qk0-x22a.google.com (mail-qk0-x22a.google.com [IPv6:2607:f8b0:400d:c09::22a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EB7861295ED for ; Tue, 20 Dec 2016 12:04:40 -0800 (PST) Received: by mail-qk0-x22a.google.com with SMTP id u25so49608467qki.2 for ; Tue, 20 Dec 2016 12:04:40 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=Jefungx7UrBtEltyiQfbCaPx/WqsOYn5zEnptidbsjQ=; b=HSa6SgZUseVhh6DaezFUbdQmMqDIEJ7DLDoGJgHvS3XUOixOfpLWSq1LUrOyIvkRmJ PmYy1ONH4VY4L8ho8WO+1NAfWpGOrSO89UQNuE9GZMZlCsILYSpd4zvPke0R5OBGm8OL alvlSY2FE6kv0zjIg0NbMyNUUvIeM6Mc1TU6JKaAlX6g6szgEwibjik4cUjS7EruoFJz RP9TpSiKNLCaMyCqcSUdgbnf97VE3+jAc0gubnZqY9YfMeahUL6pIS1zB7wyntLlaUJu tkYr/ngMCBRJ5dadE5abK1xdma1JZonPet/hUQiHdunyP0vi1otR98DKbSf8jPG3Sgq6 5k5g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=Jefungx7UrBtEltyiQfbCaPx/WqsOYn5zEnptidbsjQ=; b=WnI0X8nlkCUpJae5HZnsMKYfIp9xvymxDnEfH+WTjP8IrzckJpV3XgXOPtgQj3/9S/ X8vyQosrniiYZNV20efld8xfflkiu3BZxGqNVQc2hnclpjOacdTy1MUtBDb0uRVDR0fR 7F31i9JYKFOa1YtH5buScWGXRsuylNZNmn46fiKLhDxQ5du0Q7wxJNTiUYNVaiGqYm6Y kBxXBRc82tagLIUqCAJMUAdna1KKGOxb6gbz6RrbzuXhgr0GG/1zKIWRY0/nJu5IFOmh GWwwqQk+bEZuPSfUcMnlybZ37yUIlOqxa/lN+WdsYGlZAl3l3ksxAQKBKRFPPLkXD2cJ rqww== X-Gm-Message-State: AIkVDXKkJZr7/KJ4f6FKO/wvhjs3AxoMgG1rbOYQ/r1atSnMaEh3ocDejpG54OkqtYt0qDMSvrzHDVlXhqwIFBs6 X-Received: by 10.55.70.76 with SMTP id t73mr1179081qka.195.1482264279884; Tue, 20 Dec 2016 12:04:39 -0800 (PST) MIME-Version: 1.0 Received: by 10.140.17.52 with HTTP; Tue, 20 Dec 2016 12:04:19 -0800 (PST) In-Reply-To: References: From: Nick Harper Date: Tue, 20 Dec 2016 12:04:19 -0800 Message-ID: To: Brian Campbell Content-Type: multipart/alternative; boundary=001a114abf6ade43b805441c8bd4 Archived-At: Cc: Andrei Popov , IETF Tokbind WG Subject: Re: [Unbearable] (late, sorry) WGLC question on establishing the binding or not X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 20 Dec 2016 20:04:43 -0000 --001a114abf6ade43b805441c8bd4 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable On Tue, Dec 20, 2016 at 11:53 AM, Brian Campbell wrote: > Thanks Andrei, some further discussion inline... > > On Mon, Dec 19, 2016 at 5:37 PM, Andrei Popov > wrote: > >> =C3=98 What should a server do if it receives an HTTP request without a >> Sec-Token-Binding header on a TLS connection where token binding was >> negotiated in the handshake? >> >> This means TB is not established with this client, see TBNEGO: =E2=80=9C= If the >> client does not support the Token Binding protocol version selected by t= he >> server, then the connection proceeds without Token Binding.=E2=80=9D >> > I knew I'd seen something like that somewhere but couldn't conjure it up. > Thanks for the pointer/reminder. > > But in defense of my own dumb question, that clearly covers the case wher= e > the client doesn't support the TB version that the server chose. But > doesn't address the case where the client and server both indicate exactl= y > the same versions during negotiation but no TB message is sent at the > application layer. > > > =C3=98 The case where the client and server both indicate exactly the sa= me >> versions during negotiation but no TokenBindingMessage is sent, for >> example, seems like it should be a failure condition in the same vein as= a >> mismatch between the negotiated TokenBindingKeyParameters and in the the >> TokenBindingKeyParameters of the provided_token_binding TokenBindingID. >> >> >> >> We could special-case and say that if a server picks the exact TB versio= n >> a client sent, and the client=E2=80=99s subsequent request does not cont= ain the TB >> message, then the request MUST be rejected. >> >> However, in practice this feels like a failure case for no good reason. >> >> >> >> I think we have 4 possibilities: >> >> 1. The client sends a TB message and a bound token =3D> the server >> verifies per TBPROTO. >> >> 2. The client sends a TB message and no bound token =3D> the serve= r >> verifies per TBPROTO. >> >> 3. The client sends no TB message and a bound token =3D> the serve= r >> rejects per TBPROTO. >> >> 4. The client sends no TB message and no bound token =3D> we could >> require that this be rejected, if the server picked the client=E2=80=99s= offered TB >> version, but why create this failure case? >> > I'm not sure to be honest. That's why I'm asking. I don't fully understan= d > the reasoning behind the requirements that exist between the handshake > negotiation to checking the TB message. And the treatment of this case > feels a bit inconsistent to me. If TB was not negotiated but a TB message > is sent, reject the bindings. If TB was negotiated but the keyparams of t= he > provided TB in the TB message doesn't match the negotiated keyparams, > reject the bindings. When the TB version negotiated is identical but a TB > message isn't sent, it would seem to suggest at least a misbehaving clien= t. > Maybe that's okay though. Even as I write it, it doesn't seem as > inconsistent as it did in my mind before. But I'm asking to try and bette= r > understand the ramifications of the case. And the others. Are there > implications beyond a misbehaving client in the case of a mismatch betwee= n > the key parameters type that was negotiated and the key parameters type o= f > the provided_token_binding in the TB message? > > Since in this case (client and server sent exact same TB version in nego) a server knows that the client supports TB, so if the client doesn't send a TB message, either some sort of weird attack is happening (which we definitely don't want), or the client is buggy and negotiated TB when it shouldn't have. I would suggest that when servers can detect buggy clients, they be as strict as possible, which would mean TB should say that a server SHOULD reject the TB message (and maybe close the connection) in this case. > > > > > > > > _______________________________________________ > Unbearable mailing list > Unbearable@ietf.org > https://www.ietf.org/mailman/listinfo/unbearable > > --001a114abf6ade43b805441c8bd4 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable


On Tue, Dec 20, 2016 at 11:53 AM, Brian Campbell <= bcampbell@p= ingidentity.com> wrote:
Thanks Andrei, some further discussion inline...

On = Mon, Dec 19, 2016 at 5:37 PM, Andrei Popov <Andrei.Popov@microsof= t.com> wrote:

=C3=98=C2=A0 What should a server do if it receives an = HTTP request without a Sec-Token-Binding header on a TLS connection where t= oken binding was negotiated in the handshake?

This means TB is n= ot established with this client, see TBNEGO: =E2=80=9CIf the client does not support the Token Binding proto= col version selected by the server, then the connection proceeds without To= ken Binding.=E2=80=9D

I knew= I'd seen something like that somewhere but couldn't conjure it up.= Thanks for the pointer/reminder.

But in defense of my ow= n dumb question, that clearly covers the case where the client doesn't = support the TB version that the server chose. But doesn't address the c= ase where the client and server both indicate exactly the same versions dur= ing negotiation but no TB message is sent at the application layer.=C2=A0 <= br>


<= span style=3D"font-size:11pt;font-family:"calibri light",sans-ser= if">

=C3=98=C2=A0 The case where the client and server both = indicate exactly the same versions during negotiation but no TokenBindingMe= ssage is sent, for example, seems like it should be a failure condition in the same vein as a mismatch between th= e negotiated TokenBindingKeyParameters and in the the TokenBindingKeyParame= ters of the=C2=A0 provided_token_binding TokenBindingID.

=C2=A0

We could special-case and say that if a server = picks the exact TB version a client sent, and the client=E2=80=99s subseque= nt request does not contain the TB message, then the request MUST be rejected.

However, in practice this feels like a failure = case for no good reason.

=C2=A0

I think we have 4 possibilities:<= /span>

1.=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0 The client sends a TB message and a bound = token =3D> the server verifies per TBPROTO.

2.=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0 The client sends a TB message and no bound= token =3D> the server verifies per TBPROTO.

3.=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0 The client sends no TB message and a bound= token =3D> the server rejects per TBPROTO.

4.=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0 The client sends no TB message and no boun= d token =3D> we could require that this be rejected, if the server picke= d the client=E2=80=99s offered TB version, but why create this failure case?

I'm = not sure to be honest. That's why I'm asking. I don't fully und= erstand the reasoning behind the requirements that exist between the handsh= ake negotiation to checking the TB message. And the treatment of this case = feels a bit inconsistent to me. If TB was not negotiated but a TB message i= s sent, reject the bindings. If TB was negotiated but the keyparams of the = provided TB in the TB message doesn't match the negotiated keyparams, r= eject the bindings. When the TB version negotiated is identical but a TB me= ssage isn't sent, it would seem to suggest at least a misbehaving clien= t. Maybe that's okay though. Even as I write it, it doesn't seem as= inconsistent as it did in my mind before. But I'm asking to try and be= tter understand the ramifications of the case. And the others. Are there im= plications beyond a misbehaving client in the case of a mismatch between th= e key parameters type that was negotiated and the key parameters type of th= e provided_token_binding in the TB message?

=
Since in this case (client and server s= ent exact same TB version in nego) a server knows that the client supports = TB, so if the client doesn't send a TB message, either some sort of wei= rd attack is happening (which we definitely don't want), or the client = is buggy and negotiated TB when it shouldn't have. I would suggest that= when servers can detect buggy clients, they be as strict as possible, whic= h would mean TB should say that a server SHOULD reject the TB message (and = maybe close the connection) in this case.
=C2=A0



=C2=A0

=

_______________________________________________
Unbearable mailing list
Unbearable@ietf.org
https://www.ietf.org/mailman/listinfo/unbearabl= e


--001a114abf6ade43b805441c8bd4-- From nobody Tue Dec 20 12:11:41 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2A7141295DE for ; Tue, 20 Dec 2016 12:11:39 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.021 X-Spam-Level: X-Spam-Status: No, score=-2.021 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id o0cfWcOI9CJI for ; Tue, 20 Dec 2016 12:11:37 -0800 (PST) Received: from NAM02-BL2-obe.outbound.protection.outlook.com (mail-bl2nam02on0127.outbound.protection.outlook.com [104.47.38.127]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F13AD12941D for ; Tue, 20 Dec 2016 12:11:36 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=QQdanEZHr5xM3MKhfoLUfbmuQI/2hePfwGFnnQvF/Fw=; b=YTxRM1i4QJRrGyZyPz3CAkFeDqEOGPGOSsXei1Ddc+ua0it0EPyJJnFQM6mH2in4gHo23QobXyiTiGZo9ZyI/z7eVeP4N1fN7oweMKlEHp+SKHzE6wnfx87iCnGgEhm0rzX7MOSdSAia+sZXMq2Pt7VdKqOJqwPC5IeWuIiwfx0= Received: from CY1PR0301MB0842.namprd03.prod.outlook.com (10.160.163.148) by CY1PR0301MB0842.namprd03.prod.outlook.com (10.160.163.148) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.789.14; Tue, 20 Dec 2016 20:11:34 +0000 Received: from CY1PR0301MB0842.namprd03.prod.outlook.com ([10.160.163.148]) by CY1PR0301MB0842.namprd03.prod.outlook.com ([10.160.163.148]) with mapi id 15.01.0789.018; Tue, 20 Dec 2016 20:11:34 +0000 From: Andrei Popov To: Nick Harper , Brian Campbell Thread-Topic: [Unbearable] (late, sorry) WGLC question on establishing the binding or not Thread-Index: AQHSWvrivRNalV6Ld0i/cnyaQrT2PaERQomAgAABJTA= Date: Tue, 20 Dec 2016 20:11:34 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Andrei.Popov@microsoft.com; x-originating-ip: [2001:4898:80e8:7::1d2] x-ms-office365-filtering-correlation-id: 403c88e6-96dc-4de1-f659-08d4291465ae x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001); SRVR:CY1PR0301MB0842; x-microsoft-exchange-diagnostics: 1; CY1PR0301MB0842; 7:rZCfEP6X7n5NZAUMAancFExeO2AtGfm3c8of4Rp7D/8/FXXOPkWa7nu2m9cnxUxSSiAoZpsgWbAOFGSFZIsb7wqQ4isyDR7HspG4vVh6I53W+xPSNuoBflvucZbBUOeRYtrbX4QIpt/frWIqJXhUwlHTupjdOB5dLA8Os/C4zkzRRLXm3A2zApb8ZhJavAmfLjsTMaIHuE1oFPEzgVSMwCX0TyEsK1zM1UZuj92FIx4iQIJJGDIl8m2r2ljv/UHpWHW3NyTNejysOgcyte7peJnOn0nzXCryr4mbr+bYhchIG/kgzvcecqNY1xfjA/S8BJbc+1VUbbMBiOJssmAAzjNIo9u/VFgBNiDTFdHQq6uWxGA/xOWpCYLxJQk3rNN3YN3/p0wDNES/kM2++YxT4buI7fwsWPpoahr93z/AhNFkdf219+NYGShb0h6dCRZw5uZbXB58KOnEUKoT8HspWbFFQ9QoZNsg3Bhii331bPs= x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(158342451672863)(21748063052155); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040375)(601004)(2401047)(8121501046)(5005006)(3002001)(10201501046)(6055026)(61426038)(61427038)(6041248)(20161123560025)(20161123564025)(20161123562025)(20161123555025)(6072148)(6047074); SRVR:CY1PR0301MB0842; BCL:0; PCL:0; RULEID:; SRVR:CY1PR0301MB0842; x-forefront-prvs: 0162ACCC24 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(6009001)(7916002)(39840400002)(39450400003)(39850400002)(39410400002)(39860400002)(189002)(199003)(68736007)(77096006)(105586002)(8936002)(54356999)(106356001)(106116001)(2906002)(99286002)(5660300001)(229853002)(81166006)(4326007)(8676002)(6506006)(790700001)(38730400001)(101416001)(93886004)(81156014)(189998001)(7696004)(6116002)(102836003)(6436002)(8990500004)(86612001)(92566002)(3660700001)(76176999)(76576001)(97736004)(5001770100001)(10090500001)(86362001)(2950100002)(10290500002)(5005710100001)(3280700002)(7736002)(74316002)(33656002)(9686002)(122556002)(50986999)(2900100001)(25786008); DIR:OUT; SFP:1102; SCL:1; SRVR:CY1PR0301MB0842; H:CY1PR0301MB0842.namprd03.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:1; LANG:en; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_CY1PR0301MB084208DBC92146CE08CCB4668C900CY1PR0301MB0842_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 20 Dec 2016 20:11:34.6311 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY1PR0301MB0842 Archived-At: Cc: IETF Tokbind WG Subject: Re: [Unbearable] (late, sorry) WGLC question on establishing the binding or not X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 20 Dec 2016 20:11:39 -0000 --_000_CY1PR0301MB084208DBC92146CE08CCB4668C900CY1PR0301MB0842_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 w5ggIEkgZG9uJ3QgZnVsbHkgdW5kZXJzdGFuZCB0aGUgcmVhc29uaW5nIGJlaGluZCB0aGUgcmVx dWlyZW1lbnRzIHRoYXQgZXhpc3QgYmV0d2VlbiB0aGUgaGFuZHNoYWtlIG5lZ290aWF0aW9uIHRv IGNoZWNraW5nIHRoZSBUQiBtZXNzYWdlLg0KSeKAmWxsIHRyeSB0byBoZWxwIHdpdGggdGhpcy4N Cg0KDQrDmCAgSWYgVEIgd2FzIG5vdCBuZWdvdGlhdGVkIGJ1dCBhIFRCIG1lc3NhZ2UgaXMgc2Vu dCwgcmVqZWN0IHRoZSBiaW5kaW5ncy4NClRoZSBzZXJ2ZXIgdGhhdCBpc27igJl0IGNvbmZpZ3Vy ZWQgdG8gdXNlIFRCIHNob3VsZCBub3QgaW5jdXIgVEIgdmVyaWZpY2F0aW9uIGNvc3RzLg0KDQoN CsOYICBJZiBUQiB3YXMgbmVnb3RpYXRlZCBidXQgdGhlIGtleXBhcmFtcyBvZiB0aGUgcHJvdmlk ZWQgVEIgaW4gdGhlIFRCIG1lc3NhZ2UgZG9lc24ndCBtYXRjaCB0aGUgbmVnb3RpYXRlZCBrZXlw YXJhbXMsIHJlamVjdCB0aGUgYmluZGluZ3MuDQpSaWdodCwgc28gdGhlcmUgaXMgbm8gZG93bmdy YWRlIGZyb20gd2hhdOKAmXMgbmVnb3RpYXRlZC4gQWxzbywgdGhpcyBwcmV2ZW50cyB0aGUgY2xp ZW50IHVzaW5nIHBhcmFtZXRlcnMgdW5zdXBwb3J0ZWQgYnkgdGhlIHNlcnZlci4NCg0KDQrDmCAg V2hlbiB0aGUgVEIgdmVyc2lvbiBuZWdvdGlhdGVkIGlzIGlkZW50aWNhbCBidXQgYSBUQiBtZXNz YWdlIGlzbid0IHNlbnQsIGl0IHdvdWxkIHNlZW0gdG8gc3VnZ2VzdCBhdCBsZWFzdCBhIG1pc2Jl aGF2aW5nIGNsaWVudC4NClllcywgYnV0IGlmIHRoZXJl4oCZcyBubyBib3VuZCB0b2tlbiBpbiB0 aGUgcmVxdWVzdCwgSSB0aGluayB0aGUgc2VydmVyIGNhbiBpZ25vcmUgdGhlIGxhY2sgb2YgVEIg bWVzc2FnZSAocGxlYXNlIGxldCBtZSBrbm93IGlmIHlvdSBoYXZlIGFuIGF0dGFjayBpbiBtaW5k KS4NCklmIHRoaXMgcmVxdWVzdCBoYXMgYSBib3VuZCB0b2tlbiBpbiBpdCwgZXhpc3RpbmcgbGFu Z3VhZ2Ugd2lsbCByZXF1aXJlIHRoZSBzZXJ2ZXIgdG8gcmVqZWN0Lg0KDQpDaGVlcnMsDQoNCkFu ZHJlaQ0K --_000_CY1PR0301MB084208DBC92146CE08CCB4668C900CY1PR0301MB0842_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 V2luZ2RpbmdzOw0KCXBhbm9zZS0xOjUgMCAwIDAgMCAwIDAgMCAwIDA7fQ0KQGZvbnQtZmFjZQ0K CXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2IDMg MiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1 IDUgMiAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWws IGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0 b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcg Um9tYW4iLHNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXBy aW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQph OnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5 Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnAuTXNv TGlzdFBhcmFncmFwaCwgbGkuTXNvTGlzdFBhcmFncmFwaCwgZGl2Lk1zb0xpc3RQYXJhZ3JhcGgN Cgl7bXNvLXN0eWxlLXByaW9yaXR5OjM0Ow0KCW1hcmdpbi10b3A6MGluOw0KCW1hcmdpbi1yaWdo dDowaW47DQoJbWFyZ2luLWJvdHRvbTowaW47DQoJbWFyZ2luLWxlZnQ6LjVpbjsNCgltYXJnaW4t Ym90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGltZXMg TmV3IFJvbWFuIixzZXJpZjt9DQpwLm1zb25vcm1hbDAsIGxpLm1zb25vcm1hbDAsIGRpdi5tc29u b3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCgltc28tbWFyZ2luLXRvcC1hbHQ6 YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0K CW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1l cyBOZXcgUm9tYW4iLHNlcmlmO30NCnAubS00MTMzNDkwOTk2NTg1Njg5MTc2Z21haWwtbS0yMTA1 MjUxOTI3NDAzOTU2OTUzZ21haWwtbTExNDg0OTk0NjEzNTcxNjYzMjFnbWFpbC1tNTYyNDgwNzUy Mjk0MTY1NTE0Nm1zb2xpc3RwYXJhZ3JhcGgsIGxpLm0tNDEzMzQ5MDk5NjU4NTY4OTE3NmdtYWls LW0tMjEwNTI1MTkyNzQwMzk1Njk1M2dtYWlsLW0xMTQ4NDk5NDYxMzU3MTY2MzIxZ21haWwtbTU2 MjQ4MDc1MjI5NDE2NTUxNDZtc29saXN0cGFyYWdyYXBoLCBkaXYubS00MTMzNDkwOTk2NTg1Njg5 MTc2Z21haWwtbS0yMTA1MjUxOTI3NDAzOTU2OTUzZ21haWwtbTExNDg0OTk0NjEzNTcxNjYzMjFn bWFpbC1tNTYyNDgwNzUyMjk0MTY1NTE0Nm1zb2xpc3RwYXJhZ3JhcGgNCgl7bXNvLXN0eWxlLW5h bWU6bV8tNDEzMzQ5MDk5NjU4NTY4OTE3NmdtYWlsLW1fLTIxMDUyNTE5Mjc0MDM5NTY5NTNnbWFp bC1tXzExNDg0OTk0NjEzNTcxNjYzMjFnbWFpbC1tXzU2MjQ4MDc1MjI5NDE2NTUxNDZtc29saXN0 cGFyYWdyYXBoOw0KCW1zby1tYXJnaW4tdG9wLWFsdDphdXRvOw0KCW1hcmdpbi1yaWdodDowaW47 DQoJbXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87DQoJbWFyZ2luLWxlZnQ6MGluOw0KCWZvbnQt c2l6ZToxMi4wcHQ7DQoJZm9udC1mYW1pbHk6IlRpbWVzIE5ldyBSb21hbiIsc2VyaWY7fQ0Kc3Bh bi5FbWFpbFN0eWxlMTkNCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwtcmVwbHk7DQoJZm9udC1m YW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6d2luZG93dGV4dDt9DQpzcGFuLkVt YWlsU3R5bGUyMQ0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbDsNCglmb250LWZhbWlseToiQ2Fs aWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjp3aW5kb3d0ZXh0O30NCi5Nc29DaHBEZWZhdWx0DQoJ e21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5z LXNlcmlmO30NCkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjguNWluIDExLjBpbjsNCgltYXJn aW46MS4waW4gMS4waW4gMS4waW4gMS4waW47fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldv cmRTZWN0aW9uMTt9DQovKiBMaXN0IERlZmluaXRpb25zICovDQpAbGlzdCBsMA0KCXttc28tbGlz dC1pZDozNjQwNjY5OTA7DQoJbXNvLWxpc3QtdHlwZTpoeWJyaWQ7DQoJbXNvLWxpc3QtdGVtcGxh dGUtaWRzOjIxMDkwMDg5MzQgNDcyNDIwODI0IDY3Njk4NjkxIDY3Njk4NjkzIDY3Njk4Njg5IDY3 Njk4NjkxIDY3Njk4NjkzIDY3Njk4Njg5IDY3Njk4NjkxIDY3Njk4NjkzO30NCkBsaXN0IGwwOmxl dmVsMQ0KCXttc28tbGV2ZWwtc3RhcnQtYXQ6MDsNCgltc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpi dWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674OYOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0K CW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJ Zm9udC1mYW1pbHk6V2luZ2RpbmdzOw0KCW1zby1mYXJlYXN0LWZvbnQtZmFtaWx5OkNhbGlicmk7 DQoJbXNvLWJpZGktZm9udC1mYW1pbHk6IlRpbWVzIE5ldyBSb21hbiI7fQ0KQGxpc3QgbDA6bGV2 ZWwyDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDpv Ow0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246 bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3Ijt9 DQpAbGlzdCBsMDpsZXZlbDMNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1z by1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwt bnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5 OldpbmdkaW5nczt9DQpAbGlzdCBsMDpsZXZlbDQNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6 YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsN Cgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0K CWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMDpsZXZlbDUNCgl7bXNvLWxldmVsLW51bWJl ci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Om87DQoJbXNvLWxldmVsLXRhYi1zdG9w Om5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0u MjVpbjsNCglmb250LWZhbWlseToiQ291cmllciBOZXciO30NCkBsaXN0IGwwOmxldmVsNg0KCXtt c28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1z by1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsN Cgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGww OmxldmVsNw0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRl eHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9z aXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6U3ltYm9sO30N CkBsaXN0IGwwOmxldmVsOA0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNv LWxldmVsLXRleHQ6bzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVt YmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OiJD b3VyaWVyIE5ldyI7fQ0KQGxpc3QgbDA6bGV2ZWw5DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0 OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7 DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsN Cglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDENCgl7bXNvLWxpc3QtaWQ6MTEyNDA4 MzIwMzsNCgltc28tbGlzdC10eXBlOmh5YnJpZDsNCgltc28tbGlzdC10ZW1wbGF0ZS1pZHM6LTM2 NzM2ODQxOCA2NDAxNjk1NTggNjc2OTg2OTEgNjc2OTg2OTMgNjc2OTg2ODkgNjc2OTg2OTEgNjc2 OTg2OTMgNjc2OTg2ODkgNjc2OTg2OTEgNjc2OTg2OTM7fQ0KQGxpc3QgbDE6bGV2ZWwxDQoJe21z by1sZXZlbC1zdGFydC1hdDowOw0KCW1zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCglt c28tbGV2ZWwtdGV4dDrvg5g7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVs LW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWls eTpXaW5nZGluZ3M7DQoJbXNvLWZhcmVhc3QtZm9udC1mYW1pbHk6Q2FsaWJyaTsNCgltc28tYmlk aS1mb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIjt9DQpAbGlzdCBsMTpsZXZlbDINCgl7bXNv LWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Om87DQoJbXNvLWxl dmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRl eHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseToiQ291cmllciBOZXciO30NCkBsaXN0IGwx OmxldmVsMw0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRl eHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9z aXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6V2luZ2Rpbmdz O30NCkBsaXN0IGwxOmxldmVsNA0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJ bXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZl bC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1p bHk6U3ltYm9sO30NCkBsaXN0IGwxOmxldmVsNQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpi dWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6bzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCglt c28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZv bnQtZmFtaWx5OiJDb3VyaWVyIE5ldyI7fQ0KQGxpc3QgbDE6bGV2ZWw2DQoJe21zby1sZXZlbC1u dW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRh Yi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5k ZW50Oi0uMjVpbjsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDE6bGV2ZWw3DQoJ e21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJ bXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0 Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDE6 bGV2ZWw4DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4 dDpvOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRp b246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3 Ijt9DQpAbGlzdCBsMTpsZXZlbDkNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0K CW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2 ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFt aWx5OldpbmdkaW5nczt9DQpvbA0KCXttYXJnaW4tYm90dG9tOjBpbjt9DQp1bA0KCXttYXJnaW4t Ym90dG9tOjBpbjt9DQotLT48L3N0eWxlPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hh cGVkZWZhdWx0cyB2OmV4dD0iZWRpdCIgc3BpZG1heD0iMTAyNiIgLz4NCjwveG1sPjwhW2VuZGlm XS0tPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVsYXlvdXQgdjpleHQ9ImVkaXQi Pg0KPG86aWRtYXAgdjpleHQ9ImVkaXQiIGRhdGE9IjEiIC8+DQo8L286c2hhcGVsYXlvdXQ+PC94 bWw+PCFbZW5kaWZdLS0+DQo8L2hlYWQ+DQo8Ym9keSBsYW5nPSJFTi1VUyIgbGluaz0iYmx1ZSIg dmxpbms9InB1cnBsZSI+DQo8ZGl2IGNsYXNzPSJXb3JkU2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1z b0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJ0ZXh0LWluZGVudDotLjI1aW47bXNvLWxpc3Q6bDAgbGV2 ZWwxIGxmbzIiPjwhW2lmICFzdXBwb3J0TGlzdHNdPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpX aW5nZGluZ3MiPjxzcGFuIHN0eWxlPSJtc28tbGlzdDpJZ25vcmUiPsOYPHNwYW4gc3R5bGU9ImZv bnQ6Ny4wcHQgJnF1b3Q7VGltZXMgTmV3IFJvbWFuJnF1b3Q7Ij4mbmJzcDsNCjwvc3Bhbj48L3Nw YW4+PC9zcGFuPjwhW2VuZGlmXT5JIGRvbid0IGZ1bGx5IHVuZGVyc3RhbmQgdGhlIHJlYXNvbmlu ZyBiZWhpbmQgdGhlIHJlcXVpcmVtZW50cyB0aGF0IGV4aXN0IGJldHdlZW4gdGhlIGhhbmRzaGFr ZSBuZWdvdGlhdGlvbiB0byBjaGVja2luZyB0aGUgVEIgbWVzc2FnZS48bzpwPjwvbzpwPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+SeKAmWxsIHRyeSB0byBoZWxw IHdpdGggdGhpcy48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1 b3Q7LHNhbnMtc2VyaWYiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29MaXN0UGFyYWdyYXBoIiBzdHlsZT0idGV4dC1pbmRlbnQ6LS4yNWluO21zby1saXN0OmwxIGxl dmVsMSBsZm8xIj48IVtpZiAhc3VwcG9ydExpc3RzXT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTpXaW5nZGluZ3MiPjxzcGFuIHN0eWxlPSJtc28tbGlzdDpJZ25vcmUi PsOYPHNwYW4gc3R5bGU9ImZvbnQ6Ny4wcHQgJnF1b3Q7VGltZXMgTmV3IFJvbWFuJnF1b3Q7Ij4m bmJzcDsNCjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwhW2VuZGlmXT5JZiBUQiB3YXMgbm90IG5lZ290 aWF0ZWQgYnV0IGEgVEIgbWVzc2FnZSBpcyBzZW50LCByZWplY3QgdGhlIGJpbmRpbmdzLjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZiI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZx dW90OyxzYW5zLXNlcmlmIj5UaGUgc2VydmVyIHRoYXQgaXNu4oCZdCBjb25maWd1cmVkIHRvIHVz ZSBUQiBzaG91bGQgbm90IGluY3VyIFRCIHZlcmlmaWNhdGlvbiBjb3N0cy48bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+Jm5i c3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBoIiBzdHlsZT0i dGV4dC1pbmRlbnQ6LS4yNWluO21zby1saXN0OmwxIGxldmVsMSBsZm8xIj48IVtpZiAhc3VwcG9y dExpc3RzXT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpXaW5nZGlu Z3MiPjxzcGFuIHN0eWxlPSJtc28tbGlzdDpJZ25vcmUiPsOYPHNwYW4gc3R5bGU9ImZvbnQ6Ny4w cHQgJnF1b3Q7VGltZXMgTmV3IFJvbWFuJnF1b3Q7Ij4mbmJzcDsNCjwvc3Bhbj48L3NwYW4+PC9z cGFuPjwhW2VuZGlmXT5JZiBUQiB3YXMgbmVnb3RpYXRlZCBidXQgdGhlIGtleXBhcmFtcyBvZiB0 aGUgcHJvdmlkZWQgVEIgaW4gdGhlIFRCIG1lc3NhZ2UgZG9lc24ndCBtYXRjaCB0aGUgbmVnb3Rp YXRlZCBrZXlwYXJhbXMsIHJlamVjdCB0aGUgYmluZGluZ3MuPHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj48bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYi PlJpZ2h0LCBzbyB0aGVyZSBpcyBubyBkb3duZ3JhZGUgZnJvbSB3aGF04oCZcyBuZWdvdGlhdGVk LiBBbHNvLCB0aGlzIHByZXZlbnRzIHRoZSBjbGllbnQgdXNpbmcgcGFyYW1ldGVycyB1bnN1cHBv cnRlZCBieSB0aGUgc2VydmVyLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouMjVpbiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj48bzpwPiZu YnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTGlzdFBhcmFncmFwaCIgc3R5bGU9 InRleHQtaW5kZW50Oi0uMjVpbjttc28tbGlzdDpsMSBsZXZlbDEgbGZvMSI+PCFbaWYgIXN1cHBv cnRMaXN0c10+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6V2luZ2Rp bmdzIj48c3BhbiBzdHlsZT0ibXNvLWxpc3Q6SWdub3JlIj7DmDxzcGFuIHN0eWxlPSJmb250Ojcu MHB0ICZxdW90O1RpbWVzIE5ldyBSb21hbiZxdW90OyI+Jm5ic3A7DQo8L3NwYW4+PC9zcGFuPjwv c3Bhbj48IVtlbmRpZl0+V2hlbiB0aGUgVEIgdmVyc2lvbiBuZWdvdGlhdGVkIGlzIGlkZW50aWNh bCBidXQgYSBUQiBtZXNzYWdlIGlzbid0IHNlbnQsIGl0IHdvdWxkIHNlZW0gdG8gc3VnZ2VzdCBh dCBsZWFzdCBhIG1pc2JlaGF2aW5nIGNsaWVudC48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+WWVzLCBi dXQgaWYgdGhlcmXigJlzIG5vIGJvdW5kIHRva2VuIGluIHRoZSByZXF1ZXN0LCBJIHRoaW5rIHRo ZSBzZXJ2ZXIgY2FuIGlnbm9yZSB0aGUgbGFjayBvZiBUQiBtZXNzYWdlIChwbGVhc2UgbGV0IG1l IGtub3cgaWYgeW91IGhhdmUgYW4gYXR0YWNrIGluIG1pbmQpLjxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+SWYgdGhpcyByZXF1ZXN0 IGhhcyBhIGJvdW5kIHRva2VuIGluIGl0LCBleGlzdGluZyBsYW5ndWFnZSB3aWxsIHJlcXVpcmUg dGhlIHNlcnZlciB0byByZWplY3QuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkNoZWVycyw8bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+Jm5i c3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJp ZiI+QW5kcmVpPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+ DQo= --_000_CY1PR0301MB084208DBC92146CE08CCB4668C900CY1PR0301MB0842_-- From nobody Tue Dec 20 12:58:21 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 65DDF129416 for ; Tue, 20 Dec 2016 12:58:17 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.8 X-Spam-Level: X-Spam-Status: No, score=-5.8 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-3.1, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id h0hMgbkkgBUU for ; Tue, 20 Dec 2016 12:58:15 -0800 (PST) Received: from mail-qt0-x232.google.com (mail-qt0-x232.google.com [IPv6:2607:f8b0:400d:c0d::232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DD44C129616 for ; Tue, 20 Dec 2016 12:58:14 -0800 (PST) Received: by mail-qt0-x232.google.com with SMTP id n6so188791733qtd.1 for ; Tue, 20 Dec 2016 12:58:14 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=xBGZXjXSp09reZYqsVPAPnQ9P6ZJsFpxsE4U7qeNNGI=; b=Ejr4Uj7C9qBL1kXkF4RYGQKl1NxlKXRjESij/RsOSYcgClTjzWgIKJivF5tJek/JrT I3t94XQ+ptrZhjc9bD2btluKq5HJK5kp6mP/G7arW+JQXCAiEfIB8Ycmm6JgAHOd+0ZX 1BG+8IGAj1wzaq4y/oU/yY/A6DAO19wxizZJf1/mVlxRe/zHpcjzH/2G3xywPfzvqxw4 CfuOLTKo4biHxYevmxNsr2ZS0oZ/ykv+R4WZGryQfwPqM9gixiAVWNCjxcZs0ZCTjo6A z3BLIv9t5rDndjhGckIAvdA3BVSvuUL/eXYzwuUTzttsEM/qvaJrGN034+20c9g7UYMb 0OnA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=xBGZXjXSp09reZYqsVPAPnQ9P6ZJsFpxsE4U7qeNNGI=; b=qo4VdCbuAaXw73o8yearHbTRcbaeH+tp7XbTIfRKv48FXo88x4DjEce4JHoCAFuUM/ TQ76JeLA488rN0Bzl34JJBybkwN7+VkW6qoHA5reMolRatjWdqKawnGUwT15kK5L9Bqa JIroB8+5hPDEQmnAo5bLLD9iyubH7YLm11S7aBPwIFWI9dnp6CXVDr69rBjp4ndhv0s5 SXcxW5wWM51G/uFZV9HJcX8qWkY0yI/Lreav/siW+VYp9RmM5PzI9ZobYb5DDsbM4fLS 5GWC42oG+uyq1uPzLZGRvsozkmmQQEJQTLR9qn95S78EZYAPu8yQzKx8BdiOq8ZNa0zs zN/w== X-Gm-Message-State: AIkVDXJQdqj8JH4BLKc26AzQrAOmPMk/yIGq5FbDWT+FOLt5w7CTmvCH3pR4s5R1kWYcclcLruloxwitpYbDveA4 X-Received: by 10.237.39.37 with SMTP id n34mr1450739qtd.128.1482267493953; Tue, 20 Dec 2016 12:58:13 -0800 (PST) MIME-Version: 1.0 Received: by 10.140.17.52 with HTTP; Tue, 20 Dec 2016 12:57:53 -0800 (PST) In-Reply-To: References: From: Nick Harper Date: Tue, 20 Dec 2016 12:57:53 -0800 Message-ID: To: Andrei Popov Content-Type: multipart/alternative; boundary=94eb2c06c9d470b3bd05441d4b3e Archived-At: Cc: IETF Tokbind WG , Brian Campbell Subject: Re: [Unbearable] (late, sorry) WGLC question on establishing the binding or not X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 20 Dec 2016 20:58:17 -0000 --94eb2c06c9d470b3bd05441d4b3e Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable On Tue, Dec 20, 2016 at 12:11 PM, Andrei Popov wrote: > > =C3=98 When the TB version negotiated is identical but a TB message isn'= t > sent, it would seem to suggest at least a misbehaving client. > > Yes, but if there=E2=80=99s no bound token in the request, I think the se= rver can > ignore the lack of TB message (please let me know if you have an attack i= n > mind). > > If this request has a bound token in it, existing language will require > the server to reject. > I don't have a specific attack in mind here (perhaps you could have a mitm that's negotiating TB but then stripping TB messages, but that seems like a worse attack than the mitm not negotiating TB at all). I made an assumption that a client that negotiates TB but then doesn't send a TB message in accordance with the application profile is buggy. If this is a bug, I think servers should fail to inter-operate with it to reduce the number of buggy TB implementations in the ecosystem. > > > Cheers, > > > > Andrei > --94eb2c06c9d470b3bd05441d4b3e Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable


On Tue, Dec 20, 2016 at 12:11 PM, Andrei Popov <Andrei.Popov@= microsoft.com> wrote:

=C3=98=C2=A0 When the TB version negotiated is identical but= a TB message isn't sent, it would seem to suggest at least a misbehavi= ng client.

Yes, but if there=E2=80=99s no bound token in the r= equest, I think the server can ignore the lack of TB message (please let me= know if you have an attack in mind).

If this request has a bound token in it, existing l= anguage will require the server to reject.


I don't have a specific attack in mind here (per= haps you could have a mitm that's negotiating TB but then stripping TB = messages, but that seems like a worse attack than the mitm not negotiating = TB at all). I made an assumption that a client that negotiates TB but then = doesn't send a TB message in accordance with the application profile is= buggy. If this is a bug, I think servers should fail to inter-operate with= it to reduce the number of buggy TB implementations in the ecosystem.

=C2=A0

Cheers,

=C2=A0

Andrei


--94eb2c06c9d470b3bd05441d4b3e-- From nobody Tue Dec 20 14:02:17 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id ACBC3127078 for ; Tue, 20 Dec 2016 14:02:15 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=pingidentity.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jAkCuBmZPw7s for ; Tue, 20 Dec 2016 14:02:13 -0800 (PST) Received: from mail-io0-x22f.google.com (mail-io0-x22f.google.com [IPv6:2607:f8b0:4001:c06::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 632DF129415 for ; Tue, 20 Dec 2016 14:02:12 -0800 (PST) Received: by mail-io0-x22f.google.com with SMTP id m133so6479081iom.3 for ; Tue, 20 Dec 2016 14:02:12 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=pingidentity.com; s=gmail; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=ZauZHQh18e0+tbjUf0SY38Uuk9wSwj8TXfmlseI9Jvo=; b=RLqFByKh+ps7x3t7+CApncSY/ecEdvy9ZIqmtgALipmsOyAAmYxna0vxYqj3riy37O ig4ByEYMqHnj4VUanOPB7mNn92pYD8R+v0vxMNAxcmzkdsLjQhbpwl6f++AKLrBl2kij ARRhqbgIJzxPApyZCflk49FUemjIYBYu8h5sw= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=ZauZHQh18e0+tbjUf0SY38Uuk9wSwj8TXfmlseI9Jvo=; b=R6YfGU3CvR7ULETOSWCy9Myt6tZzZHh6Ag1WDdSLz2ABXdTRb6C2wtN5j7KUKwHcDe vdguTZCZCxOqUg2Re1Vxw3CTT8zrGnKF6cyyOOeTPZyohv3RinJasFh7wHyCl4Z0zQxO ZJCsPrVIRi9aA39QKc8Qm1So0P3RA19lcy9YgsBJy99KLnn1uCtZEtCcUPHzUj70ApRv 1TUBjteahjPB+D4B31aXW9CLyV9dtKvbsA6aJe9ZZqOHSo880jGU9C4jH/QH9bxTKpP9 yUzDzXzT12+7+f1VQ1s4ck+yqG+zmjnT5D64GkcWuAEKncza4Len85TbUy60PL8Nxtcr aWsQ== X-Gm-Message-State: AIkVDXLvCkQltxb1SBexR4OBkqIQOnGfrSe/4dW0mxBblwI20pKD9D1RLrlAlrl2BNPwHXJo/XQnEDDoBa3S6LFs X-Received: by 10.107.13.137 with SMTP id 131mr2300885ion.122.1482271331516; Tue, 20 Dec 2016 14:02:11 -0800 (PST) MIME-Version: 1.0 Received: by 10.79.31.5 with HTTP; Tue, 20 Dec 2016 14:01:40 -0800 (PST) In-Reply-To: References: From: Brian Campbell Date: Tue, 20 Dec 2016 15:01:40 -0700 Message-ID: To: Nick Harper Content-Type: multipart/alternative; boundary=001a113fdfd42d386305441e307c Archived-At: Cc: Andrei Popov , IETF Tokbind WG Subject: Re: [Unbearable] (late, sorry) WGLC question on establishing the binding or not X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 20 Dec 2016 22:02:16 -0000 --001a113fdfd42d386305441e307c Content-Type: text/plain; charset=UTF-8 > Since in this case (client and server sent exact same TB version in nego) > a server knows that the client supports TB, so if the client doesn't send a > TB message, either some sort of weird attack is happening (which we > definitely don't want), or the client is buggy and negotiated TB when it > shouldn't have. I would suggest that when servers can detect buggy clients, > they be as strict as possible, which would mean TB should say that a server > SHOULD reject the TB message (and maybe close the connection) in this case. > There's no TB message in that case so it'd have to be reject the application message (I guess a 400 for HTTP). But that's basically the same train of thought that I had. I don't feel all that strongly about it but that does align with my thoughts. --001a113fdfd42d386305441e307c Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable

=
Since in this case (clie= nt and server sent exact same TB version in nego) a server knows that the c= lient supports TB, so if the client doesn't send a TB message, either s= ome sort of weird attack is happening (which we definitely don't want),= or the client is buggy and negotiated TB when it shouldn't have. I wou= ld suggest that when servers can detect buggy clients, they be as strict as= possible, which would mean TB should say that a server SHOULD reject the T= B message (and maybe close the connection) in this case.
<= /div>

There's no TB message in that cas= e so it'd have to be reject the application message (I guess a 400 for = HTTP). But that's basically the same train of thought that I had. I don= 't feel all that strongly about it but that does align with my thoughts= .=C2=A0


--001a113fdfd42d386305441e307c-- From nobody Tue Dec 20 14:24:11 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 421E412965E for ; Tue, 20 Dec 2016 14:24:10 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=pingidentity.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4eArT25fYZnF for ; Tue, 20 Dec 2016 14:24:09 -0800 (PST) Received: from mail-io0-x22d.google.com (mail-io0-x22d.google.com [IPv6:2607:f8b0:4001:c06::22d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CB8D1129588 for ; Tue, 20 Dec 2016 14:24:08 -0800 (PST) Received: by mail-io0-x22d.google.com with SMTP id m133so6885620iom.3 for ; Tue, 20 Dec 2016 14:24:08 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=pingidentity.com; s=gmail; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=qBHfSN//6DeMA9sFWwAJf0bVtnOf+QUpfpacCwxWD9Y=; b=SZynx9VwfY/DGAjiF5rP/uETxknMRMydbZE1P9Gup4W6SsLo5N/YVqwPlFFoo+npMG nw2kgGwjWNK22d2kcyJPoAfuHTL7EOLcI+A2B33e10mXFFjIj/tNDs7sMYqVDdggAYb5 6rWqNrh4T11Jp4Qz7ut08Uv6cj07BiWjKX9FE= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=qBHfSN//6DeMA9sFWwAJf0bVtnOf+QUpfpacCwxWD9Y=; b=cxwZ2J2x1Rec8WWYtFv4gSezZ0V025WV0vZB/pqMl9G16nWCjQczQoYGKZGOnAJd9g afKzPZvkF364xDRrsJIQpt6VUiRe1g8V5qW/sWVnan+DZxZdVnF1Oj3T0KYBImygWmu/ /gBo4nUtxaOqSXQHKkKELlgQY7TaFVYwyDsNssgWkiO9CaR9ksofxDXVrmjSv1uSr0j+ p/i7l0sKfeWgIx7YLLASyD6VcqqPLRnIOVUN0u8m0DN7fYWBo9l9Lnj795e9RApLLFli +aK/F8uh/lG/xSZDOHM5s39CWZCFCHHifF/NSczUWYm0fioYFxmTTY4OsoGKBHug8Vey 1RnA== X-Gm-Message-State: AIkVDXII+ZB0Fd8i5j0/EVYvkW9CpzqPsjIbfPx61ygkb1d15uCohF9aznXp8MAi9pZT4EHDnzascmvspjgu5+bQ X-Received: by 10.107.141.211 with SMTP id p202mr2392186iod.47.1482272648002; Tue, 20 Dec 2016 14:24:08 -0800 (PST) MIME-Version: 1.0 Received: by 10.79.31.5 with HTTP; Tue, 20 Dec 2016 14:23:37 -0800 (PST) In-Reply-To: References: From: Brian Campbell Date: Tue, 20 Dec 2016 15:23:37 -0700 Message-ID: To: Andrei Popov Content-Type: multipart/alternative; boundary=94eb2c062c9ea52aaa05441e7e49 Archived-At: Cc: IETF Tokbind WG , Nick Harper Subject: Re: [Unbearable] (late, sorry) WGLC question on establishing the binding or not X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 20 Dec 2016 22:24:10 -0000 --94eb2c062c9ea52aaa05441e7e49 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable On Tue, Dec 20, 2016 at 1:11 PM, Andrei Popov wrote: > =C3=98 I don't fully understand the reasoning behind the requirements th= at > exist between the handshake negotiation to checking the TB message. > > I=E2=80=99ll try to help with this. > Thanks. =C3=98 If TB was not negotiated but a TB message is sent, reject the bindi= ngs. > > The server that isn=E2=80=99t configured to use TB should not incur TB > verification costs. > > > I'd assume a server that doesn't support TB will ignore TB messages because it doesn't know about TB. That bit is from Server Processing Rules in TBPROTO so I read it as a requirement of the server on how to react to a misbehaving client. > =C3=98 If TB was negotiated but the keyparams of the provided TB in the = TB > message doesn't match the negotiated keyparams, reject the bindings. > > Right, so there is no downgrade from what=E2=80=99s negotiated. Also, thi= s > prevents the client using parameters unsupported by the server. > For properly behaving clients, yes, but the server still has to check. What's the risk or attack in a downgrade from what=E2=80=99s negotiated? I'd like to better understand this one in particularly because the I-D I'm intending to write about using TB with TLS terminating reverse proxies will need to deal with the MUST somehow. I'm leaning towards having the application validate the Token Binding Message with the EKM sent as a header by the TLS terminator. That approach would seem to imply that the application also check that the negotiated key parameters type matches what's in the message. So that needs to be passed too. Which can be done but it muddies things. > =C3=98 When the TB version negotiated is identical but a TB message isn'= t > sent, it would seem to suggest at least a misbehaving client. > > Yes, but if there=E2=80=99s no bound token in the request, I think the se= rver can > ignore the lack of TB message (please let me know if you have an attack i= n > mind). > I don't have a attack in mind. It seems like it's also a downgrade from what was negotiated. > If this request has a bound token in it, existing language will require > the server to reject. > Yes. But if tokens haven't yet been issued by the server and will be issued now, they won't be bound. --94eb2c062c9ea52aaa05441e7e49 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable


On Tue, Dec 20, 2016 at 1:11 PM, Andrei Popov <Andrei.Popov@m= icrosoft.com> wrote:

=C3=98=C2=A0 I don't fully understand the reasoning behi= nd the requirements that exist between the handshake negotiation to checkin= g the TB message.

I=E2=80=99ll try to help with this.


Thanks.=C2=A0

<= /u>

=C3=98=C2=A0 If TB was not negotiated but a TB message is se= nt, reject the bindings.

The server that isn=E2=80=99t configured to use TB sh= ould not incur TB verification costs.

=C2=A0

I'd assume a server that doesn't support TB will ignor= e TB messages because it doesn't know about TB. That bit is from Server= Processing Rules in TBPROTO so I read it as a requirement of the server on= how to react to a misbehaving client.

=C2=A0

=

=C3=98=C2=A0 If TB was negotiated but the keyparams of the p= rovided TB in the TB message doesn't match the negotiated keyparams, re= ject the bindings.

Right, so there is no downgrade from what=E2=80=99s n= egotiated. Also, this prevents the client using parameters unsupported by t= he server.


For prope= rly behaving clients, yes, but the server still has to check.

What's the risk or attack in a downgrade from what=E2=80=99s nego= tiated?

I'd like to better understand this one in pa= rticularly because the I-D I'm intending to write about using TB with T= LS terminating reverse proxies will need to deal with the MUST somehow. I&#= 39;m leaning towards having the application validate the Token Binding Mess= age with the EKM sent as a header by the TLS terminator. That approach woul= d seem to imply that the application also check that the negotiated key par= ameters type matches what's in the message. So that needs to be passed = too. Which can be done but it muddies things.
=C2=A0
=C2= =A0

=C3=98=C2=A0 When the TB version negotiated is identical but= a TB message isn't sent, it would seem to suggest at least a misbehavi= ng client.

Yes, but if there=E2=80=99s no bound token in the req= uest, I think the server can ignore the lack of TB message (please let me k= now if you have an attack in mind).


I don't have a attack in mind. It seems like it's a= lso a downgrade from what was negotiated.

=C2=A0

If this request has a bound token in it, existing lan= guage will require the server to reject.


Yes. But if tokens haven't yet been issued by the = server and will be issued now, they won't be bound.
=C2= =A0

--94eb2c062c9ea52aaa05441e7e49-- From nobody Tue Dec 20 17:21:25 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3C28F129B65 for ; Tue, 20 Dec 2016 17:21:24 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.002 X-Spam-Level: X-Spam-Status: No, score=-2.002 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id POWg47Ye9zVo for ; Tue, 20 Dec 2016 17:21:22 -0800 (PST) Received: from NAM01-BN3-obe.outbound.protection.outlook.com (mail-bn3nam01on0125.outbound.protection.outlook.com [104.47.33.125]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B41B41296E4 for ; Tue, 20 Dec 2016 17:21:21 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=Uf3ZZdRMitU5Sh22GZUIiVSTqaQ6RGOi91Ywj+jww74=; b=P1mQIqchO4S6OmiMy4HppN2jBjgKS0blFFSwGWS1WfHnImCdPrrRIUx97fQe0r7zOmgksC1oeZ5qsCInMMRfkTt6KymewmjafXR2nqK5/+PhnPQ9hrLJPIfxnzx06muNJwfsmCc+gRz31KcE6LtdspNmigAvDsFMwOJE7G3Ju8w= Received: from CY1PR0301MB0842.namprd03.prod.outlook.com (10.160.163.148) by CY1PR0301MB0841.namprd03.prod.outlook.com (10.160.163.147) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.789.14; Wed, 21 Dec 2016 01:20:49 +0000 Received: from CY1PR0301MB0842.namprd03.prod.outlook.com ([10.160.163.148]) by CY1PR0301MB0842.namprd03.prod.outlook.com ([10.160.163.148]) with mapi id 15.01.0789.018; Wed, 21 Dec 2016 01:20:49 +0000 From: Andrei Popov To: Brian Campbell , Nick Harper Thread-Topic: [Unbearable] (late, sorry) WGLC question on establishing the binding or not Thread-Index: AQHSWvrivRNalV6Ld0i/cnyaQrT2PaERQomAgAABJTCAACXGgIAAJbGg Date: Wed, 21 Dec 2016 01:20:49 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Andrei.Popov@microsoft.com; x-originating-ip: [2001:4898:80e8:7::1d2] x-ms-office365-filtering-correlation-id: 1dc8b233-0bfa-4871-b67a-08d4293f990d x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001); SRVR:CY1PR0301MB0841; x-microsoft-exchange-diagnostics: 1; CY1PR0301MB0841; 7:8sO86WSF8oDr2V1ovPt61vIsVNeOMDuHuzNwjU/6MxXlYcsvm9M2uMeXVJ8i8WzprsjrP28sIf9lMmv/AfYj9r47wfDxHvNknHez0lx1T6yURRHfyK1IHsHyva7kYZJLeMtwCDYkjmq9zBcC2ZnVFQmlzpW/2cjBEacVpGoZIQTacyG2TzuSuZNda23p1FkOhK05yJ4GdwtsbSsUVNMxMLs6ApdVzHwziOrPxMBALpWqMyDGVc3fSBGhNj+VP22Ze9jsMUUGyZhDhR6zM3bZHW30SdDSmsV5B3mYL3MvVAqse8DUOEcC62CSfKZvQ1wzPNF0pEcOTP2+6yxH/BqaStvBSrwmPlT7YuOzCADSOUtLd9HMghFMMbbJ6M/k5xC9T6xPytI7vphYF/AbjdZtt2EJeVS+0rV6X95QLLOK9fSB0orjdOqdaMLnnvRBjlDQEpCeaUwhabQH9E+WG2ErLShbeelAQcVPnnTu6RcwsGw= x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(158342451672863)(21748063052155); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040375)(601004)(2401047)(5005006)(8121501046)(10201501046)(3002001)(6055026)(61426038)(61427038)(6041248)(20161123560025)(20161123555025)(20161123562025)(20161123564025)(6072148)(6047074); SRVR:CY1PR0301MB0841; BCL:0; PCL:0; RULEID:; SRVR:CY1PR0301MB0841; x-forefront-prvs: 01630974C0 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(6009001)(7916002)(39840400002)(39450400003)(39860400002)(39410400002)(39850400002)(189002)(199003)(54356999)(76176999)(2950100002)(6116002)(102836003)(790700001)(8676002)(10090500001)(189998001)(81156014)(81166006)(4326007)(50986999)(2906002)(5660300001)(76576001)(122556002)(8936002)(229853002)(101416001)(8990500004)(68736007)(38730400001)(10290500002)(7696004)(5005710100001)(93886004)(86362001)(3280700002)(7736002)(86612001)(74316002)(3660700001)(77096006)(6436002)(106116001)(105586002)(106356001)(6506006)(99286002)(25786008)(9686002)(97736004)(5001770100001)(92566002)(2900100001)(33656002); DIR:OUT; SFP:1102; SCL:1; SRVR:CY1PR0301MB0841; H:CY1PR0301MB0842.namprd03.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:1; LANG:en; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_CY1PR0301MB0842D8B16A4EBCC099E6DC8E8C930CY1PR0301MB0842_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 21 Dec 2016 01:20:49.1171 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY1PR0301MB0841 Archived-At: Cc: IETF Tokbind WG Subject: Re: [Unbearable] (late, sorry) WGLC question on establishing the binding or not X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Dec 2016 01:21:24 -0000 --_000_CY1PR0301MB0842D8B16A4EBCC099E6DC8E8C930CY1PR0301MB0842_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 QEJyaWFuOg0KDQrDmCAgV2hhdCdzIHRoZSByaXNrIG9yIGF0dGFjayBpbiBhIGRvd25ncmFkZSBm cm9tIHdoYXTigJlzIG5lZ290aWF0ZWQ/DQpGb3IgdGhlIHNha2Ugb2YgYW4gZXh0cmVtZSBleGFt cGxlLCBpZiBteSBzZXJ2ZXIgaXMgY29uZmlndXJlZCB0byBhY2NlcHQgcG9zdC1xdWFudHVtIE5l d0hvcGU2ayBrZXkgcGFyYW1ldGVycywgSSBkb27igJl0IHdhbnQgdG8gYmUgZG93bmdyYWRlZCB0 byByc2E3NjhfcGtjczEuNS4NCldlIGRvbuKAmXQgaGF2ZSB0aGlzIGlzc3VlIHlldCwgYnV0IGV2 ZW4gdG9kYXkgYSBzZXJ2ZXIgb3BlcmF0b3IgcHJvYmFibHkgZG9lcyBub3Qgd2FudCB0byByZWNl aXZlIHJzYTIwNDhfcGtjczEuNSBhZnRlciBuZWdvdGlhdGluZyBlY2RzYXAyNTYsIGZvciBlZmZp Y2llbmN5IHJlYXNvbnMuDQoNCg0Kw5ggIEJ1dCBpZiB0b2tlbnMgaGF2ZW4ndCB5ZXQgYmVlbiBp c3N1ZWQgYnkgdGhlIHNlcnZlciBhbmQgd2lsbCBiZSBpc3N1ZWQgbm93LCB0aGV5IHdvbid0IGJl IGJvdW5kLg0KQ29ycmVjdCwgc28gdGhpcyBpcyBpZGVudGljYWwgdG8gdGhlIGNhc2Ugb2YgVEIg bm90IGhhdmluZyBiZWVuIG5lZ290aWF0ZWQuDQpJbiBhIGRpc3RhbnQgZnV0dXJlLCB3ZSBtaWdo dCBnZXQgdG8gYSBwb2ludCB3aGVyZSBzZXJ2ZXJzIGFuZC9vciBjbGllbnRzIHdvbuKAmXQgc2V0 dGxlIGZvciBhIGNvbm5lY3Rpb24gd2l0aG91dCBUQi4NCkZvciBzdWNoIHNlcnZlcnMgYW5kIGNs aWVudHMsIGl0IHdpbGwgbWFrZSBzZW5zZSB0byByZWplY3QgcmVxdWVzdHMgd2l0aG91dCBUQiBt ZXNzYWdlcy4NCg0KQE5pY2s6DQoNCsOYICBJIGRvbid0IGhhdmUgYSBzcGVjaWZpYyBhdHRhY2sg aW4gbWluZCBoZXJlIChwZXJoYXBzIHlvdSBjb3VsZCBoYXZlIGEgbWl0bSB0aGF0J3MgbmVnb3Rp YXRpbmcgVEIgYnV0IHRoZW4gc3RyaXBwaW5nIFRCIG1lc3NhZ2VzLCBidXQgdGhhdCBzZWVtcyBs aWtlIGEgd29yc2UgYXR0YWNrIHRoYW4gdGhlIG1pdG0gbm90IG5lZ290aWF0aW5nIFRCIGF0IGFs bCkuIEkgbWFkZSBhbiBhc3N1bXB0aW9uIHRoYXQgYSBjbGllbnQgdGhhdCBuZWdvdGlhdGVzIFRC IGJ1dCB0aGVuIGRvZXNuJ3Qgc2VuZCBhIFRCIG1lc3NhZ2UgaW4gYWNjb3JkYW5jZSB3aXRoIHRo ZSBhcHBsaWNhdGlvbiBwcm9maWxlIGlzIGJ1Z2d5LiBJZiB0aGlzIGlzIGEgYnVnLCBJIHRoaW5r IHNlcnZlcnMgc2hvdWxkIGZhaWwgdG8gaW50ZXItb3BlcmF0ZSB3aXRoIGl0IHRvIHJlZHVjZSB0 aGUgbnVtYmVyIG9mIGJ1Z2d5IFRCIGltcGxlbWVudGF0aW9ucyBpbiB0aGUgZWNvc3lzdGVtLg0K U3BlY2lmaWNhbGx5LCB3aGF0IGxhbmd1YWdlIGRvIHlvdSBzdWdnZXN0IGFuZCBpbiB3aGljaCBJ LUQocyk/DQo= --_000_CY1PR0301MB0842D8B16A4EBCC099E6DC8E8C930CY1PR0301MB0842_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 V2luZ2RpbmdzOw0KCXBhbm9zZS0xOjUgMCAwIDAgMCAwIDAgMCAwIDA7fQ0KQGZvbnQtZmFjZQ0K CXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2IDMg MiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1 IDUgMiAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWws IGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0 b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcg Um9tYW4iLHNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXBy aW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQph OnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5 Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnAuTXNv TGlzdFBhcmFncmFwaCwgbGkuTXNvTGlzdFBhcmFncmFwaCwgZGl2Lk1zb0xpc3RQYXJhZ3JhcGgN Cgl7bXNvLXN0eWxlLXByaW9yaXR5OjM0Ow0KCW1hcmdpbi10b3A6MGluOw0KCW1hcmdpbi1yaWdo dDowaW47DQoJbWFyZ2luLWJvdHRvbTowaW47DQoJbWFyZ2luLWxlZnQ6LjVpbjsNCgltYXJnaW4t Ym90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGltZXMg TmV3IFJvbWFuIixzZXJpZjt9DQpwLm1zb25vcm1hbDAsIGxpLm1zb25vcm1hbDAsIGRpdi5tc29u b3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCgltc28tbWFyZ2luLXRvcC1hbHQ6 YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0K CW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1l cyBOZXcgUm9tYW4iLHNlcmlmO30NCnAuZ21haWwtbS03MzE1NTMwMDMwMDg5NTY5ODQ1bXNvbGlz dHBhcmFncmFwaCwgbGkuZ21haWwtbS03MzE1NTMwMDMwMDg5NTY5ODQ1bXNvbGlzdHBhcmFncmFw aCwgZGl2LmdtYWlsLW0tNzMxNTUzMDAzMDA4OTU2OTg0NW1zb2xpc3RwYXJhZ3JhcGgNCgl7bXNv LXN0eWxlLW5hbWU6Z21haWwtbV8tNzMxNTUzMDAzMDA4OTU2OTg0NW1zb2xpc3RwYXJhZ3JhcGg7 DQoJbXNvLW1hcmdpbi10b3AtYWx0OmF1dG87DQoJbWFyZ2luLXJpZ2h0OjBpbjsNCgltc28tbWFy Z2luLWJvdHRvbS1hbHQ6YXV0bzsNCgltYXJnaW4tbGVmdDowaW47DQoJZm9udC1zaXplOjEyLjBw dDsNCglmb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIixzZXJpZjt9DQpzcGFuLkVtYWlsU3R5 bGUxOQ0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1yZXBseTsNCglmb250LWZhbWlseToiQ2Fs aWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjp3aW5kb3d0ZXh0O30NCi5Nc29DaHBEZWZhdWx0DQoJ e21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5O30NCkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXpl OjguNWluIDExLjBpbjsNCgltYXJnaW46MS4waW4gMS4waW4gMS4waW4gMS4waW47fQ0KZGl2Lldv cmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQovKiBMaXN0IERlZmluaXRpb25zICov DQpAbGlzdCBsMA0KCXttc28tbGlzdC1pZDo3MDk5NjM5NTY7DQoJbXNvLWxpc3QtdHlwZTpoeWJy aWQ7DQoJbXNvLWxpc3QtdGVtcGxhdGUtaWRzOjE1ODgyNjI0OTAgMTA0MTQxMzg4NCA2NzY5ODY5 MSA2NzY5ODY5MyA2NzY5ODY4OSA2NzY5ODY5MSA2NzY5ODY5MyA2NzY5ODY4OSA2NzY5ODY5MSA2 NzY5ODY5Mzt9DQpAbGlzdCBsMDpsZXZlbDENCgl7bXNvLWxldmVsLXN0YXJ0LWF0OjA7DQoJbXNv LWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+DmDsNCgltc28t bGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJ dGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczsNCgltc28tZmFyZWFz dC1mb250LWZhbWlseTpDYWxpYnJpOw0KCW1zby1iaWRpLWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcg Um9tYW4iO30NCkBsaXN0IGwwOmxldmVsMg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxs ZXQ7DQoJbXNvLWxldmVsLXRleHQ6bzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28t bGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQt ZmFtaWx5OiJDb3VyaWVyIE5ldyI7fQ0KQGxpc3QgbDA6bGV2ZWwzDQoJe21zby1sZXZlbC1udW1i ZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1z dG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50 Oi0uMjVpbjsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDA6bGV2ZWw0DQoJe21z by1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNv LWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0K CXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDA6bGV2 ZWw1DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDpv Ow0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246 bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3Ijt9 DQpAbGlzdCBsMDpsZXZlbDYNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1z by1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwt bnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5 OldpbmdkaW5nczt9DQpAbGlzdCBsMDpsZXZlbDcNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6 YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsN Cgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0K CWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMDpsZXZlbDgNCgl7bXNvLWxldmVsLW51bWJl ci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Om87DQoJbXNvLWxldmVsLXRhYi1zdG9w Om5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0u MjVpbjsNCglmb250LWZhbWlseToiQ291cmllciBOZXciO30NCkBsaXN0IGwwOmxldmVsOQ0KCXtt c28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1z by1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsN Cgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCm9sDQoJe21h cmdpbi1ib3R0b206MGluO30NCnVsDQoJe21hcmdpbi1ib3R0b206MGluO30NCi0tPjwvc3R5bGU+ PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWRlZmF1bHRzIHY6ZXh0PSJlZGl0IiBz cGlkbWF4PSIxMDI2IiAvPg0KPC94bWw+PCFbZW5kaWZdLS0+PCEtLVtpZiBndGUgbXNvIDldPjx4 bWw+DQo8bzpzaGFwZWxheW91dCB2OmV4dD0iZWRpdCI+DQo8bzppZG1hcCB2OmV4dD0iZWRpdCIg ZGF0YT0iMSIgLz4NCjwvbzpzaGFwZWxheW91dD48L3htbD48IVtlbmRpZl0tLT4NCjwvaGVhZD4N Cjxib2R5IGxhbmc9IkVOLVVTIiBsaW5rPSJibHVlIiB2bGluaz0icHVycGxlIj4NCjxkaXYgY2xh c3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWJv dHRvbToxMi4wcHQiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+QEJyaWFuOjxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBoIiBzdHlsZT0ibWFyZ2luLWJvdHRvbToxMi4w cHQ7dGV4dC1pbmRlbnQ6LS4yNWluO21zby1saXN0OmwwIGxldmVsMSBsZm8xIj4NCjwhW2lmICFz dXBwb3J0TGlzdHNdPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpXaW5nZGluZ3MiPjxzcGFuIHN0 eWxlPSJtc28tbGlzdDpJZ25vcmUiPsOYPHNwYW4gc3R5bGU9ImZvbnQ6Ny4wcHQgJnF1b3Q7VGlt ZXMgTmV3IFJvbWFuJnF1b3Q7Ij4mbmJzcDsNCjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwhW2VuZGlm XT5XaGF0J3MgdGhlIHJpc2sgb3IgYXR0YWNrIGluIGEgZG93bmdyYWRlIGZyb20gd2hhdOKAmXMg bmVnb3RpYXRlZD8NCjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90Oyxz YW5zLXNlcmlmIj5Gb3IgdGhlIHNha2Ugb2YgYW4gZXh0cmVtZSBleGFtcGxlLCBpZiBteSBzZXJ2 ZXIgaXMgY29uZmlndXJlZCB0byBhY2NlcHQgcG9zdC1xdWFudHVtIE5ld0hvcGU2ayBrZXkgcGFy YW1ldGVycywgSSBkb27igJl0IHdhbnQgdG8gYmUgZG93bmdyYWRlZCB0byByc2E3NjhfcGtjczEu NS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMt c2VyaWYiPldlIGRvbuKAmXQgaGF2ZSB0aGlzIGlzc3VlIHlldCwgYnV0IGV2ZW4gdG9kYXkgYSBz ZXJ2ZXIgb3BlcmF0b3IgcHJvYmFibHkgZG9lcyBub3Qgd2FudCB0byByZWNlaXZlIHJzYTIwNDhf cGtjczEuNSBhZnRlciBuZWdvdGlhdGluZyBlY2RzYXAyNTYsIGZvciBlZmZpY2llbmN5IHJlYXNv bnMuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5z LXNlcmlmIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTGlzdFBh cmFncmFwaCIgc3R5bGU9InRleHQtaW5kZW50Oi0uMjVpbjttc28tbGlzdDpsMCBsZXZlbDEgbGZv MSI+PCFbaWYgIXN1cHBvcnRMaXN0c10+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OldpbmdkaW5n cyI+PHNwYW4gc3R5bGU9Im1zby1saXN0Oklnbm9yZSI+w5g8c3BhbiBzdHlsZT0iZm9udDo3LjBw dCAmcXVvdDtUaW1lcyBOZXcgUm9tYW4mcXVvdDsiPiZuYnNwOw0KPC9zcGFuPjwvc3Bhbj48L3Nw YW4+PCFbZW5kaWZdPkJ1dCBpZiB0b2tlbnMgaGF2ZW4ndCB5ZXQgYmVlbiBpc3N1ZWQgYnkgdGhl IHNlcnZlciBhbmQgd2lsbCBiZSBpc3N1ZWQgbm93LCB0aGV5IHdvbid0IGJlIGJvdW5kLg0KPG86 cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkNvcnJl Y3QsIHNvIHRoaXMgaXMgaWRlbnRpY2FsIHRvIHRoZSBjYXNlIG9mIFRCIG5vdCBoYXZpbmcgYmVl biBuZWdvdGlhdGVkLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkm cXVvdDssc2Fucy1zZXJpZiI+SW4gYSBkaXN0YW50IGZ1dHVyZSwgd2UgbWlnaHQgZ2V0IHRvIGEg cG9pbnQgd2hlcmUgc2VydmVycyBhbmQvb3IgY2xpZW50cyB3b27igJl0IHNldHRsZSBmb3IgYSBj b25uZWN0aW9uIHdpdGhvdXQgVEIuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5Gb3Igc3VjaCBzZXJ2ZXJzIGFuZCBjbGllbnRzLCBp dCB3aWxsIG1ha2Ugc2Vuc2UgdG8gcmVqZWN0IHJlcXVlc3RzIHdpdGhvdXQgVEIgbWVzc2FnZXMu PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1 b3Q7LHNhbnMtc2VyaWYiPkBOaWNrOjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29MaXN0UGFyYWdyYXBoIiBzdHlsZT0idGV4dC1pbmRlbnQ6LS4yNWluO21zby1saXN0OmwwIGxl dmVsMSBsZm8xIj48IVtpZiAhc3VwcG9ydExpc3RzXT48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6 V2luZ2RpbmdzIj48c3BhbiBzdHlsZT0ibXNvLWxpc3Q6SWdub3JlIj7DmDxzcGFuIHN0eWxlPSJm b250OjcuMHB0ICZxdW90O1RpbWVzIE5ldyBSb21hbiZxdW90OyI+Jm5ic3A7DQo8L3NwYW4+PC9z cGFuPjwvc3Bhbj48IVtlbmRpZl0+SSBkb24ndCBoYXZlIGEgc3BlY2lmaWMgYXR0YWNrIGluIG1p bmQgaGVyZSAocGVyaGFwcyB5b3UgY291bGQgaGF2ZSBhIG1pdG0gdGhhdCdzIG5lZ290aWF0aW5n IFRCIGJ1dCB0aGVuIHN0cmlwcGluZyBUQiBtZXNzYWdlcywgYnV0IHRoYXQgc2VlbXMgbGlrZSBh IHdvcnNlIGF0dGFjayB0aGFuIHRoZSBtaXRtIG5vdCBuZWdvdGlhdGluZyBUQiBhdCBhbGwpLiBJ IG1hZGUgYW4gYXNzdW1wdGlvbg0KIHRoYXQgYSBjbGllbnQgdGhhdCBuZWdvdGlhdGVzIFRCIGJ1 dCB0aGVuIGRvZXNuJ3Qgc2VuZCBhIFRCIG1lc3NhZ2UgaW4gYWNjb3JkYW5jZSB3aXRoIHRoZSBh cHBsaWNhdGlvbiBwcm9maWxlIGlzIGJ1Z2d5LiBJZiB0aGlzIGlzIGEgYnVnLCBJIHRoaW5rIHNl cnZlcnMgc2hvdWxkIGZhaWwgdG8gaW50ZXItb3BlcmF0ZSB3aXRoIGl0IHRvIHJlZHVjZSB0aGUg bnVtYmVyIG9mIGJ1Z2d5IFRCIGltcGxlbWVudGF0aW9ucyBpbiB0aGUgZWNvc3lzdGVtLjxvOnA+ PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5TcGVjaWZp Y2FsbHksIHdoYXQgbGFuZ3VhZ2UgZG8geW91IHN1Z2dlc3QgYW5kIGluIHdoaWNoIEktRChzKT88 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_CY1PR0301MB0842D8B16A4EBCC099E6DC8E8C930CY1PR0301MB0842_-- From nobody Tue Dec 20 17:46:21 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 46013129BA4 for ; Tue, 20 Dec 2016 17:46:20 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.8 X-Spam-Level: X-Spam-Status: No, score=-5.8 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-3.1, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Mv7fYRqAlzxP for ; Tue, 20 Dec 2016 17:46:18 -0800 (PST) Received: from mail-qt0-x22f.google.com (mail-qt0-x22f.google.com [IPv6:2607:f8b0:400d:c0d::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C1880129482 for ; Tue, 20 Dec 2016 17:46:18 -0800 (PST) Received: by mail-qt0-x22f.google.com with SMTP id c47so193740854qtc.2 for ; Tue, 20 Dec 2016 17:46:18 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=dpovP1Xw0dq2nazKom43P7KufxmJRZ/2lbgNLNC/ws0=; b=HWx+Xvv/JMzP5z7zxsCof6KSLt0l+3Jsz1Bg3vgM4q0bYpxlHN74jzP3ADmYmEiWEr VTY0pJxyY82S+gS+/PJoTnkhnCnRr6x9XLEOQ9OVf589Pf7hwG/OGvqSVSrbqmyqPQAn MZgYWk4b9RD3ERP+p30y1BTbH2SO82h6O8RCZ2JNhi8imbONRqPgJ/04NUEkTMFYiFdq 1kHGcyKtDDln5uASiJ3jsqU8lzaQQ03fuJtjQZKoT9958T4w8MLcQa+MS5iiIEow4LtM l71UQVWLVmXeEpGY5jWuyQ6u1Au6JoGC6ed2NRyMpm0blkYRLg+6rSGjwVrfRhDePU4T wMog== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=dpovP1Xw0dq2nazKom43P7KufxmJRZ/2lbgNLNC/ws0=; b=FH1KtOVq1pjTISgfiu9F1JQL+ehqoxv8ESthY3wAkB1QiVKf3YI+fg6+UlTwKCQzXx +NJDkujCigLjcF1rxYjgHRYx85pLeYG8IHfRTHnn2yw1Ffv+6WvOC5SBfdeH3pIMaG6Y TNTWbJt7yO4vIQy1OLMFcbQl/gpg1QIfhB7iAq8wXuxYcT4wEA7O0trQM2jo3WwVHPXG z/TStb1tN+DqpAxaAZAxhgwwUSv95/czRbMeMaNgynVOQrV3yD6AdcoosNpMn9kR1R1t pVwxDBasjMOmtcX1luxlIpdj8cpgum/CJb8A8tgFM31PZ6kjk/wL6d6GO2YO74YiDX0j //0Q== X-Gm-Message-State: AIkVDXIqOwP717THLJZqdLN4vFf42Xt+YaMELNf6QxDFar3HdPNw88T/oRBK82G62FJ1xYX05K0g5eTFgI1pwNzJ X-Received: by 10.200.48.206 with SMTP id w14mr2572938qta.150.1482284777886; Tue, 20 Dec 2016 17:46:17 -0800 (PST) MIME-Version: 1.0 Received: by 10.140.17.52 with HTTP; Tue, 20 Dec 2016 17:45:57 -0800 (PST) In-Reply-To: References: From: Nick Harper Date: Tue, 20 Dec 2016 17:45:57 -0800 Message-ID: To: Andrei Popov Content-Type: multipart/alternative; boundary=001a1147b82ca49de50544215126 Archived-At: Cc: IETF Tokbind WG , Brian Campbell Subject: Re: [Unbearable] (late, sorry) WGLC question on establishing the binding or not X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Dec 2016 01:46:20 -0000 --001a1147b82ca49de50544215126 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable On Tue, Dec 20, 2016 at 5:20 PM, Andrei Popov wrote: > > > > @Nick: > > =C3=98 I don't have a specific attack in mind here (perhaps you could ha= ve a > mitm that's negotiating TB but then stripping TB messages, but that seems > like a worse attack than the mitm not negotiating TB at all). I made an > assumption that a client that negotiates TB but then doesn't send a TB > message in accordance with the application profile is buggy. If this is a > bug, I think servers should fail to inter-operate with it to reduce the > number of buggy TB implementations in the ecosystem. > > Specifically, what language do you suggest and in which I-D(s)? > In TBPROTO section 3, there currently is language describing when a client MUST and MUST NOT send a TB message. I'd add a sentence/paragraph after the first paragraph in that section to say something like "A server SHOULD reject an application protocol message that does not contain a Token Binding message if the client and server successfully negotiated the use of the Token Binding protocol.". The second-to-last paragraph of TBNEGO section 4 clarifies "If the client does not support the Token Binding protocol version selected by the server, then the connection proceeds without Token Binding". I'd add to that "If the server selects the same Token Binding protocol version sent by the client, then the Token Binding protocol was successfully negotiated". Given the wording that already exists in those two sections, I think it would be reasonable for one to infer that it is reasonable for a server to reject application protocol messages if TB was negotiated but a TB message wasn't sent (e.g. by sending an HTTP 4xx response). Adding more language makes this more clear, but I don't feel particularly strongly about this issue. --001a1147b82ca49de50544215126 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
On T= ue, Dec 20, 2016 at 5:20 PM, Andrei Popov <Andrei.Popov@microsoft= .com> wrote:

=C2=A0

@Nick:

=C3=98=C2=A0 I don't have a specific attack in mind here= (perhaps you could have a mitm that's negotiating TB but then strippin= g TB messages, but that seems like a worse attack than the mitm not negotia= ting TB at all). I made an assumption that a client that negotiates TB but then doesn't send a TB message in= accordance with the application profile is buggy. If this is a bug, I thin= k servers should fail to inter-operate with it to reduce the number of bugg= y TB implementations in the ecosystem.

Specifically, what language do you suggest and in w= hich I-D(s)?


In TBPR= OTO section 3, there currently is language describing when a client MUST an= d MUST NOT send a TB message. I'd add a sentence/paragraph after the fi= rst paragraph in that section to say something like "A server SHOULD r= eject an application protocol message that does not contain a Token Binding= message if the client and server successfully negotiated the use of the To= ken Binding protocol.".

The second-to-last pa= ragraph of TBNEGO section 4 clarifies "If the client does not support = the Token Binding protocol version selected by the server, then the connect= ion proceeds without Token Binding". I'd add to that "If the = server selects the same Token Binding protocol version sent by the client, = then the Token Binding protocol was successfully negotiated".

Given the wording that already exists in those two section= s, I think it would be reasonable for one to infer that it is reasonable fo= r a server to reject application protocol messages if TB was negotiated but= a TB message wasn't sent (e.g. by sending an HTTP 4xx response). Addin= g more language makes this more clear, but I don't feel particularly st= rongly about this issue.

--001a1147b82ca49de50544215126-- From nobody Tue Dec 20 18:02:21 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 42E9612948D for ; Tue, 20 Dec 2016 18:02:20 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.002 X-Spam-Level: X-Spam-Status: No, score=-2.002 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IKfVPjMbKdns for ; Tue, 20 Dec 2016 18:02:18 -0800 (PST) Received: from NAM02-CY1-obe.outbound.protection.outlook.com (mail-cys01nam02on0133.outbound.protection.outlook.com [104.47.37.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4D73812948B for ; Tue, 20 Dec 2016 18:02:18 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=OkBEqV5aCWvk2b7ILzkWqwa289ZEPX/sF7HgtKG+Hf8=; b=cIJIyewYYm4hHdZL+IUdfM5pPkbNcDVHOuWkJyN7lk5QPySR0yqtMQwbpXPhB37Jolbywq8M01HgAR7IGN7dM7Kui1TsKKrcg+KVh6vKJa32uo3cjag6/nmSXhcRA7dOHB7QK5dTBb+Cbx8FMo6g1IekeClw+TlPPjCOOdh9Uho= Received: from CY1PR0301MB0842.namprd03.prod.outlook.com (10.160.163.148) by CY1PR0301MB0844.namprd03.prod.outlook.com (10.160.163.150) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.789.14; Wed, 21 Dec 2016 02:02:16 +0000 Received: from CY1PR0301MB0842.namprd03.prod.outlook.com ([10.160.163.148]) by CY1PR0301MB0842.namprd03.prod.outlook.com ([10.160.163.148]) with mapi id 15.01.0789.018; Wed, 21 Dec 2016 02:02:16 +0000 From: Andrei Popov To: Nick Harper Thread-Topic: [Unbearable] (late, sorry) WGLC question on establishing the binding or not Thread-Index: AQHSWvrivRNalV6Ld0i/cnyaQrT2PaERQomAgAABJTCAACXGgIAAJbGggAAS14CAAACIAA== Date: Wed, 21 Dec 2016 02:02:16 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Andrei.Popov@microsoft.com; x-originating-ip: [2001:4898:80e8:7::1d2] x-ms-office365-filtering-correlation-id: 893966f8-da4d-467d-636a-08d429456388 x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001); SRVR:CY1PR0301MB0844; x-microsoft-exchange-diagnostics: 1; CY1PR0301MB0844; 7:IGy2fhD6j1z3pzDWlfophSuDOYcUHfFF59kjaMJ659N91hFVmp64fnc5CE5xR1g1tStS1wQqvF/DF27bf0vqtt7J300VNCI7qsHsN4SmKtUz2wvk0ysCppECBjGWlI384cOHYZpctBYxIWD/YWPnRnzAU/N9lf05UP281G7kld9ESO8qplpG1AIhqyNn7QjGH2ZLPNGPWzwZyoHGptq89uauJyD81xh4hvuaSEecJda0/vypqlYeBXLvf1YvwCOFxmX0bnME9EZYYtjdOye97GGNl8f0RG6zfLSmHVtVbrJbbvTEavjcGpRAKQsNGNRQ75Q0o5vyWGVMm7o8CWZPJmB2gmQaI9yQwCr3pg0TjW39UmNi0pViSWxvKj9OEXtCop97WuRVQf7TUp0WVh0NGL8Qrqgy1a5M3JQsLreEcIhE9MjFssdEVWtLEw8IqAf2q5ITtGYiq4VtEs4hxI4jfJ7sxv/HwmGx8F2oGaQkZZI= x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(158342451672863)(21748063052155); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040375)(601004)(2401047)(5005006)(8121501046)(10201501046)(3002001)(6055026)(61426038)(61427038)(6041248)(20161123560025)(20161123564025)(20161123555025)(20161123562025)(6042181)(6072148)(6047074); SRVR:CY1PR0301MB0844; BCL:0; PCL:0; RULEID:; SRVR:CY1PR0301MB0844; x-forefront-prvs: 01630974C0 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(6009001)(7916002)(199003)(189002)(99286002)(106116001)(106356001)(105586002)(5660300001)(2950100002)(6916009)(9686002)(2900100001)(8990500004)(97736004)(5005710100001)(10290500002)(76576001)(10090500001)(92566002)(93886004)(2906002)(189998001)(101416001)(229853002)(3660700001)(3280700002)(25786008)(102836003)(6116002)(8936002)(790700001)(122556002)(4326007)(68736007)(74316002)(33656002)(76176999)(7736002)(54356999)(8676002)(50986999)(86612001)(81156014)(86362001)(7696004)(6436002)(81166006)(6506006)(77096006)(38730400001)(110136003); DIR:OUT; SFP:1102; SCL:1; SRVR:CY1PR0301MB0844; H:CY1PR0301MB0842.namprd03.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; A:1; MX:1; LANG:en; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_CY1PR0301MB0842F91C321A8F402529A26B8C930CY1PR0301MB0842_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 21 Dec 2016 02:02:16.3796 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY1PR0301MB0844 Archived-At: Cc: IETF Tokbind WG , Brian Campbell Subject: Re: [Unbearable] (late, sorry) WGLC question on establishing the binding or not X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Dec 2016 02:02:20 -0000 --_000_CY1PR0301MB0842F91C321A8F402529A26B8C930CY1PR0301MB0842_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 w5ggIEluIFRCUFJPVE8gc2VjdGlvbiAzLCB0aGVyZSBjdXJyZW50bHkgaXMgbGFuZ3VhZ2UgZGVz Y3JpYmluZyB3aGVuIGEgY2xpZW50IE1VU1QgYW5kIE1VU1QgTk9UIHNlbmQgYSBUQiBtZXNzYWdl LiBJJ2QgYWRkIGEgc2VudGVuY2UvcGFyYWdyYXBoIGFmdGVyIHRoZSBmaXJzdCBwYXJhZ3JhcGgg aW4gdGhhdCBzZWN0aW9uIHRvIHNheSBzb21ldGhpbmcgbGlrZSAiQSBzZXJ2ZXIgU0hPVUxEIHJl amVjdCBhbiBhcHBsaWNhdGlvbiBwcm90b2NvbCBtZXNzYWdlIHRoYXQgZG9lcyBub3QgY29udGFp biBhIFRva2VuIEJpbmRpbmcgbWVzc2FnZSBpZiB0aGUgY2xpZW50IGFuZCBzZXJ2ZXIgc3VjY2Vz c2Z1bGx5IG5lZ290aWF0ZWQgdGhlIHVzZSBvZiB0aGUgVG9rZW4gQmluZGluZyBwcm90b2NvbC4i Lg0KVGhpcyBkb2VzIG5vdCB3b3JrLCBiZWNhdXNlIFRCUFJPVE8gZG9lcyBub3QgcmVxdWlyZSB0 aGF0IHRoZSBUQiBtZXNzYWdlIGJlIGluY2x1ZGVkIGluIGV2ZXJ5IGFwcGxpY2F0aW9uIHByb3Rv Y29sIG1lc3NhZ2UuIFRCUFJPVE8gb25seSByZXF1aXJlcyB0aGUgVEIgbWVzc2FnZSBpbiB0aGUg Y2xpZW504oCZcyBmaXJzdCBhcHBsaWNhdGlvbiBwcm90b2NvbCBtZXNzYWdlIChpbiB0aGUgY29u bmVjdGlvbiB3aGVyZSBUQiBpcyBuZWdvdGlhdGVkKS4NCg0KVGhlIHJlcXVpcmVtZW50IHRoYXQg ZWFjaCBIVFRQIHJlcXVlc3QgaGFzIGEgVEIgbWVzc2FnZSBpbiBpdCBpcyBzcGVjaWZpYyB0byBI VFRQUy4gV2hpbGUgdGhpcyBpcyB3YXN0ZWZ1bCwgd2UgaGF2ZSB0byBkbyBpdCBiZWNhdXNlIEhU VFAgaGVhZGVycyBhcmUgcGVyIHJlcXVlc3QsIHJhdGhlciB0aGFuIGFmZmVjdGluZyB0aGUgZW50 aXJlIGNvbm5lY3Rpb24gKEhUVFAvMiByZWR1Y2VzIHRoaXMgd2FzdGUgYnkgY29tcHJlc3Npbmcg aGVhZGVycykuDQo= --_000_CY1PR0301MB0842F91C321A8F402529A26B8C930CY1PR0301MB0842_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 V2luZ2RpbmdzOw0KCXBhbm9zZS0xOjUgMCAwIDAgMCAwIDAgMCAwIDA7fQ0KQGZvbnQtZmFjZQ0K CXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2IDMg MiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1 IDUgMiAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWws IGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0 b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcg Um9tYW4iLHNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXBy aW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQph OnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5 Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnAuTXNv TGlzdFBhcmFncmFwaCwgbGkuTXNvTGlzdFBhcmFncmFwaCwgZGl2Lk1zb0xpc3RQYXJhZ3JhcGgN Cgl7bXNvLXN0eWxlLXByaW9yaXR5OjM0Ow0KCW1hcmdpbi10b3A6MGluOw0KCW1hcmdpbi1yaWdo dDowaW47DQoJbWFyZ2luLWJvdHRvbTowaW47DQoJbWFyZ2luLWxlZnQ6LjVpbjsNCgltYXJnaW4t Ym90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGltZXMg TmV3IFJvbWFuIixzZXJpZjt9DQpwLm1zb25vcm1hbDAsIGxpLm1zb25vcm1hbDAsIGRpdi5tc29u b3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCgltc28tbWFyZ2luLXRvcC1hbHQ6 YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0K CW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1l cyBOZXcgUm9tYW4iLHNlcmlmO30NCnAubS0zNjY2NTk5NTc1MDE0NjE2MTAzbXNvbGlzdHBhcmFn cmFwaCwgbGkubS0zNjY2NTk5NTc1MDE0NjE2MTAzbXNvbGlzdHBhcmFncmFwaCwgZGl2Lm0tMzY2 NjU5OTU3NTAxNDYxNjEwM21zb2xpc3RwYXJhZ3JhcGgNCgl7bXNvLXN0eWxlLW5hbWU6bV8tMzY2 NjU5OTU3NTAxNDYxNjEwM21zb2xpc3RwYXJhZ3JhcGg7DQoJbXNvLW1hcmdpbi10b3AtYWx0OmF1 dG87DQoJbWFyZ2luLXJpZ2h0OjBpbjsNCgltc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzsNCglt YXJnaW4tbGVmdDowaW47DQoJZm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGltZXMg TmV3IFJvbWFuIixzZXJpZjt9DQpzcGFuLkVtYWlsU3R5bGUxOQ0KCXttc28tc3R5bGUtdHlwZTpw ZXJzb25hbC1yZXBseTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xv cjp3aW5kb3d0ZXh0O30NCi5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1v bmx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCkBwYWdlIFdvcmRTZWN0 aW9uMQ0KCXtzaXplOjguNWluIDExLjBpbjsNCgltYXJnaW46MS4waW4gMS4waW4gMS4waW4gMS4w aW47fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQovKiBMaXN0IERl ZmluaXRpb25zICovDQpAbGlzdCBsMA0KCXttc28tbGlzdC1pZDoyMDMyMTAxNTg3Ow0KCW1zby1s aXN0LXR5cGU6aHlicmlkOw0KCW1zby1saXN0LXRlbXBsYXRlLWlkczotMTQzNzE5Njg3MCAtMTU0 OTczOTQ5NCA2NzY5ODY5MSA2NzY5ODY5MyA2NzY5ODY4OSA2NzY5ODY5MSA2NzY5ODY5MyA2NzY5 ODY4OSA2NzY5ODY5MSA2NzY5ODY5Mzt9DQpAbGlzdCBsMDpsZXZlbDENCgl7bXNvLWxldmVsLXN0 YXJ0LWF0OjA7DQoJbXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10 ZXh0Ou+DmDsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBv c2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OldpbmdkaW5n czsNCgltc28tZmFyZWFzdC1mb250LWZhbWlseTpDYWxpYnJpOw0KCW1zby1iaWRpLWZvbnQtZmFt aWx5OiJUaW1lcyBOZXcgUm9tYW4iO30NCkBsaXN0IGwwOmxldmVsMg0KCXttc28tbGV2ZWwtbnVt YmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6bzsNCgltc28tbGV2ZWwtdGFiLXN0 b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6 LS4yNWluOw0KCWZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyI7fQ0KQGxpc3QgbDA6bGV2ZWwzDQoJ e21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJ bXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0 Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3Qg bDA6bGV2ZWw0DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwt dGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1w b3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseTpTeW1ib2w7 fQ0KQGxpc3QgbDA6bGV2ZWw1DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCglt c28tbGV2ZWwtdGV4dDpvOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1u dW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6 IkNvdXJpZXIgTmV3Ijt9DQpAbGlzdCBsMDpsZXZlbDYNCgl7bXNvLWxldmVsLW51bWJlci1mb3Jt YXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9u ZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWlu Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMDpsZXZlbDcNCgl7bXNvLWxldmVs LW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwt dGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1p bmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMDpsZXZlbDgNCgl7 bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Om87DQoJbXNv LWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0K CXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseToiQ291cmllciBOZXciO30NCkBsaXN0 IGwwOmxldmVsOQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVs LXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXIt cG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6V2luZ2Rp bmdzO30NCm9sDQoJe21hcmdpbi1ib3R0b206MGluO30NCnVsDQoJe21hcmdpbi1ib3R0b206MGlu O30NCi0tPjwvc3R5bGU+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWRlZmF1bHRz IHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2IiAvPg0KPC94bWw+PCFbZW5kaWZdLS0+PCEtLVtp ZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWxheW91dCB2OmV4dD0iZWRpdCI+DQo8bzppZG1h cCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4NCjwvbzpzaGFwZWxheW91dD48L3htbD48IVtlbmRp Zl0tLT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9IkVOLVVTIiBsaW5rPSJibHVlIiB2bGluaz0icHVy cGxlIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTGlzdFBhcmFn cmFwaCIgc3R5bGU9InRleHQtaW5kZW50Oi0uMjVpbjttc28tbGlzdDpsMCBsZXZlbDEgbGZvMSI+ PCFbaWYgIXN1cHBvcnRMaXN0c10+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OldpbmdkaW5ncyI+ PHNwYW4gc3R5bGU9Im1zby1saXN0Oklnbm9yZSI+w5g8c3BhbiBzdHlsZT0iZm9udDo3LjBwdCAm cXVvdDtUaW1lcyBOZXcgUm9tYW4mcXVvdDsiPiZuYnNwOw0KPC9zcGFuPjwvc3Bhbj48L3NwYW4+ PCFbZW5kaWZdPkluIFRCUFJPVE8gc2VjdGlvbiAzLCB0aGVyZSBjdXJyZW50bHkgaXMgbGFuZ3Vh Z2UgZGVzY3JpYmluZyB3aGVuIGEgY2xpZW50IE1VU1QgYW5kIE1VU1QgTk9UIHNlbmQgYSBUQiBt ZXNzYWdlLiBJJ2QgYWRkIGEgc2VudGVuY2UvcGFyYWdyYXBoIGFmdGVyIHRoZSBmaXJzdCBwYXJh Z3JhcGggaW4gdGhhdCBzZWN0aW9uIHRvIHNheSBzb21ldGhpbmcgbGlrZSAmcXVvdDtBIHNlcnZl ciBTSE9VTEQgcmVqZWN0DQogYW4gYXBwbGljYXRpb24gcHJvdG9jb2wgbWVzc2FnZSB0aGF0IGRv ZXMgbm90IGNvbnRhaW4gYSBUb2tlbiBCaW5kaW5nIG1lc3NhZ2UgaWYgdGhlIGNsaWVudCBhbmQg c2VydmVyIHN1Y2Nlc3NmdWxseSBuZWdvdGlhdGVkIHRoZSB1c2Ugb2YgdGhlIFRva2VuIEJpbmRp bmcgcHJvdG9jb2wuJnF1b3Q7LjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZx dW90OyxzYW5zLXNlcmlmIj5UaGlzIGRvZXMgbm90IHdvcmssIGJlY2F1c2UgVEJQUk9UTyBkb2Vz IG5vdCByZXF1aXJlIHRoYXQgdGhlIFRCIG1lc3NhZ2UgYmUgaW5jbHVkZWQgaW4gZXZlcnkgYXBw bGljYXRpb24gcHJvdG9jb2wgbWVzc2FnZS4gVEJQUk9UTyBvbmx5IHJlcXVpcmVzIHRoZSBUQiBt ZXNzYWdlIGluIHRoZSBjbGllbnTigJlzDQogZmlyc3QgYXBwbGljYXRpb24gcHJvdG9jb2wgbWVz c2FnZSAoaW4gdGhlIGNvbm5lY3Rpb24gd2hlcmUgVEIgaXMgbmVnb3RpYXRlZCkuPG86cD48L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj48bzpw PiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMt c2VyaWYiPlRoZSByZXF1aXJlbWVudCB0aGF0IGVhY2ggSFRUUCByZXF1ZXN0IGhhcyBhIFRCIG1l c3NhZ2UgaW4gaXQgaXMgc3BlY2lmaWMgdG8gSFRUUFMuIFdoaWxlIHRoaXMgaXMgd2FzdGVmdWws IHdlIGhhdmUgdG8gZG8gaXQgYmVjYXVzZSBIVFRQIGhlYWRlcnMgYXJlIHBlciByZXF1ZXN0LCBy YXRoZXIgdGhhbg0KIGFmZmVjdGluZyB0aGUgZW50aXJlIGNvbm5lY3Rpb24gKEhUVFAvMiByZWR1 Y2VzIHRoaXMgd2FzdGUgYnkgY29tcHJlc3NpbmcgaGVhZGVycykuPG86cD48L286cD48L3NwYW4+ PC9wPg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_CY1PR0301MB0842F91C321A8F402529A26B8C930CY1PR0301MB0842_-- From nobody Tue Dec 20 18:07:45 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AEBFA129478 for ; Tue, 20 Dec 2016 18:07:43 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.8 X-Spam-Level: X-Spam-Status: No, score=-5.8 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-3.1, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id G9kAPjDOfCk9 for ; Tue, 20 Dec 2016 18:07:42 -0800 (PST) Received: from mail-qk0-x236.google.com (mail-qk0-x236.google.com [IPv6:2607:f8b0:400d:c09::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9174012948B for ; Tue, 20 Dec 2016 18:07:42 -0800 (PST) Received: by mail-qk0-x236.google.com with SMTP id q68so68219932qki.1 for ; Tue, 20 Dec 2016 18:07:42 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=IduCMZpEEMTPNvwIFsA8GWbhgNuNNmdNOrQEiVD1EZ4=; b=CF6A78nw3WIDypecJQERAcuC8tv31O4+ZmAQyXAXeeS67rKreAujvl5z8gDZ7mOjL1 9IJScKsKt/ztdJv07Py4T+22o/RK/ai4uHkgrXi+TGZzyBpIuzpbv+Nfs8n4YCmdfytG fG+shoW+BlYcPUVxpGmj3eWkQrljiWUGcATgLh0Eamnz9BkxR+SNYUm2P+TbK+FLRTPj EH4t/T17ZZ1Uq3ExOALzjvnw0VlhogVn816mSAjcz8axwqoAPracq3s3974YzeZqWhwb dZXbHxe+4EuKV2evVPmyqb4164Qdglv9U3jcJ+zpBjEZUqImgh0nJZIVTDpHfBwCVOVp c2Ow== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=IduCMZpEEMTPNvwIFsA8GWbhgNuNNmdNOrQEiVD1EZ4=; b=O3olW0jbCWt9WDzKBzC/MsCyqxJeOFSi08mR+0AcL61Lwcw0N6xXR6YNyjlh/oIaIk HxbF9dBjqvp/3QDGSMwLa4/wq9L4v+6XuIZSOwx9sKFistIUudgJl6rijgHiDDAh1Naq ZRSqV5P5zKLE2iAqIbRmR6YMoi23xKBF7evGDsuOEh7oHWz8o5afYhNit5kGQZIwWbOV vOFfxe+2frIrIN//qjOdd18vukxJvAEAzPBnDT0hDemHwW1Amhnkvlr303Tf/oqGlxwZ ZvreB64TQHRX9xhciQD7ZTkquivcNeGWEMlO3DbF9PG3mgeD+bcm1M6hTksyc9TOGWQs 7n2A== X-Gm-Message-State: AIkVDXJxHxWjBBRSvS+vSQGV1IlySUDksffXxnianq4K92orhyAv01HS2i+BbnHMcoeBjaSDrWZiZuD8HH91LHu6 X-Received: by 10.55.105.4 with SMTP id e4mr2399580qkc.273.1482286061583; Tue, 20 Dec 2016 18:07:41 -0800 (PST) MIME-Version: 1.0 Received: by 10.140.17.52 with HTTP; Tue, 20 Dec 2016 18:07:21 -0800 (PST) In-Reply-To: References: From: Nick Harper Date: Tue, 20 Dec 2016 18:07:21 -0800 Message-ID: To: Andrei Popov Content-Type: multipart/alternative; boundary=001a114ff2c22846ab0544219e1e Archived-At: Cc: IETF Tokbind WG , Brian Campbell Subject: Re: [Unbearable] (late, sorry) WGLC question on establishing the binding or not X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Dec 2016 02:07:44 -0000 --001a114ff2c22846ab0544219e1e Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable That could be changed to "A server SHOULD reject a client's first application protocol message...", and I think that fixes that problem. However, that doesn't cover the case of other application protocol messages lacking a TB message when the application profile (e.g. HTTPSTB) expects there to be one. The intention is that if the client disobeys the MUSTs in that first paragraph, then the server is fine to reject the message. (I was hoping that "an application protocol message" instead of "any application protocol message" would be vague enough to get around the first message vs every message restriction, but that isn't the case.) On Tue, Dec 20, 2016 at 6:02 PM, Andrei Popov wrote: > =C3=98 In TBPROTO section 3, there currently is language describing when= a > client MUST and MUST NOT send a TB message. I'd add a sentence/paragraph > after the first paragraph in that section to say something like "A server > SHOULD reject an application protocol message that does not contain a Tok= en > Binding message if the client and server successfully negotiated the use = of > the Token Binding protocol.". > > This does not work, because TBPROTO does not require that the TB message > be included in every application protocol message. TBPROTO only requires > the TB message in the client=E2=80=99s first application protocol message= (in the > connection where TB is negotiated). > > > > The requirement that each HTTP request has a TB message in it is specific > to HTTPS. While this is wasteful, we have to do it because HTTP headers a= re > per request, rather than affecting the entire connection (HTTP/2 reduces > this waste by compressing headers). > --001a114ff2c22846ab0544219e1e Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
That could be changed to "A server SHOULD reject a cl= ient's first application protocol message...", and I think that fi= xes that problem. However, that doesn't cover the case of other applica= tion protocol messages lacking a TB message when the application profile (e= .g. HTTPSTB) expects there to be one. The intention is that if the client d= isobeys the MUSTs in that first paragraph, then the server is fine to rejec= t the message. (I was hoping that "an application protocol message&quo= t; instead of "any application protocol message" would be vague e= nough to get around the first message vs every message restriction, but tha= t isn't the case.)

On Tue, Dec 20, 2016 at 6:02 PM, Andrei Popov = <Andrei.= Popov@microsoft.com> wrote:

=C3=98=C2=A0 In TBPROTO section 3, there currently is langua= ge describing when a client MUST and MUST NOT send a TB message. I'd ad= d a sentence/paragraph after the first paragraph in that section to say som= ething like "A server SHOULD reject an application protocol message that does not contain a Token Binding mess= age if the client and server successfully negotiated the use of the Token B= inding protocol.".

This does not work, because TBPROTO does not requir= e that the TB message be included in every application protocol message. TB= PROTO only requires the TB message in the client=E2=80=99s first application protocol message (in the connection where TB is negotiat= ed).

=C2=A0

The requirement that each HTTP request has a TB mes= sage in it is specific to HTTPS. While this is wasteful, we have to do it b= ecause HTTP headers are per request, rather than affecting the entire connection (HTTP/2 reduces this waste by compressing = headers).


--001a114ff2c22846ab0544219e1e-- From nobody Tue Dec 20 18:13:50 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 395261296EC for ; Tue, 20 Dec 2016 18:13:49 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.021 X-Spam-Level: X-Spam-Status: No, score=-2.021 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WSccpQBoGImY for ; Tue, 20 Dec 2016 18:13:47 -0800 (PST) Received: from NAM03-BY2-obe.outbound.protection.outlook.com (mail-by2nam03on0112.outbound.protection.outlook.com [104.47.42.112]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4BBD11293FF for ; Tue, 20 Dec 2016 18:13:47 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=zxz1b3kXyKkjzJLbVrcXGX4sMUZn2r5tiNabZnxCxlo=; b=D4AV19bZU58qgU2xx88z+xCP2JfPpGwa/E6I0sconFjOO87sDuwnJhuBuNx0mH5HboQUDK3UuhFSDqmLY6iQTsm2ms5zxg0dYJQH9aQ+0EdHyYZbvZ2xNXQvzRcmd4YG5QHUYQaPKUYyxLJbKte5JniMba2/iH0nzuOq4xltJzw= Received: from CY1PR0301MB0842.namprd03.prod.outlook.com (10.160.163.148) by CY1PR0301MB0841.namprd03.prod.outlook.com (10.160.163.147) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.789.14; Wed, 21 Dec 2016 02:13:43 +0000 Received: from CY1PR0301MB0842.namprd03.prod.outlook.com ([10.160.163.148]) by CY1PR0301MB0842.namprd03.prod.outlook.com ([10.160.163.148]) with mapi id 15.01.0789.018; Wed, 21 Dec 2016 02:13:43 +0000 From: Andrei Popov To: Nick Harper Thread-Topic: [Unbearable] (late, sorry) WGLC question on establishing the binding or not Thread-Index: AQHSWvrivRNalV6Ld0i/cnyaQrT2PaERQomAgAABJTCAACXGgIAAJbGggAAS14CAAACIAIAABXOAgAAARkA= Date: Wed, 21 Dec 2016 02:13:42 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Andrei.Popov@microsoft.com; x-originating-ip: [2001:4898:80e8:7::1d2] x-ms-office365-filtering-correlation-id: f7524689-5518-44f7-9972-08d42946fcd7 x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001); SRVR:CY1PR0301MB0841; x-microsoft-exchange-diagnostics: 1; CY1PR0301MB0841; 7:sBlmmpqW5M8PJIIl6CudUKTXDcUwdXiFMMepzTgw+2J9RzEcoWjXuah8SRrWKqH8yoNEteBKo1TWzdP6FWVXsncKgmlzC1PzFxlXMytPF8DMkkxEFZOv3m/JVpRkqcRFvCoteuhl1CRLSh+1msWzdSVN67TRHkgXAt8ic9p8X7KvUNUnF3h25984OtrEGWYVIlVpEdtqDVMo2CYBWGOlrSE+igt6AS6FjPR3NXFpwi6okR/xIJ/YLCBEEYoTbfG4GbRFkn75AieuxNoMrjlhtEuSC6oj6fNwRz9lTttFJCpB6BH44+7U8pcnct+JzimJvfnpQysW3ZYs3Ic3cB0Eiu1oXV8R/MenUlqNWRCsmp0c2MdEYdPbotKQaDkQkXPV4JbiVi4aYL0QSz5o4Lx+F4Lcj2/LnvREz6jVLrmn+TS0udq4CKHGpi+f0nKfEb6rDZj5lCUkkyhOj/U4KHUhgQ9B9KJkmTsbOtwbywK4xxU= x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(158342451672863)(211936372134217)(21748063052155); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040375)(601004)(2401047)(8121501046)(5005006)(3002001)(10201501046)(6055026)(61426038)(61427038)(6041248)(20161123564025)(20161123562025)(20161123555025)(20161123560025)(6072148)(6047074); SRVR:CY1PR0301MB0841; BCL:0; PCL:0; RULEID:; SRVR:CY1PR0301MB0841; x-forefront-prvs: 01630974C0 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(6009001)(7916002)(39840400002)(39450400003)(39860400002)(39850400002)(39410400002)(189002)(377454003)(51444003)(199003)(54356999)(76176999)(2950100002)(6916009)(6116002)(102836003)(790700001)(10090500001)(8676002)(81156014)(81166006)(189998001)(4326007)(50986999)(2906002)(5660300001)(76576001)(19609705001)(122556002)(8936002)(229853002)(101416001)(8990500004)(110136003)(68736007)(38730400001)(10290500002)(7696004)(5005710100001)(93886004)(86362001)(3280700002)(74316002)(86612001)(3660700001)(7736002)(77096006)(6436002)(106116001)(105586002)(106356001)(6506006)(99286002)(25786008)(9686002)(97736004)(2900100001)(92566002)(33656002); DIR:OUT; SFP:1102; SCL:1; SRVR:CY1PR0301MB0841; H:CY1PR0301MB0842.namprd03.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:1; LANG:en; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_CY1PR0301MB084255A571DA0559181347648C930CY1PR0301MB0842_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 21 Dec 2016 02:13:43.0008 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY1PR0301MB0841 Archived-At: Cc: IETF Tokbind WG , Brian Campbell Subject: Re: [Unbearable] (late, sorry) WGLC question on establishing the binding or not X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Dec 2016 02:13:49 -0000 --_000_CY1PR0301MB084255A571DA0559181347648C930CY1PR0301MB0842_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 V2hhdCBpZiBpbnN0ZWFkIHdlIHNheSBpbiBIVFRQU1RCIHRoYXQgaWYgdGhlIHNlcnZlciBpcyBj b25maWd1cmVkIHRvIHJlcXVpcmUgVEIsIHRoZW4gdGhpcyBzZXJ2ZXIgTVVTVCByZWplY3QgSFRU UCByZXF1ZXN0cyBsYWNraW5nIFRCIGhlYWRlcnM/DQoNClRoaXMgYXZvaWRzOg0KDQoxLiAgICAg ICBUaGUgaXNzdWUgb2YgdGhlIGZpcnN0IHZzLiBzdWJzZXF1ZW50IHJlcXVlc3RzOw0KDQoyLiAg ICAgICBUaGUgY29ybmVyLWNhc2luZyBvZiBzZXJ2ZXJzIG5lZ290aWF0aW5nIHRoZSBjbGllbnQt b2ZmZXJlZCBUQiB2ZXJzaW9uIHZzLiBhIGxvd2VyIFRCIHZlcnNpb247DQoNCjMuICAgICAgIFRo ZSBzcXVpc2hpbmVzcyBvZiBTSE9VTEQuDQoNCkZyb206IE5pY2sgSGFycGVyIFttYWlsdG86bmhh cnBlckBnb29nbGUuY29tXQ0KU2VudDogVHVlc2RheSwgRGVjZW1iZXIgMjAsIDIwMTYgNjowNyBQ TQ0KVG86IEFuZHJlaSBQb3BvdiA8QW5kcmVpLlBvcG92QG1pY3Jvc29mdC5jb20+DQpDYzogQnJp YW4gQ2FtcGJlbGwgPGJjYW1wYmVsbEBwaW5naWRlbnRpdHkuY29tPjsgSUVURiBUb2tiaW5kIFdH IDx1bmJlYXJhYmxlQGlldGYub3JnPg0KU3ViamVjdDogUmU6IFtVbmJlYXJhYmxlXSAobGF0ZSwg c29ycnkpIFdHTEMgcXVlc3Rpb24gb24gZXN0YWJsaXNoaW5nIHRoZSBiaW5kaW5nIG9yIG5vdA0K DQpUaGF0IGNvdWxkIGJlIGNoYW5nZWQgdG8gIkEgc2VydmVyIFNIT1VMRCByZWplY3QgYSBjbGll bnQncyBmaXJzdCBhcHBsaWNhdGlvbiBwcm90b2NvbCBtZXNzYWdlLi4uIiwgYW5kIEkgdGhpbmsg dGhhdCBmaXhlcyB0aGF0IHByb2JsZW0uIEhvd2V2ZXIsIHRoYXQgZG9lc24ndCBjb3ZlciB0aGUg Y2FzZSBvZiBvdGhlciBhcHBsaWNhdGlvbiBwcm90b2NvbCBtZXNzYWdlcyBsYWNraW5nIGEgVEIg bWVzc2FnZSB3aGVuIHRoZSBhcHBsaWNhdGlvbiBwcm9maWxlIChlLmcuIEhUVFBTVEIpIGV4cGVj dHMgdGhlcmUgdG8gYmUgb25lLiBUaGUgaW50ZW50aW9uIGlzIHRoYXQgaWYgdGhlIGNsaWVudCBk aXNvYmV5cyB0aGUgTVVTVHMgaW4gdGhhdCBmaXJzdCBwYXJhZ3JhcGgsIHRoZW4gdGhlIHNlcnZl ciBpcyBmaW5lIHRvIHJlamVjdCB0aGUgbWVzc2FnZS4gKEkgd2FzIGhvcGluZyB0aGF0ICJhbiBh cHBsaWNhdGlvbiBwcm90b2NvbCBtZXNzYWdlIiBpbnN0ZWFkIG9mICJhbnkgYXBwbGljYXRpb24g cHJvdG9jb2wgbWVzc2FnZSIgd291bGQgYmUgdmFndWUgZW5vdWdoIHRvIGdldCBhcm91bmQgdGhl IGZpcnN0IG1lc3NhZ2UgdnMgZXZlcnkgbWVzc2FnZSByZXN0cmljdGlvbiwgYnV0IHRoYXQgaXNu J3QgdGhlIGNhc2UuKQ0K --_000_CY1PR0301MB084255A571DA0559181347648C930CY1PR0301MB0842_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 V2luZ2RpbmdzOw0KCXBhbm9zZS0xOjUgMCAwIDAgMCAwIDAgMCAwIDA7fQ0KQGZvbnQtZmFjZQ0K CXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2IDMg MiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1 IDUgMiAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWws IGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0 b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcg Um9tYW4iLHNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXBy aW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQph OnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5 Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnAuTXNv TGlzdFBhcmFncmFwaCwgbGkuTXNvTGlzdFBhcmFncmFwaCwgZGl2Lk1zb0xpc3RQYXJhZ3JhcGgN Cgl7bXNvLXN0eWxlLXByaW9yaXR5OjM0Ow0KCW1hcmdpbi10b3A6MGluOw0KCW1hcmdpbi1yaWdo dDowaW47DQoJbWFyZ2luLWJvdHRvbTowaW47DQoJbWFyZ2luLWxlZnQ6LjVpbjsNCgltYXJnaW4t Ym90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGltZXMg TmV3IFJvbWFuIixzZXJpZjt9DQpwLm1zb25vcm1hbDAsIGxpLm1zb25vcm1hbDAsIGRpdi5tc29u b3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCgltc28tbWFyZ2luLXRvcC1hbHQ6 YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0K CW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1l cyBOZXcgUm9tYW4iLHNlcmlmO30NCnAubTI2MTI1OTcxMzEwNjkxNDQ1MzRtc29saXN0cGFyYWdy YXBoLCBsaS5tMjYxMjU5NzEzMTA2OTE0NDUzNG1zb2xpc3RwYXJhZ3JhcGgsIGRpdi5tMjYxMjU5 NzEzMTA2OTE0NDUzNG1zb2xpc3RwYXJhZ3JhcGgNCgl7bXNvLXN0eWxlLW5hbWU6bV8yNjEyNTk3 MTMxMDY5MTQ0NTM0bXNvbGlzdHBhcmFncmFwaDsNCgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsN CgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0KCW1hcmdp bi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcg Um9tYW4iLHNlcmlmO30NCnNwYW4uRW1haWxTdHlsZTE5DQoJe21zby1zdHlsZS10eXBlOnBlcnNv bmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOndp bmRvd3RleHQ7fQ0Kc3Bhbi5FbWFpbFN0eWxlMjENCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWw7 DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6d2luZG93dGV4dDt9 DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LWZh bWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo4 LjVpbiAxMS4waW47DQoJbWFyZ2luOjEuMGluIDEuMGluIDEuMGluIDEuMGluO30NCmRpdi5Xb3Jk U2VjdGlvbjENCgl7cGFnZTpXb3JkU2VjdGlvbjE7fQ0KLyogTGlzdCBEZWZpbml0aW9ucyAqLw0K QGxpc3QgbDANCgl7bXNvLWxpc3QtaWQ6MTE1OTM0Mjc5NDsNCgltc28tbGlzdC10eXBlOmh5YnJp ZDsNCgltc28tbGlzdC10ZW1wbGF0ZS1pZHM6LTE4Mzg1MjIzOTggNjc2OTg3MDMgNjc2OTg2OTEg Njc2OTg2OTMgNjc2OTg2ODkgNjc2OTg2OTEgNjc2OTg2OTMgNjc2OTg2ODkgNjc2OTg2OTEgNjc2 OTg2OTM7fQ0KQGxpc3QgbDA6bGV2ZWwxDQoJe21zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1z by1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47fQ0KQGxp c3QgbDA6bGV2ZWwyDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2 ZWwtdGV4dDpvOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXIt cG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6IkNvdXJp ZXIgTmV3Ijt9DQpAbGlzdCBsMDpsZXZlbDMNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVs bGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCglt c28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZv bnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMDpsZXZlbDQNCgl7bXNvLWxldmVsLW51bWJl ci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0 b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6 LS4yNWluOw0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMDpsZXZlbDUNCgl7bXNvLWxl dmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Om87DQoJbXNvLWxldmVs LXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQt aW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseToiQ291cmllciBOZXciO30NCkBsaXN0IGwwOmxl dmVsNg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6 74KnOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRp b246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30N CkBsaXN0IGwwOmxldmVsNw0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNv LWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1u dW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6 U3ltYm9sO30NCkBsaXN0IGwwOmxldmVsOA0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxs ZXQ7DQoJbXNvLWxldmVsLXRleHQ6bzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28t bGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQt ZmFtaWx5OiJDb3VyaWVyIE5ldyI7fQ0KQGxpc3QgbDA6bGV2ZWw5DQoJe21zby1sZXZlbC1udW1i ZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1z dG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50 Oi0uMjVpbjsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDENCgl7bXNvLWxpc3Qt aWQ6MTcxMjY1NDA0MDsNCgltc28tbGlzdC10eXBlOmh5YnJpZDsNCgltc28tbGlzdC10ZW1wbGF0 ZS1pZHM6LTExMzMzNzcxODggLTQyNTU2MzEyMiA2NzY5ODY5MSA2NzY5ODY5MyA2NzY5ODY4OSA2 NzY5ODY5MSA2NzY5ODY5MyA2NzY5ODY4OSA2NzY5ODY5MSA2NzY5ODY5Mzt9DQpAbGlzdCBsMTps ZXZlbDENCgl7bXNvLWxldmVsLXN0YXJ0LWF0OjA7DQoJbXNvLWxldmVsLW51bWJlci1mb3JtYXQ6 YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Oi07DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJ bXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglm b250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgltc28tZmFyZWFzdC1mb250LWZhbWls eTpDYWxpYnJpOw0KCW1zby1iaWRpLWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iO30NCkBs aXN0IGwxOmxldmVsMg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxl dmVsLXRleHQ6bzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVy LXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OiJDb3Vy aWVyIE5ldyI7fQ0KQGxpc3QgbDE6bGV2ZWwzDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1 bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJ bXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglm b250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDE6bGV2ZWw0DQoJe21zby1sZXZlbC1udW1i ZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1z dG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50 Oi0uMjVpbjsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDE6bGV2ZWw1DQoJe21zby1s ZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDpvOw0KCW1zby1sZXZl bC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0 LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3Ijt9DQpAbGlzdCBsMTps ZXZlbDYNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0 Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0 aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9 DQpAbGlzdCBsMTpsZXZlbDcNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1z by1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwt bnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5 OlN5bWJvbDt9DQpAbGlzdCBsMTpsZXZlbDgNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVs bGV0Ow0KCW1zby1sZXZlbC10ZXh0Om87DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNv LWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250 LWZhbWlseToiQ291cmllciBOZXciO30NCkBsaXN0IGwxOmxldmVsOQ0KCXttc28tbGV2ZWwtbnVt YmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWIt c3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVu dDotLjI1aW47DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCm9sDQoJe21hcmdpbi1ib3R0b206 MGluO30NCnVsDQoJe21hcmdpbi1ib3R0b206MGluO30NCi0tPjwvc3R5bGU+PCEtLVtpZiBndGUg bXNvIDldPjx4bWw+DQo8bzpzaGFwZWRlZmF1bHRzIHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2 IiAvPg0KPC94bWw+PCFbZW5kaWZdLS0+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFw ZWxheW91dCB2OmV4dD0iZWRpdCI+DQo8bzppZG1hcCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4N CjwvbzpzaGFwZWxheW91dD48L3htbD48IVtlbmRpZl0tLT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9 IkVOLVVTIiBsaW5rPSJibHVlIiB2bGluaz0icHVycGxlIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0 aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPldoYXQgaWYgaW5z dGVhZCB3ZSBzYXkgaW4gSFRUUFNUQiB0aGF0IGlmIHRoZSBzZXJ2ZXIgaXMgY29uZmlndXJlZCB0 byByZXF1aXJlIFRCLCB0aGVuIHRoaXMgc2VydmVyIE1VU1QgcmVqZWN0IEhUVFAgcmVxdWVzdHMg bGFja2luZyBUQiBoZWFkZXJzPzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nh bGlicmkmcXVvdDssc2Fucy1zZXJpZiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5UaGlzIGF2b2lkczo8bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTGlzdFBhcmFncmFwaCIgc3R5bGU9InRleHQtaW5k ZW50Oi0uMjVpbjttc28tbGlzdDpsMCBsZXZlbDEgbGZvMiI+PCFbaWYgIXN1cHBvcnRMaXN0c10+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZx dW90OyxzYW5zLXNlcmlmIj48c3BhbiBzdHlsZT0ibXNvLWxpc3Q6SWdub3JlIj4xLjxzcGFuIHN0 eWxlPSJmb250OjcuMHB0ICZxdW90O1RpbWVzIE5ldyBSb21hbiZxdW90OyI+Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7DQo8L3NwYW4+PC9zcGFuPjwvc3Bhbj48IVtlbmRpZl0+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZx dW90OyxzYW5zLXNlcmlmIj5UaGUgaXNzdWUgb2YgdGhlIGZpcnN0IHZzLiBzdWJzZXF1ZW50IHJl cXVlc3RzOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBo IiBzdHlsZT0idGV4dC1pbmRlbnQ6LS4yNWluO21zby1saXN0OmwwIGxldmVsMSBsZm8yIj48IVtp ZiAhc3VwcG9ydExpc3RzXT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPjxzcGFuIHN0eWxlPSJtc28tbGlzdDpJ Z25vcmUiPjIuPHNwYW4gc3R5bGU9ImZvbnQ6Ny4wcHQgJnF1b3Q7VGltZXMgTmV3IFJvbWFuJnF1 b3Q7Ij4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsNCjwvc3Bhbj48L3NwYW4+ PC9zcGFuPjwhW2VuZGlmXT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPlRoZSBjb3JuZXItY2FzaW5nIG9mIHNl cnZlcnMgbmVnb3RpYXRpbmcgdGhlIGNsaWVudC1vZmZlcmVkIFRCIHZlcnNpb24gdnMuIGEgbG93 ZXIgVEIgdmVyc2lvbjs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTGlzdFBh cmFncmFwaCIgc3R5bGU9InRleHQtaW5kZW50Oi0uMjVpbjttc28tbGlzdDpsMCBsZXZlbDEgbGZv MiI+PCFbaWYgIXN1cHBvcnRMaXN0c10+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj48c3BhbiBzdHlsZT0ibXNv LWxpc3Q6SWdub3JlIj4zLjxzcGFuIHN0eWxlPSJmb250OjcuMHB0ICZxdW90O1RpbWVzIE5ldyBS b21hbiZxdW90OyI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7DQo8L3NwYW4+ PC9zcGFuPjwvc3Bhbj48IVtlbmRpZl0+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5UaGUgc3F1aXNoaW5lc3Mg b2YgU0hPVUxELjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssc2Fucy1zZXJpZiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5Gcm9tOjwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmIj4gTmljayBIYXJwZXIgW21haWx0bzpuaGFycGVyQGdvb2dsZS5jb21dDQo8YnI+DQo8Yj5T ZW50OjwvYj4gVHVlc2RheSwgRGVjZW1iZXIgMjAsIDIwMTYgNjowNyBQTTxicj4NCjxiPlRvOjwv Yj4gQW5kcmVpIFBvcG92ICZsdDtBbmRyZWkuUG9wb3ZAbWljcm9zb2Z0LmNvbSZndDs8YnI+DQo8 Yj5DYzo8L2I+IEJyaWFuIENhbXBiZWxsICZsdDtiY2FtcGJlbGxAcGluZ2lkZW50aXR5LmNvbSZn dDs7IElFVEYgVG9rYmluZCBXRyAmbHQ7dW5iZWFyYWJsZUBpZXRmLm9yZyZndDs8YnI+DQo8Yj5T dWJqZWN0OjwvYj4gUmU6IFtVbmJlYXJhYmxlXSAobGF0ZSwgc29ycnkpIFdHTEMgcXVlc3Rpb24g b24gZXN0YWJsaXNoaW5nIHRoZSBiaW5kaW5nIG9yIG5vdDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPlRoYXQgY291bGQgYmUgY2hhbmdlZCB0byAmcXVvdDtBIHNlcnZlciBT SE9VTEQgcmVqZWN0IGEgY2xpZW50J3MgZmlyc3QgYXBwbGljYXRpb24gcHJvdG9jb2wgbWVzc2Fn ZS4uLiZxdW90OywgYW5kIEkgdGhpbmsgdGhhdCBmaXhlcyB0aGF0IHByb2JsZW0uIEhvd2V2ZXIs IHRoYXQgZG9lc24ndCBjb3ZlciB0aGUgY2FzZSBvZiBvdGhlciBhcHBsaWNhdGlvbiBwcm90b2Nv bCBtZXNzYWdlcyBsYWNraW5nIGEgVEIgbWVzc2FnZSB3aGVuDQogdGhlIGFwcGxpY2F0aW9uIHBy b2ZpbGUgKGUuZy4gSFRUUFNUQikgZXhwZWN0cyB0aGVyZSB0byBiZSBvbmUuIFRoZSBpbnRlbnRp b24gaXMgdGhhdCBpZiB0aGUgY2xpZW50IGRpc29iZXlzIHRoZSBNVVNUcyBpbiB0aGF0IGZpcnN0 IHBhcmFncmFwaCwgdGhlbiB0aGUgc2VydmVyIGlzIGZpbmUgdG8gcmVqZWN0IHRoZSBtZXNzYWdl LiAoSSB3YXMgaG9waW5nIHRoYXQgJnF1b3Q7YW4gYXBwbGljYXRpb24gcHJvdG9jb2wgbWVzc2Fn ZSZxdW90OyBpbnN0ZWFkIG9mICZxdW90O2FueQ0KIGFwcGxpY2F0aW9uIHByb3RvY29sIG1lc3Nh Z2UmcXVvdDsgd291bGQgYmUgdmFndWUgZW5vdWdoIHRvIGdldCBhcm91bmQgdGhlIGZpcnN0IG1l c3NhZ2UgdnMgZXZlcnkgbWVzc2FnZSByZXN0cmljdGlvbiwgYnV0IHRoYXQgaXNuJ3QgdGhlIGNh c2UuKTxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_CY1PR0301MB084255A571DA0559181347648C930CY1PR0301MB0842_-- From nobody Wed Dec 21 02:16:01 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 23638129DFA for ; Wed, 21 Dec 2016 02:16:00 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.598 X-Spam-Level: X-Spam-Status: No, score=-2.598 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fYRiBg9RHRov for ; Wed, 21 Dec 2016 02:15:58 -0800 (PST) Received: from smtp6-g21.free.fr (smtp6-g21.free.fr [IPv6:2a01:e0c:1:1599::15]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 31801129544 for ; Wed, 21 Dec 2016 02:15:41 -0800 (PST) Received: from [192.168.0.13] (unknown [88.182.125.39]) by smtp6-g21.free.fr (Postfix) with ESMTP id 5B43B7803CE for ; Wed, 21 Dec 2016 11:15:39 +0100 (CET) From: Denis To: unbearable@ietf.org Message-ID: <86d009f4-09d0-b128-f33a-825147af30eb@free.fr> Date: Wed, 21 Dec 2016 11:15:45 +0100 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.5.1 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="------------E1ADDDCA78D2644294E949F8" Archived-At: Subject: [Unbearable] WGLC on draft-ietf-tokbind-protocol X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Dec 2016 10:16:00 -0000 This is a multi-part message in MIME format. --------------E1ADDDCA78D2644294E949F8 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit On November 31, 2016, I sent a message saying: This set of documents failed to meet the terms of references of the WG charter. It is not resistant to the ABC attack (Alice and Bob collusion attack). In this attack Bob who is older than 18 colloborates with Alice and transmits a token to Alice who is only 14 so that she can demonstrat to a RS that she is older than 18. This kind of attack is not even mentionned in the security considerations section. This set of documents should not be progressed to IETF last call unless the attack can be countered. ======================================================================== There are two options: *Option A*: drop this series of documents, i.e. : draft-ietf-tokbind-protocol draft-ietf-tokbind-https draft-ietf-tokbind-negotiation or * * *Option B*: clearly mention that the ABC attack cannot be countered using TLS binding. In case, the latter decision would be taken by the WG, I propose a few text replacements. Current Abstract: This document specifies Version 1.0 of the Token Binding protocol.The Token Binding protocol allows client/server applications to create long-lived, uniquely identifiable TLS [RFC5246 ] bindingsspanning multiple TLS sessions and connections.Applications arethen enabled to cryptographically bind security tokens to the TLS layer, preventing token export and replay attacks.To protectprivacy, the Token Binding identifiers are only transmitted encryptedand can be reset by the user at any time.Proposed replacementAbstract: This document specifies Version 1.0 of the Token Binding protocol. The Token Binding protocol allows client/server applications tocreate long-lived, uniquely identifiable TLS [RFC5246 ] bindingsspanning multiple TLS sessions and connections.Applications arethen enabled to cryptographically bind security tokens to the TLSlayer. *However, the binding a security token to a TLS connection **is unable to counter collaboration attacks between two clients **since one client can compute the necessary information for the **other client without the need to release his key(s) to the other **client.For an effective protection against collaboration attacks, **an appropriate format of the security token, together with an **appropriate validation of some fields of it, must be used.*To protect privacy, the Token Binding identifiers are only transmitted encrypted and can be reset by the user at any time. Current Introduction (...) In order to successfully export and replay a bound security token, the attacker needs to also be able to export the client's privatekey, which is hard to do in the case of the key generated in a securehardware module.Proposed replacement Introduction (...) *In order to successfully export and replay a bound security token,**a client does not need to export the client's private**key, since it can perform all the necessary computations in the **case of a collaboration attack.* Some other changes might need to be done in the same spirit. Denis --------------E1ADDDCA78D2644294E949F8 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 8bit

On November 31, 2016, I sent a message saying:

This set of documents failed to meet the terms of references of the WG charter.

It is not resistant to the ABC attack (Alice and Bob collusion attack).
In this attack Bob who is older than 18 colloborates with Alice and transmits a token to Alice
who is only 14 so that she can demonstrat to a RS that she is older than 18.

This kind of attack is not even mentionned in the security considerations section.

This set of documents should not be progressed to IETF last call unless the attack can be countered.

========================================================================

There are two options:
 
Option A: drop this series of documents, i.e. :

  draft-ietf-tokbind-protocol
  draft-ietf-tokbind-https
  draft-ietf-tokbind-negotiation

or

Option B: clearly mention that the ABC attack cannot be countered using TLS binding.

In case, the latter decision would be taken by the WG, I propose a few text replacements.

Current Abstract :  

   This document specifies Version 1.0 of the Token Binding protocol.
   The Token Binding protocol allows client/server applications to
   create long-lived, uniquely identifiable TLS [RFC5246] bindings
   spanning multiple TLS sessions and connections.  Applications are
   then enabled to cryptographically bind security tokens to the TLS
   layer, preventing token export and replay attacks.  To protect
   privacy, the Token Binding identifiers are only transmitted encrypted
   and can be reset by the user at any time. 

Proposed replacement Abstract:
   
   This document specifies Version 1.0 of the Token Binding protocol.
   The Token Binding protocol allows client/server applications to
   create long-lived, uniquely identifiable TLS [RFC5246] bindings
   spanning multiple TLS sessions and connections.  Applications are
   then enabled to cryptographically bind security tokens to the TLS
   layer.  However, the binding a security token to a TLS connection
   is unable to counter collaboration attacks between two clients
   since one client can compute the necessary information for the
   other client without the need to release his key(s) to the other
   client.  For an effective protection against collaboration attacks,
   an appropriate format of the security token, together with an
   appropriate validation of some fields of it, must be used.  To
   protect privacy, the Token Binding identifiers are only transmitted
   encrypted and can be reset by the user at any time.

Current Introduction

   (...)    In order to successfully export and replay a bound security token,    the attacker needs to also be able to export the client's private    key, which is hard to do in the case of the key generated in a secure    hardware module. Proposed replacement

 

Introduction

 (...)    In order to successfully export and replay a bound security token,    a client does not need to export the client's private    key, since it can perform all the necessary computations in the    case of a collaboration attack.

 

Some other changes might need to be done in the same spirit.

Denis
--------------E1ADDDCA78D2644294E949F8-- From nobody Wed Dec 21 02:16:52 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D3A40129E05 for ; Wed, 21 Dec 2016 02:16:50 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.598 X-Spam-Level: X-Spam-Status: No, score=-2.598 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XKkDPyuiD9iz for ; Wed, 21 Dec 2016 02:16:48 -0800 (PST) Received: from smtp6-g21.free.fr (smtp6-g21.free.fr [IPv6:2a01:e0c:1:1599::15]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 54F97129E03 for ; Wed, 21 Dec 2016 02:16:48 -0800 (PST) Received: from [192.168.0.13] (unknown [88.182.125.39]) by smtp6-g21.free.fr (Postfix) with ESMTP id 2A5F67802CE for ; Wed, 21 Dec 2016 11:16:46 +0100 (CET) To: unbearable@ietf.org From: Denis Message-ID: <8f401a89-9edb-e492-b5b5-76642e832432@free.fr> Date: Wed, 21 Dec 2016 11:16:52 +0100 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.5.1 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="------------192E8CC5E9B4E8D5B251F198" Archived-At: Subject: [Unbearable] WGLC on draft-ietf-tokbind-https X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Dec 2016 10:16:51 -0000 This is a multi-part message in MIME format. --------------192E8CC5E9B4E8D5B251F198 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit On November 31, 2016, I sent a message saying: This set of documents failed to meet the terms of references of the WG charter. It is not resistant to the ABC attack (Alice and Bob collusion attack). In this attack Bob who is older than 18 colloborates with Alice and transmits a token to Alice who is only 14 so that she can demonstrat to a RS that she is older than 18. This kind of attack is not even mentionned in the security considerations section. This set of documents should not be progressed to IETF last call unless the attack can be countered. ======================================================================== There are two options: *Option A*: drop this series of documents, i.e. : draft-ietf-tokbind-protocol draft-ietf-tokbind-https draft-ietf-tokbind-negotiation or * * *Option B*: clearly mention that the ABC attack cannot be countered using TLS binding. In case, the latter decision would be taken by the WG, I propose a few text replacements. * Current text: *AbstractThis document describes a collection of mechanisms that allow HTTP servers to cryptographically bind authentication tokens (such ascookies and OAuth tokens) to TLS [RFC5246 ] connections.We describe both _first-party_ and _federated_ scenarios.In afirst-party scenario, an HTTP server is able to cryptographicallybind the security tokens it issues to a client, and which the clientsubsequently returns to the server, to the TLS connection between theclient and server.Such bound security tokens are protected frommisuse since the server can generally detect if they are replayedinappropriately, e.g., over other TLS connections.Federated token bindings, on the other hand, allow servers to cryptographically bind security tokens to a TLS connection that theclient has with a _different_ server than the one issuing the token. This Internet-Draft is a companion document to The Token BindingProtocol [I-D.ietf-tokbind-protocol ]*Proposed additions in blue*Abstract This document describes a collection of mechanisms that allow HTTP servers to cryptographically bind authentication tokens (such ascookies and OAuth tokens) to TLS [RFC5246 ] connections. We describe both _first-party_ and _federated_ scenarios.In afirst-party scenario, an HTTP server is able to cryptographicallybind the security tokens it issues to a client, and which the client subsequently returns to the server, to the TLS connection between the client and server.Such bound security tokens are protected from misuse since the server can generally detect if they are replayedinappropriately, e.g., over other TLS connections.*However, the binding a security token to a TLS connection is **unable to counter collaboration attacks between two clients since **one client can compute the necessary information for the other **client without the need to release his key(s) to the other client. For an effective protection against collaboration attacks, an **appropriate format of the security token, together with an **appropriate validation of some fields of it, must be used.*Federated token bindings, on the other hand, allow servers tocryptographically bind security tokens to a TLS connection that theclient has with a _different_ server than the one issuing the token. This Internet-Draft is a companion document to The Token BindingProtocol [I-D.ietf-tokbind-protocol ] *Current text: * 7.1. Security Token Replay The goal of the Federated Token Binding mechanisms is to preventattackers from exporting and replaying tokens used in protocolsbetween the client and Token Consumer, thereby impersonatinglegitimate users and gaining access to protected resources.Bound tokens can still be replayed by malware present in the client.Inorder to export the token to another machine and successfully replay it, the attacker also needs to export the corresponding private key.The Token Binding private key is therefore a high-value asset andMUST be strongly protected, ideally by generating it in a hardware security module that prevents key export *Proposed replacement* 7.1. Security Token Export andReplayThe goal of the Federated Token Binding mechanisms is to preventattackers from exporting and replaying tokens used in protocols between the client and Token Consumer, thereby impersonatinglegitimate users and gaining access to protected resources.Boundtokens can still be replayed by malware present in the client. *They can also be exported and re-used when a client collaborates **with another client.In order to export the token to another **machine and successfully use it, a client may export the **corresponding private key to the other client or may perform all **the necessary computations for the other client without exporting **the corresponding private**.Protecting the Token Binding private **key, e.g. in a hardware security module that prevents key export is **a good practice, but in such a case, it is inefficient to counter **the clients collaboration attack.* Some other changes might need to be done in the same spirit. Denis --------------192E8CC5E9B4E8D5B251F198 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: base64 PGh0bWw+DQogIDxoZWFkPg0KDQogICAgPG1ldGEgaHR0cC1lcXVpdj0iY29udGVudC10eXBl IiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KICA8L2hlYWQ+DQogIDxi b2R5IGJnY29sb3I9IiNGRkZGRkYiIHRleHQ9IiMwMDAwMDAiPg0KICAgIDxwPjxmb250IGZh Y2U9IkFyaWFsIj5PbiBOb3ZlbWJlciAzMSwgMjAxNiwgSSBzZW50IGEgbWVzc2FnZSBzYXlp bmc6PC9mb250PjwvcD4NCiAgICA8cD48Zm9udCBmYWNlPSJBcmlhbCI+VGhpcyBzZXQgb2Yg ZG9jdW1lbnRzIGZhaWxlZCB0byBtZWV0IHRoZSB0ZXJtcw0KICAgICAgICBvZiByZWZlcmVu Y2VzIG9mIHRoZSBXRyBjaGFydGVyLjxicj4NCiAgICAgICAgPGJyPg0KICAgICAgICBJdCBp cyBub3QgcmVzaXN0YW50IHRvIHRoZSBBQkMgYXR0YWNrIChBbGljZSBhbmQgQm9iIGNvbGx1 c2lvbg0KICAgICAgICBhdHRhY2spLjxicj4NCiAgICAgICAgSW4gdGhpcyBhdHRhY2sgQm9i IHdobyBpcyBvbGRlciB0aGFuIDE4IGNvbGxvYm9yYXRlcyB3aXRoIEFsaWNlDQogICAgICAg IGFuZCB0cmFuc21pdHMgYSB0b2tlbiB0byBBbGljZSA8YnI+DQogICAgICAgIHdobyBpcyBv bmx5IDE0IHNvIHRoYXQgc2hlIGNhbiBkZW1vbnN0cmF0IHRvIGEgUlMgdGhhdCBzaGUgaXMN CiAgICAgICAgb2xkZXIgdGhhbiAxOC48YnI+DQogICAgICAgIDxicj4NCiAgICAgICAgVGhp cyBraW5kIG9mIGF0dGFjayBpcyBub3QgZXZlbiBtZW50aW9ubmVkIGluIHRoZSBzZWN1cml0 eQ0KICAgICAgICBjb25zaWRlcmF0aW9ucyBzZWN0aW9uLjxicj4NCiAgICAgICAgPGJyPg0K ICAgICAgICBUaGlzIHNldCBvZiBkb2N1bWVudHMgc2hvdWxkIG5vdCBiZSBwcm9ncmVzc2Vk IHRvIElFVEYgbGFzdCBjYWxsDQogICAgICAgIHVubGVzcyB0aGUgYXR0YWNrIGNhbiBiZSBj b3VudGVyZWQuPGJyPg0KICAgICAgICA8YnI+DQo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT08YnI+DQog ICAgICAgIDxicj4NCiAgICAgICAgVGhlcmUgYXJlIHR3byBvcHRpb25zOjxicj4NCiAgICAg ICAgwqA8YnI+DQogICAgICAgIDxiPk9wdGlvbiBBPC9iPjogZHJvcCB0aGlzIHNlcmllcyBv ZiBkb2N1bWVudHMsIGkuZS4gOiA8YnI+DQogICAgICAgIDxicj4NCiAgICAgICAgwqAgZHJh ZnQtaWV0Zi10b2tiaW5kLXByb3RvY29sPGJyPg0KICAgICAgICDCoCBkcmFmdC1pZXRmLXRv a2JpbmQtaHR0cHM8YnI+DQogICAgICAgIMKgIGRyYWZ0LWlldGYtdG9rYmluZC1uZWdvdGlh dGlvbjxicj4NCiAgICAgICAgPGJyPg0KICAgICAgICBvciA8Yj48YnI+DQogICAgICAgIDwv Yj48L2ZvbnQ+PC9wPg0KICAgIDxwPjxmb250IGZhY2U9IkFyaWFsIj48Yj5PcHRpb24gQjwv Yj46IGNsZWFybHkgbWVudGlvbiB0aGF0IHRoZSBBQkMNCiAgICAgICAgYXR0YWNrIGNhbm5v dCBiZSBjb3VudGVyZWQgdXNpbmcgVExTIGJpbmRpbmcuPGJyPg0KICAgICAgICA8YnI+DQog ICAgICAgIEluIGNhc2UsIHRoZSBsYXR0ZXIgZGVjaXNpb24gd291bGQgYmUgdGFrZW4gYnkg dGhlIFdHLCBJIHByb3Bvc2UNCiAgICAgICAgYSBmZXcgdGV4dCByZXBsYWNlbWVudHMuPC9m b250PjwvcD4NCiAgICA8cHJlIHdyYXA9IiI+PGZvbnQgZmFjZT0iQXJpYWwiPg0KPC9mb250 PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ow0KbXNvLWJpZGktZm9udC1zaXplOjEw LjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90Ozttc28tYW5zaS1sYW5n dWFnZTpFTi1VUyIgbGFuZz0iRU4tVVMiPjwvc3Bhbj48Yj48Zm9udCBmYWNlPSJBcmlhbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTogMTFwdDsiIGxhbmc9IkVOLVVTIj48cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLXRvcDo2LjBwdCI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7bXNvLWJpZGktZm9udC1zaXplOjEyLjBwdDtmb250LWZhbWlseTomcXVv dDtDb3VyaWVyIE5ldyZxdW90OzsNCm1zby1hbnNpLWxhbmd1YWdlOkVOLVVTIiBsYW5nPSJF Ti1VUyI+Q3VycmVudCB0ZXh0Ojwvc3Bhbj48L3A+PC9zcGFuPjwvZm9udD48L2I+PGZvbnQg ZmFjZT0iQXJpYWwiIHNpemU9Ii0xIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOiAxMXB0OyIg bGFuZz0iRU4tVVMiPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7bXNvLWJpZGkt Zm9udC1zaXplOjEwLjBwdDsNCmZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7 O21zby1hbnNpLWxhbmd1YWdlOkVOLVVTIiBsYW5nPSJFTi1VUyI+PCEtLVtpZiAhc3VwcG9y dEVtcHR5UGFyYXNdLS0+wqA8IS0tW2VuZGlmXS0tPjxvOnA+PC9vOnA+PC9zcGFuPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O21zby1iaWRpLWZvbnQtc2l6ZToxMC4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPkFic3RyYWN0PG86cD48L286cD48 L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7bXNvLWJpZGktZm9udC1zaXpl OjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+PCEtLVtpZiAh c3VwcG9ydEVtcHR5UGFyYXNdLS0+wqA8IS0tW2VuZGlmXS0tPjxvOnA+PC9vOnA+PC9zcGFu PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O21zby1iaWRpLWZvbnQtc2l6ZToxMC4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDs7DQptc28tYW5zaS1sYW5n dWFnZTpFTi1VUyIgbGFuZz0iRU4tVVMiPjxzcGFuIHN0eWxlPSJtc28tc3BhY2VydW46IHll cyI+wqDCoCA8L3NwYW4+DQoNCjxmb250IGZhY2U9IkFyaWFsIj4gICAgICAgPC9mb250PlRo aXMgZG9jdW1lbnQgZGVzY3JpYmVzIGEgY29sbGVjdGlvbiBvZiBtZWNoYW5pc21zIHRoYXQg YWxsb3cgSFRUUA0KPG86cD48L286cD48L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7bXNvLWJpZGktZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3Vy aWVyIE5ldyZxdW90OzsNCm1zby1hbnNpLWxhbmd1YWdlOkVOLVVTIiBsYW5nPSJFTi1VUyI+ PHNwYW4gc3R5bGU9Im1zby1zcGFjZXJ1bjogeWVzIj7CoMKgIDwvc3Bhbj5zZXJ2ZXJzIHRv IGNyeXB0b2dyYXBoaWNhbGx5IGJpbmQgYXV0aGVudGljYXRpb24gdG9rZW5zIChzdWNoIGFz PG86cD48L286cD48L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7bXNvLWJp ZGktZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90 OzsNCm1zby1hbnNpLWxhbmd1YWdlOkVOLVVTIiBsYW5nPSJFTi1VUyI+PHNwYW4gc3R5bGU9 Im1zby1zcGFjZXJ1bjogeWVzIj4NCsKgwqAgPC9zcGFuPmNvb2tpZXMgYW5kIE9BdXRoIHRv a2VucykgdG8gVExTIFs8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7bXNv LWJpZGktZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZx dW90OyI+PGEgaHJlZj0iaHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL3JmYzUyNDYiIHRp dGxlPSImcXVvdDtUaGUgVHJhbnNwb3J0IExheWVyIFNlY3VyaXR5IChUTFMpIFByb3RvY29s IFZlcnNpb24gMS4yJnF1b3Q7Ij48c3BhbiBzdHlsZT0ibXNvLWFuc2ktbGFuZ3VhZ2U6RU4t VVMiIGxhbmc9IkVOLVVTIj5SRkM1MjQ2PC9zcGFuPjwvYT48L3NwYW4+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7bXNvLWJpZGktZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWls eTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OzsNCm1zby1hbnNpLWxhbmd1YWdlOkVOLVVTIiBs YW5nPSJFTi1VUyI+XSBjb25uZWN0aW9ucy48bzpwPjwvbzpwPjwvc3Bhbj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDttc28tYmlkaS1mb250LXNpemU6MTAuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ow0KbXNvLWFuc2ktbGFuZ3VhZ2U6RU4tVVMi IGxhbmc9IkVOLVVTIj48IS0tW2lmICFzdXBwb3J0RW1wdHlQYXJhc10tLT4NCjwhLS1bZW5k aWZdLS0+PG86cD48L286cD48L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 bXNvLWJpZGktZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5l dyZxdW90OzsNCm1zby1hbnNpLWxhbmd1YWdlOkVOLVVTIiBsYW5nPSJFTi1VUyI+PHNwYW4g c3R5bGU9Im1zby1zcGFjZXJ1bjogeWVzIj7CoMKgIDwvc3Bhbj4NCjxmb250IGZhY2U9IkFy aWFsIj4gICAgICA8L2ZvbnQ+V2UgZGVzY3JpYmUgYm90aCBfZmlyc3QtcGFydHlfIGFuZCBf ZmVkZXJhdGVkXyBzY2VuYXJpb3MuPHNwYW4gc3R5bGU9Im1zby1zcGFjZXJ1bjogeWVzIj7C oCA8L3NwYW4+SW4gYTxvOnA+PC9vOnA+PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O21zby1iaWRpLWZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291 cmllciBOZXcmcXVvdDs7DQptc28tYW5zaS1sYW5ndWFnZTpFTi1VUyIgbGFuZz0iRU4tVVMi PjxzcGFuIHN0eWxlPSJtc28tc3BhY2VydW46IHllcyI+DQrCoMKgIDwvc3Bhbj5maXJzdC1w YXJ0eSBzY2VuYXJpbywgYW4gSFRUUCBzZXJ2ZXIgaXMgYWJsZSB0byBjcnlwdG9ncmFwaGlj YWxseTxvOnA+PC9vOnA+PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O21z by1iaWRpLWZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcm cXVvdDs7DQptc28tYW5zaS1sYW5ndWFnZTpFTi1VUyIgbGFuZz0iRU4tVVMiPjxzcGFuIHN0 eWxlPSJtc28tc3BhY2VydW46IHllcyI+DQrCoMKgIDwvc3Bhbj5iaW5kIHRoZSBzZWN1cml0 eSB0b2tlbnMgaXQgaXNzdWVzIHRvIGEgY2xpZW50LCBhbmQgd2hpY2ggdGhlIGNsaWVudDxv OnA+PC9vOnA+PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O21zby1iaWRp LWZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDs7 DQptc28tYW5zaS1sYW5ndWFnZTpFTi1VUyIgbGFuZz0iRU4tVVMiPjxzcGFuIHN0eWxlPSJt c28tc3BhY2VydW46IHllcyI+DQrCoMKgIDwvc3Bhbj5zdWJzZXF1ZW50bHkgcmV0dXJucyB0 byB0aGUgc2VydmVyLCB0byB0aGUgVExTIGNvbm5lY3Rpb24gYmV0d2VlbiB0aGU8bzpwPjwv bzpwPjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDttc28tYmlkaS1mb250 LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ow0KbXNv LWFuc2ktbGFuZ3VhZ2U6RU4tVVMiIGxhbmc9IkVOLVVTIj48c3BhbiBzdHlsZT0ibXNvLXNw YWNlcnVuOiB5ZXMiPg0KwqDCoCA8L3NwYW4+Y2xpZW50IGFuZCBzZXJ2ZXIuPHNwYW4gc3R5 bGU9Im1zby1zcGFjZXJ1bjogeWVzIj7CoCA8L3NwYW4+U3VjaCBib3VuZCBzZWN1cml0eSB0 b2tlbnMgYXJlIHByb3RlY3RlZCBmcm9tPG86cD48L286cD48L3NwYW4+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7bXNvLWJpZGktZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWls eTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OzsNCm1zby1hbnNpLWxhbmd1YWdlOkVOLVVTIiBs YW5nPSJFTi1VUyI+PHNwYW4gc3R5bGU9Im1zby1zcGFjZXJ1bjogeWVzIj4NCsKgwqAgPC9z cGFuPm1pc3VzZSBzaW5jZSB0aGUgc2VydmVyIGNhbiBnZW5lcmFsbHkgZGV0ZWN0IGlmIHRo ZXkgYXJlIHJlcGxheWVkPG86cD48L286cD48L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7bXNvLWJpZGktZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtD b3VyaWVyIE5ldyZxdW90OzsNCm1zby1hbnNpLWxhbmd1YWdlOkVOLVVTIiBsYW5nPSJFTi1V UyI+PHNwYW4gc3R5bGU9Im1zby1zcGFjZXJ1bjogeWVzIj4NCsKgwqAgPC9zcGFuPmluYXBw cm9wcmlhdGVseSwgZS5nLiwgb3ZlciBvdGhlciBUTFMgY29ubmVjdGlvbnMuPG86cD48L286 cD48L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7bXNvLWJpZGktZm9udC1z aXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OzsNCm1zby1h bnNpLWxhbmd1YWdlOkVOLVVTIiBsYW5nPSJFTi1VUyI+PCEtLVtpZiAhc3VwcG9ydEVtcHR5 UGFyYXNdLS0+IA0KDQo8IS0tW2VuZGlmXS0tPjxvOnA+PC9vOnA+PC9zcGFuPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O21zby1iaWRpLWZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDs7DQptc28tYW5zaS1sYW5ndWFnZTpFTi1V UyIgbGFuZz0iRU4tVVMiPjxzcGFuIHN0eWxlPSJtc28tc3BhY2VydW46IHllcyI+wqDCoCA8 L3NwYW4+RmVkZXJhdGVkIHRva2VuIGJpbmRpbmdzLCBvbiB0aGUgb3RoZXIgaGFuZCwgYWxs b3cgc2VydmVycyB0bw0KPG86cD48L286cD48L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7bXNvLWJpZGktZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtD b3VyaWVyIE5ldyZxdW90OzsNCm1zby1hbnNpLWxhbmd1YWdlOkVOLVVTIiBsYW5nPSJFTi1V UyI+PHNwYW4gc3R5bGU9Im1zby1zcGFjZXJ1bjogeWVzIj7CoMKgIDwvc3Bhbj5jcnlwdG9n cmFwaGljYWxseSBiaW5kIHNlY3VyaXR5IHRva2VucyB0byBhIFRMUyBjb25uZWN0aW9uIHRo YXQgdGhlPG86cD48L286cD48L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 bXNvLWJpZGktZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5l dyZxdW90OzsNCm1zby1hbnNpLWxhbmd1YWdlOkVOLVVTIiBsYW5nPSJFTi1VUyI+PHNwYW4g c3R5bGU9Im1zby1zcGFjZXJ1bjogeWVzIj4NCsKgwqAgPC9zcGFuPmNsaWVudCBoYXMgd2l0 aCBhIF9kaWZmZXJlbnRfIHNlcnZlciB0aGFuIHRoZSBvbmUgaXNzdWluZyB0aGUgdG9rZW4u DQo8bzpwPjwvbzpwPjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDttc28t YmlkaS1mb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1 b3Q7Ow0KbXNvLWFuc2ktbGFuZ3VhZ2U6RU4tVVMiIGxhbmc9IkVOLVVTIj48IS0tW2lmICFz dXBwb3J0RW1wdHlQYXJhc10tLT4NCjwhLS1bZW5kaWZdLS0+PG86cD48L286cD48L3NwYW4+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7bXNvLWJpZGktZm9udC1zaXplOjEwLjBw dDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OzsNCm1zby1hbnNpLWxhbmd1 YWdlOkVOLVVTIiBsYW5nPSJFTi1VUyI+PHNwYW4gc3R5bGU9Im1zby1zcGFjZXJ1bjogeWVz Ij7CoMKgIDwvc3Bhbj5UaGlzIEludGVybmV0LURyYWZ0IGlzIGEgY29tcGFuaW9uIGRvY3Vt ZW50IHRvIFRoZSBUb2tlbiBCaW5kaW5nPG86cD48L286cD48L3NwYW4+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7bXNvLWJpZGktZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWls eTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OzsNCm1zby1hbnNpLWxhbmd1YWdlOkVOLVVTIiBs YW5nPSJFTi1VUyI+PHNwYW4gc3R5bGU9Im1zby1zcGFjZXJ1bjogeWVzIj4NCsKgwqAgPC9z cGFuPlByb3RvY29sIFs8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7bXNv LWJpZGktZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZx dW90OyI+PGEgaHJlZj0iaHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LWlldGYt dG9rYmluZC1odHRwcy0wNyNyZWYtSS1ELmlldGYtdG9rYmluZC1wcm90b2NvbCI+PHNwYW4g c3R5bGU9Im1zby1hbnNpLWxhbmd1YWdlOkVOLVVTIiBsYW5nPSJFTi1VUyI+SS1ELmlldGYt dG9rYmluZC1wcm90b2NvbDwvc3Bhbj48L2E+PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O21zby1iaWRpLWZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q291cmllciBOZXcmcXVvdDs7DQptc28tYW5zaS1sYW5ndWFnZTpFTi1VUyIgbGFuZz0iRU4t VVMiPl08bzpwPjwvbzpwPjwvc3Bhbj4NCg0KDQo8Yj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDttc28tYmlkaS1mb250LXNpemU6MTAuMHB0Ow0KZm9udC1mYW1pbHk6JnF1b3Q7 Q291cmllciBOZXcmcXVvdDs7bXNvLWFuc2ktbGFuZ3VhZ2U6RU4tVVMiIGxhbmc9IkVOLVVT Ij5Qcm9wb3NlZCBhZGRpdGlvbnMgPHNwYW4gc3R5bGU9ImNvbG9yOmJsdWUiPmluIGJsdWU8 bzpwPjwvbzpwPjwvc3Bhbj48L3NwYW4+PC9iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O21zby1iaWRpLWZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmll ciBOZXcmcXVvdDs7DQptc28tYW5zaS1sYW5ndWFnZTpFTi1VUyIgbGFuZz0iRU4tVVMiPjwh LS1baWYgIXN1cHBvcnRFbXB0eVBhcmFzXS0tPsKgPCEtLVtlbmRpZl0tLT48bzpwPjwvbzpw Pjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDttc28tYmlkaS1mb250LXNp emU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4NCg0KQWJz dHJhY3QNCjxvOnA+PC9vOnA+PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O21zby1iaWRpLWZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBO ZXcmcXVvdDsiPjwhLS1baWYgIXN1cHBvcnRFbXB0eVBhcmFzXS0tPsKgPCEtLVtlbmRpZl0t LT48bzpwPjwvbzpwPjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDttc28t YmlkaS1mb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1 b3Q7Ow0KbXNvLWFuc2ktbGFuZ3VhZ2U6RU4tVVMiIGxhbmc9IkVOLVVTIj48c3BhbiBzdHls ZT0ibXNvLXNwYWNlcnVuOiB5ZXMiPsKgwqAgPC9zcGFuPg0KICAgVGhpcyBkb2N1bWVudCBk ZXNjcmliZXMgYSBjb2xsZWN0aW9uIG9mIG1lY2hhbmlzbXMgdGhhdCBhbGxvdyBIVFRQDQo8 bzpwPjwvbzpwPjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDttc28tYmlk aS1mb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7 Ow0KbXNvLWFuc2ktbGFuZ3VhZ2U6RU4tVVMiIGxhbmc9IkVOLVVTIj48c3BhbiBzdHlsZT0i bXNvLXNwYWNlcnVuOiB5ZXMiPsKgwqAgPC9zcGFuPnNlcnZlcnMgdG8gY3J5cHRvZ3JhcGhp Y2FsbHkgYmluZCBhdXRoZW50aWNhdGlvbiB0b2tlbnMgKHN1Y2ggYXM8bzpwPjwvbzpwPjwv c3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDttc28tYmlkaS1mb250LXNpemU6 MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ow0KbXNvLWFuc2kt bGFuZ3VhZ2U6RU4tVVMiIGxhbmc9IkVOLVVTIj48c3BhbiBzdHlsZT0ibXNvLXNwYWNlcnVu OiB5ZXMiPg0KwqDCoCA8L3NwYW4+Y29va2llcyBhbmQgT0F1dGggdG9rZW5zKSB0byBUTFMg Wzwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDttc28tYmlkaS1mb250LXNp emU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij48YSBocmVm PSJodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvcmZjNTI0NiIgdGl0bGU9IiZxdW90O1Ro ZSBUcmFuc3BvcnQgTGF5ZXIgU2VjdXJpdHkgKFRMUykgUHJvdG9jb2wgVmVyc2lvbiAxLjIm cXVvdDsiPjxzcGFuIHN0eWxlPSJtc28tYW5zaS1sYW5ndWFnZTpFTi1VUyIgbGFuZz0iRU4t VVMiPlJGQzUyNDY8L3NwYW4+PC9hPjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDttc28tYmlkaS1mb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJp ZXIgTmV3JnF1b3Q7Ow0KbXNvLWFuc2ktbGFuZ3VhZ2U6RU4tVVMiIGxhbmc9IkVOLVVTIj5d IGNvbm5lY3Rpb25zLg0KPG86cD48L286cD48L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7bXNvLWJpZGktZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtD b3VyaWVyIE5ldyZxdW90OzsNCm1zby1hbnNpLWxhbmd1YWdlOkVOLVVTIiBsYW5nPSJFTi1V UyI+PCEtLVtpZiAhc3VwcG9ydEVtcHR5UGFyYXNdLS0+DQogPCEtLVtlbmRpZl0tLT48bzpw PjwvbzpwPjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDttc28tYmlkaS1m b250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ow0K bXNvLWFuc2ktbGFuZ3VhZ2U6RU4tVVMiIGxhbmc9IkVOLVVTIj48c3BhbiBzdHlsZT0ibXNv LXNwYWNlcnVuOiB5ZXMiPsKgIDwvc3Bhbj5XZSBkZXNjcmliZSBib3RoIF9maXJzdC1wYXJ0 eV8gYW5kIF9mZWRlcmF0ZWRfIHNjZW5hcmlvcy48c3BhbiBzdHlsZT0ibXNvLXNwYWNlcnVu OiB5ZXMiPsKgIDwvc3Bhbj5JbiBhPG86cD48L286cD48L3NwYW4+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7bXNvLWJpZGktZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTom cXVvdDtDb3VyaWVyIE5ldyZxdW90OzsNCm1zby1hbnNpLWxhbmd1YWdlOkVOLVVTIiBsYW5n PSJFTi1VUyI+PHNwYW4gc3R5bGU9Im1zby1zcGFjZXJ1bjogeWVzIj4NCsKgwqAgPC9zcGFu PmZpcnN0LXBhcnR5IHNjZW5hcmlvLCBhbiBIVFRQIHNlcnZlciBpcyBhYmxlIHRvIGNyeXB0 b2dyYXBoaWNhbGx5PG86cD48L286cD48L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7bXNvLWJpZGktZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3Vy aWVyIE5ldyZxdW90OzsNCm1zby1hbnNpLWxhbmd1YWdlOkVOLVVTIiBsYW5nPSJFTi1VUyI+ PHNwYW4gc3R5bGU9Im1zby1zcGFjZXJ1bjogeWVzIj4NCsKgwqAgPC9zcGFuPmJpbmQgdGhl IHNlY3VyaXR5IHRva2VucyBpdCBpc3N1ZXMgdG8gYSBjbGllbnQsIGFuZCB3aGljaCB0aGUg Y2xpZW50DQo8bzpwPjwvbzpwPjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDttc28tYmlkaS1mb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIg TmV3JnF1b3Q7Ow0KbXNvLWFuc2ktbGFuZ3VhZ2U6RU4tVVMiIGxhbmc9IkVOLVVTIj48c3Bh biBzdHlsZT0ibXNvLXNwYWNlcnVuOiB5ZXMiPsKgwqAgPC9zcGFuPnN1YnNlcXVlbnRseSBy ZXR1cm5zIHRvIHRoZSBzZXJ2ZXIsIHRvIHRoZSBUTFMgY29ubmVjdGlvbiBiZXR3ZWVuIHRo ZQ0KPG86cD48L286cD48L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7bXNv LWJpZGktZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZx dW90OzsNCm1zby1hbnNpLWxhbmd1YWdlOkVOLVVTIiBsYW5nPSJFTi1VUyI+PHNwYW4gc3R5 bGU9Im1zby1zcGFjZXJ1bjogeWVzIj7CoMKgIDwvc3Bhbj5jbGllbnQgYW5kIHNlcnZlci48 c3BhbiBzdHlsZT0ibXNvLXNwYWNlcnVuOiB5ZXMiPsKgIDwvc3Bhbj5TdWNoIGJvdW5kIHNl Y3VyaXR5IHRva2VucyBhcmUgcHJvdGVjdGVkIGZyb20NCjxvOnA+PC9vOnA+PC9zcGFuPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O21zby1iaWRpLWZvbnQtc2l6ZToxMC4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDs7DQptc28tYW5zaS1sYW5ndWFn ZTpFTi1VUyIgbGFuZz0iRU4tVVMiPjxzcGFuIHN0eWxlPSJtc28tc3BhY2VydW46IHllcyI+ wqDCoCA8L3NwYW4+bWlzdXNlIHNpbmNlIHRoZSBzZXJ2ZXIgY2FuIGdlbmVyYWxseSBkZXRl Y3QgaWYgdGhleSBhcmUgcmVwbGF5ZWQ8bzpwPjwvbzpwPjwvc3Bhbj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDttc28tYmlkaS1mb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ow0KbXNvLWFuc2ktbGFuZ3VhZ2U6RU4tVVMiIGxh bmc9IkVOLVVTIj48c3BhbiBzdHlsZT0ibXNvLXNwYWNlcnVuOiB5ZXMiPg0KwqDCoCA8L3Nw YW4+aW5hcHByb3ByaWF0ZWx5LCBlLmcuLCBvdmVyIG90aGVyIFRMUyBjb25uZWN0aW9ucy48 bzpwPjwvbzpwPjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDttc28tYmlk aS1mb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7 Ow0KbXNvLWFuc2ktbGFuZ3VhZ2U6RU4tVVMiIGxhbmc9IkVOLVVTIj48IS0tW2lmICFzdXBw b3J0RW1wdHlQYXJhc10tLT4gDQo8IS0tW2VuZGlmXS0tPjxvOnA+PC9vOnA+PC9zcGFuPjxi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O21zby1iaWRpLWZvbnQtc2l6ZToxMC4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDs7DQpjb2xvcjpibHVlO21z by1hbnNpLWxhbmd1YWdlOkVOLVVTIiBsYW5nPSJFTi1VUyI+PHNwYW4gc3R5bGU9Im1zby1z cGFjZXJ1bjogeWVzIj4NCsKgwqAgPC9zcGFuPkhvd2V2ZXIsIHRoZSBiaW5kaW5nIGEgc2Vj dXJpdHkgdG9rZW4gdG8gYSBUTFMgY29ubmVjdGlvbiBpcw0KPG86cD48L286cD48L3NwYW4+ PC9iPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O21zby1iaWRpLWZvbnQtc2l6 ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDs7DQpjb2xvcjpi bHVlO21zby1hbnNpLWxhbmd1YWdlOkVOLVVTIiBsYW5nPSJFTi1VUyI+PHNwYW4gc3R5bGU9 Im1zby1zcGFjZXJ1bjogeWVzIj7CoMKgwqA8L3NwYW4+dW5hYmxlIHRvIGNvdW50ZXIgY29s bGFib3JhdGlvbiBhdHRhY2tzIGJldHdlZW4gdHdvIGNsaWVudHMgc2luY2UNCjxvOnA+PC9v OnA+PC9zcGFuPjwvYj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDttc28tYmlk aS1mb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7 Ow0KY29sb3I6Ymx1ZTttc28tYW5zaS1sYW5ndWFnZTpFTi1VUyIgbGFuZz0iRU4tVVMiPjxz cGFuIHN0eWxlPSJtc28tc3BhY2VydW46IHllcyI+wqDCoMKgPC9zcGFuPm9uZSBjbGllbnQg Y2FuIGNvbXB1dGUgdGhlIG5lY2Vzc2FyeSBpbmZvcm1hdGlvbiBmb3IgdGhlIG90aGVyDQo8 bzpwPjwvbzpwPjwvc3Bhbj48L2I+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 bXNvLWJpZGktZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5l dyZxdW90OzsNCmNvbG9yOmJsdWU7bXNvLWFuc2ktbGFuZ3VhZ2U6RU4tVVMiIGxhbmc9IkVO LVVTIj48c3BhbiBzdHlsZT0ibXNvLXNwYWNlcnVuOiB5ZXMiPsKgwqDCoDwvc3Bhbj5jbGll bnQgd2l0aG91dCB0aGUgbmVlZCB0byByZWxlYXNlIGhpcyBrZXkocykgdG8gdGhlIG90aGVy IGNsaWVudC4NCg0KPHNwYW4gc3R5bGU9Im1zby1zcGFjZXJ1bjogeWVzIj7CoMKgIDwvc3Bh bj5Gb3IgYW4gZWZmZWN0aXZlIHByb3RlY3Rpb24gYWdhaW5zdCBjb2xsYWJvcmF0aW9uIGF0 dGFja3MsIGFuDQo8bzpwPjwvbzpwPjwvc3Bhbj48L2I+PGI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7bXNvLWJpZGktZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVv dDtDb3VyaWVyIE5ldyZxdW90OzsNCmNvbG9yOmJsdWU7bXNvLWFuc2ktbGFuZ3VhZ2U6RU4t VVMiIGxhbmc9IkVOLVVTIj48c3BhbiBzdHlsZT0ibXNvLXNwYWNlcnVuOiB5ZXMiPsKgwqDC oDwvc3Bhbj5hcHByb3ByaWF0ZSBmb3JtYXQgb2YgdGhlIHNlY3VyaXR5IHRva2VuLCB0b2dl dGhlciB3aXRoIGFuDQo8Zm9udCBmYWNlPSJBcmlhbCI+ICA8L2ZvbnQ+PC9zcGFuPjwvYj48 Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDttc28tYmlkaS1mb250LXNpemU6MTAu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ow0KY29sb3I6Ymx1ZTtt c28tYW5zaS1sYW5ndWFnZTpFTi1VUyIgbGFuZz0iRU4tVVMiPjxzcGFuIHN0eWxlPSJtc28t c3BhY2VydW46IHllcyI+wqAgPC9zcGFuPmFwcHJvcHJpYXRlIHZhbGlkYXRpb24gb2Ygc29t ZSBmaWVsZHMgb2YgaXQsIG11c3QgYmUgdXNlZC48bzpwPjwvbzpwPjwvc3Bhbj48L2I+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7bXNvLWJpZGktZm9udC1zaXplOjEwLjBwdDtm b250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OzsNCm1zby1hbnNpLWxhbmd1YWdl OkVOLVVTIiBsYW5nPSJFTi1VUyI+PCEtLVtpZiAhc3VwcG9ydEVtcHR5UGFyYXNdLS0+IA0K DQo8IS0tW2VuZGlmXS0tPjxvOnA+PC9vOnA+PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O21zby1iaWRpLWZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q291cmllciBOZXcmcXVvdDs7DQptc28tYW5zaS1sYW5ndWFnZTpFTi1VUyIgbGFuZz0iRU4t VVMiPjxzcGFuIHN0eWxlPSJtc28tc3BhY2VydW46IHllcyI+wqDCoCA8L3NwYW4+RmVkZXJh dGVkIHRva2VuIGJpbmRpbmdzLCBvbiB0aGUgb3RoZXIgaGFuZCwgYWxsb3cgc2VydmVycyB0 bzxvOnA+PC9vOnA+PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O21zby1i aWRpLWZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVv dDs7DQptc28tYW5zaS1sYW5ndWFnZTpFTi1VUyIgbGFuZz0iRU4tVVMiPjxzcGFuIHN0eWxl PSJtc28tc3BhY2VydW46IHllcyI+DQrCoMKgIDwvc3Bhbj5jcnlwdG9ncmFwaGljYWxseSBi aW5kIHNlY3VyaXR5IHRva2VucyB0byBhIFRMUyBjb25uZWN0aW9uIHRoYXQgdGhlPG86cD48 L286cD48L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7bXNvLWJpZGktZm9u dC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OzsNCm1z by1hbnNpLWxhbmd1YWdlOkVOLVVTIiBsYW5nPSJFTi1VUyI+PHNwYW4gc3R5bGU9Im1zby1z cGFjZXJ1bjogeWVzIj4NCsKgwqAgPC9zcGFuPmNsaWVudCBoYXMgd2l0aCBhIF9kaWZmZXJl bnRfIHNlcnZlciB0aGFuIHRoZSBvbmUgaXNzdWluZyB0aGUgdG9rZW4uDQo8bzpwPjwvbzpw Pjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDttc28tYmlkaS1mb250LXNp emU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ow0KbXNvLWFu c2ktbGFuZ3VhZ2U6RU4tVVMiIGxhbmc9IkVOLVVTIj48IS0tW2lmICFzdXBwb3J0RW1wdHlQ YXJhc10tLT4NCjwhLS1bZW5kaWZdLS0+PG86cD48L286cD48L3NwYW4+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7bXNvLWJpZGktZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWls eTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OzsNCm1zby1hbnNpLWxhbmd1YWdlOkVOLVVTIiBs YW5nPSJFTi1VUyI+PHNwYW4gc3R5bGU9Im1zby1zcGFjZXJ1bjogeWVzIj7CoMKgIDwvc3Bh bj5UaGlzIEludGVybmV0LURyYWZ0IGlzIGEgY29tcGFuaW9uIGRvY3VtZW50IHRvIFRoZSBU b2tlbiBCaW5kaW5nPG86cD48L286cD48L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7bXNvLWJpZGktZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3Vy aWVyIE5ldyZxdW90OzsNCm1zby1hbnNpLWxhbmd1YWdlOkVOLVVTIiBsYW5nPSJFTi1VUyI+ PHNwYW4gc3R5bGU9Im1zby1zcGFjZXJ1bjogeWVzIj4gDQo8Zm9udCBmYWNlPSJBcmlhbCI+ IDwvZm9udD4gwqA8L3NwYW4+UHJvdG9jb2wgWzwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDttc28tYmlkaS1mb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NvdXJpZXIgTmV3JnF1b3Q7Ij48YSBocmVmPSJodHRwczovL3Rvb2xzLmlldGYub3JnL2h0 bWwvZHJhZnQtaWV0Zi10b2tiaW5kLWh0dHBzLTA3I3JlZi1JLUQuaWV0Zi10b2tiaW5kLXBy b3RvY29sIj48c3BhbiBzdHlsZT0ibXNvLWFuc2ktbGFuZ3VhZ2U6RU4tVVMiIGxhbmc9IkVO LVVTIj5JLUQuaWV0Zi10b2tiaW5kLXByb3RvY29sPC9zcGFuPjwvYT48L3NwYW4+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7bXNvLWJpZGktZm9udC1zaXplOjEwLjBwdDtmb250 LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OzsNCm1zby1hbnNpLWxhbmd1YWdlOkVO LVVTIiBsYW5nPSJFTi1VUyI+XTxvOnA+PC9vOnA+PC9zcGFuPg0KDQoNCjwvc3Bhbj48L2Zv bnQ+PGZvbnQgZmFjZT0iQXJpYWwiIHNpemU9Ii0xIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OiAxMXB0OyIgbGFuZz0iRU4tVVMiPjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJn aW4tdG9wOjYuMHB0Ij48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDttc28tYmlk aS1mb250LXNpemU6MTIuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7 Ow0KbXNvLWFuc2ktbGFuZ3VhZ2U6RU4tVVMiIGxhbmc9IkVOLVVTIj5DdXJyZW50IHRleHQ6 IDwvc3Bhbj48L2I+PGZvbnQgZmFjZT0iQXJpYWwiIHNpemU9Ii0xIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOiAxMXB0OyIgbGFuZz0iRU4tVVMiPjwvc3Bhbj48L2ZvbnQ+PGZvbnQgZmFj ZT0iQXJpYWwiIHNpemU9Ii0xIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOiAxMXB0OyIgbGFu Zz0iRU4tVVMiPg0KPC9zcGFuPjwvZm9udD48L3A+PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1hcmdpbi10b3A6Ni4wcHQiPjxmb250IGZhY2U9IkFyaWFsIiBzaXplPSItMSI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZTogMTFwdDsiIGxhbmc9IkVOLVVTIj43LjEuIFNlY3VyaXR5 IFRva2VuIFJlcGxheTwvc3Bhbj48L2ZvbnQ+PGZvbnQgZmFjZT0iQXJpYWwiIHNpemU9Ii0x Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOiAxMXB0OyIgbGFuZz0iRU4tVVMiPjwvc3Bhbj48 L2ZvbnQ+DQo8L3A+PC9zcGFuPjwvZm9udD48Zm9udCBmYWNlPSJBcmlhbCIgc2l6ZT0iLTEi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6IDExcHQ7IiBsYW5nPSJFTi1VUyI+PHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi10b3A6Ni4wcHQiPjxmb250IGZhY2U9IkFyaWFs IiBzaXplPSItMSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTogMTFwdDsiIGxhbmc9IkVOLVVT Ij48aDMgc3R5bGU9InRhYi1zdG9wczo0NS44cHQgOTEuNnB0IDEzNy40cHQgMTgzLjJwdCAy MjkuMHB0IDI3NC44cHQgMzIwLjZwdCAzNjYuNHB0IDQxMi4ycHQgNDU4LjBwdCA1MDMuOHB0 IDU0OS42cHQgNTk1LjRwdCA2NDEuMnB0IDY4Ny4wcHQgNzMyLjhwdCI+PGZvbnQgZmFjZT0i QXJpYWwiIHNpemU9Ii0xIj48Zm9udCBmYWNlPSJBcmlhbCIgc2l6ZT0iLTEiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O21zby1iaWRpLWZvbnQtc2l6ZToxMy41cHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDs7DQptc28tYW5zaS1sYW5ndWFnZTpFTi1V UyIgbGFuZz0iRU4tVVMiPjwvc3Bhbj48Zm9udCBmYWNlPSJBcmlhbCIgc2l6ZT0iLTEiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6IDExcHQ7IiBsYW5nPSJFTi1VUyI+PC9zcGFuPjwvZm9u dD48L2ZvbnQ+PC9mb250PjwvaDM+PC9zcGFuPjwvZm9udD48Zm9udCBmYWNlPSJBcmlhbCIg c2l6ZT0iLTEiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6IDExcHQ7IiBsYW5nPSJFTi1VUyI+ PC9zcGFuPjwvZm9udD48L3A+PC9zcGFuPjwvZm9udD48cHJlIHdyYXA9IiI+PGZvbnQgZmFj ZT0iQXJpYWwiIHNpemU9Ii0xIj48Zm9udCBmYWNlPSJBcmlhbCIgc2l6ZT0iLTEiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6IDExcHQ7IiBsYW5nPSJFTi1VUyI+PC9zcGFuPjwvZm9udD48 Zm9udCBmYWNlPSJBcmlhbCIgc2l6ZT0iLTEiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6IDEx cHQ7IiBsYW5nPSJFTi1VUyI+PC9zcGFuPjwvZm9udD48L2ZvbnQ+PC9wcmU+PGZvbnQgZmFj ZT0iQXJpYWwiIHNpemU9Ii0xIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOiAxMXB0OyIgbGFu Zz0iRU4tVVMiPjwvc3Bhbj48L2ZvbnQ+PGZvbnQgZmFjZT0iQXJpYWwiIHNpemU9Ii0xIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOiAxMXB0OyIgbGFuZz0iRU4tVVMiPjwvc3Bhbj48L2Zv bnQ+PGZvbnQgZmFjZT0iQXJpYWwiIHNpemU9Ii0xIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OiAxMXB0OyIgbGFuZz0iRU4tVVMiPjxoMyBzdHlsZT0idGFiLXN0b3BzOjQ1LjhwdCA5MS42 cHQgMTM3LjRwdCAxODMuMnB0IDIyOS4wcHQgMjc0LjhwdCAzMjAuNnB0IDM2Ni40cHQgNDEy LjJwdCA0NTguMHB0IDUwMy44cHQgNTQ5LjZwdCA1OTUuNHB0IDY0MS4ycHQgNjg3LjBwdCA3 MzIuOHB0Ij48Zm9udCBmYWNlPSJBcmlhbCIgc2l6ZT0iLTEiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6IDExcHQ7IiBsYW5nPSJFTi1VUyI+PG86cD48L286cD48L3NwYW4+PC9mb250Pjwv aDM+PC9zcGFuPjwvZm9udD48Zm9udCBmYWNlPSJBcmlhbCIgc2l6ZT0iLTEiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6IDExcHQ7IiBsYW5nPSJFTi1VUyI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7bXNvLWJpZGktZm9udC1zaXplOjEwLjBwdDsNCmZvbnQtZmFtaWx5OiZx dW90O0NvdXJpZXIgTmV3JnF1b3Q7O21zby1hbnNpLWxhbmd1YWdlOkVOLVVTIiBsYW5nPSJF Ti1VUyI+PHNwYW4gc3R5bGU9Im1zby1zcGFjZXJ1bjogeWVzIj7CoMKgIDwvc3Bhbj5UaGUg Z29hbCBvZiB0aGUgRmVkZXJhdGVkIFRva2VuIEJpbmRpbmcgbWVjaGFuaXNtcyBpcyB0byBw cmV2ZW50PG86cD48L286cD48L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 bXNvLWJpZGktZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5l dyZxdW90OzsNCm1zby1hbnNpLWxhbmd1YWdlOkVOLVVTIiBsYW5nPSJFTi1VUyI+PHNwYW4g c3R5bGU9Im1zby1zcGFjZXJ1bjogeWVzIj4NCsKgwqAgPC9zcGFuPmF0dGFja2VycyBmcm9t IGV4cG9ydGluZyBhbmQgcmVwbGF5aW5nIHRva2VucyB1c2VkIGluIHByb3RvY29sczxvOnA+ PC9vOnA+PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O21zby1iaWRpLWZv bnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDs7DQpt c28tYW5zaS1sYW5ndWFnZTpFTi1VUyIgbGFuZz0iRU4tVVMiPjxzcGFuIHN0eWxlPSJtc28t c3BhY2VydW46IHllcyI+IA0KIMKgIDwvc3Bhbj5iZXR3ZWVuIHRoZSBjbGllbnQgYW5kIFRv a2VuIENvbnN1bWVyLCB0aGVyZWJ5IGltcGVyc29uYXRpbmc8bzpwPjwvbzpwPjwvc3Bhbj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDttc28tYmlkaS1mb250LXNpemU6MTAuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ow0KbXNvLWFuc2ktbGFuZ3Vh Z2U6RU4tVVMiIGxhbmc9IkVOLVVTIj48c3BhbiBzdHlsZT0ibXNvLXNwYWNlcnVuOiB5ZXMi Pg0KwqDCoCA8L3NwYW4+bGVnaXRpbWF0ZSB1c2VycyBhbmQgZ2FpbmluZyBhY2Nlc3MgdG8g cHJvdGVjdGVkIHJlc291cmNlcy48c3BhbiBzdHlsZT0ibXNvLXNwYWNlcnVuOiB5ZXMiPsKg IDwvc3Bhbj5Cb3VuZA0KPG86cD48L286cD48L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7bXNvLWJpZGktZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtD b3VyaWVyIE5ldyZxdW90OzsNCm1zby1hbnNpLWxhbmd1YWdlOkVOLVVTIiBsYW5nPSJFTi1V UyI+PHNwYW4gc3R5bGU9Im1zby1zcGFjZXJ1bjogeWVzIj7CoMKgIDwvc3Bhbj50b2tlbnMg Y2FuIHN0aWxsIGJlIHJlcGxheWVkIGJ5IG1hbHdhcmUgcHJlc2VudCBpbiB0aGUgY2xpZW50 LjxzcGFuIHN0eWxlPSJtc28tc3BhY2VydW46IHllcyI+wqAgPC9zcGFuPjxmb250IGNvbG9y PSIjNjY2NjY2Ij5JbjxvOnA+PC9vOnA+PC9mb250Pjwvc3Bhbj48Zm9udCBjb2xvcj0iIzY2 NjY2NiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7bXNvLWJpZGktZm9udC1zaXpl OjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OzsNCm1zby1hbnNp LWxhbmd1YWdlOkVOLVVTIiBsYW5nPSJFTi1VUyI+PHNwYW4gc3R5bGU9Im1zby1zcGFjZXJ1 bjogeWVzIj4NCsKgwqAgPC9zcGFuPm9yZGVyIHRvIGV4cG9ydCB0aGUgdG9rZW4gdG8gYW5v dGhlciBtYWNoaW5lIGFuZCBzdWNjZXNzZnVsbHkgcmVwbGF5DQo8bzpwPjwvbzpwPjwvc3Bh bj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDttc28tYmlkaS1mb250LXNpemU6MTAu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ow0KbXNvLWFuc2ktbGFu Z3VhZ2U6RU4tVVMiIGxhbmc9IkVOLVVTIj48c3BhbiBzdHlsZT0ibXNvLXNwYWNlcnVuOiB5 ZXMiPsKgwqAgPC9zcGFuPml0LCB0aGUgYXR0YWNrZXIgYWxzbyBuZWVkcyB0byBleHBvcnQg dGhlIGNvcnJlc3BvbmRpbmcgcHJpdmF0ZSBrZXkuPG86cD48L286cD48L3NwYW4+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7bXNvLWJpZGktZm9udC1zaXplOjEwLjBwdDtmb250 LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OzsNCm1zby1hbnNpLWxhbmd1YWdlOkVO LVVTIiBsYW5nPSJFTi1VUyI+PHNwYW4gc3R5bGU9Im1zby1zcGFjZXJ1bjogeWVzIj4NCsKg wqAgPC9zcGFuPlRoZSBUb2tlbiBCaW5kaW5nIHByaXZhdGUga2V5IGlzIHRoZXJlZm9yZSBh IGhpZ2gtdmFsdWUgYXNzZXQgYW5kPG86cD48L286cD48L3NwYW4+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7bXNvLWJpZGktZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTom cXVvdDtDb3VyaWVyIE5ldyZxdW90OzsNCm1zby1hbnNpLWxhbmd1YWdlOkVOLVVTIiBsYW5n PSJFTi1VUyI+PHNwYW4gc3R5bGU9Im1zby1zcGFjZXJ1bjogeWVzIj4NCsKgwqAgPC9zcGFu Pk1VU1QgYmUgc3Ryb25nbHkgcHJvdGVjdGVkLCBpZGVhbGx5IGJ5IGdlbmVyYXRpbmcgaXQg aW4gYSBoYXJkd2FyZQ0KPC9zcGFuPjwvZm9udD48L3NwYW4+PC9mb250Pjxmb250IGZhY2U9 IkFyaWFsIiBjb2xvcj0iIzY2NjY2NiIgc2l6ZT0iLTEiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6IDExcHQ7IiBsYW5nPSJFTi1VUyI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 bXNvLWJpZGktZm9udC1zaXplOg0KMTIuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIg TmV3JnF1b3Q7O21zby1hbnNpLWxhbmd1YWdlOkVOLVVTIiBsYW5nPSJFTi1VUyI+ICAgc2Vj dXJpdHkgbW9kdWxlIHRoYXQgcHJldmVudHMga2V5IGV4cG9ydDwvc3Bhbj48L3NwYW4+PC9m b250Pjxmb250IGNvbG9yPSIjNjY2NjY2Ij4NCjwvZm9udD48Zm9udCBmYWNlPSJBcmlhbCIg c2l6ZT0iLTEiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6IDExcHQ7IiBsYW5nPSJFTi1VUyI+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLXRvcDo2LjBwdCI+PGI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7bXNvLWJpZGktZm9udC1zaXplOjEyLjBwdDtm b250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OzsNCm1zby1hbnNpLWxhbmd1YWdl OkVOLVVTIiBsYW5nPSJFTi1VUyI+UHJvcG9zZWQgcmVwbGFjZW1lbnQ8bzpwPjwvbzpwPjwv c3Bhbj48L2I+PC9wPjwvc3Bhbj48L2ZvbnQ+PGZvbnQgZmFjZT0iQXJpYWwiIHNpemU9Ii0x Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOiAxMXB0OyIgbGFuZz0iRU4tVVMiPjxmb250IGZh Y2U9IkFyaWFsIiBzaXplPSItMSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTogMTFwdDsiIGxh bmc9IkVOLVVTIj48aDMgc3R5bGU9InRhYi1zdG9wczo0NS44cHQgOTEuNnB0IDEzNy40cHQg MTgzLjJwdCAyMjkuMHB0IDI3NC44cHQgMzIwLjZwdCAzNjYuNHB0IDQxMi4ycHQgNDU4LjBw dCA1MDMuOHB0IDU0OS42cHQgNTk1LjRwdCA2NDEuMnB0IDY4Ny4wcHQgNzMyLjhwdCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7bXNvLWJpZGktZm9udC1zaXplOjEzLjVwdDtm b250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+PGEgaHJlZj0iaHR0cHM6Ly90 b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LWlldGYtdG9rYmluZC1odHRwcy0wNyNzZWN0aW9u LTcuMSI+PHNwYW4gc3R5bGU9Im1zby1hbnNpLWxhbmd1YWdlOkVOLVVTIiBsYW5nPSJFTi1V UyI+PC9zcGFuPjwvYT48L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7bXNv LWJpZGktZm9udC1zaXplOjEzLjVwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZx dW90OzsNCm1zby1hbnNpLWxhbmd1YWdlOkVOLVVTIiBsYW5nPSJFTi1VUyI+PHNwYW4gc3R5 bGU9Im1zby1zcGFjZXJ1bjogeWVzIj48L3NwYW4+Ny4xLiBTZWN1cml0eSBUb2tlbiA8c3Bh biBzdHlsZT0iY29sb3I6Ymx1ZSI+RXhwb3J0IGFuZDwvc3Bhbj48L3NwYW4+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7bXNvLWJpZGktZm9udC1zaXplOjEzLjVwdDtmb250LWZh bWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OzsNCm1zby1hbnNpLWxhbmd1YWdlOkVOLVVT IiBsYW5nPSJFTi1VUyI+PGZvbnQgZmFjZT0iQXJpYWwiPiA8L2ZvbnQ+UmVwbGF5PC9zcGFu Pjxmb250IGZhY2U9IkFyaWFsIiBzaXplPSItMSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTog MTFwdDsiIGxhbmc9IkVOLVVTIj4NCg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 bXNvLWJpZGktZm9udC1zaXplOjEwLjBwdDsNCmZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIg TmV3JnF1b3Q7O21zby1hbnNpLWxhbmd1YWdlOkVOLVVTIiBsYW5nPSJFTi1VUyI+PHNwYW4g c3R5bGU9Im1zby1zcGFjZXJ1bjogeWVzIj7CoMKgIDwvc3Bhbj5UaGUgZ29hbCBvZiB0aGUg RmVkZXJhdGVkIFRva2VuIEJpbmRpbmcgbWVjaGFuaXNtcyBpcyB0byBwcmV2ZW50PG86cD48 L286cD48L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7bXNvLWJpZGktZm9u dC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OzsNCm1z by1hbnNpLWxhbmd1YWdlOkVOLVVTIiBsYW5nPSJFTi1VUyI+PHNwYW4gc3R5bGU9Im1zby1z cGFjZXJ1bjogeWVzIj4NCsKgwqAgPC9zcGFuPmF0dGFja2VycyBmcm9tIGV4cG9ydGluZyBh bmQgcmVwbGF5aW5nIHRva2VucyB1c2VkIGluIHByb3RvY29scw0KPG86cD48L286cD48L3Nw YW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7bXNvLWJpZGktZm9udC1zaXplOjEw LjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OzsNCm1zby1hbnNpLWxh bmd1YWdlOkVOLVVTIiBsYW5nPSJFTi1VUyI+PHNwYW4gc3R5bGU9Im1zby1zcGFjZXJ1bjog eWVzIj7CoMKgIDwvc3Bhbj5iZXR3ZWVuIHRoZSBjbGllbnQgYW5kIFRva2VuIENvbnN1bWVy LCB0aGVyZWJ5IGltcGVyc29uYXRpbmc8bzpwPjwvbzpwPjwvc3Bhbj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDttc28tYmlkaS1mb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ow0KbXNvLWFuc2ktbGFuZ3VhZ2U6RU4tVVMiIGxh bmc9IkVOLVVTIj48c3BhbiBzdHlsZT0ibXNvLXNwYWNlcnVuOiB5ZXMiPg0KwqDCoCA8L3Nw YW4+bGVnaXRpbWF0ZSB1c2VycyBhbmQgZ2FpbmluZyBhY2Nlc3MgdG8gcHJvdGVjdGVkIHJl c291cmNlcy48c3BhbiBzdHlsZT0ibXNvLXNwYWNlcnVuOiB5ZXMiPsKgIDwvc3Bhbj5Cb3Vu ZDxvOnA+PC9vOnA+PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O21zby1i aWRpLWZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVv dDs7DQptc28tYW5zaS1sYW5ndWFnZTpFTi1VUyIgbGFuZz0iRU4tVVMiPjxzcGFuIHN0eWxl PSJtc28tc3BhY2VydW46IHllcyI+DQrCoMKgIDwvc3Bhbj50b2tlbnMgY2FuIHN0aWxsIGJl IHJlcGxheWVkIGJ5IG1hbHdhcmUgcHJlc2VudCBpbiB0aGUgY2xpZW50LjxzcGFuIHN0eWxl PSJtc28tc3BhY2VydW46IHllcyI+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9mb250PjwvaDM+ PC9zcGFuPjwvZm9udD48L3NwYW4+PC9mb250Pjxmb250IGZhY2U9IkFyaWFsIiBzaXplPSIt MSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTogMTFwdDsiIGxhbmc9IkVOLVVTIj48aDMgc3R5 bGU9InRhYi1zdG9wczo0NS44cHQgOTEuNnB0IDEzNy40cHQgMTgzLjJwdCAyMjkuMHB0IDI3 NC44cHQgMzIwLjZwdCAzNjYuNHB0IDQxMi4ycHQgNDU4LjBwdCA1MDMuOHB0IDU0OS42cHQg NTk1LjRwdCA2NDEuMnB0IDY4Ny4wcHQgNzMyLjhwdCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7bXNvLWJpZGktZm9udC1zaXplOjEzLjVwdDtmb250LWZhbWlseTomcXVvdDtD b3VyaWVyIE5ldyZxdW90OzsNCm1zby1hbnNpLWxhbmd1YWdlOkVOLVVTIiBsYW5nPSJFTi1V UyI+PG86cD48L286cD48L3NwYW4+PC9oMz48L3NwYW4+PC9mb250Pjxmb250IGZhY2U9IkFy aWFsIiBzaXplPSItMSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTogMTFwdDsiIGxhbmc9IkVO LVVTIj48Zm9udCBmYWNlPSJBcmlhbCIgc2l6ZT0iLTEiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6IDExcHQ7IiBsYW5nPSJFTi1VUyI+PGgzIHN0eWxlPSJ0YWItc3RvcHM6NDUuOHB0IDkx LjZwdCAxMzcuNHB0IDE4My4ycHQgMjI5LjBwdCAyNzQuOHB0IDMyMC42cHQgMzY2LjRwdCA0 MTIuMnB0IDQ1OC4wcHQgNTAzLjhwdCA1NDkuNnB0IDU5NS40cHQgNjQxLjJwdCA2ODcuMHB0 IDczMi44cHQiPjxmb250IGZhY2U9IkFyaWFsIiBzaXplPSItMSI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZTogMTFwdDsiIGxhbmc9IkVOLVVTIj48Zm9udCBmYWNlPSJDb3VyaWVyIE5ldyI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTogMTFwdDsiIGxhbmc9IkVOLVVTIj48c3BhbiBzdHls ZT0ibXNvLXNwYWNlcnVuOiB5ZXMiPiAgPC9zcGFuPjwvc3Bhbj48Yj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOiAxMXB0OyBjb2xvcjogYmx1ZTsiIGxhbmc9IkVOLVVTIj48c3BhbiBzdHls ZT0ibXNvLXNwYWNlcnVuOiB5ZXMiPiA8L3NwYW4+VGhleSBjYW4gYWxzbyBiZSBleHBvcnRl ZCBhbmQgcmUtdXNlZCB3aGVuIGEgY2xpZW50IGNvbGxhYm9yYXRlcw0KIDwvc3Bhbj48L2I+ PC9mb250PjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O21zby1iaWRpLWZvbnQt c2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDs7DQpjb2xv cjpibHVlO21zby1hbnNpLWxhbmd1YWdlOkVOLVVTIiBsYW5nPSJFTi1VUyI+PGZvbnQgZmFj ZT0iQ291cmllciBOZXciPjxzcGFuIHN0eWxlPSJtc28tc3BhY2VydW46IHllcyI+wqAgPC9z cGFuPndpdDwvZm9udD5oIGFub3RoZXIgY2xpZW50LjxzcGFuIHN0eWxlPSJtc28tc3BhY2Vy dW46IHllcyI+wqAgPC9zcGFuPkluIG9yZGVyIHRvIGV4cG9ydCB0aGUgdG9rZW4gdG8gYW5v dGhlcg0KIDwvc3Bhbj48L2I+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7bXNv LWJpZGktZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZx dW90OzsNCmNvbG9yOmJsdWU7bXNvLWFuc2ktbGFuZ3VhZ2U6RU4tVVMiIGxhbmc9IkVOLVVT Ij48c3BhbiBzdHlsZT0ibXNvLXNwYWNlcnVuOiB5ZXMiPsKgIDwvc3Bhbj5tYWNoaW5lIGFu ZCBzdWNjZXNzZnVsbHkgdXNlIGl0LCBhIGNsaWVudCBtYXkgZXhwb3J0IHRoZSA8bzpwPjwv bzpwPjwvc3Bhbj48L2I+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7bXNvLWJp ZGktZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90 OzsNCmNvbG9yOmJsdWU7bXNvLWFuc2ktbGFuZ3VhZ2U6RU4tVVMiIGxhbmc9IkVOLVVTIj48 c3BhbiBzdHlsZT0ibXNvLXNwYWNlcnVuOiB5ZXMiPg0KwqDCoCA8L3NwYW4+Y29ycmVzcG9u ZGluZyBwcml2YXRlIGtleSB0byB0aGUgb3RoZXIgY2xpZW50IG9yIG1heSBwZXJmb3JtIGFs bCANCjxvOnA+PC9vOnA+PC9zcGFuPjwvYj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDttc28tYmlkaS1mb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJp ZXIgTmV3JnF1b3Q7Ow0KY29sb3I6Ymx1ZTttc28tYW5zaS1sYW5ndWFnZTpFTi1VUyIgbGFu Zz0iRU4tVVMiPjxzcGFuIHN0eWxlPSJtc28tc3BhY2VydW46IHllcyI+wqDCoMKgPC9zcGFu PnRoZSBuZWNlc3NhcnkgY29tcHV0YXRpb25zIGZvciB0aGUgb3RoZXIgY2xpZW50IHdpdGhv dXQgZXhwb3J0aW5nIA0KPG86cD48L286cD48L3NwYW4+PC9iPjxiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O21zby1iaWRpLWZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q291cmllciBOZXcmcXVvdDs7DQpjb2xvcjpibHVlO21zby1hbnNpLWxhbmd1YWdl OkVOLVVTIiBsYW5nPSJFTi1VUyI+PHNwYW4gc3R5bGU9Im1zby1zcGFjZXJ1bjogeWVzIj7C oMKgwqA8L3NwYW4+dGhlIGNvcnJlc3BvbmRpbmcgcHJpdmF0ZTwvc3Bhbj48L2I+PGI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7bXNvLWJpZGktZm9udC1zaXplOjEwLjBwdDtm b250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OzsNCm1zby1hbnNpLWxhbmd1YWdl OkVOLVVTIiBsYW5nPSJFTi1VUyI+LjxzcGFuIHN0eWxlPSJjb2xvcjpibHVlIj48c3BhbiBz dHlsZT0ibXNvLXNwYWNlcnVuOiB5ZXMiPsKgIDwvc3Bhbj5Qcm90ZWN0aW5nIHRoZSBUb2tl biBCaW5kaW5nIHByaXZhdGUgPG86cD48L286cD48L3NwYW4+PC9zcGFuPjwvYj48Yj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDttc28tYmlkaS1mb250LXNpemU6MTAuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ow0KY29sb3I6Ymx1ZTttc28tYW5z aS1sYW5ndWFnZTpFTi1VUyIgbGFuZz0iRU4tVVMiPjxzcGFuIHN0eWxlPSJtc28tc3BhY2Vy dW46IHllcyI+DQrCoMKgIDwvc3Bhbj5rZXksIGUuZy4gaW4gYSBoYXJkd2FyZSBzZWN1cml0 eSBtb2R1bGUgdGhhdCBwcmV2ZW50cyBrZXkgZXhwb3J0IGlzIDxvOnA+PC9vOnA+PC9zcGFu PjwvYj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDttc28tYmlkaS1mb250LXNp emU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ow0KY29sb3I6 Ymx1ZTttc28tYW5zaS1sYW5ndWFnZTpFTi1VUyIgbGFuZz0iRU4tVVMiPjxzcGFuIHN0eWxl PSJtc28tc3BhY2VydW46IHllcyI+DQrCoMKgIDwvc3Bhbj5hIGdvb2QgcHJhY3RpY2UsIGJ1 dCBpbiBzdWNoIGEgY2FzZSwgaXQgaXMgaW5lZmZpY2llbnQgdG8gY291bnRlciANCjxvOnA+ PC9vOnA+PC9zcGFuPjwvYj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDttc28t YmlkaS1mb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1 b3Q7Ow0KY29sb3I6Ymx1ZTttc28tYW5zaS1sYW5ndWFnZTpFTi1VUyIgbGFuZz0iRU4tVVMi PjxzcGFuIHN0eWxlPSJtc28tc3BhY2VydW46IHllcyI+wqDCoMKgPC9zcGFuPnRoZSBjbGll bnRzIGNvbGxhYm9yYXRpb24gYXR0YWNrLjxvOnA+PC9vOnA+PC9zcGFuPjwvYj4gPC9zcGFu PjwvZm9udD48L2gzPjwvc3Bhbj48L2ZvbnQ+PC9zcGFuPjwvZm9udD48L3ByZT4NCiAgICA8 Zm9udCBmYWNlPSJBcmlhbCIgc2l6ZT0iLTEiPg0KICAgIDwvZm9udD4NCiAgICA8cHJlIHdy YXA9IiI+PGZvbnQgZmFjZT0iQXJpYWwiIHNpemU9Ii0xIj5Tb21lIG90aGVyIGNoYW5nZXMg bWlnaHQgbmVlZCB0byBiZSBkb25lIGluIHRoZSBzYW1lIHNwaXJpdC4NCg0KRGVuaXM8L2Zv bnQ+DQo8L3ByZT4NCiAgPC9ib2R5Pg0KPC9odG1sPg0K --------------192E8CC5E9B4E8D5B251F198-- From nobody Wed Dec 21 07:23:25 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2644A1296E5 for ; Wed, 21 Dec 2016 07:23:24 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=pingidentity.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jmbR3DN3ueax for ; Wed, 21 Dec 2016 07:23:23 -0800 (PST) Received: from mail-io0-x22e.google.com (mail-io0-x22e.google.com [IPv6:2607:f8b0:4001:c06::22e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 110201296E1 for ; Wed, 21 Dec 2016 07:23:23 -0800 (PST) Received: by mail-io0-x22e.google.com with SMTP id 15so25262865iom.2 for ; Wed, 21 Dec 2016 07:23:23 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=pingidentity.com; s=gmail; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=9aTwYV21kszRzmJnFGK4PocwKdkottrJ9b1j/QCOUCg=; b=KZp16FY2XpEMMxELWdayvky5OTL7IWfID1kshmKb9hMySHATVq5UUr3A8Rr9hI+Mqt sI3Xnnh93ANs9CHkme42gJxIAdjaGYVHa5mkJgg4E5LYXpkuGyw1JpoSoE+/jiwF5l9e yu0Qc+NtlhEoBMtJTNxSyBBNztRXB0VL/hGOc= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=9aTwYV21kszRzmJnFGK4PocwKdkottrJ9b1j/QCOUCg=; b=i7dMzPA6TcY21JN36tULf+NwPQhN1yyS3yRKJVbXYmWj+l2f1uLSYZFZzsow3In0Ob 51E7lnuDHrxQCwV9RDH/l1yDnWgfn4ymxURJdTuZNmXN6ZbDOJ/mR2A/WrqFy5omK20Z /9Ji2vMBKAo00ujf3d7Aq7zL9Zkw1ewh6kQmq3sVki25G7+99USgG1b1zV8NIQIm8Upv Zp8H/RHwnV2oq2AXdG9hZB5kisYzLb61GmRhhzqNYoNu/jUas5Wb/bs/r3JV4VUEUJ/f NZPLPoqpf6zFRo3Eyok6pS64fIYA3uLIX+GBGTeff5Ad7stgapeDG5/XhsL5ai6z1v8Q pKmA== X-Gm-Message-State: AIkVDXI0ArbvrToHEvFOdzVE4m6cg48tzHFiRT5RnU27trpznbUa4ukuNvlS/pFM1+TjqvqVLsQTAFgcEY6Kaf+d X-Received: by 10.107.13.137 with SMTP id 131mr5543078ion.122.1482333802195; Wed, 21 Dec 2016 07:23:22 -0800 (PST) MIME-Version: 1.0 Received: by 10.79.31.5 with HTTP; Wed, 21 Dec 2016 07:22:51 -0800 (PST) In-Reply-To: References: From: Brian Campbell Date: Wed, 21 Dec 2016 08:22:51 -0700 Message-ID: To: Andrei Popov Content-Type: multipart/alternative; boundary=001a113fdfd4b81a5b05442cbbb8 Archived-At: Cc: IETF Tokbind WG , Nick Harper Subject: Re: [Unbearable] (late, sorry) WGLC question on establishing the binding or not X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Dec 2016 15:23:24 -0000 --001a113fdfd4b81a5b05442cbbb8 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable On Tue, Dec 20, 2016 at 6:20 PM, Andrei Popov wrote: > @Brian: > > =C3=98 What's the risk or attack in a downgrade from what=E2=80=99s nego= tiated? > > For the sake of an extreme example, if my server is configured to accept > post-quantum NewHope6k key parameters, I don=E2=80=99t want to be downgra= ded to > rsa768_pkcs1.5. > Yeah, I know the gist of downgrade. I'm struggling to understand it in this specific context of TB. Like who would do the downgrade between negotiation and app messages. And how that might even be possible. And to the benefit of whom. --001a113fdfd4b81a5b05442cbbb8 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable


On Tue, Dec 20, 2016 at 6:20 PM, Andrei Popov <Andrei.Popov@m= icrosoft.com> wrote:

@Brian:

=C3=98=C2=A0 What's the risk or attack in a downgrade fr= om what=E2=80=99s negotiated?

For the sake of an extreme example, if my server is c= onfigured to accept post-quantum NewHope6k key parameters, I don=E2=80=99t = want to be downgraded to rsa768_pkcs1.5.


Yeah, I know the gist of downgrade. I'm struggling to underst= and it in=20 this specific context of TB. Like who would do the downgrade between=20 negotiation and app messages. And how that might even be possible. And=20 to the benefit of whom.

=C2=A0

=
--001a113fdfd4b81a5b05442cbbb8-- From nobody Wed Dec 21 10:21:35 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EFF4B1294DA for ; Wed, 21 Dec 2016 10:21:33 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.021 X-Spam-Level: X-Spam-Status: No, score=-2.021 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qUY7UDSN4m0H for ; Wed, 21 Dec 2016 10:21:31 -0800 (PST) Received: from NAM02-SN1-obe.outbound.protection.outlook.com (mail-sn1nam02on0123.outbound.protection.outlook.com [104.47.36.123]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A5684129472 for ; Wed, 21 Dec 2016 10:21:31 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=WtrYA06tgfTOUZFQLPYiFVz2oyXhVSn2oqt3TNQaWrQ=; b=WcXRBLlf/ltgi1i4M9a1I6MTvXUeD6VpNDURdSqx/imszFJZ0ugnYbJ1iJF1jtXMdXvKG3UnZANF93s4rC9A8cNsf/nOruPzVLaQqs8GEXb6OIKODADe2KOUW4xncvgDcWPJg/vhnmNix3G9fyuRmtlGC9figqwKA0nPeEyYIO8= Received: from CY1PR0301MB0842.namprd03.prod.outlook.com (10.160.163.148) by CY1PR0301MB0842.namprd03.prod.outlook.com (10.160.163.148) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.789.14; Wed, 21 Dec 2016 18:21:26 +0000 Received: from CY1PR0301MB0842.namprd03.prod.outlook.com ([10.160.163.148]) by CY1PR0301MB0842.namprd03.prod.outlook.com ([10.160.163.148]) with mapi id 15.01.0789.018; Wed, 21 Dec 2016 18:21:26 +0000 From: Andrei Popov To: Brian Campbell Thread-Topic: [Unbearable] (late, sorry) WGLC question on establishing the binding or not Thread-Index: AQHSWvrivRNalV6Ld0i/cnyaQrT2PaERQomAgAABJTCAACXGgIAAJbGggAD3FICAACJogA== Date: Wed, 21 Dec 2016 18:21:26 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Andrei.Popov@microsoft.com; x-originating-ip: [2001:4898:80e8:7::1d2] x-ms-office365-filtering-correlation-id: 337d5ecf-900b-4c3e-68a5-08d429ce2d39 x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001); SRVR:CY1PR0301MB0842; x-microsoft-exchange-diagnostics: 1; CY1PR0301MB0842; 7:mIBbosVw7quWHGTtJ7CANI/aS1yJ5rnrwQDRArbtS3UVs0UWF8s/TJA9SzYZGydRMVa8cUNTDv0e94T8DeJw2ipX7pKy9SpfusvPUua8ZJuCmecewDk482XakPfvVO1KmPRB0/we8zSWuuiyk3ZNE7G/sbzoQYf1GiaPkws4BFT0QRjLCi86PUkStwd8eu32Ki0aJmirs/1U+6C6Z+DtZ1VMKZP+Y2oaj9ZHgOWwE33qbiqys9r6MpuHwInE2fUbOhgLW1E+K+RjnZqFJExi8MC9wDLo9laLdMawSxLRu+RED1GJyBw8V8Th8fSsSRJyOkhUIf46z6mh0lMUujKgNVFH7nH48KqmoUSNHCuSly77425OkZsULec8ekW7jjJpmAwnD6Cohj31fhesUn+WTCkR4iEhg9JUK1xcHZJNbIUz6qwNVej/s3EZRcWARFi72OroJ5wLDDJtaB8tmvn6QOmnpBy9EtwQnWjPQTKJaKs= x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(158342451672863)(211936372134217)(21748063052155); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040375)(601004)(2401047)(8121501046)(5005006)(3002001)(10201501046)(6055026)(61426038)(61427038)(6041248)(20161123560025)(20161123564025)(20161123562025)(20161123555025)(6042181)(6072148)(6047074); SRVR:CY1PR0301MB0842; BCL:0; PCL:0; RULEID:; SRVR:CY1PR0301MB0842; x-forefront-prvs: 01630974C0 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(7916002)(24454002)(377454003)(189002)(199003)(101416001)(68736007)(105586002)(106116001)(106356001)(8936002)(77096006)(6506006)(54356999)(2906002)(99286002)(229853002)(81166006)(81156014)(6436002)(790700001)(4326007)(93886004)(8676002)(7696004)(38730400001)(5660300001)(189998001)(110136003)(102836003)(6116002)(86612001)(8990500004)(92566002)(3660700001)(86362001)(76176999)(10090500001)(97736004)(25786008)(2950100002)(6916009)(5005710100001)(10290500002)(7736002)(122556002)(74316002)(33656002)(50986999)(9686002)(2900100001)(3280700002)(76576001); DIR:OUT; SFP:1102; SCL:1; SRVR:CY1PR0301MB0842; H:CY1PR0301MB0842.namprd03.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:1; LANG:en; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_CY1PR0301MB0842C44B524D57BB4290F90C8C930CY1PR0301MB0842_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 21 Dec 2016 18:21:26.1969 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY1PR0301MB0842 Archived-At: Cc: IETF Tokbind WG , Nick Harper Subject: Re: [Unbearable] (late, sorry) WGLC question on establishing the binding or not X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Dec 2016 18:21:34 -0000 --_000_CY1PR0301MB0842C44B524D57BB4290F90C8C930CY1PR0301MB0842_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 w5ggIEknbSBzdHJ1Z2dsaW5nIHRvIHVuZGVyc3RhbmQgaXQgaW4gdGhpcyBzcGVjaWZpYyBjb250 ZXh0IG9mIFRCLiBMaWtlIHdobyB3b3VsZCBkbyB0aGUgZG93bmdyYWRlIGJldHdlZW4gbmVnb3Rp YXRpb24gYW5kIGFwcCBtZXNzYWdlcy4gQW5kIGhvdyB0aGF0IG1pZ2h0IGV2ZW4gYmUgcG9zc2li bGUuIEFuZCB0byB0aGUgYmVuZWZpdCBvZiB3aG9tLg0KQSBtaXNtYXRjaCBiZXR3ZWVuIHRoZSBu ZWdvdGlhdGVkIFRCIHBhcmFtZXRlcnMgYW5kIHRob3NlIHVzZWQgaW4gdGhlIFRCIG1lc3NhZ2Ug Y291bGQgb2NjdXIgYXMgYSByZXN1bHQgb2YgaW1wbGVtZW50YXRpb24gZGVmZWN0cyAod2XigJl2 ZSBhbHJlYWR5IHNlZW4gc29tZSBvZiB0aGlzKS4gVGhpcyBpcyB0byB0aGUgYmVuZWZpdCBvZiBu byBvbmUsIGJ1dCBJIHRoaW5rIGEgc2VydmVyIHNob3VsZCBkZXRlY3QgdGhpcy4NCkFzIGZvciBt YWxpY2lvdXMgZG93bmdyYWRlLCBwZXJoYXBzIGEgY2xpZW50IGNvdWxkIERPUyBhbiBhcHBsaWNh dGlvbiBzZXJ2ZXIgYnkgc2VuZGluZyBUQiBtZXNzYWdlcyBzaWduZWQgdXNpbmcgQ1BVLWludGVu c2l2ZSBhbGdvcml0aG1zLCBldmVuIGlmIHRoZSBzZXJ2ZXIgaXMgb25seSBjb25maWd1cmVkIHRv IGFjY2VwdCBhbiBlZmZpY2llbnQgYWxnb3JpdGhtIChhc3N1bWluZyB0aGUgc2VydmVyIGRvZXMg bm90IHBlcmZvcm0gdGhlIFRCIHBhcmFtZXRlcnMgY2hlY2spPw0KDQpGcm9tOiBCcmlhbiBDYW1w YmVsbCBbbWFpbHRvOmJjYW1wYmVsbEBwaW5naWRlbnRpdHkuY29tXQ0KU2VudDogV2VkbmVzZGF5 LCBEZWNlbWJlciAyMSwgMjAxNiA3OjIzIEFNDQpUbzogQW5kcmVpIFBvcG92IDxBbmRyZWkuUG9w b3ZAbWljcm9zb2Z0LmNvbT4NCkNjOiBOaWNrIEhhcnBlciA8bmhhcnBlckBnb29nbGUuY29tPjsg SUVURiBUb2tiaW5kIFdHIDx1bmJlYXJhYmxlQGlldGYub3JnPg0KU3ViamVjdDogUmU6IFtVbmJl YXJhYmxlXSAobGF0ZSwgc29ycnkpIFdHTEMgcXVlc3Rpb24gb24gZXN0YWJsaXNoaW5nIHRoZSBi aW5kaW5nIG9yIG5vdA0KDQoNCg0KT24gVHVlLCBEZWMgMjAsIDIwMTYgYXQgNjoyMCBQTSwgQW5k cmVpIFBvcG92IDxBbmRyZWkuUG9wb3ZAbWljcm9zb2Z0LmNvbTxtYWlsdG86QW5kcmVpLlBvcG92 QG1pY3Jvc29mdC5jb20+PiB3cm90ZToNCkBCcmlhbjoNCg0KPiAgV2hhdCdzIHRoZSByaXNrIG9y IGF0dGFjayBpbiBhIGRvd25ncmFkZSBmcm9tIHdoYXTigJlzIG5lZ290aWF0ZWQ/DQpGb3IgdGhl IHNha2Ugb2YgYW4gZXh0cmVtZSBleGFtcGxlLCBpZiBteSBzZXJ2ZXIgaXMgY29uZmlndXJlZCB0 byBhY2NlcHQgcG9zdC1xdWFudHVtIE5ld0hvcGU2ayBrZXkgcGFyYW1ldGVycywgSSBkb27igJl0 IHdhbnQgdG8gYmUgZG93bmdyYWRlZCB0byByc2E3NjhfcGtjczEuNS4NCg0KWWVhaCwgSSBrbm93 IHRoZSBnaXN0IG9mIGRvd25ncmFkZS4gSSdtIHN0cnVnZ2xpbmcgdG8gdW5kZXJzdGFuZCBpdCBp biB0aGlzIHNwZWNpZmljIGNvbnRleHQgb2YgVEIuIExpa2Ugd2hvIHdvdWxkIGRvIHRoZSBkb3du Z3JhZGUgYmV0d2VlbiBuZWdvdGlhdGlvbiBhbmQgYXBwIG1lc3NhZ2VzLiBBbmQgaG93IHRoYXQg bWlnaHQgZXZlbiBiZSBwb3NzaWJsZS4gQW5kIHRvIHRoZSBiZW5lZml0IG9mIHdob20uDQoNCg0K DQo= --_000_CY1PR0301MB0842C44B524D57BB4290F90C8C930CY1PR0301MB0842_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 V2luZ2RpbmdzOw0KCXBhbm9zZS0xOjUgMCAwIDAgMCAwIDAgMCAwIDA7fQ0KQGZvbnQtZmFjZQ0K CXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2IDMg MiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1 IDUgMiAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWws IGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0 b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcg Um9tYW4iLHNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXBy aW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQph OnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5 Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnAuTXNv TGlzdFBhcmFncmFwaCwgbGkuTXNvTGlzdFBhcmFncmFwaCwgZGl2Lk1zb0xpc3RQYXJhZ3JhcGgN Cgl7bXNvLXN0eWxlLXByaW9yaXR5OjM0Ow0KCW1hcmdpbi10b3A6MGluOw0KCW1hcmdpbi1yaWdo dDowaW47DQoJbWFyZ2luLWJvdHRvbTowaW47DQoJbWFyZ2luLWxlZnQ6LjVpbjsNCgltYXJnaW4t Ym90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGltZXMg TmV3IFJvbWFuIixzZXJpZjt9DQpwLm1zb25vcm1hbDAsIGxpLm1zb25vcm1hbDAsIGRpdi5tc29u b3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCgltc28tbWFyZ2luLXRvcC1hbHQ6 YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0K CW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1l cyBOZXcgUm9tYW4iLHNlcmlmO30NCnAuZ21haWwtbS02OTQ3MjA4NTg2MDc2MjM5NTMwZ21haWwt bS0zNTg4OTI1ODU2NjU1MDU2MDYzbXNvbGlzdHBhcmFncmFwaCwgbGkuZ21haWwtbS02OTQ3MjA4 NTg2MDc2MjM5NTMwZ21haWwtbS0zNTg4OTI1ODU2NjU1MDU2MDYzbXNvbGlzdHBhcmFncmFwaCwg ZGl2LmdtYWlsLW0tNjk0NzIwODU4NjA3NjIzOTUzMGdtYWlsLW0tMzU4ODkyNTg1NjY1NTA1NjA2 M21zb2xpc3RwYXJhZ3JhcGgNCgl7bXNvLXN0eWxlLW5hbWU6Z21haWwtbV8tNjk0NzIwODU4NjA3 NjIzOTUzMGdtYWlsLW1fLTM1ODg5MjU4NTY2NTUwNTYwNjNtc29saXN0cGFyYWdyYXBoOw0KCW1z by1tYXJnaW4tdG9wLWFsdDphdXRvOw0KCW1hcmdpbi1yaWdodDowaW47DQoJbXNvLW1hcmdpbi1i b3R0b20tYWx0OmF1dG87DQoJbWFyZ2luLWxlZnQ6MGluOw0KCWZvbnQtc2l6ZToxMi4wcHQ7DQoJ Zm9udC1mYW1pbHk6IlRpbWVzIE5ldyBSb21hbiIsc2VyaWY7fQ0Kc3Bhbi5FbWFpbFN0eWxlMTkN Cgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwtcmVwbHk7DQoJZm9udC1mYW1pbHk6IkNhbGlicmki LHNhbnMtc2VyaWY7DQoJY29sb3I6d2luZG93dGV4dDt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28t c3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJp Zjt9DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo4LjVpbiAxMS4waW47DQoJbWFyZ2luOjEu MGluIDEuMGluIDEuMGluIDEuMGluO30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7cGFnZTpXb3JkU2Vj dGlvbjE7fQ0KLyogTGlzdCBEZWZpbml0aW9ucyAqLw0KQGxpc3QgbDANCgl7bXNvLWxpc3QtaWQ6 NzYwMjg2NDsNCgltc28tbGlzdC10eXBlOmh5YnJpZDsNCgltc28tbGlzdC10ZW1wbGF0ZS1pZHM6 NTkxOTgwOTIyIDEwMzY1NjI4MzAgNjc2OTg2OTEgNjc2OTg2OTMgNjc2OTg2ODkgNjc2OTg2OTEg Njc2OTg2OTMgNjc2OTg2ODkgNjc2OTg2OTEgNjc2OTg2OTM7fQ0KQGxpc3QgbDA6bGV2ZWwxDQoJ e21zby1sZXZlbC1zdGFydC1hdDowOw0KCW1zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsN Cgltc28tbGV2ZWwtdGV4dDrvg5g7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxl dmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZh bWlseTpXaW5nZGluZ3M7DQoJbXNvLWZhcmVhc3QtZm9udC1mYW1pbHk6Q2FsaWJyaTsNCgltc28t YmlkaS1mb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIjt9DQpAbGlzdCBsMDpsZXZlbDINCgl7 bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Om87DQoJbXNv LWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0K CXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseToiQ291cmllciBOZXciO30NCkBsaXN0 IGwwOmxldmVsMw0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVs LXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXIt cG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6V2luZ2Rp bmdzO30NCkBsaXN0IGwwOmxldmVsNA0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7 DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1s ZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1m YW1pbHk6U3ltYm9sO30NCkBsaXN0IGwwOmxldmVsNQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1h dDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6bzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsN Cgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0K CWZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyI7fQ0KQGxpc3QgbDA6bGV2ZWw2DQoJe21zby1sZXZl bC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVs LXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQt aW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDA6bGV2ZWw3 DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7 DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjps ZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3Qg bDA6bGV2ZWw4DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwt dGV4dDpvOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9z aXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIg TmV3Ijt9DQpAbGlzdCBsMDpsZXZlbDkNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0 Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28t bGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQt ZmFtaWx5OldpbmdkaW5nczt9DQpvbA0KCXttYXJnaW4tYm90dG9tOjBpbjt9DQp1bA0KCXttYXJn aW4tYm90dG9tOjBpbjt9DQotLT48L3N0eWxlPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86 c2hhcGVkZWZhdWx0cyB2OmV4dD0iZWRpdCIgc3BpZG1heD0iMTAyNiIgLz4NCjwveG1sPjwhW2Vu ZGlmXS0tPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVsYXlvdXQgdjpleHQ9ImVk aXQiPg0KPG86aWRtYXAgdjpleHQ9ImVkaXQiIGRhdGE9IjEiIC8+DQo8L286c2hhcGVsYXlvdXQ+ PC94bWw+PCFbZW5kaWZdLS0+DQo8L2hlYWQ+DQo8Ym9keSBsYW5nPSJFTi1VUyIgbGluaz0iYmx1 ZSIgdmxpbms9InB1cnBsZSI+DQo8ZGl2IGNsYXNzPSJXb3JkU2VjdGlvbjEiPg0KPHAgY2xhc3M9 Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJ0ZXh0LWluZGVudDotLjI1aW47bXNvLWxpc3Q6bDAg bGV2ZWwxIGxmbzEiPjwhW2lmICFzdXBwb3J0TGlzdHNdPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OldpbmdkaW5ncyI+PHNwYW4gc3R5bGU9Im1zby1saXN0Oklnbm9y ZSI+w5g8c3BhbiBzdHlsZT0iZm9udDo3LjBwdCAmcXVvdDtUaW1lcyBOZXcgUm9tYW4mcXVvdDsi PiZuYnNwOw0KPC9zcGFuPjwvc3Bhbj48L3NwYW4+PCFbZW5kaWZdPkknbSBzdHJ1Z2dsaW5nIHRv IHVuZGVyc3RhbmQgaXQgaW4gdGhpcyBzcGVjaWZpYyBjb250ZXh0IG9mIFRCLiBMaWtlIHdobyB3 b3VsZCBkbyB0aGUgZG93bmdyYWRlIGJldHdlZW4gbmVnb3RpYXRpb24gYW5kIGFwcCBtZXNzYWdl cy4gQW5kIGhvdyB0aGF0IG1pZ2h0IGV2ZW4gYmUgcG9zc2libGUuIEFuZCB0byB0aGUgYmVuZWZp dCBvZiB3aG9tLjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5BIG1pc21hdGNoIGJldHdlZW4gdGhlIG5l Z290aWF0ZWQgVEIgcGFyYW1ldGVycyBhbmQgdGhvc2UgdXNlZCBpbiB0aGUgVEIgbWVzc2FnZSBj b3VsZCBvY2N1ciBhcyBhIHJlc3VsdCBvZiBpbXBsZW1lbnRhdGlvbiBkZWZlY3RzICh3ZeKAmXZl IGFscmVhZHkgc2VlbiBzb21lIG9mIHRoaXMpLiBUaGlzIGlzDQogdG8gdGhlIGJlbmVmaXQgb2Yg bm8gb25lLCBidXQgSSB0aGluayBhIHNlcnZlciBzaG91bGQgZGV0ZWN0IHRoaXMuPG86cD48L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5BcyBm b3IgbWFsaWNpb3VzIGRvd25ncmFkZSwgcGVyaGFwcyBhIGNsaWVudCBjb3VsZCBET1MgYW4gYXBw bGljYXRpb24gc2VydmVyIGJ5IHNlbmRpbmcgVEIgbWVzc2FnZXMgc2lnbmVkIHVzaW5nIENQVS1p bnRlbnNpdmUgYWxnb3JpdGhtcywgZXZlbiBpZiB0aGUgc2VydmVyIGlzIG9ubHkgY29uZmlndXJl ZA0KIHRvIGFjY2VwdCBhbiBlZmZpY2llbnQgYWxnb3JpdGhtIChhc3N1bWluZyB0aGUgc2VydmVy IGRvZXMgbm90IHBlcmZvcm0gdGhlIFRCIHBhcmFtZXRlcnMgY2hlY2spPzxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+PG86cD4mbmJz cDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmIj5Gcm9tOjwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4gQnJpYW4gQ2FtcGJlbGwgW21h aWx0bzpiY2FtcGJlbGxAcGluZ2lkZW50aXR5LmNvbV0NCjxicj4NCjxiPlNlbnQ6PC9iPiBXZWRu ZXNkYXksIERlY2VtYmVyIDIxLCAyMDE2IDc6MjMgQU08YnI+DQo8Yj5Ubzo8L2I+IEFuZHJlaSBQ b3BvdiAmbHQ7QW5kcmVpLlBvcG92QG1pY3Jvc29mdC5jb20mZ3Q7PGJyPg0KPGI+Q2M6PC9iPiBO aWNrIEhhcnBlciAmbHQ7bmhhcnBlckBnb29nbGUuY29tJmd0OzsgSUVURiBUb2tiaW5kIFdHICZs dDt1bmJlYXJhYmxlQGlldGYub3JnJmd0Ozxicj4NCjxiPlN1YmplY3Q6PC9iPiBSZTogW1VuYmVh cmFibGVdIChsYXRlLCBzb3JyeSkgV0dMQyBxdWVzdGlvbiBvbiBlc3RhYmxpc2hpbmcgdGhlIGJp bmRpbmcgb3Igbm90PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4m bmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8 L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+T24gVHVlLCBEZWMgMjAsIDIw MTYgYXQgNjoyMCBQTSwgQW5kcmVpIFBvcG92ICZsdDs8YSBocmVmPSJtYWlsdG86QW5kcmVpLlBv cG92QG1pY3Jvc29mdC5jb20iIHRhcmdldD0iX2JsYW5rIj5BbmRyZWkuUG9wb3ZAbWljcm9zb2Z0 LmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJv cmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowaW4gMGlu IDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tcmlnaHQ6MGluIj4NCjxkaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRv O21hcmdpbi1ib3R0b206MTIuMHB0Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkBCcmlhbjo8L3NwYW4+PG86 cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbS02OTQ3MjA4NTg2MDc2MjM5NTMwZ21haWwt bS0zNTg4OTI1ODU2NjU1MDU2MDYzbXNvbGlzdHBhcmFncmFwaCIgc3R5bGU9Im1hcmdpbi1ib3R0 b206MTIuMHB0Ij4NCjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpXaW5nZGluZ3MiPsOYPC9zcGFu PjxzcGFuIHN0eWxlPSJmb250LXNpemU6Ny4wcHQiPiZuYnNwOyA8L3NwYW4+DQpXaGF0J3MgdGhl IHJpc2sgb3IgYXR0YWNrIGluIGEgZG93bmdyYWRlIGZyb20gd2hhdOKAmXMgbmVnb3RpYXRlZD8g PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10 b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+ Rm9yIHRoZSBzYWtlIG9mIGFuIGV4dHJlbWUgZXhhbXBsZSwgaWYgbXkgc2VydmVyIGlzIGNvbmZp Z3VyZWQgdG8gYWNjZXB0IHBvc3QtcXVhbnR1bSBOZXdIb3BlNmsga2V5IHBhcmFtZXRlcnMsIEkN CiBkb27igJl0IHdhbnQgdG8gYmUgZG93bmdyYWRlZCB0byByc2E3NjhfcGtjczEuNS48L3NwYW4+ PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tYm90dG9tOjEyLjBwdCI+PGJyPg0KWWVh aCwgSSBrbm93IHRoZSBnaXN0IG9mIGRvd25ncmFkZS4gSSdtIHN0cnVnZ2xpbmcgdG8gdW5kZXJz dGFuZCBpdCBpbiB0aGlzIHNwZWNpZmljIGNvbnRleHQgb2YgVEIuIExpa2Ugd2hvIHdvdWxkIGRv IHRoZSBkb3duZ3JhZGUgYmV0d2VlbiBuZWdvdGlhdGlvbiBhbmQgYXBwIG1lc3NhZ2VzLiBBbmQg aG93IHRoYXQgbWlnaHQgZXZlbiBiZSBwb3NzaWJsZS4gQW5kIHRvIHRoZSBiZW5lZml0IG9mIHdo b20uDQo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2 Pg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_CY1PR0301MB0842C44B524D57BB4290F90C8C930CY1PR0301MB0842_-- From nobody Wed Dec 21 10:49:15 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BA2CE12948A for ; Wed, 21 Dec 2016 10:49:13 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=pingidentity.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wNI6ozo7JnIN for ; Wed, 21 Dec 2016 10:49:12 -0800 (PST) Received: from mail-it0-x22b.google.com (mail-it0-x22b.google.com [IPv6:2607:f8b0:4001:c0b::22b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 795DC129519 for ; Wed, 21 Dec 2016 10:49:12 -0800 (PST) Received: by mail-it0-x22b.google.com with SMTP id o141so38345471itc.0 for ; Wed, 21 Dec 2016 10:49:12 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=pingidentity.com; s=gmail; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=LKCQ8TwoJ9r8g3a1yLPwFBI64HO7eELpqpj5qkwSZ78=; b=k8WxDnKTt4xnxQz4Pz8o+/XUOWJo5aFrzyBDgmSPmFlEYzDJeDlDphW96/3MZNFCn1 6WILk5LxoMH1aEeAURPsgPpdyk/zYg3jap6/BX1V9XfeVVrLrBoqtSxPH5chPczEVc7A KLYjjwkrGB3xxfhNOCTOWJ5HB9WdW3OcaR74o= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=LKCQ8TwoJ9r8g3a1yLPwFBI64HO7eELpqpj5qkwSZ78=; b=AL5SClebd53cLJr9dLZLa32TZ9jW1wQvAfpDhwboPI/HfQ0qiOhw0s9AxfatOZWosc 0VxUtdlCDp7GQo/eDG2Z4hjjx+WIGowgd77zYDtD2tm9eMU7a4ZZnIYMzri3xO1sqyHq KZ/w8PbhQUFKFvhcZQZGSkrhI+FAuRs/zL8M/AcvWz1VgqnJyO8TORi89oTMEEQk25An 5/SqSEv83UdItcKtOQkE9F+AWA9bFaAftlJSSo/O63Em3pl+c7o+MAQMnm7p1jaHiZDz pkarSmfB0bPHEq5zTdleMzwd4qhj9wsjSBtNnjGCrRvNDmFwhl496z9Ad2RlLyCcXaWq SGqg== X-Gm-Message-State: AIkVDXJPlJle7MBD2LON/CE5Xhs8gbmo1n/gDRFDztVXDFu9qULGgMTclVK14SaJUNkkofWMZU3x8lb9XMy1AkDY X-Received: by 10.36.139.4 with SMTP id g4mr9253262ite.35.1482346151786; Wed, 21 Dec 2016 10:49:11 -0800 (PST) MIME-Version: 1.0 Received: by 10.79.31.5 with HTTP; Wed, 21 Dec 2016 10:48:40 -0800 (PST) In-Reply-To: References: From: Brian Campbell Date: Wed, 21 Dec 2016 11:48:40 -0700 Message-ID: To: Andrei Popov Content-Type: multipart/alternative; boundary=94eb2c04abb8cfd23805442f9bf1 Archived-At: Cc: IETF Tokbind WG , Nick Harper Subject: Re: [Unbearable] (late, sorry) WGLC question on establishing the binding or not X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Dec 2016 18:49:13 -0000 --94eb2c04abb8cfd23805442f9bf1 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Fair enough. Thanks. On Wed, Dec 21, 2016 at 11:21 AM, Andrei Popov wrote: > =C3=98 I'm struggling to understand it in this specific context of TB. L= ike > who would do the downgrade between negotiation and app messages. And how > that might even be possible. And to the benefit of whom. > > A mismatch between the negotiated TB parameters and those used in the TB > message could occur as a result of implementation defects (we=E2=80=99ve = already > seen some of this). This is to the benefit of no one, but I think a serve= r > should detect this. > > As for malicious downgrade, perhaps a client could DOS an application > server by sending TB messages signed using CPU-intensive algorithms, even > if the server is only configured to accept an efficient algorithm (assumi= ng > the server does not perform the TB parameters check)? > > > > *From:* Brian Campbell [mailto:bcampbell@pingidentity.com] > *Sent:* Wednesday, December 21, 2016 7:23 AM > *To:* Andrei Popov > *Cc:* Nick Harper ; IETF Tokbind WG < > unbearable@ietf.org> > *Subject:* Re: [Unbearable] (late, sorry) WGLC question on establishing > the binding or not > > > > > > > > On Tue, Dec 20, 2016 at 6:20 PM, Andrei Popov > wrote: > > @Brian: > > =C3=98 What's the risk or attack in a downgrade from what=E2=80=99s nego= tiated? > > For the sake of an extreme example, if my server is configured to accept > post-quantum NewHope6k key parameters, I don=E2=80=99t want to be downgra= ded to > rsa768_pkcs1.5. > > > Yeah, I know the gist of downgrade. I'm struggling to understand it in > this specific context of TB. Like who would do the downgrade between > negotiation and app messages. And how that might even be possible. And to > the benefit of whom. > > > > > > > --94eb2c04abb8cfd23805442f9bf1 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Fair enough. Thanks.
=
On Wed, Dec 21, 2016 at 11:21 AM, Andrei Pop= ov <Andrei.Popov@microsoft.com> wrote:

=C3=98=C2=A0 I'm struggling to understand it in this spe= cific context of TB. Like who would do the downgrade between negotiation an= d app messages. And how that might even be possible. And to the benefit of = whom.

A mismatch between the negotiated TB parameters and= those used in the TB message could occur as a result of implementation def= ects (we=E2=80=99ve already seen some of this). This is to the benefit of no one, but I think a server should detect this.<= u>

As for malicious downgrade, perhaps a client could = DOS an application server by sending TB messages signed using CPU-intensive= algorithms, even if the server is only configured to accept an efficient algorithm (assuming the server does not perform the= TB parameters check)?

=C2=A0

From: Brian Campbell [mailto:bcampbell@pin= gidentity.com]
Sent: Wednesday, December 21, 2016 7:23 AM
To: Andrei Popov <Andrei.Popov@microsoft.com>
Cc: Nick Harper <nharper@google.com>; IETF Tokbind WG <unbearable@ietf.org>
Subject: Re: [Unbearable] (late, sorry) WGLC question on establishin= g the binding or not

=C2=A0

=C2=A0

=C2=A0

On Tue, Dec 20, 2016 at 6:20 PM, Andrei Popov <Andrei.Popov@= microsoft.com> wrote:

@Brian:

=C3=98=C2=A0 What's the risk or attack in a downgrade from what=E2=80=99s negotiated= ?

For the sake of an extreme example, if my server is= configured to accept post-quantum NewHope6k key parameters, I don=E2=80=99t want to be downgraded to rsa768_pkcs1.5.


Yeah, I know the gist of downgrade. I'm struggling to understand it in = this specific context of TB. Like who would do the downgrade between negoti= ation and app messages. And how that might even be possible. And to the ben= efit of whom.

=C2=A0

=C2=A0

=C2=A0


--94eb2c04abb8cfd23805442f9bf1-- From nobody Wed Dec 21 11:19:05 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4D299126D74 for ; Wed, 21 Dec 2016 11:19:04 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=pingidentity.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jWw8h2153xjp for ; Wed, 21 Dec 2016 11:19:02 -0800 (PST) Received: from mail-it0-x22a.google.com (mail-it0-x22a.google.com [IPv6:2607:f8b0:4001:c0b::22a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4433E12956B for ; Wed, 21 Dec 2016 11:19:02 -0800 (PST) Received: by mail-it0-x22a.google.com with SMTP id 75so85827008ite.1 for ; Wed, 21 Dec 2016 11:19:02 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=pingidentity.com; s=gmail; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=rUgtOB8Rn9XyQqDd+WEXhG6USYaqsanIj5nmtNWTQjM=; b=UGhmkbGcm1pRdGbfAVFVS9IKbJ/bJHR6MwrwiBTCJlfNYhjIJ+rfUKVmLs4IBP7e8s f5TRcK3+W5PxVSvq4S1rNDcNdqTcOZaEi8Wk2Ad9LNHgUX+GY1tPmoXV4eayu/Q+O+Td kg9gTmKezEIKh8zQsLiBIs5Eu4V4frUO03RvM= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=rUgtOB8Rn9XyQqDd+WEXhG6USYaqsanIj5nmtNWTQjM=; b=Lb7+ePwVYphTB42p4w02cqMZAH5PRShAOjhH4iYQdKnpbemJ8Rt3vACIKwrcsx2Xub 5s61opBlET1YPaZHc+vgW88QSDLI3syoe40m9rFHj7efkWRtv4ziQ1T1mH2DlvgMdVKs /iT+n7Sy+MwFifEDxkdd9h0C2NIPaIrUz8jTgq9OMv/exk6RlLXNLPqXFTkDaNoWTiyX jTsIpqT/GUAabpQQrjPKgqnd1IjUBczpx+XVXH4Gk2Vp74w3wcNhar0wxH/tUneUzi1+ CoKnsxs0JxVTT+xHs6tIHwH6sBPuqlSI3TWbRLiZJxClStbZiMo2ncel0bl0hd92g7o3 feQw== X-Gm-Message-State: AIkVDXJA4+t9SviGqu3RVYDHHObxiBiUDWdqR5DmwU/9ra/TM7BGH5/Bte9snm5RBUeiWAXG+olT7IpLDphnewMg X-Received: by 10.36.148.84 with SMTP id j81mr7136245ite.35.1482347941478; Wed, 21 Dec 2016 11:19:01 -0800 (PST) MIME-Version: 1.0 Received: by 10.79.31.5 with HTTP; Wed, 21 Dec 2016 11:18:31 -0800 (PST) In-Reply-To: References: From: Brian Campbell Date: Wed, 21 Dec 2016 12:18:31 -0700 Message-ID: To: Andrei Popov Content-Type: multipart/alternative; boundary=94eb2c0ef0e27c7a520544300662 Archived-At: Cc: IETF Tokbind WG , Nick Harper Subject: Re: [Unbearable] (late, sorry) WGLC question on establishing the binding or not X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Dec 2016 19:19:04 -0000 --94eb2c0ef0e27c7a520544300662 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable On Tue, Dec 20, 2016 at 7:13 PM, Andrei Popov wrote: > What if instead we say in HTTPSTB that if the server is configured to > require TB, then this server MUST reject HTTP requests lacking TB headers= ? > I think that's implied. It might be some time before straight requiring TB is viable but that's a deployment/policy decision and of course such a deployment would reject HTTP requests w/ out TB headers. The situation at hand is a more general server that will accept both TB and non-TB but when the client and server both negotiate the same TB version and then the client doesn't send the TB message. Looking at the drafts a bit more again I see that TBNEGO =C2=A74 has: If the "token_binding" extension is included in the server hello and the client supports the Token Binding protocol version selected by the server, it means that the version and key parameters have been negotiated between the client and the server and SHALL be definitive for the TLS connection. While HTTPSTB =C2=A72 has: Once a client and server have negotiated the Token Binding Protocol with HTTP/1.1 or HTTP/2 (see [I-D.ietf-tokbind-protocol] and [I-D.ietf-tokbind-negotiation]), clients MUST include the Sec-Token- Binding header field in their HTTP requests. Taken together I think that could be read to say that an HTTP client that offers TB 1.0 in the client hello and gets TB 1.0 in the server hello but doesn't send the TB message with HTTP requests is not complying with the spec and a server could reasonably choose to reject such requests. Does that seem legit? I suppose more text could be added or clarified but maybe it's good enough as is. --94eb2c0ef0e27c7a520544300662 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable


On Tue, Dec 20, 2016 at 7:13 PM, Andrei Popov <Andrei.Popov@m= icrosoft.com> wrote:

What if instead we say in HTTPSTB that if the server = is configured to require TB, then this server MUST reject HTTP requests lac= king TB headers?


I t= hink that's implied. It might be some time before straight requiring TB= is viable but that's a deployment/policy decision and of course such a= deployment would reject HTTP requests w/ out TB headers.

The situation at hand is a more general server that will accept both TB a= nd non-TB but when the client and server both negotiate the same TB version= and then the client doesn't send the TB message. Looking at the drafts= a bit more again I see that TBNEGO =C2=A74 has:

=C2=A0= =C2=A0 If the "token_binding" extension is included in the server= hello and
=C2=A0=C2=A0 the client supports the Token Binding protocol v= ersion selected by
=C2=A0=C2=A0 the server, it means that the version an= d key parameters have been
=C2=A0=C2=A0 negotiated between the client an= d the server and SHALL be definitive
=C2=A0=C2=A0 for the TLS connection= .

While HTTPSTB =C2=A72 has:

=C2=A0=C2=A0 O= nce a client and server have negotiated the Token Binding Protocol
=C2= =A0=C2=A0 with HTTP/1.1 or HTTP/2 (see [I-D.ietf-tokbind-protocol] and
= =C2=A0=C2=A0 [I-D.ietf-tokbind-negotiation]), clients MUST include the Sec-= Token-
=C2=A0=C2=A0 Binding header field in their HTTP requests.
Taken together I think that could be read to say that an HTTP c= lient that offers TB 1.0 in the client hello and gets TB 1.0 in the server = hello but doesn't send the TB message with HTTP requests is not complyi= ng with the spec and a server could reasonably choose to reject such reques= ts.

Does that seem legit?

I= suppose more text could be added or clarified but maybe it's good enou= gh as is.


=C2=A0

--94eb2c0ef0e27c7a520544300662-- From nobody Wed Dec 21 11:55:32 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4DEA11295B3 for ; Wed, 21 Dec 2016 11:55:31 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.021 X-Spam-Level: X-Spam-Status: No, score=-2.021 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qLNrslrdJ3w6 for ; Wed, 21 Dec 2016 11:55:29 -0800 (PST) Received: from NAM03-BY2-obe.outbound.protection.outlook.com (mail-by2nam03on0125.outbound.protection.outlook.com [104.47.42.125]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 29E8C129500 for ; Wed, 21 Dec 2016 11:55:28 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=0zI4b7eN1pThg5lytmEMPRWD3/eab2bMSRh7PPnyuoI=; b=efVzlVkUPMRTrabPRS1EZQmNvpA4rqLpVRHkLTY0W8tKzXxFb/fmVTFgE/XwHs2NMTYP6ubd1h5/N9dQsicTPAqL5buMELuYZsa0R3KsCzOc4ydw4GN2/lj3i8S6Wu3tx7TbVqqycqbtycmUwsd1ndT2QAoSaoaiLGsNSrxSKAw= Received: from CY1PR0301MB0842.namprd03.prod.outlook.com (10.160.163.148) by CY1PR0301MB0843.namprd03.prod.outlook.com (10.160.163.149) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.789.14; Wed, 21 Dec 2016 19:55:27 +0000 Received: from CY1PR0301MB0842.namprd03.prod.outlook.com ([10.160.163.148]) by CY1PR0301MB0842.namprd03.prod.outlook.com ([10.160.163.148]) with mapi id 15.01.0789.018; Wed, 21 Dec 2016 19:55:27 +0000 From: Andrei Popov To: Brian Campbell Thread-Topic: [Unbearable] (late, sorry) WGLC question on establishing the binding or not Thread-Index: AQHSWvrivRNalV6Ld0i/cnyaQrT2PaERQomAgAABJTCAACXGgIAAJbGggAAS14CAAACIAIAABXOAgAAARkCAAR/VgIAAAc/g Date: Wed, 21 Dec 2016 19:55:27 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Andrei.Popov@microsoft.com; x-originating-ip: [2001:4898:80e8:7::1d2] x-ms-office365-filtering-correlation-id: e205d38e-b187-41a0-b9d8-08d429db4fb8 x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001); SRVR:CY1PR0301MB0843; x-microsoft-exchange-diagnostics: 1; CY1PR0301MB0843; 7:PgwBx2W5lgJ2ibjKoaVZDUUt+Jdi4r86FYrSklMsRiQJmm6Iunfr0xrshQEMy6HGbDpxINiMkCHsSMsVzO3a47IAHwXkDL12zpVxEpo2JuyJ5RuPOyi6h/yz9Uo5+ZMV8y2WhZnilLqYWegoUeOSVe7V2C5hjpEBouahOci9kYt72e49GL2S4XtZMOIEuJNuVJo8g+GRZFww+bKkuluy3vlnIwEfyt1nhe4kyuhu+apFQwMO+MrvH35teh6sUQwGJu4RD77cyHI3rh3VWj5ZY4Pfqerlge0kp9Zqs4Be0UMI9ansUsk5meKfuGKy8PV+jv9w0ONkkG7LZH4qihZooqXCAJwcutRsJMnJPN9zcJkB7EkEgEHZwJY4el/TygzaYU1OwAUs2QUffhIpo6EIHcd0VIorm1ElIsrdzl5d90T7U4sMCkgly4/ph0yq0dKTm3eqiZJs5FKwFGu3FiqbFfa/eEBC7qVfZ8x3VQNSzRY= x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(158342451672863)(21748063052155); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040375)(601004)(2401047)(8121501046)(5005006)(3002001)(10201501046)(6055026)(61426038)(61427038)(6041248)(20161123555025)(20161123560025)(20161123564025)(20161123562025)(6072148)(6047074); SRVR:CY1PR0301MB0843; BCL:0; PCL:0; RULEID:; SRVR:CY1PR0301MB0843; x-forefront-prvs: 01630974C0 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(7916002)(39850400002)(39410400002)(39840400002)(39450400003)(39860400002)(199003)(51444003)(189002)(105586002)(606005)(6436002)(2906002)(8990500004)(99286002)(33656002)(68736007)(101416001)(790700001)(25786008)(189998001)(106356001)(106116001)(6116002)(86612001)(76576001)(9686002)(93886004)(6916009)(97736004)(102836003)(5660300001)(4326007)(122556002)(86362001)(2950100002)(7696004)(6506006)(10290500002)(2900100001)(74316002)(38730400001)(92566002)(7736002)(81166006)(110136003)(8676002)(3660700001)(10090500001)(81156014)(8936002)(3280700002)(19609705001)(229853002)(50986999)(54356999)(5005710100001)(77096006)(76176999)(7906003); DIR:OUT; SFP:1102; SCL:1; SRVR:CY1PR0301MB0843; H:CY1PR0301MB0842.namprd03.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; A:1; MX:1; LANG:en; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_CY1PR0301MB08425CEBE0923C0A8A1B00878C930CY1PR0301MB0842_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 21 Dec 2016 19:55:27.5124 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY1PR0301MB0843 Archived-At: Cc: IETF Tokbind WG , Nick Harper Subject: Re: [Unbearable] (late, sorry) WGLC question on establishing the binding or not X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Dec 2016 19:55:31 -0000 --_000_CY1PR0301MB08425CEBE0923C0A8A1B00878C930CY1PR0301MB0842_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 DQoNCsOYICBXaGF0IGlmIGluc3RlYWQgd2Ugc2F5IGluIEhUVFBTVEIgdGhhdCBpZiB0aGUgc2Vy dmVyIGlzIGNvbmZpZ3VyZWQgdG8gcmVxdWlyZSBUQiwgdGhlbiB0aGlzIHNlcnZlciBNVVNUIHJl amVjdCBIVFRQIHJlcXVlc3RzIGxhY2tpbmcgVEIgaGVhZGVycz8NCg0Kw5ggIEkgdGhpbmsgdGhh dCdzIGltcGxpZWQuIEl0IG1pZ2h0IGJlIHNvbWUgdGltZSBiZWZvcmUgc3RyYWlnaHQgcmVxdWly aW5nIFRCIGlzIHZpYWJsZSBidXQgdGhhdCdzIGEgZGVwbG95bWVudC9wb2xpY3kgZGVjaXNpb24g YW5kIG9mIGNvdXJzZSBzdWNoIGEgZGVwbG95bWVudCB3b3VsZCByZWplY3QgSFRUUCByZXF1ZXN0 cyB3LyBvdXQgVEIgaGVhZGVycy4NCkkgYWxzbyB0aGluayB0aGF0IGl0IGlzIGltcGxpZWQsIGJ1 dCBJIGRvbuKAmXQgbWluZCBtYWtpbmcgdGhpcyBleHBsaWNpdCBpbiBIVFRQU1RCLCBpZiBmb2xr cyB0aGluayBpdCB3b3VsZCBiZSBtb3JlIGNsZWFyLg0KDQoNCsOYICBUYWtlbiB0b2dldGhlciBJ IHRoaW5rIHRoYXQgY291bGQgYmUgcmVhZCB0byBzYXkgdGhhdCBhbiBIVFRQIGNsaWVudCB0aGF0 IG9mZmVycyBUQiAxLjAgaW4gdGhlIGNsaWVudCBoZWxsbyBhbmQgZ2V0cyBUQiAxLjAgaW4gdGhl IHNlcnZlciBoZWxsbyBidXQgZG9lc24ndCBzZW5kIHRoZSBUQiBtZXNzYWdlIHdpdGggSFRUUCBy ZXF1ZXN0cyBpcyBub3QgY29tcGx5aW5nIHdpdGggdGhlIHNwZWMgYW5kIGEgc2VydmVyIGNvdWxk IHJlYXNvbmFibHkgY2hvb3NlIHRvIHJlamVjdCBzdWNoIHJlcXVlc3RzLg0KDQrDmA0KDQrDmCAg RG9lcyB0aGF0IHNlZW0gbGVnaXQ/DQpZZXMsIHRoaXMgbWFrZXMgc2Vuc2UuIElmIG15IFRCIGNs aWVudCBpbXBsZW1lbnRhdGlvbiBmYWlsZWQgdG8gc2VuZCBUQiBtZXNzYWdlcyB3aGVuIFRCIGlz IG5lZ290aWF0ZWQsIEnigJlkIHRyZWF0IGl0IGFzIGEgYnVnIChwZXIgVEJORUdPIMKnNDxodHRw czovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQtaWV0Zi10b2tiaW5kLW5lZ290aWF0aW9uLTA2 I3NlY3Rpb24tND4pIGFuZCBnZXQgaXQgZml4ZWQuDQpJIHRoaW5rIGl0IGlzIG5vdCBpbXBvcnRh bnQgdG8gcmVxdWlyZSB0aGF0IHRoZSBzZXJ2ZXIgZW5mb3JjZSB0aGlzLCBpZiB0aGUgc2VydmVy IGlzIGNvbmZpZ3VyZWQgdG8gYWNjZXB0IG5vbi1UQiByZXF1ZXN0cy4NCg0KVGhlIGltcG9ydGFu dCB0aGluZyBpcyB0aGF0IHdoZW4gYW4gSFRUUFMgc2VydmVyIHJlcXVpcmVzIFRCLCBpdCBNVVNU IGZhaWwgcmVxdWVzdHMgdGhhdCBsYWNrIFRCIG1lc3NhZ2VzLiBJIHRoaW5rIGl0IGFscmVhZHkg Zm9sbG93cyBmcm9tIHRoZSBzcGVjcywgYnV0IGRvbuKAmXQgbWluZCBzdGF0aW5nIGV4cGxpY2l0 bHkuDQo= --_000_CY1PR0301MB08425CEBE0923C0A8A1B00878C930CY1PR0301MB0842_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 V2luZ2RpbmdzOw0KCXBhbm9zZS0xOjUgMCAwIDAgMCAwIDAgMCAwIDA7fQ0KQGZvbnQtZmFjZQ0K CXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2IDMg MiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1 IDUgMiAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWws IGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0 b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcg Um9tYW4iLHNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXBy aW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQph OnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5 Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnAuTXNv TGlzdFBhcmFncmFwaCwgbGkuTXNvTGlzdFBhcmFncmFwaCwgZGl2Lk1zb0xpc3RQYXJhZ3JhcGgN Cgl7bXNvLXN0eWxlLXByaW9yaXR5OjM0Ow0KCW1hcmdpbi10b3A6MGluOw0KCW1hcmdpbi1yaWdo dDowaW47DQoJbWFyZ2luLWJvdHRvbTowaW47DQoJbWFyZ2luLWxlZnQ6LjVpbjsNCgltYXJnaW4t Ym90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGltZXMg TmV3IFJvbWFuIixzZXJpZjt9DQpwLm1zb25vcm1hbDAsIGxpLm1zb25vcm1hbDAsIGRpdi5tc29u b3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCgltc28tbWFyZ2luLXRvcC1hbHQ6 YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0K CW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1l cyBOZXcgUm9tYW4iLHNlcmlmO30NCnNwYW4uRW1haWxTdHlsZTE4DQoJe21zby1zdHlsZS10eXBl OnBlcnNvbmFsOw0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOndp bmRvd3RleHQ7fQ0Kc3Bhbi5FbWFpbFN0eWxlMjANCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwt Y29tcG9zZTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjp3aW5k b3d0ZXh0O30NCi5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5O30N CkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjguNWluIDExLjBpbjsNCgltYXJnaW46MS4waW4g MS4waW4gMS4waW4gMS4waW47fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9u MTt9DQovKiBMaXN0IERlZmluaXRpb25zICovDQpAbGlzdCBsMA0KCXttc28tbGlzdC1pZDo4Njg1 NjQ5OTg7DQoJbXNvLWxpc3QtdHlwZTpoeWJyaWQ7DQoJbXNvLWxpc3QtdGVtcGxhdGUtaWRzOjE3 MjMxMDI0MDIgLTczMDk3NzUwMCA2NzY5ODY5MSA2NzY5ODY5MyA2NzY5ODY4OSA2NzY5ODY5MSA2 NzY5ODY5MyA2NzY5ODY4OSA2NzY5ODY5MSA2NzY5ODY5Mzt9DQpAbGlzdCBsMDpsZXZlbDENCgl7 bXNvLWxldmVsLXN0YXJ0LWF0OjA7DQoJbXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0K CW1zby1sZXZlbC10ZXh0Ou+DmDsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2 ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFt aWx5OldpbmdkaW5nczsNCgltc28tZmFyZWFzdC1mb250LWZhbWlseTpDYWxpYnJpOw0KCW1zby1i aWRpLWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iO30NCkBsaXN0IGwwOmxldmVsMg0KCXtt c28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6bzsNCgltc28t bGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJ dGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyI7fQ0KQGxpc3Qg bDA6bGV2ZWwzDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwt dGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1w b3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseTpXaW5nZGlu Z3M7fQ0KQGxpc3QgbDA6bGV2ZWw0DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsN Cgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxl dmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZh bWlseTpTeW1ib2w7fQ0KQGxpc3QgbDA6bGV2ZWw1DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0 OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDpvOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0K CW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJ Zm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3Ijt9DQpAbGlzdCBsMDpsZXZlbDYNCgl7bXNvLWxldmVs LW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwt dGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1p bmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMDpsZXZlbDcN Cgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsN Cgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxl ZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBs MDpsZXZlbDgNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10 ZXh0Om87DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3Np dGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseToiQ291cmllciBO ZXciO30NCkBsaXN0IGwwOmxldmVsOQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7 DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1s ZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1m YW1pbHk6V2luZ2RpbmdzO30NCm9sDQoJe21hcmdpbi1ib3R0b206MGluO30NCnVsDQoJe21hcmdp bi1ib3R0b206MGluO30NCi0tPjwvc3R5bGU+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpz aGFwZWRlZmF1bHRzIHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2IiAvPg0KPC94bWw+PCFbZW5k aWZdLS0+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWxheW91dCB2OmV4dD0iZWRp dCI+DQo8bzppZG1hcCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4NCjwvbzpzaGFwZWxheW91dD48 L3htbD48IVtlbmRpZl0tLT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9IkVOLVVTIiBsaW5rPSJibHVl IiB2bGluaz0icHVycGxlIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29MaXN0UGFyYWdy YXBoIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0 OmF1dG87dGV4dC1pbmRlbnQ6LS4yNWluO21zby1saXN0OmwwIGxldmVsMSBsZm8xIj4NCjwhW2lm ICFzdXBwb3J0TGlzdHNdPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpXaW5nZGluZ3MiPjxzcGFu IHN0eWxlPSJtc28tbGlzdDpJZ25vcmUiPsOYPHNwYW4gc3R5bGU9ImZvbnQ6Ny4wcHQgJnF1b3Q7 VGltZXMgTmV3IFJvbWFuJnF1b3Q7Ij4mbmJzcDsNCjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwhW2Vu ZGlmXT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxp YnJpJnF1b3Q7LHNhbnMtc2VyaWYiPldoYXQgaWYgaW5zdGVhZCB3ZSBzYXkgaW4gSFRUUFNUQiB0 aGF0IGlmIHRoZSBzZXJ2ZXIgaXMgY29uZmlndXJlZCB0byByZXF1aXJlIFRCLCB0aGVuIHRoaXMg c2VydmVyIE1VU1QgcmVqZWN0IEhUVFAgcmVxdWVzdHMgbGFja2luZyBUQiBoZWFkZXJzPzwvc3Bh bj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBoIiBzdHlsZT0idGV4 dC1pbmRlbnQ6LS4yNWluO21zby1saXN0OmwwIGxldmVsMSBsZm8xIj48IVtpZiAhc3VwcG9ydExp c3RzXT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpXaW5nZGluZ3Mi PjxzcGFuIHN0eWxlPSJtc28tbGlzdDpJZ25vcmUiPsOYPHNwYW4gc3R5bGU9ImZvbnQ6Ny4wcHQg JnF1b3Q7VGltZXMgTmV3IFJvbWFuJnF1b3Q7Ij4mbmJzcDsNCjwvc3Bhbj48L3NwYW4+PC9zcGFu PjwhW2VuZGlmXT5JIHRoaW5rIHRoYXQncyBpbXBsaWVkLiBJdCBtaWdodCBiZSBzb21lIHRpbWUg YmVmb3JlIHN0cmFpZ2h0IHJlcXVpcmluZyBUQiBpcyB2aWFibGUgYnV0IHRoYXQncyBhIGRlcGxv eW1lbnQvcG9saWN5IGRlY2lzaW9uIGFuZCBvZiBjb3Vyc2Ugc3VjaCBhIGRlcGxveW1lbnQgd291 bGQgcmVqZWN0IEhUVFAgcmVxdWVzdHMgdy8gb3V0IFRCIGhlYWRlcnMuPHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlm Ij48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMt c2VyaWYiPkkgYWxzbyB0aGluayB0aGF0IGl0IGlzIGltcGxpZWQsIGJ1dCBJIGRvbuKAmXQgbWlu ZCBtYWtpbmcgdGhpcyBleHBsaWNpdCBpbiBIVFRQU1RCLCBpZiBmb2xrcyB0aGluayBpdCB3b3Vs ZCBiZSBtb3JlIGNsZWFyLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGli cmkmcXVvdDssc2Fucy1zZXJpZiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJ0ZXh0LWluZGVudDotLjI1aW47bXNvLWxpc3Q6 bDAgbGV2ZWwxIGxmbzEiPjwhW2lmICFzdXBwb3J0TGlzdHNdPjxzcGFuIHN0eWxlPSJmb250LWZh bWlseTpXaW5nZGluZ3MiPjxzcGFuIHN0eWxlPSJtc28tbGlzdDpJZ25vcmUiPsOYPHNwYW4gc3R5 bGU9ImZvbnQ6Ny4wcHQgJnF1b3Q7VGltZXMgTmV3IFJvbWFuJnF1b3Q7Ij4mbmJzcDsNCjwvc3Bh bj48L3NwYW4+PC9zcGFuPjwhW2VuZGlmXT5UYWtlbiB0b2dldGhlciBJIHRoaW5rIHRoYXQgY291 bGQgYmUgcmVhZCB0byBzYXkgdGhhdCBhbiBIVFRQIGNsaWVudCB0aGF0IG9mZmVycyBUQiAxLjAg aW4gdGhlIGNsaWVudCBoZWxsbyBhbmQgZ2V0cyBUQiAxLjAgaW4gdGhlIHNlcnZlciBoZWxsbyBi dXQgZG9lc24ndCBzZW5kIHRoZSBUQiBtZXNzYWdlIHdpdGggSFRUUCByZXF1ZXN0cyBpcyBub3Qg Y29tcGx5aW5nIHdpdGggdGhlIHNwZWMNCiBhbmQgYSBzZXJ2ZXIgY291bGQgcmVhc29uYWJseSBj aG9vc2UgdG8gcmVqZWN0IHN1Y2ggcmVxdWVzdHMuIDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJ0ZXh0LWluZGVudDotLjI1aW47bXNvLWxpc3Q6bDAg bGV2ZWwxIGxmbzEiPjwhW2lmICFzdXBwb3J0TGlzdHNdPjxzcGFuIHN0eWxlPSJmb250LWZhbWls eTpXaW5nZGluZ3MiPjxzcGFuIHN0eWxlPSJtc28tbGlzdDpJZ25vcmUiPsOYPHNwYW4gc3R5bGU9 ImZvbnQ6Ny4wcHQgJnF1b3Q7VGltZXMgTmV3IFJvbWFuJnF1b3Q7Ij4mbmJzcDsNCjwvc3Bhbj48 L3NwYW4+PC9zcGFuPjwhW2VuZGlmXT48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJN c29MaXN0UGFyYWdyYXBoIiBzdHlsZT0ibWFyZ2luLWJvdHRvbToxMi4wcHQ7dGV4dC1pbmRlbnQ6 LS4yNWluO21zby1saXN0OmwwIGxldmVsMSBsZm8xIj4NCjwhW2lmICFzdXBwb3J0TGlzdHNdPjxz cGFuIHN0eWxlPSJmb250LWZhbWlseTpXaW5nZGluZ3MiPjxzcGFuIHN0eWxlPSJtc28tbGlzdDpJ Z25vcmUiPsOYPHNwYW4gc3R5bGU9ImZvbnQ6Ny4wcHQgJnF1b3Q7VGltZXMgTmV3IFJvbWFuJnF1 b3Q7Ij4mbmJzcDsNCjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwhW2VuZGlmXT5Eb2VzIHRoYXQgc2Vl bSBsZWdpdD88bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1z ZXJpZiI+WWVzLCB0aGlzIG1ha2VzIHNlbnNlLiBJZiBteSBUQiBjbGllbnQgaW1wbGVtZW50YXRp b24gZmFpbGVkIHRvIHNlbmQgVEIgbWVzc2FnZXMgd2hlbiBUQiBpcyBuZWdvdGlhdGVkLCBJ4oCZ ZCB0cmVhdCBpdCBhcyBhIGJ1ZyAocGVyDQo8YSBocmVmPSJodHRwczovL3Rvb2xzLmlldGYub3Jn L2h0bWwvZHJhZnQtaWV0Zi10b2tiaW5kLW5lZ290aWF0aW9uLTA2I3NlY3Rpb24tNCI+DQpUQk5F R08gwqc0PC9hPikgYW5kIGdldCBpdCBmaXhlZC4gPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5JIHRoaW5rIGl0IGlzIG5vdCBpbXBv cnRhbnQgdG8gcmVxdWlyZSB0aGF0IHRoZSBzZXJ2ZXIgZW5mb3JjZSB0aGlzLCBpZiB0aGUgc2Vy dmVyIGlzIGNvbmZpZ3VyZWQgdG8gYWNjZXB0IG5vbi1UQiByZXF1ZXN0cy4NCjxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+PG86cD4m bmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmIj5UaGUgaW1wb3J0YW50IHRoaW5nIGlzIHRoYXQgd2hlbiBhbiBIVFRQUyBzZXJ2ZXIgcmVx dWlyZXMgVEIsIGl0IE1VU1QgZmFpbCByZXF1ZXN0cyB0aGF0IGxhY2sgVEIgbWVzc2FnZXMuIEkg dGhpbmsgaXQgYWxyZWFkeSBmb2xsb3dzIGZyb20gdGhlIHNwZWNzLCBidXQgZG9u4oCZdCBtaW5k IHN0YXRpbmcNCiBleHBsaWNpdGx5LjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9i b2R5Pg0KPC9odG1sPg0K --_000_CY1PR0301MB08425CEBE0923C0A8A1B00878C930CY1PR0301MB0842_-- From nobody Wed Dec 21 12:36:10 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5C9AF1295A1 for ; Wed, 21 Dec 2016 12:36:09 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.1 X-Spam-Level: X-Spam-Status: No, score=-5.1 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RP_MATCHES_RCVD=-3.1, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PQlmreNs-sAQ for ; Wed, 21 Dec 2016 12:36:08 -0800 (PST) Received: from mail-qt0-x229.google.com (mail-qt0-x229.google.com [IPv6:2607:f8b0:400d:c0d::229]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 58E8E12965D for ; Wed, 21 Dec 2016 12:26:18 -0800 (PST) Received: by mail-qt0-x229.google.com with SMTP id p16so214279822qta.0 for ; Wed, 21 Dec 2016 12:26:18 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=YZZlbGtm/kxk4U/HVlRUIibbnTfk4blulrEJqFqOLdc=; b=TdBzR7Ha1DQ3b47fc1Wt+rVpf5gzR0MDf0Qj4AAO8SG3H8519ejUTopmbRBtTMemAr mAhG9fWpBohZk9Es5UDmE9D6N0Br0hNphUk8J2RdnSCK2o+OdYea+d0tYWEASLAVAgAi g1k96/mtsuufkUxe/LFAo6Ffx+iRutE7e2TrMPcjiswNgiy0JGLkFOborOdstR9XzbK+ Nx8c2AMWOvK1jlCh2UJLDhWpRtK1zCGjv3G87jV4pY92XDLWUIvR4WSMmsUwiny9wT0U v3nCO7Ug5Cc0/QEfsV1wg0Xr5iHMNIKUeJMeN0HYCEpCY0kq8clPiAR0d1/XkZy4JKZS wi9A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=YZZlbGtm/kxk4U/HVlRUIibbnTfk4blulrEJqFqOLdc=; b=FV5Hmiq+kkk7yjbDl54wxHFwCILGqgvLSriMOagMeZfOgMmUUFL4iXXUh8+R9pcYhA Gf2vCzdE6yAtb+81M7qj78nM0SYX/IO6ey6sqfNTz1MGwl8rPh0QAjOq/gCWtpPhuGzI taYl/qPzYY/RNVtVy8G2rKP93UEYMMXLsm6I7bRD6DytLB7wndqWfhJlvNuz85r6Uxrp p6rtg1p8pFdgKQbmAQ8a2kw6G3OG92AK6174jJUOqfRE7VkQOJ86aegyKcBuINbSOCpr vZBq3eA/LmxApBg1ef1h8LsJYRZTXLTlkT9t/bQ55LRP9mYHqalXhdenU6TQOdXKHi09 HDrg== X-Gm-Message-State: AIkVDXIM7q9zuzPdpU/e0swt/Qyu+SVmKhoXomynTHRK20avYLdn4aK3UJUd9rORTUwZZtsz1hpvwLHzqS1A1CVy X-Received: by 10.237.39.37 with SMTP id n34mr6593334qtd.128.1482351977313; Wed, 21 Dec 2016 12:26:17 -0800 (PST) MIME-Version: 1.0 Received: by 10.140.17.52 with HTTP; Wed, 21 Dec 2016 12:25:56 -0800 (PST) In-Reply-To: References: From: Nick Harper Date: Wed, 21 Dec 2016 12:25:56 -0800 Message-ID: To: Andrei Popov Content-Type: multipart/alternative; boundary=94eb2c06c9d40a88a2054430f7b2 Archived-At: Cc: IETF Tokbind WG , Brian Campbell Subject: Re: [Unbearable] (late, sorry) WGLC question on establishing the binding or not X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Dec 2016 20:36:09 -0000 --94eb2c06c9d40a88a2054430f7b2 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable On Wed, Dec 21, 2016 at 11:55 AM, Andrei Popov wrote: > > > =C3=98 What if instead we say in HTTPSTB that if the server is configure= d to > require TB, then this server MUST reject HTTP requests lacking TB headers= ? > > =C3=98 I think that's implied. It might be some time before straight > requiring TB is viable but that's a deployment/policy decision and of > course such a deployment would reject HTTP requests w/ out TB headers. > > I also think that it is implied, but I don=E2=80=99t mind making this exp= licit in > HTTPSTB, if folks think it would be more clear. > > > > =C3=98 Taken together I think that could be read to say that an HTTP cli= ent > that offers TB 1.0 in the client hello and gets TB 1.0 in the server hell= o > but doesn't send the TB message with HTTP requests is not complying with > the spec and a server could reasonably choose to reject such requests. > > =C3=98 > > =C3=98 Does that seem legit? > > Yes, this makes sense. If my TB client implementation failed to send TB > messages when TB is negotiated, I=E2=80=99d treat it as a bug (per TBNEGO= =C2=A74 > = ) > and get it fixed. > > I think it is not important to require that the server enforce this, if > the server is configured to accept non-TB requests. > I agree with Brian on this point - we don't need any more language in the spec to say that if the versions match, then the client and server definitively know that TB was negotiated. > > > The important thing is that when an HTTPS server requires TB, it MUST fai= l > requests that lack TB messages. I think it already follows from the specs= , > but don=E2=80=99t mind stating explicitly. > I also think this follows, and I don't have a preference one way or another about adding more language to state that explicitly. --94eb2c06c9d40a88a2054430f7b2 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable


On Wed, Dec 21, 2016 at 11:55 AM, Andrei Popov <Andrei.Popov@= microsoft.com> wrote:

=C2=A0

=C3=98=C2=A0 What if instead we say in HTTPSTB that if the = server is configured to require TB, then this server MUST reject HTTP reque= sts lacking TB headers?

=C3=98=C2=A0 I think that's implied. It might be some ti= me before straight requiring TB is viable but that's a deployment/polic= y decision and of course such a deployment would reject HTTP requests w/ ou= t TB headers.

I also think that it is implied, but I don=E2=80=99= t mind making this explicit in HTTPSTB, if folks think it would be more cle= ar.

=C2=A0

=C3=98=C2=A0 Taken together I think that could be read to sa= y that an HTTP client that offers TB 1.0 in the client hello and gets TB 1.= 0 in the server hello but doesn't send the TB message with HTTP request= s is not complying with the spec and a server could reasonably choose to reject such requests.

=C3=98=C2=A0 =C2=A0

=C3=98=C2=A0 Does that seem legit?

Yes, this makes sense. If my TB client implementati= on failed to send TB messages when TB is negotiated, I=E2=80=99d treat it a= s a bug (per TBNEGO =C2=A74) and get it fixed.

I think it is not important to require that the ser= ver enforce this, if the server is configured to accept non-TB requests.


I agree with Brian on = this point - we don't need any more language in the spec to say that if= the versions match, then the client and server definitively know that TB w= as negotiated.=C2=A0

=C2=A0

The important thing is that when an HTTPS server re= quires TB, it MUST fail requests that lack TB messages. I think it already = follows from the specs, but don=E2=80=99t mind stating explicitly.


I also = think this follows, and I don't have a preference one way or another ab= out adding more language to state that explicitly.=C2=A0

--94eb2c06c9d40a88a2054430f7b2-- From nobody Wed Dec 21 12:41:43 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 336D91295ED for ; Wed, 21 Dec 2016 12:41:42 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=pingidentity.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EVyOC506jYfE for ; Wed, 21 Dec 2016 12:41:40 -0800 (PST) Received: from mail-it0-x236.google.com (mail-it0-x236.google.com [IPv6:2607:f8b0:4001:c0b::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0AD101295E7 for ; Wed, 21 Dec 2016 12:41:39 -0800 (PST) Received: by mail-it0-x236.google.com with SMTP id c20so110418167itb.0 for ; Wed, 21 Dec 2016 12:41:38 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=pingidentity.com; s=gmail; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=q8trG95kYL3ra3KPXjT4w82UON+gyHZjEl0pb2Po4Zw=; b=eYVJlgqj/GSWzjArj61jf+XSrnHjBeTTKvKH4PIHpTNsqwRVeBYFtlcBqdZWprOTRQ W54WF8cJUD+yhwnQIxjA4eWzaOlDQ9eB9LDjpxdvIVLqcGC/KZW9AqxdhS9wVmM1ymlM bKVJp2Rt3dyfnKEpLJsd1YpmID0PrbpgPbrmA= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=q8trG95kYL3ra3KPXjT4w82UON+gyHZjEl0pb2Po4Zw=; b=CPjFMuyB6FHR4bGNVU6+LlLG4Fwu6BSTlNKSS/PntcJ5lgSNbbM/iwCpv4jaayycwU yv3Umc6w3rtvSl0rAILXyudDfdCZ0smVO4yzZBoiJBNBRW85QrBPtOgFeq1q7T3fRojx VS4LMlDrqASFNak0BvtarR6TfpVO9oiSqzwfxBgS04N9oYLSVGlMq6V+0paAiZXX+Tmz w9dAA594UFMYcTUa5Iv/FWET3CT3vTFDUoeb8pUM/UQeqlN+IYo0cbrUvOLEcmuInM55 kgfuKjivRuVt+G+JCQhlS8nDEIa1S7SIDQ13dCe2ZeiJyWiGgNp/C/KJTKEnWSRcQpF/ Qmgw== X-Gm-Message-State: AIkVDXJbyTnkQDvS9rNeiaw6borsrhaGJRNirU4x079UM/U7ds2dzQben0W7ghWxh8lgtg3TX5LrDydfUbgVwHr2 X-Received: by 10.36.57.75 with SMTP id l72mr9825494ita.11.1482352898223; Wed, 21 Dec 2016 12:41:38 -0800 (PST) MIME-Version: 1.0 Received: by 10.79.31.5 with HTTP; Wed, 21 Dec 2016 12:41:07 -0800 (PST) In-Reply-To: References: From: Brian Campbell Date: Wed, 21 Dec 2016 13:41:07 -0700 Message-ID: To: Nick Harper Content-Type: multipart/alternative; boundary=001a114a9a30ee4c550544312d72 Archived-At: Cc: Andrei Popov , IETF Tokbind WG Subject: Re: [Unbearable] (late, sorry) WGLC question on establishing the binding or not X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Dec 2016 20:41:42 -0000 --001a114a9a30ee4c550544312d72 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable As the one who started the thread I've come around to thinking that no additional language is needed. For whatever that's worth. Thanks for discussing it though. On Wed, Dec 21, 2016 at 1:25 PM, Nick Harper wrote: > > > On Wed, Dec 21, 2016 at 11:55 AM, Andrei Popov > wrote: > >> >> >> =C3=98 What if instead we say in HTTPSTB that if the server is configur= ed to >> require TB, then this server MUST reject HTTP requests lacking TB header= s? >> >> =C3=98 I think that's implied. It might be some time before straight >> requiring TB is viable but that's a deployment/policy decision and of >> course such a deployment would reject HTTP requests w/ out TB headers. >> >> I also think that it is implied, but I don=E2=80=99t mind making this ex= plicit in >> HTTPSTB, if folks think it would be more clear. >> >> >> >> =C3=98 Taken together I think that could be read to say that an HTTP cl= ient >> that offers TB 1.0 in the client hello and gets TB 1.0 in the server hel= lo >> but doesn't send the TB message with HTTP requests is not complying with >> the spec and a server could reasonably choose to reject such requests. >> >> =C3=98 >> >> =C3=98 Does that seem legit? >> >> Yes, this makes sense. If my TB client implementation failed to send TB >> messages when TB is negotiated, I=E2=80=99d treat it as a bug (per TBNEG= O =C2=A74 >> ) >> and get it fixed. >> >> I think it is not important to require that the server enforce this, if >> the server is configured to accept non-TB requests. >> > > I agree with Brian on this point - we don't need any more language in the > spec to say that if the versions match, then the client and server > definitively know that TB was negotiated. > >> >> >> The important thing is that when an HTTPS server requires TB, it MUST >> fail requests that lack TB messages. I think it already follows from the >> specs, but don=E2=80=99t mind stating explicitly. >> > > I also think this follows, and I don't have a preference one way or > another about adding more language to state that explicitly. > > --001a114a9a30ee4c550544312d72 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
As the one who started the thread I've come aroun= d to thinking that no additional language is needed. For whatever that'= s worth. Thanks for discussing it though.=C2=A0

On Wed, Dec 21, 2016 at 1:2= 5 PM, Nick Harper <nharper@google.com> wrote:


On Wed, Dec 21, 2016 at 11:55 AM,= Andrei Popov <Andrei.Popov@microsoft.com> wrote:

=C2=A0

=C3=98=C2=A0 What if instead we say in HTTPSTB that if the = server is configured to require TB, then this server MUST reject HTTP reque= sts lacking TB headers?

= =C3=98=C2=A0 I think that's implied. It might be some ti= me before straight requiring TB is viable but that's a deployment/polic= y decision and of course such a deployment would reject HTTP requests w/ ou= t TB headers.

I also think that it is implied, but I don=E2=80=99= t mind making this explicit in HTTPSTB, if folks think it would be more cle= ar.

=C2=A0

= =C3=98=C2=A0 Taken together I think that could be read to sa= y that an HTTP client that offers TB 1.0 in the client hello and gets TB 1.= 0 in the server hello but doesn't send the TB message with HTTP request= s is not complying with the spec and a server could reasonably choose to reject such requests.

= =C3=98=C2=A0 =C2=A0

=C3=98=C2=A0 Does that seem legit?

Yes, this makes sense. If my TB client implementati= on failed to send TB messages when TB is negotiated, I=E2=80=99d treat it a= s a bug (per TBNEGO =C2=A74) and get it fixed.

I think it is not important to require that the ser= ver enforce this, if the server is configured to accept non-TB requests.


I agree with Br= ian on this point - we don't need any more language in the spec to say = that if the versions match, then the client and server definitively know th= at TB was negotiated.=C2=A0

=

=C2=A0

The important thing is that when an HTTPS server re= quires TB, it MUST fail requests that lack TB messages. I think it already = follows from the specs, but don=E2=80=99t mind stating explicitly.


= I also think this follows, and I don't have a preference one way or ano= ther about adding more language to state that explicitly.=C2=A0
=

--001a114a9a30ee4c550544312d72-- From nobody Fri Dec 23 11:08:26 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4AA7D129438 for ; Fri, 23 Dec 2016 11:08:25 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.055 X-Spam-Level: X-Spam-Status: No, score=-0.055 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_BL_SPAMCOP_NET=1.347, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, RCVD_IN_SORBS_SPAM=0.5, SPF_PASS=-0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VbwhIEgi2AY8 for ; Fri, 23 Dec 2016 11:08:24 -0800 (PST) Received: from gproxy5-pub.mail.unifiedlayer.com (gproxy5-pub.mail.unifiedlayer.com [67.222.38.55]) by ietfa.amsl.com (Postfix) with SMTP id 6EB4512007C for ; Fri, 23 Dec 2016 11:08:24 -0800 (PST) Received: (qmail 5967 invoked by uid 0); 23 Dec 2016 19:08:21 -0000 Received: from unknown (HELO cmgw2) (10.0.90.83) by gproxy5.mail.unifiedlayer.com with SMTP; 23 Dec 2016 19:08:20 -0000 Received: from box514.bluehost.com ([74.220.219.114]) by cmgw2 with id PX8F1u00n2UhLwi01X8JhG; Fri, 23 Dec 2016 12:08:19 -0700 X-Authority-Analysis: v=2.1 cv=KYpB72oD c=1 sm=1 tr=0 a=9W6Fsu4pMcyimqnCr1W0/w==:117 a=9W6Fsu4pMcyimqnCr1W0/w==:17 a=L9H7d07YOLsA:10 a=9cW_t1CCXrUA:10 a=s5jvgZ67dGcA:10 a=IkcTkHD0fZMA:10 a=n5n_aSjo0skA:10 a=_KuT03QilnefIBJQwtAA:9 a=QEXdDO2ut3YA:10 a=zAqbSSiTv3UA:10 Received: from c-73-202-80-238.hsd1.ca.comcast.net ([73.202.80.238]:58696 helo=[192.168.11.53]) by box514.bluehost.com with esmtpsa (TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128) (Exim 4.86_1) (envelope-from ) id 1cKVCT-0000Me-1v for unbearable@ietf.org; Fri, 23 Dec 2016 12:08:17 -0700 To: IETF TokBind WG From: =JeffH Message-ID: <4e70b0c4-a249-3133-9c00-f5f4cf0d3048@KingsMountain.com> Date: Fri, 23 Dec 2016 11:08:16 -0800 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:45.0) Gecko/20100101 Thunderbird/45.5.1 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - box514.bluehost.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - KingsMountain.com X-BWhitelist: no X-Source-IP: 73.202.80.238 X-Exim-ID: 1cKVCT-0000Me-1v X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: c-73-202-80-238.hsd1.ca.comcast.net ([192.168.11.53]) [73.202.80.238]:58696 X-Source-Auth: jeff.hodges+kingsmountain.com X-Email-Count: 1 X-Source-Cap: a2luZ3Ntb3U7a2luZ3Ntb3U7Ym94NTE0LmJsdWVob3N0LmNvbQ== Archived-At: Subject: Re: [Unbearable] (late, sorry) WGLC question on establishing the binding or not X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 23 Dec 2016 19:08:25 -0000 Brian Campbell wrote on Wed, 21 Dec 2016 13:41:07 -0700: > > I've come around to thinking that no additional language is needed. > For whatever that's worth. Thanks for discussing it though. I'm also basically agreed with this after reviewing the thread. Though, if similar questions arise during IETF-wide Last Call, we may wish to reconsider. =JeffH From nobody Fri Dec 23 11:18:10 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 04B0C1296FC for ; Fri, 23 Dec 2016 11:18:09 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.055 X-Spam-Level: X-Spam-Status: No, score=-0.055 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_BL_SPAMCOP_NET=1.347, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, RCVD_IN_SORBS_SPAM=0.5, SPF_PASS=-0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xyabbKMc6dxI for ; Fri, 23 Dec 2016 11:18:08 -0800 (PST) Received: from gproxy6-pub.mail.unifiedlayer.com (gproxy6-pub.mail.unifiedlayer.com [67.222.39.168]) by ietfa.amsl.com (Postfix) with SMTP id F3C9D129475 for ; Fri, 23 Dec 2016 11:18:07 -0800 (PST) Received: (qmail 22374 invoked by uid 0); 23 Dec 2016 19:18:03 -0000 Received: from unknown (HELO cmgw3) (10.0.90.84) by gproxy6.mail.unifiedlayer.com with SMTP; 23 Dec 2016 19:18:03 -0000 Received: from box514.bluehost.com ([74.220.219.114]) by cmgw3 with id PXHz1u0152UhLwi01XJ24F; Fri, 23 Dec 2016 12:18:03 -0700 X-Authority-Analysis: v=2.1 cv=G8WPTbU5 c=1 sm=1 tr=0 a=9W6Fsu4pMcyimqnCr1W0/w==:117 a=9W6Fsu4pMcyimqnCr1W0/w==:17 a=L9H7d07YOLsA:10 a=9cW_t1CCXrUA:10 a=s5jvgZ67dGcA:10 a=IkcTkHD0fZMA:10 a=n5n_aSjo0skA:10 a=NEAV23lmAAAA:8 a=W0SWmeN5ZppLWkmxFgwA:9 a=QEXdDO2ut3YA:10 a=nLgV7C8IG_gA:10 a=Bn2pgwyD2vrAyMmN8A2t:22 Received: from c-73-202-80-238.hsd1.ca.comcast.net ([73.202.80.238]:58840 helo=[192.168.11.53]) by box514.bluehost.com with esmtpsa (TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128) (Exim 4.86_1) (envelope-from ) id 1cKVLr-0000yl-H7 for unbearable@ietf.org; Fri, 23 Dec 2016 12:17:59 -0700 To: IETF TokBind WG From: =JeffH Message-ID: Date: Fri, 23 Dec 2016 11:17:58 -0800 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:45.0) Gecko/20100101 Thunderbird/45.5.1 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - box514.bluehost.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - KingsMountain.com X-BWhitelist: no X-Source-IP: 73.202.80.238 X-Exim-ID: 1cKVLr-0000yl-H7 X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: c-73-202-80-238.hsd1.ca.comcast.net ([192.168.11.53]) [73.202.80.238]:58840 X-Source-Auth: jeff.hodges+kingsmountain.com X-Email-Count: 2 X-Source-Cap: a2luZ3Ntb3U7a2luZ3Ntb3U7Ym94NTE0LmJsdWVob3N0LmNvbQ== Archived-At: Subject: Re: [Unbearable] [TokenBinding/Internet-Drafts] HTTPSTB: WGLC: web origin -> server or eTLD+1 (#85) X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 23 Dec 2016 19:18:09 -0000 Andrei wrote on Wed, 14 Dec 2016 10:34:56 -0800: > > I think this change would make the language more concrete > and more consistent. thx, this is addressed in https://github.com/equalsJeffH/Internet-Drafts/commit/39ab776bfa87bde83a05e0feaf83eefb7fbf21d4 which is part of PR #86: https://github.com/TokenBinding/Internet-Drafts/pull/86 hth, =JeffH From nobody Fri Dec 23 13:25:31 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4EF33129559 for ; Fri, 23 Dec 2016 13:25:30 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com; domainkeys=pass (1024-bit key) header.sender=andreipo=microsoft.com@github.com header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MCwdDksF5FUf for ; Fri, 23 Dec 2016 13:25:29 -0800 (PST) Received: from m69-170.mailgun.net (m69-170.mailgun.net [166.78.69.170]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 01C3C129557 for ; Fri, 23 Dec 2016 13:25:28 -0800 (PST) DKIM-Signature: a=rsa-sha256; v=1; c=relaxed/relaxed; d=github.com; q=dns/txt; s=mailo; t=1482528328; h=Content-Transfer-Encoding: Content-Type: Mime-Version: Subject: Message-ID: To: Reply-To: From: Date: Sender; bh=VOtrLMR5qIt+6cBJwC3wvKxFYpZ7A5B2lwop3ULPWww=; b=Ox17ae4SDoSU6jjS+NkHqV5U4ZyoNs7lUeDV/f4x96jryagvG0Yp55zV28GWiyAKUus19b11 HxPri3aYwNn6apM9yQV76Zsnm1dlxuCgZ3TTa/jpLEgWituCj93+iBk1nWd2jtnEuGltIfGS fBSRsUmGjMwLI0zsXGotrFzZXYk= DomainKey-Signature: a=rsa-sha1; c=nofws; d=github.com; s=mailo; q=dns; h=Sender: Date: From: Reply-To: To: Message-ID: Subject: Mime-Version: Content-Type: Content-Transfer-Encoding; b=fkcMSsiI5AvekPt2zmm0Mu55UKHSZaHTfJt0YUqyWsjJKUIRctcj40IihIcOKqRNj2aiaw PKevoZ98oT7fubXrmerYcnycKyjWxjeDKMm0IiWosCir/EomI1q4g9NchaXLnRlVuMOgX/zg m3Oc6NIEy/VfEUPV3GEK2/0rsDbNI= Sender: andreipo=microsoft.com@github.com X-Mailgun-Sending-Ip: 166.78.69.170 X-Mailgun-Sid: WyIzMTNlNyIsICJ1bmJlYXJhYmxlQGlldGYub3JnIiwgIjQwZiJd Received: from github.com (Unknown [192.30.252.41]) by mxa.mailgun.org with ESMTP id 585d9647.7f500c3002a0-in07; Fri, 23 Dec 2016 21:25:27 -0000 (UTC) Date: Fri, 23 Dec 2016 13:25:27 -0800 From: Andrei Popov To: unbearable@ietf.org Message-ID: <585d96472c378_450f3fe71d77d14088862@hookshot-fe5-cp1-prd.iad.github.net.mail> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="--==_mimepart_585d96472bf7c_450f3fe71d77d14088770"; charset=UTF-8 Content-Transfer-Encoding: 7bit Archived-At: Subject: [Unbearable] [TokenBinding/Internet-Drafts] 517c1d: Clarifying TLS versions affected by triple HS X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: Andrei Popov List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 23 Dec 2016 21:25:30 -0000 ----==_mimepart_585d96472bf7c_450f3fe71d77d14088770 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Branch: refs/heads/master Home: https://github.com/TokenBinding/Internet-Drafts Commit: 517c1d773de2304c6510b37a3fda29b8d014a288 https://github.com/TokenBinding/Internet-Drafts/commit/517c1d773de2304c6510b37a3fda29b8d014a288 Author: Andrei Popov Date: 2016-12-23 (Fri, 23 Dec 2016) Changed paths: M README.md M draft-ietf-tokbind-negotiation-06.xml M draft-ietf-tokbind-protocol-12.xml Log Message: ----------- Clarifying TLS versions affected by triple HS ----==_mimepart_585d96472bf7c_450f3fe71d77d14088770-- From nobody Fri Dec 23 13:28:36 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 512E0129559 for ; Fri, 23 Dec 2016 13:28:35 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=github.com; domainkeys=pass (1024-bit key) header.sender=andreipo=microsoft.com@github.com header.d=github.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DxPh_2mVuANN for ; Fri, 23 Dec 2016 13:28:34 -0800 (PST) Received: from m69-169.mailgun.net (m69-169.mailgun.net [166.78.69.169]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D8AFE129557 for ; Fri, 23 Dec 2016 13:28:33 -0800 (PST) DKIM-Signature: a=rsa-sha256; v=1; c=relaxed/relaxed; d=github.com; q=dns/txt; s=mailo; t=1482528513; h=Content-Transfer-Encoding: Content-Type: Mime-Version: Subject: Message-ID: To: Reply-To: From: Date: Sender; bh=kQ8A2W56dTpkwj1DT8llXqC0W4w6QsMIlWXNknMaEjU=; b=x2GaGNaxrPTbQjQnuolHiiDieSYBSwpnrReKj9LUO2QBcQ2394HOqJWcG9q1qxaa600zFu5m efcrzZSJRZ3mWCcG/hGCbvgfmYThe+OaMvPrFxQzZF3P7vago9MCiM6SyplUfITSwpFV5WPq E4IFaRm/GoozxdoV3Bil0ruu53I= DomainKey-Signature: a=rsa-sha1; c=nofws; d=github.com; s=mailo; q=dns; h=Sender: Date: From: Reply-To: To: Message-ID: Subject: Mime-Version: Content-Type: Content-Transfer-Encoding; b=KrCR8CQZpjYaKeuVlxaupkRTX2UlxHQEDYX/tS3RfwcY42guMBcp8y23qGwaUaORlleMMG 6+W6al2Q7Z4zsRsNrvmgj53hB8MpjeRm7ksI1MhR/ljXE+6x5giOJMD8IA5840865Tn2OYcp JV9WeNCgyu0Su815J+xA/rKtiuqqc= Sender: andreipo=microsoft.com@github.com X-Mailgun-Sending-Ip: 166.78.69.169 X-Mailgun-Sid: WyIzMTNlNyIsICJ1bmJlYXJhYmxlQGlldGYub3JnIiwgIjQwZiJd Received: from github.com (Unknown [192.30.252.45]) by mxa.mailgun.org with ESMTP id 585d9701.7fcce84b94e0-smtp-out-n02; Fri, 23 Dec 2016 21:28:33 -0000 (UTC) Date: Fri, 23 Dec 2016 13:28:32 -0800 From: Andrei Popov To: unbearable@ietf.org Message-ID: <585d9700e74d4_32d33ff75fcad1403849f@hookshot-fe3-cp1-prd.iad.github.net.mail> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="--==_mimepart_585d9700e709e_32d33ff75fcad14038371"; charset=UTF-8 Content-Transfer-Encoding: 7bit Archived-At: Subject: [Unbearable] [TokenBinding/Internet-Drafts] 5fd553: Renaming TBNEGO-07 X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: Andrei Popov List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 23 Dec 2016 21:28:35 -0000 ----==_mimepart_585d9700e709e_32d33ff75fcad14038371 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Branch: refs/heads/master Home: https://github.com/TokenBinding/Internet-Drafts Commit: 5fd553bd306e908a7d214c673ca11f5bb1da216c https://github.com/TokenBinding/Internet-Drafts/commit/5fd553bd306e908a7d214c673ca11f5bb1da216c Author: Andrei Popov Date: 2016-12-23 (Fri, 23 Dec 2016) Changed paths: R draft-ietf-tokbind-negotiation-06.xml A draft-ietf-tokbind-negotiation-07.xml Log Message: ----------- Renaming TBNEGO-07 ----==_mimepart_585d9700e709e_32d33ff75fcad14038371-- From nobody Fri Dec 23 13:32:43 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 504FA129557 for ; Fri, 23 Dec 2016 13:32:41 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.021 X-Spam-Level: X-Spam-Status: No, score=-2.021 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FX4_vQ30zPSN for ; Fri, 23 Dec 2016 13:32:39 -0800 (PST) Received: from NAM01-BY2-obe.outbound.protection.outlook.com (mail-by2nam01on0122.outbound.protection.outlook.com [104.47.34.122]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E2EB012954E for ; Fri, 23 Dec 2016 13:32:38 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=/eO8cRLyvaICu3jDMsfC4eFisr3AGTo2J1eflE0909c=; b=ndp5sYWaGQRPT5DH++5g0fY1ZzITjIuuFDNuwJYRYNNVZcjZE+d41RK65H3PcRh8hME8D1fsS/3ptz3NoKNVrJ+Yp0/oE99LExOlmFwyTaQtAw4n4sNIbmocNHXwpSe20gWIN0RSlt9amxdJ/2rBepgTvrLK184L1t3Bq/dfIi4= Received: from CY1PR0301MB0842.namprd03.prod.outlook.com (10.160.163.148) by CY1PR0301MB0843.namprd03.prod.outlook.com (10.160.163.149) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.789.14; Fri, 23 Dec 2016 21:32:34 +0000 Received: from CY1PR0301MB0842.namprd03.prod.outlook.com ([10.160.163.148]) by CY1PR0301MB0842.namprd03.prod.outlook.com ([10.160.163.148]) with mapi id 15.01.0789.018; Fri, 23 Dec 2016 21:32:34 +0000 From: Andrei Popov To: Andrei Popov , Brian Campbell , IETF Tokbind WG Thread-Topic: [Unbearable] (late) WGLC nit on TBNEGO Thread-Index: AQHSWi3gZpKzb7ukQkWKpeoPtNoJgaEPqqnQgAZo3HA= Date: Fri, 23 Dec 2016 21:32:34 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Andrei.Popov@microsoft.com; x-originating-ip: [2001:4898:80e8:7::1d2] x-ms-office365-filtering-correlation-id: 70142a42-37ee-4766-505a-08d42b7b3566 x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001); SRVR:CY1PR0301MB0843; x-microsoft-exchange-diagnostics: 1; CY1PR0301MB0843; 7:XID2ngfewp1PQQVQJVS2h/DRoa6k8S/L9JnDLHPFmCgPR8gRyqdTNDrz3JHIxpUzUGdTJwOSVRAuSd9wEh1iAQ7212J1i5WSU3POa85hzfrYJPUipAg0RgBObDBaFhTHMn4yaMMAE5UcSEfNKz2pkWi8QmZOqoWotYkmsCulwuSL2R8XAJN3Jc5kr5t/e/tInUq243o7M3yia+3tfUioKc7/FDPkAco3sscA83vHHpOk6u2Wx5byOT+La5/6CrIusyaArFlgd8lb8jhOBVLvyhoYJNrpduDtktaZyzweT4aQleX3K4c5fcagm8CHi3pVKyLH/SWa4HEVUv3XrbbXSi+LRAA3qOSp3B8l+6KCm2T+isPrcuTiI8q8p0szJi+apvaYybKe/tfyE6sSbD0ndHcgaOUmaEVLM4lSPg8f4yKtG+023+DekYo3XIvDVyC3g1kH3uR0FsLCVfIh5sFqo7OqE+D9/3NjaCwIVfq+jlk= x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(21748063052155); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040375)(601004)(2401047)(8121501046)(5005006)(3002001)(10201501046)(6055026)(61426038)(61427038)(6041248)(20161123562025)(20161123560025)(20161123564025)(20161123555025)(6047074)(6072148); SRVR:CY1PR0301MB0843; BCL:0; PCL:0; RULEID:; SRVR:CY1PR0301MB0843; x-forefront-prvs: 016572D96D x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(7916002)(39410400002)(39840400002)(39450400003)(39860400002)(39850400002)(189002)(377454003)(199003)(229853002)(101416001)(5005710100001)(107886002)(2950100002)(33656002)(122556002)(86612001)(102836003)(790700001)(6116002)(6506006)(2561002)(77096006)(10290500002)(5001770100001)(38730400001)(97736004)(2906002)(5660300001)(92566002)(25786008)(86362001)(6436002)(99286002)(606005)(68736007)(106356001)(189998001)(19609705001)(105586002)(1511001)(76576001)(106116001)(8990500004)(81166006)(81156014)(3660700001)(2421001)(7696004)(2900100001)(9686002)(3280700002)(7906003)(7736002)(54356999)(8936002)(8676002)(50986999)(10090500001)(74316002)(76176999); DIR:OUT; SFP:1102; SCL:1; SRVR:CY1PR0301MB0843; H:CY1PR0301MB0842.namprd03.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:1; LANG:en; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_CY1PR0301MB08428AAAA52D31DF473178C58C950CY1PR0301MB0842_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 23 Dec 2016 21:32:34.1140 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY1PR0301MB0843 Archived-At: Subject: Re: [Unbearable] (late) WGLC nit on TBNEGO X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 23 Dec 2016 21:32:41 -0000 --_000_CY1PR0301MB08428AAAA52D31DF473178C58C950CY1PR0301MB0842_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 VXBkYXRlZCBUQk5FR08tMDcgb24gR2l0SHViIHRvIGNsYXJpZnkgdGhpcy4NCg0KQ2hlZXJzLA0K DQpBbmRyZWkNCg0KRnJvbTogVW5iZWFyYWJsZSBbbWFpbHRvOnVuYmVhcmFibGUtYm91bmNlc0Bp ZXRmLm9yZ10gT24gQmVoYWxmIE9mIEFuZHJlaSBQb3Bvdg0KU2VudDogTW9uZGF5LCBEZWNlbWJl ciAxOSwgMjAxNiAxMTo0MCBBTQ0KVG86IEJyaWFuIENhbXBiZWxsIDxiY2FtcGJlbGxAcGluZ2lk ZW50aXR5LmNvbT47IElFVEYgVG9rYmluZCBXRyA8dW5iZWFyYWJsZUBpZXRmLm9yZz4NClN1Ympl Y3Q6IFJlOiBbVW5iZWFyYWJsZV0gKGxhdGUpIFdHTEMgbml0IG9uIFRCTkVHTw0KDQpHb29kIHBv aW50LCB0aGFua3MsIEJyaWFuLCBmb3IgY2F0Y2hpbmcgdGhpcy4gV2lsbCBmaXggaW4gdGhlIG5l eHQgcmV2aXNpb24uDQoNCkNoZWVycywNCg0KQW5kcmVpDQoNCkZyb206IFVuYmVhcmFibGUgW21h aWx0bzp1bmJlYXJhYmxlLWJvdW5jZXNAaWV0Zi5vcmddIE9uIEJlaGFsZiBPZiBCcmlhbiBDYW1w YmVsbA0KU2VudDogTW9uZGF5LCBEZWNlbWJlciAxOSwgMjAxNiAxMToyNiBBTQ0KVG86IElFVEYg VG9rYmluZCBXRyA8dW5iZWFyYWJsZUBpZXRmLm9yZz4NClN1YmplY3Q6IFtVbmJlYXJhYmxlXSAo bGF0ZSkgV0dMQyBuaXQgb24gVEJORUdPDQoNClRCTkVHTyBzZWMgNi4yPGh0dHBzOi8vdG9vbHMu aWV0Zi5vcmcvaHRtbC9kcmFmdC1pZXRmLXRva2JpbmQtbmVnb3RpYXRpb24tMDYjc2VjdGlvbi02 LjI+IG1lbnRpb25zICJ0aGVzZSBUTFMgdmVyc2lvbnMiIGJ1dCBvdGhlciB0aGFuIGluIHRoZSBz ZWN0aW9uIHRpdGxlIGRvZXNuJ3Qgc2F5IHdoYXQgdGhvc2UgdmVyc2lvbnMgYXJlLiBBc3R1dGUg cmVhZGVycyBjYW4gZmlndXJlIGl0IG91dCBmcm9tIHRoZSBzZWN0aW9uIHRpdGxlIG9yIGFsc28g Y29udGVudCBpbiBzZWN0aW9uIDQgYnV0IGl0IGRvZXMgcmVhZHMgc29tZXdoYXQgYXdrd2FyZCBh cyBpdCBpcyBub3cuIEknZCBzdWdnZXN0IGFkZGluZyB3b3JkaW5nIHNpbWlsYXIgdG8gVEJQUk9U TyBzZWMgNy41PGh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1pZXRmLXRva2JpbmQt cHJvdG9jb2wtMTEjc2VjdGlvbi03LjU+IGFuZCBIVFRQU1RCIHNlYyA3LjI8aHR0cHM6Ly90b29s cy5pZXRmLm9yZy9odG1sL2RyYWZ0LWlldGYtdG9rYmluZC1odHRwcy0wNyNzZWN0aW9uLTcuMj4g dGhhdCBoYXMgImluIFRMUyAxLjIgYW5kIG9sZGVyIFRMUyB2ZXJzaW9ucyIgZWFybGllciBpbiB0 aGUgcGFyYWdyYXBoLiBBbmQgbWF5YmUgZXZlbiBnb2luZyBzbyBmYXIgYXMgaGF2aW5nIHRob3Nl IHRocmVlIHNlY3Rpb25zIGp1c3QgaGF2ZSBpZGVudGljYWwgdGV4dC4NCg0KaHR0cHM6Ly90b29s cy5pZXRmLm9yZy9odG1sL2RyYWZ0LWlldGYtdG9rYmluZC1uZWdvdGlhdGlvbi0wNiNzZWN0aW9u LTYuMg0KNi4yLiAgVHJpcGxlIEhhbmRzaGFrZSBWdWxuZXJhYmlsaXR5IGluIFRMUyAxLjIgYW5k IE9sZGVyIFRMUyBWZXJzaW9ucw0KDQogICBUaGUgVG9rZW4gQmluZGluZyBwcm90b2NvbCByZWxp ZXMgb24gdGhlIFRMUyBFeHBvcnRlcnMgW1JGQzU3MDVdIHRvDQogICBhc3NvY2lhdGUgYSBUTFMg Y29ubmVjdGlvbiB3aXRoIGEgVG9rZW4gQmluZGluZy4gIFRoZSB0cmlwbGUNCiAgIGhhbmRzaGFr ZSBhdHRhY2sgW1RSSVBMRS1IU10gaXMgYSBrbm93biBUTFMgcHJvdG9jb2wgdnVsbmVyYWJpbGl0 eQ0KICAgYWxsb3dpbmcgdGhlIGF0dGFja2VyIHRvIHN5bmNocm9uaXplIGV4cG9ydGVkIGtleWlu ZyBtYXRlcmlhbCBiZXR3ZWVuDQogICBUTFMgY29ubmVjdGlvbnMuICBUaGUgYXR0YWNrZXIgY2Fu IHRoZW4gc3VjY2Vzc2Z1bGx5IHJlcGxheSBib3VuZA0KICAgdG9rZW5zLiAgRm9yIHRoaXMgcmVh c29uLCB0aGUgVG9rZW4gQmluZGluZyBwcm90b2NvbCBNVVNUIE5PVCBiZQ0KICAgbmVnb3RpYXRl ZCB3aXRoIHRoZXNlIFRMUyB2ZXJzaW9ucywgdW5sZXNzIHRoZSBFeHRlbmRlZCBNYXN0ZXIgU2Vj cmV0DQogICBbUkZDNzYyN10gYW5kIFJlbmVnb3RpYXRpb24gSW5kaWNhdGlvbiBbUkZDNTc0Nl0g VExTIGV4dGVuc2lvbnMgaGF2ZQ0KICAgYWxzbyBiZWVuIG5lZ290aWF0ZWQuDQoNCg0KaHR0cHM6 Ly90b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LWlldGYtdG9rYmluZC1wcm90b2NvbC0xMSNzZWN0 aW9uLTcuNQ0KNy41LiAgVHJpcGxlIEhhbmRzaGFrZSBWdWxuZXJhYmlsaXR5IGluIFRMUyAxLjIg YW5kIE9sZGVyIFRMUyBWZXJzaW9ucw0KDQogICBUaGUgVG9rZW4gQmluZGluZyBwcm90b2NvbCBy ZWxpZXMgb24gdGhlIGV4cG9ydGVkIGtleWluZyBtYXRlcmlhbA0KICAgKEVLTSkgdG8gYXNzb2Np YXRlIGEgVExTIGNvbm5lY3Rpb24gd2l0aCBhIFRva2VuIEJpbmRpbmcuICBUaGUgdHJpcGxlDQog ICBoYW5kc2hha2UgYXR0YWNrIFtUUklQTEUtSFNdIGlzIGEga25vd24gdnVsbmVyYWJpbGl0eSBp biBUTFMgMS4yIGFuZA0KICAgb2xkZXIgVExTIHZlcnNpb25zLCBhbGxvd2luZyB0aGUgYXR0YWNr ZXIgdG8gc3luY2hyb25pemUga2V5aW5nDQogICBtYXRlcmlhbCBiZXR3ZWVuIFRMUyBjb25uZWN0 aW9ucy4gIFRoZSBhdHRhY2tlciBjYW4gdGhlbiBzdWNjZXNzZnVsbHkNCiAgIHJlcGxheSBib3Vu ZCB0b2tlbnMuICBGb3IgdGhpcyByZWFzb24sIHRoZSBUb2tlbiBCaW5kaW5nIHByb3RvY29sDQog ICBNVVNUIE5PVCBiZSBuZWdvdGlhdGVkIHdpdGggdGhlc2UgVExTIHZlcnNpb25zLCB1bmxlc3Mg dGhlIEV4dGVuZGVkDQogICBNYXN0ZXIgU2VjcmV0IFtSRkM3NjI3XSBhbmQgUmVuZWdvdGlhdGlv biBJbmRpY2F0aW9uIFtSRkM1NzQ2XSBUTFMNCiAgIGV4dGVuc2lvbnMgaGF2ZSBhbHNvIGJlZW4g bmVnb3RpYXRlZC4NCg0KDQpodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQtaWV0Zi10 b2tiaW5kLWh0dHBzLTA3I3NlY3Rpb24tNy4yDQo3LjIuICBUcmlwbGUgSGFuZHNoYWtlIFZ1bG5l cmFiaWxpdHkgaW4gVExTIDEuMiBhbmQgT2xkZXIgVExTIFZlcnNpb25zDQoNCiAgIFRoZSBUb2tl biBCaW5kaW5nIHByb3RvY29sIHJlbGllcyBvbiB0aGUgZXhwb3J0ZWQga2V5IG1hdGVyaWFsIChF S00pDQogICB2YWx1ZSBbUkZDNTcwNV0gdG8gYXNzb2NpYXRlIGEgVExTIGNvbm5lY3Rpb24gd2l0 aCBhIFRMUyBUb2tlbg0KICAgQmluZGluZy4gIFRoZSB0cmlwbGUgaGFuZHNoYWtlIGF0dGFjayBb VFJJUExFLUhTXSBpcyBhIGtub3duDQogICB2dWxuZXJhYmlsaXR5IGluIFRMUyAxLjIgYW5kIG9s ZGVyIFRMUyB2ZXJzaW9ucywgYWxsb3dpbmcgdGhlDQogICBhdHRhY2tlciB0byBzeW5jaHJvbml6 ZSBrZXlpbmcgbWF0ZXJpYWwgYmV0d2VlbiBUTFMgY29ubmVjdGlvbnMuICBUaGUNCiAgIGF0dGFj a2VyIGNhbiB0aGVuIHN1Y2Nlc3NmdWxseSByZXBsYXkgYm91bmQgdG9rZW5zLiAgRm9yIHRoaXMg cmVhc29uLA0KICAgdGhlIFRva2VuIEJpbmRpbmcgcHJvdG9jb2wgTVVTVCBOT1QgYmUgbmVnb3Rp YXRlZCB3aXRoIHRoZXNlIFRMUw0KICAgdmVyc2lvbnMsIHVubGVzcyB0aGUgRXh0ZW5kZWQgTWFz dGVyIFNlY3JldCBbUkZDNzYyN10gYW5kDQogICBSZW5lZ290aWF0aW9uIEluZGljYXRpb24gW1JG QzU3NDZdIFRMUyBleHRlbnNpb25zIGhhdmUgYWxzbyBiZWVuDQogICBuZWdvdGlhdGVkLg0K --_000_CY1PR0301MB08428AAAA52D31DF473178C58C950CY1PR0301MB0842_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIixzZXJpZjt9 DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCglj b2xvcjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFu Lk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpw dXJwbGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLm1zb25vcm1hbDAsIGxpLm1z b25vcm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCglt c28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTIuMHB0Ow0K CWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iLHNlcmlmO30NCnNwYW4uRW1haWxTdHlsZTE4 DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsOw0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5z LXNlcmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0Kc3Bhbi5FbWFpbFN0eWxlMTkNCgl7bXNvLXN0 eWxlLXR5cGU6cGVyc29uYWwtcmVwbHk7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2Vy aWY7DQoJY29sb3I6d2luZG93dGV4dDt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5bGUtdHlw ZTpleHBvcnQtb25seTsNCglmb250LXNpemU6MTAuMHB0O30NCkBwYWdlIFdvcmRTZWN0aW9uMQ0K CXtzaXplOjguNWluIDExLjBpbjsNCgltYXJnaW46MS4waW4gMS4waW4gMS4waW4gMS4waW47fQ0K ZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQotLT48L3N0eWxlPjwhLS1b aWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVkZWZhdWx0cyB2OmV4dD0iZWRpdCIgc3BpZG1h eD0iMTAyNiIgLz4NCjwveG1sPjwhW2VuZGlmXS0tPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0K PG86c2hhcGVsYXlvdXQgdjpleHQ9ImVkaXQiPg0KPG86aWRtYXAgdjpleHQ9ImVkaXQiIGRhdGE9 IjEiIC8+DQo8L286c2hhcGVsYXlvdXQ+PC94bWw+PCFbZW5kaWZdLS0+DQo8L2hlYWQ+DQo8Ym9k eSBsYW5nPSJFTi1VUyIgbGluaz0iYmx1ZSIgdmxpbms9InB1cnBsZSI+DQo8ZGl2IGNsYXNzPSJX b3JkU2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5VcGRh dGVkIFRCTkVHTy0wNyBvbiBHaXRIdWIgdG8gY2xhcmlmeSB0aGlzLjxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+PG86cD4mbmJzcDs8 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5D aGVlcnMsPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90Oyxz YW5zLXNlcmlmIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxp YnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkFuZHJlaTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+ PC9wPg0KPGRpdj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0Ux RTFFMSAxLjBwdDtwYWRkaW5nOjMuMHB0IDBpbiAwaW4gMGluIj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nh bGlicmkmcXVvdDssc2Fucy1zZXJpZiI+RnJvbTo8L3NwYW4+PC9iPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+ IFVuYmVhcmFibGUgW21haWx0bzp1bmJlYXJhYmxlLWJvdW5jZXNAaWV0Zi5vcmddDQo8Yj5PbiBC ZWhhbGYgT2YgPC9iPkFuZHJlaSBQb3Bvdjxicj4NCjxiPlNlbnQ6PC9iPiBNb25kYXksIERlY2Vt YmVyIDE5LCAyMDE2IDExOjQwIEFNPGJyPg0KPGI+VG86PC9iPiBCcmlhbiBDYW1wYmVsbCAmbHQ7 YmNhbXBiZWxsQHBpbmdpZGVudGl0eS5jb20mZ3Q7OyBJRVRGIFRva2JpbmQgV0cgJmx0O3VuYmVh cmFibGVAaWV0Zi5vcmcmZ3Q7PGJyPg0KPGI+U3ViamVjdDo8L2I+IFJlOiBbVW5iZWFyYWJsZV0g KGxhdGUpIFdHTEMgbml0IG9uIFRCTkVHTzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0K PC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+R29vZCBwb2ludCwgdGhhbmtzLCBCcmlh biwgZm9yIGNhdGNoaW5nIHRoaXMuIFdpbGwgZml4IGluIHRoZSBuZXh0IHJldmlzaW9uLjxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+ PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90Oyxz YW5zLXNlcmlmIj5DaGVlcnMsPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2Fs aWJyaSZxdW90OyxzYW5zLXNlcmlmIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkFuZHJlaTxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+PG86cD4mbmJzcDs8 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlm Ij5Gcm9tOjwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4gVW5iZWFyYWJsZSBbbWFpbHRvOnVu YmVhcmFibGUtYm91bmNlc0BpZXRmLm9yZ10NCjxiPk9uIEJlaGFsZiBPZiA8L2I+QnJpYW4gQ2Ft cGJlbGw8YnI+DQo8Yj5TZW50OjwvYj4gTW9uZGF5LCBEZWNlbWJlciAxOSwgMjAxNiAxMToyNiBB TTxicj4NCjxiPlRvOjwvYj4gSUVURiBUb2tiaW5kIFdHICZsdDt1bmJlYXJhYmxlQGlldGYub3Jn Jmd0Ozxicj4NCjxiPlN1YmplY3Q6PC9iPiBbVW5iZWFyYWJsZV0gKGxhdGUpIFdHTEMgbml0IG9u IFRCTkVHTzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJn aW4tYm90dG9tOjEyLjBwdCI+PGEgaHJlZj0iaHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL2Ry YWZ0LWlldGYtdG9rYmluZC1uZWdvdGlhdGlvbi0wNiNzZWN0aW9uLTYuMiI+VEJORUdPIHNlYyA2 LjI8L2E+IG1lbnRpb25zICZxdW90O3RoZXNlIFRMUyB2ZXJzaW9ucyZxdW90OyBidXQgb3RoZXIg dGhhbiBpbiB0aGUgc2VjdGlvbiB0aXRsZSBkb2Vzbid0IHNheSB3aGF0IHRob3NlIHZlcnNpb25z IGFyZS4gQXN0dXRlDQogcmVhZGVycyBjYW4gZmlndXJlIGl0IG91dCBmcm9tIHRoZSBzZWN0aW9u IHRpdGxlIG9yIGFsc28gY29udGVudCBpbiBzZWN0aW9uIDQgYnV0IGl0IGRvZXMgcmVhZHMgc29t ZXdoYXQgYXdrd2FyZCBhcyBpdCBpcyBub3cuIEknZCBzdWdnZXN0IGFkZGluZyB3b3JkaW5nIHNp bWlsYXIgdG8NCjxhIGhyZWY9Imh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1pZXRm LXRva2JpbmQtcHJvdG9jb2wtMTEjc2VjdGlvbi03LjUiPg0KVEJQUk9UTyBzZWMgNy41PC9hPiBh bmQgPGEgaHJlZj0iaHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LWlldGYtdG9rYmlu ZC1odHRwcy0wNyNzZWN0aW9uLTcuMiI+DQpIVFRQU1RCIHNlYyA3LjI8L2E+IHRoYXQgaGFzICZx dW90O2luIFRMUyAxLjIgYW5kIG9sZGVyIFRMUyB2ZXJzaW9ucyZxdW90OyBlYXJsaWVyIGluIHRo ZSBwYXJhZ3JhcGguIEFuZCBtYXliZSBldmVuIGdvaW5nIHNvIGZhciBhcyBoYXZpbmcgdGhvc2Ug dGhyZWUgc2VjdGlvbnMganVzdCBoYXZlIGlkZW50aWNhbCB0ZXh0LiAmbmJzcDsNCjxicj4NCjxi cj4NCjxhIGhyZWY9Imh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1pZXRmLXRva2Jp bmQtbmVnb3RpYXRpb24tMDYjc2VjdGlvbi02LjIiPmh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRt bC9kcmFmdC1pZXRmLXRva2JpbmQtbmVnb3RpYXRpb24tMDYjc2VjdGlvbi02LjI8L2E+PGJyPg0K Ni4yLiZuYnNwOyBUcmlwbGUgSGFuZHNoYWtlIFZ1bG5lcmFiaWxpdHkgaW4gVExTIDEuMiBhbmQg T2xkZXIgVExTIFZlcnNpb25zPGJyPg0KPGJyPg0KJm5ic3A7Jm5ic3A7IFRoZSBUb2tlbiBCaW5k aW5nIHByb3RvY29sIHJlbGllcyBvbiB0aGUgVExTIEV4cG9ydGVycyBbUkZDNTcwNV0gdG88YnI+ DQombmJzcDsmbmJzcDsgYXNzb2NpYXRlIGEgVExTIGNvbm5lY3Rpb24gd2l0aCBhIFRva2VuIEJp bmRpbmcuJm5ic3A7IFRoZSB0cmlwbGU8YnI+DQombmJzcDsmbmJzcDsgaGFuZHNoYWtlIGF0dGFj ayBbVFJJUExFLUhTXSBpcyBhIGtub3duIFRMUyBwcm90b2NvbCB2dWxuZXJhYmlsaXR5PGJyPg0K Jm5ic3A7Jm5ic3A7IGFsbG93aW5nIHRoZSBhdHRhY2tlciB0byBzeW5jaHJvbml6ZSBleHBvcnRl ZCBrZXlpbmcgbWF0ZXJpYWwgYmV0d2Vlbjxicj4NCiZuYnNwOyZuYnNwOyBUTFMgY29ubmVjdGlv bnMuJm5ic3A7IFRoZSBhdHRhY2tlciBjYW4gdGhlbiBzdWNjZXNzZnVsbHkgcmVwbGF5IGJvdW5k PGJyPg0KJm5ic3A7Jm5ic3A7IHRva2Vucy4mbmJzcDsgRm9yIHRoaXMgcmVhc29uLCB0aGUgVG9r ZW4gQmluZGluZyBwcm90b2NvbCBNVVNUIE5PVCBiZTxicj4NCiZuYnNwOyZuYnNwOyBuZWdvdGlh dGVkIHdpdGggdGhlc2UgVExTIHZlcnNpb25zLCB1bmxlc3MgdGhlIEV4dGVuZGVkIE1hc3RlciBT ZWNyZXQ8YnI+DQombmJzcDsmbmJzcDsgW1JGQzc2MjddIGFuZCBSZW5lZ290aWF0aW9uIEluZGlj YXRpb24gW1JGQzU3NDZdIFRMUyBleHRlbnNpb25zIGhhdmU8YnI+DQombmJzcDsmbmJzcDsgYWxz byBiZWVuIG5lZ290aWF0ZWQuPGJyPg0KPGJyPg0KPGJyPg0KPGEgaHJlZj0iaHR0cHM6Ly90b29s cy5pZXRmLm9yZy9odG1sL2RyYWZ0LWlldGYtdG9rYmluZC1wcm90b2NvbC0xMSNzZWN0aW9uLTcu NSI+aHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LWlldGYtdG9rYmluZC1wcm90b2Nv bC0xMSNzZWN0aW9uLTcuNTwvYT48YnI+DQo3LjUuJm5ic3A7IFRyaXBsZSBIYW5kc2hha2UgVnVs bmVyYWJpbGl0eSBpbiBUTFMgMS4yIGFuZCBPbGRlciBUTFMgVmVyc2lvbnM8YnI+DQo8YnI+DQom bmJzcDsmbmJzcDsgVGhlIFRva2VuIEJpbmRpbmcgcHJvdG9jb2wgcmVsaWVzIG9uIHRoZSBleHBv cnRlZCBrZXlpbmcgbWF0ZXJpYWw8YnI+DQombmJzcDsmbmJzcDsgKEVLTSkgdG8gYXNzb2NpYXRl IGEgVExTIGNvbm5lY3Rpb24gd2l0aCBhIFRva2VuIEJpbmRpbmcuJm5ic3A7IFRoZSB0cmlwbGU8 YnI+DQombmJzcDsmbmJzcDsgaGFuZHNoYWtlIGF0dGFjayBbVFJJUExFLUhTXSBpcyBhIGtub3du IHZ1bG5lcmFiaWxpdHkgaW4gVExTIDEuMiBhbmQ8YnI+DQombmJzcDsmbmJzcDsgb2xkZXIgVExT IHZlcnNpb25zLCBhbGxvd2luZyB0aGUgYXR0YWNrZXIgdG8gc3luY2hyb25pemUga2V5aW5nPGJy Pg0KJm5ic3A7Jm5ic3A7IG1hdGVyaWFsIGJldHdlZW4gVExTIGNvbm5lY3Rpb25zLiZuYnNwOyBU aGUgYXR0YWNrZXIgY2FuIHRoZW4gc3VjY2Vzc2Z1bGx5PGJyPg0KJm5ic3A7Jm5ic3A7IHJlcGxh eSBib3VuZCB0b2tlbnMuJm5ic3A7IEZvciB0aGlzIHJlYXNvbiwgdGhlIFRva2VuIEJpbmRpbmcg cHJvdG9jb2w8YnI+DQombmJzcDsmbmJzcDsgTVVTVCBOT1QgYmUgbmVnb3RpYXRlZCB3aXRoIHRo ZXNlIFRMUyB2ZXJzaW9ucywgdW5sZXNzIHRoZSBFeHRlbmRlZDxicj4NCiZuYnNwOyZuYnNwOyBN YXN0ZXIgU2VjcmV0IFtSRkM3NjI3XSBhbmQgUmVuZWdvdGlhdGlvbiBJbmRpY2F0aW9uIFtSRkM1 NzQ2XSBUTFM8YnI+DQombmJzcDsmbmJzcDsgZXh0ZW5zaW9ucyBoYXZlIGFsc28gYmVlbiBuZWdv dGlhdGVkLjxicj4NCjxicj4NCjxicj4NCjxhIGhyZWY9Imh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcv aHRtbC9kcmFmdC1pZXRmLXRva2JpbmQtaHR0cHMtMDcjc2VjdGlvbi03LjIiPmh0dHBzOi8vdG9v bHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1pZXRmLXRva2JpbmQtaHR0cHMtMDcjc2VjdGlvbi03LjI8 L2E+PGJyPg0KNy4yLiZuYnNwOyBUcmlwbGUgSGFuZHNoYWtlIFZ1bG5lcmFiaWxpdHkgaW4gVExT IDEuMiBhbmQgT2xkZXIgVExTIFZlcnNpb25zPGJyPg0KPGJyPg0KJm5ic3A7Jm5ic3A7IFRoZSBU b2tlbiBCaW5kaW5nIHByb3RvY29sIHJlbGllcyBvbiB0aGUgZXhwb3J0ZWQga2V5IG1hdGVyaWFs IChFS00pPGJyPg0KJm5ic3A7Jm5ic3A7IHZhbHVlIFtSRkM1NzA1XSB0byBhc3NvY2lhdGUgYSBU TFMgY29ubmVjdGlvbiB3aXRoIGEgVExTIFRva2VuPGJyPg0KJm5ic3A7Jm5ic3A7IEJpbmRpbmcu Jm5ic3A7IFRoZSB0cmlwbGUgaGFuZHNoYWtlIGF0dGFjayBbVFJJUExFLUhTXSBpcyBhIGtub3du PGJyPg0KJm5ic3A7Jm5ic3A7IHZ1bG5lcmFiaWxpdHkgaW4gVExTIDEuMiBhbmQgb2xkZXIgVExT IHZlcnNpb25zLCBhbGxvd2luZyB0aGU8YnI+DQombmJzcDsmbmJzcDsgYXR0YWNrZXIgdG8gc3lu Y2hyb25pemUga2V5aW5nIG1hdGVyaWFsIGJldHdlZW4gVExTIGNvbm5lY3Rpb25zLiZuYnNwOyBU aGU8YnI+DQombmJzcDsmbmJzcDsgYXR0YWNrZXIgY2FuIHRoZW4gc3VjY2Vzc2Z1bGx5IHJlcGxh eSBib3VuZCB0b2tlbnMuJm5ic3A7IEZvciB0aGlzIHJlYXNvbiw8YnI+DQombmJzcDsmbmJzcDsg dGhlIFRva2VuIEJpbmRpbmcgcHJvdG9jb2wgTVVTVCBOT1QgYmUgbmVnb3RpYXRlZCB3aXRoIHRo ZXNlIFRMUzxicj4NCiZuYnNwOyZuYnNwOyB2ZXJzaW9ucywgdW5sZXNzIHRoZSBFeHRlbmRlZCBN YXN0ZXIgU2VjcmV0IFtSRkM3NjI3XSBhbmQ8YnI+DQombmJzcDsmbmJzcDsgUmVuZWdvdGlhdGlv biBJbmRpY2F0aW9uIFtSRkM1NzQ2XSBUTFMgZXh0ZW5zaW9ucyBoYXZlIGFsc28gYmVlbjxicj4N CiZuYnNwOyZuYnNwOyBuZWdvdGlhdGVkLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4N CjwvYm9keT4NCjwvaHRtbD4NCg== --_000_CY1PR0301MB08428AAAA52D31DF473178C58C950CY1PR0301MB0842_-- From nobody Thu Dec 29 12:46:06 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id ABA9E12965F for ; Thu, 29 Dec 2016 12:46:05 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=pingidentity.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ggo8itFsFErl for ; Thu, 29 Dec 2016 12:46:04 -0800 (PST) Received: from mail-it0-x22d.google.com (mail-it0-x22d.google.com [IPv6:2607:f8b0:4001:c0b::22d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4D381129658 for ; Thu, 29 Dec 2016 12:46:04 -0800 (PST) Received: by mail-it0-x22d.google.com with SMTP id o141so198290683itc.0 for ; Thu, 29 Dec 2016 12:46:04 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=pingidentity.com; s=gmail; h=mime-version:from:date:message-id:subject:to; bh=XTy31paOduCuDkaVdP+3gGjGAvuz9ut5SVzaTtJyGUM=; b=R7TeTunwwhS1xaW4bzM9tSxb3Z18DbqYDBQTMUukJKRPdaPpJuDUvA5dUq2m/EO6f7 6yjc0gm8McwafNi/G6a2gZ3hIll5XpE70JZ0eaoEtrMoPHYQLUmF7vEAJfp6QXgAOOoe u/VlCMSJlbT4Hvbc7Mg4yhPOs+IBeN4GWiuPM= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=XTy31paOduCuDkaVdP+3gGjGAvuz9ut5SVzaTtJyGUM=; b=nRgH6cvSClQ3JpP7nk4+z//wSxCkt3pH7d3wHTrj7bNd+m1966V95T4kpLAZmBAWJh 5BvLHSuWO73u9unhU2rbGDLRulL7jTzHe5WmCklbolIVZrCnzpXV/R8DK556w02kKAWa EHNIDrHkiNrlPN3ltf2LqpQk6QkUu/ASF4KnvXdkD7a3LmLVdoWhroQqborE0Lg8h3nm sKP3bTF1t16WJtzomOGrmRLqFDKuQ7QKPwyfJvfX5CXKF7QUp2HDiPWH9QPEgNDaNH8T RqfwVlEX9qjTndwtSxEKpqdrzDoYIbuf0tWNy470nKxpYAdO0GaIre/DvgbxxX/JQGh8 xfHQ== X-Gm-Message-State: AIkVDXIdy+sX5XWn70sd9sEuy1nU8Pd4Ft7cexy9yw0F+q/hs+d0vYjR6WtV5fv6pXF0VyzjW/WkCxOfnd2PiN5Z X-Received: by 10.36.225.195 with SMTP id n186mr24804354ith.35.1483044363329; Thu, 29 Dec 2016 12:46:03 -0800 (PST) MIME-Version: 1.0 Received: by 10.79.31.5 with HTTP; Thu, 29 Dec 2016 12:45:32 -0800 (PST) From: Brian Campbell Date: Thu, 29 Dec 2016 13:45:32 -0700 Message-ID: To: IETF Tokbind WG Content-Type: multipart/alternative; boundary=94eb2c19d676767be60544d22cca Archived-At: Subject: [Unbearable] reference in HTTPSTB to TBPROTO out of sync X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 29 Dec 2016 20:46:05 -0000 --94eb2c19d676767be60544d22cca Content-Type: text/plain; charset=UTF-8 https://tools.ietf.org/html/draft-ietf-tokbind-https-07#section-4 has "See [I-D.ietf-tokbind-protocol] Section 6 for general guidance regarding binding of security tokens and their subsequent validation" but Section 6 is IANA Considerations. I believe it should refer to Section 5. Bound Security Token Creation and Validation. I created https://github.com/TokenBinding/Internet-Drafts/issues/91 for it. But posting here too 'cause Leif said it doesn't count unless it's on the list ;) --94eb2c19d676767be60544d22cca Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
https://tools.ietf.org/html/draft-ietf-tokbind-htt= ps-07#section-4 has "See [I-D.ietf-tokbind-protocol] Section 6 for= general guidance regarding binding of security tokens and their subsequent= validation" but Section 6 is IANA Considerations. I believe it should= refer to Section 5.=C2=A0 Bound Security Token Creation and Validation.
I created https://github.com/TokenBinding/Internet-Drafts/issues/91 for it. But posting here too 'cause Leif said it doesn't count u= nless it's on the list ;)
--94eb2c19d676767be60544d22cca-- From nobody Fri Dec 30 01:25:48 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5C56E129A66 for ; Fri, 30 Dec 2016 01:25:47 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.618 X-Spam-Level: X-Spam-Status: No, score=-2.618 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TafejDd3HUJh for ; Fri, 30 Dec 2016 01:25:45 -0800 (PST) Received: from smtp6-g21.free.fr (smtp6-g21.free.fr [212.27.42.6]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0E4B5129A65 for ; Fri, 30 Dec 2016 01:25:45 -0800 (PST) Received: from [192.168.0.13] (unknown [88.182.125.39]) by smtp6-g21.free.fr (Postfix) with ESMTP id A383D780371; Fri, 30 Dec 2016 10:25:42 +0100 (CET) To: bcampbell@pingidentity.com References: From: Denis Message-ID: <054a4303-e8d9-5fc2-bb7f-6c6ae0b978cf@free.fr> Date: Fri, 30 Dec 2016 10:25:45 +0100 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.5.1 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/alternative; boundary="------------FEF0A226420DD9A7BD4DDC19" Archived-At: Cc: unbearable@ietf.org Subject: Re: [Unbearable] reference in HTTPSTB to TBPROTO out of sync X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 30 Dec 2016 09:25:47 -0000 This is a multi-part message in MIME format. --------------FEF0A226420DD9A7BD4DDC19 Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Brian, It seems that you missed two of my messages sent to the list on November 31, 2016 and on December 21, 2016 under the subject "WGLC on draft-ietf-tokbind-https". This approach is not resistant to the ABC attack (Alice and Bob collusion attack). In this attack, Bob who is older than 18 collaborates with Alice and transmits an access token to Alice who is only 14 so that she can demonstrate to a RS that she is older than 18. This kind of attack is not mentioned in the security considerations section. Would you be able to respond to these emails ? Denis > https://tools.ietf.org/html/draft-ietf-tokbind-https-07#section-4 has > "See [I-D.ietf-tokbind-protocol] Section 6 for general guidance > regarding binding of security tokens and their subsequent validation" > but Section 6 is IANA Considerations. I believe it should refer to > Section 5. Bound Security Token Creation and Validation. > > I created https://github.com/TokenBinding/Internet-Drafts/issues/91 > for it. But posting here too 'cause Leif said it doesn't count unless > it's on the list ;) > > > _______________________________________________ > Unbearable mailing list > Unbearable@ietf.org > https://www.ietf.org/mailman/listinfo/unbearable --------------FEF0A226420DD9A7BD4DDC19 Content-Type: text/html; charset=windows-1252 Content-Transfer-Encoding: 8bit
Brian,

It seems that you missed two of my messages sent to the list on November 31, 2016 and on December 21, 2016
under the subject "WGLC on draft-ietf-tokbind-https".

This approach is not resistant to the ABC attack (Alice and Bob collusion attack).
In this attack, Bob who is older than 18 collaborates with Alice and transmits an access token
to Alice who is only 14 so that she can demonstrate to a RS that she is older than 18.

This kind of attack is not mentioned in the security considerations section.

Would you be able to respond to these emails ?

Denis

https://tools.ietf.org/html/draft-ietf-tokbind-https-07#section-4 has "See [I-D.ietf-tokbind-protocol] Section 6 for general guidance regarding binding of security tokens and their subsequent validation" but Section 6 is IANA Considerations. I believe it should refer to Section 5. Bound Security Token Creation and Validation.

I created https://github.com/TokenBinding/Internet-Drafts/issues/91 for it. But posting here too 'cause Leif said it doesn't count unless it's on the list ;) 


_______________________________________________
Unbearable mailing list
Unbearable@ietf.org
https://www.ietf.org/mailman/listinfo/unbearable


--------------FEF0A226420DD9A7BD4DDC19-- From nobody Fri Dec 30 09:13:35 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 611F0128AC9 for ; Fri, 30 Dec 2016 09:13:34 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=pingidentity.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id meMHM4V9EanE for ; Fri, 30 Dec 2016 09:13:32 -0800 (PST) Received: from mail-io0-x236.google.com (mail-io0-x236.google.com [IPv6:2607:f8b0:4001:c06::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A92281293E3 for ; Fri, 30 Dec 2016 09:13:32 -0800 (PST) Received: by mail-io0-x236.google.com with SMTP id n85so141533194ioi.2 for ; Fri, 30 Dec 2016 09:13:32 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=pingidentity.com; s=gmail; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=ZXwdr7KPOQKl9ifBcf66O1agB9/eIyDFbj/JhldAUS8=; b=XKIF7l7cBHltQxWp3rQr6W8SpywtuT6sT41o1r6qg1pu/DTFW4S2EvGAkabcJKLDMZ 9mlIrXuzRV/kZ3wim6wLTxKwP188g8sRKzhfFlHUKBmRMFk5n92/oniPycSiASYHVXx9 XMf2nEd7R1SWG8JlosJzA4NiQVw7ZRXJfW3bA= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=ZXwdr7KPOQKl9ifBcf66O1agB9/eIyDFbj/JhldAUS8=; b=JnsHhTxG+AhVPoS54xnh5Z//I5EgQMhJNCKj3aEtHtt3EnTTvcN18QBlwULBgFpYDV Ty3eJVJ+1gOIH1yCJc0W0OS5rYGuYhanJPjtxACdwonCWYv1w9K4tyH/bLddm1i5SROo yqsmFpzYOJapcL2DOB0G8ALeMsxJCwvOXFn9s1CGrXmYN0y3jnh8sdB8Be73UfuvdnYo SvNwb0nOGI6MaXVt9dwaXIBKs7o20z+swE8ulZcwAJfMJhFbZfzohtd1RyqqsFIaUhn5 dR6N6wh86tCl3G/5GCPz+m5Rlmc3ng2qHb3a40ZEjYANFh5MykT0L4RsEMkDdnj74+pW L6Zg== X-Gm-Message-State: AIkVDXKoS37PllI7Bs5vIXm3+42JtWPwTPwzXW7xcPbDtTHqeZkhhifuFv2FmKElfS9jFePRF26GNPUVw+zi1aX4 X-Received: by 10.107.181.213 with SMTP id e204mr27481294iof.156.1483118011831; Fri, 30 Dec 2016 09:13:31 -0800 (PST) MIME-Version: 1.0 Received: by 10.79.31.5 with HTTP; Fri, 30 Dec 2016 09:13:01 -0800 (PST) In-Reply-To: <054a4303-e8d9-5fc2-bb7f-6c6ae0b978cf@free.fr> References: <054a4303-e8d9-5fc2-bb7f-6c6ae0b978cf@free.fr> From: Brian Campbell Date: Fri, 30 Dec 2016 10:13:01 -0700 Message-ID: To: Denis Content-Type: multipart/alternative; boundary=001a11444e644172170544e35208 Archived-At: Cc: IETF Tokbind WG Subject: Re: [Unbearable] reference in HTTPSTB to TBPROTO out of sync X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 30 Dec 2016 17:13:34 -0000 --001a11444e644172170544e35208 Content-Type: text/plain; charset=UTF-8 Denis, I sent a message aiming to correct a minor inconsistency in the section numbering of two of the WG documents. What about that suggested to you that I should be singled out as responsible for responding to the pet issue that you've been pushing? I did not miss the many messages you've sent. I just didn't feel that it is was necessarily my place to respond. But because you've asked me directly, I will say that I don't believe that explicitly preventing or even mentioning the so called "ABC attack" is in scope for this work. It's not in the charter and isn't part of a threat model that's particularly relevant to most applications and/or isn't already addressed by the inclusion of other specific identity attributes in (or referenced by) the application specific security tokens. On Fri, Dec 30, 2016 at 2:25 AM, Denis wrote: > Brian, > > It seems that you missed two of my messages sent to the list on November > 31, 2016 and on December 21, 2016 > under the subject "WGLC on draft-ietf-tokbind-https". > > This approach is not resistant to the ABC attack (Alice and Bob collusion > attack). > In this attack, Bob who is older than 18 collaborates with Alice and > transmits an access token > to Alice who is only 14 so that she can demonstrate to a RS that she is > older than 18. > > This kind of attack is not mentioned in the security considerations > section. > > Would you be able to respond to these emails ? > > Denis > > https://tools.ietf.org/html/draft-ietf-tokbind-https-07#section-4 has > "See [I-D.ietf-tokbind-protocol] Section 6 for general guidance regarding > binding of security tokens and their subsequent validation" but Section 6 > is IANA Considerations. I believe it should refer to Section 5. Bound > Security Token Creation and Validation. > > I created https://github.com/TokenBinding/Internet-Drafts/issues/91 for > it. But posting here too 'cause Leif said it doesn't count unless it's on > the list ;) > > > _______________________________________________ > Unbearable mailing listUnbearable@ietf.orghttps://www.ietf.org/mailman/listinfo/unbearable > > > --001a11444e644172170544e35208 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Denis,

I sent a message aiming= to correct a minor inconsistency in the section numbering of two of the WG= documents. What about that suggested to you that I should be singled out a= s responsible for responding to the pet issue that you've been pushing?=

I did not miss the many messages you've sent. I just didn= 't feel that it is was necessarily my place to respond. But because you= 've asked me directly, I will say that I don't believe that explici= tly preventing or even mentioning the so called "= ABC attack" is in scope for this work. It's not in the charter and= isn't part of a threat model that's particularly relevant to most = applications and/or isn't already addressed by the inclusion of other s= pecific identity attributes in (or referenced by) the application specific = security tokens.

=C2=A0
=

=C2=A0

On Fri, Dec 30, 2016 at 2:25 AM, Denis <denis.ietf@free.fr>= ; wrote:
=20 =20 =20
Brian,

It seems that you missed two of my messages sent to the list on November 31, 2016 and on December 21, 2016
under the subject "WGLC on draft-ietf-tokbind-https".

This approach is not resistant to the ABC attack (Alice and Bob collusion attack).
In this attack, Bob who is older than 18 collaborates with Alice and transmits an access token
to Alice who is only 14 so that she can demonstrate to a RS that she is older than 18.

This kind of attack is not mentioned in the security considerations section.

Would you be able to respond to these emails ?

Denis

https://tools.ietf.org/html/draft-ie= tf-tokbind-https-07#section-4 has "See [I-D.ietf-tokbind-protocol] Section 6 for general guidance regarding binding of security tokens and their subsequent validation" but Section 6 is IANA Considerations.= I believe it should refer to Section 5.=C2=A0 Bound Security Token Creation and Validation.

I created https://github.com/TokenBinding/Interne= t-Drafts/issues/91 for it. But posting here too 'cause Leif said it doesn't co= unt unless it's on the list ;) 


_______________________________________________
Unbearable mailing list
Unbearable@ietf.org
https://www.ietf.org/mailman/listinfo/=
unbearable



--001a11444e644172170544e35208-- From nobody Fri Dec 30 09:44:04 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D0C32129451 for ; Fri, 30 Dec 2016 09:44:03 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=ve7jtb-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NRe2FzpcnIha for ; Fri, 30 Dec 2016 09:44:01 -0800 (PST) Received: from mail-qk0-x232.google.com (mail-qk0-x232.google.com [IPv6:2607:f8b0:400d:c09::232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A14A6129452 for ; Fri, 30 Dec 2016 09:44:01 -0800 (PST) Received: by mail-qk0-x232.google.com with SMTP id t184so302712708qkd.0 for ; Fri, 30 Dec 2016 09:44:01 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ve7jtb-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=Vs5OrbU1vOcpO/IKx/ZS9nOT0bSPQSqIFlqOIniWNDg=; b=qRH4lHJPeDTkqpzX1bUgh4NmNJLW+/U2hA60wBObSF9HnbdQd2nJcf/TPUKjckdNLm nOnXLf0jDxwGDn/OZd5H72JYbbtOa4TXl/7UArVUShycR97DEZR+s+QAA6Sro308UmRm MG53gAQkEauBLELz30y8WOK9CBrvffMcz74JKNZ/2ZX0L0x2mzbc3kogtQ+OoZCgGptA igUWV1vFd7UgakQbWOey0h5uPXIo5rPA2P99qr8B94khOsejeYheqy5NydAP4WPVYIl4 qzL9TH1HcUkFrq/ph2dcMCnv6Slv+3V4FfSkrx5Y+FqTKB4cEYKdeJgKfDVCFjmU8hIx E+mw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=Vs5OrbU1vOcpO/IKx/ZS9nOT0bSPQSqIFlqOIniWNDg=; b=mjNicCfEh5KUgsLKPmE/d16WpjWon8VeeW2K7F+6NVStNkqFb5p3fxwOVO9r6lAkkJ U107DrFE61U0Pje3xO/7Yv2NO5Q27fGk1xfuxrMscgQP9evxq/aMigserdsSw0aHLStg UcFQP+2XsTTrraccfkxsbR+s9NDvmJ0JPu1kbH6CIyXxP8ZToqmk+zeiGbc5DV+ckoia WqNyjKo1SLMRbTzGt8D1FCv/f8ToVLWFBtgjihH3ClSa8TCVQOuRWiFizxwJnHMWixkM 1ONSGhXXDmvDnLPxuhy/zkvrKQPI5hLgYAbrhYPxLS5paxw9jLz3icCXH5wSaQiFNhWs XXag== X-Gm-Message-State: AIkVDXL7l1Uj7Y3yEaaWG4gn4YJs+owrsHLm8wdGr9Pq22Xr12uzSjMNT30pocMjrINJ+SD+ X-Received: by 10.55.26.159 with SMTP id l31mr46052785qkh.164.1483119840551; Fri, 30 Dec 2016 09:44:00 -0800 (PST) Received: from [192.168.1.216] ([191.115.153.30]) by smtp.gmail.com with ESMTPSA id h127sm13143215qkd.40.2016.12.30.09.43.58 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 30 Dec 2016 09:44:00 -0800 (PST) From: John Bradley Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_5DE3A947-59A6-463E-B086-7B87D998AA74" Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\)) Date: Fri, 30 Dec 2016 14:43:56 -0300 In-Reply-To: To: Brian Campbell References: <054a4303-e8d9-5fc2-bb7f-6c6ae0b978cf@free.fr> X-Mailer: Apple Mail (2.3259) Archived-At: Cc: IETF Tokbind WG , Denis Subject: Re: [Unbearable] reference in HTTPSTB to TBPROTO out of sync X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 30 Dec 2016 17:44:04 -0000 --Apple-Mail=_5DE3A947-59A6-463E-B086-7B87D998AA74 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 As a reminder this is our charter: = https://datatracker.ietf.org/wg/tokbind/charter/ = Per design objective #1 "Allow applications and services to prevent = unauthorized replay of security tokens.=E2=80=9D The issue that Denis is raising is a collusion attack where Bob = authorizes Alice to use the token by providing key material or a signed = Token Binding header over a EKM provided by Alice. The attack is on the token validator, and not Bob. This working group is not designing a Attribute Based Credential (ABC) = system, token binding might however be used by someone as part of such a = system. I think it would be helpful for the editors if some security = consideration text were proposed to clarify that token binding prevents = unauthorized replay of security tokens but not authorized replay of = security tokens, when there is collusion between the parties. Are there other security concerns related to this that should be = mentioned? Other people are working on the ABC problem eg https://abc4trust.eu/ = . Regards John B. > On Dec 30, 2016, at 2:13 PM, Brian Campbell = wrote: >=20 > Denis, >=20 > I sent a message aiming to correct a minor inconsistency in the = section numbering of two of the WG documents. What about that suggested = to you that I should be singled out as responsible for responding to the = pet issue that you've been pushing? >=20 > I did not miss the many messages you've sent. I just didn't feel that = it is was necessarily my place to respond. But because you've asked me = directly, I will say that I don't believe that explicitly preventing or = even mentioning the so called "ABC attack" is in scope for this work. = It's not in the charter and isn't part of a threat model that's = particularly relevant to most applications and/or isn't already = addressed by the inclusion of other specific identity attributes in (or = referenced by) the application specific security tokens. >=20 > =20 >=20 > =20 >=20 > On Fri, Dec 30, 2016 at 2:25 AM, Denis > wrote: > Brian, >=20 > It seems that you missed two of my messages sent to the list on = November 31, 2016 and on December 21, 2016=20 > under the subject "WGLC on draft-ietf-tokbind-https". >=20 > This approach is not resistant to the ABC attack (Alice and Bob = collusion attack). > In this attack, Bob who is older than 18 collaborates with Alice and = transmits an access token=20 > to Alice who is only 14 so that she can demonstrate to a RS that she = is older than 18. >=20 > This kind of attack is not mentioned in the security considerations = section. >=20 > Would you be able to respond to these emails ? >=20 > Denis >=20 >> https://tools.ietf.org/html/draft-ietf-tokbind-https-07#section-4 = has = "See [I-D.ietf-tokbind-protocol] Section 6 for general guidance = regarding binding of security tokens and their subsequent validation" = but Section 6 is IANA Considerations. I believe it should refer to = Section 5. Bound Security Token Creation and Validation. >>=20 >> I created https://github.com/TokenBinding/Internet-Drafts/issues/91 = for it. But = posting here too 'cause Leif said it doesn't count unless it's on the = list ;)=20 >>=20 >>=20 >> _______________________________________________ >> Unbearable mailing list >> Unbearable@ietf.org >> https://www.ietf.org/mailman/listinfo/unbearable = >=20 >=20 > _______________________________________________ > Unbearable mailing list > Unbearable@ietf.org > https://www.ietf.org/mailman/listinfo/unbearable --Apple-Mail=_5DE3A947-59A6-463E-B086-7B87D998AA74 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 As a reminder this is our charter: https://datatracker.ietf.org/wg/tokbind/charter/

Per design objective #1 = "Allow applications and services to prevent unauthorized = replay of security tokens.=E2=80=9D

The issue that Denis is raising is a = collusion attack where Bob authorizes Alice to use the token by = providing key material or a signed Token Binding header over a EKM = provided by Alice.
The attack is on the token validator, and not Bob.

This working group is not designing a Attribute Based = Credential (ABC) system, token binding might however be used by someone = as part of such a system.

I think it would be helpful for the editors if = some security consideration text were proposed to clarify that token = binding prevents unauthorized replay of security tokens but not = authorized replay of security tokens, when there is collusion between = the parties.

Are there other security concerns related to this that = should be mentioned?

Other people are working on the ABC problem eg https://abc4trust.eu/.

Regards
John B.


On Dec 30, 2016, at 2:13 PM, Brian Campbell <bcampbell@pingidentity.com> wrote:

Denis,

I sent a message aiming to correct a = minor inconsistency in the section numbering of two of the WG documents. = What about that suggested to you that I should be singled out as = responsible for responding to the pet issue that you've been pushing?

I did not miss the many messages you've = sent. I just didn't feel that it is was necessarily my place to respond. = But because you've asked me directly, I will say that I don't believe = that explicitly preventing or even mentioning the so called "ABC attack" is in scope for this work. It's = not in the charter and isn't part of a threat model that's particularly = relevant to most applications and/or isn't already addressed by the = inclusion of other specific identity attributes in (or referenced by) = the application specific security tokens.

 

 

On Fri, Dec 30, 2016 at 2:25 AM, = Denis <denis.ietf@free.fr> wrote:
=20 =20 =20
Brian,

It seems that you missed two of my messages sent to the list on November 31, 2016 and on December 21, 2016
under the subject "WGLC on draft-ietf-tokbind-https".

This approach is not resistant to the ABC attack (Alice and Bob collusion attack).
In this attack, Bob who is older than 18 collaborates with Alice and transmits an access token
to Alice who is only 14 so that she can demonstrate to a RS that she is older than 18.

This kind of attack is not mentioned in the security considerations section.

Would you be able to respond to these emails ?

Denis

https://tools.ietf.org/html/draft-ietf-tokbind-https-07#section-4 has "See [I-D.ietf-tokbind-protocol] Section 6 for general guidance regarding binding of security tokens and their subsequent validation" but Section 6 is IANA Considerations. I believe it should refer to Section 5.  Bound Security = Token Creation and Validation.

I created https://github.com/TokenBinding/Internet-Drafts/issues/91 for it. But posting here too 'cause Leif said it doesn't count unless it's on the list ;) 


_______________________________________________
Unbearable mailing list
Unbearable@ietf.org
https://www.ietf.org/mailman/listinfo/unbearable



_______________________________________________
Unbearable = mailing list
Unbearable@ietf.org
https://www.ietf.org/mailman/listinfo/unbearable

= --Apple-Mail=_5DE3A947-59A6-463E-B086-7B87D998AA74-- From nobody Fri Dec 30 10:14:21 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 55E551294C5 for ; Fri, 30 Dec 2016 10:14:19 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.598 X-Spam-Level: X-Spam-Status: No, score=-2.598 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VYOkAWzCgb5v for ; Fri, 30 Dec 2016 10:14:16 -0800 (PST) Received: from smtp6-g21.free.fr (smtp6-g21.free.fr [IPv6:2a01:e0c:1:1599::15]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 65B741294B0 for ; Fri, 30 Dec 2016 10:14:16 -0800 (PST) Received: from [192.168.0.13] (unknown [88.182.125.39]) by smtp6-g21.free.fr (Postfix) with ESMTP id 9EC717803C8; Fri, 30 Dec 2016 19:14:11 +0100 (CET) To: John Bradley , Brian Campbell References: <054a4303-e8d9-5fc2-bb7f-6c6ae0b978cf@free.fr> From: Denis Message-ID: <0adfc4ff-2a50-9cd3-060d-f9739986a236@free.fr> Date: Fri, 30 Dec 2016 19:14:13 +0100 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.5.1 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/alternative; boundary="------------715C877B2380D1BC19F866B2" Archived-At: Cc: IETF Tokbind WG Subject: Re: [Unbearable] reference in HTTPSTB to TBPROTO out of sync X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 30 Dec 2016 18:14:19 -0000 This is a multi-part message in MIME format. --------------715C877B2380D1BC19F866B2 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Brian and John, It is indeed within the terms of reference of the charter of this WG. Hereafter is a copy and paste of two sentences from the charter available at: https://datatracker.ietf.org/wg/tokbind/charter/ It is a goal of this working group to enable defense against attacks that involve unauthorized replay of security tokens. Other issues associated with the use of security tokens are out of scope. Another goal of this working group is to design the Token Binding protocol such that it would be also useable with application protocols *other than HTTPS*. The second task of the group which happened to be "Specify the use of the Token Binding protocol in combination with HTTPS" failed to meet the terms of the charter, since it is not resistant to the ABC attack. So a Token Binding protocol "useable with application protocols other than HTTPS" should be considered. I am not asking in any way to consider in this WG Attribute Based Credential (ABC) systems, like Idemix from IBM or U-Prove from Microsoft. For your information, both Idemix from IBM and U-Prove from Microsoft are subject to the ABC attack, since when used with secure elements, only the secrets keys are protected. In the case of the ABC attack, Bob can still perform all the computations that Alice needs. The protection of secret keys in secure elements or HSMs is thus insufficient. I contacted the two project leaders (one by phone, the other one by email) and they both turned a blind eye to this issue and hid their heads in the sand. Denis > As a reminder this is our charter: > https://datatracker.ietf.org/wg/tokbind/charter/ > > Per design objective #1 "Allow applications and services to prevent > unauthorized replay of security tokens.” > > The issue that Denis is raising is a collusion attack where Bob > authorizes Alice to use the token by providing key material or a > signed Token Binding header over a EKM provided by Alice. > The attack is on the token validator, and not Bob. > > This working group is not designing a Attribute Based Credential (ABC) > system, token binding might however be used by someone as part of such > a system. > > I think it would be helpful for the editors if some security > consideration text were proposed to clarify that token binding > prevents unauthorized replay of security tokens but not authorized > replay of security tokens, when there is collusion between the parties. > > Are there other security concerns related to this that should be > mentioned? > > Other people are working on the ABC problem eg https://abc4trust.eu/. > > Regards > John B. > > >> On Dec 30, 2016, at 2:13 PM, Brian Campbell >> > wrote: >> >> Denis, >> >> I sent a message aiming to correct a minor inconsistency in the >> section numbering of two of the WG documents. What about that >> suggested to you that I should be singled out as responsible for >> responding to the pet issue that you've been pushing? >> >> I did not miss the many messages you've sent. I just didn't feel that >> it is was necessarily my place to respond. But because you've asked >> me directly, I will say that I don't believe that explicitly >> preventing or even mentioning the so called "ABC attack" is in scope >> for this work. It's not in the charter and isn't part of a threat >> model that's particularly relevant to most applications and/or isn't >> already addressed by the inclusion of other specific identity >> attributes in (or referenced by) the application specific security >> tokens. >> >> >> >> >> >> On Fri, Dec 30, 2016 at 2:25 AM, Denis > > wrote: >> >> Brian, >> >> It seems that you missed two of my messages sent to the list on >> November 31, 2016 and on December 21, 2016 >> under the subject "WGLC on draft-ietf-tokbind-https". >> >> This approach is not resistant to the ABC attack (Alice and Bob >> collusion attack). >> In this attack, Bob who is older than 18 collaborates with Alice >> and transmits an access token >> to Alice who is only 14 so that she can demonstrate to a RS that >> she is older than 18. >> >> This kind of attack is not mentioned in the security >> considerations section. >> >> Would you be able to respond to these emails ? >> >> Denis >> >>> https://tools.ietf.org/html/draft-ietf-tokbind-https-07#section-4 >>> >>> has "See [I-D.ietf-tokbind-protocol] Section 6 for general >>> guidance regarding binding of security tokens and their >>> subsequent validation" but Section 6 is IANA Considerations. I >>> believe it should refer to Section 5. Bound Security Token >>> Creation and Validation. >>> >>> I created >>> https://github.com/TokenBinding/Internet-Drafts/issues/91 >>> for >>> it. But posting here too 'cause Leif said it doesn't count >>> unless it's on the list ;) >>> >>> >>> _______________________________________________ >>> Unbearable mailing list >>> Unbearable@ietf.org >>> https://www.ietf.org/mailman/listinfo/unbearable >>> >> >> _______________________________________________ Unbearable mailing >> list Unbearable@ietf.org >> https://www.ietf.org/mailman/listinfo/unbearable --------------715C877B2380D1BC19F866B2 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 8bit
Brian and John,

It is indeed within the terms of reference of the charter of this WG. Hereafter is a copy and paste of two sentences from the charter
available at: https://datatracker.ietf.org/wg/tokbind/charter/

It is a goal of this working group to enable defense against attacks that involve unauthorized replay of security tokens.
Other issues associated with the use of security tokens are out of scope. Another goal of this working group is to design
the Token Binding protocol such that it would be also useable with application protocols other than HTTPS.

The second task of the group which happened to be "Specify the use of the Token Binding protocol in combination with HTTPS"
failed to meet the terms of the charter, since it is not resistant to the ABC attack.

So a Token Binding protocol "useable with application protocols other than HTTPS" should be considered.

I am not asking in any way to consider in this WG Attribute Based Credential (ABC) systems, like Idemix from IBM or U-Prove from Microsoft.

For your information, both Idemix from IBM and U-Prove from Microsoft are subject to the ABC attack, since when used with secure elements,
only the secrets keys are protected. In the case of the ABC attack, Bob can still perform all the computations that Alice needs. The protection
of secret keys in secure elements or HSMs is thus insufficient.

I contacted the two project leaders (one by phone, the other one by email) and they both turned a blind eye to this issue
and hid their heads in the sand.

 Denis

As a reminder this is our charter: https://datatracker.ietf.org/wg/tokbind/charter/

Per design objective #1 "Allow applications and services to prevent unauthorized replay of security tokens.”

The issue that Denis is raising is a collusion attack where Bob authorizes Alice to use the token by providing key material or a signed Token Binding header over a EKM provided by Alice.
The attack is on the token validator, and not Bob.

This working group is not designing a Attribute Based Credential (ABC) system, token binding might however be used by someone as part of such a system.

I think it would be helpful for the editors if some security consideration text were proposed to clarify that token binding prevents unauthorized replay of security tokens but not authorized replay of security tokens, when there is collusion between the parties.

Are there other security concerns related to this that should be mentioned?

Other people are working on the ABC problem eg https://abc4trust.eu/.

Regards
John B.


On Dec 30, 2016, at 2:13 PM, Brian Campbell <bcampbell@pingidentity.com> wrote:

Denis,

I sent a message aiming to correct a minor inconsistency in the section numbering of two of the WG documents. What about that suggested to you that I should be singled out as responsible for responding to the pet issue that you've been pushing?

I did not miss the many messages you've sent. I just didn't feel that it is was necessarily my place to respond. But because you've asked me directly, I will say that I don't believe that explicitly preventing or even mentioning the so called "ABC attack" is in scope for this work. It's not in the charter and isn't part of a threat model that's particularly relevant to most applications and/or isn't already addressed by the inclusion of other specific identity attributes in (or referenced by) the application specific security tokens.

 

 

On Fri, Dec 30, 2016 at 2:25 AM, Denis <denis.ietf@free.fr> wrote:
Brian,

It seems that you missed two of my messages sent to the list on November 31, 2016 and on December 21, 2016
under the subject "WGLC on draft-ietf-tokbind-https".

This approach is not resistant to the ABC attack (Alice and Bob collusion attack).
In this attack, Bob who is older than 18 collaborates with Alice and transmits an access token
to Alice who is only 14 so that she can demonstrate to a RS that she is older than 18.

This kind of attack is not mentioned in the security considerations section.

Would you be able to respond to these emails ?

Denis

https://tools.ietf.org/html/draft-ietf-tokbind-https-07#section-4 has "See [I-D.ietf-tokbind-protocol] Section 6 for general guidance regarding binding of security tokens and their subsequent validation" but Section 6 is IANA Considerations. I believe it should refer to Section 5.  Bound Security Token Creation and Validation.

I created https://github.com/TokenBinding/Internet-Drafts/issues/91 for it. But posting here too 'cause Leif said it doesn't count unless it's on the list ;) 


_______________________________________________
Unbearable mailing list
Unbearable@ietf.org
https://www.ietf.org/mailman/listinfo/unbearable

_______________________________________________ Unbearable mailing list Unbearable@ietf.org https://www.ietf.org/mailman/listinfo/unbearable

--------------715C877B2380D1BC19F866B2-- From nobody Fri Dec 30 14:08:49 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 58E1F129623 for ; Fri, 30 Dec 2016 14:08:47 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.402 X-Spam-Level: X-Spam-Status: No, score=-1.402 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, RCVD_IN_SORBS_SPAM=0.5, SPF_PASS=-0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9hVzaJox5yjU for ; Fri, 30 Dec 2016 14:08:46 -0800 (PST) Received: from gproxy6-pub.mail.unifiedlayer.com (gproxy6-pub.mail.unifiedlayer.com [67.222.39.168]) by ietfa.amsl.com (Postfix) with SMTP id 5B234129617 for ; Fri, 30 Dec 2016 14:08:46 -0800 (PST) Received: (qmail 23099 invoked by uid 0); 30 Dec 2016 22:07:52 -0000 Received: from unknown (HELO CMOut01) (10.0.90.82) by gproxy6.mail.unifiedlayer.com with SMTP; 30 Dec 2016 22:07:52 -0000 Received: from box514.bluehost.com ([74.220.219.114]) by CMOut01 with id SN7m1u00c2UhLwi01N7pJm; Fri, 30 Dec 2016 15:07:50 -0700 X-Authority-Analysis: v=2.1 cv=U4oBU4bu c=1 sm=1 tr=0 a=9W6Fsu4pMcyimqnCr1W0/w==:117 a=9W6Fsu4pMcyimqnCr1W0/w==:17 a=L9H7d07YOLsA:10 a=9cW_t1CCXrUA:10 a=s5jvgZ67dGcA:10 a=IkcTkHD0fZMA:10 a=n5n_aSjo0skA:10 a=48vgC7mUAAAA:8 a=VrpkVSdPDwg2p0tPT34A:9 a=QEXdDO2ut3YA:10 a=B7WOQvVZSQ8A:10 a=0HVE76H6kAUA:10 a=w1C3t2QeGrPiZgrLijVG:22 Received: from [173.224.162.69] (port=12944 helo=[10.225.80.16]) by box514.bluehost.com with esmtpsa (TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128) (Exim 4.86_1) (envelope-from ) id 1cN5L1-000629-VX; Fri, 30 Dec 2016 15:07:47 -0700 From: =JeffH To: John Bradley Message-ID: Date: Fri, 30 Dec 2016 14:07:46 -0800 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:45.0) Gecko/20100101 Thunderbird/45.5.1 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - box514.bluehost.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - KingsMountain.com X-BWhitelist: no X-Source-IP: 173.224.162.69 X-Exim-ID: 1cN5L1-000629-VX X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: ([10.225.80.16]) [173.224.162.69]:12944 X-Source-Auth: jeff.hodges+kingsmountain.com X-Email-Count: 2 X-Source-Cap: a2luZ3Ntb3U7a2luZ3Ntb3U7Ym94NTE0LmJsdWVob3N0LmNvbQ== Archived-At: Cc: IETF TokBind WG Subject: Re: [Unbearable] Alice & Bob Collusion (ABC) attack (was: reference in HTTPSTB to TBPROTO out of sync X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 30 Dec 2016 22:08:47 -0000 > I think it would be helpful for the editors if some security > consideration text were proposed to clarify that token binding > prevents unauthorized replay of security tokens but not authorized > replay of security tokens, when there is collusion between the > parties. sounds nominally reasonable to me. see also.. Re: [Unbearable] Re : Re : Answer to WGLC for core document set https://www.ietf.org/mail-archive/web/unbearable/current/msg01018.html =JeffH From nobody Fri Dec 30 15:18:36 2016 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 25D98129462 for ; Fri, 30 Dec 2016 15:18:35 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.003 X-Spam-Level: X-Spam-Status: No, score=-2.003 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id P6XFQ_6lXIA6 for ; Fri, 30 Dec 2016 15:18:33 -0800 (PST) Received: from NAM03-BY2-obe.outbound.protection.outlook.com (mail-by2nam03on0107.outbound.protection.outlook.com [104.47.42.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 990AC126BF6 for ; Fri, 30 Dec 2016 15:18:33 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=HtU541g5ZLH1VRz5QQ1sXoUpU6FX32WQR4DvL0OQAVI=; b=M1Nalfr6xUVM88gBcRvTCtW5pD90lwD5UDmLC68vv9xMCeUV4UUEkjeXaw8b5ftdBCxLvUQasaXPZJ9uHmMLLVFLLDZ6mgYnewgz385TYDxDALysoIRr+qYWQjUwQoX1nPh3qIc3Wqhn6WLVqO3KlLrlXseQ3GNwyKcoMQaq/PU= Received: from CY1PR0301MB0842.namprd03.prod.outlook.com (10.160.163.148) by CY1PR0301MB0841.namprd03.prod.outlook.com (10.160.163.147) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.803.11; Fri, 30 Dec 2016 23:18:32 +0000 Received: from CY1PR0301MB0842.namprd03.prod.outlook.com ([10.160.163.148]) by CY1PR0301MB0842.namprd03.prod.outlook.com ([10.160.163.148]) with mapi id 15.01.0803.021; Fri, 30 Dec 2016 23:18:32 +0000 From: Andrei Popov To: =JeffH , John Bradley , "denis.ietf@free.fr" Thread-Topic: [Unbearable] Alice & Bob Collusion (ABC) attack (was: reference in HTTPSTB to TBPROTO out of sync Thread-Index: AQHSYulQFDBG6suMH0y8ySduCzbboKEhH5xQ Date: Fri, 30 Dec 2016 23:18:31 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Andrei.Popov@microsoft.com; x-originating-ip: [50.46.229.189] x-ms-office365-filtering-correlation-id: fef980a7-1cb8-482e-c596-08d4310a2bed x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001); SRVR:CY1PR0301MB0841; x-microsoft-exchange-diagnostics: 1; CY1PR0301MB0841; 7:5OoTZ8jhzE5OE6jaGThNM+TCwYrzC8kiMx5YUaDKfAadcV8/MhoWGsm9W3+qYLPx+2siBMZxH4hRJ4ARqdmqjSrTI7eNsLEpchWCPzNP+S+4nN4BPfXKS73cMG+1Ru/zBsdy9+HF56Jiaok4TLMikttYYEUCmJgsOsOWOz+pmceI2smHWiKiK2Ir9lSY744fGRarH9UNG9D8saMoghp5cnD0jA10QlBH9K2O2nNVPIXLzOTMtUe3EOfgCKcPp33WB34jR6pSCdnIAjkaML8y/qCm2WgrmEo6zvEkh541WpEwQjBegDYszGxllMu2vYcvR8DrFglLCMc6THzCpxAHOMuRDSTWpWYg7EvX8OGleIt0qhL1vv05bwzl+w0Pvjb//fZMtgpwmFZIr5hYoJB4aHQW08YB6/hRB1ERHC/1b9edtNuyRZvDh1vhVW6bAky5TbeqOWb2NoQWiJjBZHQuhmP2TJAWBCtPjNaaJbpihoU= x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(192374486261705); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040375)(601004)(2401047)(8121501046)(5005006)(3002001)(10201501046)(6055026)(61426038)(61427038)(6041248)(20161123564025)(20161123562025)(20161123555025)(20161123560025)(6072148)(6047074); SRVR:CY1PR0301MB0841; BCL:0; PCL:0; RULEID:; SRVR:CY1PR0301MB0841; x-forefront-prvs: 0172F0EF77 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(979002)(6009001)(7916002)(39450400003)(39840400002)(39850400002)(39860400002)(39410400002)(199003)(377454003)(189002)(13464003)(3280700002)(3660700001)(55016002)(2906002)(86362001)(10290500002)(122556002)(86612001)(5001770100001)(4326007)(7736002)(5660300001)(2900100001)(189998001)(74316002)(7696004)(97736004)(305945005)(99286003)(2501003)(10090500001)(8676002)(229853002)(106116001)(8936002)(66066001)(6436002)(81156014)(33656002)(4000630100001)(81166006)(9686002)(2950100002)(92566002)(6506006)(6116002)(76176999)(77096006)(50986999)(25786008)(105586002)(38730400001)(54356999)(102836003)(3846002)(5005710100001)(106356001)(101416001)(8990500004)(68736007)(969003)(989001)(999001)(1009001)(1019001); DIR:OUT; SFP:1102; SCL:1; SRVR:CY1PR0301MB0841; H:CY1PR0301MB0842.namprd03.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; A:1; MX:1; LANG:en; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 30 Dec 2016 23:18:32.0297 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY1PR0301MB0841 Archived-At: Cc: IETF TokBind WG Subject: Re: [Unbearable] Alice & Bob Collusion (ABC) attack (was: reference in HTTPSTB to TBPROTO out of sync X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 30 Dec 2016 23:18:35 -0000 I will not object against adding a mention of collusion between clients to = the security considerations in TBPROTO, if folks think this is useful. Denis, please feel free to suggest text (as a PR or in e-mail), so that the= WG can consider. Cheers, Andrei -----Original Message----- From: Unbearable [mailto:unbearable-bounces@ietf.org] On Behalf Of =3DJeffH Sent: Friday, December 30, 2016 2:08 PM To: John Bradley Cc: IETF TokBind WG Subject: Re: [Unbearable] Alice & Bob Collusion (ABC) attack (was: referenc= e in HTTPSTB to TBPROTO out of sync > I think it would be helpful for the editors if some security > consider= ation text were proposed to clarify that token binding > prevents unauthor= ized replay of security tokens but not authorized > replay of security tok= ens, when there is collusion between the > parties. sounds nominally reasonable to me. see also.. Re: [Unbearable] Re : Re : Answer to WGLC for core document set https://www= .ietf.org/mail-archive/web/unbearable/current/msg01018.html =3DJeffH =09 _______________________________________________ Unbearable mailing list Unbearable@ietf.org https://www.ietf.org/mailman/listinfo/unbearable