From nobody Wed Jun 3 06:34:55 2015 Return-Path: X-Original-To: vot@ietfa.amsl.com Delivered-To: vot@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9A91B1A8865 for ; Wed, 3 Jun 2015 06:34:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.511 X-Spam-Level: X-Spam-Status: No, score=-1.511 tagged_above=-999 required=5 tests=[BAYES_50=0.8, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iUSV18wxj03n for ; Wed, 3 Jun 2015 06:34:51 -0700 (PDT) Received: from dmz-mailsec-scanner-8.mit.edu (dmz-mailsec-scanner-8.mit.edu [18.7.68.37]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CCDDA1A8862 for ; Wed, 3 Jun 2015 06:34:50 -0700 (PDT) X-AuditID: 12074425-f79076d000000db5-ee-556f027954d8 Received: from mailhub-auth-3.mit.edu ( [18.9.21.43]) (using TLS with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by dmz-mailsec-scanner-8.mit.edu (Symantec Messaging Gateway) with SMTP id 89.12.03509.9720F655; Wed, 3 Jun 2015 09:34:49 -0400 (EDT) Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) by mailhub-auth-3.mit.edu (8.13.8/8.9.2) with ESMTP id t53DYmb2002955 for ; Wed, 3 Jun 2015 09:34:49 -0400 Received: from [192.168.128.56] (static-96-237-195-53.bstnma.fios.verizon.net [96.237.195.53]) (authenticated bits=0) (User authenticated as jricher@ATHENA.MIT.EDU) by outgoing.mit.edu (8.13.8/8.12.4) with ESMTP id t53DYlYf021182 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES128-SHA bits=128 verify=NOT) for ; Wed, 3 Jun 2015 09:34:48 -0400 Message-ID: <556F0271.5000009@mit.edu> Date: Wed, 03 Jun 2015 09:34:41 -0400 From: Justin Richer User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Thunderbird/31.7.0 MIME-Version: 1.0 To: vot@ietf.org Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFjrBIsWRmVeSWpSXmKPExsUixCmqrVvJlB9qsOeuskXDzwesDoweS5b8 ZApgjOKySUnNySxLLdK3S+DK2ProIXPBJemKeS2/2BsY74h1MXJySAiYSOy++YAFwhaTuHBv PVsXIxeHkMBiJomDl5ewgiSEBA4zSkzaogmReMsk0TX5HFAHBwevgJrEquuBICaLgKrEv61G IOVsQOb0NS1MILaoQJTE1MfrwObzCghKnJz5BMwWERCQ6Fn8gx3EFhawl3i1+xsbiM0sYCYx b/NDZghbXqJ562zmCYx8s5C0z0JSNgtJ2QJG5lWMsim5Vbq5iZk5xanJusXJiXl5qUW6Fnq5 mSV6qSmlmxhBAcbuorqDccIhpUOMAhyMSjy8DmF5oUKsiWXFlbmHGCU5mJREedd8AQrxJeWn VGYkFmfEF5XmpBYfYpTgYFYS4X35DijHm5JYWZValA+TkuZgURLn3fSDL0RIID2xJDU7NbUg tQgmK8PBoSTBG8SYHyokWJSanlqRlplTgpBm4uAEGc4DNHw6SA1vcUFibnFmOkT+FKOilDhv FEhCACSRUZoH1wtLAK8YxYFeEebNAaniASYPuO5XQIOZgAa3C+SADC5JREhJNTCGBhXMONap uvXvpiLbrULbelh2TCxv2cxX4/Pts+zbzpevHvqF3K7PY244a+LC01/a5pUfsfl74qoXC1uW +Mp4SlZ4/ZWaKP3KzsCxmcP5y261wB3Ru/XzxdMSzOXfub/b3PVx+oG7djYb1mslCy16eWNG psjtl0rWVt/PL1v+5PnJO9LaBzcosRRnJBpqMRcVJwIA9OkCX9sCAAA= Archived-At: Subject: [VoT] Trust Frameworks: The anchor point of vectors of trust X-BeenThere: vot@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Vectors of Trust discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 03 Jun 2015 13:34:53 -0000 As I’ve been working through the VoT concept more recently, it’s becoming clearer to me that the vectors themselves always need to be anchored in the context of some kind of trust framework agreement in order for them to make any sense at all. Now, this could be something as simple as “I’m an RP that’s been configured to trust this particular IdP no matter what it says”, or it could be something much more complex, like what the folks at GTRI have been working on for years now. [1] In the original strawman, we proposed that there would be a “trustmark” discovery component that would allow the RP to do some processing on the request and make some reasonable decisions as to what to do with the vector information. After digging into this more, and talking with a number of people about this, I think we can take that a step further. I’m proposing that we define the values of the components in the context of trust frameworks, with a VoT IETF document itself acting as a “reasonable default” definition of these values that other trust frameworks can use. One of the reasons that I’m looking to this approach is that there have been and will continue to be a lot of contentious arguments about the contents of these vector components. There are bound to be many context-sensitive and implementation-specific details that go into defining whether or not, for instance, a shared password of a particular entropy value qualifies as “C2" or not. So does this mean we’re punting on core functionality and pushing it off to a nebulous “trust framework” definition? What does the VoT draft itself bring to the table, then? I think that it brings a few very valuable things: - A set of well-defined component categories (proofing, credentialing, assertion) - A default (example?) set of elements within those categories - A way of combining components losslessly into a single vector value (the losslessness is very important!!) - A way of communicating vectors across the internet in an authentication transaction - A way of tying the expression of a particular vector in an authentication transaction’s context to a specific trust framework/trustmark definition. It also gives us a chance to ground the trustmark work in a real, modern identity protocol context. I think there’s been a lot of good work done here, and it needs to be expressed in a way that RPs can make sense of it, especially in light of a dynamic world. Take, for example, a user signing into an RP with an IdP that the RP has never heard of before. This is very possible with protocols like OpenID Connect, on a technology level, but it doesn’t give the RP much hope in establishing a trust relationship beyond the basic “you’re probably the server I talked to last time”. But what if the IdP is assessed by a trust framework that the RP knows about? What if the RP can programmatically process the information that the trust framework provides about the IdP? When properly applied, this combination would give us (I believe) the hooks necessary for an RP to drill down into details about specific attributes, if desired. I strongly believe that we don’t want to chuck a ton of attributes and metadata about those attributes (and metadata about the metadata, ad nauseum) along with every authentication transaction. But I do think there’s some value in having that available through clear process grounded in the vector itself. — Justin [1]https://trustmark.gtri.gatech.edu/ From nobody Wed Jun 3 10:29:38 2015 Return-Path: X-Original-To: vot@ietfa.amsl.com Delivered-To: vot@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 15DB81A88BC for ; Wed, 3 Jun 2015 10:29:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.211 X-Spam-Level: X-Spam-Status: No, score=-4.211 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fQNAftV3lT0I for ; Wed, 3 Jun 2015 10:29:35 -0700 (PDT) Received: from smtp01.ees.hhs.gov (smtp.ees.hhs.gov [158.72.139.19]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BB65D1A8A3D for ; Wed, 3 Jun 2015 10:29:23 -0700 (PDT) X-IronPort-AV: E=Sophos;i="5.13,548,1427774400"; d="scan'208";a="352306082" Received: from unknown (HELO pl-emscas12.ees.hhs.gov) ([158.72.139.33]) by smtp01.ees.hhs.gov with ESMTP/TLS/AES128-SHA; 03 Jun 2015 11:43:03 -0400 Received: from PL-EMSMB12.ees.hhs.gov ([158.72.137.102]) by PL-EMSCAS12.ees.hhs.gov ([158.72.137.92]) with mapi id 14.03.0224.002; Wed, 3 Jun 2015 11:43:03 -0400 From: "Bucci, Debbie (OS/ONC)" To: Justin Richer Thread-Topic: [VoT] Trust Frameworks: The anchor point of vectors of trust Thread-Index: AQHQngIV43m8RxaRMUek/2SCwZ5EeJ2a6/Dd Date: Wed, 3 Jun 2015 15:43:02 +0000 Message-ID: <2878234F-3ED5-427F-80EF-5BB13DA9A38E@hhs.gov> References: <556F0271.5000009@mit.edu> In-Reply-To: <556F0271.5000009@mit.edu> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Cc: "vot@ietf.org" Subject: Re: [VoT] Trust Frameworks: The anchor point of vectors of trust X-BeenThere: vot@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Vectors of Trust discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 03 Jun 2015 17:29:38 -0000 +1 Curious .... Does the GTRI work need to be vetted or at lest recognized by = IETF ? Sent from my iPhone > On Jun 3, 2015, at 9:34 AM, Justin Richer wrote: >=20 > As I=92ve been working through the VoT concept more recently, it=92s beco= ming clearer to me that the vectors themselves always need to be anchored i= n the context of some kind of trust framework agreement in order for them t= o make any sense at all. Now, this could be something as simple as =93I=92m= an RP that=92s been configured to trust this particular IdP no matter what= it says=94, or it could be something much more complex, like what the folk= s at GTRI have been working on for years now. [1] >=20 > In the original strawman, we proposed that there would be a =93trustmark= =94 discovery component that would allow the RP to do some processing on th= e request and make some reasonable decisions as to what to do with the vect= or information. After digging into this more, and talking with a number of = people about this, I think we can take that a step further. I=92m proposing= that we define the values of the components in the context of trust framew= orks, with a VoT IETF document itself acting as a =93reasonable default=94 = definition of these values that other trust frameworks can use. >=20 > One of the reasons that I=92m looking to this approach is that there have= been and will continue to be a lot of contentious arguments about the cont= ents of these vector components. There are bound to be many context-sensiti= ve and implementation-specific details that go into defining whether or not= , for instance, a shared password of a particular entropy value qualifies a= s =93C2" or not. >=20 > So does this mean we=92re punting on core functionality and pushing it of= f to a nebulous =93trust framework=94 definition? What does the VoT draft i= tself bring to the table, then? I think that it brings a few very valuable = things: >=20 > - A set of well-defined component categories (proofing, credentialing, as= sertion) > - A default (example?) set of elements within those categories > - A way of combining components losslessly into a single vector value (th= e losslessness is very important!!) > - A way of communicating vectors across the internet in an authentication= transaction > - A way of tying the expression of a particular vector in an authenticati= on transaction=92s context to a specific trust framework/trustmark definiti= on. >=20 > It also gives us a chance to ground the trustmark work in a real, modern = identity protocol context. I think there=92s been a lot of good work done h= ere, and it needs to be expressed in a way that RPs can make sense of it, e= specially in light of a dynamic world. Take, for example, a user signing in= to an RP with an IdP that the RP has never heard of before. This is very po= ssible with protocols like OpenID Connect, on a technology level, but it do= esn=92t give the RP much hope in establishing a trust relationship beyond t= he basic =93you=92re probably the server I talked to last time=94. But what= if the IdP is assessed by a trust framework that the RP knows about? What = if the RP can programmatically process the information that the trust frame= work provides about the IdP? >=20 > When properly applied, this combination would give us (I believe) the hoo= ks necessary for an RP to drill down into details about specific attributes= , if desired. I strongly believe that we don=92t want to chuck a ton of att= ributes and metadata about those attributes (and metadata about the metadat= a, ad nauseum) along with every authentication transaction. But I do think = there=92s some value in having that available through clear process grounde= d in the vector itself. >=20 > =97 Justin >=20 > [1]https://trustmark.gtri.gatech.edu/ >=20 > _______________________________________________ > vot mailing list > vot@ietf.org > https://www.ietf.org/mailman/listinfo/vot From nobody Fri Jun 26 20:15:29 2015 Return-Path: X-Original-To: vot@ietfa.amsl.com Delivered-To: vot@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9298C1B2DA1 for ; Fri, 26 Jun 2015 20:15:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.21 X-Spam-Level: X-Spam-Status: No, score=-4.21 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TMDG8tio4FRN for ; Fri, 26 Jun 2015 20:15:25 -0700 (PDT) Received: from dmz-mailsec-scanner-6.mit.edu (dmz-mailsec-scanner-6.mit.edu [18.7.68.35]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8DDDD1B2D88 for ; Fri, 26 Jun 2015 20:15:15 -0700 (PDT) X-AuditID: 12074423-f79496d000001e58-31-558e15422b36 Received: from mailhub-auth-3.mit.edu ( [18.9.21.43]) (using TLS with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by dmz-mailsec-scanner-6.mit.edu (Symantec Messaging Gateway) with SMTP id 70.D0.07768.2451E855; Fri, 26 Jun 2015 23:15:14 -0400 (EDT) Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) by mailhub-auth-3.mit.edu (8.13.8/8.9.2) with ESMTP id t5R3FDPU012490 for ; Fri, 26 Jun 2015 23:15:14 -0400 Received: from artemisia.richer.local (static-96-237-195-53.bstnma.fios.verizon.net [96.237.195.53]) (authenticated bits=0) (User authenticated as jricher@ATHENA.MIT.EDU) by outgoing.mit.edu (8.13.8/8.12.4) with ESMTP id t5R3FCnt017687 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT) for ; Fri, 26 Jun 2015 23:15:13 -0400 From: Justin Richer Content-Type: multipart/alternative; boundary="Apple-Mail=_EEFE3D9A-4FBD-4FCF-9D62-258AFEB7E48B" Message-Id: <4DF01AF4-CD33-4BB7-958B-FFECD37C8AFE@mit.edu> Date: Fri, 26 Jun 2015 23:15:11 -0400 To: vot@ietf.org Mime-Version: 1.0 (Mac OS X Mail 8.2 \(2098\)) X-Mailer: Apple Mail (2.2098) X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFnrIIsWRmVeSWpSXmKPExsUixCmqresk2hdqcHOeuEXDzwesDoweS5b8 ZApgjOKySUnNySxLLdK3S+DKONjeylRwQbBiTWMjSwPjQv4uRk4OCQETifnPLrBD2GISF+6t Z+ti5OIQEljMJNE17woThHOEUeLy9EdQmS9MEm9PnWUGaWETUJWYv/IWE4jNLJAgcf/NRUYQ W1hAVuLll+VgNq+AlcSupTtYuxg5OFiA6h+sjAMJiwgISPQs/sEOUaIn8ejpY3aQEgmg1q9b 5SYw8s5CMnQWkiqIuLbEsoWvmSFsTYn93ctZMMU1JDq/TWRdwMi2ilE2JbdKNzcxM6c4NVm3 ODkxLy+1SNdMLzezRC81pXQTIygk2V2UdzD+Oah0iFGAg1GJhzfjUm+oEGtiWXFl7iFGSQ4m JVFenWtAIb6k/JTKjMTijPii0pzU4kOMEhzMSiK8VY+BcrwpiZVVqUX5MClpDhYlcd5NP/hC hATSE0tSs1NTC1KLYLIyHBxKErz/hPtChQSLUtNTK9Iyc0oQ0kwcnCDDeYCGh4sA1fAWFyTm FmemQ+RPMSpKifMKgSQEQBIZpXlwvbCU8YpRHOgVYd6dICt4gOkGrvsV0GAmoMFv47tABpck IqSkGhg5uqudNf2nzJ6ffIB1U2HDCXZNlldFrtrzT/BuZ/E3MnfJLvnS0B5jMttOVdzV7mP8 nNTZeXviX27inPvQo1nX7au0yJUDd29Ee1cdSzjDsz9y0TruE6bRTffdCq5/3Xho24fNh/XL +2VvHnqzUfLYq+jtipv9eE84FLi/j9L48Z2l+dkWndNKLMUZiYZazEXFiQDGEXCy9AIAAA== Archived-At: Subject: [VoT] Vectors of Trust I-D X-BeenThere: vot@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Vectors of Trust discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 27 Jun 2015 03:15:27 -0000 --Apple-Mail=_EEFE3D9A-4FBD-4FCF-9D62-258AFEB7E48B Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hi Everyone, I have taken the initial strawman proposal along with a substantial = number of edits and inputs from several folks and have created an = initial I-D of the document: https://tools.ietf.org/id/draft-richer-vectors-of-trust-00 = It=E2=80=99s still a very drafty draft, but hopefully it=E2=80=99s = starting to make this a concrete thing. Please read it over and discuss = it here on the list. I would like to propose a bar-BoF in Prague for VoT for anyone who would = like to discuss this. If you=E2=80=99re interested (and will be there in = person), let me know! =E2=80=94 Justin= --Apple-Mail=_EEFE3D9A-4FBD-4FCF-9D62-258AFEB7E48B Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Hi Everyone,

I have taken the initial strawman proposal along with a = substantial number of edits and inputs from several folks and have = created an initial I-D of the document:

https://tools.ietf.org/id/draft-richer-vectors-of-trust-00<= /div>

It=E2=80=99s = still a very drafty draft, but hopefully it=E2=80=99s starting to make = this a concrete thing. Please read it over and discuss it here on the = list.

I would = like to propose a bar-BoF in Prague for VoT for anyone who would like to = discuss this. If you=E2=80=99re interested (and will be there in = person), let me know!

 =E2=80=94 Justin
= --Apple-Mail=_EEFE3D9A-4FBD-4FCF-9D62-258AFEB7E48B-- From nobody Mon Jun 29 16:14:10 2015 Return-Path: X-Original-To: vot@ietfa.amsl.com Delivered-To: vot@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 817901B2F8A for ; Mon, 29 Jun 2015 16:14:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.383 X-Spam-Level: * X-Spam-Status: No, score=1.383 tagged_above=-999 required=5 tests=[BAYES_50=0.8, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HELO_EQ_BIZ=0.288, HTML_MESSAGE=0.001, MSGID_FROM_MTA_HEADER=0.001, RCVD_IN_DNSWL_LOW=-0.7, RELAY_IS_203=0.994, SPF_HELO_PASS=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JEcM-3xinesC for ; Mon, 29 Jun 2015 16:14:07 -0700 (PDT) Received: from mx1.securemx.biz (mx1.securemx.biz [203.84.134.2]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 779E01B2F0A for ; Mon, 29 Jun 2015 16:14:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; d=nz.smxemail.com; s=alpha; c=relaxed/relaxed; q=dns/txt; i=@nz.smxemail.com; t=1435619645; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc; bh=epT8IvfaodrDOful8std/FKQOxdU/xoeG8CQj9SI68s=; b=twLjwPBjmTRGvupVuioSlKV9D3qk4r9aEIVTRb7MfQg0XMPrJ76hhi7/OCP5aer6 C7WVBmvlFKBoy63TN5hoeKBU7ejYaEVjKKcnNHnSvpciHl7dvZGwThodxFLociDe nSgwnhjWR7HLMDi9dEZE7QI9OPvks7YLzQomhqiti/E=; Received: from s111-0006-lnv01 ([131.203.48.73]) by omr.nz.smxemail.com with ESMTP (using TLSv1 with cipher AES256-SHA (256/256 bits)) id 5591D13D-28250DEE@mta1101.omr; Mon, 29 Jun 2015 23:14:05 +0000 MIME-Version: 1.0 Message-ID: <147EE18440E5AF44834B220ED35BA530014AB1AEC1@WLGPRDMBX02.dia.govt.nz> X-MessageIsInfected: false Received: from 161-65-142-21.ip.fx.net.nz (EHLO WLGPRDMM01.dia.govt.nz) ([161.65.142.21]) by s111-0006-lnv01 (JAMES SMTP Server ) with ESMTP ID 1872100071; Tue, 30 Jun 2015 11:14:02 +1200 (NZST) Received: from WLGPRDCAS01.dia.govt.nz (Not Verified[172.29.0.93]) by WLGPRDMM01.dia.govt.nz with MailMarshal (v7, 1, 1, 5205) (using TLS: SSLv23) id ; Tue, 30 Jun 2015 11:14:02 +1200 Received: from WLGPRDMBX02.dia.govt.nz ([fe80::d51f:14cf:8162:8a0b]) by WLGPRDCAS01.dia.govt.nz ([172.29.0.93]) with mapi id 14.03.0235.001; Tue, 30 Jun 2015 11:14:02 +1200 From: Colin Wallis To: 'Justin Richer' , "vot@ietf.org" Thread-Topic: Clause 7 edgy on scope? (RE: [VoT] Vectors of Trust I-D) Thread-Index: AdCywAdxGV06rU/8R4OLexR95fMGDA== Date: Mon, 29 Jun 2015 23:14:02 +0000 Accept-Language: en-US, en-NZ Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-mailadviser: Confirmation not required x-originating-ip: [172.29.0.162] Content-Type: multipart/alternative; boundary="_000_147EE18440E5AF44834B220ED35BA530014AB1AEC1WLGPRDMBX02di_" Archived-At: Subject: [VoT] Clause 7 edgy on scope? (RE: Vectors of Trust I-D) X-BeenThere: vot@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Vectors of Trust discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 29 Jun 2015 23:14:09 -0000 --_000_147EE18440E5AF44834B220ED35BA530014AB1AEC1WLGPRDMBX02di_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 TWFueSB0aGFua3MgSnVzdGluIGFuZCBMZWlmDQoNCknigJl2ZSBkb25lIGEgZmlyc3QgcGFzcy9s aWdodCByZWFkLCBhbmQgZnJvbSB0aGF0LCBJIHRoaW5rIGl0IGlzIGEgdGVycmlmaWMgZmlyc3Qg Y3V0IHRoYXQgZ2V0cyB1cyBvbiB0aGUgcGF0aCB0byBub3JtYWxpemluZyB0aGUgZGlzY3Vzc2lv bnMgb3ZlciB0aGUgcGFzdCA5IG1vbnRocy4NCg0KQXNpZGUgZnJvbSBhIGZldyB0aWR5IHVwcywg SSBqdXN0IGhhdmUgdGhpcyBzbGlnaHQgY29uY2VybiB3aGV0aGVyIGFsbCBvZiBDbGF1c2UgNyAo RGlzY292ZXJ5IGFuZCBWZXJpZmljYXRpb24pIGlzIGluIHNjb3BlIGZvciBub3JtYXRpdmUgdGV4 dD8NCkkgY2VydGFpbmx5IGFwcHJlY2lhdGUgdGhhdCBpbiBtb3N0IGltcGxlbWVudGF0aW9ucyBh bmQgZGVwbG95bWVudHMsIHRoZXJlIHdvdWxkIGJlIGEgZGVwZW5kZW5jeSBvbiBhbiBvcGVyYXRp b25hbCB0cnVzdCBmcmFtZXdvcmsgYW5kIHRydXN0bWFyay4NCkJ1dCBpcyBpdCB0b28gYmlnIGEg c3RyZXRjaCB0byBtYWtlIHRoYXQgbm9ybWF0aXZlIGZvciB0aGlzIHdvcms/DQpKdXN0IGEgdGhv dWdodC4uIGFuZCBtb3JlIHRoYW4gaGFwcHkgdG8gYmUgcHJvdmVuIHdyb25nLi4g4pi6Lg0KDQpD aGVlcnMNCkNvbGluDQoNCg0KRnJvbTogdm90IFttYWlsdG86dm90LWJvdW5jZXNAaWV0Zi5vcmdd IE9uIEJlaGFsZiBPZiBKdXN0aW4gUmljaGVyDQpTZW50OiBTYXR1cmRheSwgMjcgSnVuZSAyMDE1 IDM6MTUgcC5tLg0KVG86IHZvdEBpZXRmLm9yZw0KU3ViamVjdDogW1ZvVF0gVmVjdG9ycyBvZiBU cnVzdCBJLUQNCg0KSGkgRXZlcnlvbmUsDQoNCkkgaGF2ZSB0YWtlbiB0aGUgaW5pdGlhbCBzdHJh d21hbiBwcm9wb3NhbCBhbG9uZyB3aXRoIGEgc3Vic3RhbnRpYWwgbnVtYmVyIG9mIGVkaXRzIGFu ZCBpbnB1dHMgZnJvbSBzZXZlcmFsIGZvbGtzIGFuZCBoYXZlIGNyZWF0ZWQgYW4gaW5pdGlhbCBJ LUQgb2YgdGhlIGRvY3VtZW50Og0KDQpodHRwczovL3Rvb2xzLmlldGYub3JnL2lkL2RyYWZ0LXJp Y2hlci12ZWN0b3JzLW9mLXRydXN0LTAwDQoNCkl04oCZcyBzdGlsbCBhIHZlcnkgZHJhZnR5IGRy YWZ0LCBidXQgaG9wZWZ1bGx5IGl04oCZcyBzdGFydGluZyB0byBtYWtlIHRoaXMgYSBjb25jcmV0 ZSB0aGluZy4gUGxlYXNlIHJlYWQgaXQgb3ZlciBhbmQgZGlzY3VzcyBpdCBoZXJlIG9uIHRoZSBs aXN0Lg0KDQpJIHdvdWxkIGxpa2UgdG8gcHJvcG9zZSBhIGJhci1Cb0YgaW4gUHJhZ3VlIGZvciBW b1QgZm9yIGFueW9uZSB3aG8gd291bGQgbGlrZSB0byBkaXNjdXNzIHRoaXMuIElmIHlvdeKAmXJl IGludGVyZXN0ZWQgKGFuZCB3aWxsIGJlIHRoZXJlIGluIHBlcnNvbiksIGxldCBtZSBrbm93IQ0K DQog4oCUIEp1c3Rpbg0K --_000_147EE18440E5AF44834B220ED35BA530014AB1AEC1WLGPRDMBX02di_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTQgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 V2luZ2RpbmdzOw0KCXBhbm9zZS0xOjUgMCAwIDAgMCAwIDAgMCAwIDA7fQ0KQGZvbnQtZmFjZQ0K CXtmb250LWZhbWlseTpXaW5nZGluZ3M7DQoJcGFub3NlLTE6NSAwIDAgMCAwIDAgMCAwIDAgMDt9 DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIg MiAyIDQgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpUYWhvbWE7DQoJcGFub3Nl LTE6MiAxMSA2IDQgMyA1IDQgNCAyIDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNv Tm9ybWFsLCBsaS5Nc29Ob3JtYWwsIGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBjbTsNCgltYXJn aW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGlt ZXMgTmV3IFJvbWFuIiwic2VyaWYiO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNv LXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVy bGluZTt9DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxl LXByaW9yaXR5Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5l O30NCnNwYW4uRW1haWxTdHlsZTE3DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0K CWZvbnQtZmFtaWx5OiJDYWxpYnJpIiwic2Fucy1zZXJpZiI7DQoJY29sb3I6IzFGNDk3RDt9DQou TXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LXNpemU6 MTAuMHB0O30NCkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjYxMi4wcHQgNzkyLjBwdDsNCglt YXJnaW46NzIuMHB0IDcyLjBwdCA3Mi4wcHQgNzIuMHB0O30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7 cGFnZTpXb3JkU2VjdGlvbjE7fQ0KLS0+PC9zdHlsZT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4N CjxvOnNoYXBlZGVmYXVsdHMgdjpleHQ9ImVkaXQiIHNwaWRtYXg9IjEwMjYiIC8+DQo8L3htbD48 IVtlbmRpZl0tLT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlbGF5b3V0IHY6ZXh0 PSJlZGl0Ij4NCjxvOmlkbWFwIHY6ZXh0PSJlZGl0IiBkYXRhPSIxIiAvPg0KPC9vOnNoYXBlbGF5 b3V0PjwveG1sPjwhW2VuZGlmXS0tPg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0iRU4tTloiIGxpbms9 ImJsdWUiIHZsaW5rPSJwdXJwbGUiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90Oztjb2xvcjojMUY0OTdE Ij5NYW55IHRoYW5rcyBKdXN0aW4gYW5kIExlaWY8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTomcXVvdDtDYWxpYnJpJnF1b3Q7LCZxdW90O3NhbnMtc2VyaWYmcXVvdDs7Y29sb3I6IzFGNDk3 RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OywmcXVvdDtzYW5zLXNlcmlmJnF1b3Q7O2NvbG9yOiMxRjQ5N0QiPknigJl2ZSBkb25lIGEgZmly c3QgcGFzcy9saWdodCByZWFkLCBhbmQgZnJvbSB0aGF0LCBJIHRoaW5rIGl0IGlzIGEgdGVycmlm aWMgZmlyc3QgY3V0IHRoYXQgZ2V0cyB1cyBvbiB0aGUgcGF0aCB0byBub3JtYWxpemluZyB0aGUg ZGlzY3Vzc2lvbnMgb3ZlciB0aGUgcGFzdCA5DQogbW9udGhzLiA8bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LCZxdW90O3NhbnMtc2VyaWYmcXVvdDs7Y29s b3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2Fs aWJyaSZxdW90OywmcXVvdDtzYW5zLXNlcmlmJnF1b3Q7O2NvbG9yOiMxRjQ5N0QiPkFzaWRlIGZy b20gYSBmZXcgdGlkeSB1cHMsIEkganVzdCBoYXZlIHRoaXMgc2xpZ2h0IGNvbmNlcm4gd2hldGhl ciBhbGwgb2YgQ2xhdXNlIDcgKERpc2NvdmVyeSBhbmQgVmVyaWZpY2F0aW9uKSBpcyBpbiBzY29w ZSBmb3Igbm9ybWF0aXZlIHRleHQ/PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OywmcXVvdDtzYW5zLXNlcmlmJnF1b3Q7O2NvbG9yOiMxRjQ5N0QiPkkgY2Vy dGFpbmx5IGFwcHJlY2lhdGUgdGhhdCBpbiBtb3N0IGltcGxlbWVudGF0aW9ucyBhbmQgZGVwbG95 bWVudHMsIHRoZXJlIHdvdWxkIGJlIGEgZGVwZW5kZW5jeSBvbiBhbiBvcGVyYXRpb25hbCB0cnVz dCBmcmFtZXdvcmsgYW5kIHRydXN0bWFyay48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDYWxpYnJpJnF1b3Q7LCZxdW90O3NhbnMtc2VyaWYmcXVvdDs7Y29sb3I6IzFGNDk3RCI+ QnV0IGlzIGl0IHRvbyBiaWcgYSBzdHJldGNoIHRvIG1ha2UgdGhhdCBub3JtYXRpdmUgZm9yIHRo aXMgd29yaz88bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7 LCZxdW90O3NhbnMtc2VyaWYmcXVvdDs7Y29sb3I6IzFGNDk3RCI+SnVzdCBhIHRob3VnaHQuLiBh bmQgbW9yZSB0aGFuIGhhcHB5IHRvIGJlIHByb3ZlbiB3cm9uZy4uDQo8L3NwYW4+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6V2luZ2RpbmdzO2NvbG9yOiMxRjQ5N0Qi Pko8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OywmcXVvdDtzYW5zLXNlcmlmJnF1b3Q7O2NvbG9yOiMxRjQ5N0QiPi48bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LCZxdW90O3NhbnMt c2VyaWYmcXVvdDs7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OywmcXVvdDtzYW5zLXNlcmlmJnF1b3Q7O2NvbG9yOiMx RjQ5N0QiPkNoZWVyczxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkm cXVvdDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90Oztjb2xvcjojMUY0OTdEIj5Db2xpbg0KPG86cD48 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OywmcXVvdDtzYW5zLXNl cmlmJnF1b3Q7O2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O0NhbGlicmkmcXVvdDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90Oztjb2xvcjojMUY0 OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0iYm9y ZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjQjVDNERGIDEuMHB0O3BhZGRpbmc6My4wcHQgMGNt IDBjbSAwY20iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4gbGFuZz0iRU4tVVMiIHN0 eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1RhaG9tYSZxdW90OywmcXVv dDtzYW5zLXNlcmlmJnF1b3Q7Ij5Gcm9tOjwvc3Bhbj48L2I+PHNwYW4gbGFuZz0iRU4tVVMiIHN0 eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1RhaG9tYSZxdW90OywmcXVv dDtzYW5zLXNlcmlmJnF1b3Q7Ij4gdm90IFttYWlsdG86dm90LWJvdW5jZXNAaWV0Zi5vcmddDQo8 Yj5PbiBCZWhhbGYgT2YgPC9iPkp1c3RpbiBSaWNoZXI8YnI+DQo8Yj5TZW50OjwvYj4gU2F0dXJk YXksIDI3IEp1bmUgMjAxNSAzOjE1IHAubS48YnI+DQo8Yj5Ubzo8L2I+IHZvdEBpZXRmLm9yZzxi cj4NCjxiPlN1YmplY3Q6PC9iPiBbVm9UXSBWZWN0b3JzIG9mIFRydXN0IEktRDxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZu YnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkhpIEV2ZXJ5b25lLDxvOnA+PC9v OnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SSBoYXZlIHRha2VuIHRoZSBp bml0aWFsIHN0cmF3bWFuIHByb3Bvc2FsIGFsb25nIHdpdGggYSBzdWJzdGFudGlhbCBudW1iZXIg b2YgZWRpdHMgYW5kIGlucHV0cyBmcm9tIHNldmVyYWwgZm9sa3MgYW5kIGhhdmUgY3JlYXRlZCBh biBpbml0aWFsIEktRCBvZiB0aGUgZG9jdW1lbnQ6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxhIGhyZWY9Imh0dHBzOi8vdG9vbHMuaWV0Zi5v cmcvaWQvZHJhZnQtcmljaGVyLXZlY3RvcnMtb2YtdHJ1c3QtMDAiPmh0dHBzOi8vdG9vbHMuaWV0 Zi5vcmcvaWQvZHJhZnQtcmljaGVyLXZlY3RvcnMtb2YtdHJ1c3QtMDA8L2E+PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkl04oCZcyBzdGlsbCBh IHZlcnkgZHJhZnR5IGRyYWZ0LCBidXQgaG9wZWZ1bGx5IGl04oCZcyBzdGFydGluZyB0byBtYWtl IHRoaXMgYSBjb25jcmV0ZSB0aGluZy4gUGxlYXNlIHJlYWQgaXQgb3ZlciBhbmQgZGlzY3VzcyBp dCBoZXJlIG9uIHRoZSBsaXN0LjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj5JIHdvdWxkIGxpa2UgdG8gcHJvcG9zZSBhIGJhci1Cb0YgaW4gUHJh Z3VlIGZvciBWb1QgZm9yIGFueW9uZSB3aG8gd291bGQgbGlrZSB0byBkaXNjdXNzIHRoaXMuIElm IHlvdeKAmXJlIGludGVyZXN0ZWQgKGFuZCB3aWxsIGJlIHRoZXJlIGluIHBlcnNvbiksIGxldCBt ZSBrbm93ITxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj4mbmJzcDvigJQgSnVzdGluPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9i b2R5Pg0KPC9odG1sPg0K --_000_147EE18440E5AF44834B220ED35BA530014AB1AEC1WLGPRDMBX02di_-- From nobody Mon Jun 29 17:49:12 2015 Return-Path: X-Original-To: vot@ietfa.amsl.com Delivered-To: vot@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0F3EA1A1A51 for ; Mon, 29 Jun 2015 17:49:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.51 X-Spam-Level: X-Spam-Status: No, score=-1.51 tagged_above=-999 required=5 tests=[BAYES_50=0.8, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 44e8C3J1Km-X for ; Mon, 29 Jun 2015 17:49:09 -0700 (PDT) Received: from dmz-mailsec-scanner-1.mit.edu (dmz-mailsec-scanner-1.mit.edu [18.9.25.12]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 650561A1A4E for ; Mon, 29 Jun 2015 17:49:09 -0700 (PDT) X-AuditID: 1209190c-f79296d000000622-26-5591e7833418 Received: from mailhub-auth-4.mit.edu ( [18.7.62.39]) (using TLS with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by dmz-mailsec-scanner-1.mit.edu (Symantec Messaging Gateway) with SMTP id CE.6B.01570.387E1955; Mon, 29 Jun 2015 20:49:08 -0400 (EDT) Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) by mailhub-auth-4.mit.edu (8.13.8/8.9.2) with ESMTP id t5U0n7Uh024869; Mon, 29 Jun 2015 20:49:07 -0400 Received: from artemisia.richer.local (static-96-237-195-53.bstnma.fios.verizon.net [96.237.195.53]) (authenticated bits=0) (User authenticated as jricher@ATHENA.MIT.EDU) by outgoing.mit.edu (8.13.8/8.12.4) with ESMTP id t5U0n53S017384 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT); Mon, 29 Jun 2015 20:49:06 -0400 Content-Type: multipart/alternative; boundary="Apple-Mail=_CBE12F76-DB82-4CD7-8E49-369950E7EBB4" Mime-Version: 1.0 (Mac OS X Mail 8.2 \(2098\)) From: Justin Richer In-Reply-To: <147EE18440E5AF44834B220ED35BA530014AB1AEC1@WLGPRDMBX02.dia.govt.nz> Date: Mon, 29 Jun 2015 20:49:04 -0400 Message-Id: References: <147EE18440E5AF44834B220ED35BA530014AB1AEC1@WLGPRDMBX02.dia.govt.nz> To: Colin Wallis X-Mailer: Apple Mail (2.2098) X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFupjleLIzCtJLcpLzFFi42IRYrdT1215PjHU4MxFRos9Ew+zWTT8fMDq wORxZFKBx5IlP5kCmKK4bFJSczLLUov07RK4Mq5sOcta0B9ZsXVLL1MD4znfLkZODgkBE4kp r9awQ9hiEhfurWcDsYUEFjNJbPku2MXIBWRvZJRoOfWBDcJ5yCTx88RbsCpmgQSJd6/bwLp5 BfQkHj19DGYLC7hK7GlbwgpiswmoSkxf08IEYnMKBEpMer0RLM4CFF/5ppcFYo6ixLlp5xgh 5lhJbL2/iRXiigCJ39tugtWICGhLnJ1yirmLkQPoUlmJr1vlJjAKzEJyxSwkV0DEtSWWLXzN DGFrSuzvXs6CKa4h0fltIusCRrZVjLIpuVW6uYmZOcWpybrFyYl5ealFuoZ6uZkleqkppZsY QcHOKcmzg/HNQaVDjAIcjEo8vAlPJ4YKsSaWFVfmHmKU5GBSEuU1uwsU4kvKT6nMSCzOiC8q zUktPsQowcGsJMLLFAuU401JrKxKLcqHSUlzsCiJ8276wRciJJCeWJKanZpakFoEk5Xh4FCS 4BV6BtQoWJSanlqRlplTgpBm4uAEGc4DNPwpyC28xQWJucWZ6RD5U4yKUuK8PiDNAiCJjNI8 uF5YMnrFKA70ijBvDUgVDzCRwXW/AhrMBDR4lXcfyOCSRISUVANjX37jrQUlIjsXnJUM27Zm MnfG+5/lz/o/2IXfe5VR0vb53F8FzcqkiS9XXbQ7trzZXDI64L/8jlaFwg0Pk+s85xqUOrLt uC++bNHt6ZYTnq/xOj9HJCO17dJOxh8S8ziEou3eR//6H/trexNzVNWfP3fWujLM/rf++srD 4benLr6VpS3mPbdxlRJLcUaioRZzUXEiAIG87oAhAwAA Archived-At: Cc: "vot@ietf.org" Subject: Re: [VoT] Clause 7 edgy on scope? (RE: Vectors of Trust I-D) X-BeenThere: vot@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Vectors of Trust discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 30 Jun 2015 00:49:12 -0000 --Apple-Mail=_CBE12F76-DB82-4CD7-8E49-369950E7EBB4 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Colin, that=E2=80=99s a great question, because I=E2=80=99m honestly not = sure what the answer is yet. I think that the vectors only make sense in = the context of some kind of trust framework setup, but that sometimes = those policies will be hard-coded at configuration time and won=E2=80=99t = need to be dynamically bound or discovered. That said, I think the real = value of this is going to be cross-domain where an RP could subscribe to = (and understand) multiple trust marks and be able to validate them at = runtime. Still, that piece might be separable enough, and perhaps = substantive enough, to be its own draft.=20 That said, I figured I=E2=80=99d write it down down and figure out where = it=E2=80=99s actually supposed to go later. :) =E2=80=94 Justin > On Jun 29, 2015, at 7:14 PM, Colin Wallis = wrote: >=20 > Many thanks Justin and Leif > =20 > I=E2=80=99ve done a first pass/light read, and from that, I think it = is a terrific first cut that gets us on the path to normalizing the = discussions over the past 9 months. > =20 > Aside from a few tidy ups, I just have this slight concern whether all = of Clause 7 (Discovery and Verification) is in scope for normative text? > I certainly appreciate that in most implementations and deployments, = there would be a dependency on an operational trust framework and = trustmark. > But is it too big a stretch to make that normative for this work? > Just a thought.. and more than happy to be proven wrong.. J. > =20 > Cheers > Colin > =20 > =20 > From: vot [mailto:vot-bounces@ietf.org] On Behalf Of Justin Richer > Sent: Saturday, 27 June 2015 3:15 p.m. > To: vot@ietf.org > Subject: [VoT] Vectors of Trust I-D > =20 > Hi Everyone, > =20 > I have taken the initial strawman proposal along with a substantial = number of edits and inputs from several folks and have created an = initial I-D of the document: > =20 > https://tools.ietf.org/id/draft-richer-vectors-of-trust-00 = > =20 > It=E2=80=99s still a very drafty draft, but hopefully it=E2=80=99s = starting to make this a concrete thing. Please read it over and discuss = it here on the list. > =20 > I would like to propose a bar-BoF in Prague for VoT for anyone who = would like to discuss this. If you=E2=80=99re interested (and will be = there in person), let me know! > =20 > =E2=80=94 Justin --Apple-Mail=_CBE12F76-DB82-4CD7-8E49-369950E7EBB4 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Colin, that=E2=80=99s a great question, because I=E2=80=99m = honestly not sure what the answer is yet. I think that the vectors only = make sense in the context of some kind of trust framework setup, but = that sometimes those policies will be hard-coded at configuration time = and won=E2=80=99t need to be dynamically bound or discovered. That said, = I think the real value of this is going to be cross-domain where an RP = could subscribe to (and understand) multiple trust marks and be able to = validate them at runtime. Still, that piece might be separable enough, = and perhaps substantive enough, to be its own draft. 

That said, I figured = I=E2=80=99d write it down down and figure out where it=E2=80=99s = actually supposed to go later. :)

 =E2=80=94 Justin

On Jun 29, 2015, at 7:14 PM, Colin Wallis <Colin.Wallis@dia.govt.nz> wrote:

Many thanks Justin and Leif

 

I=E2=80=99ve done a first pass/light = read, and from that, I think it is a terrific first cut that gets us on = the path to normalizing the discussions over the past 9 months.

 

Aside from a few tidy ups, I just have = this slight concern whether all of Clause 7 (Discovery and Verification) = is in scope for normative text?

I certainly appreciate that in most = implementations and deployments, there would be a dependency on an = operational trust framework and trustmark.

But is it too big a stretch to make = that normative for this work?

Just a thought.. and more than happy to = be proven wrong.. J.

 

Cheers

Colin

 

 

From: vot [mailto:vot-bounces@ietf.org] On Behalf Of Justin Richer
Sent: Saturday, 27 June 2015 3:15 p.m.
To: vot@ietf.org
Subject: [VoT] Vectors of Trust I-D

 

Hi Everyone,

 

I have taken the initial strawman = proposal along with a substantial number of edits and inputs from = several folks and have created an initial I-D of the document:

 

https://tools.ietf.org/id/draft-richer-vectors-of-trust-00<= o:p class=3D"">

 

It=E2=80=99s still a very drafty = draft, but hopefully it=E2=80=99s starting to make this a concrete = thing. Please read it over and discuss it here on the list.

 

I would like to propose a bar-BoF = in Prague for VoT for anyone who would like to discuss this. If you=E2=80=99= re interested (and will be there in person), let me know!

 

 =E2=80=94 Justin


= --Apple-Mail=_CBE12F76-DB82-4CD7-8E49-369950E7EBB4-- From nobody Mon Jun 29 18:36:13 2015 Return-Path: X-Original-To: vot@ietfa.amsl.com Delivered-To: vot@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4608F1A87EF for ; Mon, 29 Jun 2015 18:36:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CroGAyoAponK for ; Mon, 29 Jun 2015 18:36:07 -0700 (PDT) Received: from na01-bn1-obe.outbound.protection.outlook.com (mail-bn1bon0708.outbound.protection.outlook.com [IPv6:2a01:111:f400:fc10::1:708]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 38D5D1A87E3 for ; Mon, 29 Jun 2015 18:36:07 -0700 (PDT) Received: from SN1PR09MB0720.namprd09.prod.outlook.com (10.162.2.17) by SN1PR09MB0718.namprd09.prod.outlook.com (10.162.2.156) with Microsoft SMTP Server (TLS) id 15.1.195.15; Tue, 30 Jun 2015 01:35:48 +0000 Received: from SN1PR09MB0720.namprd09.prod.outlook.com ([10.162.2.17]) by SN1PR09MB0720.namprd09.prod.outlook.com ([10.162.2.17]) with mapi id 15.01.0201.000; Tue, 30 Jun 2015 01:35:48 +0000 From: "Grassi, Paul A." To: Justin Richer Thread-Topic: [VoT] Clause 7 edgy on scope? (RE: Vectors of Trust I-D) Thread-Index: AdCywAdxGV06rU/8R4OLexR95fMGDAADohkAAAGh2mU= Date: Tue, 30 Jun 2015 01:35:48 +0000 Message-ID: <69B21050-7E52-4B85-8081-8DE210DE432A@nist.gov> References: <147EE18440E5AF44834B220ED35BA530014AB1AEC1@WLGPRDMBX02.dia.govt.nz>, In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: mit.edu; dkim=none (message not signed) header.d=none; x-originating-ip: [96.231.131.239] x-microsoft-exchange-diagnostics: 1; SN1PR09MB0718; 5:rD+8GJayKO+mg67fyTBHKDGJrFIoTPGKJI4n4aBl9zuHDdlykrMXkmMq59vMwgorO0QMFlG1EHAuA+WWgzVCsUKMi527Euf5xQ+fq5q6BwEWGTSbM3IkYcrfi7a4vmmVcHb8l27HLUp7G+tDIF/fyQ==; 24:LXU8I41/c1IYrHn7y6SMpa/jR349Fmj3JKwZDjPw3YWVrxrdsn64pTOaYj6bp0X33V10ghPVBGvzmpMfR6h9IaT+QS5FxEIiU++f3G9x6zI=; 20:uIkmQ84NSQ7Pq4E/+5p1FQZg/Kpp+cm21rieUUdOgbdA3d/VPFyZwPrY9GhdnKecC+bYDIhokcGsdg/vpUngWg== x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(42139001); SRVR:SN1PR09MB0718; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:; x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(601004)(5005006)(3002001); SRVR:SN1PR09MB0718; BCL:0; PCL:0; RULEID:; SRVR:SN1PR09MB0718; x-forefront-prvs: 06237E4555 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(24454002)(377454003)(53754006)(51444003)(66654002)(110136002)(15975445007)(102836002)(76176999)(62966003)(2950100001)(5001960100002)(2900100001)(77096005)(66066001)(77156002)(189998001)(83716003)(82746002)(40100003)(54356999)(50986999)(92566002)(122556002)(5002640100001)(46102003)(16236675004)(33656002)(561944003)(19625215002)(19617315012)(2171001)(87936001)(86362001)(2656002)(19580395003)(19580405001)(36756003)(99286002)(104396002)(19607625011); DIR:OUT; SFP:1102; SCL:1; SRVR:SN1PR09MB0718; H:SN1PR09MB0720.namprd09.prod.outlook.com; FPR:; SPF:None; MLV:sfv; LANG:en; Content-Type: multipart/alternative; boundary="_000_69B210507E524B8580818DE210DE432Anistgov_" MIME-Version: 1.0 X-OriginatorOrg: nist.gov X-MS-Exchange-CrossTenant-originalarrivaltime: 30 Jun 2015 01:35:48.2833 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 2ab5d82f-d8fa-4797-a93e-054655c61dec X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN1PR09MB0718 Archived-At: Cc: Colin Wallis , "vot@ietf.org" Subject: Re: [VoT] Clause 7 edgy on scope? (RE: Vectors of Trust I-D) X-BeenThere: vot@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Vectors of Trust discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 30 Jun 2015 01:36:11 -0000 --_000_69B210507E524B8580818DE210DE432Anistgov_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable I personally like the idea of discoverability at the onset, and the discuss= ion that will follow. This was great to read, thanks to you and Leif for the work! On Jun 29, 2015, at 8:49 PM, "Justin Richer" > wrote: Colin, that's a great question, because I'm honestly not sure what the answ= er is yet. I think that the vectors only make sense in the context of some = kind of trust framework setup, but that sometimes those policies will be ha= rd-coded at configuration time and won't need to be dynamically bound or di= scovered. That said, I think the real value of this is going to be cross-do= main where an RP could subscribe to (and understand) multiple trust marks a= nd be able to validate them at runtime. Still, that piece might be separabl= e enough, and perhaps substantive enough, to be its own draft. That said, I figured I'd write it down down and figure out where it's actua= lly supposed to go later. :) - Justin On Jun 29, 2015, at 7:14 PM, Colin Wallis > wrote: Many thanks Justin and Leif I've done a first pass/light read, and from that, I think it is a terrific = first cut that gets us on the path to normalizing the discussions over the = past 9 months. Aside from a few tidy ups, I just have this slight concern whether all of C= lause 7 (Discovery and Verification) is in scope for normative text? I certainly appreciate that in most implementations and deployments, there = would be a dependency on an operational trust framework and trustmark. But is it too big a stretch to make that normative for this work? Just a thought.. and more than happy to be proven wrong.. :). Cheers Colin From: vot [mailto:vot-bounces@ietf.org] On Behalf Of Justin Richer Sent: Saturday, 27 June 2015 3:15 p.m. To: vot@ietf.org Subject: [VoT] Vectors of Trust I-D Hi Everyone, I have taken the initial strawman proposal along with a substantial number = of edits and inputs from several folks and have created an initial I-D of t= he document: https://tools.ietf.org/id/draft-richer-vectors-of-trust-00 It's still a very drafty draft, but hopefully it's starting to make this a = concrete thing. Please read it over and discuss it here on the list. I would like to propose a bar-BoF in Prague for VoT for anyone who would li= ke to discuss this. If you're interested (and will be there in person), let= me know! - Justin _______________________________________________ vot mailing list vot@ietf.org https://www.ietf.org/mailman/listinfo/vot --_000_69B210507E524B8580818DE210DE432Anistgov_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable
I personally like the idea of discoverability at the onset, and the di= scussion that will follow.

This was great to read, thanks to you and Leif for the work!

On Jun 29, 2015, at 8:49 PM, "Justin Richer" <jricher@mit.edu> wrote:

Colin, that’s a great question, because I’m honestly not s= ure what the answer is yet. I think that the vectors only make sense in the= context of some kind of trust framework setup, but that sometimes those po= licies will be hard-coded at configuration time and won’t need to be dynamically bound or discovered. That said, I t= hink the real value of this is going to be cross-domain where an RP could s= ubscribe to (and understand) multiple trust marks and be able to validate t= hem at runtime. Still, that piece might be separable enough, and perhaps substantive enough, to be its own draft.&= nbsp;

That said, I figured I’d write it down down and figur= e out where it’s actually supposed to go later. :)

 — Justin

On Jun 29, 2015, at 7:14 PM, Colin Wallis <Colin.Wallis@dia.govt.nz> = wrote:

Many thanks Ju= stin and Leif

 <= /p>

I’ve don= e a first pass/light read, and from that, I think it is a terrific first cu= t that gets us on the path to normalizing the discussions over the past 9 months.

 <= /p>

Aside from a f= ew tidy ups, I just have this slight concern whether all of Clause 7 (Disco= very and Verification) is in scope for normative text?

I certainly ap= preciate that in most implementations and deployments, there would be a dep= endency on an operational trust framework and trustmark.

But is it too = big a stretch to make that normative for this work?

Just a thought= .. and more than happy to be proven wrong.. J.=

 <= /p>

Cheers

Colin

 <= /p>

 <= /p>

= From: vot [mailto:vot-bounces@ietf.org] On Behalf Of Justin Richer
Sent: Saturday, 27 June 2015 3:15 p.m.
To: vot@ietf.o= rg
Subject: [VoT] Vectors of Trust I-D=

 

Hi Everyone,

 

I have taken the initial strawman proposal along wit= h a substantial number of edits and inputs from several folks and have crea= ted an initial I-D of the document:

 

https://tools.ietf.org/id/draft-richer-vector= s-of-trust-00

 

It’s still a very drafty draft, but hopefully = it’s starting to make this a concrete thing. Please read it over and = discuss it here on the list.

 

I would like to propose a bar-BoF in Prague for VoT = for anyone who would like to discuss this. If you’re interested (and = will be there in person), let me know!

 

 — Justin


_______________________________________________
vot mailing list
vot@ietf.org
https://www.iet= f.org/mailman/listinfo/vot
--_000_69B210507E524B8580818DE210DE432Anistgov_-- From nobody Tue Jun 30 04:22:52 2015 Return-Path: X-Original-To: vot@ietfa.amsl.com Delivered-To: vot@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6BA701A8932 for ; Tue, 30 Jun 2015 04:22:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.5 X-Spam-Level: X-Spam-Status: No, score=-1.5 tagged_above=-999 required=5 tests=[BAYES_50=0.8, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QEUL-cM5izB8 for ; Tue, 30 Jun 2015 04:22:46 -0700 (PDT) Received: from eu-smtp-delivery-189.mimecast.com (eu-smtp-delivery-189.mimecast.com [207.82.80.189]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 570F41A8927 for ; Tue, 30 Jun 2015 04:22:45 -0700 (PDT) Received: from emea01-db3-obe.outbound.protection.outlook.com (mail-db3lrp0077.outbound.protection.outlook.com [213.199.154.77]) (Using TLS) by eu-smtp-1.mimecast.com with ESMTP id uk-mta-6-1_VuMKnESmq_9zJagKPzTQ-1 Received: from DB3PR07MB138.eurprd07.prod.outlook.com (10.242.132.20) by DB3PR07MB139.eurprd07.prod.outlook.com (10.242.132.25) with Microsoft SMTP Server (TLS) id 15.1.201.16; Tue, 30 Jun 2015 11:22:41 +0000 Received: from DB3PR07MB138.eurprd07.prod.outlook.com ([169.254.8.196]) by DB3PR07MB138.eurprd07.prod.outlook.com ([169.254.8.196]) with mapi id 15.01.0201.000; Tue, 30 Jun 2015 11:22:41 +0000 From: Josh Howlett To: Justin Richer , "vot@ietf.org" Thread-Topic: [VoT] Vectors of Trust I-D Thread-Index: AQHQsIeK301/ChJFC0aYTs+tGmtIRJ3E1lTQ Date: Tue, 30 Jun 2015 11:22:41 +0000 Message-ID: References: <4DF01AF4-CD33-4BB7-958B-FFECD37C8AFE@mit.edu> In-Reply-To: <4DF01AF4-CD33-4BB7-958B-FFECD37C8AFE@mit.edu> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [46.233.116.159] x-microsoft-exchange-diagnostics: 1; DB3PR07MB139; 5:mMivANvmNw4O53z+cBpzV6OxzicTcge3yGueUfesT/y4x6kDrHkHjvG4vJHjKnM0uZIPVGRqEZVDubUE87s6coBvs6qRTYUCNRoaN8HwsForDrfuwAT/bgFXpyQNHZun010DJVN7D3F35WDUkw1GXQ==; 24:QYmTwPEGaRYsBpF+pmkMNX8QhNEnjfUedtzhIhC6mCvCtFYVaRs3zCdaLDAaiiTTOCBK2+K4VZVBCyBEz+hGp2bpEONz13IS0AX8wXkUlJ0=; 20:2qdVJQxEBXsghvkWX2pBHuNtnqTbmq9bvkx0jV9albqIidTanHMM1yLRXz0l+fvv2fi0Sm+Y3xJj4kdTQoxUaRbmlZuuHt+QTyDBSgJU8satWzGg3sEs8jcf19FAz/Et21o7GqXgoAboe35iZcvz+fMTbQx/SHn+LqtKy4f44K4= x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:DB3PR07MB139; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:; x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(601004)(5005006)(3002001); SRVR:DB3PR07MB139; BCL:0; PCL:0; RULEID:; SRVR:DB3PR07MB139; x-forefront-prvs: 06237E4555 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(53754006)(16236675004)(15975445007)(102836002)(5002640100001)(2950100001)(2900100001)(5001770100001)(86362001)(189998001)(66066001)(19625215002)(2171001)(87936001)(110136002)(76176999)(107886002)(54356999)(5001960100002)(77156002)(92566002)(62966003)(122556002)(50986999)(19580405001)(2501003)(561944003)(19617315012)(76576001)(2656002)(106116001)(74482002)(33656002)(74316001)(5003600100002)(46102003)(40100003)(19300405004)(19580395003); DIR:OUT; SFP:1101; SCL:1; SRVR:DB3PR07MB139; H:DB3PR07MB138.eurprd07.prod.outlook.com; FPR:; SPF:None; MLV:sfv; LANG:en; spamdiagnosticoutput: 1:23 spamdiagnosticmetadata: NSPM MIME-Version: 1.0 X-OriginatorOrg: jisc.ac.uk X-MS-Exchange-CrossTenant-originalarrivaltime: 30 Jun 2015 11:22:41.7373 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 48f9394d-8a14-4d27-82a6-f35f12361205 X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB3PR07MB139 X-MC-Unique: 1_VuMKnESmq_9zJagKPzTQ-1 Content-Type: multipart/alternative; boundary="_000_DB3PR07MB138FDE12ED039C4C8CA9968BCA90DB3PR07MB138eurprd_" Archived-At: Subject: Re: [VoT] Vectors of Trust I-D X-BeenThere: vot@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Vectors of Trust discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 30 Jun 2015 11:22:51 -0000 --_000_DB3PR07MB138FDE12ED039C4C8CA9968BCA90DB3PR07MB138eurprd_ Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: base64 SnVzdGluLCBMZWlmLA0KDQpUaGFua3MgZm9yIHRoaXMgZHJhZnQuIEkgb25seSBoYXZlIHNvbWUg Z2VuZXJhbCBjb21tZW50cyBhdCB0aGlzIHBvaW50LiBUaGUgZmlyc3QgdHdvIGNvbmNlcm4gdGhl IHVzZSBvZiBsYW5ndWFnZTsgSSBtaWdodCBiZSBoYWlyLXNwbGl0dGluZzogWU1NVi4gVGhlIGZp bmFsIGNvbW1lbnQgaXMgbW9yZSBzdWJzdGFudGl2ZS4NCg0KMS4gVmVjdG9ycyBoYXZlIGEgdmVy eSBzcGVjaWZpYyBmb3JtYWwgbWVhbmluZyBpbiBtYXRoZW1hdGljcy4gR2l2ZW4gdGhhdCB0aGlz IGlzIGFuIGVuZ2luZWVyaW5nIGNvbW11bml0eSwgSSB0aGluayB0aGVyZeKAmXMgYSBwb3NzaWJp bGl0eSBvZiBjcmVhdGluZyBjb25mdXNpb24gZnJvbSB0aGUgdXNlIG9mIHRoaXMgbGFuZ3VhZ2Uu IFlvdSBjb3JyZWN0bHkgdHJ5IHRvIGRpc2FtYmlndWF0ZSB0aGlzIGluIDIuMiwgYnV0IHRoZSB1 c2Ugb2YgZGlmZmVyZW50IGxhbmd1YWdlIHdvdWxkIG1ha2UgdGhpcyB1bm5lY2Vzc2FyeS4NCg0K Mi4gVGhlIGRyYWZ0IHRhbGtzIG9mIHZlY3RvcnMgb2YgdHJ1c3QgYnV0IGFjdHVhbGx5IGRlc2Ny aWJlcyB0eXBlcyBvZiBldmlkZW5jZSBhbmQgYXR0cmlidXRlcyB0aGF0IGNhbiBiZSBhc3NvY2lh dGVkIHdpdGggdGhlc2UuIEFzIHlvdSBkaXNjdXNzIGluIHNlY3Rpb24gNy4xLCB0aGVyZSBpcyBh IHNwZWNpZmljIHRydXN0IGNvbnRleHQgd2hpY2ggY29uZmVycyBzZW1hbnRpY3Mgb24gdGhlc2Ug YXR0cmlidXRlcyBleCBwb3N0IGZhY3RvLiBUaHVzIHRoaXMgZXZpZGVuY2UgYW5kIHRoZWlyIGF0 dHJpYnV0ZXMgY2FuIGluZm9ybSBydW50aW1lIG91dGNvbWVzLCBpbiB0aGUgY29udGV4dCBvZiBh IGdpdmVuIHRydXN0IGNvbnRleHQsIGJ1dCBkbyBub3QgZGVmaW5lIGl0LiBJIHRoaW5rIGl0IG1p Z2h0IGJlIGhlbHBmdWwgdG8gcmVjb25zaWRlciB0aGUgZGVzY3JpcHRpb24gb2YgdGhpcyB3b3Jr LCBzbyB0aGF0IGl0cyBnb2FsIGlzIGNsZWFyZXIgdG8gdGhlIHJlYWRlcjsgYW5kIHNldCBvdXQg dGhlIGZ1bmRhbWVudGFsIHJvbGUgb2YgdGhlIHRydXN0IGNvbnRleHQgd2l0aGluIHRoZSBpbnRy b2R1Y3Rpb24vYmFja2dyb3VuZC4NCg0KMy4gVGhlIGdvYWwgb2YgdGhlIGRyYWZ0LCBhcyBJIHVu ZGVyc3RhbmQgaXQsIGlzIHRvIGVuYWJsZSBSUHMgYW5kIElkUHMgdG8gc2hhcmUgYSBjb21tb24g dm9jYWJ1bGFyeSBvZiBldmlkZW5jZSBhbmQgdGhlaXIgYXR0cmlidXRlcy4gVGhpcyBhdm9pZHMg dGhlIOKAnGJ1bmRsaW5n4oCdIG9mIGRpZmZlcmVudCBraW5kcyBvZiBldmlkZW5jZSBieSBhbGxv d2luZyBmb3IgZGVjb21wb3NhYmlsaXR5LiBUaGlzIGV2aWRlbmNlLCBub3cgdW5idW5kbGVkLCBj YW4gYmUgZW1wbG95ZWQgaW4gZGlmZmVyZW50IHRydXN0IGNvbnRleHRzLCBmYWNpbGl0YXRpbmcg aW50ZXJvcGVyYWJpbGl0eSBhY3Jvc3MgdHJ1c3QgZnJhbWV3b3JrLiBTbyBmYXIgc28gZ29vZD8g SG93ZXZlciBJ4oCZbGwgbm90ZSB0aGF0IHRoZSBldmlkZW5jZXMgYW5kIGF0dHJpYnV0ZXMgZGVz Y3JpYmVkIGluIHNlY3Rpb24gMyBhcmUgb2Z0ZW4gdGhlbXNlbHZlcyBidW5kbGVzICjigJxDNSBT ZWFsZWQgaGFyZHdhcmUgdG9rZW4gLyB0cnVzdGVkIGJpb21ldHJpYyAvIFRQTS1iYWNrZWQga2V5 cykuIFNvLCBwbGF5aW5nIGRldmls4oCZcyBhZHZvY2F0ZSwgd2hhdCBpcyB0byBzdG9wIGFjdG9y cyBmcm9tIGRlY29tcG9zaW5nIHRoZSBjb3JlIGVsZW1lbnRzIGRlc2NyaWJlZCBpbiBzZWN0aW9u IDM/IEluZGVlZCBJIHRoaW5rIGl04oCZcyBhY3R1YWxseSBhIGdvYWwgb2YgdGhpcyBkb2N1bWVu dCB0byBwZXJtaXQgdGhhdCB0aHJvdWdoIGV4dGVuc2lvbnMuIEkgd29uZGVyIHRoZXJlZm9yZSB3 aGV0aGVyIGFuIGV4Y2VzcyBvZiBkZWNvbXBvc2FiaWxpdHkgd2lsbCBhY3R1YWxseSBhZ2dyYXZh dGUgaW50ZXJvcGVyYWJpbGl0eSBiZXR3ZWVuIHRydXN0IGNvbnRleHRzLiBDbGVhcmx5IHRoaXMg Y291bGQgYmUgYWRkcmVzc2VkIGJ5IHNldHRpbmcgbm9ybXMsIGJ1dCB0aGVuIHlvdeKAmXZlIHJl aW52ZW50ZWQgTklTVCA4MDAtNjMuIEFsdGVybmF0aXZlbHkgeW91IGNvdWxkIGltYWdpbmUgYSB0 YXhvbm9teSBvZiBldmlkZW5jZSwgd2l0aCBjbGFzc2VzIGFuZCAodGhyb3VnaCBleHRlbnNpb25z KSBzdWItY2xhc3NlcyBhbGxvd2luZyBmb3IgZ3JlYXRlciBzcGVjaWZpY2l0eSwgd2hpbGUgcHJv dmlkaW5nIGZvciBhIGdlbmVyYWwgaW50ZXJwcmV0YXRpb24gaWYgYWN0b3JzIGRvIG5vdCBzaGFy ZSB0aGUgc2FtZSB2b2NhYnVsYXJ5LiBJIGhlc2l0YXRlIHRvIGRlc2NyaWJlIHRoaXMgYXMgZnJh Y3RhbCwgYnV0IEkgaG9wZSB5b3UgY2FuIHNlZSB3aGF0IEnigJltIGRyaXZpbmcgYXQuDQoNCkpv c2guDQpGcm9tOiB2b3QgW21haWx0bzp2b3QtYm91bmNlc0BpZXRmLm9yZ10gT24gQmVoYWxmIE9m IEp1c3RpbiBSaWNoZXINClNlbnQ6IDI3IEp1bmUgMjAxNSAwNDoxNQ0KVG86IHZvdEBpZXRmLm9y Zw0KU3ViamVjdDogW1ZvVF0gVmVjdG9ycyBvZiBUcnVzdCBJLUQNCg0KSGkgRXZlcnlvbmUsDQoN CkkgaGF2ZSB0YWtlbiB0aGUgaW5pdGlhbCBzdHJhd21hbiBwcm9wb3NhbCBhbG9uZyB3aXRoIGEg c3Vic3RhbnRpYWwgbnVtYmVyIG9mIGVkaXRzIGFuZCBpbnB1dHMgZnJvbSBzZXZlcmFsIGZvbGtz IGFuZCBoYXZlIGNyZWF0ZWQgYW4gaW5pdGlhbCBJLUQgb2YgdGhlIGRvY3VtZW50Og0KDQpodHRw czovL3Rvb2xzLmlldGYub3JnL2lkL2RyYWZ0LXJpY2hlci12ZWN0b3JzLW9mLXRydXN0LTAwDQoN Ckl04oCZcyBzdGlsbCBhIHZlcnkgZHJhZnR5IGRyYWZ0LCBidXQgaG9wZWZ1bGx5IGl04oCZcyBz dGFydGluZyB0byBtYWtlIHRoaXMgYSBjb25jcmV0ZSB0aGluZy4gUGxlYXNlIHJlYWQgaXQgb3Zl ciBhbmQgZGlzY3VzcyBpdCBoZXJlIG9uIHRoZSBsaXN0Lg0KDQpJIHdvdWxkIGxpa2UgdG8gcHJv cG9zZSBhIGJhci1Cb0YgaW4gUHJhZ3VlIGZvciBWb1QgZm9yIGFueW9uZSB3aG8gd291bGQgbGlr ZSB0byBkaXNjdXNzIHRoaXMuIElmIHlvdeKAmXJlIGludGVyZXN0ZWQgKGFuZCB3aWxsIGJlIHRo ZXJlIGluIHBlcnNvbiksIGxldCBtZSBrbm93IQ0KDQog4oCUIEp1c3Rpbg0KDQpKaXNjIGlzIGEg cmVnaXN0ZXJlZCBjaGFyaXR5IChudW1iZXIgMTE0OTc0MCkgYW5kIGEgY29tcGFueSBsaW1pdGVk IGJ5IGd1YXJhbnRlZSB3aGljaCBpcyByZWdpc3RlcmVkIGluIEVuZ2xhbmQgdW5kZXIgQ29tcGFu eSBOby4gNTc0NzMzOSwgVkFUIE5vLiBHQiAxOTcgMDYzMiA4Ni4gSmlzY+KAmXMgcmVnaXN0ZXJl ZCBvZmZpY2UgaXM6IE9uZSBDYXN0bGVwYXJrLCBUb3dlciBIaWxsLCBCcmlzdG9sLCBCUzIgMEpB LiBUIDAyMDMgNjk3IDU4MDAuDQoNCkppc2MgU2VydmljZXMgTGltaXRlZCBpcyBhIHdob2xseSBv d25lZCBKaXNjIHN1YnNpZGlhcnkgYW5kIGEgY29tcGFueSBsaW1pdGVkIGJ5IGd1YXJhbnRlZSB3 aGljaCBpcyByZWdpc3RlcmVkIGluIEVuZ2xhbmQgdW5kZXIgY29tcGFueSBudW1iZXIgMjg4MTAy NCwgVkFUIG51bWJlciBHQiAxOTcgMDYzMiA4Ni4gVGhlIHJlZ2lzdGVyZWQgb2ZmaWNlIGlzOiBP bmUgQ2FzdGxlIFBhcmssIFRvd2VyIEhpbGwsIEJyaXN0b2wgQlMyIDBKQS4gVCAwMjAzIDY5NyA1 ODAwLiAgDQo= --_000_DB3PR07MB138FDE12ED039C4C8CA9968BCA90DB3PR07MB138eurprd_ Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1IDUgMiAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZp bml0aW9ucyAqLw0KcC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXtt YXJnaW46MGNtOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0K CWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iLHNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29I eXBlcmxpbmsNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1k ZWNvcmF0aW9uOnVuZGVybGluZTt9DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93 ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29y YXRpb246dW5kZXJsaW5lO30NCnAuTXNvTGlzdFBhcmFncmFwaCwgbGkuTXNvTGlzdFBhcmFncmFw aCwgZGl2Lk1zb0xpc3RQYXJhZ3JhcGgNCgl7bXNvLXN0eWxlLXByaW9yaXR5OjM0Ow0KCW1hcmdp bi10b3A6MGNtOw0KCW1hcmdpbi1yaWdodDowY207DQoJbWFyZ2luLWJvdHRvbTowY207DQoJbWFy Z2luLWxlZnQ6MzYuMHB0Ow0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTIu MHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iLHNlcmlmO30NCnNwYW4uRW1haWxT dHlsZTE3DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJD YWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOiMxRjQ5N0Q7fQ0KLk1zb0NocERlZmF1bHQNCgl7 bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1zaXplOjEwLjBwdDt9DQpAcGFnZSBX b3JkU2VjdGlvbjENCgl7c2l6ZTo2MTIuMHB0IDc5Mi4wcHQ7DQoJbWFyZ2luOjcyLjBwdCA3Mi4w cHQgNzIuMHB0IDcyLjBwdDt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24x O30NCi8qIExpc3QgRGVmaW5pdGlvbnMgKi8NCkBsaXN0IGwwDQoJe21zby1saXN0LWlkOjg1MTcy MTAwMDsNCgltc28tbGlzdC10eXBlOmh5YnJpZDsNCgltc28tbGlzdC10ZW1wbGF0ZS1pZHM6MzY3 MDQ5NDM0IDEzNDgwNzU2NyAxMzQ4MDc1NzcgMTM0ODA3NTc5IDEzNDgwNzU2NyAxMzQ4MDc1Nzcg MTM0ODA3NTc5IDEzNDgwNzU2NyAxMzQ4MDc1NzcgMTM0ODA3NTc5O30NCkBsaXN0IGwwOmxldmVs MQ0KCXttc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9u OmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDt9DQpAbGlzdCBsMDpsZXZlbDINCgl7bXNvLWxl dmVsLW51bWJlci1mb3JtYXQ6YWxwaGEtbG93ZXI7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7 DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7 fQ0KQGxpc3QgbDA6bGV2ZWwzDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OnJvbWFuLWxvd2Vy Ow0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246 cmlnaHQ7DQoJdGV4dC1pbmRlbnQ6LTkuMHB0O30NCkBsaXN0IGwwOmxldmVsNA0KCXttc28tbGV2 ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4 dC1pbmRlbnQ6LTE4LjBwdDt9DQpAbGlzdCBsMDpsZXZlbDUNCgl7bXNvLWxldmVsLW51bWJlci1m b3JtYXQ6YWxwaGEtbG93ZXI7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVs LW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7fQ0KQGxpc3QgbDA6 bGV2ZWw2DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OnJvbWFuLWxvd2VyOw0KCW1zby1sZXZl bC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246cmlnaHQ7DQoJdGV4 dC1pbmRlbnQ6LTkuMHB0O30NCkBsaXN0IGwwOmxldmVsNw0KCXttc28tbGV2ZWwtdGFiLXN0b3A6 bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4 LjBwdDt9DQpAbGlzdCBsMDpsZXZlbDgNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YWxwaGEt bG93ZXI7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3Np dGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7fQ0KQGxpc3QgbDA6bGV2ZWw5DQoJe21z by1sZXZlbC1udW1iZXItZm9ybWF0OnJvbWFuLWxvd2VyOw0KCW1zby1sZXZlbC10YWItc3RvcDpu b25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246cmlnaHQ7DQoJdGV4dC1pbmRlbnQ6LTku MHB0O30NCkBsaXN0IGwxDQoJe21zby1saXN0LWlkOjEyNDk2NTE2OTM7DQoJbXNvLWxpc3QtdHlw ZTpoeWJyaWQ7DQoJbXNvLWxpc3QtdGVtcGxhdGUtaWRzOjE4MjU3MTMwNDQgMTM0ODA3NTY3IDEz NDgwNzU3NyAxMzQ4MDc1NzkgMTM0ODA3NTY3IDEzNDgwNzU3NyAxMzQ4MDc1NzkgMTM0ODA3NTY3 IDEzNDgwNzU3NyAxMzQ4MDc1Nzk7fQ0KQGxpc3QgbDE6bGV2ZWwxDQoJe21zby1sZXZlbC1zdGFy dC1hdDowOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9z aXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0O30NCkBsaXN0IGwxOmxldmVsMg0KCXtt c28tbGV2ZWwtbnVtYmVyLWZvcm1hdDphbHBoYS1sb3dlcjsNCgltc28tbGV2ZWwtdGFiLXN0b3A6 bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4 LjBwdDt9DQpAbGlzdCBsMTpsZXZlbDMNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6cm9tYW4t bG93ZXI7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3Np dGlvbjpyaWdodDsNCgl0ZXh0LWluZGVudDotOS4wcHQ7fQ0KQGxpc3QgbDE6bGV2ZWw0DQoJe21z by1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsN Cgl0ZXh0LWluZGVudDotMTguMHB0O30NCkBsaXN0IGwxOmxldmVsNQ0KCXttc28tbGV2ZWwtbnVt YmVyLWZvcm1hdDphbHBoYS1sb3dlcjsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28t bGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDt9DQpAbGlz dCBsMTpsZXZlbDYNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6cm9tYW4tbG93ZXI7DQoJbXNv LWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpyaWdodDsN Cgl0ZXh0LWluZGVudDotOS4wcHQ7fQ0KQGxpc3QgbDE6bGV2ZWw3DQoJe21zby1sZXZlbC10YWIt c3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVu dDotMTguMHB0O30NCkBsaXN0IGwxOmxldmVsOA0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDph bHBoYS1sb3dlcjsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVy LXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDt9DQpAbGlzdCBsMTpsZXZlbDkN Cgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6cm9tYW4tbG93ZXI7DQoJbXNvLWxldmVsLXRhYi1z dG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpyaWdodDsNCgl0ZXh0LWluZGVu dDotOS4wcHQ7fQ0KQGxpc3QgbDINCgl7bXNvLWxpc3QtaWQ6MTcyNTcxODAwNzsNCgltc28tbGlz dC10eXBlOmh5YnJpZDsNCgltc28tbGlzdC10ZW1wbGF0ZS1pZHM6LTE2OTc5ODE1NjIgMTM0ODA3 NTY3IDEzNDgwNzU3NyAxMzQ4MDc1NzkgMTM0ODA3NTY3IDEzNDgwNzU3NyAxMzQ4MDc1NzkgMTM0 ODA3NTY3IDEzNDgwNzU3NyAxMzQ4MDc1Nzk7fQ0KQGxpc3QgbDI6bGV2ZWwxDQoJe21zby1sZXZl bC1zdGFydC1hdDowOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1i ZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0O30NCkBsaXN0IGwyOmxldmVs Mg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDphbHBoYS1sb3dlcjsNCgltc28tbGV2ZWwtdGFi LXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRl bnQ6LTE4LjBwdDt9DQpAbGlzdCBsMjpsZXZlbDMNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6 cm9tYW4tbG93ZXI7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJl ci1wb3NpdGlvbjpyaWdodDsNCgl0ZXh0LWluZGVudDotOS4wcHQ7fQ0KQGxpc3QgbDI6bGV2ZWw0 DQoJe21zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246 bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0O30NCkBsaXN0IGwyOmxldmVsNQ0KCXttc28tbGV2 ZWwtbnVtYmVyLWZvcm1hdDphbHBoYS1sb3dlcjsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsN Cgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDt9 DQpAbGlzdCBsMjpsZXZlbDYNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6cm9tYW4tbG93ZXI7 DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpy aWdodDsNCgl0ZXh0LWluZGVudDotOS4wcHQ7fQ0KQGxpc3QgbDI6bGV2ZWw3DQoJe21zby1sZXZl bC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0 LWluZGVudDotMTguMHB0O30NCkBsaXN0IGwyOmxldmVsOA0KCXttc28tbGV2ZWwtbnVtYmVyLWZv cm1hdDphbHBoYS1sb3dlcjsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwt bnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDt9DQpAbGlzdCBsMjps ZXZlbDkNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6cm9tYW4tbG93ZXI7DQoJbXNvLWxldmVs LXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpyaWdodDsNCgl0ZXh0 LWluZGVudDotOS4wcHQ7fQ0KQGxpc3QgbDMNCgl7bXNvLWxpc3QtaWQ6MTg0NTcwNjUxMTsNCglt c28tbGlzdC10eXBlOmh5YnJpZDsNCgltc28tbGlzdC10ZW1wbGF0ZS1pZHM6LTE1MjQ0NjY5MTIg MTM0ODA3NTY3IDEzNDgwNzU3NyAxMzQ4MDc1NzkgMTM0ODA3NTY3IDEzNDgwNzU3NyAxMzQ4MDc1 NzkgMTM0ODA3NTY3IDEzNDgwNzU3NyAxMzQ4MDc1Nzk7fQ0KQGxpc3QgbDM6bGV2ZWwxDQoJe21z by1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsN Cgl0ZXh0LWluZGVudDotMTguMHB0O30NCkBsaXN0IGwzOmxldmVsMg0KCXttc28tbGV2ZWwtbnVt YmVyLWZvcm1hdDphbHBoYS1sb3dlcjsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28t bGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDt9DQpAbGlz dCBsMzpsZXZlbDMNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6cm9tYW4tbG93ZXI7DQoJbXNv LWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpyaWdodDsN Cgl0ZXh0LWluZGVudDotOS4wcHQ7fQ0KQGxpc3QgbDM6bGV2ZWw0DQoJe21zby1sZXZlbC10YWIt c3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVu dDotMTguMHB0O30NCkBsaXN0IGwzOmxldmVsNQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDph bHBoYS1sb3dlcjsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVy LXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDt9DQpAbGlzdCBsMzpsZXZlbDYN Cgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6cm9tYW4tbG93ZXI7DQoJbXNvLWxldmVsLXRhYi1z dG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpyaWdodDsNCgl0ZXh0LWluZGVu dDotOS4wcHQ7fQ0KQGxpc3QgbDM6bGV2ZWw3DQoJe21zby1sZXZlbC10YWItc3RvcDpub25lOw0K CW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0O30N CkBsaXN0IGwzOmxldmVsOA0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDphbHBoYS1sb3dlcjsN Cgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxl ZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDt9DQpAbGlzdCBsMzpsZXZlbDkNCgl7bXNvLWxldmVs LW51bWJlci1mb3JtYXQ6cm9tYW4tbG93ZXI7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJ bXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpyaWdodDsNCgl0ZXh0LWluZGVudDotOS4wcHQ7fQ0K b2wNCgl7bWFyZ2luLWJvdHRvbTowY207fQ0KdWwNCgl7bWFyZ2luLWJvdHRvbTowY207fQ0KLS0+ PC9zdHlsZT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlZGVmYXVsdHMgdjpleHQ9 ImVkaXQiIHNwaWRtYXg9IjEwMjYiIC8+DQo8L3htbD48IVtlbmRpZl0tLT48IS0tW2lmIGd0ZSBt c28gOV0+PHhtbD4NCjxvOnNoYXBlbGF5b3V0IHY6ZXh0PSJlZGl0Ij4NCjxvOmlkbWFwIHY6ZXh0 PSJlZGl0IiBkYXRhPSIxIiAvPg0KPC9vOnNoYXBlbGF5b3V0PjwveG1sPjwhW2VuZGlmXS0tPg0K PC9oZWFkPg0KPGJvZHkgbGFuZz0iRU4tR0IiIGxpbms9ImJsdWUiIHZsaW5rPSJwdXJwbGUiPg0K PGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fu cy1zZXJpZjtjb2xvcjojMUY0OTdEO21zby1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTIj5KdXN0aW4s IExlaWYsPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90Oyxz YW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0Q7bXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1z ZXJpZjtjb2xvcjojMUY0OTdEO21zby1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTIj5UaGFua3MgZm9y IHRoaXMgZHJhZnQuPGEgbmFtZT0iX01haWxFbmRDb21wb3NlIj4gSSBvbmx5IGhhdmUgc29tZSBn ZW5lcmFsIGNvbW1lbnRzIGF0IHRoaXMgcG9pbnQuIFRoZSBmaXJzdCB0d28gY29uY2VybiB0aGUg dXNlIG9mDQogbGFuZ3VhZ2U7IEkgbWlnaHQgYmUgaGFpci1zcGxpdHRpbmc6IFlNTVYuIFRoZSBm aW5hbCBjb21tZW50IGlzIG1vcmUgc3Vic3RhbnRpdmUuDQo8bzpwPjwvbzpwPjwvYT48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0Q7 bXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEO21zby1m YXJlYXN0LWxhbmd1YWdlOkVOLVVTIj4xLiBWZWN0b3JzIGhhdmUgYSB2ZXJ5IHNwZWNpZmljIGZv cm1hbCBtZWFuaW5nIGluIG1hdGhlbWF0aWNzLiBHaXZlbiB0aGF0IHRoaXMgaXMgYW4gZW5naW5l ZXJpbmcgY29tbXVuaXR5LCBJIHRoaW5rIHRoZXJl4oCZcyBhIHBvc3NpYmlsaXR5DQogb2YgY3Jl YXRpbmcgY29uZnVzaW9uIGZyb20gdGhlIHVzZSBvZiB0aGlzIGxhbmd1YWdlLiBZb3UgY29ycmVj dGx5IHRyeSB0byBkaXNhbWJpZ3VhdGUgdGhpcyBpbiAyLjIsIGJ1dCB0aGUgdXNlIG9mIGRpZmZl cmVudCBsYW5ndWFnZSB3b3VsZCBtYWtlIHRoaXMgdW5uZWNlc3NhcnkuPG86cD48L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5 N0Q7bXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEO21z by1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTIj4yLiBUaGUgZHJhZnQgdGFsa3Mgb2YgdmVjdG9ycyBv ZiB0cnVzdCBidXQgYWN0dWFsbHkgZGVzY3JpYmVzIHR5cGVzIG9mIGV2aWRlbmNlIGFuZCBhdHRy aWJ1dGVzIHRoYXQgY2FuIGJlIGFzc29jaWF0ZWQgd2l0aCB0aGVzZS4gQXMNCiB5b3UgZGlzY3Vz cyBpbiBzZWN0aW9uIDcuMSwgdGhlcmUgaXMgYSBzcGVjaWZpYyB0cnVzdCBjb250ZXh0IHdoaWNo IGNvbmZlcnMgc2VtYW50aWNzIG9uIHRoZXNlIGF0dHJpYnV0ZXMgZXggcG9zdCBmYWN0by4gVGh1 cyB0aGlzIGV2aWRlbmNlIGFuZCB0aGVpciBhdHRyaWJ1dGVzIGNhbiBpbmZvcm0gcnVudGltZSBv dXRjb21lcywgaW4gdGhlIGNvbnRleHQgb2YgYSBnaXZlbiB0cnVzdCBjb250ZXh0LCBidXQgZG8g bm90IGRlZmluZSBpdC4gSSB0aGluaw0KIGl0IG1pZ2h0IGJlIGhlbHBmdWwgdG8gcmVjb25zaWRl ciB0aGUgZGVzY3JpcHRpb24gb2YgdGhpcyB3b3JrLCBzbyB0aGF0IGl0cyBnb2FsIGlzIGNsZWFy ZXIgdG8gdGhlIHJlYWRlcjsgYW5kIHNldCBvdXQgdGhlIGZ1bmRhbWVudGFsIHJvbGUgb2YgdGhl IHRydXN0IGNvbnRleHQgd2l0aGluIHRoZSBpbnRyb2R1Y3Rpb24vYmFja2dyb3VuZC4NCjxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtj b2xvcjojMUY0OTdEO21zby1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTIj48bzpwPiZuYnNwOzwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6 IzFGNDk3RDttc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1VUyI+My4gVGhlIGdvYWwgb2YgdGhlIGRy YWZ0LCBhcyBJIHVuZGVyc3RhbmQgaXQsIGlzIHRvIGVuYWJsZSBSUHMgYW5kIElkUHMgdG8gc2hh cmUgYSBjb21tb24gdm9jYWJ1bGFyeSBvZiBldmlkZW5jZSBhbmQgdGhlaXIgYXR0cmlidXRlcy4N CiBUaGlzIGF2b2lkcyB0aGUg4oCcYnVuZGxpbmfigJ0gb2YgZGlmZmVyZW50IGtpbmRzIG9mIGV2 aWRlbmNlIGJ5IGFsbG93aW5nIGZvciBkZWNvbXBvc2FiaWxpdHkuIFRoaXMgZXZpZGVuY2UsIG5v dyB1bmJ1bmRsZWQsIGNhbiBiZSBlbXBsb3llZCBpbiBkaWZmZXJlbnQgdHJ1c3QgY29udGV4dHMs IGZhY2lsaXRhdGluZyBpbnRlcm9wZXJhYmlsaXR5IGFjcm9zcyB0cnVzdCBmcmFtZXdvcmsuIFNv IGZhciBzbyBnb29kPyBIb3dldmVyIEnigJlsbCBub3RlIHRoYXQNCiB0aGUgZXZpZGVuY2VzIGFu ZCBhdHRyaWJ1dGVzIGRlc2NyaWJlZCBpbiBzZWN0aW9uIDMgYXJlIG9mdGVuIHRoZW1zZWx2ZXMg YnVuZGxlcyAo4oCcQzUgU2VhbGVkIGhhcmR3YXJlIHRva2VuIC8gdHJ1c3RlZCBiaW9tZXRyaWMg LyBUUE0tYmFja2VkIGtleXMpLiBTbywgcGxheWluZyBkZXZpbOKAmXMgYWR2b2NhdGUsIHdoYXQg aXMgdG8gc3RvcCBhY3RvcnMgZnJvbSBkZWNvbXBvc2luZyB0aGUgY29yZSBlbGVtZW50cyBkZXNj cmliZWQgaW4gc2VjdGlvbg0KIDM/IEluZGVlZCBJIHRoaW5rIGl04oCZcyBhY3R1YWxseSBhIGdv YWwgb2YgdGhpcyBkb2N1bWVudCB0byBwZXJtaXQgdGhhdCB0aHJvdWdoIGV4dGVuc2lvbnMuIEkg d29uZGVyIHRoZXJlZm9yZSB3aGV0aGVyIGFuIGV4Y2VzcyBvZiBkZWNvbXBvc2FiaWxpdHkgd2ls bCBhY3R1YWxseSBhZ2dyYXZhdGUgaW50ZXJvcGVyYWJpbGl0eSBiZXR3ZWVuIHRydXN0IGNvbnRl eHRzLiBDbGVhcmx5IHRoaXMgY291bGQgYmUgYWRkcmVzc2VkIGJ5IHNldHRpbmcgbm9ybXMsDQog YnV0IHRoZW4geW914oCZdmUgcmVpbnZlbnRlZCBOSVNUIDgwMC02My4gQWx0ZXJuYXRpdmVseSB5 b3UgY291bGQgaW1hZ2luZSBhIHRheG9ub215IG9mIGV2aWRlbmNlLCB3aXRoIGNsYXNzZXMgYW5k ICh0aHJvdWdoIGV4dGVuc2lvbnMpIHN1Yi1jbGFzc2VzIGFsbG93aW5nIGZvciBncmVhdGVyIHNw ZWNpZmljaXR5LCB3aGlsZSBwcm92aWRpbmcgZm9yIGEgZ2VuZXJhbCBpbnRlcnByZXRhdGlvbiBp ZiBhY3RvcnMgZG8gbm90IHNoYXJlIHRoZSBzYW1lDQogdm9jYWJ1bGFyeS4gSSBoZXNpdGF0ZSB0 byBkZXNjcmliZSB0aGlzIGFzIGZyYWN0YWwsIGJ1dCBJIGhvcGUgeW91IGNhbiBzZWUgd2hhdCBJ 4oCZbSBkcml2aW5nIGF0LjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGli cmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEO21zby1mYXJlYXN0LWxhbmd1YWdlOkVO LVVTIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1 b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RDttc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1VUyI+ Sm9zaC48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNh bnMtc2VyaWY7Y29sb3I6IzFGNDk3RDttc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1VUyI+PG86cD48 L286cD48L3NwYW4+PC9wPg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29s aWQgYmx1ZSAxLjVwdDtwYWRkaW5nOjBjbSAwY20gMGNtIDQuMHB0Ij4NCjxkaXY+DQo8ZGl2IHN0 eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNFMUUxRTEgMS4wcHQ7cGFkZGluZzoz LjBwdCAwY20gMGNtIDBjbSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBsYW5nPSJF Ti1VUyIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZx dW90OyxzYW5zLXNlcmlmIj5Gcm9tOjwvc3Bhbj48L2I+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1z ZXJpZiI+IHZvdCBbbWFpbHRvOnZvdC1ib3VuY2VzQGlldGYub3JnXQ0KPGI+T24gQmVoYWxmIE9m IDwvYj5KdXN0aW4gUmljaGVyPGJyPg0KPGI+U2VudDo8L2I+IDI3IEp1bmUgMjAxNSAwNDoxNTxi cj4NCjxiPlRvOjwvYj4gdm90QGlldGYub3JnPGJyPg0KPGI+U3ViamVjdDo8L2I+IFtWb1RdIFZl Y3RvcnMgb2YgVHJ1c3QgSS1EPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+SGkgRXZlcnlvbmUsPG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj5JIGhhdmUgdGFrZW4gdGhlIGluaXRpYWwgc3RyYXdtYW4gcHJvcG9zYWwgYWxv bmcgd2l0aCBhIHN1YnN0YW50aWFsIG51bWJlciBvZiBlZGl0cyBhbmQgaW5wdXRzIGZyb20gc2V2 ZXJhbCBmb2xrcyBhbmQgaGF2ZSBjcmVhdGVkIGFuIGluaXRpYWwgSS1EIG9mIHRoZSBkb2N1bWVu dDo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxv OnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PGEgaHJlZj0iaHR0cHM6Ly90b29scy5pZXRmLm9yZy9pZC9kcmFmdC1yaWNoZXItdmVjdG9ycy1v Zi10cnVzdC0wMCI+aHR0cHM6Ly90b29scy5pZXRmLm9yZy9pZC9kcmFmdC1yaWNoZXItdmVjdG9y cy1vZi10cnVzdC0wMDwvYT48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+SXTigJlzIHN0aWxsIGEgdmVyeSBkcmFmdHkgZHJhZnQsIGJ1dCBob3Bl ZnVsbHkgaXTigJlzIHN0YXJ0aW5nIHRvIG1ha2UgdGhpcyBhIGNvbmNyZXRlIHRoaW5nLiBQbGVh c2UgcmVhZCBpdCBvdmVyIGFuZCBkaXNjdXNzIGl0IGhlcmUgb24gdGhlIGxpc3QuPG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwv bzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkkgd291bGQgbGlr ZSB0byBwcm9wb3NlIGEgYmFyLUJvRiBpbiBQcmFndWUgZm9yIFZvVCBmb3IgYW55b25lIHdobyB3 b3VsZCBsaWtlIHRvIGRpc2N1c3MgdGhpcy4gSWYgeW914oCZcmUgaW50ZXJlc3RlZCAoYW5kIHdp bGwgYmUgdGhlcmUgaW4gcGVyc29uKSwgbGV0IG1lIGtub3chPG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwO+KAlCBKdXN0aW48bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxmb250IHNpemU9IjEiPiA8Zm9udCBm YWNlPSJDb3JiZWwiPiAgIDxiciAvPg0KSmlzYyBpcyBhIHJlZ2lzdGVyZWQgY2hhcml0eSAobnVt YmVyIDExNDk3NDApIGFuZCBhIGNvbXBhbnkgbGltaXRlZCBieSBndWFyYW50ZWUgd2hpY2ggaXMg cmVnaXN0ZXJlZCBpbiBFbmdsYW5kIHVuZGVyIENvbXBhbnkgTm8uIDU3NDczMzksIFZBVCBOby4g R0IgMTk3IDA2MzIgODYuIEppc2PigJlzIHJlZ2lzdGVyZWQgb2ZmaWNlIGlzOiBPbmUgQ2FzdGxl cGFyaywgVG93ZXIgSGlsbCwgQnJpc3RvbCwgQlMyIDBKQS4gVCAwMjAzIDY5NyA1ODAwLjxiciAv PjxiciAvPg0KIA0KSmlzYyBTZXJ2aWNlcyBMaW1pdGVkIGlzIGEgd2hvbGx5IG93bmVkIEppc2Mg c3Vic2lkaWFyeSBhbmQgYSBjb21wYW55IGxpbWl0ZWQgYnkgZ3VhcmFudGVlIHdoaWNoIGlzIHJl Z2lzdGVyZWQgaW4gRW5nbGFuZCB1bmRlciBjb21wYW55IG51bWJlciAyODgxMDI0LCBWQVQgbnVt YmVyIEdCIDE5NyAwNjMyIDg2LiBUaGUgcmVnaXN0ZXJlZCBvZmZpY2UgaXM6IE9uZSBDYXN0bGUg UGFyaywgVG93ZXIgSGlsbCwgQnJpc3RvbCBCUzIgMEpBLiBUIDAyMDMgNjk3IDU4MDAuDQogDQog ICAgDQo8L2ZvbnQ+PC9mb250PjwvYm9keT4NCjwvaHRtbD4NCg== --_000_DB3PR07MB138FDE12ED039C4C8CA9968BCA90DB3PR07MB138eurprd_-- From nobody Tue Jun 30 04:35:11 2015 Return-Path: X-Original-To: vot@ietfa.amsl.com Delivered-To: vot@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2E5A11A8942 for ; Tue, 30 Jun 2015 04:35:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3w35BqcEEFWE for ; Tue, 30 Jun 2015 04:35:08 -0700 (PDT) Received: from mailscan1.extendcp.co.uk (mailscan11.extendcp.co.uk [79.170.45.20]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D69A21A8983 for ; Tue, 30 Jun 2015 04:35:07 -0700 (PDT) Received: from mailscanlb0.hi.local ([10.0.44.160] helo=mailscan4.hi.local) by mailscan-g73.hi.local with esmtp (Exim 4.80.1) (envelope-from ) id 1Z9tod-0002aL-0y; Tue, 30 Jun 2015 12:35:03 +0100 Received: from mailscanlb0.hi.local ([10.0.44.160] helo=mail43.extendcp.co.uk) by mailscan4.hi.local with esmtps (UNKNOWN:DHE-RSA-AES256-GCM-SHA384:256) (Exim 4.80.1) (envelope-from ) id 1Z9toc-0007U0-A0; Tue, 30 Jun 2015 12:35:03 +0100 Received: from host-2-96-222-144.as13285.net ([2.96.222.144] helo=[192.168.1.2]) by mail43.extendcp.com with esmtpsa (TLSv1:DHE-RSA-AES256-SHA:256) (Exim 4.80.1) id 1Z9toa-0003Z4-3z; Tue, 30 Jun 2015 12:35:00 +0100 Mime-Version: 1.0 (Mac OS X Mail 8.2 \(2098\)) Content-Type: multipart/signed; boundary="Apple-Mail=_687FF112-1682-408B-BC36-54DB63667DFA"; protocol="application/pgp-signature"; micalg=pgp-sha512 X-Pgp-Agent: GPGMail 2.5 From: Mark Lizar In-Reply-To: <69B21050-7E52-4B85-8081-8DE210DE432A@nist.gov> Date: Tue, 30 Jun 2015 12:34:50 +0100 Message-Id: <675F1A61-4881-4365-8138-8517B2047B91@smartspecies.com> References: <147EE18440E5AF44834B220ED35BA530014AB1AEC1@WLGPRDMBX02.dia.govt.nz> <69B21050-7E52-4B85-8081-8DE210DE432A@nist.gov> To: "Grassi, Paul A." X-Mailer: Apple Mail (2.2098) X-Authenticated-As: mark@smartspecies.com X-Extend-Src: mailout Archived-At: Cc: Colin Wallis , "vot@ietf.org" , Justin Richer Subject: Re: [VoT] Clause 7 edgy on scope? (RE: Vectors of Trust I-D) X-BeenThere: vot@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Vectors of Trust discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 30 Jun 2015 11:35:11 -0000 --Apple-Mail=_687FF112-1682-408B-BC36-54DB63667DFA Content-Type: multipart/alternative; boundary="Apple-Mail=_C36F22AD-EED0-4028-B0D2-048B24A1A829" --Apple-Mail=_C36F22AD-EED0-4028-B0D2-048B24A1A829 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 nice and crisp. I can really start to imagine how discovery and trust marks can be used = to scale trust. Although there is some additional issues around the = overarching trust framework (whatever that is, I am assuming law). For = example assessing trust marks so that they are appropriate for the = purpose and also for application in the framework, with a robust method = for assessing and asserting integrity of trust marks. In this context = then I think it would be clear how the trust marks fit with VOT. Its = the gap between these elements I suspect that needs to be further = articulated and understood. nicely thought provoking .. > On 30 Jun 2015, at 02:35, Grassi, Paul A. = wrote: >=20 > I personally like the idea of discoverability at the onset, and the = discussion that will follow. >=20 > This was great to read, thanks to you and Leif for the work! >=20 > On Jun 29, 2015, at 8:49 PM, "Justin Richer" > wrote: >=20 >> Colin, that=E2=80=99s a great question, because I=E2=80=99m honestly = not sure what the answer is yet. I think that the vectors only make = sense in the context of some kind of trust framework setup, but that = sometimes those policies will be hard-coded at configuration time and = won=E2=80=99t need to be dynamically bound or discovered. That said, I = think the real value of this is going to be cross-domain where an RP = could subscribe to (and understand) multiple trust marks and be able to = validate them at runtime. Still, that piece might be separable enough, = and perhaps substantive enough, to be its own draft. >>=20 >> That said, I figured I=E2=80=99d write it down down and figure out = where it=E2=80=99s actually supposed to go later. :) >>=20 >> =E2=80=94 Justin >>=20 >>> On Jun 29, 2015, at 7:14 PM, Colin Wallis > wrote: >>>=20 >>> Many thanks Justin and Leif >>>=20 >>> I=E2=80=99ve done a first pass/light read, and from that, I think it = is a terrific first cut that gets us on the path to normalizing the = discussions over the past 9 months. >>>=20 >>> Aside from a few tidy ups, I just have this slight concern whether = all of Clause 7 (Discovery and Verification) is in scope for normative = text? >>> I certainly appreciate that in most implementations and deployments, = there would be a dependency on an operational trust framework and = trustmark. >>> But is it too big a stretch to make that normative for this work? >>> Just a thought.. and more than happy to be proven wrong.. J. >>>=20 >>> Cheers >>> Colin >>>=20 >>>=20 >>> From: vot [mailto:vot-bounces@ietf.org = ] On Behalf Of Justin Richer >>> Sent: Saturday, 27 June 2015 3:15 p.m. >>> To: vot@ietf.org >>> Subject: [VoT] Vectors of Trust I-D >>>=20 >>> Hi Everyone, >>>=20 >>> I have taken the initial strawman proposal along with a substantial = number of edits and inputs from several folks and have created an = initial I-D of the document: >>>=20 >>> https://tools.ietf.org/id/draft-richer-vectors-of-trust-00 = >>>=20 >>> It=E2=80=99s still a very drafty draft, but hopefully it=E2=80=99s = starting to make this a concrete thing. Please read it over and discuss = it here on the list. >>>=20 >>> I would like to propose a bar-BoF in Prague for VoT for anyone who = would like to discuss this. If you=E2=80=99re interested (and will be = there in person), let me know! >>>=20 >>> =E2=80=94 Justin >>=20 >> _______________________________________________ >> vot mailing list >> vot@ietf.org >> https://www.ietf.org/mailman/listinfo/vot = > _______________________________________________ > vot mailing list > vot@ietf.org > https://www.ietf.org/mailman/listinfo/vot = --Apple-Mail=_C36F22AD-EED0-4028-B0D2-048B24A1A829 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 nice and crisp. 

I can really start to imagine how discovery and trust marks = can be used to scale trust. Although there is some additional issues = around the overarching trust framework (whatever that is, I am assuming = law). For example assessing trust marks so that they are appropriate for = the purpose and also for application in the framework, with a robust = method for assessing and asserting integrity of trust marks.  In = this context then I think it would be clear how the trust marks fit with = VOT.  Its the gap between these elements I suspect that needs to be = further articulated and understood.

nicely thought provoking   = .. 

On 30 Jun 2015, at 02:35, = Grassi, Paul A. <paul.grassi@nist.gov> wrote:

I personally like the = idea of discoverability at the onset, and the discussion that will = follow.

This was great to read, thanks to you and Leif for the = work!

On Jun 29, 2015, at 8:49 PM, "Justin Richer" = <jricher@mit.edu> = wrote:

Colin, = that=E2=80=99s a great question, because I=E2=80=99m honestly not sure = what the answer is yet. I think that the vectors only make sense in the = context of some kind of trust framework setup, but that sometimes those = policies will be hard-coded at configuration time and won=E2=80=99t need = to be dynamically bound or discovered. That said, I think the real value = of this is going to be cross-domain where an RP could subscribe to (and = understand) multiple trust marks and be able to validate them at = runtime. Still, that piece might be separable enough, and perhaps = substantive enough, to be its own draft. 

That said, I figured I=E2=80=99d write = it down down and figure out where it=E2=80=99s actually supposed to go = later. :)

 =E2=80=94 Justin

On Jun 29, 2015, at 7:14 PM, Colin Wallis <Colin.Wallis@dia.govt.nz> = wrote:

Many thanks = Justin and Leif

 

I=E2=80=99ve done a first pass/light read, and = from that, I think it is a terrific first cut that gets us on the path = to normalizing the discussions over the past 9 months. 

 

Aside = from a few tidy ups, I just have this slight concern whether all of = Clause 7 (Discovery and Verification) is in scope for normative = text?
I certainly appreciate = that in most implementations and deployments, there would be a = dependency on an operational trust framework and trustmark.
But is it too big a stretch to make that = normative for this work?
Just a = thought.. and more than happy to be proven wrong.. J.

 

Cheers
Colin

 

 

From: vot [mailto:vot-bounces@ietf.org] On Behalf = Of Justin = Richer
Sent: Saturday, 27 June 2015 3:15 = p.m.
To: vot@ietf.org
Subject: [VoT] Vectors of Trust = I-D
 
Hi Everyone,
 
I have taken the initial strawman proposal along with = a substantial number of edits and inputs from several folks and have = created an initial I-D of the document:
 
https://tools.ietf.org/id/draft-richer-vectors-of-trust-00=
 
It=E2=80=99s still a = very drafty draft, but hopefully it=E2=80=99s starting to make this a = concrete thing. Please read it over and discuss it here on the list.
 
I would like to propose a bar-BoF in = Prague for VoT for anyone who would like to discuss this. If you=E2=80=99r= e interested (and will be there in person), let me know!
 
 =E2=80=94 Justin

_______________________________________________
vot mailing list
vot@ietf.org
https://www.ietf.org/mailman/listinfo/vot
_______________________________________________
vot mailing list
vot@ietf.org
https://www.ietf.org/mailman/listinfo/vot

= --Apple-Mail=_C36F22AD-EED0-4028-B0D2-048B24A1A829-- --Apple-Mail=_687FF112-1682-408B-BC36-54DB63667DFA Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP using GPGMail -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org iQEcBAEBCgAGBQJVkn7bAAoJEIspLIZzUmxu2h0H/2dNl5kqsGInaO0NfPCVnO4k pE2RZvWfaQiX3airv9UrUVJUeROIrg0wQafCb9YXvn5aBMHBaSw3KoVmPP9FJVMQ XF2kAXlsDVgAxKmtpcmpGlStMRv6esEgvIgbCTvdxJvV3EH2u57G2htKS0nfs+c7 YoyA1bl4dLFBKPrLJcbqI+w1F1Tm7HDAvssG+V+aRjusRQ/k5i4kVes4l5td1Ekr LOtSKl/pWhrZHAVW3VPyeRTr6UapHZKJwNUgWIQBO8AUWC3/CVRMHPaacDAv0/DF r86QtXnLwEKv63v9Nk+u2Icp+O3Y0u3Yi6cWb7Et7aZwv5NE/W/GmhDaVlHsE+E= =Pxt6 -----END PGP SIGNATURE----- --Apple-Mail=_687FF112-1682-408B-BC36-54DB63667DFA-- From nobody Tue Jun 30 06:23:30 2015 Return-Path: X-Original-To: vot@ietfa.amsl.com Delivered-To: vot@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E8A6A1AD068 for ; Tue, 30 Jun 2015 06:23:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.01 X-Spam-Level: X-Spam-Status: No, score=-2.01 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4V_0Gs40d_xe for ; Tue, 30 Jun 2015 06:23:28 -0700 (PDT) Received: from v2.bluepopcorn.net (v2.bluepopcorn.net [IPv6:2607:f2f8:a994::2]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 077831AD061 for ; Tue, 30 Jun 2015 06:23:27 -0700 (PDT) Received: from splunge.local (mobile-166-170-028-120.mycingular.net [166.170.28.120] (may be forged)) (authenticated bits=0) by v2.bluepopcorn.net (8.14.3/8.14.3/Debian-9.4) with ESMTP id t5UDNLCM016809 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES128-SHA bits=128 verify=NO); Tue, 30 Jun 2015 06:23:24 -0700 Message-ID: <55929843.2030104@bluepopcorn.net> Date: Tue, 30 Jun 2015 06:23:15 -0700 From: Jim Fenton User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:31.0) Gecko/20100101 Thunderbird/31.7.0 MIME-Version: 1.0 To: Justin Richer , vot@ietf.org References: <4DF01AF4-CD33-4BB7-958B-FFECD37C8AFE@mit.edu> In-Reply-To: <4DF01AF4-CD33-4BB7-958B-FFECD37C8AFE@mit.edu> Content-Type: multipart/alternative; boundary="------------090101060406000104010701" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=bluepopcorn.net; s=supersize; t=1435670605; bh=h4NDzOfv3EYSyMOc8OEBfybUTwzfYggq8Iarw5epsEo=; h=Date:From:To:Subject:References:In-Reply-To; b=edO1yib4IE4LjhanlCYfoY91HiCImPF9C+dmIZwSYoohxd63Y/dLVhFU7+uSmh3ZK Hynio6gzpRKXBy5wy1DwJZXiN2xh8rZKwETvHoQ2Z9skaceknyGkhlI8c/sh6FcPTV tUQmYc0PbBrSQd7s3GabaHwQ/nmjtNytLKnVn5tw= Archived-At: Subject: Re: [VoT] Vectors of Trust I-D X-BeenThere: vot@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Vectors of Trust discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 30 Jun 2015 13:23:30 -0000 This is a multi-part message in MIME format. --------------090101060406000104010701 Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: quoted-printable Justin and Leif, thanks for getting things moving with this draft. The biggest surprise to me is that (section 2.2, last paragraph) the components of the vector do not have ordinal properties; i.e., they are just an enumerated list. Aside from confusing people that are expecting a vector to be a set of scalars, it also requires Relying Parties, for example, to enumerate all of the types of credential management they will accept rather than "C2 or better". This isn't a huge problem at the current scale, but I'm concerned that the number of choices might grow. I also have some problem with the use of the term "credential" because it encompasses management of attributes as well as tokens, which then overlaps with the identity proofing dimension which is, more generally, the question of how strongly the relying party can depend on attribute values. I'd rather that we use the term "token" rather than "credential" to keep these separate. -Jim On 6/26/15 8:15 PM, Justin Richer wrote: > Hi Everyone, > > I have taken the initial strawman proposal along with a substantial > number of edits and inputs from several folks and have created an > initial I-D of the document: > > https://tools.ietf.org/id/draft-richer-vectors-of-trust-00 > > It=92s still a very drafty draft, but hopefully it=92s starting to make= > this a concrete thing. Please read it over and discuss it here on the > list. > > I would like to propose a bar-BoF in Prague for VoT for anyone who > would like to discuss this. If you=92re interested (and will be there i= n > person), let me know! > > =97 Justin > > > _______________________________________________ > vot mailing list > vot@ietf.org > https://www.ietf.org/mailman/listinfo/vot --------------090101060406000104010701 Content-Type: text/html; charset=windows-1252 Content-Transfer-Encoding: 8bit
Justin and Leif, thanks for getting things moving with this draft.

The biggest surprise to me is that (section 2.2, last paragraph) the components of the vector do not have ordinal properties; i.e., they are just an enumerated list. Aside from confusing people that are expecting a vector to be a set of scalars, it also requires Relying Parties, for example, to enumerate all of the types of credential management they will accept rather than "C2 or better". This isn't a huge problem at the current scale, but I'm concerned that the number of choices might grow.

I also have some problem with the use of the term "credential" because it encompasses management of attributes as well as tokens, which then overlaps with the identity proofing dimension which is, more generally, the question of how strongly the relying party can depend on attribute values. I'd rather that we use the term "token" rather than "credential" to keep these separate.

-Jim

On 6/26/15 8:15 PM, Justin Richer wrote:
Hi Everyone,

I have taken the initial strawman proposal along with a substantial number of edits and inputs from several folks and have created an initial I-D of the document:


Its still a very drafty draft, but hopefully its starting to make this a concrete thing. Please read it over and discuss it here on the list.

I would like to propose a bar-BoF in Prague for VoT for anyone who would like to discuss this. If youre interested (and will be there in person), let me know!

Justin


_______________________________________________
vot mailing list
vot@ietf.org
https://www.ietf.org/mailman/listinfo/vot

--------------090101060406000104010701-- From nobody Tue Jun 30 08:54:32 2015 Return-Path: X-Original-To: vot@ietfa.amsl.com Delivered-To: vot@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3D0EC1ACD28 for ; Tue, 30 Jun 2015 08:54:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.311 X-Spam-Level: X-Spam-Status: No, score=-2.311 tagged_above=-999 required=5 tests=[BAYES_20=-0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Nm5Li8rLAtlq for ; Tue, 30 Jun 2015 08:54:28 -0700 (PDT) Received: from dmz-mailsec-scanner-7.mit.edu (dmz-mailsec-scanner-7.mit.edu [18.7.68.36]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 738851AC42B for ; Tue, 30 Jun 2015 08:54:28 -0700 (PDT) X-AuditID: 12074424-f79b46d000001e7f-8e-5592bbb34741 Received: from mailhub-auth-4.mit.edu ( [18.7.62.39]) (using TLS with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by dmz-mailsec-scanner-7.mit.edu (Symantec Messaging Gateway) with SMTP id AE.16.07807.3BBB2955; Tue, 30 Jun 2015 11:54:27 -0400 (EDT) Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) by mailhub-auth-4.mit.edu (8.13.8/8.9.2) with ESMTP id t5UFsQo5001794; Tue, 30 Jun 2015 11:54:26 -0400 Received: from artemisia.richer.local (static-96-237-195-53.bstnma.fios.verizon.net [96.237.195.53]) (authenticated bits=0) (User authenticated as jricher@ATHENA.MIT.EDU) by outgoing.mit.edu (8.13.8/8.12.4) with ESMTP id t5UFsO5V001581 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT); Tue, 30 Jun 2015 11:54:26 -0400 Content-Type: multipart/alternative; boundary="Apple-Mail=_3DA89513-05CB-4F62-918E-4B0B9D50E2E6" Mime-Version: 1.0 (Mac OS X Mail 8.2 \(2098\)) From: Justin Richer In-Reply-To: <55929843.2030104@bluepopcorn.net> Date: Tue, 30 Jun 2015 11:54:24 -0400 Message-Id: References: <4DF01AF4-CD33-4BB7-958B-FFECD37C8AFE@mit.edu> <55929843.2030104@bluepopcorn.net> To: Jim Fenton X-Mailer: Apple Mail (2.2098) X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFupnleLIzCtJLcpLzFFi42IRYrdT1928e1KowcZvwhbfOmcxWzT8fMDq wOTxdNUrJo8lS34yBTBFcdmkpOZklqUW6dslcGU0dJ1gL/jkXfF3+UT2BsYDtl2MHBwSAiYS 818EdjFyApliEhfurWfrYuTiEBJYzCTR9fUYC4SzkVHiwbVOVgjnIZPEkb6bbCAtzAIJEueP nWcFsXkF9CQePX3MDmILC6hLNK3sZwKx2QRUJaavaQGzOQX0JZpPTgezWYDih7sbWCHmCEjM PTSNCWKOlcScXYvAbCGBWInFX9aD7RIBmvmgYwUjxNWyEl+3yk1gFJiF5IpZSK6AiGtLLFv4 mhnCNpB42vmKFVNcX+LNuzlMCxjZVjHKpuRW6eYmZuYUpybrFicn5uWlFuma6+VmluilppRu YgSHu4vKDsbmQ0qHGAU4GJV4eHc8nxgqxJpYVlyZe4hRkoNJSZT38K5JoUJ8SfkplRmJxRnx RaU5qcWHGCU4mJVEeHuagHK8KYmVValF+TApaQ4WJXHeTT/4QoQE0hNLUrNTUwtSi2CyMhwc ShK8jSBDBYtS01Mr0jJzShDSTBycIMN5gIbHgtTwFhck5hZnpkPkTzEqSonz1oEkBEASGaV5 cL2wdPSKURzoFWHeXSBVPMBUBtf9CmgwE9Dgl/Zgg0sSEVJSDYyTlZbNcojriVdZumipxTaR te2L9p3SvF42aXPC0/+R+hlp3zUm3Pv11GjBu4vSFWq/CvrK96+bXlX8/dGRWzVzmr4vPX5+ SdbGA1vm/fr8O98wUMMrob1Ed1HwE/U57R2935wu6+ux2f5YHp9r/yWrd9edE1sKnpn9K7kt Oe9gwq6govZtmv8dlFiKMxINtZiLihMBaC8IFyIDAAA= Archived-At: Cc: vot@ietf.org Subject: Re: [VoT] Vectors of Trust I-D X-BeenThere: vot@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Vectors of Trust discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 30 Jun 2015 15:54:31 -0000 --Apple-Mail=_3DA89513-05CB-4F62-918E-4B0B9D50E2E6 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=windows-1252 Leif and I went back and forth on this one and decided to put a stake in = the ground to start at. One of the biggest challenges in LoA-style = systems has always been the overloading of the linear scale model. I=92ve = seen passionate arguments about the ordering of otherwise similar = components, with people willing to die for the cause on both sides. I = think that we can side step that with the technology expression while = still keeping the =93common sense semantics=94 of ordinals. In that =932 = is probably better than 1 for most values of better but mostly they=92re = just different=94. I=92m also afraid of the growth of the space for each component, but = hopefully by having a few definitions set good examples (like the spec = itself) we can encourage people to summarize the categories = appropriately, as Josh talks about in his response. While I agree that naming things is hard, and I=92m open to new names, = I=92m very strongly against the use of =93token=94 here. It=92s already = far too overloaded a term. OAuth issues tokens, FIDO calls their devices = tokens, the IETF=92s =93token binding=94 is calling something (that I=92m = not even sure what it is) tokens, even the WS-* folks have started to = re-cast all the WS-* stuff as =93tokens=94. I think the more precise = term is =93primary credential=94 or =93primary user credential=94. = Neither of these have anything to do with the attributes, but they do = speak to how strongly bound the credential is to the account. Still, I=92m= open to better names. Thanks for the feedback, =97 Justin > On Jun 30, 2015, at 9:23 AM, Jim Fenton = wrote: >=20 > Justin and Leif, thanks for getting things moving with this draft. >=20 > The biggest surprise to me is that (section 2.2, last paragraph) the = components of the vector do not have ordinal properties; i.e., they are = just an enumerated list. Aside from confusing people that are expecting = a vector to be a set of scalars, it also requires Relying Parties, for = example, to enumerate all of the types of credential management they = will accept rather than "C2 or better". This isn't a huge problem at the = current scale, but I'm concerned that the number of choices might grow. >=20 > I also have some problem with the use of the term "credential" because = it encompasses management of attributes as well as tokens, which then = overlaps with the identity proofing dimension which is, more generally, = the question of how strongly the relying party can depend on attribute = values. I'd rather that we use the term "token" rather than = "credential" to keep these separate. >=20 > -Jim >=20 > On 6/26/15 8:15 PM, Justin Richer wrote: >> Hi Everyone, >>=20 >> I have taken the initial strawman proposal along with a substantial = number of edits and inputs from several folks and have created an = initial I-D of the document: >>=20 >> https://tools.ietf.org/id/draft-richer-vectors-of-trust-00 = >>=20 >> It=92s still a very drafty draft, but hopefully it=92s starting to = make this a concrete thing. Please read it over and discuss it here on = the list. >>=20 >> I would like to propose a bar-BoF in Prague for VoT for anyone who = would like to discuss this. If you=92re interested (and will be there in = person), let me know! >>=20 >> =97 Justin >>=20 >>=20 >> _______________________________________________ >> vot mailing list >> vot@ietf.org >> https://www.ietf.org/mailman/listinfo/vot = >=20 --Apple-Mail=_3DA89513-05CB-4F62-918E-4B0B9D50E2E6 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=windows-1252
Leif and I went back and forth on this one = and decided to put a stake in the ground to start at. One of the biggest = challenges in LoA-style systems has always been the overloading of the = linear scale model. I=92ve seen passionate arguments about the ordering = of otherwise similar components, with people willing to die for the = cause on both sides. I think that we can side step that with the = technology expression while still keeping the =93common sense semantics=94= of ordinals. In that =932 is probably better than 1 for most values of = better but mostly they=92re just different=94.

I=92m also afraid of the growth of the = space for each component, but hopefully by having a few definitions set = good examples (like the spec itself) we can encourage people to = summarize the categories appropriately, as Josh talks about in his = response.

While I agree that = naming things is hard, and I=92m open to new names, I=92m very strongly = against the use of =93token=94 here. It=92s already far too overloaded a = term. OAuth issues tokens, FIDO calls their devices tokens, the IETF=92s = =93token binding=94 is calling something (that I=92m not even sure what = it is) tokens, even the WS-* folks have started to re-cast all the WS-* = stuff as =93tokens=94. I think the more precise term is =93primary = credential=94 or =93primary user credential=94. Neither of these have = anything to do with the attributes, but they do speak to how strongly = bound the credential is to the account. Still, I=92m open to better = names.

Thanks for = the feedback,
 =97 Justin

On Jun 30, 2015, at 9:23 AM, Jim Fenton <fenton@bluepopcorn.net> wrote:

=20
Justin and Leif, thanks for getting things moving with this draft.

The biggest surprise to me is that (section 2.2, last paragraph) the components of the vector do not have ordinal properties; i.e., they are just an enumerated list. Aside from confusing people that are expecting a vector to be a set of scalars, it also requires Relying Parties, for example, to enumerate all of the types of credential management they will accept rather than "C2 or better". This isn't a huge problem at the current scale, but I'm concerned that the number of choices might grow.

I also have some problem with the use of the term "credential" because it encompasses management of attributes as well as tokens, which then overlaps with the identity proofing dimension which is, more generally, the question of how strongly the relying party can depend on attribute values.  I'd rather that we use the term "token" rather than "credential" to keep these separate.

-Jim

On 6/26/15 8:15 PM, Justin Richer wrote:
=20 Hi Everyone,

I have taken the initial strawman proposal along with a substantial number of edits and inputs from several folks and have created an initial I-D of the document:

https://tools.ietf.org/id/draft-richer-vectors-of-trust-00<= /div>

It=92s still a very drafty draft, but hopefully = it=92s starting to make this a concrete thing. Please read it over and discuss it here on the list.

I would like to propose a bar-BoF in Prague for = VoT for anyone who would like to discuss this. If you=92re = interested (and will be there in person), let me know!

 =97 Justin


_______________________________________________
vot mailing list
vot@ietf.org
https://www.ietf.org/ma=
ilman/listinfo/vot


= --Apple-Mail=_3DA89513-05CB-4F62-918E-4B0B9D50E2E6-- From nobody Tue Jun 30 09:02:10 2015 Return-Path: X-Original-To: vot@ietfa.amsl.com Delivered-To: vot@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8834A1ACD4F for ; Tue, 30 Jun 2015 09:02:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.21 X-Spam-Level: X-Spam-Status: No, score=-4.21 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xWUELlegh5pL for ; Tue, 30 Jun 2015 09:02:05 -0700 (PDT) Received: from dmz-mailsec-scanner-1.mit.edu (dmz-mailsec-scanner-1.mit.edu [18.9.25.12]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 52AED1ACD48 for ; Tue, 30 Jun 2015 09:02:03 -0700 (PDT) X-AuditID: 1209190c-f79296d000000622-cd-5592bd793f89 Received: from mailhub-auth-2.mit.edu ( [18.7.62.36]) (using TLS with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by dmz-mailsec-scanner-1.mit.edu (Symantec Messaging Gateway) with SMTP id 39.C0.01570.97DB2955; Tue, 30 Jun 2015 12:02:01 -0400 (EDT) Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) by mailhub-auth-2.mit.edu (8.13.8/8.9.2) with ESMTP id t5UG2012022496; Tue, 30 Jun 2015 12:02:01 -0400 Received: from artemisia.richer.local (static-96-237-195-53.bstnma.fios.verizon.net [96.237.195.53]) (authenticated bits=0) (User authenticated as jricher@ATHENA.MIT.EDU) by outgoing.mit.edu (8.13.8/8.12.4) with ESMTP id t5UG1xCY005232 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT); Tue, 30 Jun 2015 12:02:00 -0400 Content-Type: multipart/alternative; boundary="Apple-Mail=_F9C9E1A0-DF5D-4639-ADD1-717496541EAD" Mime-Version: 1.0 (Mac OS X Mail 8.2 \(2098\)) From: Justin Richer In-Reply-To: Date: Tue, 30 Jun 2015 12:01:59 -0400 Message-Id: <3F524C09-C71B-49DA-ADD2-AE57610C6C89@mit.edu> References: <4DF01AF4-CD33-4BB7-958B-FFECD37C8AFE@mit.edu> To: Josh Howlett X-Mailer: Apple Mail (2.2098) X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFprAKsWRmVeSWpSXmKPExsUixG6nolu5d1KowbYjBhbXbj5it2j4+YDV gcljyZKfTB4rf19hC2CK4rJJSc3JLEst0rdL4MqY8XglW8HxA4wVfQ0tLA2MB5YxdjFyckgI mEjcX7mFFcIWk7hwbz1bFyMXh5DAYiaJq7ePs0A4Gxkl5u9YywJSJSTwkEmiZ08miM0skCDR /u8MO4jNK6An8ejpYzBbWEBdomllPxOIzSagKjF9TQuYzSkQLfH/bS9zFyMHBwtQ/OzOWIgx ihLnpp1jBAnzClhJdE2NgVjbySix9eR1sFYRAS2J2Q2r2EBqJARkJb5ulZvAKDALyRGzkBwB EdeWWLbwNTOErSmxv3s5C6a4hkTnt4msCxjZVjHKpuRW6eYmZuYUpybrFicn5uWlFuka6uVm luilppRuYgQFPKckzw7GNweVDjEKcDAq8fAmPJ0YKsSaWFZcmXuIUZKDSUmU9/CuSaFCfEn5 KZUZicUZ8UWlOanFhxglOJiVRHh7moByvCmJlVWpRfkwKWkOFiVx3k0/+EKEBNITS1KzU1ML UotgsjIcHEoSvLF7gBoFi1LTUyvSMnNKENJMHJwgw3mAhteD1PAWFyTmFmemQ+RPMSpKifPO BUkIgCQySvPgemEJ6RWjONArwryPdgNV8QCTGVz3K6DBTECDX9qDDS5JREhJNTBO1JASD3i+ +8PHXd5Govfe9Vr9UP2nFBdYrpT6IsGdb8qrD/LOll/VW1ZyrnryI1Jmz6xp0+6Vnn3PrCrq 43dBQ+bIl5Ibr/O3fZbpiZdQb3qWo+uqdZx/xhQlTpOPnSkH/VgdZh/19k3ocS3Xusf3yKZ+ 4ofTXC0h6+Qcz9ZkHtnvwJnR/U2JpTgj0VCLuag4EQCuFlTxIwMAAA== Archived-At: Cc: "vot@ietf.org" Subject: Re: [VoT] Vectors of Trust I-D X-BeenThere: vot@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Vectors of Trust discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 30 Jun 2015 16:02:08 -0000 --Apple-Mail=_F9C9E1A0-DF5D-4639-ADD1-717496541EAD Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Josh, thanks for the great comments. Responses inline: > On Jun 30, 2015, at 7:22 AM, Josh Howlett = wrote: >=20 > Justin, Leif, > =20 > Thanks for this draft. I only have some general comments at this = point. The first two concern the use of language; I might be = hair-splitting: YMMV. The final comment is more substantive. <> > =20 > 1. Vectors have a very specific formal meaning in mathematics. Given = that this is an engineering community, I think there=E2=80=99s a = possibility of creating confusion from the use of this language. You = correctly try to disambiguate this in 2.2, but the use of different = language would make this unnecessary. When we picked the name =E2=80=9Cvectors of trust=E2=80=9D we knew that = both =E2=80=9Cvector=E2=80=9D and =E2=80=9Ctrust=E2=80=9D were terms = that were going to confuse some people but could be explained fairly = succinctly in this context and help get the point across. I=E2=80=99m = honestly welcome to renaming the whole shebang but for now I=E2=80=99ve = yet to hear a better set of terms. > =20 > 2. The draft talks of vectors of trust but actually describes types of = evidence and attributes that can be associated with these. As you = discuss in section 7.1, there is a specific trust context which confers = semantics on these attributes ex post facto. Thus this evidence and = their attributes can inform runtime outcomes, in the context of a given = trust context, but do not define it. I think it might be helpful to = reconsider the description of this work, so that its goal is clearer to = the reader; and set out the fundamental role of the trust context within = the introduction/background. It was only in this latest draft that we really started to set out the = importance of context for a given VoT value, so I think your comments = here are valid.=20 > =20 > 3. The goal of the draft, as I understand it, is to enable RPs and = IdPs to share a common vocabulary of evidence and their attributes. This = avoids the =E2=80=9Cbundling=E2=80=9D of different kinds of evidence by = allowing for decomposability. This evidence, now unbundled, can be = employed in different trust contexts, facilitating interoperability = across trust framework. So far so good? However I=E2=80=99ll note that = the evidences and attributes described in section 3 are often themselves = bundles (=E2=80=9CC5 Sealed hardware token / trusted biometric / = TPM-backed keys). So, playing devil=E2=80=99s advocate, what is to stop = actors from decomposing the core elements described in section 3? Indeed = I think it=E2=80=99s actually a goal of this document to permit that = through extensions. I wonder therefore whether an excess of = decomposability will actually aggravate interoperability between trust = contexts. Clearly this could be addressed by setting norms, but then = you=E2=80=99ve reinvented NIST 800-63. Alternatively you could imagine a = taxonomy of evidence, with classes and (through extensions) sub-classes = allowing for greater specificity, while providing for a general = interpretation if actors do not share the same vocabulary. I hesitate to = describe this as fractal, but I hope you can see what I=E2=80=99m = driving at. > =20 >=20 It could definitely be fractal, but I think it=E2=80=99s important that = we capture something at the right level. Aggregate a bunch of vector = values together and you get a definition like 800-63, which is still = useful but only in its intended consequences. Break apart the vector = components and you get into the specifics of a full trust framework = definition, like the high granularity in the GTRI work (or Steve=E2=80=99s= =E2=80=9Ceverything is an attribute=E2=80=9D utopia). I think there=E2=80= =99s value in each of those, but the value doesn=E2=80=99t really come = at runtime when you need to make a contextual decision. That=E2=80=99s = where I think that the VoT approach can really shine. It=E2=80=99s more = granular than the broad sweeping definitions that authentication = guidelines would have, but it=E2=80=99s less granular than a sea of = attributes. We want something that an RP can hope to process and make = sense of, and to do that we need to walk a fine line. =E2=80=94 Justin > Josh. > From: vot [mailto:vot-bounces@ietf.org] On Behalf Of Justin Richer > Sent: 27 June 2015 04:15 > To: vot@ietf.org > Subject: [VoT] Vectors of Trust I-D > =20 > Hi Everyone, > =20 > I have taken the initial strawman proposal along with a substantial = number of edits and inputs from several folks and have created an = initial I-D of the document: > =20 > https://tools.ietf.org/id/draft-richer-vectors-of-trust-00 = > =20 > It=E2=80=99s still a very drafty draft, but hopefully it=E2=80=99s = starting to make this a concrete thing. Please read it over and discuss = it here on the list. > =20 > I would like to propose a bar-BoF in Prague for VoT for anyone who = would like to discuss this. If you=E2=80=99re interested (and will be = there in person), let me know! > =20 > =E2=80=94 Justin >=20 > Jisc is a registered charity (number 1149740) and a company limited by = guarantee which is registered in England under Company No. 5747339, VAT = No. GB 197 0632 86. Jisc=E2=80=99s registered office is: One Castlepark, = Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. >=20 > Jisc Services Limited is a wholly owned Jisc subsidiary and a company = limited by guarantee which is registered in England under company number = 2881024, VAT number GB 197 0632 86. The registered office is: One Castle = Park, Tower Hill, Bristol BS2 0JA. T 0203 697 5800. --Apple-Mail=_F9C9E1A0-DF5D-4639-ADD1-717496541EAD Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Josh, thanks for the great comments. Responses inline:

On Jun 30, 2015, at 7:22 AM, Josh Howlett <Josh.Howlett@jisc.ac.uk> wrote:

Justin, Leif,

 

Thanks for this draft. I only have some general comments = at this point. The first two concern the use of language; I might be hair-splitting: YMMV. The final comment is more = substantive.

 

1. Vectors have a very = specific formal meaning in mathematics. Given that this is an = engineering community, I think there=E2=80=99s a possibility of creating confusion from the use of this language. You correctly try = to disambiguate this in 2.2, but the use of different language would = make this unnecessary.


When we picked the name =E2=80=9Cvectors of = trust=E2=80=9D we knew that both =E2=80=9Cvector=E2=80=9D and = =E2=80=9Ctrust=E2=80=9D were terms that were going to confuse some = people but could be explained fairly succinctly in this context and help = get the point across. I=E2=80=99m honestly welcome to renaming the whole = shebang but for now I=E2=80=99ve yet to hear a better set of = terms.

 

2. The draft talks of = vectors of trust but actually describes types of evidence and attributes = that can be associated with these. As you discuss in section 7.1, there is a specific trust context which = confers semantics on these attributes ex post facto. Thus this evidence = and their attributes can inform runtime outcomes, in the context of a = given trust context, but do not define it. I think it might be helpful to reconsider the description of this work, so that = its goal is clearer to the reader; and set out the fundamental role of = the trust context within the introduction/background.


It was only in this latest draft that we really = started to set out the importance of context for a given VoT value, so I = think your comments here are valid. 

 

3. The goal of the = draft, as I understand it, is to enable RPs and IdPs to share a common = vocabulary of evidence and their attributes. This avoids the =E2=80=9Cbundling=E2=80=9D of different kinds of = evidence by allowing for decomposability. This evidence, now unbundled, = can be employed in different trust contexts, facilitating = interoperability across trust framework. So far so good? However I=E2=80=99= ll note that the evidences and attributes described in section 3 are often = themselves bundles (=E2=80=9CC5 Sealed hardware token / trusted = biometric / TPM-backed keys). So, playing devil=E2=80=99s advocate, what = is to stop actors from decomposing the core elements described in = section 3? Indeed I think it=E2=80=99s actually a goal of this document to = permit that through extensions. I wonder therefore whether an excess of = decomposability will actually aggravate interoperability between trust = contexts. Clearly this could be addressed by setting norms, but then you=E2=80=99ve reinvented NIST 800-63. Alternatively you could = imagine a taxonomy of evidence, with classes and (through extensions) = sub-classes allowing for greater specificity, while providing for a = general interpretation if actors do not share the same vocabulary. I hesitate to describe this as fractal, but I hope you can = see what I=E2=80=99m driving at.

 



It could definitely be fractal, but I think it=E2=80= =99s important that we capture something at the right level. Aggregate a = bunch of vector values together and you get a definition like 800-63, = which is still useful but only in its intended consequences. Break apart = the vector components and you get into the specifics of a full trust = framework definition, like the high granularity in the GTRI work (or = Steve=E2=80=99s =E2=80=9Ceverything is an attribute=E2=80=9D utopia). I = think there=E2=80=99s value in each of those, but the value doesn=E2=80=99= t really come at runtime when you need to make a contextual decision. = That=E2=80=99s where I think that the VoT approach can really shine. = It=E2=80=99s more granular than the broad sweeping definitions that = authentication guidelines would have, but it=E2=80=99s less granular = than a sea of attributes. We want something that an RP can hope to = process and make sense of, and to do that we need to walk a fine = line.

 =E2=80=94 = Justin

Josh.

From: vot [mailto:vot-bounces@ietf.org] On Behalf Of Justin Richer
Sent: 27 June 2015 04:15
To: vot@ietf.org
Subject: [VoT] Vectors of Trust I-D

 

Hi Everyone,

 

I have taken the initial strawman = proposal along with a substantial number of edits and inputs from = several folks and have created an initial I-D of the document:

 

https://tools.ietf.org/id/draft-richer-vectors-of-trust-00<= o:p class=3D"">

 

It=E2=80=99s still a very drafty = draft, but hopefully it=E2=80=99s starting to make this a concrete = thing. Please read it over and discuss it here on the list.

 

I would like to propose a bar-BoF = in Prague for VoT for anyone who would like to discuss this. If you=E2=80=99= re interested (and will be there in person), let me know!

 

 =E2=80=94 Justin


Jisc is a registered charity (number 1149740) and a company limited by = guarantee which is registered in England under Company No. 5747339, VAT = No. GB 197 0632 86. Jisc=E2=80=99s registered office is: One Castlepark, = Tower Hill, Bristol, BS2 0JA. T 0203 697 5800.

=20 Jisc Services Limited is a wholly owned Jisc subsidiary and a company = limited by guarantee which is registered in England under company number = 2881024, VAT number GB 197 0632 86. The registered office is: One Castle = Park, Tower Hill, Bristol BS2 0JA. T 0203 697 5800. =20 =20

= --Apple-Mail=_F9C9E1A0-DF5D-4639-ADD1-717496541EAD-- From nobody Tue Jun 30 09:04:07 2015 Return-Path: X-Original-To: vot@ietfa.amsl.com Delivered-To: vot@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D88E11ACD4F for ; Tue, 30 Jun 2015 09:04:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.221 X-Spam-Level: X-Spam-Status: No, score=-2.221 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=1.989, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LBaa3Cq0hI1o for ; Tue, 30 Jun 2015 09:04:02 -0700 (PDT) Received: from mta6.uth.tmc.edu (mta6.uth.tmc.edu [129.106.163.164]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E34D41ACD4E for ; Tue, 30 Jun 2015 09:04:01 -0700 (PDT) Received: from pps.filterd (mta6.uth.tmc.edu [127.0.0.1]) by mta6.uth.tmc.edu (8.15.0.59/8.15.0.59) with SMTP id t5UFjuhg006626; Tue, 30 Jun 2015 11:03:52 -0500 Received: from uthmail4.uthouston.edu ([129.106.175.240]) by mta6.uth.tmc.edu with ESMTP id 1va0phc141-1 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NOT); Tue, 30 Jun 2015 11:03:52 -0500 Received: from UTHMAIL1.uthouston.edu ([fe80::c1d2:3f6a:4f56:4fa4]) by UTHMAIL4.uthouston.edu ([fe80::c5ef:d941:6689:80df%21]) with mapi id 14.03.0210.002; Tue, 30 Jun 2015 11:03:51 -0500 From: "Jones, Mark B" To: Justin Richer , Jim Fenton Thread-Topic: [VoT] Vectors of Trust I-D Thread-Index: AQHQsIeG59OZHqfCD0icaga7zerMgZ3FYpmAgAAqOwD//62ZoA== Date: Tue, 30 Jun 2015 16:03:50 +0000 Message-ID: <38AAF00EA635514CA6667ACA60C7F0A548AF141C@UTHMAIL1.uthouston.edu> References: <4DF01AF4-CD33-4BB7-958B-FFECD37C8AFE@mit.edu> <55929843.2030104@bluepopcorn.net> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: x-originating-ip: [129.106.8.25] Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=SHA1; boundary="----=_NextPart_000_01DD_01D0B324.7157ABF0" MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2015-06-30_07:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 kscore.is_bulkscore=0 kscore.compositescore=1 compositescore=0.9 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0 kscore.is_spamscore=0 rbsscore=0.9 spamscore=0 urlsuspectscore=0.9 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1506180000 definitions=main-1506300240 Archived-At: Cc: "vot@ietf.org" Subject: Re: [VoT] Vectors of Trust I-D X-BeenThere: vot@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Vectors of Trust discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 30 Jun 2015 16:04:06 -0000 ------=_NextPart_000_01DD_01D0B324.7157ABF0 Content-Type: multipart/alternative; boundary="----=_NextPart_001_01DE_01D0B324.7157ABF0" ------=_NextPart_001_01DE_01D0B324.7157ABF0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit 'Credential' is just as overloaded as 'token'. I think you just need to pick a term and make sure it is well defined in the document. The External Identity working group decided to use the term 'authenticator'. https://spaces.internet2.edu/display/EXTID/External+Identities+Working+Group +Report From: vot [mailto:vot-bounces@ietf.org] On Behalf Of Justin Richer Sent: Tuesday, June 30, 2015 10:54 AM To: Jim Fenton Cc: vot@ietf.org Subject: Re: [VoT] Vectors of Trust I-D Leif and I went back and forth on this one and decided to put a stake in the ground to start at. One of the biggest challenges in LoA-style systems has always been the overloading of the linear scale model. I've seen passionate arguments about the ordering of otherwise similar components, with people willing to die for the cause on both sides. I think that we can side step that with the technology expression while still keeping the "common sense semantics" of ordinals. In that "2 is probably better than 1 for most values of better but mostly they're just different". I'm also afraid of the growth of the space for each component, but hopefully by having a few definitions set good examples (like the spec itself) we can encourage people to summarize the categories appropriately, as Josh talks about in his response. While I agree that naming things is hard, and I'm open to new names, I'm very strongly against the use of "token" here. It's already far too overloaded a term. OAuth issues tokens, FIDO calls their devices tokens, the IETF's "token binding" is calling something (that I'm not even sure what it is) tokens, even the WS-* folks have started to re-cast all the WS-* stuff as "tokens". I think the more precise term is "primary credential" or "primary user credential". Neither of these have anything to do with the attributes, but they do speak to how strongly bound the credential is to the account. Still, I'm open to better names. Thanks for the feedback, - Justin On Jun 30, 2015, at 9:23 AM, Jim Fenton wrote: Justin and Leif, thanks for getting things moving with this draft. The biggest surprise to me is that (section 2.2, last paragraph) the components of the vector do not have ordinal properties; i.e., they are just an enumerated list. Aside from confusing people that are expecting a vector to be a set of scalars, it also requires Relying Parties, for example, to enumerate all of the types of credential management they will accept rather than "C2 or better". This isn't a huge problem at the current scale, but I'm concerned that the number of choices might grow. I also have some problem with the use of the term "credential" because it encompasses management of attributes as well as tokens, which then overlaps with the identity proofing dimension which is, more generally, the question of how strongly the relying party can depend on attribute values. I'd rather that we use the term "token" rather than "credential" to keep these separate. -Jim On 6/26/15 8:15 PM, Justin Richer wrote: Hi Everyone, I have taken the initial strawman proposal along with a substantial number of edits and inputs from several folks and have created an initial I-D of the document: https://tools.ietf.org/id/draft-richer-vectors-of-trust-00 It's still a very drafty draft, but hopefully it's starting to make this a concrete thing. Please read it over and discuss it here on the list. I would like to propose a bar-BoF in Prague for VoT for anyone who would like to discuss this. If you're interested (and will be there in person), let me know! - Justin _______________________________________________ vot mailing list vot@ietf.org https://www.ietf.org/mailman/listinfo/vot ------=_NextPart_001_01DE_01D0B324.7157ABF0 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

‘Credential’ is just as overloaded as = ‘token’.  I think you just need to pick a term and make = sure it is well defined in the document.

 

The External Identity working group decided to use the term = ‘authenticator’.

https://spaces.internet2.edu/display/EXTID/External+I= dentities+Working+Group+Report

 

 

 

From:= = vot [mailto:vot-bounces@ietf.org] On Behalf Of Justin = Richer
Sent: Tuesday, June 30, 2015 10:54 AM
To: Jim = Fenton
Cc: vot@ietf.org
Subject: Re: [VoT] Vectors = of Trust I-D

 

Leif = and I went back and forth on this one and decided to put a stake in the = ground to start at. One of the biggest challenges in LoA-style systems = has always been the overloading of the linear scale model. I’ve = seen passionate arguments about the ordering of otherwise similar = components, with people willing to die for the cause on both sides. I = think that we can side step that with the technology expression while = still keeping the “common sense semantics” of ordinals. In = that “2 is probably better than 1 for most values of better but = mostly they’re just different”.

 

I’m also afraid of the growth of the space for = each component, but hopefully by having a few definitions set good = examples (like the spec itself) we can encourage people to summarize the = categories appropriately, as Josh talks about in his = response.

 

While = I agree that naming things is hard, and I’m open to new names, = I’m very strongly against the use of “token” here. = It’s already far too overloaded a term. OAuth issues tokens, FIDO = calls their devices tokens, the IETF’s “token binding” = is calling something (that I’m not even sure what it is) tokens, = even the WS-* folks have started to re-cast all the WS-* stuff as = “tokens”. I think the more precise term is “primary = credential” or “primary user credential”. Neither of = these have anything to do with the attributes, but they do speak to how = strongly bound the credential is to the account. Still, I’m open = to better names.

 

Thanks for the feedback,

 — Justin

 

On Jun 30, 2015, at 9:23 AM, Jim Fenton <fenton@bluepopcorn.net> = wrote:

 

Justin and Leif, thanks for getting things moving with = this draft.

The biggest surprise to me is that (section 2.2, last = paragraph) the components of the vector do not have ordinal properties; = i.e., they are just an enumerated list. Aside from confusing people that = are expecting a vector to be a set of scalars, it also requires Relying = Parties, for example, to enumerate all of the types of credential = management they will accept rather than "C2 or better". This = isn't a huge problem at the current scale, but I'm concerned that the = number of choices might grow.

I also have some problem with the = use of the term "credential" because it encompasses management = of attributes as well as tokens, which then overlaps with the identity = proofing dimension which is, more generally, the question of how = strongly the relying party can depend on attribute values.  I'd = rather that we use the term "token" rather than = "credential" to keep these separate.

-Jim

On = 6/26/15 8:15 PM, Justin Richer wrote:

Hi = Everyone,

 

I = have taken the initial strawman proposal along with a substantial number = of edits and inputs from several folks and have created an initial I-D = of the document:

 

https://t= ools.ietf.org/id/draft-richer-vectors-of-trust-00

 

It’s still a very drafty draft, but hopefully = it’s starting to make this a concrete thing. Please read it over = and discuss it here on the list.

 

I = would like to propose a bar-BoF in Prague for VoT for anyone who would = like to discuss this. If you’re interested (and will be there in = person), let me know!

 

 — Justin




_______________________=
________________________
vot mailing =
list
vot@ietf.org
https://www.ietf.org/mailman/listin=
fo/vot

 

 

------=_NextPart_001_01DE_01D0B324.7157ABF0-- ------=_NextPart_000_01DD_01D0B324.7157ABF0 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIITvjCCBDYw ggMeoAMCAQICAQEwDQYJKoZIhvcNAQEFBQAwbzELMAkGA1UEBhMCU0UxFDASBgNVBAoTC0FkZFRy dXN0IEFCMSYwJAYDVQQLEx1BZGRUcnVzdCBFeHRlcm5hbCBUVFAgTmV0d29yazEiMCAGA1UEAxMZ QWRkVHJ1c3QgRXh0ZXJuYWwgQ0EgUm9vdDAeFw0wMDA1MzAxMDQ4MzhaFw0yMDA1MzAxMDQ4Mzha MG8xCzAJBgNVBAYTAlNFMRQwEgYDVQQKEwtBZGRUcnVzdCBBQjEmMCQGA1UECxMdQWRkVHJ1c3Qg RXh0ZXJuYWwgVFRQIE5ldHdvcmsxIjAgBgNVBAMTGUFkZFRydXN0IEV4dGVybmFsIENBIFJvb3Qw ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC39xoz5vIABC054E5b7R+8bA/Ntfojts7e mxEzl6QpTH2Tn71KvJPtAxrjj8/lbVBa1pcplFqAsEl62y6V/bjKvzc4LR4+kUGtcFbH8E8/6DKe dMrIkFTpxl8PeJ2aQDwOrGGqXhSPnoehalDc15pOrwWzpnGUnHGzUGAKxxOdOAeGAqjpqGkmGJCr TLBPI6s6T4TY386f4Wlvu9dC12tE5Met7m1BX3JacQg3s3llpFmglDf3AC8NwpJy2tA4ctsUqEXE XSp9t7TWxO6szRNEt8kr3UMAJfphuWlqWCMRt6czj1Z1WfXNKddGtworZbbTQm8Vsrh7++/pXVPV NFonAgMBAAGjgdwwgdkwHQYDVR0OBBYEFK29mHo0tCb3+sQmVO8DveAky1QaMAsGA1UdDwQEAwIB BjAPBgNVHRMBAf8EBTADAQH/MIGZBgNVHSMEgZEwgY6AFK29mHo0tCb3+sQmVO8DveAky1QaoXOk cTBvMQswCQYDVQQGEwJTRTEUMBIGA1UEChMLQWRkVHJ1c3QgQUIxJjAkBgNVBAsTHUFkZFRydXN0 IEV4dGVybmFsIFRUUCBOZXR3b3JrMSIwIAYDVQQDExlBZGRUcnVzdCBFeHRlcm5hbCBDQSBSb290 ggEBMA0GCSqGSIb3DQEBBQUAA4IBAQCwm+CFJcLWI+IPlgaSnUGYnNmEeYHZHlsUByM2ZY+w2He7 rEFsR2CDUbD5Mj3n/PYmE8eAFqW/WvyHz3h5iSGa4kwHCoY1vPLeUcTSlrfcfk7ucP0cOesMAlEU LY69FuDB30Z15ySt7PRCtIWTcBBnup0GNUoY0yt6zFFCoXpj0ea7ocUrwja+Ew3mvWN+eXunCQ1A q2rdj4rD9vaMGkIFUdRF9Z+nYiFoFSBDPJnnfL0k2KmRF3OIP1YbMTgYtHEPms3IDp6OLhvhjJiD yx8x8URMxgRzSXZgD8f4vReAay7pzEwOWpp5DyAKLtWeYyYeVZKU2IIXWnvQvMePToYEMIIEnTCC A4WgAwIBAgIQND3pK6wnNP+PyzSU+8xwVDANBgkqhkiG9w0BAQUFADBvMQswCQYDVQQGEwJTRTEU MBIGA1UEChMLQWRkVHJ1c3QgQUIxJjAkBgNVBAsTHUFkZFRydXN0IEV4dGVybmFsIFRUUCBOZXR3 b3JrMSIwIAYDVQQDExlBZGRUcnVzdCBFeHRlcm5hbCBDQSBSb290MB4XDTA1MDYwNzA4MDkxMFoX DTIwMDUzMDEwNDgzOFowga4xCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJVVDEXMBUGA1UEBxMOU2Fs dCBMYWtlIENpdHkxHjAcBgNVBAoTFVRoZSBVU0VSVFJVU1QgTmV0d29yazEhMB8GA1UECxMYaHR0 cDovL3d3dy51c2VydHJ1c3QuY29tMTYwNAYDVQQDEy1VVE4tVVNFUkZpcnN0LUNsaWVudCBBdXRo ZW50aWNhdGlvbiBhbmQgRW1haWwwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCyOYWk 8n2rQTtiRjeuzcFgdbw5ZflKGkeiucxIzGqY1U01GbmkQuXOSeKKLx580jEHx060g2SdLinVomTE hb2FUTV5pE5okHsceqSSqBfymBXyk8zJpDKVuwxPML2YoAuL5W4bokb6eLyib6tZXqUvz8rabaov 66yhs2qqty5nNYt54R5piOLmRs2gpeq+C852OnoOm+r82idbPXMfIuZIYcZM82mxqC4bttQxICy8 goqOpA6l14lD/BZarx1x1xFZ2rqHDa/68+HC8KTFZ4zW1lQ63gqkugN3s2XI/R7TdGKqGMpokx6h hX71R2XL+E1XKHTSNP8wtu72YjAUjCzrAgMBAAGjgfQwgfEwHwYDVR0jBBgwFoAUrb2YejS0Jvf6 xCZU7wO94CTLVBowHQYDVR0OBBYEFImCZ33EnSZwAEu0UEh83j2uBG59MA4GA1UdDwEB/wQEAwIB BjAPBgNVHRMBAf8EBTADAQH/MBEGA1UdIAQKMAgwBgYEVR0gADBEBgNVHR8EPTA7MDmgN6A1hjNo dHRwOi8vY3JsLnVzZXJ0cnVzdC5jb20vQWRkVHJ1c3RFeHRlcm5hbENBUm9vdC5jcmwwNQYIKwYB BQUHAQEEKTAnMCUGCCsGAQUFBzABhhlodHRwOi8vb2NzcC51c2VydHJ1c3QuY29tMA0GCSqGSIb3 DQEBBQUAA4IBAQABvJzjYyiw8zEBwt973WKgAZ0jMQ+cknNTUeofTPrWn8TKL2d+eDMPdBa5kYeR 9Yom+mRwANge+QsEYlCHk4HU2vUj2zS7hVa0cDRueIM3HoUcxREVkl+HF72sav3xwtHMiV+xfPA+ UfI183zsYJhrOivg79+zfYbrtRv1W+yifJgT1wBQudEtc94DeHThBYUxXsuauZ2UxrmUN3Vy3ET7 Z+jw+iUeUqfaJelH4KDHPKBOsQo2+3dIn++Xivu0/uOUFKiDvFwtP9JgcWDuwnGCDOmINuPaILSj oGyqlku4gI51ykkH9jsUut/cBdmf2+Cy5k2geCbn5y1uf1/GHogVMIIFJTCCBA2gAwIBAgIQRIUc GfetDxT4xHWGNMR0xzANBgkqhkiG9w0BAQUFADCBrjELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAlVU MRcwFQYDVQQHEw5TYWx0IExha2UgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3Jr MSEwHwYDVQQLExhodHRwOi8vd3d3LnVzZXJ0cnVzdC5jb20xNjA0BgNVBAMTLVVUTi1VU0VSRmly c3QtQ2xpZW50IEF1dGhlbnRpY2F0aW9uIGFuZCBFbWFpbDAeFw0xMDEyMDIwMDAwMDBaFw0yMDA1 MzAxMDQ4MzhaMIGWMQswCQYDVQQGEwJVUzFBMD8GA1UEChM4VGhlIFVuaXZlcnNpdHkgb2YgVGV4 YXMgSGVhbHRoIFNjaWVuY2UgQ2VudGVyIGF0IEhvdXN0b24xRDBCBgNVBAMTO1RoZSBVbml2ZXJz aXR5IG9mIFRleGFzIEhlYWx0aCBTY2llbmNlIENlbnRlciBhdCBIb3VzdG9uIENBMIIBIjANBgkq hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxElj8A/NxSnbcaHKOvWlDt5+EbJMPZFayMmRcR5BbEqw M9PLQPTH1yJIZp+7Afgi6CZ/GrJcOEIRsfP43H3VK5O5FI6zIT6ZEEjj+huZ0hWey6Cg/ZNU22Mr XXCGEc0W4afqSXNX2mkck2oQW3xrDTaifCWBFQDki+k5d8wKQ2buk/aIFJO0qomzxq1cdJqAS/sF PWR3aRdJrn5IsjZeDsnsWZFpKCRiAybgcogM0f2mWDLATusRoL41DiOlJfH22NObHcFTQmsoAnXj X+FwJwdZ5H+kiiUCH9tXOHdPyKOoQoBqg+mdkCb4wviJsVTrq4lffBGe+xyeK2dlYngQSQIDAQAB o4IBUzCCAU8wHwYDVR0jBBgwFoAUiYJnfcSdJnAAS7RQSHzePa4Ebn0wHQYDVR0OBBYEFJkX0AQh Sm6R8Ydeb3ZvO93EMh4gMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMBkGA1Ud IAQSMBAwDgYMKwYBBAGyMQECAiQFMFgGA1UdHwRRME8wTaBLoEmGR2h0dHA6Ly9jcmwudXNlcnRy dXN0LmNvbS9VVE4tVVNFUkZpcnN0LUNsaWVudEF1dGhlbnRpY2F0aW9uYW5kRW1haWwuY3JsMHQG CCsGAQUFBwEBBGgwZjA9BggrBgEFBQcwAoYxaHR0cDovL2NydC51c2VydHJ1c3QuY29tL1VUTkFk ZFRydXN0Q2xpZW50X0NBLmNydDAlBggrBgEFBQcwAYYZaHR0cDovL29jc3AudXNlcnRydXN0LmNv bTANBgkqhkiG9w0BAQUFAAOCAQEAKqKCLV43+zEwBp/AHeelxnJikiO6zfHH7lNSvtwBPyGm4ZuI v6WHl669XQpMLcUxy8b0B8gHZ00AA+mZ7r2YP7HrUiuTEWssdA859PYHeIulfBfLhSP28On7C1Mx aODD9UQtj1j3NUGCy2kCGB2xupUjEXtNWSTgEGWhMiv5V+EvjLEns59Rpm5BHWgsycFOSyztjJYQ kRIFx3Yi6IX5b7s+lxMt96yVwaatlI+xMWPJpxeWlBzq/nIhPfREJmKf0RzZh58Gi6TnIPjmSsIV BZJhUxdTIJkfaJkajOy539WRMM9k04gBH4ZIFd2VwqwB9aZl27LgfvYOeeoswzPpRzCCBbYwggSe oAMCAQICEQC2CAUBCn9+NClEHZu5j+aOMA0GCSqGSIb3DQEBBQUAMIGWMQswCQYDVQQGEwJVUzFB MD8GA1UEChM4VGhlIFVuaXZlcnNpdHkgb2YgVGV4YXMgSGVhbHRoIFNjaWVuY2UgQ2VudGVyIGF0 IEhvdXN0b24xRDBCBgNVBAMTO1RoZSBVbml2ZXJzaXR5IG9mIFRleGFzIEhlYWx0aCBTY2llbmNl IENlbnRlciBhdCBIb3VzdG9uIENBMB4XDTE0MDkxNTAwMDAwMFoXDTE1MDkxNTIzNTk1OVowgbMx DjAMBgNVBBETBTc3MDMwMRwwGgYDVQQKExNVVEhFQUxUSCBOT04tRVNDUk9XMRQwEgYDVQQJEws3 MDAwIEZhbm5pbjEOMAwGA1UECBMFVGV4YXMxEDAOBgNVBAcTB0hvdXN0b24xCzAJBgNVBAYTAlVT MRUwEwYDVQQDEwxNYXJrIEIgSm9uZXMxJzAlBgkqhkiG9w0BCQEWGG1hcmsuYi5qb25lc0B1dGgu dG1jLmVkdTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAIsD9b8/H96eboYROkoZaA2/ QEXxNACieGhSr+CQzUfSlhWcL4M69uA938pqeKvzGWWJBEkb46tzTMhnbWuvbNfqUT+PBShIvkSr ndy7BE0ozkKjFVU/6jTsj2klnDyfq3wn0+GA/e+FTzYaDdj7ts6fij74De2GDPdNlVJa6uzzMaTd 7cS3T87ht0Yr03NStJRAl+IdN4cpJ9+Xn14NG7PnlZy5fyXDWM88kd/guUpdfK6XIjEud01vjDco NpN3ihRXl8LnEP700dosa2r897emtg8XJaSnw4k/GJUfSuGgW2rbYpUOyR9JPzZQMlLPqptNRjF5 WAzp2neDcl2fb0kCAwEAAaOCAd4wggHaMB8GA1UdIwQYMBaAFJkX0AQhSm6R8Ydeb3ZvO93EMh4g MB0GA1UdDgQWBBTk8/IYWxQfOajleb+QbNEs5R1HCzAOBgNVHQ8BAf8EBAMCBaAwDAYDVR0TAQH/ BAIwADAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwQwYDVR0gBDwwOjA4BgwrBgEEAbIx AQICJAUwKDAmBggrBgEFBQcCARYaaHR0cDovL3d3dy51dGgudG1jLmVkdS9jcHMwXgYDVR0fBFcw VTBToFGgT4ZNaHR0cDovL2NybC51dGgudG1jLmVkdS9UaGVVbml2ZXJzaXR5b2ZUZXhhc0hlYWx0 aFNjaWVuY2VDZW50ZXJhdEhvdXN0b25DQS5jcmwwgZAGCCsGAQUFBwEBBIGDMIGAMFkGCCsGAQUF BzAChk1odHRwOi8vY3J0LnV0aC50bWMuZWR1L1RoZVVuaXZlcnNpdHlvZlRleGFzSGVhbHRoU2Np ZW5jZUNlbnRlcmF0SG91c3RvbkNBLmNydDAjBggrBgEFBQcwAYYXaHR0cDovL29jc3AudXRoLnRt Yy5lZHUwIwYDVR0RBBwwGoEYbWFyay5iLmpvbmVzQHV0aC50bWMuZWR1MA0GCSqGSIb3DQEBBQUA A4IBAQCB5ypKawPDBa1lkt5Kv3priYCzwt5kUJA9MaQArIbAnpH2OoPnaUcnaGFNhgbm7TMJmC4V spP7uBsrtUGzywRe7AXwrRLX5WKxT4KKDdIonoftE0zVJGCP8SelTnlCOYk1/aa7blWsLtEan/AG sgJwFo8IjrWI95DqimKhH7qOU5KIbPovEksE6NFE0EcHdBLDEWmH1iCaZvl2qNJyrERtVYxG7wTA UTlMG6Tr2tkm1f6NJizvUSCaxCVVpZ4QSHYb6edNYI25w/D2yoDeGCvyq9lyRA/h5QooHdxu+8tG JZpxA9fSKDewjKNIJoirGOhrLM9t8/NxXw40sd7vZdTZMYIEFDCCBBACAQEwgawwgZYxCzAJBgNV BAYTAlVTMUEwPwYDVQQKEzhUaGUgVW5pdmVyc2l0eSBvZiBUZXhhcyBIZWFsdGggU2NpZW5jZSBD ZW50ZXIgYXQgSG91c3RvbjFEMEIGA1UEAxM7VGhlIFVuaXZlcnNpdHkgb2YgVGV4YXMgSGVhbHRo IFNjaWVuY2UgQ2VudGVyIGF0IEhvdXN0b24gQ0ECEQC2CAUBCn9+NClEHZu5j+aOMAkGBSsOAwIa BQCgggI8MBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTE1MDYzMDE2 MDM0OVowIwYJKoZIhvcNAQkEMRYEFLH7MSaACx7TCmzxPJ3KB9vmPN57MFsGCSqGSIb3DQEJDzFO MEwwCgYIKoZIhvcNAwcwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAcGBSsOAwIHMA0G CCqGSIb3DQMCAgEoMAcGBSsOAwIaMIG9BgkrBgEEAYI3EAQxga8wgawwgZYxCzAJBgNVBAYTAlVT MUEwPwYDVQQKEzhUaGUgVW5pdmVyc2l0eSBvZiBUZXhhcyBIZWFsdGggU2NpZW5jZSBDZW50ZXIg YXQgSG91c3RvbjFEMEIGA1UEAxM7VGhlIFVuaXZlcnNpdHkgb2YgVGV4YXMgSGVhbHRoIFNjaWVu Y2UgQ2VudGVyIGF0IEhvdXN0b24gQ0ECEQC2CAUBCn9+NClEHZu5j+aOMIG/BgsqhkiG9w0BCRAC CzGBr6CBrDCBljELMAkGA1UEBhMCVVMxQTA/BgNVBAoTOFRoZSBVbml2ZXJzaXR5IG9mIFRleGFz IEhlYWx0aCBTY2llbmNlIENlbnRlciBhdCBIb3VzdG9uMUQwQgYDVQQDEztUaGUgVW5pdmVyc2l0 eSBvZiBUZXhhcyBIZWFsdGggU2NpZW5jZSBDZW50ZXIgYXQgSG91c3RvbiBDQQIRALYIBQEKf340 KUQdm7mP5o4wDQYJKoZIhvcNAQEBBQAEggEAVHrXNmm1cbCRG6gbhR0NEfUBIwCV73hhnbPObv1a IIMvwKm6IiOLJ0kZs2gGz7AL8VPxgerkxSN+ZNXspI+5A4LaSw0eIQTsqAekWd414Q7diWCEkWbM ZdRRIeQ4zLK6AgQKlJ0b4Xn2l+lVUYdHQpeV0b1O7GXwRbPZPUGM3apodS59zjyFNOmEnSTPERER ATckM3n6xj4Lw29AtQD+QL+G3d7Y0bzFqn9VrvUWXbbAKfd7K+tVJ9UNIM+WP8FLRwb+zIJFHlrr luAJG7hQgvA+SiRIFredai5stUMpJTQroE9WbTuQ4wRJSFP37smEnVXtFqsmbXy0Bex5799yKQAA AAAAAA== ------=_NextPart_000_01DD_01D0B324.7157ABF0-- From nobody Tue Jun 30 09:25:29 2015 Return-Path: X-Original-To: vot@ietfa.amsl.com Delivered-To: vot@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7B5AE1B2E3C for ; Tue, 30 Jun 2015 09:25:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.977 X-Spam-Level: X-Spam-Status: No, score=-1.977 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oztBLIfu09lH for ; Tue, 30 Jun 2015 09:25:24 -0700 (PDT) Received: from mail-vn0-f48.google.com (mail-vn0-f48.google.com [209.85.216.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E59431ACD77 for ; Tue, 30 Jun 2015 09:25:23 -0700 (PDT) Received: by vnbf190 with SMTP id f190so2378407vnb.10 for ; Tue, 30 Jun 2015 09:25:22 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=Uj7obVxI1r0oQRSF42JZqDbrJ+kCNgPe6ATvvA7ROAI=; b=GunQkuY+kuQl2jotFo2oH5P8Gz7vCCzRJ1mNWdIT1WGu9GBZncNHXZVbaWJE8k4tAg LJMJLpM0+iPZj5XiCN461JplDklZ295o8geRW1Fqm0/ouDEYA+qciGt+itpClwxZIr9y cNvHWLP0rjMO1CPUktGGz6Pdj8DwL557BDUiAYOjUSpwDFDyPDZkmzGp09bp89Z5sZWd rn4VwvwMCYwZW3mxXfrWvq6LcorUTtw4s1Niq2NACOXAOsN+Svx3ZdCjdTnrNuWov1QB tvrVfY+L2gSaMsAMrASskteQICtlwbb83Mzef54a+qTrtRq9A5lmmEMtZHvwoeUnyg3M a/XQ== X-Gm-Message-State: ALoCoQmEzbVqSLSimu/kgy6cbyBRZgXYOC3zyJBDN5zvvaVtkUIM0SysrsnXoQ6TKehto0ig5dud MIME-Version: 1.0 X-Received: by 10.52.122.52 with SMTP id lp20mr20210320vdb.64.1435681522705; Tue, 30 Jun 2015 09:25:22 -0700 (PDT) Received: by 10.52.136.12 with HTTP; Tue, 30 Jun 2015 09:25:22 -0700 (PDT) In-Reply-To: <3F524C09-C71B-49DA-ADD2-AE57610C6C89@mit.edu> References: <4DF01AF4-CD33-4BB7-958B-FFECD37C8AFE@mit.edu> <3F524C09-C71B-49DA-ADD2-AE57610C6C89@mit.edu> Date: Tue, 30 Jun 2015 12:25:22 -0400 Message-ID: From: Scott Shorter To: Justin Richer Content-Type: multipart/alternative; boundary=089e013a13bc2bffaa0519bea70a Archived-At: Cc: Josh Howlett , "vot@ietf.org" Subject: Re: [VoT] Vectors of Trust I-D X-BeenThere: vot@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Vectors of Trust discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 30 Jun 2015 16:25:27 -0000 --089e013a13bc2bffaa0519bea70a Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Great discussion all. I don't know if I've said it here before, but my equation for trust goes like this: trust =3D 1 / risk If we are trying to measure risk, what if this were considered a "risk score" that is calculated from "risk metrics"? Identity risk score, if we want to get crazy. I get the notion from the Common Vulnerability Scoring System (CVSS, version 3 draft is available here ). I think that there's a lot of similarities between vulnerability management and credential management. Vulnerabilities represent potential risks to systems, and CVSS provides a way of expressing those risks. Similarly every credential issued represents a marginal increased risk, and our strawperson document currently looks a lot like CVSS. I don't know whether more harm is done by unmanaged credentials or unmitigated vulnerabilities, but each of those should be captured in an organization's risk registry. My 0.02USD, Scott On Tue, Jun 30, 2015 at 12:01 PM, Justin Richer wrote: > Josh, thanks for the great comments. Responses inline: > > On Jun 30, 2015, at 7:22 AM, Josh Howlett wrote= : > > Justin, Leif, > > > > Thanks for this draft. I only have some general comments at this point. > The first two concern the use of language; I might be hair-splitting: YMM= V. > The final comment is more substantive. > > > > 1. Vectors have a very specific formal meaning in mathematics. Given that > this is an engineering community, I think there=E2=80=99s a possibility o= f creating > confusion from the use of this language. You correctly try to disambiguat= e > this in 2.2, but the use of different language would make this unnecessar= y. > > > When we picked the name =E2=80=9Cvectors of trust=E2=80=9D we knew that b= oth =E2=80=9Cvector=E2=80=9D and > =E2=80=9Ctrust=E2=80=9D were terms that were going to confuse some people= but could be > explained fairly succinctly in this context and help get the point across= . > I=E2=80=99m honestly welcome to renaming the whole shebang but for now I= =E2=80=99ve yet to > hear a better set of terms. > > > > 2. The draft talks of vectors of trust but actually describes types of > evidence and attributes that can be associated with these. As you discuss > in section 7.1, there is a specific trust context which confers semantics > on these attributes ex post facto. Thus this evidence and their attribute= s > can inform runtime outcomes, in the context of a given trust context, but > do not define it. I think it might be helpful to reconsider the descripti= on > of this work, so that its goal is clearer to the reader; and set out the > fundamental role of the trust context within the introduction/background. > > > It was only in this latest draft that we really started to set out the > importance of context for a given VoT value, so I think your comments her= e > are valid. > > > > 3. The goal of the draft, as I understand it, is to enable RPs and IdPs t= o > share a common vocabulary of evidence and their attributes. This avoids t= he > =E2=80=9Cbundling=E2=80=9D of different kinds of evidence by allowing for= decomposability. > This evidence, now unbundled, can be employed in different trust contexts= , > facilitating interoperability across trust framework. So far so good? > However I=E2=80=99ll note that the evidences and attributes described in = section 3 > are often themselves bundles (=E2=80=9CC5 Sealed hardware token / trusted= biometric > / TPM-backed keys). So, playing devil=E2=80=99s advocate, what is to stop= actors > from decomposing the core elements described in section 3? Indeed I think > it=E2=80=99s actually a goal of this document to permit that through exte= nsions. I > wonder therefore whether an excess of decomposability will actually > aggravate interoperability between trust contexts. Clearly this could be > addressed by setting norms, but then you=E2=80=99ve reinvented NIST 800-6= 3. > Alternatively you could imagine a taxonomy of evidence, with classes and > (through extensions) sub-classes allowing for greater specificity, while > providing for a general interpretation if actors do not share the same > vocabulary. I hesitate to describe this as fractal, but I hope you can se= e > what I=E2=80=99m driving at. > > > > > It could definitely be fractal, but I think it=E2=80=99s important that w= e capture > something at the right level. Aggregate a bunch of vector values together > and you get a definition like 800-63, which is still useful but only in i= ts > intended consequences. Break apart the vector components and you get into > the specifics of a full trust framework definition, like the high > granularity in the GTRI work (or Steve=E2=80=99s =E2=80=9Ceverything is a= n attribute=E2=80=9D > utopia). I think there=E2=80=99s value in each of those, but the value do= esn=E2=80=99t > really come at runtime when you need to make a contextual decision. That= =E2=80=99s > where I think that the VoT approach can really shine. It=E2=80=99s more g= ranular > than the broad sweeping definitions that authentication guidelines would > have, but it=E2=80=99s less granular than a sea of attributes. We want so= mething > that an RP can hope to process and make sense of, and to do that we need = to > walk a fine line. > > =E2=80=94 Justin > > Josh. > > *From:* vot [mailto:vot-bounces@ietf.org ] *On > Behalf Of *Justin Richer > *Sent:* 27 June 2015 04:15 > *To:* vot@ietf.org > *Subject:* [VoT] Vectors of Trust I-D > > > > Hi Everyone, > > > > I have taken the initial strawman proposal along with a substantial numbe= r > of edits and inputs from several folks and have created an initial I-D of > the document: > > > > https://tools.ietf.org/id/draft-richer-vectors-of-trust-00 > > > > It=E2=80=99s still a very drafty draft, but hopefully it=E2=80=99s starti= ng to make this a > concrete thing. Please read it over and discuss it here on the list. > > > > I would like to propose a bar-BoF in Prague for VoT for anyone who would > like to discuss this. If you=E2=80=99re interested (and will be there in = person), > let me know! > > > > =E2=80=94 Justin > > Jisc is a registered charity (number 1149740) and a company limited by > guarantee which is registered in England under Company No. 5747339, VAT N= o. > GB 197 0632 86. Jisc=E2=80=99s registered office is: One Castlepark, Towe= r Hill, > Bristol, BS2 0JA. T 0203 697 5800. > > Jisc Services Limited is a wholly owned Jisc subsidiary and a company > limited by guarantee which is registered in England under company number > 2881024, VAT number GB 197 0632 86. The registered office is: One Castle > Park, Tower Hill, Bristol BS2 0JA. T 0203 697 5800. > > > > _______________________________________________ > vot mailing list > vot@ietf.org > https://www.ietf.org/mailman/listinfo/vot > > --=20 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D *Scott Shorter, Principal Security Engineer* Electrosoft *=E2=80=93* Fueling Customer Success Through Outstanding Value = and Trust! *Woman-Owned, Minority-Owned Small Business | ISO 9001 | CMMI Level 2 * 1893 Metro Center Drive; Ste 228; Reston, VA 20190 sshorter@electrosoft-inc.com (Email); http://www.electrosoft-inc.com (Web= ) =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D --089e013a13bc2bffaa0519bea70a Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Great discussion all.=C2=A0 I don't know if I've s= aid it here before, but my equation for trust goes like this:

=C2=A0 =C2=A0 =C2=A0trust =3D 1 / risk

If we= are trying to measure risk, what if this were considered a "risk scor= e" that is calculated from "risk metrics"?=C2=A0 Identity ri= sk score, if we want to get crazy.

I get the notio= n from the Common Vulnerability Scoring System (CVSS, version 3 draft is av= ailable=C2=A0here).=C2=A0 I think = that there's a lot of similarities between vulnerability management and= credential management.=C2=A0 Vulnerabilities represent potential risks to = systems, and CVSS provides a way of expressing those risks.=C2=A0 Similarly= every credential issued represents a marginal increased risk, and our stra= wperson document currently looks a lot like CVSS.=C2=A0

I don't know whether more harm is done by unmanaged credentials o= r unmitigated vulnerabilities, but each of those should be captured in an o= rganization's risk registry.=C2=A0

My 0.02= USD,
Scott

On Tue, Jun 30, 2015 at 12:01 PM, Justin Richer = <jricher@mit.edu> wrote:
Josh, thanks for the great comments. Responses inline:
<= br>

Justin, Leif,

=C2=A0

Thanks for this draft. I only have some general comments at this point. The first= two concern the use of language; I might be hair-splitting: YMMV. The final comment is more subst= antive.

=C2=A0

1. Vectors have a very speci= fic formal meaning in mathematics. Given that this is an engineering commun= ity, I think there=E2=80=99s a possibility of creating confusion from the use of this language. You correctly try to = disambiguate this in 2.2, but the use of different language would make this= unnecessary.


When we picked the name =E2=80=9Cvectors of trust=E2=80=9D we knew t= hat both =E2=80=9Cvector=E2=80=9D and =E2=80=9Ctrust=E2=80=9D were terms th= at were going to confuse some people but could be explained fairly succinct= ly in this context and help get the point across. I=E2=80=99m honestly welc= ome to renaming the whole shebang but for now I=E2=80=99ve yet to hear a be= tter set of terms.

=C2=A0

2. The draft= talks of vectors of trust but actually describes types of evidence and att= ributes that can be associated with these. As you discuss in section 7.1, there is a specific trust context which confer= s semantics on these attributes ex post facto. Thus this evidence and their= attributes can inform runtime outcomes, in the context of a given trust co= ntext, but do not define it. I think it might be helpful to reconsider the description of this work, so that it= s goal is clearer to the reader; and set out the fundamental role of the tr= ust context within the introduction/background.


It was= only in this latest draft that we really started to set out the importance= of context for a given VoT value, so I think your comments here are valid.= =C2=A0

= =C2=A0

3. The goal of the d= raft, as I understand it, is to enable RPs and IdPs to share a common vocab= ulary of evidence and their attributes. This avoids the =E2=80=9Cbundling=E2=80=9D of different kinds of evidence = by allowing for decomposability. This evidence, now unbundled, can be emplo= yed in different trust contexts, facilitating interoperability across trust= framework. So far so good? However I=E2=80=99ll note that the evidences and attributes described in section 3 are often themselves b= undles (=E2=80=9CC5 Sealed hardware token / trusted biometric / TPM-backed = keys). So, playing devil=E2=80=99s advocate, what is to stop actors from de= composing the core elements described in section 3? Indeed I think it=E2=80=99s actually a goal of this document to permit = that through extensions. I wonder therefore whether an excess of decomposab= ility will actually aggravate interoperability between trust contexts. Clea= rly this could be addressed by setting norms, but then you=E2=80=99ve reinvented NIST 800-63. Alternatively you could im= agine a taxonomy of evidence, with classes and (through extensions) sub-cla= sses allowing for greater specificity, while providing for a general interp= retation if actors do not share the same vocabulary. I hesitate to describe this as fractal, but I hope you can see= what I=E2=80=99m driving at.

=C2=A0



It could definitely be fractal, but I think= it=E2=80=99s important that we capture something at the right level. Aggre= gate a bunch of vector values together and you get a definition like 800-63= , which is still useful but only in its intended consequences. Break apart = the vector components and you get into the specifics of a full trust framew= ork definition, like the high granularity in the GTRI work (or Steve=E2=80= =99s =E2=80=9Ceverything is an attribute=E2=80=9D utopia). I think there=E2= =80=99s value in each of those, but the value doesn=E2=80=99t really come a= t runtime when you need to make a contextual decision. That=E2=80=99s where= I think that the VoT approach can really shine. It=E2=80=99s more granular= than the broad sweeping definitions that authentication guidelines would h= ave, but it=E2=80=99s less granular than a sea of attributes. We want somet= hing that an RP can hope to process and make sense of, and to do that we ne= ed to walk a fine line.

=C2=A0=E2=80=94 Justin

Josh.=

<= /p>

From: vot [mai= lto:vot-bounces@ietf.org] On Behalf Of Justin Richer
Sent: 27 June 2015 04:15
To: vot@ietf.org
Subject: [VoT] Vectors of Trust I-D

=C2=A0

Hi Everyone,

=C2=A0

I have taken the initial strawman proposal alon= g with a substantial number of edits and inputs from several folks and have= created an initial I-D of the document:

=C2=A0

=C2=A0

It=E2=80=99s still a very drafty draft, but hop= efully it=E2=80=99s starting to make this a concrete thing. Please read it = over and discuss it here on the list.

=C2=A0

I would like to propose a bar-BoF in Prague for= VoT for anyone who would like to discuss this. If you=E2=80=99re intereste= d (and will be there in person), let me know!

=C2=A0

=C2=A0=E2=80=94 Justin


Jisc is a registered charity (number 1149740) and a company limited by guar= antee which is registered in England under Company No. 5747339, VAT No. GB = 197 0632 86. Jisc=E2=80=99s registered office is: One Castlepark, Tower Hil= l, Bristol, BS2 0JA. T 0203 697 5800.

=20 Jisc Services Limited is a wholly owned Jisc subsidiary and a company limit= ed by guarantee which is registered in England under company number 2881024= , VAT number GB 197 0632 86. The registered office is: One Castle Park, Tow= er Hill, Bristol BS2 0JA. T 0203 697 5800. =20 =20


_______________________= ________________________
vot mailing list
vot@ietf.org
https://www.ietf.org/mailman/listinfo/vot




--
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
Scott Shorter, Principal Security Eng= ineer
Electrosoft=C2=A0=E2=80=93=C2=A0Fueling Custome= r Success Through Outstanding Value and Trust!
Woman-Owned, Minority-Owne= d Small Business | ISO 9001 | CMMI Level 2=C2=A0
1893 Metro Center Drive; Ste 2= 28; Reston, VA 20190
ss= horter@electrosoft-inc.com=C2=A0(Email);=C2=A0=C2=A0=C2=A0http://www.electrosoft-inc.com=C2=A0(Web)
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
<= /div>
--089e013a13bc2bffaa0519bea70a-- From nobody Tue Jun 30 10:37:57 2015 Return-Path: X-Original-To: vot@ietfa.amsl.com Delivered-To: vot@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 64D3A1B2A0A for ; Tue, 30 Jun 2015 10:37:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1IqdMFx-OEzs for ; Tue, 30 Jun 2015 10:37:52 -0700 (PDT) Received: from mail-wi0-x22c.google.com (mail-wi0-x22c.google.com [IPv6:2a00:1450:400c:c05::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1CADA1B2A09 for ; Tue, 30 Jun 2015 10:37:52 -0700 (PDT) Received: by wiwl6 with SMTP id l6so139943667wiw.0 for ; Tue, 30 Jun 2015 10:37:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; bh=7UELqoLhiHPtRDo7G7Mei+SVXgF6Ra7Bb3ddcPfIA1w=; b=zDzubKoGHU03aLqBahm8UChKzAQgHV78IWvyys+U7gszS1LpyJ8mK+tJk87QQEh8PP gkef+Td29d9XKOI9VZaMONp7La1COCrqv0HA/Wxs4TO0358QJOCS+1Ltho3fgeEg8bQh CIAScRZg7lolrey1nXKBmJ6X9Urlo+uLvG0IyXe3nBTDa+cgETQfWQsJZDyqK74hc6K1 +VW7RhYEe1FjnnKw8BVwdIaUKg9J8KtO1SwsFvKeG+SjziY721/Pa325R/YZOGj7AlU7 wnxErNx8PV8GF7qFDzafLP+X+bUxW2FyGsCHnO32ZFYlkeEInsg10/LqBoKgSuJnoh40 S33Q== X-Received: by 10.194.175.65 with SMTP id by1mr44229268wjc.152.1435685870512; Tue, 30 Jun 2015 10:37:50 -0700 (PDT) MIME-Version: 1.0 Received: by 10.27.53.205 with HTTP; Tue, 30 Jun 2015 10:37:31 -0700 (PDT) In-Reply-To: References: <4DF01AF4-CD33-4BB7-958B-FFECD37C8AFE@mit.edu> <3F524C09-C71B-49DA-ADD2-AE57610C6C89@mit.edu> From: Ira McDonald Date: Tue, 30 Jun 2015 13:37:31 -0400 Message-ID: To: Scott Shorter , Ira McDonald Content-Type: multipart/alternative; boundary=089e013d196a52344f0519bfaae5 Archived-At: Cc: Josh Howlett , Justin Richer , "vot@ietf.org" Subject: Re: [VoT] Vectors of Trust I-D X-BeenThere: vot@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Vectors of Trust discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 30 Jun 2015 17:37:56 -0000 --089e013d196a52344f0519bfaae5 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Hi, Thanks Justin and Leif for a really thought-provoking document. Thanks Scott for a compact equation for trust. About terminology: Coming from the mobile device and automotive perspectives, the use of *anonymized* identity for privacy protection is a major requirement. In biometrics especially, devices should send anonymized user identity authentication info as a "token". But the common English definition of "credential" precludes any such anonymization. I suggest shifting to "token" and stressing the need for anonymous (but highly reliable through Trusted Third Parties) device and user identities. Cheers, - Ira Ira McDonald (Musician / Software Architect) Co-Chair - TCG Trusted Mobility Solutions WG Chair - Linux Foundation Open Printing WG Secretary - IEEE-ISTO Printer Working Group Co-Chair - IEEE-ISTO PWG Internet Printing Protocol WG IETF Designated Expert - IPP & Printer MIB Blue Roof Music / High North Inc http://sites.google.com/site/blueroofmusic http://sites.google.com/site/highnorthinc mailto: blueroofmusic@gmail.com Winter 579 Park Place Saline, MI 48176 734-944-0094 Summer PO Box 221 Grand Marais, MI 49839 906-494-2434 On Tue, Jun 30, 2015 at 12:25 PM, Scott Shorter < sshorter@electrosoft-inc.com> wrote: > Great discussion all. I don't know if I've said it here before, but my > equation for trust goes like this: > > trust =3D 1 / risk > > If we are trying to measure risk, what if this were considered a "risk > score" that is calculated from "risk metrics"? Identity risk score, if w= e > want to get crazy. > > I get the notion from the Common Vulnerability Scoring System (CVSS, > version 3 draft is available here > ). > I think that there's a lot of similarities between vulnerability manageme= nt > and credential management. Vulnerabilities represent potential risks to > systems, and CVSS provides a way of expressing those risks. Similarly > every credential issued represents a marginal increased risk, and our > strawperson document currently looks a lot like CVSS. > > I don't know whether more harm is done by unmanaged credentials or > unmitigated vulnerabilities, but each of those should be captured in an > organization's risk registry. > > My 0.02USD, > Scott > > On Tue, Jun 30, 2015 at 12:01 PM, Justin Richer wrote: > >> Josh, thanks for the great comments. Responses inline: >> >> On Jun 30, 2015, at 7:22 AM, Josh Howlett >> wrote: >> >> Justin, Leif, >> >> >> >> Thanks for this draft. I only have some general comments at this point. >> The first two concern the use of language; I might be hair-splitting: YM= MV. >> The final comment is more substantive. >> >> >> >> 1. Vectors have a very specific formal meaning in mathematics. Given tha= t >> this is an engineering community, I think there=E2=80=99s a possibility = of creating >> confusion from the use of this language. You correctly try to disambigua= te >> this in 2.2, but the use of different language would make this unnecessa= ry. >> >> >> When we picked the name =E2=80=9Cvectors of trust=E2=80=9D we knew that = both =E2=80=9Cvector=E2=80=9D and >> =E2=80=9Ctrust=E2=80=9D were terms that were going to confuse some peopl= e but could be >> explained fairly succinctly in this context and help get the point acros= s. >> I=E2=80=99m honestly welcome to renaming the whole shebang but for now I= =E2=80=99ve yet to >> hear a better set of terms. >> >> >> >> 2. The draft talks of vectors of trust but actually describes types of >> evidence and attributes that can be associated with these. As you discus= s >> in section 7.1, there is a specific trust context which confers semantic= s >> on these attributes ex post facto. Thus this evidence and their attribut= es >> can inform runtime outcomes, in the context of a given trust context, bu= t >> do not define it. I think it might be helpful to reconsider the descript= ion >> of this work, so that its goal is clearer to the reader; and set out the >> fundamental role of the trust context within the introduction/background= . >> >> >> It was only in this latest draft that we really started to set out the >> importance of context for a given VoT value, so I think your comments he= re >> are valid. >> >> >> >> 3. The goal of the draft, as I understand it, is to enable RPs and IdPs >> to share a common vocabulary of evidence and their attributes. This avoi= ds >> the =E2=80=9Cbundling=E2=80=9D of different kinds of evidence by allowin= g for >> decomposability. This evidence, now unbundled, can be employed in differ= ent >> trust contexts, facilitating interoperability across trust framework. So >> far so good? However I=E2=80=99ll note that the evidences and attributes= described >> in section 3 are often themselves bundles (=E2=80=9CC5 Sealed hardware t= oken / >> trusted biometric / TPM-backed keys). So, playing devil=E2=80=99s advoca= te, what is >> to stop actors from decomposing the core elements described in section 3= ? >> Indeed I think it=E2=80=99s actually a goal of this document to permit t= hat through >> extensions. I wonder therefore whether an excess of decomposability will >> actually aggravate interoperability between trust contexts. Clearly this >> could be addressed by setting norms, but then you=E2=80=99ve reinvented = NIST >> 800-63. Alternatively you could imagine a taxonomy of evidence, with >> classes and (through extensions) sub-classes allowing for greater >> specificity, while providing for a general interpretation if actors do n= ot >> share the same vocabulary. I hesitate to describe this as fractal, but I >> hope you can see what I=E2=80=99m driving at. >> >> >> >> >> It could definitely be fractal, but I think it=E2=80=99s important that = we >> capture something at the right level. Aggregate a bunch of vector values >> together and you get a definition like 800-63, which is still useful but >> only in its intended consequences. Break apart the vector components and >> you get into the specifics of a full trust framework definition, like th= e >> high granularity in the GTRI work (or Steve=E2=80=99s =E2=80=9Ceverythin= g is an attribute=E2=80=9D >> utopia). I think there=E2=80=99s value in each of those, but the value d= oesn=E2=80=99t >> really come at runtime when you need to make a contextual decision. That= =E2=80=99s >> where I think that the VoT approach can really shine. It=E2=80=99s more = granular >> than the broad sweeping definitions that authentication guidelines would >> have, but it=E2=80=99s less granular than a sea of attributes. We want s= omething >> that an RP can hope to process and make sense of, and to do that we need= to >> walk a fine line. >> >> =E2=80=94 Justin >> >> Josh. >> >> *From:* vot [mailto:vot-bounces@ietf.org ] *On >> Behalf Of *Justin Richer >> *Sent:* 27 June 2015 04:15 >> *To:* vot@ietf.org >> *Subject:* [VoT] Vectors of Trust I-D >> >> >> >> Hi Everyone, >> >> >> >> I have taken the initial strawman proposal along with a substantial >> number of edits and inputs from several folks and have created an initia= l >> I-D of the document: >> >> >> >> https://tools.ietf.org/id/draft-richer-vectors-of-trust-00 >> >> >> >> It=E2=80=99s still a very drafty draft, but hopefully it=E2=80=99s start= ing to make this >> a concrete thing. Please read it over and discuss it here on the list. >> >> >> >> I would like to propose a bar-BoF in Prague for VoT for anyone who would >> like to discuss this. If you=E2=80=99re interested (and will be there in= person), >> let me know! >> >> >> >> =E2=80=94 Justin >> >> Jisc is a registered charity (number 1149740) and a company limited by >> guarantee which is registered in England under Company No. 5747339, VAT = No. >> GB 197 0632 86. Jisc=E2=80=99s registered office is: One Castlepark, Tow= er Hill, >> Bristol, BS2 0JA. T 0203 697 5800. >> >> Jisc Services Limited is a wholly owned Jisc subsidiary and a company >> limited by guarantee which is registered in England under company number >> 2881024, VAT number GB 197 0632 86. The registered office is: One Castle >> Park, Tower Hill, Bristol BS2 0JA. T 0203 697 5800. >> >> >> >> _______________________________________________ >> vot mailing list >> vot@ietf.org >> https://www.ietf.org/mailman/listinfo/vot >> >> > > > -- > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D > *Scott Shorter, Principal Security Engineer* > Electrosoft *=E2=80=93* Fueling Customer Success Through Outstanding Valu= e and > Trust! > *Woman-Owned, Minority-Owned Small Business | ISO 9001 | CMMI Level 2 * > 1893 Metro Center Drive; Ste 228; Reston, VA 20190 > sshorter@electrosoft-inc.com (Email); http://www.electrosoft-inc.com > (Web) > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D > > _______________________________________________ > vot mailing list > vot@ietf.org > https://www.ietf.org/mailman/listinfo/vot > > --089e013d196a52344f0519bfaae5 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Hi,

Thanks Justin and Leif for a really thought-provoking document.<= br>
Thanks Scott for a compact equation for trust.

About terminol= ogy:=C2=A0

Coming from the mobile device and automotive perspective= s, the use
of *anonymized* identity for privacy protection is a major r= equirement.

In biometrics especially, devices should send anonymized= user identity
authentication info as a "token".=C2=A0 But the= common English definition of
"credential" precludes any such= anonymization.

I suggest shifting to "token" and stressin= g the need for anonymous (but
highly reliable through Trusted Third Par= ties) device and user identities.

Cheers,
- Ira

Ira McDonald (Musician / Software Architect)=
Co-Chair - TCG Trusted Mobility Solutions WG
Chair - Linux Foundatio= n Open Printing WG
Secretary - IEEE-ISTO Printer Working Group
Co-Cha= ir - IEEE-ISTO PWG Internet Printing Protocol WG
IETF Designated Expert = - IPP & Printer MIB
Blue Roof Music / High North Inc
http://sites.google.com/site/blueroofmusic
http://sites.google.com/site/highnorthinc
mailto= : blueroofmusi= c@gmail.com
Winter=C2=A0 579 Park Place=C2=A0 Saline, MI=C2=A0 48176= =C2=A0 734-944-0094
Summer=C2=A0 PO Box 221=C2=A0 Grand Marais, MI 49839= =C2=A0 906-494-2434

=

On Tue, Jun 30, 2015 at 12:25 PM, Scott Shor= ter <sshorter@electrosoft-inc.com> wrote:
Great discussion all.=C2=A0 I d= on't know if I've said it here before, but my equation for trust go= es like this:

=C2=A0 =C2=A0 =C2=A0trust =3D 1 / risk

If we are trying to measure risk, what if this were c= onsidered a "risk score" that is calculated from "risk metri= cs"?=C2=A0 Identity risk score, if we want to get crazy.
I get the notion from the Common Vulnerability Scoring System (= CVSS, version 3 draft is available=C2=A0here).=C2=A0 I think that there's a lot of simi= larities between vulnerability management and credential management.=C2=A0 = Vulnerabilities represent potential risks to systems, and CVSS provides a w= ay of expressing those risks.=C2=A0 Similarly every credential issued repre= sents a marginal increased risk, and our strawperson document currently loo= ks a lot like CVSS.=C2=A0

I don't know whether= more harm is done by unmanaged credentials or unmitigated vulnerabilities,= but each of those should be captured in an organization's risk registr= y.=C2=A0

My 0.02USD,
Scott

On Tue, Jun= 30, 2015 at 12:01 PM, Justin Richer <jricher@mit.edu> wrote:<= br>
Josh, thanks for the great comments. Responses inline:
On Jun 30, 2015, at 7:22 AM,= Josh Howlett <Josh.Howlett@jisc.ac.uk> wrote:

Justin, Leif,

=C2=A0

Thanks for this draft. I only have some general= comments at this point. The first two concern the use of language; I might be hair-splitting: YMMV. The final comment is more subst= antive.

=C2=A0

1. Vectors have a very speci= fic formal meaning in mathematics. Given that this is an engineering commun= ity, I think there=E2=80=99s a possibility of creating confusion from the use of this language. You correctly try to = disambiguate this in 2.2, but the use of different language would make this= unnecessary.


When we picked the name =E2=80=9Cvectors of trust=E2=80=9D we knew t= hat both =E2=80=9Cvector=E2=80=9D and =E2=80=9Ctrust=E2=80=9D were terms th= at were going to confuse some people but could be explained fairly succinct= ly in this context and help get the point across. I=E2=80=99m honestly welc= ome to renaming the whole shebang but for now I=E2=80=99ve yet to hear a be= tter set of terms.

= =C2=A0

2. The draft talks o= f vectors of trust but actually describes types of evidence and attributes = that can be associated with these. As you discuss in section 7.1, there is a specific trust context which confer= s semantics on these attributes ex post facto. Thus this evidence and their= attributes can inform runtime outcomes, in the context of a given trust co= ntext, but do not define it. I think it might be helpful to reconsider the description of this work, so that it= s goal is clearer to the reader; and set out the fundamental role of the tr= ust context within the introduction/background.


It was= only in this latest draft that we really started to set out the importance= of context for a given VoT value, so I think your comments here are valid.= =C2=A0

=

=C2=A0

3. The goal of the draft, as I unde= rstand it, is to enable RPs and IdPs to share a common vocabulary of eviden= ce and their attributes. This avoids the =E2=80=9Cbundling=E2=80=9D of different kinds of evidence = by allowing for decomposability. This evidence, now unbundled, can be emplo= yed in different trust contexts, facilitating interoperability across trust= framework. So far so good? However I=E2=80=99ll note that the evidences and attributes described in section 3 are often themselves b= undles (=E2=80=9CC5 Sealed hardware token / trusted biometric / TPM-backed = keys). So, playing devil=E2=80=99s advocate, what is to stop actors from de= composing the core elements described in section 3? Indeed I think it=E2=80=99s actually a goal of this document to permit = that through extensions. I wonder therefore whether an excess of decomposab= ility will actually aggravate interoperability between trust contexts. Clea= rly this could be addressed by setting norms, but then you=E2=80=99ve reinvented NIST 800-63. Alternatively you could im= agine a taxonomy of evidence, with classes and (through extensions) sub-cla= sses allowing for greater specificity, while providing for a general interp= retation if actors do not share the same vocabulary. I hesitate to describe this as fractal, but I hope you can see= what I=E2=80=99m driving at.

=C2=A0



It could definitely be fractal, but I think= it=E2=80=99s important that we capture something at the right level. Aggre= gate a bunch of vector values together and you get a definition like 800-63= , which is still useful but only in its intended consequences. Break apart = the vector components and you get into the specifics of a full trust framew= ork definition, like the high granularity in the GTRI work (or Steve=E2=80= =99s =E2=80=9Ceverything is an attribute=E2=80=9D utopia). I think there=E2= =80=99s value in each of those, but the value doesn=E2=80=99t really come a= t runtime when you need to make a contextual decision. That=E2=80=99s where= I think that the VoT approach can really shine. It=E2=80=99s more granular= than the broad sweeping definitions that authentication guidelines would h= ave, but it=E2=80=99s less granular than a sea of attributes. We want somet= hing that an RP can hope to process and make sense of, and to do that we ne= ed to walk a fine line.

<= div>=C2=A0=E2=80=94 Justin

Josh.

From: vot [mai= lto:vot-bounces@ietf.org] On Behalf Of Justin Richer
Sent: 27 June 2015 04:15
To: vot@ietf.org
Subject: [VoT] Vectors of Trust I-D

=C2=A0

Hi Everyone,

=C2=A0

I have taken the initial strawman proposal alon= g with a substantial number of edits and inputs from several folks and have= created an initial I-D of the document:

=C2=A0

=C2=A0

It=E2=80=99s still a very drafty draft, but hop= efully it=E2=80=99s starting to make this a concrete thing. Please read it = over and discuss it here on the list.

=C2=A0

I would like to propose a bar-BoF in Prague for= VoT for anyone who would like to discuss this. If you=E2=80=99re intereste= d (and will be there in person), let me know!

=C2=A0

=C2=A0=E2=80=94 Justin


Jisc is a registered charity (number 1149740) and a company limited by guar= antee which is registered in England under Company No. 5747339, VAT No. GB = 197 0632 86. Jisc=E2=80=99s registered office is: One Castlepark, Tower Hil= l, Bristol, BS2 0JA. T 0203 697 5800.

=20 Jisc Services Limited is a wholly owned Jisc subsidiary and a company limit= ed by guarantee which is registered in England under company number 2881024= , VAT number GB 197 0632 86. The registered office is: One Castle Park, Tow= er Hill, Bristol BS2 0JA. T 0203 697 5800. =20 =20


_____= __________________________________________
vot mailing list
vot@ietf.org
https://www.ietf.org/mailman/listinfo/vot




--
=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D= =3D
Scott Shorter, Princ= ipal Security Engineer<= br>Electrosoft=C2=A0=E2=80=93=C2= =A0Fueling Customer Success Through Outstanding Value and Trust!
= Woman-Ow= ned, Minority-Owned Small Business | ISO 9001 | CMMI Level 2=C2=A0
= 1893 Metro C= enter Drive; Ste 228; Reston, VA 20190
sshorter@electrosoft-inc.com=C2=A0(Email);=C2=A0= =C2=A0=C2=A0http://www.electro= soft-inc.com=C2=A0(Web)
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=

_______________________________________________
vot mailing list
vot@ietf.org
https://www.ietf.org/mailman/listinfo/vot


--089e013d196a52344f0519bfaae5-- From nobody Tue Jun 30 13:50:16 2015 Return-Path: X-Original-To: vot@ietfa.amsl.com Delivered-To: vot@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E889E1B2EE6 for ; Tue, 30 Jun 2015 13:50:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.317 X-Spam-Level: X-Spam-Status: No, score=-1.317 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HELO_EQ_BIZ=0.288, HTML_MESSAGE=0.001, MSGID_FROM_MTA_HEADER=0.001, RCVD_IN_DNSWL_LOW=-0.7, RELAY_IS_203=0.994, SPF_HELO_PASS=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id s-oxcLICWcaP for ; Tue, 30 Jun 2015 13:50:12 -0700 (PDT) Received: from mx1.securemx.biz (mx1.securemx.biz [203.84.134.2]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D137C1B3229 for ; Tue, 30 Jun 2015 13:50:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; d=nz.smxemail.com; s=alpha; c=relaxed/relaxed; q=dns/txt; i=@nz.smxemail.com; t=1435697409; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:CC; bh=YQaUW9Ye6GwajvPMN/j2iCMoq8c5lJXFlQPCtQZIbpo=; b=Kl3b/mHJtva1Esu9ayAZoAepmAAQzTiYjQGAykGOKQj+p9s8cBGqKORtL1wS+wJi 813o1KcWYzXrvi0gYLJfYGggRHB1Uq9kvXtPDsfRu1bW+Hnbgq7KJynsyp60WzHe cRUhx8sFbmT9nWGCnA0YED/4hjOX21KTdOFL717gVhU=; Received: from s111-0006-lnv01 ([131.203.48.73]) by omr.nz.smxemail.com with ESMTP (using TLSv1 with cipher AES256-SHA (256/256 bits)) id 55930101-2C4D3136@mta1101.omr; Tue, 30 Jun 2015 20:50:09 +0000 MIME-Version: 1.0 Message-ID: <147EE18440E5AF44834B220ED35BA530014AB25FFC@WLGPRDMBX02.dia.govt.nz> X-MessageIsInfected: false Received: from 161-65-142-21.ip.fx.net.nz (EHLO WLGPRDMM01.dia.govt.nz) ([161.65.142.21]) by s111-0006-lnv01 (JAMES SMTP Server ) with ESMTP ID 1856221349; Wed, 01 Jul 2015 08:50:06 +1200 (NZST) Received: from WLGPRDCAS01.dia.govt.nz (Not Verified[172.29.0.93]) by WLGPRDMM01.dia.govt.nz with MailMarshal (v7, 1, 1, 5205) (using TLS: SSLv23) id ; Wed, 01 Jul 2015 08:50:06 +1200 Received: from WLGPRDMBX02.dia.govt.nz ([fe80::d51f:14cf:8162:8a0b]) by WLGPRDCAS01.dia.govt.nz ([172.29.0.93]) with mapi id 14.03.0235.001; Wed, 1 Jul 2015 08:50:06 +1200 From: Colin Wallis To: 'Mark Lizar' , "Grassi, Paul A." Thread-Topic: [VoT] Clause 7 edgy on scope? (RE: Vectors of Trust I-D) Thread-Index: AQHQstUckGykwW32yECQR8eylo0If53EIrcAgAFfslA= Date: Tue, 30 Jun 2015 20:50:06 +0000 References: <147EE18440E5AF44834B220ED35BA530014AB1AEC1@WLGPRDMBX02.dia.govt.nz> <69B21050-7E52-4B85-8081-8DE210DE432A@nist.gov> <675F1A61-4881-4365-8138-8517B2047B91@smartspecies.com> In-Reply-To: <675F1A61-4881-4365-8138-8517B2047B91@smartspecies.com> Accept-Language: en-US, en-NZ Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-mailadviser: Confirmation not required x-originating-ip: [172.29.0.162] Content-Type: multipart/alternative; boundary="_000_147EE18440E5AF44834B220ED35BA530014AB25FFCWLGPRDMBX02di_" Archived-At: Cc: "vot@ietf.org" , Justin Richer Subject: Re: [VoT] Clause 7 edgy on scope? (RE: Vectors of Trust I-D) X-BeenThere: vot@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Vectors of Trust discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 30 Jun 2015 20:50:15 -0000 --_000_147EE18440E5AF44834B220ED35BA530014AB25FFCWLGPRDMBX02di_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 VGhhbmtzIGZvciB0aG9zZSBjb21tZW50cyBvbiBDbGF1c2UgNy4NCkl0IHNlZW1zIGxpa2UgdGhl IGNoYWxsZW5nZSBpcyB0byBmaW5kIHRoYXQgc3dlZXQgc3BvdC9maW5lIGxpbmUgdGhhdCBnaXZl cyB0aGUgcmVhZGVyIGVub3VnaCBpbmZvIG9uIGhvdyB0byBkbyB0aGUgY3Jvc3MgZG9tYWluIHN1 YnNjcmlwdGlvbi92YWxpZGF0aW9uLCB3aXRob3V0IGhhdmluZyB0aGUgdGhpcyB3aG9sZSBkcmFm dCBzdGFuZGFyZGl6aW5nIHRydXN0IGZyYW1ld29ya3MgYW5kIHRydXN0bWFya3MuDQpCZWNhdXNl IHRoYXQgaXMgYSB3aG9sZSBsb3QgbW9yZSB3b3JrIGFuZCB0YWtlcyB0aGUgZm9jdXMgYXdheSBm cm9tIHRoZSBvcmlnaW5hbCBpbnRlbnQgKHdoaWNoIHdhcyBteSBjb25jZXJuIGFuZCBoZW5jZSB0 aGUgaWRlYSBvZiBtYWtpbmcgdGhpcyBwYXJ0IGluZm9ybWF0aXZlIHVudGlsIHN1Y2ggdGltZSBh cyB3ZSBoYXZlIGEgc3VwcG9ydGVkIHRydXN0bWFyayBhbmQgdHJ1c3QgZnJhbWV3b3JrIHN0YW5k YXJkIHRvIHJldmVyc2UgdGhlIGNyb3NzIGRvbWFpbiB0aGluZ3MgYmFjayBpbnRvKS4NCg0KQ2hl ZXJzDQpDb2xpbg0KDQoNCkZyb206IE1hcmsgTGl6YXIgW21haWx0bzptYXJrQHNtYXJ0c3BlY2ll cy5jb21dDQpTZW50OiBUdWVzZGF5LCAzMCBKdW5lIDIwMTUgMTE6MzUgcC5tLg0KVG86IEdyYXNz aSwgUGF1bCBBLg0KQ2M6IEp1c3RpbiBSaWNoZXI7IENvbGluIFdhbGxpczsgdm90QGlldGYub3Jn DQpTdWJqZWN0OiBSZTogW1ZvVF0gQ2xhdXNlIDcgZWRneSBvbiBzY29wZT8gKFJFOiBWZWN0b3Jz IG9mIFRydXN0IEktRCkNCg0KbmljZSBhbmQgY3Jpc3AuDQoNCkkgY2FuIHJlYWxseSBzdGFydCB0 byBpbWFnaW5lIGhvdyBkaXNjb3ZlcnkgYW5kIHRydXN0IG1hcmtzIGNhbiBiZSB1c2VkIHRvIHNj YWxlIHRydXN0LiBBbHRob3VnaCB0aGVyZSBpcyBzb21lIGFkZGl0aW9uYWwgaXNzdWVzIGFyb3Vu ZCB0aGUgb3ZlcmFyY2hpbmcgdHJ1c3QgZnJhbWV3b3JrICh3aGF0ZXZlciB0aGF0IGlzLCBJIGFt IGFzc3VtaW5nIGxhdykuIEZvciBleGFtcGxlIGFzc2Vzc2luZyB0cnVzdCBtYXJrcyBzbyB0aGF0 IHRoZXkgYXJlIGFwcHJvcHJpYXRlIGZvciB0aGUgcHVycG9zZSBhbmQgYWxzbyBmb3IgYXBwbGlj YXRpb24gaW4gdGhlIGZyYW1ld29yaywgd2l0aCBhIHJvYnVzdCBtZXRob2QgZm9yIGFzc2Vzc2lu ZyBhbmQgYXNzZXJ0aW5nIGludGVncml0eSBvZiB0cnVzdCBtYXJrcy4gIEluIHRoaXMgY29udGV4 dCB0aGVuIEkgdGhpbmsgaXQgd291bGQgYmUgY2xlYXIgaG93IHRoZSB0cnVzdCBtYXJrcyBmaXQg d2l0aCBWT1QuICBJdHMgdGhlIGdhcCBiZXR3ZWVuIHRoZXNlIGVsZW1lbnRzIEkgc3VzcGVjdCB0 aGF0IG5lZWRzIHRvIGJlIGZ1cnRoZXIgYXJ0aWN1bGF0ZWQgYW5kIHVuZGVyc3Rvb2QuDQoNCm5p Y2VseSB0aG91Z2h0IHByb3Zva2luZyAgIC4uDQoNCk9uIDMwIEp1biAyMDE1LCBhdCAwMjozNSwg R3Jhc3NpLCBQYXVsIEEuIDxwYXVsLmdyYXNzaUBuaXN0LmdvdjxtYWlsdG86cGF1bC5ncmFzc2lA bmlzdC5nb3Y+PiB3cm90ZToNCg0KSSBwZXJzb25hbGx5IGxpa2UgdGhlIGlkZWEgb2YgZGlzY292 ZXJhYmlsaXR5IGF0IHRoZSBvbnNldCwgYW5kIHRoZSBkaXNjdXNzaW9uIHRoYXQgd2lsbCBmb2xs b3cuDQoNClRoaXMgd2FzIGdyZWF0IHRvIHJlYWQsIHRoYW5rcyB0byB5b3UgYW5kIExlaWYgZm9y IHRoZSB3b3JrIQ0KDQpPbiBKdW4gMjksIDIwMTUsIGF0IDg6NDkgUE0sICJKdXN0aW4gUmljaGVy IiA8anJpY2hlckBtaXQuZWR1PG1haWx0bzpqcmljaGVyQG1pdC5lZHU+PiB3cm90ZToNCkNvbGlu LCB0aGF04oCZcyBhIGdyZWF0IHF1ZXN0aW9uLCBiZWNhdXNlIEnigJltIGhvbmVzdGx5IG5vdCBz dXJlIHdoYXQgdGhlIGFuc3dlciBpcyB5ZXQuIEkgdGhpbmsgdGhhdCB0aGUgdmVjdG9ycyBvbmx5 IG1ha2Ugc2Vuc2UgaW4gdGhlIGNvbnRleHQgb2Ygc29tZSBraW5kIG9mIHRydXN0IGZyYW1ld29y ayBzZXR1cCwgYnV0IHRoYXQgc29tZXRpbWVzIHRob3NlIHBvbGljaWVzIHdpbGwgYmUgaGFyZC1j b2RlZCBhdCBjb25maWd1cmF0aW9uIHRpbWUgYW5kIHdvbuKAmXQgbmVlZCB0byBiZSBkeW5hbWlj YWxseSBib3VuZCBvciBkaXNjb3ZlcmVkLiBUaGF0IHNhaWQsIEkgdGhpbmsgdGhlIHJlYWwgdmFs dWUgb2YgdGhpcyBpcyBnb2luZyB0byBiZSBjcm9zcy1kb21haW4gd2hlcmUgYW4gUlAgY291bGQg c3Vic2NyaWJlIHRvIChhbmQgdW5kZXJzdGFuZCkgbXVsdGlwbGUgdHJ1c3QgbWFya3MgYW5kIGJl IGFibGUgdG8gdmFsaWRhdGUgdGhlbSBhdCBydW50aW1lLiBTdGlsbCwgdGhhdCBwaWVjZSBtaWdo dCBiZSBzZXBhcmFibGUgZW5vdWdoLCBhbmQgcGVyaGFwcyBzdWJzdGFudGl2ZSBlbm91Z2gsIHRv IGJlIGl0cyBvd24gZHJhZnQuDQoNClRoYXQgc2FpZCwgSSBmaWd1cmVkIEnigJlkIHdyaXRlIGl0 IGRvd24gZG93biBhbmQgZmlndXJlIG91dCB3aGVyZSBpdOKAmXMgYWN0dWFsbHkgc3VwcG9zZWQg dG8gZ28gbGF0ZXIuIDopDQoNCiDigJQgSnVzdGluDQoNCk9uIEp1biAyOSwgMjAxNSwgYXQgNzox NCBQTSwgQ29saW4gV2FsbGlzIDxDb2xpbi5XYWxsaXNAZGlhLmdvdnQubno8bWFpbHRvOkNvbGlu LldhbGxpc0BkaWEuZ292dC5uej4+IHdyb3RlOg0KDQpNYW55IHRoYW5rcyBKdXN0aW4gYW5kIExl aWYNCg0KSeKAmXZlIGRvbmUgYSBmaXJzdCBwYXNzL2xpZ2h0IHJlYWQsIGFuZCBmcm9tIHRoYXQs IEkgdGhpbmsgaXQgaXMgYSB0ZXJyaWZpYyBmaXJzdCBjdXQgdGhhdCBnZXRzIHVzIG9uIHRoZSBw YXRoIHRvIG5vcm1hbGl6aW5nIHRoZSBkaXNjdXNzaW9ucyBvdmVyIHRoZSBwYXN0IDkgbW9udGhz Lg0KDQpBc2lkZSBmcm9tIGEgZmV3IHRpZHkgdXBzLCBJIGp1c3QgaGF2ZSB0aGlzIHNsaWdodCBj b25jZXJuIHdoZXRoZXIgYWxsIG9mIENsYXVzZSA3IChEaXNjb3ZlcnkgYW5kIFZlcmlmaWNhdGlv bikgaXMgaW4gc2NvcGUgZm9yIG5vcm1hdGl2ZSB0ZXh0Pw0KSSBjZXJ0YWlubHkgYXBwcmVjaWF0 ZSB0aGF0IGluIG1vc3QgaW1wbGVtZW50YXRpb25zIGFuZCBkZXBsb3ltZW50cywgdGhlcmUgd291 bGQgYmUgYSBkZXBlbmRlbmN5IG9uIGFuIG9wZXJhdGlvbmFsIHRydXN0IGZyYW1ld29yayBhbmQg dHJ1c3RtYXJrLg0KQnV0IGlzIGl0IHRvbyBiaWcgYSBzdHJldGNoIHRvIG1ha2UgdGhhdCBub3Jt YXRpdmUgZm9yIHRoaXMgd29yaz8NCkp1c3QgYSB0aG91Z2h0Li4gYW5kIG1vcmUgdGhhbiBoYXBw eSB0byBiZSBwcm92ZW4gd3JvbmcuLiDimLouDQoNCkNoZWVycw0KQ29saW4NCg0KDQpGcm9tOiB2 b3QgW21haWx0bzp2b3QtYm91bmNlc0BpZXRmLm9yZ10gT24gQmVoYWxmIE9mIEp1c3RpbiBSaWNo ZXINClNlbnQ6IFNhdHVyZGF5LCAyNyBKdW5lIDIwMTUgMzoxNSBwLm0uDQpUbzogdm90QGlldGYu b3JnPG1haWx0bzp2b3RAaWV0Zi5vcmc+DQpTdWJqZWN0OiBbVm9UXSBWZWN0b3JzIG9mIFRydXN0 IEktRA0KDQpIaSBFdmVyeW9uZSwNCg0KSSBoYXZlIHRha2VuIHRoZSBpbml0aWFsIHN0cmF3bWFu IHByb3Bvc2FsIGFsb25nIHdpdGggYSBzdWJzdGFudGlhbCBudW1iZXIgb2YgZWRpdHMgYW5kIGlu cHV0cyBmcm9tIHNldmVyYWwgZm9sa3MgYW5kIGhhdmUgY3JlYXRlZCBhbiBpbml0aWFsIEktRCBv ZiB0aGUgZG9jdW1lbnQ6DQoNCmh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaWQvZHJhZnQtcmljaGVy LXZlY3RvcnMtb2YtdHJ1c3QtMDANCg0KSXTigJlzIHN0aWxsIGEgdmVyeSBkcmFmdHkgZHJhZnQs IGJ1dCBob3BlZnVsbHkgaXTigJlzIHN0YXJ0aW5nIHRvIG1ha2UgdGhpcyBhIGNvbmNyZXRlIHRo aW5nLiBQbGVhc2UgcmVhZCBpdCBvdmVyIGFuZCBkaXNjdXNzIGl0IGhlcmUgb24gdGhlIGxpc3Qu DQoNCkkgd291bGQgbGlrZSB0byBwcm9wb3NlIGEgYmFyLUJvRiBpbiBQcmFndWUgZm9yIFZvVCBm b3IgYW55b25lIHdobyB3b3VsZCBsaWtlIHRvIGRpc2N1c3MgdGhpcy4gSWYgeW914oCZcmUgaW50 ZXJlc3RlZCAoYW5kIHdpbGwgYmUgdGhlcmUgaW4gcGVyc29uKSwgbGV0IG1lIGtub3chDQoNCiDi gJQgSnVzdGluDQoNCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fDQp2b3QgbWFpbGluZyBsaXN0DQp2b3RAaWV0Zi5vcmc8bWFpbHRvOnZvdEBpZXRmLm9yZz4N Cmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vdm90DQpfX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0Kdm90IG1haWxpbmcgbGlzdA0Kdm90 QGlldGYub3JnPG1haWx0bzp2b3RAaWV0Zi5vcmc+DQpodHRwczovL3d3dy5pZXRmLm9yZy9tYWls bWFuL2xpc3RpbmZvL3ZvdA0KDQo= --_000_147EE18440E5AF44834B220ED35BA530014AB25FFCWLGPRDMBX02di_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTQgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 SGVsdmV0aWNhOw0KCXBhbm9zZS0xOjIgMTEgNiA0IDIgMiAyIDIgMiA0O30NCkBmb250LWZhY2UN Cgl7Zm9udC1mYW1pbHk6V2luZ2RpbmdzOw0KCXBhbm9zZS0xOjUgMCAwIDAgMCAwIDAgMCAwIDA7 fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpXaW5nZGluZ3M7DQoJcGFub3NlLTE6NSAwIDAg MCAwIDAgMCAwIDAgMDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFu b3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpU YWhvbWE7DQoJcGFub3NlLTE6MiAxMSA2IDQgMyA1IDQgNCAyIDQ7fQ0KLyogU3R5bGUgRGVmaW5p dGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWwsIGRpdi5Nc29Ob3JtYWwNCgl7bWFy Z2luOjBjbTsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEyLjBwdDsNCglm b250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIiwic2VyaWYiO30NCmE6bGluaywgc3Bhbi5Nc29I eXBlcmxpbmsNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1k ZWNvcmF0aW9uOnVuZGVybGluZTt9DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93 ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29y YXRpb246dW5kZXJsaW5lO30NCnAuTXNvQWNldGF0ZSwgbGkuTXNvQWNldGF0ZSwgZGl2Lk1zb0Fj ZXRhdGUNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCW1zby1zdHlsZS1saW5rOiJCYWxsb29u IFRleHQgQ2hhciI7DQoJbWFyZ2luOjBjbTsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9u dC1zaXplOjguMHB0Ow0KCWZvbnQtZmFtaWx5OiJUYWhvbWEiLCJzYW5zLXNlcmlmIjt9DQpzcGFu LmFwcGxlLWNvbnZlcnRlZC1zcGFjZQ0KCXttc28tc3R5bGUtbmFtZTphcHBsZS1jb252ZXJ0ZWQt c3BhY2U7fQ0Kc3Bhbi5CYWxsb29uVGV4dENoYXINCgl7bXNvLXN0eWxlLW5hbWU6IkJhbGxvb24g VGV4dCBDaGFyIjsNCgltc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJbXNvLXN0eWxlLWxpbms6IkJh bGxvb24gVGV4dCI7DQoJZm9udC1mYW1pbHk6IlRhaG9tYSIsInNhbnMtc2VyaWYiO30NCnNwYW4u RW1haWxTdHlsZTIwDQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFt aWx5OiJDYWxpYnJpIiwic2Fucy1zZXJpZiI7DQoJY29sb3I6IzFGNDk3RDt9DQouTXNvQ2hwRGVm YXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LXNpemU6MTAuMHB0O30N CkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjYxMi4wcHQgNzkyLjBwdDsNCgltYXJnaW46NzIu MHB0IDcyLjBwdCA3Mi4wcHQgNzIuMHB0O30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7cGFnZTpXb3Jk U2VjdGlvbjE7fQ0KLS0+PC9zdHlsZT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBl ZGVmYXVsdHMgdjpleHQ9ImVkaXQiIHNwaWRtYXg9IjEwMjYiIC8+DQo8L3htbD48IVtlbmRpZl0t LT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlbGF5b3V0IHY6ZXh0PSJlZGl0Ij4N CjxvOmlkbWFwIHY6ZXh0PSJlZGl0IiBkYXRhPSIxIiAvPg0KPC9vOnNoYXBlbGF5b3V0PjwveG1s PjwhW2VuZGlmXS0tPg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0iRU4tTloiIGxpbms9ImJsdWUiIHZs aW5rPSJwdXJwbGUiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nh bGlicmkmcXVvdDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90Oztjb2xvcjojMUY0OTdEIj5UaGFua3Mg Zm9yIHRob3NlIGNvbW1lbnRzIG9uIENsYXVzZSA3LjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O0NhbGlicmkmcXVvdDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90Oztjb2xvcjojMUY0 OTdEIj5JdCBzZWVtcyBsaWtlIHRoZSBjaGFsbGVuZ2UgaXMgdG8gZmluZCB0aGF0IHN3ZWV0IHNw b3QvZmluZSBsaW5lIHRoYXQgZ2l2ZXMgdGhlIHJlYWRlciBlbm91Z2ggaW5mbyBvbiBob3cgdG8g ZG8gdGhlIGNyb3NzIGRvbWFpbiBzdWJzY3JpcHRpb24vdmFsaWRhdGlvbiwgd2l0aG91dA0KIGhh dmluZyB0aGUgdGhpcyB3aG9sZSBkcmFmdCBzdGFuZGFyZGl6aW5nIHRydXN0IGZyYW1ld29ya3Mg YW5kIHRydXN0bWFya3MuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJy aSZxdW90OywmcXVvdDtzYW5zLXNlcmlmJnF1b3Q7O2NvbG9yOiMxRjQ5N0QiPkJlY2F1c2UgdGhh dCBpcyBhIHdob2xlIGxvdCBtb3JlIHdvcmsgYW5kIHRha2VzIHRoZSBmb2N1cyBhd2F5IGZyb20g dGhlIG9yaWdpbmFsIGludGVudCAod2hpY2ggd2FzIG15IGNvbmNlcm4gYW5kIGhlbmNlIHRoZSBp ZGVhIG9mIG1ha2luZyB0aGlzIHBhcnQgaW5mb3JtYXRpdmUNCiB1bnRpbCBzdWNoIHRpbWUgYXMg d2UgaGF2ZSBhIHN1cHBvcnRlZCB0cnVzdG1hcmsgYW5kIHRydXN0IGZyYW1ld29yayBzdGFuZGFy ZCB0byByZXZlcnNlIHRoZSBjcm9zcyBkb21haW4gdGhpbmdzIGJhY2sgaW50bykuPG86cD48L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OywmcXVvdDtzYW5zLXNlcmlm JnF1b3Q7O2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90Oztjb2xvcjojMUY0OTdE Ij5DaGVlcnM8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7 LCZxdW90O3NhbnMtc2VyaWYmcXVvdDs7Y29sb3I6IzFGNDk3RCI+Q29saW48bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LCZxdW90O3NhbnMtc2VyaWYmcXVv dDs7Y29sb3I6IzFGNDk3RCI+Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q2FsaWJyaSZxdW90OywmcXVvdDtzYW5zLXNlcmlmJnF1b3Q7O2NvbG9yOiMxRjQ5N0QiPjxv OnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9u ZTtib3JkZXItdG9wOnNvbGlkICNCNUM0REYgMS4wcHQ7cGFkZGluZzozLjBwdCAwY20gMGNtIDBj bSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9ImZv bnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VGFob21hJnF1b3Q7LCZxdW90O3NhbnMt c2VyaWYmcXVvdDsiPkZyb206PC9zcGFuPjwvYj48c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9ImZv bnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VGFob21hJnF1b3Q7LCZxdW90O3NhbnMt c2VyaWYmcXVvdDsiPiBNYXJrIExpemFyIFttYWlsdG86bWFya0BzbWFydHNwZWNpZXMuY29tXQ0K PGJyPg0KPGI+U2VudDo8L2I+IFR1ZXNkYXksIDMwIEp1bmUgMjAxNSAxMTozNSBwLm0uPGJyPg0K PGI+VG86PC9iPiBHcmFzc2ksIFBhdWwgQS48YnI+DQo8Yj5DYzo8L2I+IEp1c3RpbiBSaWNoZXI7 IENvbGluIFdhbGxpczsgdm90QGlldGYub3JnPGJyPg0KPGI+U3ViamVjdDo8L2I+IFJlOiBbVm9U XSBDbGF1c2UgNyBlZGd5IG9uIHNjb3BlPyAoUkU6IFZlY3RvcnMgb2YgVHJ1c3QgSS1EKTxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPm5pY2UgYW5kIGNyaXNw LiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SSBj YW4gcmVhbGx5IHN0YXJ0IHRvIGltYWdpbmUgaG93IGRpc2NvdmVyeSBhbmQgdHJ1c3QgbWFya3Mg Y2FuIGJlIHVzZWQgdG8gc2NhbGUgdHJ1c3QuIEFsdGhvdWdoIHRoZXJlIGlzIHNvbWUgYWRkaXRp b25hbCBpc3N1ZXMgYXJvdW5kIHRoZSBvdmVyYXJjaGluZyB0cnVzdCBmcmFtZXdvcmsgKHdoYXRl dmVyIHRoYXQgaXMsIEkgYW0gYXNzdW1pbmcgbGF3KS4gRm9yIGV4YW1wbGUgYXNzZXNzaW5nIHRy dXN0IG1hcmtzDQogc28gdGhhdCB0aGV5IGFyZSBhcHByb3ByaWF0ZSBmb3IgdGhlIHB1cnBvc2Ug YW5kIGFsc28gZm9yIGFwcGxpY2F0aW9uIGluIHRoZSBmcmFtZXdvcmssIHdpdGggYSByb2J1c3Qg bWV0aG9kIGZvciBhc3Nlc3NpbmcgYW5kIGFzc2VydGluZyBpbnRlZ3JpdHkgb2YgdHJ1c3QgbWFy a3MuICZuYnNwO0luIHRoaXMgY29udGV4dCB0aGVuIEkgdGhpbmsgaXQgd291bGQgYmUgY2xlYXIg aG93IHRoZSB0cnVzdCBtYXJrcyBmaXQgd2l0aCBWT1QuICZuYnNwO0l0cyB0aGUgZ2FwDQogYmV0 d2VlbiB0aGVzZSBlbGVtZW50cyBJIHN1c3BlY3QgdGhhdCBuZWVkcyB0byBiZSBmdXJ0aGVyIGFy dGljdWxhdGVkIGFuZCB1bmRlcnN0b29kLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5uaWNlbHkgdGhvdWdodCBwcm92b2tpbmcgJm5ic3A7IC4u Jm5ic3A7PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4m bmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4w cHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+T24g MzAgSnVuIDIwMTUsIGF0IDAyOjM1LCBHcmFzc2ksIFBhdWwgQS4gJmx0OzxhIGhyZWY9Im1haWx0 bzpwYXVsLmdyYXNzaUBuaXN0LmdvdiI+cGF1bC5ncmFzc2lAbmlzdC5nb3Y8L2E+Jmd0OyB3cm90 ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJz cDs8L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LCZx dW90O3NhbnMtc2VyaWYmcXVvdDsiPkkgcGVyc29uYWxseSBsaWtlIHRoZSBpZGVhIG9mIGRpc2Nv dmVyYWJpbGl0eSBhdCB0aGUgb25zZXQsIGFuZCB0aGUgZGlzY3Vzc2lvbiB0aGF0IHdpbGwgZm9s bG93LjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVs dmV0aWNhJnF1b3Q7LCZxdW90O3NhbnMtc2VyaWYmcXVvdDsiPjxvOnA+Jm5ic3A7PC9vOnA+PC9z cGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LCZxdW90 O3NhbnMtc2VyaWYmcXVvdDsiPlRoaXMgd2FzIGdyZWF0IHRvIHJlYWQsIHRoYW5rcyB0byB5b3Ug YW5kIExlaWYgZm9yIHRoZSB3b3JrITxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tYm90dG9tOjEyLjBwdCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVv dDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90OyI+PGJyPg0KT24gSnVuIDI5LCAyMDE1LCBhdCA4OjQ5 IFBNLCAmcXVvdDtKdXN0aW4gUmljaGVyJnF1b3Q7ICZsdDs8YSBocmVmPSJtYWlsdG86anJpY2hl ckBtaXQuZWR1Ij48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5qcmljaGVyQG1pdC5lZHU8L3Nw YW4+PC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8YmxvY2tx dW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0O29ycGhhbnM6 IGF1dG87dGV4dC1hbGlnbjpzdGFydDt3aWRvd3M6IGF1dG87LXdlYmtpdC10ZXh0LXN0cm9rZS13 aWR0aDogMHB4O3dvcmQtc3BhY2luZzowcHgiPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNh JnF1b3Q7LCZxdW90O3NhbnMtc2VyaWYmcXVvdDsiPkNvbGluLCB0aGF04oCZcyBhIGdyZWF0IHF1 ZXN0aW9uLCBiZWNhdXNlIEnigJltIGhvbmVzdGx5IG5vdCBzdXJlIHdoYXQgdGhlIGFuc3dlciBp cyB5ZXQuIEkgdGhpbmsgdGhhdCB0aGUgdmVjdG9ycyBvbmx5IG1ha2Ugc2Vuc2UgaW4gdGhlIGNv bnRleHQgb2Ygc29tZSBraW5kIG9mIHRydXN0IGZyYW1ld29yaw0KIHNldHVwLCBidXQgdGhhdCBz b21ldGltZXMgdGhvc2UgcG9saWNpZXMgd2lsbCBiZSBoYXJkLWNvZGVkIGF0IGNvbmZpZ3VyYXRp b24gdGltZSBhbmQgd29u4oCZdCBuZWVkIHRvIGJlIGR5bmFtaWNhbGx5IGJvdW5kIG9yIGRpc2Nv dmVyZWQuIFRoYXQgc2FpZCwgSSB0aGluayB0aGUgcmVhbCB2YWx1ZSBvZiB0aGlzIGlzIGdvaW5n IHRvIGJlIGNyb3NzLWRvbWFpbiB3aGVyZSBhbiBSUCBjb3VsZCBzdWJzY3JpYmUgdG8gKGFuZCB1 bmRlcnN0YW5kKSBtdWx0aXBsZQ0KIHRydXN0IG1hcmtzIGFuZCBiZSBhYmxlIHRvIHZhbGlkYXRl IHRoZW0gYXQgcnVudGltZS4gU3RpbGwsIHRoYXQgcGllY2UgbWlnaHQgYmUgc2VwYXJhYmxlIGVu b3VnaCwgYW5kIHBlcmhhcHMgc3Vic3RhbnRpdmUgZW5vdWdoLCB0byBiZSBpdHMgb3duIGRyYWZ0 LiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGlj YSZxdW90OywmcXVvdDtzYW5zLXNlcmlmJnF1b3Q7Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OywmcXVvdDtzYW5z LXNlcmlmJnF1b3Q7Ij5UaGF0IHNhaWQsIEkgZmlndXJlZCBJ4oCZZCB3cml0ZSBpdCBkb3duIGRv d24gYW5kIGZpZ3VyZSBvdXQgd2hlcmUgaXTigJlzIGFjdHVhbGx5IHN1cHBvc2VkIHRvIGdvIGxh dGVyLiA6KTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 SGVsdmV0aWNhJnF1b3Q7LCZxdW90O3NhbnMtc2VyaWYmcXVvdDsiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LCZx dW90O3NhbnMtc2VyaWYmcXVvdDsiPiZuYnNwO+KAlCBKdXN0aW48bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5 LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssJnF1b3Q7c2Fucy1zZXJpZiZx dW90OyI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPGRpdj4NCjxibG9ja3F1b3RlIHN0 eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LCZxdW90O3NhbnMtc2VyaWYmcXVvdDsiPk9uIEp1biAyOSwg MjAxNSwgYXQgNzoxNCBQTSwgQ29saW4gV2FsbGlzICZsdDs8YSBocmVmPSJtYWlsdG86Q29saW4u V2FsbGlzQGRpYS5nb3Z0Lm56Ij48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5Db2xpbi5XYWxs aXNAZGlhLmdvdnQubno8L3NwYW4+PC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3NwYW4+PC9w Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjku MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OywmcXVvdDtzYW5zLXNlcmlmJnF1 b3Q7Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LCZxdW90O3NhbnMtc2VyaWYmcXVvdDs7Y29sb3I6IzFG NDk3RCI+TWFueSB0aGFua3MgSnVzdGluIGFuZCBMZWlmPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LCZxdW90O3NhbnMtc2VyaWYmcXVvdDs7 Y29sb3I6IzFGNDk3RCI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90Oztjb2xvcjojMUY0OTdE Ij5J4oCZdmUgZG9uZSBhIGZpcnN0IHBhc3MvbGlnaHQgcmVhZCwgYW5kIGZyb20gdGhhdCwgSSB0 aGluayBpdCBpcyBhIHRlcnJpZmljIGZpcnN0IGN1dCB0aGF0IGdldHMgdXMgb24gdGhlIHBhdGgg dG8gbm9ybWFsaXppbmcgdGhlIGRpc2N1c3Npb25zIG92ZXIgdGhlIHBhc3QgOQ0KIG1vbnRocy48 c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PC9zcGFuPjxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LCZxdW90O3Nh bnMtc2VyaWYmcXVvdDs7Y29sb3I6IzFGNDk3RCI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9w Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90 Oztjb2xvcjojMUY0OTdEIj5Bc2lkZSBmcm9tIGEgZmV3IHRpZHkgdXBzLCBJIGp1c3QgaGF2ZSB0 aGlzIHNsaWdodCBjb25jZXJuIHdoZXRoZXIgYWxsIG9mIENsYXVzZSA3IChEaXNjb3ZlcnkgYW5k IFZlcmlmaWNhdGlvbikgaXMgaW4gc2NvcGUgZm9yIG5vcm1hdGl2ZSB0ZXh0Pzwvc3Bhbj48bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssJnF1 b3Q7c2Fucy1zZXJpZiZxdW90Oztjb2xvcjojMUY0OTdEIj5JIGNlcnRhaW5seSBhcHByZWNpYXRl IHRoYXQgaW4gbW9zdCBpbXBsZW1lbnRhdGlvbnMgYW5kIGRlcGxveW1lbnRzLCB0aGVyZSB3b3Vs ZCBiZSBhIGRlcGVuZGVuY3kgb24gYW4gb3BlcmF0aW9uYWwgdHJ1c3QgZnJhbWV3b3JrIGFuZCB0 cnVzdG1hcmsuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q2FsaWJyaSZxdW90OywmcXVvdDtzYW5zLXNlcmlmJnF1b3Q7O2NvbG9yOiMxRjQ5N0QiPkJ1 dCBpcyBpdCB0b28gYmlnIGEgc3RyZXRjaCB0byBtYWtlIHRoYXQgbm9ybWF0aXZlIGZvciB0aGlz IHdvcms/PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OywmcXVvdDtzYW5zLXNlcmlmJnF1b3Q7O2NvbG9yOiMxRjQ5N0QiPkp1c3Qg YSB0aG91Z2h0Li4gYW5kIG1vcmUgdGhhbiBoYXBweSB0byBiZSBwcm92ZW4gd3JvbmcuLjxzcGFu IGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48L3NwYW4+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6V2luZ2RpbmdzO2NvbG9yOiMxRjQ5 N0QiPko8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q2FsaWJyaSZxdW90OywmcXVvdDtzYW5zLXNlcmlmJnF1b3Q7O2NvbG9yOiMxRjQ5N0QiPi48 L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss JnF1b3Q7c2Fucy1zZXJpZiZxdW90Oztjb2xvcjojMUY0OTdEIj4mbmJzcDs8L3NwYW4+PG86cD48 L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OywmcXVvdDtzYW5zLXNl cmlmJnF1b3Q7O2NvbG9yOiMxRjQ5N0QiPkNoZWVyczwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssJnF1b3Q7c2Fucy1zZXJpZiZx dW90Oztjb2xvcjojMUY0OTdEIj5Db2xpbjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OywmcXVvdDtzYW5zLXNlcmlmJnF1b3Q7O2NvbG9yOiMx RjQ5N0QiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkm cXVvdDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90Oztjb2xvcjojMUY0OTdEIj4mbmJzcDs8L3NwYW4+ PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRv cDpzb2xpZCAjQjVDNERGIDEuMHB0O3BhZGRpbmc6My4wcHQgMGNtIDBjbSAwY20iPg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iZm9udC1z aXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtUYWhvbWEmcXVvdDssJnF1b3Q7c2Fucy1zZXJp ZiZxdW90OyI+RnJvbTo8L3NwYW4+PC9iPjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3Bh Y2UiPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWls eTomcXVvdDtUYWhvbWEmcXVvdDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90OyI+Jm5ic3A7PC9zcGFu Pjwvc3Bhbj48c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7VGFob21hJnF1b3Q7LCZxdW90O3NhbnMtc2VyaWYmcXVvdDsiPnZvdA0KIFs8 YSBocmVmPSJtYWlsdG86dm90LWJvdW5jZXNAaWV0Zi5vcmciPjxzcGFuIHN0eWxlPSJjb2xvcjpw dXJwbGUiPm1haWx0bzp2b3QtYm91bmNlc0BpZXRmLm9yZzwvc3Bhbj48L2E+XTxzcGFuIGNsYXNz PSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48Yj5PbiBCZWhhbGYgT2Y8c3Bh biBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PC9iPkp1c3RpbiBS aWNoZXI8YnI+DQo8Yj5TZW50OjwvYj48c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNl Ij4mbmJzcDs8L3NwYW4+U2F0dXJkYXksIDI3IEp1bmUgMjAxNSAzOjE1IHAubS48YnI+DQo8Yj5U bzo8L2I+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjxh IGhyZWY9Im1haWx0bzp2b3RAaWV0Zi5vcmciPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPnZv dEBpZXRmLm9yZzwvc3Bhbj48L2E+PGJyPg0KPGI+U3ViamVjdDo8L2I+PHNwYW4gY2xhc3M9ImFw cGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPltWb1RdIFZlY3RvcnMgb2YgVHJ1c3Qg SS1EPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SGkgRXZlcnlvbmUsPG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5J IGhhdmUgdGFrZW4gdGhlIGluaXRpYWwgc3RyYXdtYW4gcHJvcG9zYWwgYWxvbmcgd2l0aCBhIHN1 YnN0YW50aWFsIG51bWJlciBvZiBlZGl0cyBhbmQgaW5wdXRzIGZyb20gc2V2ZXJhbCBmb2xrcyBh bmQgaGF2ZSBjcmVhdGVkIGFuIGluaXRpYWwgSS1EIG9mIHRoZSBkb2N1bWVudDo8bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PGEgaHJlZj0iaHR0cHM6Ly90b29scy5pZXRmLm9yZy9pZC9kcmFm dC1yaWNoZXItdmVjdG9ycy1vZi10cnVzdC0wMCI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+ aHR0cHM6Ly90b29scy5pZXRmLm9yZy9pZC9kcmFmdC1yaWNoZXItdmVjdG9ycy1vZi10cnVzdC0w MDwvc3Bhbj48L2E+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9k aXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkl04oCZcyBzdGlsbCBhIHZl cnkgZHJhZnR5IGRyYWZ0LCBidXQgaG9wZWZ1bGx5IGl04oCZcyBzdGFydGluZyB0byBtYWtlIHRo aXMgYSBjb25jcmV0ZSB0aGluZy4gUGxlYXNlIHJlYWQgaXQgb3ZlciBhbmQgZGlzY3VzcyBpdCBo ZXJlIG9uIHRoZSBsaXN0LjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JIHdvdWxkIGxpa2Ug dG8gcHJvcG9zZSBhIGJhci1Cb0YgaW4gUHJhZ3VlIGZvciBWb1QgZm9yIGFueW9uZSB3aG8gd291 bGQgbGlrZSB0byBkaXNjdXNzIHRoaXMuIElmIHlvdeKAmXJlIGludGVyZXN0ZWQgKGFuZCB3aWxs IGJlIHRoZXJlIGluIHBlcnNvbiksIGxldCBtZSBrbm93ITxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj4mbmJzcDvigJQgSnVzdGluPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9k aXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2Em cXVvdDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90OyI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9w Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPGJsb2NrcXVvdGUgc3R5 bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdDtvcnBoYW5zOiBhdXRvO3Rl eHQtYWxpZ246c3RhcnQ7d2lkb3dzOiBhdXRvOy13ZWJraXQtdGV4dC1zdHJva2Utd2lkdGg6IDBw eDt3b3JkLXNwYWNpbmc6MHB4Ij4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90Oywm cXVvdDtzYW5zLXNlcmlmJnF1b3Q7Ij5fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fXzxicj4NCnZvdCBtYWlsaW5nIGxpc3Q8YnI+DQo8YSBocmVmPSJtYWlsdG86 dm90QGlldGYub3JnIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj52b3RAaWV0Zi5vcmc8L3Nw YW4+PC9hPjxicj4NCjxhIGhyZWY9Imh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGlu Zm8vdm90Ij48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5odHRwczovL3d3dy5pZXRmLm9yZy9t YWlsbWFuL2xpc3RpbmZvL3ZvdDwvc3Bhbj48L2E+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9k aXY+DQo8L2Jsb2NrcXVvdGU+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OywmcXVvdDtzYW5z LXNlcmlmJnF1b3Q7Ij5fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fXzxicj4NCnZvdCBtYWlsaW5nIGxpc3Q8YnI+DQo8L3NwYW4+PGEgaHJlZj0ibWFpbHRvOnZv dEBpZXRmLm9yZyI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVv dDtIZWx2ZXRpY2EmcXVvdDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90Oztjb2xvcjpwdXJwbGUiPnZv dEBpZXRmLm9yZzwvc3Bhbj48L2E+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZh bWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90OyI+PGJyPg0K PC9zcGFuPjxhIGhyZWY9Imh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vdm90 Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGlj YSZxdW90OywmcXVvdDtzYW5zLXNlcmlmJnF1b3Q7O2NvbG9yOnB1cnBsZSI+aHR0cHM6Ly93d3cu aWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby92b3Q8L3NwYW4+PC9hPjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ib2R5Pg0KPC9odG1s Pg0K --_000_147EE18440E5AF44834B220ED35BA530014AB25FFCWLGPRDMBX02di_-- From nobody Tue Jun 30 16:58:28 2015 Return-Path: X-Original-To: vot@ietfa.amsl.com Delivered-To: vot@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8A9351B2B93 for ; Tue, 30 Jun 2015 16:58:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.21 X-Spam-Level: X-Spam-Status: No, score=-4.21 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jizSAaO9Sb9f for ; Tue, 30 Jun 2015 16:58:23 -0700 (PDT) Received: from smtp02.ees.hhs.gov (smtp.ees.hhs.gov [158.72.139.19]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E80981B2A81 for ; Tue, 30 Jun 2015 16:58:22 -0700 (PDT) X-IronPort-AV: E=Sophos;i="5.15,381,1432612800"; d="scan'208,217";a="413102245" Received: from unknown (HELO webmail.hhs.gov) ([158.72.139.33]) by smtp02.ees.hhs.gov with ESMTP/TLS/AES128-SHA; 30 Jun 2015 19:58:21 -0400 Received: from PL-EMSMB12.ees.hhs.gov ([158.72.137.102]) by PL-EMSCAS12.ees.hhs.gov ([158.72.137.92]) with mapi id 14.03.0224.002; Tue, 30 Jun 2015 19:58:20 -0400 From: "Bucci, Debbie (OS/ONC)" To: Colin Wallis Thread-Topic: [VoT] Clause 7 edgy on scope? (RE: Vectors of Trust I-D) Thread-Index: AdCywAdxGV06rU/8R4OLexR95fMGDAAMA90AAAGh1QAAFOvGAAATZHkAAAMURQA= Date: Tue, 30 Jun 2015 23:58:19 +0000 Message-ID: References: <147EE18440E5AF44834B220ED35BA530014AB1AEC1@WLGPRDMBX02.dia.govt.nz> <69B21050-7E52-4B85-8081-8DE210DE432A@nist.gov> <675F1A61-4881-4365-8138-8517B2047B91@smartspecies.com> <147EE18440E5AF44834B220ED35BA530014AB25FFC@WLGPRDMBX02.dia.govt.nz> In-Reply-To: <147EE18440E5AF44834B220ED35BA530014AB25FFC@WLGPRDMBX02.dia.govt.nz> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: Content-Type: multipart/alternative; boundary="_000_A549FC9D1DEA4500849B0235BBA00CEAhhsgov_" MIME-Version: 1.0 Archived-At: Cc: "Grassi, Paul A." , Justin Richer , "vot@ietf.org" , Mark Lizar Subject: Re: [VoT] Clause 7 edgy on scope? (RE: Vectors of Trust I-D) X-BeenThere: vot@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Vectors of Trust discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 30 Jun 2015 23:58:26 -0000 --_000_A549FC9D1DEA4500849B0235BBA00CEAhhsgov_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SW4gcmU6IHRydXN0bWFya3MsICBJIHdvdWxkIHN1Z2dlc3QgdGhlcmUgYXJlIGV4ZW1wbGFycyBv dXQgdGhlcmUgdG9kYXkuICBWT1Qgc2hvdWxkIHN0YW5kYXJkaXplcyB0aGUgY29udGFpbmVyIGFu ZCBsZXQgb3RoZXJzIGR1a2Ugb3V0IHRoZSBjb250ZW50IGlzc3VlLg0KDQpTZW50IGZyb20gbXkg aVBob25lDQoNCk9uIEp1biAzMCwgMjAxNSwgYXQgNDo1MCBQTSwgQ29saW4gV2FsbGlzIDxDb2xp bi5XYWxsaXNAZGlhLmdvdnQubno8bWFpbHRvOkNvbGluLldhbGxpc0BkaWEuZ292dC5uej4+IHdy b3RlOg0KDQpUaGFua3MgZm9yIHRob3NlIGNvbW1lbnRzIG9uIENsYXVzZSA3Lg0KSXQgc2VlbXMg bGlrZSB0aGUgY2hhbGxlbmdlIGlzIHRvIGZpbmQgdGhhdCBzd2VldCBzcG90L2ZpbmUgbGluZSB0 aGF0IGdpdmVzIHRoZSByZWFkZXIgZW5vdWdoIGluZm8gb24gaG93IHRvIGRvIHRoZSBjcm9zcyBk b21haW4gc3Vic2NyaXB0aW9uL3ZhbGlkYXRpb24sIHdpdGhvdXQgaGF2aW5nIHRoZSB0aGlzIHdo b2xlIGRyYWZ0IHN0YW5kYXJkaXppbmcgdHJ1c3QgZnJhbWV3b3JrcyBhbmQgdHJ1c3RtYXJrcy4N CkJlY2F1c2UgdGhhdCBpcyBhIHdob2xlIGxvdCBtb3JlIHdvcmsgYW5kIHRha2VzIHRoZSBmb2N1 cyBhd2F5IGZyb20gdGhlIG9yaWdpbmFsIGludGVudCAod2hpY2ggd2FzIG15IGNvbmNlcm4gYW5k IGhlbmNlIHRoZSBpZGVhIG9mIG1ha2luZyB0aGlzIHBhcnQgaW5mb3JtYXRpdmUgdW50aWwgc3Vj aCB0aW1lIGFzIHdlIGhhdmUgYSBzdXBwb3J0ZWQgdHJ1c3RtYXJrIGFuZCB0cnVzdCBmcmFtZXdv cmsgc3RhbmRhcmQgdG8gcmV2ZXJzZSB0aGUgY3Jvc3MgZG9tYWluIHRoaW5ncyBiYWNrIGludG8p Lg0KDQpDaGVlcnMNCkNvbGluDQoNCg0KRnJvbTogTWFyayBMaXphciBbbWFpbHRvOm1hcmtAc21h cnRzcGVjaWVzLmNvbV0NClNlbnQ6IFR1ZXNkYXksIDMwIEp1bmUgMjAxNSAxMTozNSBwLm0uDQpU bzogR3Jhc3NpLCBQYXVsIEEuDQpDYzogSnVzdGluIFJpY2hlcjsgQ29saW4gV2FsbGlzOyB2b3RA aWV0Zi5vcmc8bWFpbHRvOnZvdEBpZXRmLm9yZz4NClN1YmplY3Q6IFJlOiBbVm9UXSBDbGF1c2Ug NyBlZGd5IG9uIHNjb3BlPyAoUkU6IFZlY3RvcnMgb2YgVHJ1c3QgSS1EKQ0KDQpuaWNlIGFuZCBj cmlzcC4NCg0KSSBjYW4gcmVhbGx5IHN0YXJ0IHRvIGltYWdpbmUgaG93IGRpc2NvdmVyeSBhbmQg dHJ1c3QgbWFya3MgY2FuIGJlIHVzZWQgdG8gc2NhbGUgdHJ1c3QuIEFsdGhvdWdoIHRoZXJlIGlz IHNvbWUgYWRkaXRpb25hbCBpc3N1ZXMgYXJvdW5kIHRoZSBvdmVyYXJjaGluZyB0cnVzdCBmcmFt ZXdvcmsgKHdoYXRldmVyIHRoYXQgaXMsIEkgYW0gYXNzdW1pbmcgbGF3KS4gRm9yIGV4YW1wbGUg YXNzZXNzaW5nIHRydXN0IG1hcmtzIHNvIHRoYXQgdGhleSBhcmUgYXBwcm9wcmlhdGUgZm9yIHRo ZSBwdXJwb3NlIGFuZCBhbHNvIGZvciBhcHBsaWNhdGlvbiBpbiB0aGUgZnJhbWV3b3JrLCB3aXRo IGEgcm9idXN0IG1ldGhvZCBmb3IgYXNzZXNzaW5nIGFuZCBhc3NlcnRpbmcgaW50ZWdyaXR5IG9m IHRydXN0IG1hcmtzLiAgSW4gdGhpcyBjb250ZXh0IHRoZW4gSSB0aGluayBpdCB3b3VsZCBiZSBj bGVhciBob3cgdGhlIHRydXN0IG1hcmtzIGZpdCB3aXRoIFZPVC4gIEl0cyB0aGUgZ2FwIGJldHdl ZW4gdGhlc2UgZWxlbWVudHMgSSBzdXNwZWN0IHRoYXQgbmVlZHMgdG8gYmUgZnVydGhlciBhcnRp Y3VsYXRlZCBhbmQgdW5kZXJzdG9vZC4NCg0KbmljZWx5IHRob3VnaHQgcHJvdm9raW5nICAgLi4N Cg0KT24gMzAgSnVuIDIwMTUsIGF0IDAyOjM1LCBHcmFzc2ksIFBhdWwgQS4gPHBhdWwuZ3Jhc3Np QG5pc3QuZ292PG1haWx0bzpwYXVsLmdyYXNzaUBuaXN0Lmdvdj4+IHdyb3RlOg0KDQpJIHBlcnNv bmFsbHkgbGlrZSB0aGUgaWRlYSBvZiBkaXNjb3ZlcmFiaWxpdHkgYXQgdGhlIG9uc2V0LCBhbmQg dGhlIGRpc2N1c3Npb24gdGhhdCB3aWxsIGZvbGxvdy4NCg0KVGhpcyB3YXMgZ3JlYXQgdG8gcmVh ZCwgdGhhbmtzIHRvIHlvdSBhbmQgTGVpZiBmb3IgdGhlIHdvcmshDQoNCk9uIEp1biAyOSwgMjAx NSwgYXQgODo0OSBQTSwgIkp1c3RpbiBSaWNoZXIiIDxqcmljaGVyQG1pdC5lZHU8bWFpbHRvOmpy aWNoZXJAbWl0LmVkdT4+IHdyb3RlOg0KQ29saW4sIHRoYXTigJlzIGEgZ3JlYXQgcXVlc3Rpb24s IGJlY2F1c2UgSeKAmW0gaG9uZXN0bHkgbm90IHN1cmUgd2hhdCB0aGUgYW5zd2VyIGlzIHlldC4g SSB0aGluayB0aGF0IHRoZSB2ZWN0b3JzIG9ubHkgbWFrZSBzZW5zZSBpbiB0aGUgY29udGV4dCBv ZiBzb21lIGtpbmQgb2YgdHJ1c3QgZnJhbWV3b3JrIHNldHVwLCBidXQgdGhhdCBzb21ldGltZXMg dGhvc2UgcG9saWNpZXMgd2lsbCBiZSBoYXJkLWNvZGVkIGF0IGNvbmZpZ3VyYXRpb24gdGltZSBh bmQgd29u4oCZdCBuZWVkIHRvIGJlIGR5bmFtaWNhbGx5IGJvdW5kIG9yIGRpc2NvdmVyZWQuIFRo YXQgc2FpZCwgSSB0aGluayB0aGUgcmVhbCB2YWx1ZSBvZiB0aGlzIGlzIGdvaW5nIHRvIGJlIGNy b3NzLWRvbWFpbiB3aGVyZSBhbiBSUCBjb3VsZCBzdWJzY3JpYmUgdG8gKGFuZCB1bmRlcnN0YW5k KSBtdWx0aXBsZSB0cnVzdCBtYXJrcyBhbmQgYmUgYWJsZSB0byB2YWxpZGF0ZSB0aGVtIGF0IHJ1 bnRpbWUuIFN0aWxsLCB0aGF0IHBpZWNlIG1pZ2h0IGJlIHNlcGFyYWJsZSBlbm91Z2gsIGFuZCBw ZXJoYXBzIHN1YnN0YW50aXZlIGVub3VnaCwgdG8gYmUgaXRzIG93biBkcmFmdC4NCg0KVGhhdCBz YWlkLCBJIGZpZ3VyZWQgSeKAmWQgd3JpdGUgaXQgZG93biBkb3duIGFuZCBmaWd1cmUgb3V0IHdo ZXJlIGl04oCZcyBhY3R1YWxseSBzdXBwb3NlZCB0byBnbyBsYXRlci4gOikNCg0KIOKAlCBKdXN0 aW4NCg0KT24gSnVuIDI5LCAyMDE1LCBhdCA3OjE0IFBNLCBDb2xpbiBXYWxsaXMgPENvbGluLldh bGxpc0BkaWEuZ292dC5uejxtYWlsdG86Q29saW4uV2FsbGlzQGRpYS5nb3Z0Lm56Pj4gd3JvdGU6 DQoNCk1hbnkgdGhhbmtzIEp1c3RpbiBhbmQgTGVpZg0KDQpJ4oCZdmUgZG9uZSBhIGZpcnN0IHBh c3MvbGlnaHQgcmVhZCwgYW5kIGZyb20gdGhhdCwgSSB0aGluayBpdCBpcyBhIHRlcnJpZmljIGZp cnN0IGN1dCB0aGF0IGdldHMgdXMgb24gdGhlIHBhdGggdG8gbm9ybWFsaXppbmcgdGhlIGRpc2N1 c3Npb25zIG92ZXIgdGhlIHBhc3QgOSBtb250aHMuDQoNCkFzaWRlIGZyb20gYSBmZXcgdGlkeSB1 cHMsIEkganVzdCBoYXZlIHRoaXMgc2xpZ2h0IGNvbmNlcm4gd2hldGhlciBhbGwgb2YgQ2xhdXNl IDcgKERpc2NvdmVyeSBhbmQgVmVyaWZpY2F0aW9uKSBpcyBpbiBzY29wZSBmb3Igbm9ybWF0aXZl IHRleHQ/DQpJIGNlcnRhaW5seSBhcHByZWNpYXRlIHRoYXQgaW4gbW9zdCBpbXBsZW1lbnRhdGlv bnMgYW5kIGRlcGxveW1lbnRzLCB0aGVyZSB3b3VsZCBiZSBhIGRlcGVuZGVuY3kgb24gYW4gb3Bl cmF0aW9uYWwgdHJ1c3QgZnJhbWV3b3JrIGFuZCB0cnVzdG1hcmsuDQpCdXQgaXMgaXQgdG9vIGJp ZyBhIHN0cmV0Y2ggdG8gbWFrZSB0aGF0IG5vcm1hdGl2ZSBmb3IgdGhpcyB3b3JrPw0KSnVzdCBh IHRob3VnaHQuLiBhbmQgbW9yZSB0aGFuIGhhcHB5IHRvIGJlIHByb3ZlbiB3cm9uZy4uIOKYui4N Cg0KQ2hlZXJzDQpDb2xpbg0KDQoNCkZyb206IHZvdCBbbWFpbHRvOnZvdC1ib3VuY2VzQGlldGYu b3JnXSBPbiBCZWhhbGYgT2YgSnVzdGluIFJpY2hlcg0KU2VudDogU2F0dXJkYXksIDI3IEp1bmUg MjAxNSAzOjE1IHAubS4NClRvOiB2b3RAaWV0Zi5vcmc8bWFpbHRvOnZvdEBpZXRmLm9yZz4NClN1 YmplY3Q6IFtWb1RdIFZlY3RvcnMgb2YgVHJ1c3QgSS1EDQoNCkhpIEV2ZXJ5b25lLA0KDQpJIGhh dmUgdGFrZW4gdGhlIGluaXRpYWwgc3RyYXdtYW4gcHJvcG9zYWwgYWxvbmcgd2l0aCBhIHN1YnN0 YW50aWFsIG51bWJlciBvZiBlZGl0cyBhbmQgaW5wdXRzIGZyb20gc2V2ZXJhbCBmb2xrcyBhbmQg aGF2ZSBjcmVhdGVkIGFuIGluaXRpYWwgSS1EIG9mIHRoZSBkb2N1bWVudDoNCg0KaHR0cHM6Ly90 b29scy5pZXRmLm9yZy9pZC9kcmFmdC1yaWNoZXItdmVjdG9ycy1vZi10cnVzdC0wMA0KDQpJdOKA mXMgc3RpbGwgYSB2ZXJ5IGRyYWZ0eSBkcmFmdCwgYnV0IGhvcGVmdWxseSBpdOKAmXMgc3RhcnRp bmcgdG8gbWFrZSB0aGlzIGEgY29uY3JldGUgdGhpbmcuIFBsZWFzZSByZWFkIGl0IG92ZXIgYW5k IGRpc2N1c3MgaXQgaGVyZSBvbiB0aGUgbGlzdC4NCg0KSSB3b3VsZCBsaWtlIHRvIHByb3Bvc2Ug YSBiYXItQm9GIGluIFByYWd1ZSBmb3IgVm9UIGZvciBhbnlvbmUgd2hvIHdvdWxkIGxpa2UgdG8g ZGlzY3VzcyB0aGlzLiBJZiB5b3XigJlyZSBpbnRlcmVzdGVkIChhbmQgd2lsbCBiZSB0aGVyZSBp biBwZXJzb24pLCBsZXQgbWUga25vdyENCg0KIOKAlCBKdXN0aW4NCg0KX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCnZvdCBtYWlsaW5nIGxpc3QNCnZvdEBp ZXRmLm9yZzxtYWlsdG86dm90QGlldGYub3JnPg0KaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1h bi9saXN0aW5mby92b3QNCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fDQp2b3QgbWFpbGluZyBsaXN0DQp2b3RAaWV0Zi5vcmc8bWFpbHRvOnZvdEBpZXRmLm9y Zz4NCmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vdm90DQoNCl9fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQp2b3QgbWFpbGluZyBsaXN0 DQp2b3RAaWV0Zi5vcmc8bWFpbHRvOnZvdEBpZXRmLm9yZz4NCmh0dHBzOi8vd3d3LmlldGYub3Jn L21haWxtYW4vbGlzdGluZm8vdm90DQo= --_000_A549FC9D1DEA4500849B0235BBA00CEAhhsgov_ Content-Type: text/html; charset="utf-8" Content-ID: <49A09B6EB96EC244B91CAA0C4C1FBB63@HHSGOV.mail.onmicrosoft.com> Content-Transfer-Encoding: base64 PGh0bWw+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIgY29udGVudD0i dGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjwvaGVhZD4NCjxib2R5IGRpcj0iYXV0byI+DQo8 ZGl2PkluIHJlOiB0cnVzdG1hcmtzLCAmbmJzcDtJIHdvdWxkIHN1Z2dlc3QgdGhlcmUgYXJlIGV4 ZW1wbGFycyBvdXQgdGhlcmUgdG9kYXkuICZuYnNwO1ZPVCBzaG91bGQgc3RhbmRhcmRpemVzIHRo ZSBjb250YWluZXIgYW5kIGxldCBvdGhlcnMgZHVrZSBvdXQgdGhlIGNvbnRlbnQgaXNzdWUuPGJy Pg0KPGJyPg0KU2VudCBmcm9tIG15IGlQaG9uZTwvZGl2Pg0KPGRpdj48YnI+DQpPbiBKdW4gMzAs IDIwMTUsIGF0IDQ6NTAgUE0sIENvbGluIFdhbGxpcyAmbHQ7PGEgaHJlZj0ibWFpbHRvOkNvbGlu LldhbGxpc0BkaWEuZ292dC5ueiI+Q29saW4uV2FsbGlzQGRpYS5nb3Z0Lm56PC9hPiZndDsgd3Jv dGU6PGJyPg0KPGJyPg0KPC9kaXY+DQo8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj4NCjxkaXY+DQo8 bWV0YSBuYW1lPSJHZW5lcmF0b3IiIGNvbnRlbnQ9Ik1pY3Jvc29mdCBXb3JkIDE0IChmaWx0ZXJl ZCBtZWRpdW0pIj4NCjxzdHlsZT48IS0tDQovKiBGb250IERlZmluaXRpb25zICovDQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkhlbHZldGljYTsNCglwYW5vc2UtMToyIDExIDYgNCAyIDIgMiAy IDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OldpbmdkaW5nczsNCglwYW5vc2UtMTo1 IDAgMCAwIDAgMCAwIDAgMCAwO30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6V2luZ2Rpbmdz Ow0KCXBhbm9zZS0xOjUgMCAwIDAgMCAwIDAgMCAwIDA7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZh bWlseTpDYWxpYnJpOw0KCXBhbm9zZS0xOjIgMTUgNSAyIDIgMiA0IDMgMiA0O30NCkBmb250LWZh Y2UNCgl7Zm9udC1mYW1pbHk6VGFob21hOw0KCXBhbm9zZS0xOjIgMTEgNiA0IDMgNSA0IDQgMiA0 O30NCi8qIFN0eWxlIERlZmluaXRpb25zICovDQpwLk1zb05vcm1hbCwgbGkuTXNvTm9ybWFsLCBk aXYuTXNvTm9ybWFsDQoJe21hcmdpbjowY207DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZv bnQtc2l6ZToxMi4wcHQ7DQoJZm9udC1mYW1pbHk6IlRpbWVzIE5ldyBSb21hbiIsInNlcmlmIjt9 DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCglj b2xvcjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFu Lk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpw dXJwbGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLk1zb0FjZXRhdGUsIGxpLk1z b0FjZXRhdGUsIGRpdi5Nc29BY2V0YXRlDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgltc28t c3R5bGUtbGluazoiQmFsbG9vbiBUZXh0IENoYXIiOw0KCW1hcmdpbjowY207DQoJbWFyZ2luLWJv dHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6ZTo4LjBwdDsNCglmb250LWZhbWlseToiVGFob21hIiwi c2Fucy1zZXJpZiI7fQ0Kc3Bhbi5hcHBsZS1jb252ZXJ0ZWQtc3BhY2UNCgl7bXNvLXN0eWxlLW5h bWU6YXBwbGUtY29udmVydGVkLXNwYWNlO30NCnNwYW4uQmFsbG9vblRleHRDaGFyDQoJe21zby1z dHlsZS1uYW1lOiJCYWxsb29uIFRleHQgQ2hhciI7DQoJbXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0K CW1zby1zdHlsZS1saW5rOiJCYWxsb29uIFRleHQiOw0KCWZvbnQtZmFtaWx5OiJUYWhvbWEiLCJz YW5zLXNlcmlmIjt9DQpzcGFuLkVtYWlsU3R5bGUyMA0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25h bC1yZXBseTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsInNhbnMtc2VyaWYiOw0KCWNvbG9yOiMx RjQ5N0Q7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJ Zm9udC1zaXplOjEwLjBwdDt9DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo2MTIuMHB0IDc5 Mi4wcHQ7DQoJbWFyZ2luOjcyLjBwdCA3Mi4wcHQgNzIuMHB0IDcyLjBwdDt9DQpkaXYuV29yZFNl Y3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi0tPjwvc3R5bGU+PCEtLVtpZiBndGUgbXNv IDldPjx4bWw+DQo8bzpzaGFwZWRlZmF1bHRzIHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2IiAv Pg0KPC94bWw+PCFbZW5kaWZdLS0+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWxh eW91dCB2OmV4dD0iZWRpdCI+DQo8bzppZG1hcCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4NCjwv bzpzaGFwZWxheW91dD48L3htbD48IVtlbmRpZl0tLT4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9u MSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LCZxdW90O3NhbnMtc2VyaWYmcXVvdDs7Y29s b3I6IzFGNDk3RCI+VGhhbmtzIGZvciB0aG9zZSBjb21tZW50cyBvbiBDbGF1c2UgNy48bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LCZxdW90O3NhbnMtc2Vy aWYmcXVvdDs7Y29sb3I6IzFGNDk3RCI+SXQgc2VlbXMgbGlrZSB0aGUgY2hhbGxlbmdlIGlzIHRv IGZpbmQgdGhhdCBzd2VldCBzcG90L2ZpbmUgbGluZSB0aGF0IGdpdmVzIHRoZSByZWFkZXIgZW5v dWdoIGluZm8gb24gaG93IHRvIGRvIHRoZSBjcm9zcyBkb21haW4gc3Vic2NyaXB0aW9uL3ZhbGlk YXRpb24sIHdpdGhvdXQNCiBoYXZpbmcgdGhlIHRoaXMgd2hvbGUgZHJhZnQgc3RhbmRhcmRpemlu ZyB0cnVzdCBmcmFtZXdvcmtzIGFuZCB0cnVzdG1hcmtzLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90Oztjb2xvcjoj MUY0OTdEIj5CZWNhdXNlIHRoYXQgaXMgYSB3aG9sZSBsb3QgbW9yZSB3b3JrIGFuZCB0YWtlcyB0 aGUgZm9jdXMgYXdheSBmcm9tIHRoZSBvcmlnaW5hbCBpbnRlbnQgKHdoaWNoIHdhcyBteSBjb25j ZXJuIGFuZCBoZW5jZSB0aGUgaWRlYSBvZiBtYWtpbmcgdGhpcyBwYXJ0IGluZm9ybWF0aXZlDQog dW50aWwgc3VjaCB0aW1lIGFzIHdlIGhhdmUgYSBzdXBwb3J0ZWQgdHJ1c3RtYXJrIGFuZCB0cnVz dCBmcmFtZXdvcmsgc3RhbmRhcmQgdG8gcmV2ZXJzZSB0aGUgY3Jvc3MgZG9tYWluIHRoaW5ncyBi YWNrIGludG8pLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90Oztjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LCZxdW90O3NhbnMtc2VyaWYm cXVvdDs7Y29sb3I6IzFGNDk3RCI+Q2hlZXJzPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q2FsaWJyaSZxdW90OywmcXVvdDtzYW5zLXNlcmlmJnF1b3Q7O2NvbG9yOiMxRjQ5N0Qi PkNvbGluPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90Oywm cXVvdDtzYW5zLXNlcmlmJnF1b3Q7O2NvbG9yOiMxRjQ5N0QiPiZuYnNwOzxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90 Oztjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2Pg0KPGRp diBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjQjVDNERGIDEuMHB0O3BhZGRp bmc6My4wcHQgMGNtIDBjbSAwY20iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4gbGFu Zz0iRU4tVVMiIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1RhaG9t YSZxdW90OywmcXVvdDtzYW5zLXNlcmlmJnF1b3Q7Ij5Gcm9tOjwvc3Bhbj48L2I+PHNwYW4gbGFu Zz0iRU4tVVMiIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1RhaG9t YSZxdW90OywmcXVvdDtzYW5zLXNlcmlmJnF1b3Q7Ij4gTWFyayBMaXphciBbPGEgaHJlZj0ibWFp bHRvOm1hcmtAc21hcnRzcGVjaWVzLmNvbSI+bWFpbHRvOm1hcmtAc21hcnRzcGVjaWVzLmNvbTwv YT5dDQo8YnI+DQo8Yj5TZW50OjwvYj4gVHVlc2RheSwgMzAgSnVuZSAyMDE1IDExOjM1IHAubS48 YnI+DQo8Yj5Ubzo8L2I+IEdyYXNzaSwgUGF1bCBBLjxicj4NCjxiPkNjOjwvYj4gSnVzdGluIFJp Y2hlcjsgQ29saW4gV2FsbGlzOyA8YSBocmVmPSJtYWlsdG86dm90QGlldGYub3JnIj52b3RAaWV0 Zi5vcmc8L2E+PGJyPg0KPGI+U3ViamVjdDo8L2I+IFJlOiBbVm9UXSBDbGF1c2UgNyBlZGd5IG9u IHNjb3BlPyAoUkU6IFZlY3RvcnMgb2YgVHJ1c3QgSS1EKTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPm5pY2UgYW5kIGNyaXNwLiZuYnNwOzxvOnA+PC9vOnA+ PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SSBjYW4gcmVhbGx5IHN0YXJ0IHRv IGltYWdpbmUgaG93IGRpc2NvdmVyeSBhbmQgdHJ1c3QgbWFya3MgY2FuIGJlIHVzZWQgdG8gc2Nh bGUgdHJ1c3QuIEFsdGhvdWdoIHRoZXJlIGlzIHNvbWUgYWRkaXRpb25hbCBpc3N1ZXMgYXJvdW5k IHRoZSBvdmVyYXJjaGluZyB0cnVzdCBmcmFtZXdvcmsgKHdoYXRldmVyIHRoYXQgaXMsIEkgYW0g YXNzdW1pbmcgbGF3KS4gRm9yIGV4YW1wbGUgYXNzZXNzaW5nIHRydXN0IG1hcmtzDQogc28gdGhh dCB0aGV5IGFyZSBhcHByb3ByaWF0ZSBmb3IgdGhlIHB1cnBvc2UgYW5kIGFsc28gZm9yIGFwcGxp Y2F0aW9uIGluIHRoZSBmcmFtZXdvcmssIHdpdGggYSByb2J1c3QgbWV0aG9kIGZvciBhc3Nlc3Np bmcgYW5kIGFzc2VydGluZyBpbnRlZ3JpdHkgb2YgdHJ1c3QgbWFya3MuICZuYnNwO0luIHRoaXMg Y29udGV4dCB0aGVuIEkgdGhpbmsgaXQgd291bGQgYmUgY2xlYXIgaG93IHRoZSB0cnVzdCBtYXJr cyBmaXQgd2l0aCBWT1QuICZuYnNwO0l0cyB0aGUgZ2FwDQogYmV0d2VlbiB0aGVzZSBlbGVtZW50 cyBJIHN1c3BlY3QgdGhhdCBuZWVkcyB0byBiZSBmdXJ0aGVyIGFydGljdWxhdGVkIGFuZCB1bmRl cnN0b29kLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj5uaWNlbHkgdGhvdWdodCBwcm92b2tpbmcgJm5ic3A7IC4uJm5ic3A7PG86cD48L286cD48 L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8 ZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1 LjBwdCI+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+T24gMzAgSnVuIDIwMTUsIGF0IDAy OjM1LCBHcmFzc2ksIFBhdWwgQS4gJmx0OzxhIGhyZWY9Im1haWx0bzpwYXVsLmdyYXNzaUBuaXN0 LmdvdiI+cGF1bC5ncmFzc2lAbmlzdC5nb3Y8L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LCZxdW90O3NhbnMtc2VyaWYmcXVv dDsiPkkgcGVyc29uYWxseSBsaWtlIHRoZSBpZGVhIG9mIGRpc2NvdmVyYWJpbGl0eSBhdCB0aGUg b25zZXQsIGFuZCB0aGUgZGlzY3Vzc2lvbiB0aGF0IHdpbGwgZm9sbG93LjxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LCZxdW90 O3NhbnMtc2VyaWYmcXVvdDsiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LCZxdW90O3NhbnMtc2VyaWYmcXVvdDsi PlRoaXMgd2FzIGdyZWF0IHRvIHJlYWQsIHRoYW5rcyB0byB5b3UgYW5kIExlaWYgZm9yIHRoZSB3 b3JrITxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtYXJnaW4tYm90dG9tOjEyLjBwdCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssJnF1b3Q7c2Fucy1zZXJp ZiZxdW90OyI+PGJyPg0KT24gSnVuIDI5LCAyMDE1LCBhdCA4OjQ5IFBNLCAmcXVvdDtKdXN0aW4g UmljaGVyJnF1b3Q7ICZsdDs8YSBocmVmPSJtYWlsdG86anJpY2hlckBtaXQuZWR1Ij48c3BhbiBz dHlsZT0iY29sb3I6cHVycGxlIj5qcmljaGVyQG1pdC5lZHU8L3NwYW4+PC9hPiZndDsgd3JvdGU6 PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2lu LXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0O29ycGhhbnM6IGF1dG87dGV4dC1hbGlnbjpz dGFydDt3aWRvd3M6IGF1dG87LXdlYmtpdC10ZXh0LXN0cm9rZS13aWR0aDogMHB4O3dvcmQtc3Bh Y2luZzowcHgiPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LCZxdW90O3NhbnMt c2VyaWYmcXVvdDsiPkNvbGluLCB0aGF04oCZcyBhIGdyZWF0IHF1ZXN0aW9uLCBiZWNhdXNlIEni gJltIGhvbmVzdGx5IG5vdCBzdXJlIHdoYXQgdGhlIGFuc3dlciBpcyB5ZXQuIEkgdGhpbmsgdGhh dCB0aGUgdmVjdG9ycyBvbmx5IG1ha2Ugc2Vuc2UgaW4gdGhlIGNvbnRleHQgb2Ygc29tZSBraW5k IG9mIHRydXN0IGZyYW1ld29yaw0KIHNldHVwLCBidXQgdGhhdCBzb21ldGltZXMgdGhvc2UgcG9s aWNpZXMgd2lsbCBiZSBoYXJkLWNvZGVkIGF0IGNvbmZpZ3VyYXRpb24gdGltZSBhbmQgd29u4oCZ dCBuZWVkIHRvIGJlIGR5bmFtaWNhbGx5IGJvdW5kIG9yIGRpc2NvdmVyZWQuIFRoYXQgc2FpZCwg SSB0aGluayB0aGUgcmVhbCB2YWx1ZSBvZiB0aGlzIGlzIGdvaW5nIHRvIGJlIGNyb3NzLWRvbWFp biB3aGVyZSBhbiBSUCBjb3VsZCBzdWJzY3JpYmUgdG8gKGFuZCB1bmRlcnN0YW5kKSBtdWx0aXBs ZQ0KIHRydXN0IG1hcmtzIGFuZCBiZSBhYmxlIHRvIHZhbGlkYXRlIHRoZW0gYXQgcnVudGltZS4g U3RpbGwsIHRoYXQgcGllY2UgbWlnaHQgYmUgc2VwYXJhYmxlIGVub3VnaCwgYW5kIHBlcmhhcHMg c3Vic3RhbnRpdmUgZW5vdWdoLCB0byBiZSBpdHMgb3duIGRyYWZ0LiZuYnNwOzxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OywmcXVvdDtzYW5z LXNlcmlmJnF1b3Q7Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OywmcXVvdDtzYW5zLXNlcmlmJnF1b3Q7Ij5UaGF0 IHNhaWQsIEkgZmlndXJlZCBJ4oCZZCB3cml0ZSBpdCBkb3duIGRvd24gYW5kIGZpZ3VyZSBvdXQg d2hlcmUgaXTigJlzIGFjdHVhbGx5IHN1cHBvc2VkIHRvIGdvIGxhdGVyLiA6KTxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LCZx dW90O3NhbnMtc2VyaWYmcXVvdDsiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LCZxdW90O3NhbnMtc2VyaWYmcXVv dDsiPiZuYnNwO+KAlCBKdXN0aW48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTom cXVvdDtIZWx2ZXRpY2EmcXVvdDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90OyI+PG86cD4mbmJzcDs8 L286cD48L3NwYW4+PC9wPg0KPGRpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUu MHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1 b3Q7LCZxdW90O3NhbnMtc2VyaWYmcXVvdDsiPk9uIEp1biAyOSwgMjAxNSwgYXQgNzoxNCBQTSwg Q29saW4gV2FsbGlzICZsdDs8YSBocmVmPSJtYWlsdG86Q29saW4uV2FsbGlzQGRpYS5nb3Z0Lm56 Ij48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5Db2xpbi5XYWxsaXNAZGlhLmdvdnQubno8L3Nw YW4+PC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0hlbHZldGljYSZxdW90OywmcXVvdDtzYW5zLXNlcmlmJnF1b3Q7Ij48bzpwPiZuYnNwOzwv bzpwPjwvc3Bhbj48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LCZxdW90O3NhbnMtc2VyaWYmcXVvdDs7Y29sb3I6IzFGNDk3RCI+TWFueSB0aGFua3Mg SnVzdGluIGFuZCBMZWlmPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDYWxpYnJpJnF1b3Q7LCZxdW90O3NhbnMtc2VyaWYmcXVvdDs7Y29sb3I6IzFGNDk3RCI+Jm5i c3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90Oztjb2xvcjojMUY0OTdEIj5J4oCZdmUgZG9uZSBhIGZp cnN0IHBhc3MvbGlnaHQgcmVhZCwgYW5kIGZyb20gdGhhdCwgSSB0aGluayBpdCBpcyBhIHRlcnJp ZmljIGZpcnN0IGN1dCB0aGF0IGdldHMgdXMgb24gdGhlIHBhdGggdG8gbm9ybWFsaXppbmcgdGhl IGRpc2N1c3Npb25zIG92ZXIgdGhlIHBhc3QgOQ0KIG1vbnRocy48c3BhbiBjbGFzcz0iYXBwbGUt Y29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LCZxdW90O3NhbnMtc2VyaWYmcXVvdDs7Y29s b3I6IzFGNDk3RCI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90Oztjb2xvcjojMUY0OTdEIj5B c2lkZSBmcm9tIGEgZmV3IHRpZHkgdXBzLCBJIGp1c3QgaGF2ZSB0aGlzIHNsaWdodCBjb25jZXJu IHdoZXRoZXIgYWxsIG9mIENsYXVzZSA3IChEaXNjb3ZlcnkgYW5kIFZlcmlmaWNhdGlvbikgaXMg aW4gc2NvcGUgZm9yIG5vcm1hdGl2ZSB0ZXh0Pzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90 Oztjb2xvcjojMUY0OTdEIj5JIGNlcnRhaW5seSBhcHByZWNpYXRlIHRoYXQgaW4gbW9zdCBpbXBs ZW1lbnRhdGlvbnMgYW5kIGRlcGxveW1lbnRzLCB0aGVyZSB3b3VsZCBiZSBhIGRlcGVuZGVuY3kg b24gYW4gb3BlcmF0aW9uYWwgdHJ1c3QgZnJhbWV3b3JrIGFuZCB0cnVzdG1hcmsuPC9zcGFuPjxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90Oywm cXVvdDtzYW5zLXNlcmlmJnF1b3Q7O2NvbG9yOiMxRjQ5N0QiPkJ1dCBpcyBpdCB0b28gYmlnIGEg c3RyZXRjaCB0byBtYWtlIHRoYXQgbm9ybWF0aXZlIGZvciB0aGlzIHdvcms/PC9zcGFuPjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OywmcXVv dDtzYW5zLXNlcmlmJnF1b3Q7O2NvbG9yOiMxRjQ5N0QiPkp1c3QgYSB0aG91Z2h0Li4gYW5kIG1v cmUgdGhhbiBoYXBweSB0byBiZSBwcm92ZW4gd3JvbmcuLjxzcGFuIGNsYXNzPSJhcHBsZS1jb252 ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6V2luZ2RpbmdzO2NvbG9yOiMxRjQ5N0QiPko8L3NwYW4+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90Oywm cXVvdDtzYW5zLXNlcmlmJnF1b3Q7O2NvbG9yOiMxRjQ5N0QiPi48L3NwYW4+PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssJnF1b3Q7c2Fucy1zZXJpZiZx dW90Oztjb2xvcjojMUY0OTdEIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OywmcXVvdDtzYW5zLXNlcmlmJnF1b3Q7O2NvbG9yOiMx RjQ5N0QiPkNoZWVyczwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90Oztjb2xvcjojMUY0OTdE Ij5Db2xpbjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJy aSZxdW90OywmcXVvdDtzYW5zLXNlcmlmJnF1b3Q7O2NvbG9yOiMxRjQ5N0QiPiZuYnNwOzwvc3Bh bj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssJnF1b3Q7c2Fucy1z ZXJpZiZxdW90Oztjb2xvcjojMUY0OTdEIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8 ZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjQjVDNERGIDEu MHB0O3BhZGRpbmc6My4wcHQgMGNtIDBjbSAwY20iPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxiPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZh bWlseTomcXVvdDtUYWhvbWEmcXVvdDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90OyI+RnJvbTo8L3Nw YW4+PC9iPjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPjxzcGFuIGxhbmc9IkVO LVVTIiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtUYWhvbWEmcXVv dDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90OyI+Jm5ic3A7PC9zcGFuPjwvc3Bhbj48c3BhbiBsYW5n PSJFTi1VUyIgc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VGFob21h JnF1b3Q7LCZxdW90O3NhbnMtc2VyaWYmcXVvdDsiPnZvdA0KIFs8YSBocmVmPSJtYWlsdG86dm90 LWJvdW5jZXNAaWV0Zi5vcmciPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPm1haWx0bzp2b3Qt Ym91bmNlc0BpZXRmLm9yZzwvc3Bhbj48L2E+XTxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQt c3BhY2UiPiZuYnNwOzwvc3Bhbj48Yj5PbiBCZWhhbGYgT2Y8c3BhbiBjbGFzcz0iYXBwbGUtY29u dmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PC9iPkp1c3RpbiBSaWNoZXI8YnI+DQo8Yj5TZW50 OjwvYj48c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+U2F0 dXJkYXksIDI3IEp1bmUgMjAxNSAzOjE1IHAubS48YnI+DQo8Yj5Ubzo8L2I+PHNwYW4gY2xhc3M9 ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjxhIGhyZWY9Im1haWx0bzp2b3RA aWV0Zi5vcmciPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPnZvdEBpZXRmLm9yZzwvc3Bhbj48 L2E+PGJyPg0KPGI+U3ViamVjdDo8L2I+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFj ZSI+Jm5ic3A7PC9zcGFuPltWb1RdIFZlY3RvcnMgb2YgVHJ1c3QgSS1EPC9zcGFuPjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+SGkgRXZlcnlvbmUsPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2 Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JIGhhdmUgdGFrZW4gdGhlIGlu aXRpYWwgc3RyYXdtYW4gcHJvcG9zYWwgYWxvbmcgd2l0aCBhIHN1YnN0YW50aWFsIG51bWJlciBv ZiBlZGl0cyBhbmQgaW5wdXRzIGZyb20gc2V2ZXJhbCBmb2xrcyBhbmQgaGF2ZSBjcmVhdGVkIGFu IGluaXRpYWwgSS1EIG9mIHRoZSBkb2N1bWVudDo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9k aXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PGEgaHJlZj0iaHR0cHM6Ly90b29scy5pZXRmLm9yZy9pZC9kcmFmdC1yaWNoZXItdmVjdG9ycy1v Zi10cnVzdC0wMCI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+aHR0cHM6Ly90b29scy5pZXRm Lm9yZy9pZC9kcmFmdC1yaWNoZXItdmVjdG9ycy1vZi10cnVzdC0wMDwvc3Bhbj48L2E+PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPkl04oCZcyBzdGlsbCBhIHZlcnkgZHJhZnR5IGRyYWZ0LCBi dXQgaG9wZWZ1bGx5IGl04oCZcyBzdGFydGluZyB0byBtYWtlIHRoaXMgYSBjb25jcmV0ZSB0aGlu Zy4gUGxlYXNlIHJlYWQgaXQgb3ZlciBhbmQgZGlzY3VzcyBpdCBoZXJlIG9uIHRoZSBsaXN0Ljxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JIHdvdWxkIGxpa2UgdG8gcHJvcG9zZSBhIGJhci1C b0YgaW4gUHJhZ3VlIGZvciBWb1QgZm9yIGFueW9uZSB3aG8gd291bGQgbGlrZSB0byBkaXNjdXNz IHRoaXMuIElmIHlvdeKAmXJlIGludGVyZXN0ZWQgKGFuZCB3aWxsIGJlIHRoZXJlIGluIHBlcnNv biksIGxldCBtZSBrbm93ITxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDvigJQgSnVz dGluPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxv Y2txdW90ZT4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssJnF1b3Q7c2Fucy1z ZXJpZiZxdW90OyI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4N CjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4w cHQ7bWFyZ2luLWJvdHRvbTo1LjBwdDtvcnBoYW5zOiBhdXRvO3RleHQtYWxpZ246c3RhcnQ7d2lk b3dzOiBhdXRvOy13ZWJraXQtdGV4dC1zdHJva2Utd2lkdGg6IDBweDt3b3JkLXNwYWNpbmc6MHB4 Ij4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjku MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OywmcXVvdDtzYW5zLXNlcmlmJnF1 b3Q7Ij5fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXzxicj4N CnZvdCBtYWlsaW5nIGxpc3Q8YnI+DQo8YSBocmVmPSJtYWlsdG86dm90QGlldGYub3JnIj48c3Bh biBzdHlsZT0iY29sb3I6cHVycGxlIj52b3RAaWV0Zi5vcmc8L3NwYW4+PC9hPjxicj4NCjxhIGhy ZWY9Imh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vdm90Ij48c3BhbiBzdHls ZT0iY29sb3I6cHVycGxlIj5odHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3Zv dDwvc3Bhbj48L2E+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OywmcXVvdDtzYW5zLXNlcmlmJnF1b3Q7Ij5fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXzxicj4NCnZvdCBtYWls aW5nIGxpc3Q8YnI+DQo8L3NwYW4+PGEgaHJlZj0ibWFpbHRvOnZvdEBpZXRmLm9yZyI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDss JnF1b3Q7c2Fucy1zZXJpZiZxdW90Oztjb2xvcjpwdXJwbGUiPnZvdEBpZXRmLm9yZzwvc3Bhbj48 L2E+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRp Y2EmcXVvdDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90OyI+PGJyPg0KPC9zcGFuPjxhIGhyZWY9Imh0 dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vdm90Ij48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OywmcXVvdDtzYW5z LXNlcmlmJnF1b3Q7O2NvbG9yOnB1cnBsZSI+aHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9s aXN0aW5mby92b3Q8L3NwYW4+PC9hPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Jsb2NrcXVv dGU+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0K PC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8YmxvY2txdW90 ZSB0eXBlPSJjaXRlIj4NCjxkaXY+PHNwYW4+X19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX188L3NwYW4+PGJyPg0KPHNwYW4+dm90IG1haWxpbmcgbGlzdDwvc3Bh bj48YnI+DQo8c3Bhbj48YSBocmVmPSJtYWlsdG86dm90QGlldGYub3JnIj52b3RAaWV0Zi5vcmc8 L2E+PC9zcGFuPjxicj4NCjxzcGFuPjxhIGhyZWY9Imh0dHBzOi8vd3d3LmlldGYub3JnL21haWxt YW4vbGlzdGluZm8vdm90Ij5odHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3Zv dDwvYT48L3NwYW4+PGJyPg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8L2JvZHk+DQo8L2h0bWw+ DQo= --_000_A549FC9D1DEA4500849B0235BBA00CEAhhsgov_--